@growth-labs/auth 0.1.3 → 0.2.1

package/dist/routes/reset-password.d.ts

@@ -2,6 +2,16 @@ interface ResetPasswordContext {
     request: Request;
     url: URL;
 }
+/**
+ * Thin proxy into the issuer-hosted reset-password flow.
+ *
+ * The reset link emailed to the user can point at the consumer's
+ * `/reset-password?token=...`; this route 302s to the issuer's hosted
+ * reset page with the token preserved.
+ *
+ * Returns 400 when the token is missing, 404 when the `password`
+ * provider isn't configured.
+ */
 export declare function GET(context: ResetPasswordContext): Promise<Response>;
 export {};
 //# sourceMappingURL=reset-password.d.ts.map

package/dist/routes/reset-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/routes/reset-password.ts"],"names":[],"mappings":"AAGA,UAAU,oBAAoB;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkB1E"}
+{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/routes/reset-password.ts"],"names":[],"mappings":"AAGA,UAAU,oBAAoB;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED;;;;;;;;;GASG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc1E"}

package/dist/routes/reset-password.js

@@ -1,5 +1,15 @@
 import { getConfig } from '../config-store.js';
 import { getResetPasswordUrl } from '../utils/openauth.js';
+/**
+ * Thin proxy into the issuer-hosted reset-password flow.
+ *
+ * The reset link emailed to the user can point at the consumer's
+ * `/reset-password?token=...`; this route 302s to the issuer's hosted
+ * reset page with the token preserved.
+ *
+ * Returns 400 when the token is missing, 404 when the `password`
+ * provider isn't configured.
+ */
 export async function GET(context) {
     const options = getConfig();
     if (!options.providers.includes('password')) {
@@ -9,49 +19,7 @@ export async function GET(context) {
     if (!token) {
         return new Response('Missing reset token', { status: 400 });
     }
-    const error = context.url.searchParams.get('error');
-    const html = renderResetPasswordPage(options, context.url, { token, error });
-    return new Response(html, {
-        headers: { 'Content-Type': 'text/html; charset=utf-8' },
-    });
-}
-function renderResetPasswordPage(options, url, data) {
-    const { loginPage } = options;
-    const actionUrl = getResetPasswordUrl();
-    const redirectUri = new URL(`${options.loginPath}?reset=true`, url.origin).toString();
-    return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Reset password</title>
-  <style>
-    body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
-    h1 { text-align: center; }
-    .logo { display: block; margin: 0 auto 16px; max-height: 48px; }
-    .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
-    input[type="password"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
-    .error { color: #c00; text-align: center; margin: 12px 0; }
-    .brand { text-align: center; color: #666; margin-bottom: 4px; }
-    .back-link { display: block; text-align: center; margin-top: 16px; font-size: 14px; color: #555; }
-    p.hint { text-align: center; color: #666; font-size: 14px; }
-  </style>
-</head>
-<body>
-  ${loginPage.logoUrl ? `<img src="${loginPage.logoUrl}" alt="${loginPage.brandName || ''}" class="logo">` : ''}
-  ${loginPage.brandName ? `<p class="brand">${loginPage.brandName}</p>` : ''}
-  <h1>Reset password</h1>
-  ${data.error ? '<p class="error">This reset link is invalid or has expired. Please request a new one.</p>' : ''}
-  <p class="hint">Enter your new password.</p>
-  <form method="POST" action="${actionUrl}">
-    <input type="password" name="password" placeholder="New password" required minlength="8">
-    <input type="password" name="password_confirmation" placeholder="Confirm password" required minlength="8">
-    <input type="hidden" name="token" value="${data.token}">
-    <input type="hidden" name="redirect_uri" value="${redirectUri}">
-    <button type="submit" class="btn">Reset password</button>
-  </form>
-  <a href="${options.loginPath}" class="back-link">Back to sign in</a>
-</body>
-</html>`;
+    const target = getResetPasswordUrl(token);
+    return Response.redirect(target, 302);
 }
 //# sourceMappingURL=reset-password.js.map

package/dist/routes/reset-password.js.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.js","sourceRoot":"","sources":["../../src/routes/reset-password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAO1D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA6B;IACtD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5E,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;AACH,CAAC;AAOD,SAAS,uBAAuB,CAC/B,OAAqC,EACrC,GAAQ,EACR,IAA2B;IAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAA;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAErF,OAAO;;;;;;;;;;;;;;;;;;;IAmBJ,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;;IAExE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,2FAA2F,CAAC,CAAC,CAAC,EAAE;;gCAEjF,SAAS;;;+CAGM,IAAI,CAAC,KAAK;sDACH,WAAW;;;aAGpD,OAAO,CAAC,SAAS;;QAEtB,CAAA;AACR,CAAC"}
+{"version":3,"file":"reset-password.js","sourceRoot":"","sources":["../../src/routes/reset-password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAO1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA6B;IACtD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AACtC,CAAC"}

