@growth-labs/auth 0.1.3

package/dist/routes/login.js

@@ -0,0 +1,80 @@
+import { loginPageScript } from '../client/login-page.js';
+import { getConfig } from '../config-store.js';
+import { setAuthFlowCookies } from '../utils/cookies.js';
+import { createAuthFlow, getAuthorizationUrl, getPasswordLoginUrl, } from '../utils/openauth.js';
+function _shouldShowForgotLink(options) {
+    return options.providers.includes('password');
+}
+export async function GET(context) {
+    const options = getConfig();
+    const redirectPath = context.url.searchParams.get('redirect') || '/';
+    const error = context.url.searchParams.get('error');
+    const reset = context.url.searchParams.get('reset');
+    const authFlow = await createAuthFlow(context);
+    const google = options.providers.includes('google')
+        ? await getAuthorizationUrl(context, 'google', redirectPath, authFlow)
+        : null;
+    const emailCode = options.providers.includes('email-code')
+        ? await getAuthorizationUrl(context, 'code', redirectPath, authFlow)
+        : null;
+    const html = renderLoginPage(options, { google, emailCode, redirectPath, error, reset, authFlow });
+    const response = new Response(html, {
+        headers: { 'Content-Type': 'text/html; charset=utf-8' },
+    });
+    setAuthFlowCookies(response, options, authFlow.verifier, authFlow.state, redirectPath);
+    return response;
+}
+function renderLoginPage(options, data) {
+    const { loginPage, providers } = options;
+    const hasPassword = providers.includes('password');
+    const passwordUrl = getPasswordLoginUrl({ url: new URL(options.issuer) });
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${loginPage.title}</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
+    h1 { text-align: center; }
+    .logo { display: block; margin: 0 auto 16px; max-height: 48px; }
+    .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
+    .btn-google { background: #4285f4; color: white; border: none; }
+    .divider { text-align: center; margin: 20px 0; color: #888; }
+    input[type="email"], input[type="password"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
+    .error { color: #c00; text-align: center; margin: 12px 0; }
+    .success { color: #080; text-align: center; margin: 12px 0; }
+    .brand { text-align: center; color: #666; margin-bottom: 4px; }
+    .forgot-link { display: block; text-align: right; font-size: 14px; margin: -4px 0 8px; color: #555; }
+  </style>
+</head>
+<body>
+  ${loginPage.logoUrl ? `<img src="${loginPage.logoUrl}" alt="${loginPage.brandName || ''}" class="logo">` : ''}
+  ${loginPage.brandName ? `<p class="brand">${loginPage.brandName}</p>` : ''}
+  <h1>${loginPage.title}</h1>
+  ${data.reset ? '<p class="success">Password reset successfully. Sign in with your new password.</p>' : ''}
+  ${data.error ? '<p class="error">Authentication failed. Please try again.</p>' : ''}
+  ${data.google ? `<a href="${data.google.url}" class="btn btn-google" data-provider="google">Sign in with Google</a>` : ''}
+  ${data.google && (hasPassword || data.emailCode) ? '<div class="divider">or</div>' : ''}
+  ${data.emailCode
+        ? `<a href="${data.emailCode.url}" class="btn" data-provider="email-code">Sign in with email</a>`
+        : ''}
+  ${hasPassword
+        ? `
+  <form method="POST" action="${passwordUrl}">
+    <input type="email" name="email" placeholder="Email address" required>
+    <input type="password" name="password" placeholder="Password" required>
+    <a href="${options.forgotPasswordPath}" class="forgot-link">Forgot password?</a>
+    <input type="hidden" name="redirect_uri" value="${data.authFlow.redirectUri}">
+    <input type="hidden" name="client_id" value="${data.authFlow.clientId}">
+    <input type="hidden" name="state" value="${data.authFlow.state}">
+    <input type="hidden" name="code_challenge" value="${data.authFlow.challenge}">
+    <input type="hidden" name="code_challenge_method" value="S256">
+    <button type="submit" class="btn" data-provider="password">Sign in with password</button>
+  </form>`
+        : ''}
+  <script>${loginPageScript()}</script>
+</body>
+</html>`;
+}
+//# sourceMappingURL=login.js.map

