@incorta/auth 1.0.0 → 1.1.0

package/README.md

@@ -8,7 +8,7 @@ guide; this is the API surface.
 
 | Import                  | What's in it                                                        |
 | ----------------------- | ------------------------------------------------------------------- |
-| `@incorta/auth`         | `createIncortaAuth`, `registerClient`, types (`IncortaUser`, `AuthSession`, …) |
+| `@incorta/auth`         | `createIncortaAuth`, `registerClient`, `getClient`, `updateClientRedirectUris`, types (`IncortaUser`, `AuthSession`, …) |
 | `@incorta/auth/react`   | `IncortaAuthProvider`, `useAuth`, `useUser`, `SignedIn`, `SignedOut`, `Protect`, `RedirectToLogin` |
 | `@incorta/auth/express` | `incortaAuth(auth)` middleware, `requireAuth(auth, options?)`        |
 | `@incorta/auth/node`    | `toNodeHandler(auth)`, `toWebRequest`, `sendWebResponse`, `getNodeSession` |
@@ -49,10 +49,17 @@ tokens. Nothing is stored server-side.
 ```bash
 incorta-auth register --url http://localhost:8080/incorta --tenant demo \
   --name "My App" --redirect https://myapp.example.com/auth/callback [--json]
+
+incorta-auth show --url ... --tenant ... --client <id> --rat <token> [--json]
+
+incorta-auth update-redirects --url ... --tenant ... --client <id> --rat <token> \
+  --redirect <url> [--redirect ...] [--replace] [--json]
 ```
 
-Registers the OAuth client via RFC 7591 dynamic registration and prints the
-`.env` entries.
+`register` creates the OAuth client via RFC 7591 dynamic registration and
+prints the `.env` entries (keep the registration access token). `show` and
+`update-redirects` manage the registered client's allowed callback URLs —
+adding by default, replacing the whole set with `--replace`.
 
 ## Testing
 

package/dist/cli.js

@@ -4,6 +4,26 @@
 import { randomBytes } from "crypto";
 
 // src/core/register.ts
+function registrationEndpoint(incortaUrl, tenant, clientId) {
+  const base = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
+  return clientId ? `${base}/${clientId}` : base;
+}
+async function readJson(response, what) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error(
+      `[incorta-auth] ${what} returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
+    );
+  }
+  if (!response.ok) {
+    throw new Error(
+      `[incorta-auth] ${what} failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+    );
+  }
+  return body;
+}
 async function registerClient(options) {
   const {
     incortaUrl,
@@ -17,8 +37,7 @@ async function registerClient(options) {
   if (!redirectUris.length) {
     throw new Error("[incorta-auth] registerClient requires at least one redirect URI.");
   }
-  const endpoint = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
-  const response = await fetchImpl(endpoint, {
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant), {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
     body: JSON.stringify({
@@ -29,17 +48,10 @@ async function registerClient(options) {
       token_endpoint_auth_method: "client_secret_basic"
     })
   });
-  let body;
-  try {
-    body = await response.json();
-  } catch {
+  const body = await readJson(response, "Client registration");
+  if (!body.client_id || !body.client_secret) {
     throw new Error(
-      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
-    );
-  }
-  if (!response.ok || !body.client_id || !body.client_secret) {
-    throw new Error(
-      `[incorta-auth] Client registration failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`
     );
   }
   return {
@@ -49,6 +61,63 @@ async function registerClient(options) {
     registrationClientUri: body.registration_client_uri
   };
 }
+function toClientInfo(body, fallbackClientId) {
+  return {
+    clientId: body.client_id ?? fallbackClientId,
+    name: body.client_name,
+    redirectUris: body.redirect_uris ?? [],
+    grantTypes: body.grant_types ?? [],
+    scope: body.scope
+  };
+}
+async function getClient(options) {
+  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    }
+  });
+  const body = await readJson(response, "Reading the client");
+  return toClientInfo(body, clientId);
+}
+async function updateClientRedirectUris(options) {
+  const {
+    incortaUrl,
+    tenant,
+    clientId,
+    registrationAccessToken,
+    redirectUris,
+    mode = "add",
+    fetchImpl = fetch
+  } = options;
+  if (!redirectUris.length) {
+    throw new Error("[incorta-auth] updateClientRedirectUris requires at least one redirect URI.");
+  }
+  const current = await getClient(options);
+  const nextUris = mode === "add" ? [.../* @__PURE__ */ new Set([...current.redirectUris, ...redirectUris])] : redirectUris;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    method: "PUT",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    },
+    // RFC 7592 update: client_id + full metadata. Incorta applies
+    // redirect_uris only, but nimbus-side parsing wants the full shape.
+    body: JSON.stringify({
+      client_id: clientId,
+      redirect_uris: nextUris,
+      grant_types: current.grantTypes,
+      scope: current.scope,
+      client_name: current.name
+    })
+  });
+  if (!response.ok) {
+    await readJson(response, "Updating the client");
+  }
+  return getClient(options);
+}
 