package/dist/types.d.ts

@@ -9,27 +9,31 @@ export interface UnauthenticatedUser {
     authenticated: false;
 }
 export type User = AuthenticatedUser | UnauthenticatedUser;
+/**
+ * Subject claims extracted from an OpenAuth-issued access token.
+ *
+ * The standalone identity-platform issuer (and any OpenAuth-compatible issuer)
+ * encodes the subject under `properties` in the JWT payload. The `userId`
+ * field is the stable user identifier; the JWT's top-level `sub` is an
+ * OpenAuth-internal subject hash (`{type}:{sha1-prefix}`) and is NOT the
+ * user ID.
+ */
+export interface SubjectClaims {
+    userId: string;
+    email: string;
+    name?: string;
+    image?: string;
+    isNewUser?: boolean;
+}
 export interface TokenRefreshResult {
     accessToken: string;
     refreshToken: string;
-    claims: {
-        sub: string;
-        email: string;
-        name?: string;
-        image?: string;
-    };
+    claims: SubjectClaims;
 }
 export interface TokenExchangeResult {
     accessToken: string;
     refreshToken: string;
-    isNewUser: boolean;
-    provider: string;
-    claims: {
-        sub: string;
-        email: string;
-        name?: string;
-        image?: string;
-    };
+    claims: SubjectClaims;
 }
 declare global {
     namespace App {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,KAAK,CAAA;CACpB;AAED,MAAM,MAAM,IAAI,GAAG,iBAAiB,GAAG,mBAAmB,CAAA;AAE1D,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAGD,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,MAAM;YACf,IAAI,EAAE,IAAI,CAAA;SACV;KACD;CACD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,KAAK,CAAA;CACpB;AAED,MAAM,MAAM,IAAI,GAAG,iBAAiB,GAAG,mBAAmB,CAAA;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,aAAa,CAAA;CACrB;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,aAAa,CAAA;CACrB;AAGD,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,MAAM;YACf,IAAI,EAAE,IAAI,CAAA;SACV;KACD;CACD"}

package/dist/utils/cookies.d.ts

@@ -13,5 +13,23 @@ export declare function clearCookie(response: Response, name: string, domain?: s
 export declare function setTokenCookies(response: Response, options: ResolvedAuthOptions, accessToken: string, refreshToken: string): void;
 export declare function clearTokenCookies(response: Response, options: ResolvedAuthOptions): void;
 export declare function clearAuthFlowCookies(response: Response, options: ResolvedAuthOptions): void;
+/**
+ * Set the short-lived flow cookies that the callback handler reads:
+ * - `_pkce` — PKCE verifier (proves the client started the flow)
+ * - `_state` — CSRF state nonce
+ * - `_redirect` — original `?redirect=` value to bounce back to after auth
+ *
+ * Provider attribution is set separately via `setProviderCookie` because
+ * the package's default login page renders all provider buttons up-front;
+ * we don't know which one the user will click. Custom login pages can call
+ * `setProviderCookie` immediately before redirecting to the issuer.
+ */
 export declare function setAuthFlowCookies(response: Response, options: ResolvedAuthOptions, verifier: string, state: string, redirectPath: string): void;
+/**
+ * Record which provider the user is starting an auth flow with so the
+ * callback handler can attribute analytics correctly. The standalone
+ * identity-platform issuer does NOT echo the provider back in the /token
+ * response, so we must remember it client-side.
+ */
+export declare function setProviderCookie(response: Response, options: ResolvedAuthOptions, provider: string): void;
 //# sourceMappingURL=cookies.d.ts.map

package/dist/utils/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKvE;AAED,wBAAgB,SAAS,CACxB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,gBAAqB,GAC/B,IAAI,CASN;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAMnF;AAED,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAClB,IAAI,CAgBN;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAGxF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAI3F;AAED,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAClB,IAAI,CAWN"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKvE;AAED,wBAAgB,SAAS,CACxB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,gBAAqB,GAC/B,IAAI,CASN;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAMnF;AAED,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAClB,IAAI,CAgBN;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAGxF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAK3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAClB,IAAI,CAWN;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAChC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,GACd,IAAI,CAQN"}