package/dist/routes/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAEN,cAAc,EACd,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,sBAAsB,CAAA;AAO7B,SAAS,qBAAqB,CAAC,OAAqC;IACnE,OAAO,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAqB;IAC9C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;IAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;QACtE,CAAC,CAAC,IAAI,CAAA;IACP,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC;QACpE,CAAC,CAAC,IAAI,CAAA;IAEP,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClG,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACnC,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;IAEF,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAEtF,OAAO,QAAQ,CAAA;AAChB,CAAC;AAWD,SAAS,eAAe,CAAC,OAAqC,EAAE,IAAmB;IAClF,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IACxC,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAEzE,OAAO;;;;;WAKG,SAAS,CAAC,KAAK;;;;;;;;;;;;;;;;IAgBtB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;QACpE,SAAS,CAAC,KAAK;IACnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,qFAAqF,CAAC,CAAC,CAAC,EAAE;IACvG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE;IACjF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,yEAAyE,CAAC,CAAC,CAAC,EAAE;IACvH,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE;IAEvF,IAAI,CAAC,SAAS;QACb,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,iEAAiE;QACjG,CAAC,CAAC,EACJ;IAEC,WAAW;QACV,CAAC,CAAC;gCAC2B,WAAW;;;eAG5B,OAAO,CAAC,kBAAkB;sDACa,IAAI,CAAC,QAAQ,CAAC,WAAW;mDAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ;+CAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK;wDACV,IAAI,CAAC,QAAQ,CAAC,SAAS;;;UAGrE;QACP,CAAC,CAAC,EACJ;YACW,eAAe,EAAE;;QAErB,CAAA;AACR,CAAC"}

package/dist/routes/logout.d.ts

@@ -0,0 +1,8 @@
+interface LogoutContext {
+    request: Request;
+    url: URL;
+    waitUntil?: (promise: Promise<unknown>) => void;
+}
+export declare function GET(context: LogoutContext): Promise<Response>;
+export {};
+//# sourceMappingURL=logout.d.ts.map

package/dist/routes/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAIA,UAAU,aAAa;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0BnE"}

package/dist/routes/logout.js

@@ -0,0 +1,26 @@
+import { getConfig } from '../config-store.js';
+import { clearCookie, clearTokenCookies, getCookie } from '../utils/cookies.js';
+import { revokeToken } from '../utils/openauth.js';
+export async function GET(context) {
+    const options = getConfig();
+    const refreshToken = getCookie(context.request, `${options.cookiePrefix}_rt`);
+    const clientId = options.clientId || context.url.hostname;
+    // Revoke at issuer (non-blocking)
+    if (refreshToken) {
+        const promise = revokeToken(refreshToken, clientId);
+        context.waitUntil?.(promise);
+    }
+    // Build redirect response
+    const redirectUrl = new URL(options.logoutRedirect, context.url.origin).toString();
+    const response = Response.redirect(redirectUrl, 302);
+    // Mutable copy for clearing cookies
+    const mutableResponse = new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: new Headers(response.headers),
+    });
+    clearTokenCookies(mutableResponse, options);
+    clearCookie(mutableResponse, `${options.cookiePrefix}_pkce`);
+    return mutableResponse;
+}
+//# sourceMappingURL=logout.js.map

package/dist/routes/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAQlD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAsB;IAC/C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAEzD,kCAAkC;IAClC,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACnD,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpD,oCAAoC;IACpC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC3C,WAAW,CAAC,eAAe,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IAE5D,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/routes/reset-password.d.ts

