@growth-labs/auth 0.2.1 → 0.2.3

package/README.md

@@ -2,94 +2,48 @@
 
 OpenAuth **client** package for Astro + Cloudflare. Verifies JWTs, manages session cookies, gates protected paths, and injects login/logout/callback routes.
 
-**This is a client only.** The OpenAuth issuer is a separate Worker — point this package at any standards-compliant OpenAuth issuer.
+**This is a client only.** It does NOT run an OpenAuth issuer. The canonical issuer runtime lives in `growth-labs/identity-platform`; `apps/auth-server/` in this repo is only a minimal sample Worker.
 
 **Identity, not authorization.** Answers "who is this user?" — not "what can they access?" Roles, entitlements, and premium checks are consumer concerns (e.g. `@fulcrum/auth`).
 
-## Live issuer
-
-The canonical issuer for Fulcrum and Growth Labs sites is the standalone identity-platform at `https://auth.fulcrum-labs.com`. Discovery is at `/.well-known/oauth-authorization-server`:
-
-```
-issuer:                    https://auth.fulcrum-labs.com
-authorization_endpoint:    https://auth.fulcrum-labs.com/authorize
-token_endpoint:            https://auth.fulcrum-labs.com/token
-revocation_endpoint:       https://auth.fulcrum-labs.com/revoke
-jwks_uri:                  https://auth.fulcrum-labs.com/.well-known/jwks.json
-```
-
-The repo's `apps/auth-server/` is a **reference sample** for bootstrapping new issuer Workers — it is not the canonical issuer.
-
 ## Config
 
 ```typescript
 import auth from '@growth-labs/auth'
 
 auth({
-  issuer: 'https://auth.fulcrum-labs.com',     // OpenAuth issuer URL (separate Worker)
-  cookiePrefix: 'fronts',                       // → fronts_at, fronts_rt cookies
-  sessionCookieDomain: '.fronts.co',            // Cross-subdomain sharing (optional)
-  gatedPaths: ['/premium/*', '/account/*'],     // Glob patterns for protected routes
-  loginPath: '/login',                          // Redirect target for unauthenticated users
+  issuer: 'https://auth.fedweek.com',           // OpenAuth issuer URL (separate Worker)
+  cookiePrefix: 'fedweek',                       // → fedweek_at, fedweek_rt, fedweek_provider cookies
+  sessionCookieDomain: '.fedweek.com',           // Cross-subdomain sharing (optional)
+  gatedPaths: ['/premium/*', '/account/*'],      // Glob patterns for protected routes
+  loginPath: '/login',                           // Redirect target for unauthenticated users
   logoutRedirect: '/',
   callbackPath: '/api/auth/callback',
-  forgotPasswordPath: '/forgot-password',       // Auto-injected when password provider is enabled
-  resetPasswordPath: '/reset-password',
   providers: ['google', 'password', 'email-code'],
   loginPage: {
     title: 'Sign in',
-    brandName: 'fronts.co',
-    logoUrl: 'https://media.fronts.co/logo.png',
+    brandName: 'FEDweek',
+    logoUrl: 'https://media.fedweek.com/logos/header.png',
   },
-  accessTokenMaxAge: 900,                       // 15 min (seconds)
-  refreshTokenMaxAge: 2592000,                  // 30 days
+  accessTokenMaxAge: 900,                        // 15 min (seconds)
+  refreshTokenMaxAge: 2592000,                   // 30 days
 })
 ```
 
 ## What It Injects
 
 **Middleware** (runs on every request):
-
 1. Reads `{cookiePrefix}_at` and `{cookiePrefix}_rt` cookies
-2. Verifies access token JWT against issuer's JWKS (`{issuer}/.well-known/jwks.json`, cached/refreshed by `jose.createRemoteJWKSet`)
+2. Verifies access token JWT against issuer's JWKS (`{issuer}/.well-known/jwks.json`, cached in Worker memory)
 3. If expired but refresh token valid → silent refresh, set new cookies
 4. Populates `context.locals.user` as `AuthenticatedUser | UnauthenticatedUser`
 5. If path matches `gatedPaths` and user unauthenticated → redirect to `loginPath`
 