 // src/cli.ts
 var HELP = `incorta-auth \u2014 IncortaAuth SDK helper
@@ -58,8 +127,22 @@ Usage:
                         --redirect <callbackUrl> [--redirect <callbackUrl> ...] \\
                         [--scope "openid profile email"] [--json]
 
-Registers an OAuth client in Incorta (RFC 7591 dynamic registration) and prints
-the .env entries your app needs.
+  incorta-auth show --url <incortaUrl> --tenant <tenant> \\
+                    --client <clientId> --rat <registrationAccessToken> [--json]
+
+  incorta-auth update-redirects --url <incortaUrl> --tenant <tenant> \\
+                                --client <clientId> --rat <registrationAccessToken> \\
+                                --redirect <callbackUrl> [--redirect ...] \\
+                                [--replace] [--json]
+
+register          Registers an OAuth client in Incorta (RFC 7591 dynamic
+                  registration) and prints the .env entries your app needs.
+                  Keep the printed registration access token \u2014 it is the key
+                  for show/update-redirects later.
+show              Prints a registered client's current metadata.
+update-redirects  Adds the given callback URLs to the client's allowed set
+                  (or replaces the whole set with --replace, which is also how
+                  URLs are removed).
 
 Example:
   incorta-auth register \\
@@ -69,7 +152,7 @@ Example:
     --redirect http://localhost:4000/auth/callback
 `;
 function parseArgs(argv) {
-  const args = { redirects: [], json: false };
+  const args = { redirects: [], replace: false, json: false };
   for (let i = 0; i < argv.length; i++) {
     const flag = argv[i];
     const next = () => {
@@ -90,9 +173,18 @@ function parseArgs(argv) {
       case "--scope":
         args.scope = next();
         break;
+      case "--client":
+        args.client = next();
+        break;
+      case "--rat":
+        args.rat = next();
+        break;
       case "--redirect":
         args.redirects.push(next());
         break;
+      case "--replace":
+        args.replace = true;
+        break;
       case "--json":
         args.json = true;
         break;
@@ -102,36 +194,12 @@ function parseArgs(argv) {
   }
   return args;
 }
-async function main() {
-  const [command, ...rest] = process.argv.slice(2);
-  if (!command || command === "help" || command === "--help" || command === "-h") {
-    console.log(HELP);
-    return command ? 0 : 1;
-  }
-  if (command !== "register") {
-    console.error(`Unknown command: ${command}
-`);
-    console.log(HELP);
-    return 1;
-  }
-  let args;
-  try {
-    args = parseArgs(rest);
-  } catch (error) {
-    console.error(`${error.message}
-`);
-    console.log(HELP);
-    return 1;
-  }
-  const missing = ["url", "tenant", "name"].filter((key) => !args[key]);
-  if (missing.length || !args.redirects.length) {
-    console.error(
-      `Missing required flag(s): ${[...missing.map((m) => `--${m}`), ...args.redirects.length ? [] : ["--redirect"]].join(", ")}
-`
-    );
-    console.log(HELP);
-    return 1;
-  }
+function requireFlags(args, flags, needsRedirect) {
+  const missing = flags.filter((key) => !args[key]).map((key) => `--${key}`);
+  if (needsRedirect && !args.redirects.length) missing.push("--redirect");
+  return missing;
+}
+async function runRegister(args) {
   const client = await registerClient({
     incortaUrl: args.url,
     tenant: args.tenant,
