@iaurelius/accounts-nextjs 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 iAurelius
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,133 @@
+# @iaurelius/accounts-nextjs
+
+Accounts by iAurelius for Next.js (App Router, Next 15.3+ and 16).
+
+People sign in on your application's hosted page, on your domain with passkeys, email codes and Google, and come back signed in. In your app you get:
+- `auth()` and `currentUser()` on the server;
+- `useAuth()` and `useUser()` in the browser;
+- ready-made `<SignInButton />`, `<UserButton />`, `<SignedIn>` and `<SignedOut>`.
+
+The tokens stay on the server, in an encrypted HttpOnly cookie. The SDK refreshes them before they expire.
+
+## Quick start
+
+```sh
+npx @iaurelius/accounts init
+```
+
+It installs the package, registers your development app, and writes `.env.local` and `proxy.ts`. To do it by hand, follow the three steps below.
+
+### 1. Settings (`.env.local`)
+
+Copy them from your application in the console, under Apps and APIs:
+
+```sh
+NEXT_PUBLIC_ACCOUNTS_PUBLISHABLE_KEY=pk_live_…
+ACCOUNTS_CLIENT_ID=…
+# Production (a web app, https): its secret.
+ACCOUNTS_CLIENT_SECRET=…
+# Development (the localhost app, public, PKCE only): a random secret for the cookie instead.
+# ACCOUNTS_COOKIE_SECRET=$(openssl rand -base64 32)
+# Optional: your API's identifier, for getToken().
+# ACCOUNTS_AUDIENCE=https://api.example.com
+```
+
+The development app is a public app, with no secret and PKCE only. It allows `http://localhost` redirects, which a web app cannot have. Register it with this callback, and use your real port:
+- `http://localhost:3000/api/accounts/callback` as the redirect URI;
+- `http://localhost:3000/` as the sign-out URI.
+
+In production, a web app (confidential, https) uses the same two URLs on your domain.
+
+### 2. `proxy.ts`
+
+Use `middleware.ts` before Next 16.
+
+```ts
+import { accountsMiddleware } from "@iaurelius/accounts-nextjs/server";
+
+export default accountsMiddleware({ protect: ["/dashboard(.*)"] });
+
+export const config = {
+  matcher: ["/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)", "/(api|trpc)(.*)"],
+};
+```
+
+The proxy does four things:
+- It answers `/api/accounts/{sign-in,sign-up,callback,sign-out,session,token}`, so you write no route files.
+- It keeps the session fresh.
+- It sends people who are signed out of a protected page to the sign-in, and back to that page afterwards. Protected API routes answer `401` instead.
+- It hands the session to the rest of the request.
+
+### 3. `app/layout.tsx`
+
+```tsx
+import { AccountsProvider, SignInButton, SignedIn, SignedOut, UserButton } from "@iaurelius/accounts-nextjs";
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en">
+      <body>
+        <AccountsProvider>
+          <header>
+            <SignedOut><SignInButton /></SignedOut>
+            <SignedIn><UserButton /></SignedIn>
+          </header>
+          {children}
+        </AccountsProvider>
+      </body>
+    </html>
+  );
+}
+```
+
+`<UserButton />` is the avatar menu. It shows who is signed in and has "Manage account" and "Sign out":
+- "Manage account" opens the hosted account page, which has a way back to where the person was. For that way back, allow your app's origin in the console under Emails and paths → Allowed origins.
+- "Sign out" also ends the session on the hosted pages.
+
+The buttons speak English or Spanish: `<AccountsProvider locale="es">`.
+
+## On the server
+
+```ts
+import { auth, currentUser } from "@iaurelius/accounts-nextjs/server";
+
+export default async function Page() {
+  const { userId, user } = await auth.protect(); // signed out: to the sign-in and back
+  const me = await currentUser(); // the latest profile, from the application
+  return <p>Hello {user.name ?? user.email}</p>;
+}
+```
+
+`auth()` returns:
+- `isAuthenticated`, `userId`, `sessionId`, `orgId` and `user`;
+- `getToken()`, the access token for your API;
+- `protect()` and `redirectToSignIn()`.
+
+It works in server components, route handlers and server actions.
+
+## In the browser
+
+```tsx
+"use client";
+import { useAuth, useUser } from "@iaurelius/accounts-nextjs";
+
+const { isSignedIn, getToken, signOut } = useAuth();
+const { user } = useUser();
+const res = await fetch("https://api.example.com/me", { headers: { authorization: `Bearer ${await getToken()}` } });
+```
+
+Your API checks that token with [`@iaurelius/accounts`](https://www.npmjs.com/package/@iaurelius/accounts), for example with `accountsMiddleware()` for Hono.
+
+## Security
+
+- **Sign-in:**
+  - Authorization code with PKCE (S256), `state` and `nonce`, and RFC 9207's `iss` checked.