package/dist/utils/cookies.js

@@ -53,7 +53,19 @@ export function clearAuthFlowCookies(response, options) {
     clearCookie(response, `${options.cookiePrefix}_pkce`);
     clearCookie(response, `${options.cookiePrefix}_state`);
     clearCookie(response, `${options.cookiePrefix}_redirect`);
+    clearCookie(response, `${options.cookiePrefix}_provider`);
 }
+/**
+ * Set the short-lived flow cookies that the callback handler reads:
+ * - `_pkce` — PKCE verifier (proves the client started the flow)
+ * - `_state` — CSRF state nonce
+ * - `_redirect` — original `?redirect=` value to bounce back to after auth
+ *
+ * Provider attribution is set separately via `setProviderCookie` because
+ * the package's default login page renders all provider buttons up-front;
+ * we don't know which one the user will click. Custom login pages can call
+ * `setProviderCookie` immediately before redirecting to the issuer.
+ */
 export function setAuthFlowCookies(response, options, verifier, state, redirectPath) {
     const attrs = {
         path: '/',
@@ -66,4 +78,19 @@ export function setAuthFlowCookies(response, options, verifier, state, redirectP
     setCookie(response, `${options.cookiePrefix}_state`, state, attrs);
     setCookie(response, `${options.cookiePrefix}_redirect`, redirectPath, attrs);
 }
+/**
+ * Record which provider the user is starting an auth flow with so the
+ * callback handler can attribute analytics correctly. The standalone
+ * identity-platform issuer does NOT echo the provider back in the /token
+ * response, so we must remember it client-side.
+ */
+export function setProviderCookie(response, options, provider) {
+    setCookie(response, `${options.cookiePrefix}_provider`, provider, {
+        path: '/',
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        maxAge: 600,
+    });
+}
 //# sourceMappingURL=cookies.js.map

package/dist/utils/cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,SAAS,CACxB,QAAkB,EAClB,IAAY,EACZ,KAAa,EACb,aAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtE,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAkB,EAAE,IAAY,EAAE,MAAe;IAC5E,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7B,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,QAAkB,EAClB,OAA4B,EAC5B,WAAmB,EACnB,YAAoB;IAEpB,MAAM,IAAI,GAAqB;QAC9B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;KAC3E,CAAA;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,WAAW,EAAE;QAC9D,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,CAAC,iBAAiB;KACjC,CAAC,CAAA;IACF,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,YAAY,EAAE;QAC/D,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,CAAC,kBAAkB;KAClC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB,EAAE,OAA4B;IACjF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAChF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,OAA4B;IACpF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACrD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACtD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,QAAkB,EAClB,OAA4B,EAC5B,QAAgB,EAChB,KAAa,EACb,YAAoB;IAEpB,MAAM,KAAK,GAAqB;QAC/B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACX,CAAA;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;IACpE,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAClE,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;AAC7E,CAAC"}
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,SAAS,CACxB,QAAkB,EAClB,IAAY,EACZ,KAAa,EACb,aAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtE,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAkB,EAAE,IAAY,EAAE,MAAe;IAC5E,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7B,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,QAAkB,EAClB,OAA4B,EAC5B,WAAmB,EACnB,YAAoB;IAEpB,MAAM,IAAI,GAAqB;QAC9B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;KAC3E,CAAA;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,WAAW,EAAE;QAC9D,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,CAAC,iBAAiB;KACjC,CAAC,CAAA;IACF,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,YAAY,EAAE;QAC/D,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,CAAC,kBAAkB;KAClC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB,EAAE,OAA4B;IACjF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAChF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,OAA4B;IACpF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACrD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACtD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IACzD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CACjC,QAAkB,EAClB,OAA4B,EAC5B,QAAgB,EAChB,KAAa,EACb,YAAoB;IAEpB,MAAM,KAAK,GAAqB;QAC/B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACX,CAAA;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;IACpE,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAClE,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAChC,QAAkB,EAClB,OAA4B,EAC5B,QAAgB;IAEhB,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,QAAQ,EAAE;QACjE,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACX,CAAC,CAAA;AACH,CAAC"}

