@growth-labs/auth 0.1.3

package/README.md

@@ -0,0 +1,103 @@
+# @growth-labs/auth
+
+OpenAuth **client** package for Astro + Cloudflare. Verifies JWTs, manages session cookies, gates protected paths, and injects login/logout/callback routes.
+
+**This is a client only.** It does NOT run an OpenAuth issuer. The issuer is a separate Worker — see `apps/auth-server/`.
+
+**Identity, not authorization.** Answers "who is this user?" — not "what can they access?" Roles, entitlements, and premium checks are consumer concerns (e.g. `@fulcrum/auth`).
+
+## Config
+
+```typescript
+import auth from '@growth-labs/auth'
+
+auth({
+  issuer: 'https://auth.fedweek.com',           // OpenAuth issuer URL (separate Worker)
+  cookiePrefix: 'fedweek',                       // → fedweek_at, fedweek_rt cookies
+  sessionCookieDomain: '.fedweek.com',           // Cross-subdomain sharing (optional)
+  gatedPaths: ['/premium/*', '/account/*'],      // Glob patterns for protected routes
+  loginPath: '/login',                           // Redirect target for unauthenticated users
+  logoutRedirect: '/',
+  callbackPath: '/api/auth/callback',
+  providers: ['google', 'password', 'email-code'],
+  loginPage: {
+    title: 'Sign in',
+    brandName: 'FEDweek',
+    logoUrl: 'https://media.fedweek.com/logos/header.png',
+  },
+  accessTokenMaxAge: 900,                        // 15 min (seconds)
+  refreshTokenMaxAge: 2592000,                   // 30 days
+})
+```
+
+## What It Injects
+
+**Middleware** (runs on every request):
+1. Reads `{cookiePrefix}_at` and `{cookiePrefix}_rt` cookies
+2. Verifies access token JWT against issuer's JWKS (`{issuer}/.well-known/jwks.json`, cached in Worker memory)
+3. If expired but refresh token valid → silent refresh, set new cookies
+4. Populates `context.locals.user` as `AuthenticatedUser | UnauthenticatedUser`
+5. If path matches `gatedPaths` and user unauthenticated → redirect to `loginPath`
+
+**Routes:**
+- `GET /login` — default login page with provider buttons; `email-code` redirects into the issuer-hosted code flow (overridable by consumer)
+- `GET /logout` — clears cookies, revokes refresh token at issuer, redirects
+- `GET /api/auth/callback` — OAuth callback handler (PKCE code exchange, cookie setting)
+
+## Using `context.locals.user`
+
+```typescript
+// Gated page — user guaranteed authenticated
+const { user } = Astro.locals
+// user.id, user.email, user.name, user.image, user.authenticated (true)
+
+// Non-gated page — check first
+if (user.authenticated) {
+  // show personalized content
+}
+```
+
+## TypeScript
+
+```typescript
+interface AuthenticatedUser {
+  id: string; email: string; name?: string; image?: string; authenticated: true
+}
+interface UnauthenticatedUser { authenticated: false }
+type User = AuthenticatedUser | UnauthenticatedUser
+// Available on context.locals.user (Astro.locals.user in .astro files)
+```
+
+## Wrangler Bindings
+
+None required by this package. The issuer needs KV + D1 — see `apps/auth-server/README.md`.
+
+## Integration Order
+
+Auth middleware MUST run before consent and analytics middleware. List `auth()` first in `astro.config.mjs` integrations array.
+
+## Issuer Unreachable (Cold Start)
+
+JWKS cached in Worker memory. If issuer unreachable on cold start:
+- **Non-gated paths:** fail open — `user = { authenticated: false }`, page serves normally
+- **Gated paths:** fail closed — redirect to loginPath
+
+## OAuth Flow Summary
+
+1. User clicks provider on login page → redirect to `{issuer}/authorize?response_type=code&...` with PKCE challenge
+2. Issuer authenticates → redirects to `/api/auth/callback?code=...&state=...`
+3. Callback exchanges code for tokens via PKCE, sets session cookies, redirects to original page
+
+## Analytics Integration
+
+Optional peer dependency on `@growth-labs/analytics`. If installed, emits `login_completed` / `signup_completed` events automatically. If not installed, silently skipped.
+
+## Key Patterns
+
+- Virtual module: `virtual:growth-labs/auth/config` (slash, not hyphen)
+- Cookie names: `{cookiePrefix}_at`, `{cookiePrefix}_rt`, `{cookiePrefix}_pkce`, `{cookiePrefix}_state`, `{cookiePrefix}_redirect`
+- PKCE flow with `code_verifier` / `code_challenge` (S256)
+- `email-code` is a client-side alias for the issuer's OpenAuth `code` provider
+- CSRF state parameter verified on callback
+- No `aud` claim validation in this package — single client per issuer assumed
+- `.astro` component files ship as source, not compiled