@@ -0,0 +1,7 @@
+interface ResetPasswordContext {
+    request: Request;
+    url: URL;
+}
+export declare function GET(context: ResetPasswordContext): Promise<Response>;
+export {};
+//# sourceMappingURL=reset-password.d.ts.map

package/dist/routes/reset-password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/routes/reset-password.ts"],"names":[],"mappings":"AAGA,UAAU,oBAAoB;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkB1E"}

package/dist/routes/reset-password.js

@@ -0,0 +1,57 @@
+import { getConfig } from '../config-store.js';
+import { getResetPasswordUrl } from '../utils/openauth.js';
+export async function GET(context) {
+    const options = getConfig();
+    if (!options.providers.includes('password')) {
+        return new Response('Not found', { status: 404 });
+    }
+    const token = context.url.searchParams.get('token');
+    if (!token) {
+        return new Response('Missing reset token', { status: 400 });
+    }
+    const error = context.url.searchParams.get('error');
+    const html = renderResetPasswordPage(options, context.url, { token, error });
+    return new Response(html, {
+        headers: { 'Content-Type': 'text/html; charset=utf-8' },
+    });
+}
+function renderResetPasswordPage(options, url, data) {
+    const { loginPage } = options;
+    const actionUrl = getResetPasswordUrl();
+    const redirectUri = new URL(`${options.loginPath}?reset=true`, url.origin).toString();
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Reset password</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 400px; margin: 80px auto; padding: 0 20px; }
+    h1 { text-align: center; }
+    .logo { display: block; margin: 0 auto 16px; max-height: 48px; }
+    .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
+    input[type="password"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
+    .error { color: #c00; text-align: center; margin: 12px 0; }
+    .brand { text-align: center; color: #666; margin-bottom: 4px; }
+    .back-link { display: block; text-align: center; margin-top: 16px; font-size: 14px; color: #555; }
+    p.hint { text-align: center; color: #666; font-size: 14px; }
+  </style>
+</head>
+<body>
+  ${loginPage.logoUrl ? `<img src="${loginPage.logoUrl}" alt="${loginPage.brandName || ''}" class="logo">` : ''}
+  ${loginPage.brandName ? `<p class="brand">${loginPage.brandName}</p>` : ''}
+  <h1>Reset password</h1>
+  ${data.error ? '<p class="error">This reset link is invalid or has expired. Please request a new one.</p>' : ''}
+  <p class="hint">Enter your new password.</p>
+  <form method="POST" action="${actionUrl}">
+    <input type="password" name="password" placeholder="New password" required minlength="8">
+    <input type="password" name="password_confirmation" placeholder="Confirm password" required minlength="8">
+    <input type="hidden" name="token" value="${data.token}">
+    <input type="hidden" name="redirect_uri" value="${redirectUri}">
+    <button type="submit" class="btn">Reset password</button>
+  </form>
+  <a href="${options.loginPath}" class="back-link">Back to sign in</a>
+</body>
+</html>`;
+}
+//# sourceMappingURL=reset-password.js.map

package/dist/routes/reset-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-password.js","sourceRoot":"","sources":["../../src/routes/reset-password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAO1D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA6B;IACtD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAE5E,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;AACH,CAAC;AAOD,SAAS,uBAAuB,CAC/B,OAAqC,EACrC,GAAQ,EACR,IAA2B;IAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAA;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAErF,OAAO;;;;;;;;;;;;;;;;;;;IAmBJ,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;;IAExE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,2FAA2F,CAAC,CAAC,CAAC,EAAE;;gCAEjF,SAAS;;;+CAGM,IAAI,CAAC,KAAK;sDACH,WAAW;;;aAGpD,OAAO,CAAC,SAAS;;QAEtB,CAAA;AACR,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,41 @@
+export interface AuthenticatedUser {
+    id: string;
+    email: string;
+    name?: string;
+    image?: string;
+    authenticated: true;
+}
+export interface UnauthenticatedUser {
+    authenticated: false;
+}
+export type User = AuthenticatedUser | UnauthenticatedUser;
+export interface TokenRefreshResult {
+    accessToken: string;
+    refreshToken: string;
+    claims: {
+        sub: string;
+        email: string;
+        name?: string;
+        image?: string;
+    };
+}
+export interface TokenExchangeResult {
+    accessToken: string;
+    refreshToken: string;
+    isNewUser: boolean;
+    provider: string;
+    claims: {
+        sub: string;
+        email: string;
+        name?: string;
+        image?: string;
+    };
+}
+declare global {
+    namespace App {
+        interface Locals {
+            user: User;
+        }
+    }
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,KAAK,CAAA;CACpB;AAED,MAAM,MAAM,IAAI,GAAG,iBAAiB,GAAG,mBAAmB,CAAA;AAE1D,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAGD,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,MAAM;YACf,IAAI,EAAE,IAAI,CAAA;SACV;KACD;CACD"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/utils/analytics.d.ts