 **Routes:**
-
-- `GET /login` — default login page with provider buttons. Each button is a link to `{issuer}/authorize?provider=...` (Google, password, and email-code via OpenAuth's `code` provider). Override by creating `src/pages/login.astro`.
-- `GET /logout` — clears cookies, revokes refresh token at `{issuer}/revoke`, redirects.
-- `GET /api/auth/callback` — OAuth callback handler (PKCE code exchange, cookie setting, analytics emission).
-- `GET /forgot-password` — thin 302 to `{issuer}/forgot-password` (issuer owns the UI). Only injected when the `password` provider is enabled.
-- `GET /reset-password?token=...` — thin 302 to `{issuer}/reset-password?token=...`. Only injected when the `password` provider is enabled.
-
-## Subject claims contract
-
-The package expects an OpenAuth-shaped access token. The subject payload lives under `properties` in the JWT and contains:
-
-| Claim       | Type    | Notes                                       |
-|-------------|---------|---------------------------------------------|
-| `userId`    | string  | Stable user identifier                      |
-| `email`     | string  |                                             |
-| `name`      | string  | Optional                                    |
-| `image`     | string  | Optional                                    |
-| `isNewUser` | boolean | Whether this user was just created          |
-
-The JWT's top-level `sub` is an OpenAuth-internal subject hash (`{type}:{sha1}`) and is **never** the user id.
-
-## /token response contract
-
-```jsonc
-// POST {issuer}/token
-{
-  "access_token": "<jwt>",
-  "refresh_token": "<opaque>",
-  "expires_in": 900
-}
-```
-
-The package does **not** read `is_new_user` or `provider` from the /token response — those are not part of the standalone identity-platform contract. `isNewUser` comes from the JWT subject claims; provider attribution comes from a `{cookiePrefix}_provider` cookie set when the user clicked a provider button.
+- `GET /login` — provider-selection page; `?provider=google|password|email-code` starts auth locally and redirects into the issuer's generic `/authorize` endpoint
+- `GET /logout` — clears cookies, revokes refresh token at issuer, redirects
+- `GET /api/auth/callback` — OAuth callback handler (PKCE code exchange, cookie setting)
+- `GET /forgot-password` / `GET /reset-password` — local redirects to issuer-owned password UI
 
 ## Using `context.locals.user`
 
@@ -108,94 +62,46 @@ if (user.authenticated) {
 
 ```typescript
 interface AuthenticatedUser {
-  id: string
-  email: string
-  name?: string
-  image?: string
-  authenticated: true
+  id: string; email: string; name?: string; image?: string; authenticated: true
 }
 interface UnauthenticatedUser { authenticated: false }
 type User = AuthenticatedUser | UnauthenticatedUser
 // Available on context.locals.user (Astro.locals.user in .astro files)
 ```
 
-## Wrangler bindings
+## Wrangler Bindings
 
-None required by this package. The issuer needs KV + D1 — see `apps/auth-server/README.md` (reference sample) or your standalone identity-platform's deployment docs.
+None required by this package. The issuer needs KV + D1 — see `growth-labs/identity-platform` for the production runtime shape, or `apps/auth-server/README.md` here for the minimal sample.
 
-## Integration order
+## Integration Order
 
 Auth middleware MUST run before consent and analytics middleware. List `auth()` first in `astro.config.mjs` integrations array.
 
-## Issuer unreachable (cold start)
+## Issuer Unreachable (Cold Start)
 
-JWKS is fetched lazily by `jose.createRemoteJWKSet` (cached + refreshed automatically when the key set rotates). If the issuer is unreachable on a first verification:
+JWKS cached in Worker memory. If issuer unreachable on cold start:
+- **Non-gated paths:** fail open — `user = { authenticated: false }`, page serves normally
+- **Gated paths:** fail closed — redirect to loginPath
 
-- **Non-gated paths:** fail open — `user = { authenticated: false }`, page serves normally.
-- **Gated paths:** fail closed — middleware redirects to `loginPath`.
+## OAuth Flow Summary
 
-## OAuth flow summary
+1. User clicks a provider on the local login page → browser hits `/login?provider=...`
+2. The local `/login` start route stores PKCE/state/redirect/provider cookies and redirects to `{issuer}/authorize?provider=...`
+3. Issuer authenticates → redirects to `/api/auth/callback?code=...&state=...`
+4. Callback exchanges code for tokens via PKCE, reads `properties.isNewUser` from the JWT payload with fallback to top-level `isNewUser` for legacy issuers, uses the `{cookiePrefix}_provider` auth-flow cookie set at login start for provider attribution, sets session cookies, and redirects to the original page
 