+  - The ID token is verified: signature, audience and nonce.
+- **Session cookie:** encrypted (A256GCM) with a key derived from your app's secret, `HttpOnly`, `SameSite=Lax`, and `Secure` on https.
+- **Redirects:** after sign-in the person only ever goes back to a path of your app.
+- **Sign-out:** only from your app's own pages (Origin checked). The refresh token is revoked and the hosted session ends.
+- **Revocation:** a person who is banned or signed out everywhere is out at the next refresh.
+
+## License
+
+MIT

package/dist/client.d.ts

@@ -0,0 +1,68 @@
+import { type ReactNode } from "react";
+export type SessionUser = {
+    id: string;
+    email: string | null;
+    emailVerified: boolean;
+    name: string | null;
+    imageUrl: string | null;
+};
+export type Locale = "en" | "es";
+export type AuthState = {
+    isLoaded: boolean;
+    isSignedIn: boolean;
+    user: SessionUser | null;
+    sessionId: string | null;
+    orgId: string | null;
+};
+export type AccountsProviderProps = {
+    children?: ReactNode;
+    /** Language of the buttons. Default: the page's <html lang>, else English. */
+    locale?: Locale;
+    /** Set by the server provider; a client-only app leaves them out. */
+    initialState?: AuthState;
+    issuer?: string;
+    basePath?: string;
+};
+export declare function AccountsClientProvider({ children, initialState, issuer, basePath, locale }: AccountsProviderProps): import("react").JSX.Element;
+export declare function useAuth(): {
+    isLoaded: boolean;
+    isSignedIn: boolean;
+    userId: string | null;
+    sessionId: string | null;
+    orgId: string | null;
+    getToken: () => Promise<string | null>;
+    signOut: () => void;
+};
+export declare function useUser(): {
+    isLoaded: boolean;
+    isSignedIn: boolean;
+    user: SessionUser | null;
+};
+/** Renders its children only once it is known that someone is signed in. */
+export declare function SignedIn({ children }: {
+    children?: ReactNode;
+}): import("react").JSX.Element | null;
+/** Renders its children only once it is known that nobody is signed in. */
+export declare function SignedOut({ children }: {
+    children?: ReactNode;
+}): import("react").JSX.Element | null;
+type ButtonProps = {
+    children?: ReactNode;
+    className?: string; /** Where to come back after it. Default: this page. */
+    redirectUrl?: string;
+};
+/** Goes to the hosted sign-in and back to this page. Wraps your own button if you give it one. */
+export declare const SignInButton: (p: ButtonProps) => import("react").JSX.Element;
+/** The same, opening the hosted page on "create an account". */
+export declare const SignUpButton: (p: ButtonProps) => import("react").JSX.Element;
+/** Signs out here and on the hosted pages (a POST from this app's own page). */
+export declare function SignOutButton({ children, className }: {
+    children?: ReactNode;
+    className?: string;
+}): import("react").JSX.Element;
+/** The avatar menu: who is signed in, "Manage account" (the hosted page, and back) and "Sign out". */
+export declare function UserButton({ showName }: {
+    showName?: boolean;
+}): import("react").JSX.Element | null;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.tsx"],"names":[],"mappings":"AAIA,OAAO,EAcL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAEf,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AACrI,MAAM,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;AACjC,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAoBF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAA0B,EAAE,MAAM,EAAE,EAAE,qBAAqB,+BA6BnI;AAUD,wBAAgB,OAAO;;;;;;oBAEkB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;;EAmB9D;AAED,wBAAgB,OAAO;IAEZ,QAAQ;IAAc,UAAU;IAAgB,IAAI;EAC9D;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,sCAG9D;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,sCAG/D;AAoCD,KAAK,WAAW,GAAG;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,uDAAuD;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAyB9I,kGAAkG;AAClG,eAAO,MAAM,YAAY,MAAO,WAAW,gCAAuC,CAAC;AACnF,gEAAgE;AAChE,eAAO,MAAM,YAAY,MAAO,WAAW,gCAAuC,CAAC;AAEnF,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,+BAclG;AAUD,sGAAsG;AACtG,wBAAgB,UAAU,CAAC,EAAE,QAAgB,EAAE,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,sCAoFtE"}

package/dist/client.js

@@ -0,0 +1,211 @@
+"use client";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// In the browser: the provider, useAuth()/useUser(), <SignedIn>/<SignedOut> and the buttons. The session
+// stays in its HttpOnly cookie: the browser only learns who is signed in (GET /api/accounts/session) and,
+// when it asks, an access token for your API (GET /api/accounts/token).