@@ -0,0 +1,7 @@
+export declare function emitAuthEvent(context: unknown, eventName: string, data: Record<string, string>): Promise<void>;
+export declare function analyticsAvailable(context: {
+    locals?: Record<string, unknown>;
+}): boolean;
+export declare function trackAuthEvent(context: unknown, eventName: string, data?: Record<string, string>): Promise<void>;
+export declare function _resetAnalytics(): void;
+//# sourceMappingURL=analytics.d.ts.map

package/dist/utils/analytics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AA6BA,wBAAsB,aAAa,CAClC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,OAAO,CAEzF;AAED,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,eAAe,IAAI,IAAI,CAGtC"}

package/dist/utils/analytics.js

@@ -0,0 +1,44 @@
+let trackFn = null;
+let resolved = false;
+const ANALYTICS_UTILS_MODULE = '@growth-labs/analytics/utils';
+async function importOptionalModule(modulePath) {
+    try {
+        return (await import(/* @vite-ignore */ modulePath));
+    }
+    catch {
+        return null;
+    }
+}
+async function resolveAnalytics() {
+    if (resolved)
+        return;
+    resolved = true;
+    const mod = await importOptionalModule(ANALYTICS_UTILS_MODULE);
+    let candidate;
+    try {
+        candidate = mod?.trackServerEvent;
+    }
+    catch {
+        candidate = undefined;
+    }
+    if (typeof candidate === 'function') {
+        trackFn = candidate;
+    }
+}
+export async function emitAuthEvent(context, eventName, data) {
+    await resolveAnalytics();
+    if (!trackFn)
+        return;
+    return trackFn(context, eventName, data);
+}
+export function analyticsAvailable(context) {
+    return typeof context.locals?.analyticsConfig !== 'undefined';
+}
+export async function trackAuthEvent(context, eventName, data = {}) {
+    return emitAuthEvent(context, eventName, data);
+}
+export function _resetAnalytics() {
+    trackFn = null;
+    resolved = false;
+}
+//# sourceMappingURL=analytics.js.map

package/dist/utils/analytics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/utils/analytics.ts"],"names":[],"mappings":"AAEA,IAAI,OAAO,GAAmB,IAAI,CAAA;AAClC,IAAI,QAAQ,GAAG,KAAK,CAAA;AACpB,MAAM,sBAAsB,GAAG,8BAA8B,CAAA;AAE7D,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAA4B,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC9B,IAAI,QAAQ;QAAE,OAAM;IACpB,QAAQ,GAAG,IAAI,CAAA;IACf,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;IAC9D,IAAI,SAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,SAAS,GAAG,GAAG,EAAE,gBAAgB,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,SAAS,GAAG,SAAS,CAAA;IACtB,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,GAAG,SAAoB,CAAA;IAC/B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAgB,EAChB,SAAiB,EACjB,IAA4B;IAE5B,MAAM,gBAAgB,EAAE,CAAA;IACxB,IAAI,CAAC,OAAO;QAAE,OAAM;IACpB,OAAO,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA6C;IAC/E,OAAO,OAAO,OAAO,CAAC,MAAM,EAAE,eAAe,KAAK,WAAW,CAAA;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAgB,EAChB,SAAiB,EACjB,OAA+B,EAAE;IAEjC,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,GAAG,IAAI,CAAA;IACd,QAAQ,GAAG,KAAK,CAAA;AACjB,CAAC"}

