@growth-labs/auth 0.1.3 → 0.2.1

package/README.md

@@ -2,47 +2,94 @@
 
 OpenAuth **client** package for Astro + Cloudflare. Verifies JWTs, manages session cookies, gates protected paths, and injects login/logout/callback routes.
 
-**This is a client only.** It does NOT run an OpenAuth issuer. The issuer is a separate Worker — see `apps/auth-server/`.
+**This is a client only.** The OpenAuth issuer is a separate Worker — point this package at any standards-compliant OpenAuth issuer.
 
 **Identity, not authorization.** Answers "who is this user?" — not "what can they access?" Roles, entitlements, and premium checks are consumer concerns (e.g. `@fulcrum/auth`).
 
+## Live issuer
+
+The canonical issuer for Fulcrum and Growth Labs sites is the standalone identity-platform at `https://auth.fulcrum-labs.com`. Discovery is at `/.well-known/oauth-authorization-server`:
+
+```
+issuer:                    https://auth.fulcrum-labs.com
+authorization_endpoint:    https://auth.fulcrum-labs.com/authorize
+token_endpoint:            https://auth.fulcrum-labs.com/token
+revocation_endpoint:       https://auth.fulcrum-labs.com/revoke
+jwks_uri:                  https://auth.fulcrum-labs.com/.well-known/jwks.json
+```
+
+The repo's `apps/auth-server/` is a **reference sample** for bootstrapping new issuer Workers — it is not the canonical issuer.
+
 ## Config
 
 ```typescript
 import auth from '@growth-labs/auth'
 
 auth({
-  issuer: 'https://auth.fedweek.com',           // OpenAuth issuer URL (separate Worker)
-  cookiePrefix: 'fedweek',                       // → fedweek_at, fedweek_rt cookies
-  sessionCookieDomain: '.fedweek.com',           // Cross-subdomain sharing (optional)
-  gatedPaths: ['/premium/*', '/account/*'],      // Glob patterns for protected routes
-  loginPath: '/login',                           // Redirect target for unauthenticated users
+  issuer: 'https://auth.fulcrum-labs.com',     // OpenAuth issuer URL (separate Worker)
+  cookiePrefix: 'fronts',                       // → fronts_at, fronts_rt cookies
+  sessionCookieDomain: '.fronts.co',            // Cross-subdomain sharing (optional)
+  gatedPaths: ['/premium/*', '/account/*'],     // Glob patterns for protected routes
+  loginPath: '/login',                          // Redirect target for unauthenticated users
   logoutRedirect: '/',
   callbackPath: '/api/auth/callback',
+  forgotPasswordPath: '/forgot-password',       // Auto-injected when password provider is enabled
+  resetPasswordPath: '/reset-password',
   providers: ['google', 'password', 'email-code'],
   loginPage: {
     title: 'Sign in',
-    brandName: 'FEDweek',
-    logoUrl: 'https://media.fedweek.com/logos/header.png',
+    brandName: 'fronts.co',
+    logoUrl: 'https://media.fronts.co/logo.png',
   },
-  accessTokenMaxAge: 900,                        // 15 min (seconds)
-  refreshTokenMaxAge: 2592000,                   // 30 days
+  accessTokenMaxAge: 900,                       // 15 min (seconds)
+  refreshTokenMaxAge: 2592000,                  // 30 days
 })
 ```
 
 ## What It Injects
 
 **Middleware** (runs on every request):
+
 1. Reads `{cookiePrefix}_at` and `{cookiePrefix}_rt` cookies
-2. Verifies access token JWT against issuer's JWKS (`{issuer}/.well-known/jwks.json`, cached in Worker memory)
+2. Verifies access token JWT against issuer's JWKS (`{issuer}/.well-known/jwks.json`, cached/refreshed by `jose.createRemoteJWKSet`)
 3. If expired but refresh token valid → silent refresh, set new cookies
 4. Populates `context.locals.user` as `AuthenticatedUser | UnauthenticatedUser`
 5. If path matches `gatedPaths` and user unauthenticated → redirect to `loginPath`
 