package/dist/client/login-page.d.ts

@@ -0,0 +1,2 @@
+export declare function loginPageScript(): string;
+//# sourceMappingURL=login-page.d.ts.map

package/dist/client/login-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-page.d.ts","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA,wBAAgB,eAAe,IAAI,MAAM,CAWxC"}

package/dist/client/login-page.js

@@ -0,0 +1,13 @@
+export function loginPageScript() {
+    return `
+    document.querySelectorAll('[data-provider]').forEach(function(el) {
+      el.addEventListener('click', function() {
+        var provider = el.getAttribute('data-provider');
+        if (window.glAnalytics) {
+          window.glAnalytics.track('login_clicked', { provider: provider });
+        }
+      });
+    });
+  `;
+}
+//# sourceMappingURL=login-page.js.map

package/dist/client/login-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-page.js","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,eAAe;IAC9B,OAAO;;;;;;;;;GASL,CAAA;AACH,CAAC"}

package/dist/config-store.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedAuthOptions } from './options.js';
+export declare function _setConfig(config: ResolvedAuthOptions): void;
+export declare function getConfig(): ResolvedAuthOptions;
+//# sourceMappingURL=config-store.d.ts.map

package/dist/config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAIvD,wBAAgB,UAAU,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAE5D;AAED,wBAAgB,SAAS,IAAI,mBAAmB,CAe/C"}

package/dist/config-store.js

@@ -0,0 +1,15 @@
+let _config = null;
+export function _setConfig(config) {
+    _config = config;
+}
+export function getConfig() {
+    const runtimeConfig = globalThis.__GL_AUTH_CONFIG__;
+    if (runtimeConfig) {
+        return runtimeConfig;
+    }
+    if (!_config) {
+        throw new Error('@growth-labs/auth: integration not configured. Add auth() to your astro.config.mjs integrations array.');
+    }
+    return _config;
+}
+//# sourceMappingURL=config-store.js.map

package/dist/config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAEA,IAAI,OAAO,GAA+B,IAAI,CAAA;AAE9C,MAAM,UAAU,UAAU,CAAC,MAA2B;IACrD,OAAO,GAAG,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,SAAS;IACxB,MAAM,aAAa,GAClB,UAGA,CAAC,kBAAkB,CAAA;IACpB,IAAI,aAAa,EAAE,CAAC;QACnB,OAAO,aAAa,CAAA;IACrB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACd,wGAAwG,CACxG,CAAA;IACF,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+import type { AuthOptions } from './options.js';
+interface AstroIntegration {
+    name: string;
+    hooks: {
+        'astro:config:setup': (params: {
+            addMiddleware: (opts: {
+                entrypoint: string;
+                order: 'pre' | 'post';
+            }) => void;
+            injectRoute: (opts: {
+                pattern: string;
+                entrypoint: string;
+                prerender?: boolean;
+            }) => void;
+            updateConfig: (config: {
+                vite?: {
+                    define?: Record<string, string>;
+                };
+            }) => void;
+        }) => void;
+    };
+}
+export default function auth(userOptions: AuthOptions): AstroIntegration;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG/C,UAAU,gBAAgB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACN,oBAAoB,EAAE,CAAC,MAAM,EAAE;YAC9B,aAAa,EAAE,CAAC,IAAI,EAAE;gBAAE,UAAU,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;aAAE,KAAK,IAAI,CAAA;YAC5E,WAAW,EAAE,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,UAAU,EAAE,MAAM,CAAC;gBAAC,SAAS,CAAC,EAAE,OAAO,CAAA;aAAE,KAAK,IAAI,CAAA;YACzF,YAAY,EAAE,CAAC,MAAM,EAAE;gBAAE,IAAI,CAAC,EAAE;oBAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;iBAAE,CAAA;aAAE,KAAK,IAAI,CAAA;SAC9E,KAAK,IAAI,CAAA;KACV,CAAA;CACD;AAQD,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,gBAAgB,CAuDvE"}