package/dist/utils/cookies.d.ts

@@ -0,0 +1,17 @@
+import type { ResolvedAuthOptions } from '../options.js';
+export interface CookieAttributes {
+    path?: string;
+    maxAge?: number;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    domain?: string;
+}
+export declare function getCookie(request: Request, name: string): string | null;
+export declare function setCookie(response: Response, name: string, value: string, attributes?: CookieAttributes): void;
+export declare function clearCookie(response: Response, name: string, domain?: string): void;
+export declare function setTokenCookies(response: Response, options: ResolvedAuthOptions, accessToken: string, refreshToken: string): void;
+export declare function clearTokenCookies(response: Response, options: ResolvedAuthOptions): void;
+export declare function clearAuthFlowCookies(response: Response, options: ResolvedAuthOptions): void;
+export declare function setAuthFlowCookies(response: Response, options: ResolvedAuthOptions, verifier: string, state: string, redirectPath: string): void;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/utils/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKvE;AAED,wBAAgB,SAAS,CACxB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,gBAAqB,GAC/B,IAAI,CASN;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAMnF;AAED,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAClB,IAAI,CAgBN;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAGxF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAI3F;AAED,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAClB,IAAI,CAWN"}

package/dist/utils/cookies.js

@@ -0,0 +1,69 @@
+export function getCookie(request, name) {
+    const header = request.headers.get('cookie');
+    if (!header)
+        return null;
+    const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+    return match ? decodeURIComponent(match[1]) : null;
+}
+export function setCookie(response, name, value, attributes = {}) {
+    const parts = [`${name}=${encodeURIComponent(value)}`];
+    if (attributes.path)
+        parts.push(`Path=${attributes.path}`);
+    if (attributes.maxAge !== undefined)
+        parts.push(`Max-Age=${attributes.maxAge}`);
+    if (attributes.httpOnly)
+        parts.push('HttpOnly');
+    if (attributes.secure)
+        parts.push('Secure');
+    if (attributes.sameSite)
+        parts.push(`SameSite=${attributes.sameSite}`);
+    if (attributes.domain)
+        parts.push(`Domain=${attributes.domain}`);
+    response.headers.append('Set-Cookie', parts.join('; '));
+}
+export function clearCookie(response, name, domain) {
+    setCookie(response, name, '', {
+        path: '/',
+        maxAge: 0,
+        ...(domain && { domain }),
+    });
+}
+export function setTokenCookies(response, options, accessToken, refreshToken) {
+    const base = {
+        path: '/',
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        ...(options.sessionCookieDomain && { domain: options.sessionCookieDomain }),
+    };
+    setCookie(response, `${options.cookiePrefix}_at`, accessToken, {
+        ...base,
+        maxAge: options.accessTokenMaxAge,
+    });
+    setCookie(response, `${options.cookiePrefix}_rt`, refreshToken, {
+        ...base,
+        maxAge: options.refreshTokenMaxAge,
+    });
+}
+export function clearTokenCookies(response, options) {
+    clearCookie(response, `${options.cookiePrefix}_at`, options.sessionCookieDomain);
+    clearCookie(response, `${options.cookiePrefix}_rt`, options.sessionCookieDomain);
+}
+export function clearAuthFlowCookies(response, options) {
+    clearCookie(response, `${options.cookiePrefix}_pkce`);
+    clearCookie(response, `${options.cookiePrefix}_state`);
+    clearCookie(response, `${options.cookiePrefix}_redirect`);
+}
+export function setAuthFlowCookies(response, options, verifier, state, redirectPath) {
+    const attrs = {
+        path: '/',
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        maxAge: 600,
+    };
+    setCookie(response, `${options.cookiePrefix}_pkce`, verifier, attrs);
+    setCookie(response, `${options.cookiePrefix}_state`, state, attrs);
+    setCookie(response, `${options.cookiePrefix}_redirect`, redirectPath, attrs);
+}
+//# sourceMappingURL=cookies.js.map