+import { cloneElement, createContext, isValidElement, useCallback, useContext, useEffect, useId, useMemo, useRef, useState, } from "react";
+const AccountsContext = createContext(null);
+const LOADING = { isLoaded: false, isSignedIn: false, user: null, sessionId: null, orgId: null };
+const SIGNED_OUT = { isLoaded: true, isSignedIn: false, user: null, sessionId: null, orgId: null };
+/** The issuer from a publishable key (pk_live_ + base64 of the host and "$"), without the server package. */
+function issuerOf(pk) {
+    const m = /^pk_(?:live|test)_([A-Za-z0-9+/]+={0,2})$/.exec(pk ?? "");
+    if (!m)
+        return null;
+    try {
+        const host = atob(m[1]).replace(/\$$/, "");
+        return `${/^(?:[^:]+\.)?localhost(?::\d+)?$|^127\.0\.0\.1(?::\d+)?$/.test(host) ? "http" : "https"}://${host}`;
+    }
+    catch {
+        return null;
+    }
+}
+export function AccountsClientProvider({ children, initialState, issuer, basePath = "/api/accounts", locale }) {
+    const [state, setState] = useState(initialState ?? LOADING);
+    const [lang, setLang] = useState(locale ?? "en");
+    const last = useRef(0);
+    const refresh = useCallback(async () => {
+        last.current = Date.now();
+        try {
+            const r = await fetch(`${basePath}/session`, { credentials: "same-origin", cache: "no-store" });
+            const s = (await r.json());
+            setState(s.isSignedIn && s.user ? { isLoaded: true, isSignedIn: true, user: s.user, sessionId: s.sessionId ?? null, orgId: s.orgId ?? null } : SIGNED_OUT);
+        }
+        catch {
+            setState((prev) => (prev.isLoaded ? prev : SIGNED_OUT));
+        }
+    }, [basePath]);
+    useEffect(() => {
+        if (!locale)
+            setLang(document.documentElement.lang.toLowerCase().startsWith("es") ? "es" : "en");
+        if (!initialState)
+            void refresh();
+        // Signed out in another tab, or the session ended: noticed when the person comes back.
+        const onFocus = () => {
+            if (Date.now() - last.current > 10_000)
+                void refresh();
+        };
+        window.addEventListener("focus", onFocus);
+        return () => window.removeEventListener("focus", onFocus);
+    }, [refresh, initialState, locale]);
+    const value = useMemo(() => ({ ...state, issuer: issuer ?? issuerOf(typeof process === "undefined" ? undefined : process.env.NEXT_PUBLIC_ACCOUNTS_PUBLISHABLE_KEY), basePath, locale: lang, refresh }), [state, issuer, basePath, lang, refresh]);
+    return _jsx(AccountsContext.Provider, { value: value, children: children });
+}
+function useAccounts() {
+    const c = useContext(AccountsContext);
+    if (!c)
+        throw new Error("Wrap your app in <AccountsProvider> (app/layout.tsx) to use Accounts' components and hooks.");
+    return c;
+}
+let cachedToken = null;
+export function useAuth() {
+    const c = useAccounts();
+    const getToken = useCallback(async () => {
+        if (cachedToken && cachedToken.expiresAt - Date.now() / 1000 > 30)
+            return cachedToken.token;
+        const r = await fetch(`${c.basePath}/token`, { credentials: "same-origin", cache: "no-store" });
+        if (!r.ok) {
+            cachedToken = null;
+            return null;
+        }
+        cachedToken = (await r.json());
+        return cachedToken.token;
+    }, [c.basePath]);
+    const signOut = useCallback(() => {
+        cachedToken = null;
+        const f = document.createElement("form");
+        f.method = "post";
+        f.action = `${c.basePath}/sign-out`;
+        document.body.appendChild(f);
+        f.submit();
+    }, [c.basePath]);
+    return { isLoaded: c.isLoaded, isSignedIn: c.isSignedIn, userId: c.user?.id ?? null, sessionId: c.sessionId, orgId: c.orgId, getToken, signOut };
+}
+export function useUser() {
+    const c = useAccounts();
+    return { isLoaded: c.isLoaded, isSignedIn: c.isSignedIn, user: c.user };
+}
+/** Renders its children only once it is known that someone is signed in. */
+export function SignedIn({ children }) {
+    const c = useAccounts();
+    return c.isLoaded && c.isSignedIn ? _jsx(_Fragment, { children: children }) : null;
+}
+/** Renders its children only once it is known that nobody is signed in. */
+export function SignedOut({ children }) {
+    const c = useAccounts();
+    return c.isLoaded && !c.isSignedIn ? _jsx(_Fragment, { children: children }) : null;
+}