@@ -141,7 +209,7 @@ async function main() {
   });
   if (args.json) {
     console.log(JSON.stringify(client, null, 2));
-    return 0;
+    return;
   }
   const authSecret = randomBytes(32).toString("base64url");
   console.log(`Client registered successfully.
@@ -156,10 +224,84 @@ async function main() {
   if (client.registrationAccessToken) {
     console.log(
       `
-# Keep these to manage the registration later (PUT/DELETE ${client.registrationClientUri ?? "the registration endpoint"}):`
+# Keep this token \u2014 it manages the registration later (incorta-auth show / update-redirects):`
     );
     console.log(`# registration_access_token: ${client.registrationAccessToken}`);
   }
+}
+async function runShow(args) {
+  const info = await getClient({
+    incortaUrl: args.url,
+    tenant: args.tenant,
+    clientId: args.client,
+    registrationAccessToken: args.rat
+  });
+  if (args.json) {
+    console.log(JSON.stringify(info, null, 2));
+    return;
+  }
+  console.log(`Client:      ${info.clientId}`);
+  if (info.name) console.log(`Name:        ${info.name}`);
+  if (info.scope) console.log(`Scope:       ${info.scope}`);
+  console.log(`Grant types: ${info.grantTypes.join(", ")}`);
+  console.log(`Redirect URIs:`);
+  for (const uri of info.redirectUris) console.log(`  - ${uri}`);
+}
+async function runUpdateRedirects(args) {
+  const info = await updateClientRedirectUris({
+    incortaUrl: args.url,
+    tenant: args.tenant,
+    clientId: args.client,
+    registrationAccessToken: args.rat,
+    redirectUris: args.redirects,
+    mode: args.replace ? "replace" : "add"
+  });
+  if (args.json) {
+    console.log(JSON.stringify(info, null, 2));
+    return;
+  }
+  console.log(`Redirect URIs ${args.replace ? "replaced" : "updated"}. Current set:`);
+  for (const uri of info.redirectUris) console.log(`  - ${uri}`);
+}
+var COMMANDS = {
+  register: { required: ["url", "tenant", "name"], needsRedirect: true, run: runRegister },
+  show: { required: ["url", "tenant", "client", "rat"], needsRedirect: false, run: runShow },
+  "update-redirects": {
+    required: ["url", "tenant", "client", "rat"],
+    needsRedirect: true,
+    run: runUpdateRedirects
+  }
+};
+async function main() {
+  const [command, ...rest] = process.argv.slice(2);
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    console.log(HELP);
+    return command ? 0 : 1;
+  }
+  const spec = COMMANDS[command];
+  if (!spec) {
+    console.error(`Unknown command: ${command}
+`);
+    console.log(HELP);
+    return 1;
+  }
+  let args;
+  try {
+    args = parseArgs(rest);
+  } catch (error) {
+    console.error(`${error.message}
+`);
+    console.log(HELP);
+    return 1;
+  }
+  const missing = requireFlags(args, spec.required, spec.needsRedirect);
+  if (missing.length) {
+    console.error(`Missing required flag(s): ${missing.join(", ")}
+`);
+    console.log(HELP);
+    return 1;
+  }
+  await spec.run(args);
   return 0;
 }
 main().then((code) => {

package/dist/index.cjs

@@ -22,7 +22,9 @@ var src_exports = {};
 __export(src_exports, {
   IncortaAuthError: () => IncortaAuthError,
   createIncortaAuth: () => createIncortaAuth,
-  registerClient: () => registerClient
+  getClient: () => getClient,
+  registerClient: () => registerClient,
+  updateClientRedirectUris: () => updateClientRedirectUris
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -581,6 +583,26 @@ function createHandler(config) {
 }
 