 **Routes:**
-- `GET /login` — default login page with provider buttons; `email-code` redirects into the issuer-hosted code flow (overridable by consumer)
-- `GET /logout` — clears cookies, revokes refresh token at issuer, redirects
-- `GET /api/auth/callback` — OAuth callback handler (PKCE code exchange, cookie setting)
+
+- `GET /login` — default login page with provider buttons. Each button is a link to `{issuer}/authorize?provider=...` (Google, password, and email-code via OpenAuth's `code` provider). Override by creating `src/pages/login.astro`.
+- `GET /logout` — clears cookies, revokes refresh token at `{issuer}/revoke`, redirects.
+- `GET /api/auth/callback` — OAuth callback handler (PKCE code exchange, cookie setting, analytics emission).
+- `GET /forgot-password` — thin 302 to `{issuer}/forgot-password` (issuer owns the UI). Only injected when the `password` provider is enabled.
+- `GET /reset-password?token=...` — thin 302 to `{issuer}/reset-password?token=...`. Only injected when the `password` provider is enabled.
+
+## Subject claims contract
+
+The package expects an OpenAuth-shaped access token. The subject payload lives under `properties` in the JWT and contains:
+
+| Claim       | Type    | Notes                                       |
+|-------------|---------|---------------------------------------------|
+| `userId`    | string  | Stable user identifier                      |
+| `email`     | string  |                                             |
+| `name`      | string  | Optional                                    |
+| `image`     | string  | Optional                                    |
+| `isNewUser` | boolean | Whether this user was just created          |
+
+The JWT's top-level `sub` is an OpenAuth-internal subject hash (`{type}:{sha1}`) and is **never** the user id.
+
+## /token response contract
+
+```jsonc
+// POST {issuer}/token
+{
+  "access_token": "<jwt>",
+  "refresh_token": "<opaque>",
+  "expires_in": 900
+}
+```
+
+The package does **not** read `is_new_user` or `provider` from the /token response — those are not part of the standalone identity-platform contract. `isNewUser` comes from the JWT subject claims; provider attribution comes from a `{cookiePrefix}_provider` cookie set when the user clicked a provider button.
 
 ## Using `context.locals.user`
 
@@ -61,43 +108,94 @@ if (user.authenticated) {
 
 ```typescript
 interface AuthenticatedUser {
-  id: string; email: string; name?: string; image?: string; authenticated: true
+  id: string
+  email: string
+  name?: string
+  image?: string
+  authenticated: true
 }
 interface UnauthenticatedUser { authenticated: false }
 type User = AuthenticatedUser | UnauthenticatedUser
 // Available on context.locals.user (Astro.locals.user in .astro files)
 ```
 
-## Wrangler Bindings
+## Wrangler bindings
 
-None required by this package. The issuer needs KV + D1 — see `apps/auth-server/README.md`.
+None required by this package. The issuer needs KV + D1 — see `apps/auth-server/README.md` (reference sample) or your standalone identity-platform's deployment docs.
 
-## Integration Order
+## Integration order
 
 Auth middleware MUST run before consent and analytics middleware. List `auth()` first in `astro.config.mjs` integrations array.
 
-## Issuer Unreachable (Cold Start)
+## Issuer unreachable (cold start)
 
-JWKS cached in Worker memory. If issuer unreachable on cold start:
-- **Non-gated paths:** fail open — `user = { authenticated: false }`, page serves normally
-- **Gated paths:** fail closed — redirect to loginPath
+JWKS is fetched lazily by `jose.createRemoteJWKSet` (cached + refreshed automatically when the key set rotates). If the issuer is unreachable on a first verification:
 
-## OAuth Flow Summary
+- **Non-gated paths:** fail open — `user = { authenticated: false }`, page serves normally.
+- **Gated paths:** fail closed — middleware redirects to `loginPath`.
 
-1. User clicks provider on login page → redirect to `{issuer}/authorize?response_type=code&...` with PKCE challenge
-2. Issuer authenticates → redirects to `/api/auth/callback?code=...&state=...`
-3. Callback exchanges code for tokens via PKCE, sets session cookies, redirects to original page
+## OAuth flow summary
 
-## Analytics Integration
+1. User clicks a provider on the login page → browser navigates to `{issuer}/authorize?response_type=code&...` with PKCE challenge. The login page's inline JS records the chosen provider in `{cookiePrefix}_provider`.
+2. Issuer authenticates → redirects to `/api/auth/callback?code=...&state=...`.
+3. Callback exchanges code for tokens via PKCE, decodes the JWT to read subject claims, emits `signup_completed` (if `isNewUser`) or `login_completed`, sets session cookies, redirects to original page.
 