package/dist/index.js

@@ -0,0 +1,56 @@
+import { _setConfig } from './config-store.js';
+import { authOptionsSchema } from './options.js';
+const ENTRYPOINT_EXTENSION = import.meta.url.endsWith('.ts') ? '.ts' : '.js';
+function resolveEntrypoint(path) {
+    return decodeURIComponent(new URL(`${path}${ENTRYPOINT_EXTENSION}`, import.meta.url).pathname);
+}
+export default function auth(userOptions) {
+    const options = authOptionsSchema.parse(userOptions);
+    _setConfig(options);
+    return {
+        name: '@growth-labs/auth',
+        hooks: {
+            'astro:config:setup': ({ addMiddleware, injectRoute, updateConfig }) => {
+                updateConfig({
+                    vite: {
+                        define: {
+                            'globalThis.__GL_AUTH_CONFIG__': JSON.stringify(options),
+                        },
+                    },
+                });
+                addMiddleware({
+                    entrypoint: resolveEntrypoint('./middleware/auth'),
+                    order: 'pre',
+                });
+                injectRoute({
+                    pattern: options.loginPath,
+                    entrypoint: resolveEntrypoint('./routes/login'),
+                    prerender: false,
+                });
+                injectRoute({
+                    pattern: '/logout',
+                    entrypoint: resolveEntrypoint('./routes/logout'),
+                    prerender: false,
+                });
+                injectRoute({
+                    pattern: options.callbackPath,
+                    entrypoint: resolveEntrypoint('./routes/callback'),
+                    prerender: false,
+                });
+                if (options.providers.includes('password')) {
+                    injectRoute({
+                        pattern: options.forgotPasswordPath,
+                        entrypoint: resolveEntrypoint('./routes/forgot-password'),
+                        prerender: false,
+                    });
+                    injectRoute({
+                        pattern: options.resetPasswordPath,
+                        entrypoint: resolveEntrypoint('./routes/reset-password'),
+                        prerender: false,
+                    });
+                }
+            },
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAahD,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;AAE5E,SAAS,iBAAiB,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,oBAAoB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;AAC/F,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,WAAwB;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACpD,UAAU,CAAC,OAAO,CAAC,CAAA;IAEnB,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE;YACN,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE;gBACtE,YAAY,CAAC;oBACZ,IAAI,EAAE;wBACL,MAAM,EAAE;4BACP,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;yBACxD;qBACD;iBACD,CAAC,CAAA;gBAEF,aAAa,CAAC;oBACb,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,KAAK,EAAE,KAAK;iBACZ,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,SAAS;oBAC1B,UAAU,EAAE,iBAAiB,CAAC,gBAAgB,CAAC;oBAC/C,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC;oBAChD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,YAAY;oBAC7B,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5C,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,kBAAkB;wBACnC,UAAU,EAAE,iBAAiB,CAAC,0BAA0B,CAAC;wBACzD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;oBAEF,WAAW,CAAC;wBACX,OAAO,EAAE,OAAO,CAAC,iBAAiB;wBAClC,UAAU,EAAE,iBAAiB,CAAC,yBAAyB,CAAC;wBACxD,SAAS,EAAE,KAAK;qBAChB,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;SACD;KACD,CAAA;AACF,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,6 @@
+export declare function onRequest(context: {
+    request: Request;
+    url: URL;
+    locals: Record<string, unknown>;
+}, next: () => Promise<Response>): Promise<Response>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAKA,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAkEnB"}