-1. User clicks a provider on the login page → browser navigates to `{issuer}/authorize?response_type=code&...` with PKCE challenge. The login page's inline JS records the chosen provider in `{cookiePrefix}_provider`.
-2. Issuer authenticates → redirects to `/api/auth/callback?code=...&state=...`.
-3. Callback exchanges code for tokens via PKCE, decodes the JWT to read subject claims, emits `signup_completed` (if `isNewUser`) or `login_completed`, sets session cookies, redirects to original page.
+## Analytics Integration
 
-## Password / forgot / reset
+Optional peer dependency on `@growth-labs/analytics`. If installed, emits `login_completed` / `signup_completed` events automatically. If not installed, silently skipped. The event name is derived from the access-token JWT `isNewUser` claim, preferring `payload.properties.isNewUser` and falling back to top-level `payload.isNewUser` for legacy issuers. The event payload provider comes from the `{cookiePrefix}_provider` auth-flow cookie.
 
-Password, forgot-password, and reset-password are **issuer-owned flows**. The package does NOT implement password verification locally:
+## Key Patterns
 
-- **Login with password** → the package's login page renders a button that 302s the user into `{issuer}/authorize?provider=password&...`. The issuer hosts the password UI.
-- **Forgot password** → `/forgot-password` (consumer URL) → 302 → `{issuer}/forgot-password`.
-- **Reset password** → reset email link → `/reset-password?token=...` (consumer URL) → 302 → `{issuer}/reset-password?token=...`.
-
-Consumer URLs exist so emails and bookmarks remain stable across issuer changes.
-
-## Email code (magic link)
-
-The `email-code` package alias maps to OpenAuth's `code` provider. The login page links into `{issuer}/authorize?provider=code&...`; the issuer hosts the email/code UI and (per its own configuration) sends the one-time code via whatever transport it's wired to.
-
-## Analytics integration
-
-Optional peer dependency on `@growth-labs/analytics`. If installed, the callback emits:
-
-- `signup_completed` when the JWT's `properties.isNewUser` is `true`
-- `login_completed` otherwise
-- Both include `{ provider, userId }` properties
-
-If `@growth-labs/analytics` is not installed, analytics calls are silently skipped.
-
-## Custom login pages
-
-Use the exported helpers to build branded login pages while keeping the package's PKCE/state plumbing:
-
-```typescript
-import {
-  createAuthFlow,
-  getAuthorizationUrl,
-  getPasswordLoginUrl,
-  getMagicLinkUrl,
-  setAuthFlowCookies,
-  setProviderCookie,
-} from '@growth-labs/auth/utils'
-
-// In a custom /login page or API route:
-const flow = await createAuthFlow(Astro)
-const google = await getAuthorizationUrl(Astro, 'google', redirectPath, flow)
-const password = await getPasswordLoginUrl(Astro, redirectPath, flow)
-const emailCode = await getMagicLinkUrl(Astro, redirectPath, flow)
-
-// On the response, set the flow cookies the callback handler needs:
-setAuthFlowCookies(response, options, flow.verifier, flow.state, redirectPath)
-// Optionally record provider attribution server-side instead of via JS:
-setProviderCookie(response, options, 'google')
-```
-
-## Key patterns
-
-- Virtual module: `globalThis.__GL_AUTH_CONFIG__` is set at build time via `vite.define` for runtime access; module-level `_setConfig` is the dev-time fallback.
+- Virtual module: `virtual:growth-labs/auth/config` (slash, not hyphen)
 - Cookie names: `{cookiePrefix}_at`, `{cookiePrefix}_rt`, `{cookiePrefix}_pkce`, `{cookiePrefix}_state`, `{cookiePrefix}_redirect`, `{cookiePrefix}_provider`
 - PKCE flow with `code_verifier` / `code_challenge` (S256)
-- CSRF state parameter verified on callback (constant-time compare)
-- No `aud` claim validation in this package — single client per issuer assumed
 - `email-code` is a client-side alias for the issuer's OpenAuth `code` provider
-- All token endpoint URLs are constructed via `new URL('/path', issuer)` so issuer values with or without trailing slashes both work
+- CSRF state parameter verified on callback
+- Access-token user claims live under `payload.properties.*`; the client falls back to top-level `payload.email`, `payload.name`, `payload.image`, and `payload.isNewUser` for legacy issuers
+- Forgot/reset password routes are issuer-owned redirects, not local form UIs
+- No `aud` claim validation in this package — single client per issuer assumed
+- `.astro` component files ship as source, not compiled