-Optional peer dependency on `@growth-labs/analytics`. If installed, emits `login_completed` / `signup_completed` events automatically. If not installed, silently skipped.
+## Password / forgot / reset
 
-## Key Patterns
+Password, forgot-password, and reset-password are **issuer-owned flows**. The package does NOT implement password verification locally:
 
-- Virtual module: `virtual:growth-labs/auth/config` (slash, not hyphen)
-- Cookie names: `{cookiePrefix}_at`, `{cookiePrefix}_rt`, `{cookiePrefix}_pkce`, `{cookiePrefix}_state`, `{cookiePrefix}_redirect`
+- **Login with password** → the package's login page renders a button that 302s the user into `{issuer}/authorize?provider=password&...`. The issuer hosts the password UI.
+- **Forgot password** → `/forgot-password` (consumer URL) → 302 → `{issuer}/forgot-password`.
+- **Reset password** → reset email link → `/reset-password?token=...` (consumer URL) → 302 → `{issuer}/reset-password?token=...`.
+
+Consumer URLs exist so emails and bookmarks remain stable across issuer changes.
+
+## Email code (magic link)
+
+The `email-code` package alias maps to OpenAuth's `code` provider. The login page links into `{issuer}/authorize?provider=code&...`; the issuer hosts the email/code UI and (per its own configuration) sends the one-time code via whatever transport it's wired to.
+
+## Analytics integration
+
+Optional peer dependency on `@growth-labs/analytics`. If installed, the callback emits:
+
+- `signup_completed` when the JWT's `properties.isNewUser` is `true`
+- `login_completed` otherwise
+- Both include `{ provider, userId }` properties
+
+If `@growth-labs/analytics` is not installed, analytics calls are silently skipped.
+
+## Custom login pages
+
+Use the exported helpers to build branded login pages while keeping the package's PKCE/state plumbing:
+
+```typescript
+import {
+  createAuthFlow,
+  getAuthorizationUrl,
+  getPasswordLoginUrl,
+  getMagicLinkUrl,
+  setAuthFlowCookies,
+  setProviderCookie,
+} from '@growth-labs/auth/utils'
+
+// In a custom /login page or API route:
+const flow = await createAuthFlow(Astro)
+const google = await getAuthorizationUrl(Astro, 'google', redirectPath, flow)
+const password = await getPasswordLoginUrl(Astro, redirectPath, flow)
+const emailCode = await getMagicLinkUrl(Astro, redirectPath, flow)
+
+// On the response, set the flow cookies the callback handler needs:
+setAuthFlowCookies(response, options, flow.verifier, flow.state, redirectPath)
+// Optionally record provider attribution server-side instead of via JS:
+setProviderCookie(response, options, 'google')
+```
+
+## Key patterns
+
+- Virtual module: `globalThis.__GL_AUTH_CONFIG__` is set at build time via `vite.define` for runtime access; module-level `_setConfig` is the dev-time fallback.
+- Cookie names: `{cookiePrefix}_at`, `{cookiePrefix}_rt`, `{cookiePrefix}_pkce`, `{cookiePrefix}_state`, `{cookiePrefix}_redirect`, `{cookiePrefix}_provider`
 - PKCE flow with `code_verifier` / `code_challenge` (S256)
-- `email-code` is a client-side alias for the issuer's OpenAuth `code` provider
-- CSRF state parameter verified on callback
+- CSRF state parameter verified on callback (constant-time compare)
 - No `aud` claim validation in this package — single client per issuer assumed
-- `.astro` component files ship as source, not compiled
+- `email-code` is a client-side alias for the issuer's OpenAuth `code` provider
+- All token endpoint URLs are constructed via `new URL('/path', issuer)` so issuer values with or without trailing slashes both work