package/dist/utils/index.d.ts

@@ -1,6 +1,8 @@
 export { emitAuthEvent, trackAuthEvent } from './analytics.js';
-export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
+export { clearAuthFlowCookies, clearTokenCookies, getCookie, setAuthFlowCookies, setProviderCookie, setTokenCookies, } from './cookies.js';
+export type { AuthFlow } from './openauth.js';
+export { createAuthFlow, exchangeCode, getAuthorizationUrl, getForgotPasswordUrl, getMagicLinkUrl, getPasswordLoginUrl, getResetPasswordUrl, revokeToken, } from './openauth.js';
 export { generatePKCE } from './pkce.js';
 export { generateState, verifyState } from './state.js';
-export type { VerifiedClaims } from './tokens.js';
+export { decodeJwtPayload, refreshTokens, verifyAccessToken } from './tokens.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACN,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GACf,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EACN,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA"}

package/dist/utils/index.js

@@ -1,5 +1,7 @@
 export { emitAuthEvent, trackAuthEvent } from './analytics.js';
-export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
+export { clearAuthFlowCookies, clearTokenCookies, getCookie, setAuthFlowCookies, setProviderCookie, setTokenCookies, } from './cookies.js';
+export { createAuthFlow, exchangeCode, getAuthorizationUrl, getForgotPasswordUrl, getMagicLinkUrl, getPasswordLoginUrl, getResetPasswordUrl, revokeToken, } from './openauth.js';
 export { generatePKCE } from './pkce.js';
 export { generateState, verifyState } from './state.js';
+export { decodeJwtPayload, refreshTokens, verifyAccessToken } from './tokens.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACN,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GACf,MAAM,cAAc,CAAA;AAErB,OAAO,EACN,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA"}

package/dist/utils/openauth.d.ts

@@ -9,21 +9,66 @@ export interface AuthFlow {
 export declare function createAuthFlow(context: {
     url: URL;
 }): Promise<AuthFlow>;
+/**
+ * Build an OpenAuth `/authorize` URL for a given provider.
+ *
+ * The standalone identity-platform issuer accepts these `provider` values:
+ *   - `google`     — Google OAuth (issuer-hosted)
+ *   - `password`   — issuer-hosted password UI
+ *   - `code`       — issuer-hosted email-code UI (a.k.a. "magic link")
+ *
+ * The `email-code` package alias is mapped to OpenAuth's `code` provider.
+ */
 export declare function getAuthorizationUrl(context: {
     url: URL;
 }, provider: string, _redirectPath: string, authFlow?: AuthFlow): Promise<{
     url: string;
     pkceVerifier: string;
     state: string;
+    provider: string;
 }>;
-export declare function getPasswordLoginUrl(_context: {
+/**
+ * Convenience helper for consumers building custom login pages with a
+ * password sign-in button.
+ *
+ * Returns a fully-formed `/authorize?provider=password&...` URL that takes
+ * the user into the issuer-hosted password flow. The package does NOT
+ * implement password verification locally.
+ */
+export declare function getPasswordLoginUrl(context: {
     url: URL;
-}): string;
-export declare function getMagicLinkUrl(_context: {
+}, redirectPath?: string, authFlow?: AuthFlow): Promise<{
+    url: string;
+    pkceVerifier: string;
+    state: string;
+    provider: string;
+}>;
+/**
+ * Convenience helper for consumers building custom login pages with a
+ * "Sign in with email" (magic link / email-code) button.
+ *
+ * Returns a fully-formed `/authorize?provider=code&...` URL that takes
+ * the user into the issuer-hosted email-code flow.
+ */
+export declare function getMagicLinkUrl(context: {
     url: URL;
-}): string;
+}, redirectPath?: string, authFlow?: AuthFlow): Promise<{
+    url: string;
+    pkceVerifier: string;
+    state: string;
+    provider: string;
+}>;
+/**
+ * URL the consumer site can link to / redirect to for the issuer-hosted
+ * forgot-password flow. The standalone identity-platform owns this UI.
+ */
 export declare function getForgotPasswordUrl(): string;
-export declare function getResetPasswordUrl(): string;
+/**
+ * URL the consumer site can link to / redirect to for the issuer-hosted
+ * reset-password flow. Pass through any reset token the issuer sent
+ * to the consumer's reset-password path.
+ */
+export declare function getResetPasswordUrl(token?: string | null): string;
 export declare function exchangeCode(callbackUrl: URL, code: string, codeVerifier: string): Promise<TokenExchangeResult | null>;
 export declare function revokeToken(refreshToken: string, clientId?: string): Promise<void>;
 //# sourceMappingURL=openauth.d.ts.map