package/dist/utils/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,SAAS,CACxB,QAAkB,EAClB,IAAY,EACZ,KAAa,EACb,aAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtE,IAAI,UAAU,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAkB,EAAE,IAAY,EAAE,MAAe;IAC5E,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7B,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,QAAkB,EAClB,OAA4B,EAC5B,WAAmB,EACnB,YAAoB;IAEpB,MAAM,IAAI,GAAqB;QAC9B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;KAC3E,CAAA;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,WAAW,EAAE;QAC9D,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,CAAC,iBAAiB;KACjC,CAAC,CAAA;IACF,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,YAAY,EAAE;QAC/D,GAAG,IAAI;QACP,MAAM,EAAE,OAAO,CAAC,kBAAkB;KAClC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB,EAAE,OAA4B;IACjF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAChF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,OAA4B;IACpF,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACrD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACtD,WAAW,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,QAAkB,EAClB,OAA4B,EAC5B,QAAgB,EAChB,KAAa,EACb,YAAoB;IAEpB,MAAM,KAAK,GAAqB;QAC/B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACX,CAAA;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;IACpE,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAClE,SAAS,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;AAC7E,CAAC"}

package/dist/utils/encoding.d.ts

@@ -0,0 +1,2 @@
+export declare function base64url(bytes: Uint8Array): string;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/utils/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/utils/encoding.ts"],"names":[],"mappings":"AAAA,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAInD"}

package/dist/utils/encoding.js

@@ -0,0 +1,7 @@
+export function base64url(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+//# sourceMappingURL=encoding.js.map

package/dist/utils/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/utils/encoding.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,SAAS,CAAC,KAAiB;IAC1C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC"}

package/dist/utils/index.d.ts

@@ -0,0 +1,6 @@
+export { emitAuthEvent, trackAuthEvent } from './analytics.js';
+export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
+export { generatePKCE } from './pkce.js';
+export { generateState, verifyState } from './state.js';
+export type { VerifiedClaims } from './tokens.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/utils/index.js

@@ -0,0 +1,5 @@
+export { emitAuthEvent, trackAuthEvent } from './analytics.js';
+export { getAuthorizationUrl, getMagicLinkUrl, getPasswordLoginUrl } from './openauth.js';
+export { generatePKCE } from './pkce.js';
+export { generateState, verifyState } from './state.js';
+//# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}

package/dist/utils/openauth.d.ts

@@ -0,0 +1,29 @@
+import type { TokenExchangeResult } from '../types.js';
+export interface AuthFlow {
+    verifier: string;
+    challenge: string;
+    state: string;
+    clientId: string;
+    redirectUri: string;
+}
+export declare function createAuthFlow(context: {
+    url: URL;
+}): Promise<AuthFlow>;
+export declare function getAuthorizationUrl(context: {
+    url: URL;
+}, provider: string, _redirectPath: string, authFlow?: AuthFlow): Promise<{
+    url: string;
+    pkceVerifier: string;
+    state: string;
+}>;
+export declare function getPasswordLoginUrl(_context: {
+    url: URL;
+}): string;
+export declare function getMagicLinkUrl(_context: {
+    url: URL;
+}): string;
+export declare function getForgotPasswordUrl(): string;
+export declare function getResetPasswordUrl(): string;
+export declare function exchangeCode(callbackUrl: URL, code: string, codeVerifier: string): Promise<TokenExchangeResult | null>;
+export declare function revokeToken(refreshToken: string, clientId?: string): Promise<void>;
+//# sourceMappingURL=openauth.d.ts.map

package/dist/utils/openauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openauth.d.ts","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAKtD,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY7E;AAED,wBAAsB,mBAAmB,CACxC,OAAO,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,EACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB/D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAGlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,MAAM,CAG9D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAG5C;AAED,wBAAsB,YAAY,CACjC,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA4CrC;AAED,wBAAsB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAexF"}