+// ---------------------------------------------------------------- buttons
+const LABELS = {
+    en: { signIn: "Sign in", signUp: "Sign up", signOut: "Sign out", manage: "Manage account", open: "Open account menu", menu: "Account" },
+    es: { signIn: "Entrar", signUp: "Crear cuenta", signOut: "Cerrar sesión", manage: "Gestionar cuenta", open: "Abrir el menú de la cuenta", menu: "Cuenta" },
+};
+const CSS = `
+.iaa-btn{display:inline-flex;align-items:center;justify-content:center;gap:.5em;min-height:40px;padding:0 16px;border-radius:8px;border:1px solid transparent;background:var(--accounts-accent,#3f4b5a);color:var(--accounts-on-accent,#fff);font:inherit;font-weight:600;text-decoration:none;cursor:pointer}
+.iaa-btn:focus-visible,.iaa-ub-trigger:focus-visible,.iaa-ub-item:focus-visible{outline:2px solid var(--accounts-accent,#3f4b5a);outline-offset:2px}
+.iaa-ub{position:relative;display:inline-block;font:inherit}
+.iaa-ub-trigger{display:inline-flex;align-items:center;gap:8px;min-height:40px;min-width:40px;padding:0;border:0;border-radius:999px;background:none;color:inherit;font:inherit;cursor:pointer}
+.iaa-ub-avatar{display:inline-grid;place-items:center;width:36px;height:36px;border-radius:999px;overflow:hidden;background:var(--accounts-accent,#3f4b5a);color:var(--accounts-on-accent,#fff);font-weight:600;font-size:14px;letter-spacing:.02em}
+.iaa-ub-avatar img{width:100%;height:100%;object-fit:cover}
+.iaa-ub-menu{position:absolute;right:0;top:calc(100% + 8px);z-index:50;min-width:240px;max-width:min(320px,calc(100vw - 32px));padding:6px;border-radius:12px;border:1px solid var(--accounts-border,rgba(0,0,0,.12));background:var(--accounts-surface,#fff);color:var(--accounts-text,#1f2328);box-shadow:0 12px 32px rgba(0,0,0,.14)}
+.iaa-ub-who{display:grid;gap:2px;padding:10px 10px 12px;border-bottom:1px solid var(--accounts-border,rgba(0,0,0,.12));margin-bottom:6px;overflow-wrap:anywhere}
+.iaa-ub-who strong{font-weight:600}
+.iaa-ub-who span{font-size:.875em;opacity:.72}
+.iaa-ub-item{display:flex;width:100%;align-items:center;min-height:40px;padding:0 10px;border:0;border-radius:8px;background:none;color:inherit;font:inherit;text-align:left;text-decoration:none;cursor:pointer}
+.iaa-ub-item:hover,.iaa-ub-item:focus-visible{background:var(--accounts-hover,rgba(0,0,0,.06))}
+.iaa-ub form{margin:0}
+@media (prefers-color-scheme:dark){.iaa-ub-menu{--accounts-surface:#24262b;--accounts-text:#f2f2f0;--accounts-border:rgba(255,255,255,.14);--accounts-hover:rgba(255,255,255,.08)}}
+`;
+const Styles = () => (_jsx("style", { href: "iaurelius-accounts", precedence: "default", children: CSS }));
+function useHere() {
+    const [here, setHere] = useState(null);
+    useEffect(() => setHere(location.pathname + location.search), []);
+    return here;
+}
+function AuthLink({ mode, children, className, redirectUrl }) {
+    const c = useAccounts();
+    const here = useHere();
+    const href = `${c.basePath}/${mode}?redirect_url=${encodeURIComponent(redirectUrl ?? here ?? "/")}`;
+    if (isValidElement(children)) {
+        const el = children;
+        return cloneElement(el, {
+            onClick: (e) => {
+                el.props.onClick?.(e);
+                if (!e.defaultPrevented)
+                    location.assign(href);
+            },
+        });
+    }
+    return (_jsxs(_Fragment, { children: [_jsx(Styles, {}), _jsx("a", { href: href, className: className ?? "iaa-btn", children: children ?? LABELS[c.locale][mode === "sign-in" ? "signIn" : "signUp"] })] }));
+}
+/** Goes to the hosted sign-in and back to this page. Wraps your own button if you give it one. */
+export const SignInButton = (p) => _jsx(AuthLink, { mode: "sign-in", ...p });
+/** The same, opening the hosted page on "create an account". */
+export const SignUpButton = (p) => _jsx(AuthLink, { mode: "sign-up", ...p });
+/** Signs out here and on the hosted pages (a POST from this app's own page). */
+export function SignOutButton({ children, className }) {
+    const c = useAccounts();
+    return (_jsxs("form", { method: "post", action: `${c.basePath}/sign-out`, style: { display: "inline", margin: 0 }, children: [_jsx(Styles, {}), isValidElement(children) ? (cloneElement(children, { type: "submit" })) : (_jsx("button", { type: "submit", className: className ?? "iaa-btn", children: children ?? LABELS[c.locale].signOut }))] }));
+}
+const initialsOf = (u) => (u.name ?? u.email ?? "?")