package/dist/utils/openauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAKtD,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY7E;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB/D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAGlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAG9D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAG5C;AAED,wBAAsB,YAAY,CACjC,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA4CrC;AAED,wBAAsB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAexF"}
+{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAKtD,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY7E;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,YAAY,SAAM,EAClB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAEjF;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,YAAY,SAAM,EAClB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAEjF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAKjE;AAED,wBAAsB,YAAY,CACjC,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA0DrC;AAED,wBAAsB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBxF"}

package/dist/utils/openauth.js

@@ -14,6 +14,16 @@ export async function createAuthFlow(context) {
         redirectUri: new URL(options.callbackPath, context.url.origin).toString(),
     };
 }
+/**
+ * Build an OpenAuth `/authorize` URL for a given provider.
+ *
+ * The standalone identity-platform issuer accepts these `provider` values:
+ *   - `google`     — Google OAuth (issuer-hosted)
+ *   - `password`   — issuer-hosted password UI
+ *   - `code`       — issuer-hosted email-code UI (a.k.a. "magic link")
+ *
+ * The `email-code` package alias is mapped to OpenAuth's `code` provider.
+ */
 export async function getAuthorizationUrl(context, provider, _redirectPath, authFlow) {
     const options = getConfig();
     const flow = authFlow ?? (await createAuthFlow(context));
@@ -31,30 +41,57 @@ export async function getAuthorizationUrl(context, provider, _redirectPath, auth
         url: `${options.issuer}/authorize?${params}`,
         pkceVerifier: flow.verifier,
         state: flow.state,
+        provider,
     };
 }
-export function getPasswordLoginUrl(_context) {
-    const options = getConfig();
-    return `${options.issuer}/authorize/password`;
+/**
+ * Convenience helper for consumers building custom login pages with a
+ * password sign-in button.
+ *
+ * Returns a fully-formed `/authorize?provider=password&...` URL that takes
+ * the user into the issuer-hosted password flow. The package does NOT
+ * implement password verification locally.
+ */
+export async function getPasswordLoginUrl(context, redirectPath = '/', authFlow) {
+    return getAuthorizationUrl(context, 'password', redirectPath, authFlow);
 }
-export function getMagicLinkUrl(_context) {
-    const options = getConfig();
-    return `${options.issuer}/authorize/email-code`;
+/**
+ * Convenience helper for consumers building custom login pages with a
+ * "Sign in with email" (magic link / email-code) button.
+ *
+ * Returns a fully-formed `/authorize?provider=code&...` URL that takes
+ * the user into the issuer-hosted email-code flow.
+ */
+export async function getMagicLinkUrl(context, redirectPath = '/', authFlow) {
+    return getAuthorizationUrl(context, 'code', redirectPath, authFlow);
 }
+/**
+ * URL the consumer site can link to / redirect to for the issuer-hosted
+ * forgot-password flow. The standalone identity-platform owns this UI.
+ */
 export function getForgotPasswordUrl() {
     const options = getConfig();
-    return `${options.issuer}/forgot-password`;
+    return new URL('/forgot-password', options.issuer).toString();
 }
-export function getResetPasswordUrl() {
+/**
+ * URL the consumer site can link to / redirect to for the issuer-hosted
+ * reset-password flow. Pass through any reset token the issuer sent
+ * to the consumer's reset-password path.
+ */
+export function getResetPasswordUrl(token) {
     const options = getConfig();
-    return `${options.issuer}/reset-password`;
+    const url = new URL('/reset-password', options.issuer);
+    if (token)
+        url.searchParams.set('token', token);
+    return url.toString();
 }
 export async function exchangeCode(callbackUrl, code, codeVerifier) {
     const options = getConfig();
     const clientId = options.clientId || callbackUrl.hostname;
     const redirectUri = new URL(options.callbackPath, callbackUrl.origin).toString();
     try {
-        const response = await fetch(`${options.issuer}/token`, {
+        const tokenUrl = new URL('/token', options.issuer).toString();
+        const response = await fetch(tokenUrl, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: new URLSearchParams({
@@ -67,18 +104,32 @@ export async function exchangeCode(callbackUrl, code, codeVerifier) {
         });
         if (!response.ok)
             return null;
+        // The standalone identity-platform issuer returns a standard OpenAuth
+        // /token response: { access_token, refresh_token, expires_in }.
+        // It does NOT include is_new_user or provider as top-level fields.
+        // `isNewUser` lives inside the access token's subject claims; provider
+        // attribution is the client's responsibility (track via flow state).
         const data = (await response.json());
-        const claims = decodeJwtPayload(data.access_token);
+        if (!data.access_token || !data.refresh_token)
+            return null;
+        const payload = decodeJwtPayload(data.access_token);
+        const propsCandidate = payload.properties;
+        const props = propsCandidate && typeof propsCandidate === 'object'
+            ? propsCandidate
+            : {};
+        const userId = typeof props.userId === 'string' ? props.userId : null;
+        const email = typeof props.email === 'string' ? props.email : null;
+        if (!userId || !email)
+            return null;
         return {
             accessToken: data.access_token,
             refreshToken: data.refresh_token,
-            isNewUser: data.is_new_user || false,
-            provider: data.provider || 'unknown',
             claims: {
-                sub: claims.sub,
-                email: claims.email,
-                name: claims.name,
-                image: claims.image,
+                userId,
+                email,
+                name: typeof props.name === 'string' ? props.name : undefined,
+                image: typeof props.image === 'string' ? props.image : undefined,
+                isNewUser: typeof props.isNewUser === 'boolean' ? props.isNewUser : undefined,
             },
         };
     }
@@ -89,7 +140,8 @@ export async function exchangeCode(callbackUrl, code, codeVerifier) {
 export async function revokeToken(refreshToken, clientId) {
     const options = getConfig();
     try {
-        await fetch(`${options.issuer}/revoke`, {
+        const revokeUrl = new URL('/revoke', options.issuer).toString();
+        await fetch(revokeUrl, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: new URLSearchParams({