 // src/core/register.ts
+function registrationEndpoint(incortaUrl, tenant, clientId) {
+  const base = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
+  return clientId ? `${base}/${clientId}` : base;
+}
+async function readJson(response, what) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error(
+      `[incorta-auth] ${what} returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
+    );
+  }
+  if (!response.ok) {
+    throw new Error(
+      `[incorta-auth] ${what} failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+    );
+  }
+  return body;
+}
 async function registerClient(options) {
   const {
     incortaUrl,
@@ -594,8 +616,7 @@ async function registerClient(options) {
   if (!redirectUris.length) {
     throw new Error("[incorta-auth] registerClient requires at least one redirect URI.");
   }
-  const endpoint = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
-  const response = await fetchImpl(endpoint, {
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant), {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
     body: JSON.stringify({
@@ -606,17 +627,10 @@ async function registerClient(options) {
       token_endpoint_auth_method: "client_secret_basic"
     })
   });
-  let body;
-  try {
-    body = await response.json();
-  } catch {
+  const body = await readJson(response, "Client registration");
+  if (!body.client_id || !body.client_secret) {
     throw new Error(
-      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
-    );
-  }
-  if (!response.ok || !body.client_id || !body.client_secret) {
-    throw new Error(
-      `[incorta-auth] Client registration failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`
     );
   }
   return {
@@ -626,6 +640,63 @@ async function registerClient(options) {
     registrationClientUri: body.registration_client_uri
   };
 }
+function toClientInfo(body, fallbackClientId) {
+  return {
+    clientId: body.client_id ?? fallbackClientId,
+    name: body.client_name,
+    redirectUris: body.redirect_uris ?? [],
+    grantTypes: body.grant_types ?? [],
+    scope: body.scope
+  };
+}
+async function getClient(options) {
+  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    }
+  });
+  const body = await readJson(response, "Reading the client");
+  return toClientInfo(body, clientId);
+}
+async function updateClientRedirectUris(options) {
+  const {
+    incortaUrl,
+    tenant,
+    clientId,
+    registrationAccessToken,
+    redirectUris,
+    mode = "add",
+    fetchImpl = fetch
+  } = options;
+  if (!redirectUris.length) {
+    throw new Error("[incorta-auth] updateClientRedirectUris requires at least one redirect URI.");
+  }
+  const current = await getClient(options);
+  const nextUris = mode === "add" ? [.../* @__PURE__ */ new Set([...current.redirectUris, ...redirectUris])] : redirectUris;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    method: "PUT",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    },
+    // RFC 7592 update: client_id + full metadata. Incorta applies
+    // redirect_uris only, but nimbus-side parsing wants the full shape.
+    body: JSON.stringify({
+      client_id: clientId,
+      redirect_uris: nextUris,
+      grant_types: current.grantTypes,
+      scope: current.scope,
+      client_name: current.name
+    })
+  });
+  if (!response.ok) {
+    await readJson(response, "Updating the client");
+  }
+  return getClient(options);
+}
 