package/dist/client/login-page.d.ts

@@ -1,17 +1,2 @@
-/**
- * Inline JS for the package's default login page.
- *
- * On a provider click:
- *   1. Records the provider in `{cookiePrefix}_provider` so the callback
- *      handler can attribute analytics correctly. The standalone
- *      identity-platform issuer does not echo the provider back in the
- *      /token response, so we must remember it client-side.
- *   2. Emits a `login_clicked` analytics event if `window.glAnalytics`
- *      is wired up (via `@growth-labs/analytics`).
- *
- * The provider cookie is intentionally NOT httpOnly — it must be writable
- * from JS. Provider attribution is non-sensitive (just an analytics
- * label) so this is an acceptable tradeoff.
- */
-export declare function loginPageScript(cookiePrefix: string): string;
+export declare function loginPageScript(): string;
 //# sourceMappingURL=login-page.d.ts.map

package/dist/client/login-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-page.d.ts","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAe5D"}
+{"version":3,"file":"login-page.d.ts","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA,wBAAgB,eAAe,IAAI,MAAM,CAWxC"}

package/dist/client/login-page.js

@@ -1,27 +1,8 @@
-/**
- * Inline JS for the package's default login page.
- *
- * On a provider click:
- *   1. Records the provider in `{cookiePrefix}_provider` so the callback
- *      handler can attribute analytics correctly. The standalone
- *      identity-platform issuer does not echo the provider back in the
- *      /token response, so we must remember it client-side.
- *   2. Emits a `login_clicked` analytics event if `window.glAnalytics`
- *      is wired up (via `@growth-labs/analytics`).
- *
- * The provider cookie is intentionally NOT httpOnly — it must be writable
- * from JS. Provider attribution is non-sensitive (just an analytics
- * label) so this is an acceptable tradeoff.
- */
-export function loginPageScript(cookiePrefix) {
-    // JSON.stringify safely escapes the prefix into a JS string literal.
-    const prefixLiteral = JSON.stringify(cookiePrefix);
+export function loginPageScript() {
     return `
     document.querySelectorAll('[data-provider]').forEach(function(el) {
       el.addEventListener('click', function() {
         var provider = el.getAttribute('data-provider');
-        var prefix = ${prefixLiteral};
-        document.cookie = prefix + '_provider=' + encodeURIComponent(provider) + '; max-age=600; path=/; samesite=lax; secure';
         if (window.glAnalytics) {
           window.glAnalytics.track('login_clicked', { provider: provider });
         }

package/dist/client/login-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-page.js","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IACnD,qEAAqE;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IAClD,OAAO;;;;uBAIe,aAAa;;;;;;;GAOjC,CAAA;AACH,CAAC"}
+{"version":3,"file":"login-page.js","sourceRoot":"","sources":["../../src/client/login-page.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,eAAe;IAC9B,OAAO;;;;;;;;;GASL,CAAA;AACH,CAAC"}

package/dist/middleware/auth.js

@@ -14,7 +14,7 @@ export async function onRequest(context, next) {
         const verified = await verifyAccessToken(options.issuer, accessToken);
         if (verified) {
             user = {
-                id: verified.userId,
+                id: verified.sub,
                 email: verified.email,
                 name: verified.name,
                 image: verified.image,
@@ -27,7 +27,7 @@ export async function onRequest(context, next) {
         refreshed = await refreshTokens(options.issuer, refreshToken, clientId);
         if (refreshed) {
             user = {
-                id: refreshed.claims.userId,
+                id: refreshed.claims.sub,
                 email: refreshed.claims.email,
                 name: refreshed.claims.name,
                 image: refreshed.claims.image,

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAS,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;IACzC,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,MAAM;gBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACvE,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;gBAC3B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;gBAC3B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAS,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;IACzC,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACvE,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;gBAC3B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,aAAa,EAAE,IAAI;aACnB,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/routes/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAMA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAYD,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqErE"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAMA,UAAU,eAAe;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;CAC/C;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8DrE"}