package/dist/utils/openauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAU9C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;KACR,CAAC,CAAA;IAEF,OAAO;QACN,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,cAAc,MAAM,EAAE;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAA;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,qBAAqB,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAsB;IACrD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,uBAAuB,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,kBAAkB,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,iBAAiB,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,WAAgB,EAChB,IAAY,EACZ,YAAoB;IAEpB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEhF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,QAAQ,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,QAAQ;aACnB,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAA;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAElD,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,KAAK;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;YACpC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAa;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAe;gBAC7B,IAAI,EAAE,MAAM,CAAC,IAA0B;gBACvC,KAAK,EAAE,MAAM,CAAC,KAA2B;aACzC;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,QAAiB;IACxE,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,SAAS,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,eAAe;gBAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC"}
+{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAU9C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;KACR,CAAC,CAAA;IAEF,OAAO;QACN,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,cAAc,MAAM,EAAE;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ;KACR,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,YAAY,GAAG,GAAG,EAClB,QAAmB;IAEnB,OAAO,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAAqB,EACrB,YAAY,GAAG,GAAG,EAClB,QAAmB;IAEnB,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IACnC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,IAAI,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAqB;IACxD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC/C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,WAAgB,EAChB,IAAY,EACZ,YAAoB;IAEpB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEhF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,QAAQ;aACnB,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,sEAAsE;QACtE,gEAAgE;QAChE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAA;QAE1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAA;QACzC,MAAM,KAAK,GACV,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;YACnD,CAAC,CAAE,cAA0C;YAC7C,CAAC,CAAC,EAAE,CAAA;QAEN,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QAClE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAElC,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,MAAM,EAAE;gBACP,MAAM;gBACN,KAAK;gBACL,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC7D,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAChE,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC7E;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,QAAiB;IACxE,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC/D,MAAM,KAAK,CAAC,SAAS,EAAE;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,eAAe;gBAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC"}

package/dist/utils/tokens.d.ts

@@ -1,12 +1,9 @@
-import type { TokenRefreshResult } from '../types.js';
-export interface VerifiedClaims {
-    sub: string;
-    email: string;
-    name?: string;
-    image?: string;
-}
-export declare function verifyAccessToken(issuer: string, token: string): Promise<VerifiedClaims | null>;
+import type { SubjectClaims, TokenRefreshResult } from '../types.js';
+export declare function verifyAccessToken(issuer: string, token: string): Promise<SubjectClaims | null>;
 export declare function refreshTokens(issuer: string, refreshToken: string, clientId?: string): Promise<TokenRefreshResult | null>;
 export declare function decodeJwtPayload(jwt: string): Record<string, unknown>;
+/**
+ * Exposed for tests so cached JWKS sets can be reset between cases.
+ */
 export declare function _resetJwksCache(): void;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/utils/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAkBrD,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAchC;AAED,wBAAsB,aAAa,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAoCpC;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKrE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAmDpE,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAS/B;AAED,wBAAsB,aAAa,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAmCpC;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASrE;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}