package/dist/client/login-page.d.ts

@@ -1,2 +1,17 @@
-export declare function loginPageScript(): string;
+/**
+ * Inline JS for the package's default login page.
+ *
+ * On a provider click:
+ *   1. Records the provider in `{cookiePrefix}_provider` so the callback
+ *      handler can attribute analytics correctly. The standalone
+ *      identity-platform issuer does not echo the provider back in the
+ *      /token response, so we must remember it client-side.
+ *   2. Emits a `login_clicked` analytics event if `window.glAnalytics`
+ *      is wired up (via `@growth-labs/analytics`).
+ *
+ * The provider cookie is intentionally NOT httpOnly — it must be writable
+ * from JS. Provider attribution is non-sensitive (just an analytics
+ * label) so this is an acceptable tradeoff.
+ */
+export declare function loginPageScript(cookiePrefix: string): string;
 //# sourceMappingURL=login-page.d.ts.map

package/dist/client/login-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-page.d.ts","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA,wBAAgB,eAAe,IAAI,MAAM,CAWxC"}
+{"version":3,"file":"login-page.d.ts","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAe5D"}

package/dist/client/login-page.js

@@ -1,8 +1,27 @@
-export function loginPageScript() {
+/**
+ * Inline JS for the package's default login page.
+ *
+ * On a provider click:
+ *   1. Records the provider in `{cookiePrefix}_provider` so the callback
+ *      handler can attribute analytics correctly. The standalone
+ *      identity-platform issuer does not echo the provider back in the
+ *      /token response, so we must remember it client-side.
+ *   2. Emits a `login_clicked` analytics event if `window.glAnalytics`
+ *      is wired up (via `@growth-labs/analytics`).
+ *
+ * The provider cookie is intentionally NOT httpOnly — it must be writable
+ * from JS. Provider attribution is non-sensitive (just an analytics
+ * label) so this is an acceptable tradeoff.
+ */
+export function loginPageScript(cookiePrefix) {
+    // JSON.stringify safely escapes the prefix into a JS string literal.
+    const prefixLiteral = JSON.stringify(cookiePrefix);
     return `
     document.querySelectorAll('[data-provider]').forEach(function(el) {
       el.addEventListener('click', function() {
         var provider = el.getAttribute('data-provider');
+        var prefix = ${prefixLiteral};
+        document.cookie = prefix + '_provider=' + encodeURIComponent(provider) + '; max-age=600; path=/; samesite=lax; secure';
         if (window.glAnalytics) {
           window.glAnalytics.track('login_clicked', { provider: provider });
         }

package/dist/client/login-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-page.js","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,eAAe;IAC9B,OAAO;;;;;;;;;GASL,CAAA;AACH,CAAC"}
+{"version":3,"file":"login-page.js","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IACnD,qEAAqE;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAClD,OAAO;;;;uBAIe,aAAa;;;;;;;GAOjC,CAAA;AACH,CAAC"}

package/dist/middleware/auth.js

@@ -14,7 +14,7 @@ export async function onRequest(context, next) {
         const verified = await verifyAccessToken(options.issuer, accessToken);
         if (verified) {
             user = {
-                id: verified.sub,
+                id: verified.userId,
                 email: verified.email,
                 name: verified.name,
                 image: verified.image,
@@ -27,7 +27,7 @@ export async function onRequest(context, next) {
         refreshed = await refreshTokens(options.issuer, refreshToken, clientId);
         if (refreshed) {
             user = {
-                id: refreshed.claims.sub,
+                id: refreshed.claims.userId,
                 email: refreshed.claims.email,
                 name: refreshed.claims.name,
                 image: refreshed.claims.image,

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAS,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;IACzC,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACvE,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;gBAC3B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAS,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;IACzC,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,MAAM;gBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACvE,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;gBAC3B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;gBAC3B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/routes/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAMA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqDrE"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAMA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAYD,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqErE"}