package/dist/routes/callback.js

@@ -3,16 +3,6 @@ import { analyticsAvailable, emitAuthEvent } from '../utils/analytics.js';
 import { clearAuthFlowCookies, getCookie, setTokenCookies } from '../utils/cookies.js';
 import { exchangeCode } from '../utils/openauth.js';
 import { verifyState } from '../utils/state.js';
-const ALLOWED_PROVIDERS = new Set(['google', 'password', 'email-code', 'code']);
-function normalizeProvider(value) {
-    if (!value)
-        return 'unknown';
-    if (!ALLOWED_PROVIDERS.has(value))
-        return 'unknown';
-    // `code` is the OpenAuth provider name; the package surfaces it as
-    // `email-code` for consumer-facing analytics consistency.
-    return value === 'code' ? 'email-code' : value;
-}
 export async function GET(context) {
     const options = getConfig();
     const { url, request } = context;
@@ -28,24 +18,14 @@ export async function GET(context) {
     if (!codeVerifier) {
         return new Response('Missing PKCE verifier', { status: 400 });
     }
-    if (!code) {
-        return new Response('Missing authorization code', { status: 400 });
-    }
-    // Exchange code for tokens. The /token response from the standalone
-    // identity-platform issuer is { access_token, refresh_token } — it does
-    // NOT include is_new_user or provider. Both come from elsewhere.
-    const tokenResponse = await exchangeCode(url, code, codeVerifier);
+    const provider = getCookie(request, `${options.cookiePrefix}_provider`);
+    // Exchange code for tokens
+    const tokenResponse = await exchangeCode(url, code, codeVerifier, provider === 'google' || provider === 'password' || provider === 'email-code'
+        ? provider
+        : undefined);
     if (!tokenResponse) {
         return Response.redirect(new URL(`${options.loginPath}?error=auth_failed`, url.origin).toString(), 302);
     }
-    // Provider attribution: read from the client-side flow cookie set when
-    // the user clicked the provider button. Falls back to 'unknown' if the
-    // caller (e.g. a custom login page) didn't set it.
-    const provider = normalizeProvider(getCookie(request, `${options.cookiePrefix}_provider`));
-    // isNewUser: derive from the access token's subject claims, NOT from a
-    // top-level token response field. The standalone issuer encodes
-    // isNewUser inside the subject payload (`properties.isNewUser`).
-    const isNewUser = tokenResponse.claims.isNewUser === true;
     // Build redirect response
     const redirectPath = getCookie(request, `${options.cookiePrefix}_redirect`) || '/';
     const response = Response.redirect(new URL(redirectPath, url.origin).toString(), 302);
@@ -59,10 +39,10 @@ export async function GET(context) {
     clearAuthFlowCookies(mutableResponse, options);
     // Emit analytics event (non-blocking)
     if (analyticsAvailable(context)) {
-        const eventName = isNewUser ? 'signup_completed' : 'login_completed';
+        const eventName = tokenResponse.isNewUser ? 'signup_completed' : 'login_completed';
         const promise = emitAuthEvent(context, eventName, {
-            provider,
-            userId: tokenResponse.claims.userId,
+            provider: tokenResponse.provider,
+            userId: tokenResponse.claims.sub,
         });
         context.waitUntil?.(promise);
     }

package/dist/routes/callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAS/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;AAE/E,SAAS,iBAAiB,CAAC,KAAoB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACnD,mEAAmE;IACnE,0DAA0D;IAC1D,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,QAAQ,CACvB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EACxE,GAAG,CACH,CAAA;IACF,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAC,CAAA;IAE1F,uEAAuE;IACvE,gEAAgE;IAChE,iEAAiE;IACjE,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAA;IAEzD,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IAErF,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,sCAAsC;IACtC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QACpE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;YACjD,QAAQ;YACR,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM;SACnC,CAAC,CAAA;QACF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}
+{"version":3,"file":"callback.js","sourceRoot":"","sources":["../../src/routes/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAS/C,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAwB;IACjD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3C,oBAAoB;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,QAAQ,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,OAAO,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,CAAA;IAEvE,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CACvC,GAAG,EACH,IAAK,EACL,YAAY,EACZ,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,YAAY;QAC5E,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,SAAS,CACZ,CAAA;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,QAAQ,CACvB,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EACxE,GAAG,CACH,CAAA;IACF,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW,CAAC,IAAI,GAAG,CAAA;IAClF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IAErF,mCAAmC;IACnC,MAAM,eAAe,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;IAEF,eAAe,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IAChG,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9C,sCAAsC;IACtC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QAClF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;YACjD,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;SAChC,CAAC,CAAA;QACF,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED,OAAO,eAAe,CAAA;AACvB,CAAC"}