 // src/index.ts
 function createIncortaAuth(config = {}) {
@@ -637,6 +708,8 @@ function createIncortaAuth(config = {}) {
 0 && (module.exports = {
   IncortaAuthError,
   createIncortaAuth,
-  registerClient
+  getClient,
+  registerClient,
+  updateClientRedirectUris
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/core/config.ts","../src/core/handler.ts","../src/core/cookies.ts","../src/core/discovery.ts","../src/core/session.ts","../src/core/tokens.ts","../src/core/register.ts"],"sourcesContent":["import { resolveConfig } from \"./core/config.js\";\nimport type { IncortaAuthConfig, ResolvedConfig } from \"./core/config.js\";\nimport { createHandler } from \"./core/handler.js\";\nimport type { AuthHandler, AuthSession } from \"./core/handler.js\";\n\nexport type {\n  IncortaAuthConfig,\n  IncortaUser,\n  SessionData,\n  SessionInfo,\n} from \"./core/config.js\";\nexport type { AuthHandler, AuthSession } from \"./core/handler.js\";\nexport { IncortaAuthError } from \"./core/tokens.js\";\nexport { registerClient } from \"./core/register.js\";\nexport type { RegisterClientOptions, RegisteredClient } from \"./core/register.js\";\n\nexport interface IncortaAuth {\n  /**\n   * Web-standard request handler serving the auth routes under\n   * `config.basePath` (default `/auth`): `/login`, `/callback`, `/session`,\n   * `/logout` (+ `/token` when `exposeAccessToken` is on).\n   *\n   * Wire it to anything that speaks `Request`/`Response` — a TanStack Start\n   * server route, Bun.serve, or via `@incorta/auth/node` / `@incorta/auth/express`\n   * for Node servers.\n   */\n  handler: AuthHandler;\n  /**\n   * Reads the session from a web-standard `Request` (server-side gating, API\n   * routes, server functions). Returns null when the user is not signed in.\n   */\n  getSession: (request: Request) => Promise<AuthSession | null>;\n  /** The resolved configuration (secrets included — do not log). */\n  config: ResolvedConfig;\n}\n\n/**\n * Creates an IncortaAuth instance: OAuth 2.0 authorization-code flow against\n * Incorta's built-in authorization server. Unauthenticated users are redirected\n * to the Incorta login page and returned to your app once signed in.\n */\nexport function createIncortaAuth(config: IncortaAuthConfig = {}): IncortaAuth {\n  const resolved = resolveConfig(config);\n  const { handler, getSession } = createHandler(resolved);\n  return { handler, getSession, config: resolved };\n}\n","import type { JWTVerifyGetKey } from \"jose\";\n\n/** The Incorta user identity carried by the session (claims from the ID token). */\nexport interface IncortaUser {\n  /** Incorta login name (`sub` claim). */\n  sub: string;\n  name?: string;\n  email?: string;\n  /** Incorta role names, as minted into the ID token. */\n  roles: string[];\n  /** Tenant the user authenticated against. */\n  tenant: string;\n}\n\n/** What the sealed session cookie holds. */\nexport interface SessionData {\n  user: IncortaUser;\n  /** Incorta-issued access token (RS256 JWT, aud = client_id). */\n  accessToken: string;\n  /** Epoch millis when the access token expires. */\n  accessTokenExpiresAt: number;\n  /** Rotating refresh token, present when the client has the refresh_token grant. */\n  refreshToken?: string;\n  /** Epoch millis when this session was first created (login time). */\n  createdAt: number;\n}\n\nexport interface SessionInfo {\n  user: IncortaUser;\n  /** Epoch millis when the session cookie expires (sliding). */\n  expiresAt: number;\n  /** Epoch millis when the access token expires. */\n  accessTokenExpiresAt: number;\n}\n\nexport interface IncortaAuthConfig {\n  /**\n   * Base URL of the Incorta web application, e.g. `https://acme.cloud.incorta.com/incorta`\n   * or `http://localhost:8080/incorta`. Defaults to `INCORTA_URL`.