package/dist/routes/callback.js

@@ -3,6 +3,16 @@ import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js';
 import { clearAuthFlowCookies, getCookie, setTokenCookies } from '../utils/cookies.js';
 import { exchangeCode } from '../utils/openauth.js';
 import { verifyState } from '../utils/state.js';
+const ALLOWED_PROVIDERS = new Set(['google', 'password', 'email-code', 'code']);
+function normalizeProvider(value) {
+    if (!value)
+        return 'unknown';
+    if (!ALLOWED_PROVIDERS.has(value))
+        return 'unknown';
+    // `code` is the OpenAuth provider name; the package surfaces it as
+    // `email-code` for consumer-facing analytics consistency.
+    return value === 'code' ? 'email-code' : value;
+}
 export async function GET(context) {
     const options = getConfig();
     const { url, request } = context;
@@ -18,11 +28,24 @@ export async function GET(context) {
     if (!codeVerifier) {
         return new Response('Missing PKCE verifier', { status: 400 });
     }
-    // Exchange code for tokens
+    if (!code) {
+        return new Response('Missing authorization code', { status: 400 });
+    }
+    // Exchange code for tokens. The /token response from the standalone
+    // identity-platform issuer is { access_token, refresh_token } — it does
+    // NOT include is_new_user or provider. Both come from elsewhere.
     const tokenResponse = await exchangeCode(url, code, codeVerifier);
     if (!tokenResponse) {
         return Response.redirect(new URL(`${options.loginPath}?error=auth_failed`, url.origin).toString(), 302);
     }
+    // Provider attribution: read from the client-side flow cookie set when
+    // the user clicked the provider button. Falls back to 'unknown' if the
+    // caller (e.g. a custom login page) didn't set it.
+    const provider = normalizeProvider(getCookie(request, `${options.cookiePrefix}_provider`));
+    // isNewUser: derive from the access token's subject claims, NOT from a
+    // top-level token response field. The standalone issuer encodes
+    // isNewUser inside the subject payload (`properties.isNewUser`).
+    const isNewUser = tokenResponse.claims.isNewUser === true;
     // Build redirect response
     const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/';
     const response = Response.redirect(new URL(redirectPath, url.origin).toString(), 302);
@@ -36,10 +59,10 @@ export async function GET(context) {
     clearAuthFlowCookies(mutableResponse, options);
     // Emit analytics event (non-blocking)
     if (analyticsAvailable(context)) {
-        const eventName = tokenResponse.isNewUser ? 'signup_completed' : 'login_completed';
+        const eventName = isNewUser ? 'signup_completed' : 'login_completed';
         const promise = emitAuthEvent(context, eventName, {
-            provider: tokenResponse.provider,
-            userId: tokenResponse.claims.sub,
+            provider,
+            userId: tokenResponse.claims.userId,
         });
         context.waitUntil?.(promise);
     }

package/dist/routes/callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAS/C,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAK,EAAE,YAAY,CAAC,CAAA;IAClE,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,QAAQ,CACvB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EACxE,GAAG,CACH,CAAA;IACF,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IAErF,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,sCAAsC;IACtC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QAClF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;YACjD,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;SAChC,CAAC,CAAA;QACF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAS/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;AAE/E,SAAS,iBAAiB,CAAC,KAAoB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACnD,mEAAmE;IACnE,0DAA0D;IAC1D,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,QAAQ,CACvB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EACxE,GAAG,CACH,CAAA;IACF,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAC,CAAA;IAE1F,uEAAuE;IACvE,gEAAgE;IAChE,iEAAiE;IACjE,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAA;IAEzD,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IAErF,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,sCAAsC;IACtC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QACpE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;YACjD,QAAQ;YACR,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM;SACnC,CAAC,CAAA;QACF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/routes/forgot-password.d.ts

@@ -2,6 +2,17 @@ interface ForgotPasswordContext {
     request: Request;
     url: URL;
 }
-export declare function GET(context: ForgotPasswordContext): Promise<Response>;
+/**
+ * Thin proxy into the issuer-hosted forgot-password flow.
+ *
+ * Password (and forgot/reset) are issuer-owned flows: the standalone
+ * identity-platform issuer hosts the UI. This route only exists so that
+ * consumer URLs are stable (e.g. emails can deep-link to
+ * `https://site.example/forgot-password`). The route 302s to the
+ * issuer's hosted page.
+ *
+ * Returns 404 when the `password` provider isn't configured.
+ */
+export declare function GET(_context: ForgotPasswordContext): Promise<Response>;
 export {};
 //# sourceMappingURL=forgot-password.d.ts.map