package/dist/routes/forgot-password.d.ts

@@ -2,17 +2,6 @@ interface ForgotPasswordContext {
     request: Request;
     url: URL;
 }
-/**
- * Thin proxy into the issuer-hosted forgot-password flow.
- *
- * Password (and forgot/reset) are issuer-owned flows: the standalone
- * identity-platform issuer hosts the UI. This route only exists so that
- * consumer URLs are stable (e.g. emails can deep-link to
- * `https://site.example/forgot-password`). The route 302s to the
- * issuer's hosted page.
- *
- * Returns 404 when the `password` provider isn't configured.
- */
-export declare function GET(_context: ForgotPasswordContext): Promise<Response>;
+export declare function GET(context: ForgotPasswordContext): Promise<Response>;
 export {};
 //# sourceMappingURL=forgot-password.d.ts.map

package/dist/routes/forgot-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgot-password.d.ts","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAGA,UAAU,qBAAqB;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,GAAG,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAS5E"}
+{"version":3,"file":"forgot-password.d.ts","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAGA,UAAU,qBAAqB;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAW3E"}

package/dist/routes/forgot-password.js

@@ -1,22 +1,12 @@
 import { getConfig } from '../config-store.js';
 import { getForgotPasswordUrl } from '../utils/openauth.js';
-/**
- * Thin proxy into the issuer-hosted forgot-password flow.
- *
- * Password (and forgot/reset) are issuer-owned flows: the standalone
- * identity-platform issuer hosts the UI. This route only exists so that
- * consumer URLs are stable (e.g. emails can deep-link to
- * `https://site.example/forgot-password`). The route 302s to the
- * issuer's hosted page.
- *
- * Returns 404 when the `password` provider isn't configured.
- */
-export async function GET(_context) {
+export async function GET(context) {
     const options = getConfig();
     if (!options.providers.includes('password')) {
         return new Response('Not found', { status: 404 });
     }
-    const target = getForgotPasswordUrl();
-    return Response.redirect(target, 302);
+    const target = new URL(getForgotPasswordUrl());
+    target.search = context.url.search;
+    return Response.redirect(target.toString(), 302);
 }
 //# sourceMappingURL=forgot-password.js.map

package/dist/routes/forgot-password.js.map

@@ -1 +1 @@
-{"version":3,"file":"forgot-password.js","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAO3D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,QAA+B;IACxD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AACtC,CAAC"}
+{"version":3,"file":"forgot-password.js","sourceRoot":"","sources":["../../src/routes/forgot-password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAO3D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA8B;IACvD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAC9C,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAA;IAElC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;AACjD,CAAC"}

package/dist/routes/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAKA,UAAU,YAAY;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiClE"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAKA,UAAU,YAAY;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAMD,wBAAsB,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmClE"}