+    .split(/[\s@._-]+/)
+    .filter(Boolean)
+    .slice(0, 2)
+    .map((w) => w[0].toUpperCase())
+    .join("");
+/** The avatar menu: who is signed in, "Manage account" (the hosted page, and back) and "Sign out". */
+export function UserButton({ showName = false }) {
+    const c = useAccounts();
+    const [open, setOpen] = useState(false);
+    const here = useRef(null);
+    const root = useRef(null);
+    const trigger = useRef(null);
+    const menu = useRef(null);
+    const id = useId();
+    const L = LABELS[c.locale];
+    useEffect(() => {
+        here.current = location.href;
+    });
+    useEffect(() => {
+        if (!open)
+            return;
+        menu.current?.querySelector("[role=menuitem]")?.focus();
+        const onDown = (e) => {
+            if (!root.current?.contains(e.target))
+                setOpen(false);
+        };
+        document.addEventListener("pointerdown", onDown);
+        return () => document.removeEventListener("pointerdown", onDown);
+    }, [open]);
+    if (!c.isLoaded || !c.isSignedIn || !c.user)
+        return null;
+    const u = c.user;
+    // The hosted account page (the application's root), with the way back to this page.
+    const account = c.issuer ? `${c.issuer}/?redirect_url=${encodeURIComponent(here.current ?? "")}` : null;
+    const onKey = (e) => {
+        const items = [...(menu.current?.querySelectorAll("[role=menuitem]") ?? [])];
+        const i = items.indexOf(document.activeElement);
+        if (e.key === "Escape") {
+            e.preventDefault();
+            setOpen(false);
+            trigger.current?.focus();
+        }
+        else if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+            e.preventDefault();
+            items[(i + (e.key === "ArrowDown" ? 1 : items.length - 1)) % items.length]?.focus();
+        }
+        else if (e.key === "Home" || e.key === "End") {
+            e.preventDefault();
+            items[e.key === "Home" ? 0 : items.length - 1]?.focus();
+        }
+        else if (e.key === "Tab")
+            setOpen(false);
+    };
+    return (_jsxs("div", { className: "iaa-ub", ref: root, children: [_jsx(Styles, {}), _jsxs("button", { ref: trigger, type: "button", className: "iaa-ub-trigger", "aria-haspopup": "menu", "aria-expanded": open, "aria-controls": open ? `${id}-menu` : undefined, "aria-label": showName ? undefined : L.open, onClick: () => setOpen((o) => !o), onKeyDown: (e) => {
+                    if (e.key === "ArrowDown" && !open) {
+                        e.preventDefault();
+                        setOpen(true);
+                    }
+                }, children: [_jsx("span", { className: "iaa-ub-avatar", "aria-hidden": "true", children: u.imageUrl ? _jsx("img", { src: u.imageUrl, alt: "" }) : initialsOf(u) }), showName && _jsx("span", { children: u.name ?? u.email })] }), open && (_jsxs("div", { ref: menu, id: `${id}-menu`, role: "menu", "aria-label": L.menu, className: "iaa-ub-menu", onKeyDown: onKey, children: [_jsxs("div", { className: "iaa-ub-who", role: "none", children: [u.name && _jsx("strong", { children: u.name }), u.email && _jsx("span", { children: u.email })] }), account && (_jsx("a", { role: "menuitem", className: "iaa-ub-item", href: account, children: L.manage })), _jsx("form", { method: "post", action: `${c.basePath}/sign-out`, role: "none", children: _jsx("button", { role: "menuitem", type: "submit", className: "iaa-ub-item", children: L.signOut }) })] }))] }));
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AACb,yGAAyG;AACzG,0GAA0G;AAC1G,wEAAwE;AACxE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,WAAW,EACX,UAAU,EACV,SAAS,EACT,KAAK,EACL,OAAO,EACP,MAAM,EACN,QAAQ,GAKT,MAAM,OAAO,CAAC;AAaf,MAAM,eAAe,GAAG,aAAa,CAAa,IAAI,CAAC,CAAC;AAExD,MAAM,OAAO,GAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC5G,MAAM,UAAU,GAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAE9G,6GAA6G;AAC7G,SAAS,QAAQ,CAAC,EAAsB;IACtC,MAAM,CAAC,GAAG,2CAA2C,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,GAAG,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,IAAI,EAAE,CAAC;IACjH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAYD,MAAM,UAAU,sBAAsB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,GAAG,eAAe,EAAE,MAAM,EAAyB;IAClI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAY,YAAY,IAAI,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAS,MAAM,IAAI,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAChG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAkG,CAAC;YAC5H,QAAQ,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC7J,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACf,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjG,IAAI,CAAC,YAAY;YAAE,KAAK,OAAO,EAAE,CAAC;QAClC,uFAAuF;QACvF,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