package/dist/routes/forgot-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgot-password.d.ts","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAGA,UAAU,qBAAqB;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E"}
+{"version":3,"file":"forgot-password.d.ts","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAGA,UAAU,qBAAqB;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,GAAG,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAS5E"}

package/dist/routes/forgot-password.js

@@ -1,62 +1,22 @@
 import { getConfig } from '../config-store.js';
 import { getForgotPasswordUrl } from '../utils/openauth.js';
-export async function GET(context) {
+/**
+ * Thin proxy into the issuer-hosted forgot-password flow.
+ *
+ * Password (and forgot/reset) are issuer-owned flows: the standalone
+ * identity-platform issuer hosts the UI. This route only exists so that
+ * consumer URLs are stable (e.g. emails can deep-link to
+ * `https://site.example/forgot-password`). The route 302s to the
+ * issuer's hosted page.
+ *
+ * Returns 404 when the `password` provider isn't configured.
+ */
+export async function GET(_context) {
     const options = getConfig();
     if (!options.providers.includes('password')) {
         return new Response('Not found', { status: 404 });
     }
-    const sent = context.url.searchParams.get('sent') !== null;
-    const error = context.url.searchParams.get('error');
-    const html = renderForgotPasswordPage(options, context.url, { sent, error });
-    return new Response(html, {
-        headers: { 'Content-Type': 'text/html; charset=utf-8' },
-    });
-}
-function renderForgotPasswordPage(options, url, data) {
-    const { loginPage } = options;
-    const actionUrl = getForgotPasswordUrl();
-    const redirectUri = new URL(options.forgotPasswordPath, url.origin).toString();
-    const resetUri = new URL(options.resetPasswordPath, url.origin).toString();
-    return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Forgot password</title>
-  <style>
-    body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
-    h1 { text-align: center; }
-    .logo { display: block; margin: 0 auto 16px; max-height: 48px; }
-    .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
-    input[type="email"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
-    .error { color: #c00; text-align: center; margin: 12px 0; }
-    .success { color: #080; text-align: center; margin: 12px 0; }
-    .brand { text-align: center; color: #666; margin-bottom: 4px; }
-    .back-link { display: block; text-align: center; margin-top: 16px; font-size: 14px; color: #555; }
-    p.hint { text-align: center; color: #666; font-size: 14px; }
-  </style>
-</head>
-<body>
-  ${loginPage.logoUrl ? `<img src="${loginPage.logoUrl}" alt="${loginPage.brandName || ''}" class="logo">` : ''}
-  ${loginPage.brandName ? `<p class="brand">${loginPage.brandName}</p>` : ''}
-  <h1>Forgot password</h1>
-  ${data.error ? '<p class="error">Something went wrong. Please try again.</p>' : ''}
-  ${data.sent
-        ? `
-    <p class="success">Check your email for a reset link.</p>
-    <p class="hint">If you don't see it, check your spam folder.</p>
-  `
-        : `
-    <p class="hint">Enter your email and we'll send you a link to reset your password.</p>
-    <form method="POST" action="${actionUrl}">
-      <input type="email" name="email" placeholder="Email address" required>
-      <input type="hidden" name="redirect_uri" value="${redirectUri}">
-      <input type="hidden" name="reset_uri" value="${resetUri}">
-      <button type="submit" class="btn">Send reset link</button>
-    </form>
-  `}
-  <a href="${options.loginPath}" class="back-link">Back to sign in</a>
-</body>
-</html>`;
+    const target = getForgotPasswordUrl();
+    return Response.redirect(target, 302);
 }
 //# sourceMappingURL=forgot-password.js.map

package/dist/routes/forgot-password.js.map

@@ -1 +1 @@
-{"version":3,"file":"forgot-password.js","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAO3D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA8B;IACvD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAA;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5E,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;AACH,CAAC;AAOD,SAAS,wBAAwB,CAChC,OAAqC,EACrC,GAAQ,EACR,IAA4B;IAE5B,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAA;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAE1E,OAAO;;;;;;;;;;;;;;;;;;;;IAoBJ,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;;IAExE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC,EAAE;IAElF,IAAI,CAAC,IAAI;QACR,CAAC,CAAC;;;GAGF;QACA,CAAC,CAAC;;kCAE6B,SAAS;;wDAEa,WAAW;qDACd,QAAQ;;;GAI5D;aACY,OAAO,CAAC,SAAS;;QAEtB,CAAA;AACR,CAAC"}
+{"version":3,"file":"forgot-password.js","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAO3D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,QAA+B;IACxD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AACtC,CAAC"}