package/dist/utils/openauth.js

@@ -0,0 +1,106 @@
+import { getConfig } from '../config-store.js';
+import { generatePKCE } from './pkce.js';
+import { generateState } from './state.js';
+import { decodeJwtPayload } from './tokens.js';
+export async function createAuthFlow(context) {
+    const options = getConfig();
+    const { verifier, challenge } = await generatePKCE();
+    const state = generateState();
+    return {
+        verifier,
+        challenge,
+        state,
+        clientId: options.clientId || context.url.hostname,
+        redirectUri: new URL(options.callbackPath, context.url.origin).toString(),
+    };
+}
+export async function getAuthorizationUrl(context, provider, _redirectPath, authFlow) {
+    const options = getConfig();
+    const flow = authFlow ?? (await createAuthFlow(context));
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: flow.clientId,
+        redirect_uri: flow.redirectUri,
+        scope: 'openid email profile',
+        state: flow.state,
+        code_challenge: flow.challenge,
+        code_challenge_method: 'S256',
+        provider,
+    });
+    return {
+        url: `${options.issuer}/authorize?${params}`,
+        pkceVerifier: flow.verifier,
+        state: flow.state,
+    };
+}
+export function getPasswordLoginUrl(_context) {
+    const options = getConfig();
+    return `${options.issuer}/authorize/password`;
+}
+export function getMagicLinkUrl(_context) {
+    const options = getConfig();
+    return `${options.issuer}/authorize/email-code`;
+}
+export function getForgotPasswordUrl() {
+    const options = getConfig();
+    return `${options.issuer}/forgot-password`;
+}
+export function getResetPasswordUrl() {
+    const options = getConfig();
+    return `${options.issuer}/reset-password`;
+}
+export async function exchangeCode(callbackUrl, code, codeVerifier) {
+    const options = getConfig();
+    const clientId = options.clientId || callbackUrl.hostname;
+    const redirectUri = new URL(options.callbackPath, callbackUrl.origin).toString();
+    try {
+        const response = await fetch(`${options.issuer}/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                code_verifier: codeVerifier,
+                redirect_uri: redirectUri,
+                client_id: clientId,
+            }).toString(),
+        });
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        const claims = decodeJwtPayload(data.access_token);
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            isNewUser: data.is_new_user || false,
+            provider: data.provider || 'unknown',
+            claims: {
+                sub: claims.sub,
+                email: claims.email,
+                name: claims.name,
+                image: claims.image,
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function revokeToken(refreshToken, clientId) {
+    const options = getConfig();
+    try {
+        await fetch(`${options.issuer}/revoke`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                token: refreshToken,
+                token_type_hint: 'refresh_token',
+                ...(clientId && { client_id: clientId }),
+            }).toString(),
+        });
+    }
+    catch {
+        // Fire and forget — ignore errors
+    }
+}
+//# sourceMappingURL=openauth.js.map

package/dist/utils/openauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openauth.js","sourceRoot":"","sources":["../../src/utils/openauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAU9C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAqB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAE7B,OAAO;QACN,QAAQ;QACR,SAAS;QACT,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAClD,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,QAAgB,EAChB,aAAqB,EACrB,QAAmB;IAEnB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAExD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;QAC7B,QAAQ;KACR,CAAC,CAAA;IAEF,OAAO;QACN,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,cAAc,MAAM,EAAE;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAA;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACzD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,qBAAqB,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAsB;IACrD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,uBAAuB,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,kBAAkB,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,iBAAiB,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,WAAgB,EAChB,IAAY,EACZ,YAAoB;IAEpB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAA;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEhF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,QAAQ,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,QAAQ;aACnB,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAA;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAElD,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,KAAK;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;YACpC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAa;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAe;gBAC7B,IAAI,EAAE,MAAM,CAAC,IAA0B;gBACvC,KAAK,EAAE,MAAM,CAAC,KAA2B;aACzC;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,QAAiB;IACxE,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,SAAS,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,KAAK,EAAE,YAAY;gBACnB,eAAe,EAAE,eAAe;gBAChC,GAAG,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACxC,CAAC,CAAC,QAAQ,EAAE;SACb,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC"}

package/dist/utils/pkce.d.ts

@@ -0,0 +1,5 @@
+export declare function generatePKCE(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/utils/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/utils/pkce.ts"],"names":[],"mappings":"AAEA,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CASrF"}