,MAAM;gBAAE,KAAK,OAAO,EAAE,CAAC;QACzD,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAChL,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CACzC,CAAC;IACF,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,CAAC,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACvH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAI,WAAW,GAAgD,IAAI,CAAC;AAEpE,MAAM,UAAU,OAAO;IACrB,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,IAA4B,EAAE;QAC9D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE;YAAE,OAAO,WAAW,CAAC,KAAK,CAAC;QAC5F,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,QAAQ,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,WAAW,GAAG,IAAI,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,WAAW,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAyC,CAAC;QACvE,OAAO,WAAW,CAAC,KAAK,CAAC;IAC3B,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,WAAW,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,MAAM,EAAE,CAAC;IACb,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjB,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACnJ,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,EAAE,QAAQ,EAA4B;IAC7D,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,4BAAG,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,EAAE,QAAQ,EAA4B;IAC9D,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,4BAAG,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,2EAA2E;AAC3E,MAAM,MAAM,GAAG;IACb,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;IACvI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,EAAE;CAClJ,CAAC;AAEX,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;CAeX,CAAC;AACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,CACnB,gBAAO,IAAI,EAAC,oBAAoB,EAAC,UAAU,EAAC,SAAS,YAClD,GAAG,GACE,CACT,CAAC;AAEF,SAAS,OAAO;IACd,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACtD,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAID,SAAS,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAiD;IACzG,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,IAAI,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;IACpG,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,QAA+D,CAAC;QAC3E,OAAO,YAAY,CAAC,EAAE,EAAE;YACtB,OAAO,EAAE,CAAC,CAAa,EAAE,EAAE;gBACzB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,CAAC,CAAC,gBAAgB;oBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CACL,8BACE,KAAC,MAAM,KAAG,EACV,YAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,YAC7C,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GACrE,IACH,CACJ,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,KAAC,QAAQ,IAAC,IAAI,EAAC,SAAS,KAAK,CAAC,GAAI,CAAC;AACnF,gEAAgE;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,KAAC,QAAQ,IAAC,IAAI,EAAC,SAAS,KAAK,CAAC,GAAI,CAAC;AAEnF,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAgD;IACjG,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,OAAO,CACL,gBAAM,MAAM,EAAC,MAAM,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,aAC3F,KAAC,MAAM,KAAG,EACT,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC1B,YAAY,CAAC,QAA2C,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAC9E,CAAC,CAAC,CAAC,CACF,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAE,SAAS,IAAI,SAAS,YACpD,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,GAC9B,CACV,IACI,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAc,EAAE,EAAE,CACpC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC;KACvB,KAAK,CAAC,WAAW,CAAC;KAClB,MAAM,CAAC,OAAO,CAAC;KACf,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;KACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;KAC/B,IAAI,CAAC,EAAE,CAAC,CAAC;AAEd,sGAAsG;AACtG,MAAM,UAAU,UAAU,CAAC,EAAE,QAAQ,GAAG,KAAK,EAA0B;IACrE,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAoB,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC,OAAO,EAAE,aAAa,CAAc,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,CAAC,CAAe,EAAE,EAAE;YACjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAc,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC,CAAC;QACF,QAAQ,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACX,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,oFAAoF;IACpF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAc,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAA4B,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACvB,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,CAAC;YACf,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,KAAK,WAAW,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACxD,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;QACtF,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YAC/C,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QAC1D,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,OAAO,CACL,eAAK,SAAS,EAAC,QAAQ,EAAC,GAAG,EAAE,IAAI,aAC/B,KAAC,MAAM,KAAG,EACV,kBACE,GAAG,EAAE,OAAO,EACZ,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,gBAAgB,mBACZ,MAAM,mBACL,IAAI,mBACJ,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,gBAClC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EACzC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EACjC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;oBACf,IAAI,CAAC,CAAC,GAAG,KAAK,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC;wBACnC,CAAC,CAAC,cAAc,EAAE,CAAC;wBACnB,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC,aAED,eAAM,SAAS,EAAC,eAAe,iBAAa,MAAM,YAC/C,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAK,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAC,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GACxD,EACN,QAAQ,IAAI,yBAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,GAAQ,IACtC,EACR,IAAI,IAAI,CACP,eAAK,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAC,MAAM,gBAAa,CAAC,CAAC,IAAI,EAAE,SAAS,EAAC,aAAa,EAAC,SAAS,EAAE,KAAK,aACxG,eAAK,SAAS,EAAC,YAAY,EAAC,IAAI,EAAC,MAAM,aACpC,CAAC,CAAC,IAAI,IAAI,2BAAS,CAAC,CAAC,IAAI,GAAU,EACnC,CAAC,CAAC,KAAK,IAAI,yBAAO,CAAC,CAAC,KAAK,GAAQ,IAC9B,EACL,OAAO,IAAI,CACV,YAAG,IAAI,EAAC,UAAU,EAAC,SAAS,EAAC,aAAa,EAAC,IAAI,EAAE,OAAO,YACrD,CAAC,CAAC,MAAM,GACP,CACL,EACD,eAAM,MAAM,EAAC,MAAM,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,WAAW,EAAE,IAAI,EAAC,MAAM,YAC/D,iBAAQ,IAAI,EAAC,UAAU,EAAC,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,aAAa,YAC1D,CAAC,CAAC,OAAO,GACH,GACJ,IACH,CACP,IACG,CACP,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,37 @@
+import type { FetchLike } from "@iaurelius/accounts";
+export type AccountsOptions = {
+    /** pk_live_… Default: NEXT_PUBLIC_ACCOUNTS_PUBLISHABLE_KEY. */
+    publishableKey?: string;
+    /** Your web app in the console (Apps and APIs). Default: ACCOUNTS_CLIENT_ID. */
+    clientId?: string;
+    /**
+     * Default: ACCOUNTS_CLIENT_SECRET. A production web app has one; the development app (localhost) is a
+     * public app without it, with PKCE. It also encrypts the session cookie, unless ACCOUNTS_COOKIE_SECRET is set.
+     */
+    clientSecret?: string;
+    /** Your API's identifier: the access token (getToken()) is issued for it. Default: ACCOUNTS_AUDIENCE. */
+    audience?: string | string[];
+    /** Where the SDK answers: sign-in, sign-up, callback, sign-out, session, token. Default /api/accounts. */
+    basePath?: string;
+    /** Where people land after signing out. Default "/". */
+    afterSignOutPath?: string;
+    /** Your app's public URL, if requests do not carry it (some proxies). Default: ACCOUNTS_APP_URL, else the request's origin. */
+    appUrl?: string;
+    /** Refresh the access token when it has less than this left. Default 60 s. */
+    refreshBeforeSeconds?: number;
+    /** How long a session cookie lives without being refreshed. Default 30 days. */
+    sessionMaxAgeDays?: number;
+    fetch?: FetchLike;
+};
+export type AccountsConfig = Required<Pick<AccountsOptions, "basePath" | "afterSignOutPath" | "refreshBeforeSeconds" | "sessionMaxAgeDays">> & {
+    issuer: string;
+    clientId: string;
+    clientSecret: string | undefined;
+    cookieSecret: string;
+    audience: string[] | undefined;
+    appUrl: string | undefined;
+    fetch: FetchLike | undefined;
+};
+/** The settings from the options, else the environment; says exactly which ones are missing. */
+export declare function configOf(o?: AccountsOptions): AccountsConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,MAAM,eAAe,GAAG;IAC5B,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+HAA+H;IAC/H,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,mBAAmB,CAAC,CAAC,GAAG;IAC7I,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CAC9B,CAAC;AAMF,gGAAgG;AAChG,wBAAgB,QAAQ,CAAC,CAAC,GAAE,eAAoB,GAAG,cAAc,CAsChE"}

package/dist/config.js

@@ -0,0 +1,44 @@
+import { AccountsError, issuerFromPublishableKey } from "@iaurelius/accounts";
+const envOf = () => globalThis.process?.env ?? {};
+const clean = (v) => (v && v.trim() ? v.trim() : undefined);
+/** The settings from the options, else the environment; says exactly which ones are missing. */
+export function configOf(o = {}) {
+    const env = envOf();
+    const publishableKey = clean(o.publishableKey) ?? clean(env.NEXT_PUBLIC_ACCOUNTS_PUBLISHABLE_KEY) ?? clean(env.ACCOUNTS_PUBLISHABLE_KEY);
+    const clientId = clean(o.clientId) ?? clean(env.ACCOUNTS_CLIENT_ID);
+    const clientSecret = clean(o.clientSecret) ?? clean(env.ACCOUNTS_CLIENT_SECRET);
+    const cookieSecretEnv = clean(env.ACCOUNTS_COOKIE_SECRET);
+    const missing = [
+        !publishableKey && "NEXT_PUBLIC_ACCOUNTS_PUBLISHABLE_KEY",
+        !clientId && "ACCOUNTS_CLIENT_ID",
+        // A public app (the development one) has no secret: the cookie needs its own.