package/dist/routes/login.js

@@ -2,39 +2,40 @@ import { loginPageScript } from '../client/login-page.js';
 import { getConfig } from '../config-store.js';
 import { setAuthFlowCookies } from '../utils/cookies.js';
 import { createAuthFlow, getAuthorizationUrl } from '../utils/openauth.js';
+function _shouldShowForgotLink(options) {
+    return options.providers.includes('password');
+}
 export async function GET(context) {
     const options = getConfig();
     const redirectPath = context.url.searchParams.get('redirect') || '/';
+    const selectedProvider = context.url.searchParams.get('provider');
     const error = context.url.searchParams.get('error');
     const reset = context.url.searchParams.get('reset');
-    const authFlow = await createAuthFlow(context);
-    const google = options.providers.includes('google')
-        ? await getAuthorizationUrl(context, 'google', redirectPath, authFlow)
-        : null;
-    const password = options.providers.includes('password')
-        ? await getAuthorizationUrl(context, 'password', redirectPath, authFlow)
-        : null;
-    const emailCode = options.providers.includes('email-code')
-        ? await getAuthorizationUrl(context, 'code', redirectPath, authFlow)
-        : null;
-    const html = renderLoginPage(options, {
-        google,
-        password,
-        emailCode,
-        redirectPath,
-        error,
-        reset,
-        authFlow,
-    });
-    const response = new Response(html, {
+    if (selectedProvider &&
+        options.providers.includes(selectedProvider)) {
+        const authFlow = await createAuthFlow(context);
+        const issuerProvider = selectedProvider === 'email-code' ? 'code' : selectedProvider;
+        const { url } = await getAuthorizationUrl(context, issuerProvider, redirectPath, authFlow);
+        const redirectResponse = Response.redirect(url, 302);
+        const response = new Response(redirectResponse.body, {
+            status: redirectResponse.status,
+            statusText: redirectResponse.statusText,
+            headers: new Headers(redirectResponse.headers),
+        });
+        setAuthFlowCookies(response, options, authFlow.verifier, authFlow.state, redirectPath, selectedProvider);
+        return response;
+    }
+    const html = renderLoginPage(options, { redirectPath, error, reset });
+    return new Response(html, {
         headers: { 'Content-Type': 'text/html; charset=utf-8' },
     });
-    setAuthFlowCookies(response, options, authFlow.verifier, authFlow.state, redirectPath);
-    return response;
 }
 function renderLoginPage(options, data) {
-    const { loginPage, providers } = options;
-    const cookiePrefix = options.cookiePrefix;
+    const { loginPage, providers, loginPath } = options;
+    const availableProviders = providers.filter((provider) => ['google', 'password', 'email-code'].includes(provider));
+    const hasGoogle = availableProviders.includes('google');
+    const hasAlternativeProvider = availableProviders.includes('password') || availableProviders.includes('email-code');
+    const makeStartUrl = (provider) => `${loginPath}?provider=${encodeURIComponent(provider)}&redirect=${encodeURIComponent(data.redirectPath)}`;
     return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -48,10 +49,11 @@ function renderLoginPage(options, data) {
     .btn { display: block; width: 100%; padding: 12px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; cursor: pointer; text-align: center; text-decoration: none; box-sizing: border-box; }
     .btn-google { background: #4285f4; color: white; border: none; }
     .divider { text-align: center; margin: 20px 0; color: #888; }
+    input[type="email"], input[type="password"] { display: block; width: 100%; padding: 10px; margin: 8px 0; border: 1px solid #ccc; border-radius: 6px; font-size: 16px; box-sizing: border-box; }
     .error { color: #c00; text-align: center; margin: 12px 0; }
     .success { color: #080; text-align: center; margin: 12px 0; }
     .brand { text-align: center; color: #666; margin-bottom: 4px; }
-    .forgot-link { display: block; text-align: center; font-size: 14px; margin: 12px 0; color: #555; }
+    .forgot-link { display: block; text-align: right; font-size: 14px; margin: -4px 0 8px; color: #555; }
   </style>
 </head>
 <body>
@@ -60,14 +62,19 @@ function renderLoginPage(options, data) {
   <h1>${loginPage.title}</h1>
   ${data.reset ? '<p class="success">Password reset successfully. Sign in with your new password.</p>' : ''}
   ${data.error ? '<p class="error">Authentication failed. Please try again.</p>' : ''}
-  ${data.google ? `<a href="${data.google.url}" class="btn btn-google" data-provider="google">Sign in with Google</a>` : ''}
-  ${data.google && (data.password || data.emailCode) ? '<div class="divider">or</div>' : ''}
-  ${data.password ? `<a href="${data.password.url}" class="btn" data-provider="password">Sign in with password</a>` : ''}
-  ${data.emailCode ? `<a href="${data.emailCode.url}" class="btn" data-provider="email-code">Sign in with email</a>` : ''}
-  ${providers.includes('password')
-        ? `<a href="${options.forgotPasswordPath}" class="forgot-link">Forgot password?</a>`
+  ${hasGoogle
+        ? `<a href="${makeStartUrl('google')}" class="btn btn-google" data-provider="google">Sign in with Google</a>`
+        : ''}
+  ${hasGoogle && hasAlternativeProvider ? '<div class="divider">or</div>' : ''}
+  ${availableProviders.includes('email-code')
+        ? `<a href="${makeStartUrl('email-code')}" class="btn" data-provider="email-code">Sign in with email</a>`
+        : ''}
+  ${availableProviders.includes('password')
+        ? `
+  <a href="${makeStartUrl('password')}" class="btn" data-provider="password">Sign in with password</a>
+  <a href="${options.forgotPasswordPath}" class="forgot-link">Forgot password?</a>`
         : ''}
-  <script>${loginPageScript(cookiePrefix)}</script>
+  <script>${loginPageScript()}</script>
 </body>
 </html>`;
 }