package/dist/middleware/auth.js

@@ -0,0 +1,68 @@
+import { getConfig } from '../config-store.js';
+import { getCookie, setTokenCookies } from '../utils/cookies.js';
+import { refreshTokens, verifyAccessToken } from '../utils/tokens.js';
+export async function onRequest(context, next) {
+    const options = getConfig();
+    const { request } = context;
+    // 1. Read tokens from cookies
+    const accessToken = getCookie(request, `${options.cookiePrefix}_at`);
+    const refreshToken = getCookie(request, `${options.cookiePrefix}_rt`);
+    // 2. Attempt to authenticate
+    let user = { authenticated: false };
+    let refreshed = null;
+    if (accessToken) {
+        const verified = await verifyAccessToken(options.issuer, accessToken);
+        if (verified) {
+            user = {
+                id: verified.sub,
+                email: verified.email,
+                name: verified.name,
+                image: verified.image,
+                authenticated: true,
+            };
+        }
+    }
+    if (!user.authenticated && refreshToken) {
+        const clientId = options.clientId || context.url.hostname;
+        refreshed = await refreshTokens(options.issuer, refreshToken, clientId);
+        if (refreshed) {
+            user = {
+                id: refreshed.claims.sub,
+                email: refreshed.claims.email,
+                name: refreshed.claims.name,
+                image: refreshed.claims.image,
+                authenticated: true,
+            };
+        }
+    }
+    // 3. Populate context.locals.user
+    context.locals.user = user;
+    // 4. Gate protected paths
+    if (!user.authenticated && isGatedPath(context.url.pathname, options.gatedPaths)) {
+        const loginUrl = new URL(`${options.loginPath}?redirect=${encodeURIComponent(context.url.pathname)}`, context.url.origin);
+        return Response.redirect(loginUrl.toString(), 302);
+    }
+    // 5. Continue to the page
+    const response = await next();
+    // 6. If tokens were refreshed, set new cookies on the response
+    if (refreshed) {
+        const modifiedResponse = new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: new Headers(response.headers),
+        });
+        setTokenCookies(modifiedResponse, options, refreshed.accessToken, refreshed.refreshToken);
+        return modifiedResponse;
+    }
+    return response;
+}
+function isGatedPath(pathname, gatedPaths) {
+    return gatedPaths.some((pattern) => {
+        if (pattern.endsWith('/*')) {
+            const prefix = pattern.slice(0, -1); // '/premium/*' → '/premium/'
+            return pathname.startsWith(prefix);
+        }
+        return pathname === pattern;
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAS,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;IACzC,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACvE,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;gBAC3B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/options.d.ts

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+export declare const authOptionsSchema: z.ZodObject<{
+    issuer: z.ZodString;
+    clientId: z.ZodOptional<z.ZodString>;
+    cookiePrefix: z.ZodString;
+    sessionCookieDomain: z.ZodOptional<z.ZodString>;
+    accessTokenMaxAge: z.ZodDefault<z.ZodNumber>;
+    refreshTokenMaxAge: z.ZodDefault<z.ZodNumber>;
+    gatedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    loginPath: z.ZodDefault<z.ZodString>;
+    logoutRedirect: z.ZodDefault<z.ZodString>;
+    callbackPath: z.ZodDefault<z.ZodString>;
+    forgotPasswordPath: z.ZodDefault<z.ZodString>;
+    resetPasswordPath: z.ZodDefault<z.ZodString>;
+    providers: z.ZodDefault<z.ZodArray<z.ZodEnum<["google", "password", "email-code"]>, "many">>;
+    loginPage: z.ZodDefault<z.ZodObject<{
+        title: z.ZodDefault<z.ZodString>;
+        brandName: z.ZodOptional<z.ZodString>;
+        logoUrl: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        title: string;
+        brandName?: string | undefined;
+        logoUrl?: string | undefined;
+    }, {
+        title?: string | undefined;
+        brandName?: string | undefined;
+        logoUrl?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    issuer: string;
+    cookiePrefix: string;
+    accessTokenMaxAge: number;
+    refreshTokenMaxAge: number;
+    gatedPaths: string[];
+    loginPath: string;
+    logoutRedirect: string;
+    callbackPath: string;
+    forgotPasswordPath: string;
+    resetPasswordPath: string;
+    providers: ("google" | "password" | "email-code")[];
+    loginPage: {
+        title: string;
+        brandName?: string | undefined;
+        logoUrl?: string | undefined;
+    };
+    clientId?: string | undefined;
+    sessionCookieDomain?: string | undefined;
+}, {
+    issuer: string;
+    cookiePrefix: string;
+    clientId?: string | undefined;
+    sessionCookieDomain?: string | undefined;
+    accessTokenMaxAge?: number | undefined;
+    refreshTokenMaxAge?: number | undefined;
+    gatedPaths?: string[] | undefined;
+    loginPath?: string | undefined;
+    logoutRedirect?: string | undefined;
+    callbackPath?: string | undefined;
+    forgotPasswordPath?: string | undefined;
+    resetPasswordPath?: string | undefined;
+    providers?: ("google" | "password" | "email-code")[] | undefined;
+    loginPage?: {
+        title?: string | undefined;
+        brandName?: string | undefined;
+        logoUrl?: string | undefined;
+    } | undefined;
+}>;
+export type AuthOptions = z.input<typeof authOptionsSchema>;
+export type ResolvedAuthOptions = z.output<typeof authOptionsSchema>;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoC5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA"}