package/dist/routes/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAUA,UAAU,YAAY;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAMD,wBAAsB,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBlE"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAKA,UAAU,YAAY;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiClE"}

package/dist/routes/login.js

@@ -1,10 +1,7 @@
 import { loginPageScript } from '../client/login-page.js';
 import { getConfig } from '../config-store.js';
 import { setAuthFlowCookies } from '../utils/cookies.js';
-import { createAuthFlow, getAuthorizationUrl, getPasswordLoginUrl, } from '../utils/openauth.js';
-function _shouldShowForgotLink(options) {
-    return options.providers.includes('password');
-}
+import { createAuthFlow, getAuthorizationUrl } from '../utils/openauth.js';
 export async function GET(context) {
     const options = getConfig();
     const redirectPath = context.url.searchParams.get('redirect') || '/';
@@ -14,10 +11,21 @@ export async function GET(context) {
     const google = options.providers.includes('google')
         ? await getAuthorizationUrl(context, 'google', redirectPath, authFlow)
         : null;
+    const password = options.providers.includes('password')
+        ? await getAuthorizationUrl(context, 'password', redirectPath, authFlow)
+        : null;
     const emailCode = options.providers.includes('email-code')
         ? await getAuthorizationUrl(context, 'code', redirectPath, authFlow)
         : null;
-    const html = renderLoginPage(options, { google, emailCode, redirectPath, error, reset, authFlow });
+    const html = renderLoginPage(options, {
+        google,
+        password,
+        emailCode,
+        redirectPath,
+        error,
+        reset,
+        authFlow,
+    });
     const response = new Response(html, {
         headers: { 'Content-Type': 'text/html; charset=utf-8' },
     });
@@ -26,8 +34,7 @@ export async function GET(context) {
 }
 function renderLoginPage(options, data) {
     const { loginPage, providers } = options;
-    const hasPassword = providers.includes('password');
-    const passwordUrl = getPasswordLoginUrl({ url: new URL(options.issuer) });
+    const cookiePrefix = options.cookiePrefix;
     return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -41,11 +48,10 @@ function renderLoginPage(options, data) {
     .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
     .btn-google { background: #4285f4; color: white; border: none; }
     .divider { text-align: center; margin: 20px 0; color: #888; }
-    input[type="email"], input[type="password"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
     .error { color: #c00; text-align: center; margin: 12px 0; }
     .success { color: #080; text-align: center; margin: 12px 0; }
     .brand { text-align: center; color: #666; margin-bottom: 4px; }
-    .forgot-link { display: block; text-align: right; font-size: 14px; margin: -4px 0 8px; color: #555; }
+    .forgot-link { display: block; text-align: center; font-size: 14px; margin: 12px 0; color: #555; }
   </style>
 </head>
 <body>
@@ -55,25 +61,13 @@ function renderLoginPage(options, data) {
   ${data.reset ? '<p class="success">Password reset successfully. Sign in with your new password.</p>' : ''}
   ${data.error ? '<p class="error">Authentication failed. Please try again.</p>' : ''}
   ${data.google ? `<a href="${data.google.url}" class="btn btn-google" data-provider="google">Sign in with Google</a>` : ''}
-  ${data.google && (hasPassword || data.emailCode) ? '<div class="divider">or</div>' : ''}
-  ${data.emailCode
-        ? `<a href="${data.emailCode.url}" class="btn" data-provider="email-code">Sign in with email</a>`
-        : ''}
-  ${hasPassword
-        ? `
-  <form method="POST" action="${passwordUrl}">
-    <input type="email" name="email" placeholder="Email address" required>
-    <input type="password" name="password" placeholder="Password" required>
-    <a href="${options.forgotPasswordPath}" class="forgot-link">Forgot password?</a>
-    <input type="hidden" name="redirect_uri" value="${data.authFlow.redirectUri}">
-    <input type="hidden" name="client_id" value="${data.authFlow.clientId}">
-    <input type="hidden" name="state" value="${data.authFlow.state}">
-    <input type="hidden" name="code_challenge" value="${data.authFlow.challenge}">
-    <input type="hidden" name="code_challenge_method" value="S256">
-    <button type="submit" class="btn" data-provider="password">Sign in with password</button>
-  </form>`
+  ${data.google && (data.password || data.emailCode) ? '<div class="divider">or</div>' : ''}
+  ${data.password ? `<a href="${data.password.url}" class="btn" data-provider="password">Sign in with password</a>` : ''}
+  ${data.emailCode ? `<a href="${data.emailCode.url}" class="btn" data-provider="email-code">Sign in with email</a>` : ''}
+  ${providers.includes('password')
+        ? `<a href="${options.forgotPasswordPath}" class="forgot-link">Forgot password?</a>`
         : ''}
-  <script>${loginPageScript()}</script>
+  <script>${loginPageScript(cookiePrefix)}</script>
 </body>
 </html>`;
 }