+        !clientSecret && !cookieSecretEnv && "ACCOUNTS_CLIENT_SECRET (or, for the development app, ACCOUNTS_COOKIE_SECRET)",
+    ].filter(Boolean);
+    if (missing.length)
+        throw new AccountsError("missing_configuration", `Accounts needs ${missing.join(", ")}. Run \`npx @iaurelius/accounts init\`, or copy them from the console (Apps and APIs → your web app) into .env.local.`);
+    const audience = o.audience ?? clean(env.ACCOUNTS_AUDIENCE)?.split(/[\s,]+/).filter(Boolean);
+    const basePath = (o.basePath ?? "/api/accounts").replace(/\/+$/, "");
+    if (!/^\/[A-Za-z0-9/_-]*$/.test(basePath))
+        throw new AccountsError("invalid_configuration", "basePath is a path such as /api/accounts.");
+    const afterSignOutPath = o.afterSignOutPath ?? "/";
+    if (!afterSignOutPath.startsWith("/") || afterSignOutPath.startsWith("//"))
+        throw new AccountsError("invalid_configuration", "afterSignOutPath is a path of your app, such as /.");
+    const appUrl = clean(o.appUrl) ?? clean(env.ACCOUNTS_APP_URL);
+    const cookieSecret = cookieSecretEnv ?? clientSecret;
+    if (cookieSecret.length < 32)
+        throw new AccountsError("invalid_configuration", "ACCOUNTS_COOKIE_SECRET must be at least 32 characters.");
+    return {
+        issuer: issuerFromPublishableKey(publishableKey),
+        clientId: clientId,
+        clientSecret,
+        cookieSecret,
+        audience: audience === undefined ? undefined : Array.isArray(audience) ? audience : [audience],
+        basePath,
+        afterSignOutPath,
+        appUrl: appUrl ? new URL(appUrl).origin : undefined,
+        refreshBeforeSeconds: o.refreshBeforeSeconds ?? 60,
+        sessionMaxAgeDays: o.sessionMaxAgeDays ?? 30,
+        fetch: o.fetch,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAuC9E,MAAM,KAAK,GAAG,GAAQ,EAAE,CAAE,UAA0C,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACxF,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAEhF,gGAAgG;AAChG,MAAM,UAAU,QAAQ,CAAC,CAAC,GAAoB,EAAE;IAC9C,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;IACpB,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACzI,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,CAAC,cAAc,IAAI,sCAAsC;QACzD,CAAC,QAAQ,IAAI,oBAAoB;QACjC,8EAA8E;QAC9E,CAAC,YAAY,IAAI,CAAC,eAAe,IAAI,8EAA8E;KACpH,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,IAAI,aAAa,CACrB,uBAAuB,EACvB,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uHAAuH,CAC5J,CAAC;IACJ,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7F,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,2CAA2C,CAAC,CAAC;IACzI,MAAM,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC;IACnD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,oDAAoD,CAAC,CAAC;IACnL,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,eAAe,IAAI,YAAa,CAAC;IACtD,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;IACzI,OAAO;QACL,MAAM,EAAE,wBAAwB,CAAC,cAAe,CAAC;QACjD,QAAQ,EAAE,QAAS;QACnB,YAAY;QACZ,YAAY;QACZ,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9F,QAAQ;QACR,gBAAgB;QAChB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACnD,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,EAAE;QAClD,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,EAAE;QAC5C,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC"}

package/dist/cookies.d.ts

@@ -0,0 +1,18 @@
+import { type JWTPayload } from "jose";
+export declare function seal(payload: JWTPayload, secret: string, purpose: string, maxAgeSeconds: number): Promise<string>;
+/** The payload, or null for anything not sealed by us for this purpose, or expired. */
+export declare function unseal<T extends JWTPayload>(value: string | undefined, secret: string, purpose: string): Promise<T | null>;
+export type CookieOptions = {
+    maxAge?: number;
+    path?: string;
+    secure: boolean;
+    httpOnly?: boolean;
+};
+export declare function parseCookies(header: string | null | undefined): Map<string, string>;
+export declare function serialize(name: string, value: string, o: CookieOptions): string;
+/** The Set-Cookie headers that store `value` under `name` (chunked if needed) and drop the chunks it no longer uses. */
+export declare function writeChunked(name: string, value: string, existing: Map<string, string>, o: CookieOptions): string[];
+export declare function readChunked(name: string, cookies: Map<string, string>): string | undefined;
+/** Set-Cookie headers that remove `name` and every chunk of it. */
+export declare function clearChunked(name: string, existing: Map<string, string>, o: CookieOptions): string[];
+//# sourceMappingURL=cookies.d.ts.map

package/dist/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAoB/D,wBAAsB,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,mBAMrG;AAED,uFAAuF;AACvF,wBAAsB,MAAM,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAOhI;AAGD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CASnF;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,UAMtE;AAKD,wHAAwH;AACxH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,MAAM,EAAE,CAcnH;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAM1F;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,MAAM,EAAE,CAEpG"}