package/dist/options.js

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+export const authOptionsSchema = z.object({
+    // ─── Required ───
+    issuer: z.string().url(),
+    // ─── Client identity ───
+    clientId: z.string().optional(),
+    // ─── Cookie configuration ───
+    cookiePrefix: z.string(),
+    sessionCookieDomain: z.string().optional(),
+    // ─── Token lifetimes ───
+    accessTokenMaxAge: z.number().default(900),
+    refreshTokenMaxAge: z.number().default(2592000),
+    // ─── Path configuration ───
+    gatedPaths: z.array(z.string()).default([]),
+    loginPath: z.string().default('/login'),
+    logoutRedirect: z.string().default('/'),
+    callbackPath: z.string().default('/api/auth/callback'),
+    forgotPasswordPath: z.string().default('/forgot-password'),
+    resetPasswordPath: z.string().default('/reset-password'),
+    // ─── Providers ───
+    providers: z
+        .array(z.enum(['google', 'password', 'email-code']))
+        .default(['google', 'password', 'email-code']),
+    // ─── Login page customization ───
+    loginPage: z
+        .object({
+        title: z.string().default('Sign in'),
+        brandName: z.string().optional(),
+        logoUrl: z.string().optional(),
+    })
+        .default({}),
+});
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,mBAAmB;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAExB,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,+BAA+B;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,6BAA6B;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAExD,oBAAoB;IACpB,SAAS,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;SACnD,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAE/C,mCAAmC;IACnC,SAAS,EAAE,CAAC;SACV,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;CACb,CAAC,CAAA"}

package/dist/routes/callback.d.ts

@@ -0,0 +1,9 @@
+interface CallbackContext {
+    request: Request;
+    url: URL;
+    locals: Record<string, unknown>;
+    waitUntil?: (promise: Promise<unknown>) => void;
+}
+export declare function GET(context: CallbackContext): Promise<Response>;
+export {};
+//# sourceMappingURL=callback.d.ts.map

package/dist/routes/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAMA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqDrE"}

package/dist/routes/callback.js

@@ -0,0 +1,48 @@
+import { getConfig } from '../config-store.js';
+import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js';
+import { clearAuthFlowCookies, getCookie, setTokenCookies } from '../utils/cookies.js';
+import { exchangeCode } from '../utils/openauth.js';
+import { verifyState } from '../utils/state.js';
+export async function GET(context) {
+    const options = getConfig();
+    const { url, request } = context;
+    const code = url.searchParams.get('code');
+    const state = url.searchParams.get('state');
+    // Verify CSRF state
+    const storedState = getCookie(request, `${options.cookiePrefix}_state`);
+    if (!state || !storedState || !verifyState(state, storedState)) {
+        return new Response('Invalid state parameter', { status: 403 });
+    }
+    // Read PKCE verifier
+    const codeVerifier = getCookie(request, `${options.cookiePrefix}_pkce`);
+    if (!codeVerifier) {
+        return new Response('Missing PKCE verifier', { status: 400 });
+    }
+    // Exchange code for tokens
+    const tokenResponse = await exchangeCode(url, code, codeVerifier);
+    if (!tokenResponse) {
+        return Response.redirect(new URL(`${options.loginPath}?error=auth_failed`, url.origin).toString(), 302);
+    }
+    // Build redirect response
+    const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/';
+    const response = Response.redirect(new URL(redirectPath, url.origin).toString(), 302);
+    // Mutable copy for setting cookies
+    const mutableResponse = new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: new Headers(response.headers),
+    });
+    setTokenCookies(mutableResponse, options, tokenResponse.accessToken, tokenResponse.refreshToken);
+    clearAuthFlowCookies(mutableResponse, options);
+    // Emit analytics event (non-blocking)
+    if (analyticsAvailable(context)) {
+        const eventName = tokenResponse.isNewUser ? 'signup_completed' : 'login_completed';
+        const promise = emitAuthEvent(context, eventName, {
+            provider: tokenResponse.provider,
+            userId: tokenResponse.claims.sub,
+        });
+        context.waitUntil?.(promise);
+    }
+    return mutableResponse;
+}
+//# sourceMappingURL=callback.js.map

package/dist/routes/callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAS/C,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAK,EAAE,YAAY,CAAC,CAAA;IAClE,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,QAAQ,CACvB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EACxE,GAAG,CACH,CAAA;IACF,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IAErF,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,sCAAsC;IACtC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QAClF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;YACjD,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;SAChC,CAAC,CAAA;QACF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/routes/forgot-password.d.ts