package/dist/routes/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAiB,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAOzF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAqB;IAC9C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;IAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;QACtE,CAAC,CAAC,IAAI,CAAA;IACP,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QACtD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC;QACxE,CAAC,CAAC,IAAI,CAAA;IACP,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC;QACpE,CAAC,CAAC,IAAI,CAAA;IAEP,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE;QACrC,MAAM;QACN,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,KAAK;QACL,KAAK;QACL,QAAQ;KACR,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QACnC,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;IAEF,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAEtF,OAAO,QAAQ,CAAA;AAChB,CAAC;AAmBD,SAAS,eAAe,CAAC,OAAqC,EAAE,IAAmB;IAClF,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAA;IAEzC,OAAO;;;;;WAKG,SAAS,CAAC,KAAK;;;;;;;;;;;;;;;IAetB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;QACpE,SAAS,CAAC,KAAK;IACnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,qFAAqF,CAAC,CAAC,CAAC,EAAE;IACvG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE;IACjF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,yEAAyE,CAAC,CAAC,CAAC,EAAE;IACvH,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE;IACvF,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,GAAG,kEAAkE,CAAC,CAAC,CAAC,EAAE;IACpH,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,iEAAiE,CAAC,CAAC,CAAC,EAAE;IAEvH,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7B,CAAC,CAAC,YAAY,OAAO,CAAC,kBAAkB,4CAA4C;QACpF,CAAC,CAAC,EACJ;YACW,eAAe,CAAC,YAAY,CAAC;;QAEjC,CAAA;AACR,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAO1E,SAAS,qBAAqB,CAAC,OAAqC;IACnE,OAAO,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAqB;IAC9C,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAEnD,IACC,gBAAgB;QAChB,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAsD,CAAC,EACjF,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,cAAc,GAAG,gBAAgB,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAA;QACpF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QAC1F,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,OAAO,EAAE,IAAI,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAA;QACF,kBAAkB,CACjB,QAAQ,EACR,OAAO,EACP,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,KAAK,EACd,YAAY,EACZ,gBAAgB,CAChB,CAAA;QACD,OAAO,QAAQ,CAAA;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACrE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAA;AACH,CAAC;AAQD,SAAS,eAAe,CAAC,OAAqC,EAAE,IAAmB;IAClF,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IACnD,MAAM,kBAAkB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACxD,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACvD,CAAA;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACvD,MAAM,sBAAsB,GAC3B,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IACrF,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,EAAE,CACzC,GAAG,SAAS,aAAa,kBAAkB,CAAC,QAAQ,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAA;IAE1G,OAAO;;;;;WAKG,SAAS,CAAC,KAAK;;;;;;;;;;;;;;;;IAgBtB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,SAAS,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE;IAC3G,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE;QACpE,SAAS,CAAC,KAAK;IACnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,qFAAqF,CAAC,CAAC,CAAC,EAAE;IACvG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE;IAEnF,SAAS;QACR,CAAC,CAAC,YAAY,YAAY,CAAC,QAAQ,CAAC,yEAAyE;QAC7G,CAAC,CAAC,EACJ;IACG,SAAS,IAAI,sBAAsB,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE;IAE5E,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;QACxC,CAAC,CAAC,YAAY,YAAY,CAAC,YAAY,CAAC,iEAAiE;QACzG,CAAC,CAAC,EACJ;IAEC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC;QACtC,CAAC,CAAC;aACQ,YAAY,CAAC,UAAU,CAAC;aACxB,OAAO,CAAC,kBAAkB,4CAA4C;QAChF,CAAC,CAAC,EACJ;YACW,eAAe,EAAE;;QAErB,CAAA;AACR,CAAC"}

package/dist/routes/reset-password.d.ts

@@ -2,16 +2,6 @@ interface ResetPasswordContext {
     request: Request;
     url: URL;
 }
-/**
- * Thin proxy into the issuer-hosted reset-password flow.
- *
- * The reset link emailed to the user can point at the consumer's
- * `/reset-password?token=...`; this route 302s to the issuer's hosted
- * reset page with the token preserved.
- *
- * Returns 400 when the token is missing, 404 when the `password`
- * provider isn't configured.
- */
 export declare function GET(context: ResetPasswordContext): Promise<Response>;
 export {};
 //# sourceMappingURL=reset-password.d.ts.map

package/dist/routes/reset-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/routes/reset-password.ts"],"names":[],"mappings":"AAGA,UAAU,oBAAoB;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED;;;;;;;;;GASG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc1E"}
+{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../src/routes/reset-password.ts"],"names":[],"mappings":"AAGA,UAAU,oBAAoB;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;CACR;AAED,wBAAsB,GAAG,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAW1E"}