package/dist/routes/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAEN,cAAc,EACd,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,sBAAsB,CAAA;AAO7B,SAAS,qBAAqB,CAAC,OAAqC;IACnE,OAAO,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAqB;IAC9C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;IAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;QACtE,CAAC,CAAC,IAAI,CAAA;IACP,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC;QACpE,CAAC,CAAC,IAAI,CAAA;IAEP,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClG,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACnC,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;IAEF,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAEtF,OAAO,QAAQ,CAAA;AAChB,CAAC;AAWD,SAAS,eAAe,CAAC,OAAqC,EAAE,IAAmB;IAClF,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IACxC,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAEzE,OAAO;;;;;WAKG,SAAS,CAAC,KAAK;;;;;;;;;;;;;;;;IAgBtB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;QACpE,SAAS,CAAC,KAAK;IACnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,qFAAqF,CAAC,CAAC,CAAC,EAAE;IACvG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE;IACjF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,yEAAyE,CAAC,CAAC,CAAC,EAAE;IACvH,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE;IAEvF,IAAI,CAAC,SAAS;QACb,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,iEAAiE;QACjG,CAAC,CAAC,EACJ;IAEC,WAAW;QACV,CAAC,CAAC;gCAC2B,WAAW;;;eAG5B,OAAO,CAAC,kBAAkB;sDACa,IAAI,CAAC,QAAQ,CAAC,WAAW;mDAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ;+CAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK;wDACV,IAAI,CAAC,QAAQ,CAAC,SAAS;;;UAGrE;QACP,CAAC,CAAC,EACJ;YACW,eAAe,EAAE;;QAErB,CAAA;AACR,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAiB,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAOzF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAqB;IAC9C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;IAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;QACtE,CAAC,CAAC,IAAI,CAAA;IACP,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QACtD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC;QACxE,CAAC,CAAC,IAAI,CAAA;IACP,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC;QACpE,CAAC,CAAC,IAAI,CAAA;IAEP,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE;QACrC,MAAM;QACN,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,KAAK;QACL,KAAK;QACL,QAAQ;KACR,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACnC,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;IAEF,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAEtF,OAAO,QAAQ,CAAA;AAChB,CAAC;AAmBD,SAAS,eAAe,CAAC,OAAqC,EAAE,IAAmB;IAClF,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAA;IAEzC,OAAO;;;;;WAKG,SAAS,CAAC,KAAK;;;;;;;;;;;;;;;IAetB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;QACpE,SAAS,CAAC,KAAK;IACnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,qFAAqF,CAAC,CAAC,CAAC,EAAE;IACvG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE;IACjF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,yEAAyE,CAAC,CAAC,CAAC,EAAE;IACvH,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE;IACvF,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,GAAG,kEAAkE,CAAC,CAAC,CAAC,EAAE;IACpH,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,iEAAiE,CAAC,CAAC,CAAC,EAAE;IAEvH,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7B,CAAC,CAAC,YAAY,OAAO,CAAC,kBAAkB,4CAA4C;QACpF,CAAC,CAAC,EACJ;YACW,eAAe,CAAC,YAAY,CAAC;;QAEjC,CAAA;AACR,CAAC"}