@@ -0,0 +1,7 @@
+interface ForgotPasswordContext {
+    request: Request;
+    url: URL;
+}
+export declare function GET(context: ForgotPasswordContext): Promise<Response>;
+export {};
+//# sourceMappingURL=forgot-password.d.ts.map

package/dist/routes/forgot-password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgot-password.d.ts","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAGA,UAAU,qBAAqB;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E"}

package/dist/routes/forgot-password.js

@@ -0,0 +1,62 @@
+import { getConfig } from '../config-store.js';
+import { getForgotPasswordUrl } from '../utils/openauth.js';
+export async function GET(context) {
+    const options = getConfig();
+    if (!options.providers.includes('password')) {
+        return new Response('Not found', { status: 404 });
+    }
+    const sent = context.url.searchParams.get('sent') !== null;
+    const error = context.url.searchParams.get('error');
+    const html = renderForgotPasswordPage(options, context.url, { sent, error });
+    return new Response(html, {
+        headers: { 'Content-Type': 'text/html; charset=utf-8' },
+    });
+}
+function renderForgotPasswordPage(options, url, data) {
+    const { loginPage } = options;
+    const actionUrl = getForgotPasswordUrl();
+    const redirectUri = new URL(options.forgotPasswordPath, url.origin).toString();
+    const resetUri = new URL(options.resetPasswordPath, url.origin).toString();
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Forgot password</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
+    h1 { text-align: center; }
+    .logo { display: block; margin: 0 auto 16px; max-height: 48px; }
+    .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
+    input[type="email"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
+    .error { color: #c00; text-align: center; margin: 12px 0; }
+    .success { color: #080; text-align: center; margin: 12px 0; }
+    .brand { text-align: center; color: #666; margin-bottom: 4px; }
+    .back-link { display: block; text-align: center; margin-top: 16px; font-size: 14px; color: #555; }
+    p.hint { text-align: center; color: #666; font-size: 14px; }
+  </style>
+</head>
+<body>
+  ${loginPage.logoUrl ? `<img src="${loginPage.logoUrl}" alt="${loginPage.brandName || ''}" class="logo">` : ''}
+  ${loginPage.brandName ? `<p class="brand">${loginPage.brandName}</p>` : ''}
+  <h1>Forgot password</h1>
+  ${data.error ? '<p class="error">Something went wrong. Please try again.</p>' : ''}
+  ${data.sent
+        ? `
+    <p class="success">Check your email for a reset link.</p>
+    <p class="hint">If you don't see it, check your spam folder.</p>
+  `
+        : `
+    <p class="hint">Enter your email and we'll send you a link to reset your password.</p>
+    <form method="POST" action="${actionUrl}">
+      <input type="email" name="email" placeholder="Email address" required>
+      <input type="hidden" name="redirect_uri" value="${redirectUri}">
+      <input type="hidden" name="reset_uri" value="${resetUri}">
+      <button type="submit" class="btn">Send reset link</button>
+    </form>
+  `}
+  <a href="${options.loginPath}" class="back-link">Back to sign in</a>
+</body>
+</html>`;
+}
+//# sourceMappingURL=forgot-password.js.map

package/dist/routes/forgot-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgot-password.js","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAO3D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA8B;IACvD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAA;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5E,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;AACH,CAAC;AAOD,SAAS,wBAAwB,CAChC,OAAqC,EACrC,GAAQ,EACR,IAA4B;IAE5B,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAA;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAE1E,OAAO;;;;;;;;;;;;;;;;;;;;IAoBJ,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;;IAExE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC,EAAE;IAElF,IAAI,CAAC,IAAI;QACR,CAAC,CAAC;;;GAGF;QACA,CAAC,CAAC;;kCAE6B,SAAS;;wDAEa,WAAW;qDACd,QAAQ;;;GAI5D;aACY,OAAO,CAAC,SAAS;;QAEtB,CAAA;AACR,CAAC"}

package/dist/routes/login.d.ts

@@ -0,0 +1,7 @@
+interface LoginContext {
+    request: Request;
+    url: URL;
+}
+export declare function GET(context: LoginContext): Promise<Response>;
+export {};
+//# sourceMappingURL=login.d.ts.map

package/dist/routes/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAUA,UAAU,YAAY;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAMD,wBAAsB,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBlE"}