\n   */\n  incortaUrl?: string;\n  /** Incorta tenant name, e.g. `demo`. Defaults to `INCORTA_TENANT`. */\n  tenant?: string;\n  /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */\n  clientId?: string;\n  /** OAuth client secret. Defaults to `INCORTA_CLIENT_SECRET`. */\n  clientSecret?: string;\n  /**\n   * Secret used to encrypt the session cookie (any long random string, >= 32 chars).\n   * Defaults to `INCORTA_AUTH_SECRET`.\n   */\n  secret?: string;\n  /**\n   * Path prefix the auth routes are mounted under. The SDK serves\n   * `{basePath}/login`, `{basePath}/callback`, `{basePath}/session`,\n   * `{basePath}/logout` (and optionally `{basePath}/token`).\n   * @default \"/auth\"\n   */\n  basePath?: string;\n  /**\n   * External origin of THIS app, e.g. `http://localhost:4000`. Used to build the\n   * OAuth callback URL and to validate `redirect_to` targets. When omitted it is\n   * derived per request from `x-forwarded-proto`/`x-forwarded-host`/`host`.\n   * Defaults to `INCORTA_APP_URL`.\n   */\n  appUrl?: string;\n  /** OAuth scopes to request. @default \"openid profile email\" */\n  scope?: string;\n  session?: {\n    /** @default \"incorta_auth_session\" */\n    cookieName?: string;\n    /** Session lifetime in seconds (sliding — renewed on activity). @default 43200 (12h) */\n    maxAge?: number;\n  };\n  cookies?: {\n    /**\n     * `Secure` attribute for cookies. `\"auto\"` sets it when the request is HTTPS.\n     * @default \"auto\"\n     */\n    secure?: boolean | \"auto\";\n  };\n  /**\n   * Expose `GET {basePath}/token` returning the raw Incorta access token to the\n   * browser (for calling Incorta public APIs directly from the frontend). Off by\n   * default — prefer proxying through your backend.\n   * @default false\n   */\n  exposeAccessToken?: boolean;\n  advanced?: {\n    /** Override the OIDC discovery document URL (rarely needed). */\n    discoveryUrl?: string;\n    /** Override JWKS resolution (used by tests to verify against a local key). */\n    jwks?: JWTVerifyGetKey;\n    /** Override fetch (used by tests). */\n    fetch?: typeof fetch;\n  };\n}\n\nexport interface ResolvedConfig {\n  incortaUrl: string;\n  tenant: string;\n  clientId: string;\n  clientSecret: string;\n  secret: string;\n  basePath: string;\n  appUrl?: string;\n  scope: string;\n  cookieName: string;\n  stateCookieName: string;\n  sessionMaxAge: number;\n  secureCookies: boolean | \"auto\";\n  exposeAccessToken: boolean;\n  /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */\n  issuer: string;\n  discoveryUrl: string;\n  jwksOverride?: JWTVerifyGetKey;\n  fetch: typeof fetch;\n}\n\nfunction required(value: string | undefined, name: string, envVar: string): string {\n  if (!value) {\n    throw new Error(\n      `[incorta-auth] Missing required config \"${name}\" (or env var ${envVar}).`,\n    );\n  }\n  return value;\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\nexport function resolveConfig(input: IncortaAuthConfig = {}): ResolvedConfig {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } })\n    .process?.env ?? {};\n\n  const incortaUrl = stripTrailingSlash(\n    required(input.incortaUrl ?? env.INCORTA_URL, \"incortaUrl\", \"INCORTA_URL\"),\n  );\n  const tenant = required(input.tenant ?? env.INCORTA_TENANT, \"tenant\", \"INCORTA_TENANT\");\n  const clientId = required(\n    input.clientId ?? env.INCORTA_CLIENT_ID,\n    \"clientId\",\n    \"INCORTA_CLIENT_ID\",\n  );\n  const clientSecret = required(\n    input.clientSecret ?? env.INCORTA_CLIENT_SECRET,\n    \"clientSecret\",\n    \"INCORTA_CLIENT_SECRET\",\n  );\n  const secret = required(\n    input.secret ?? env.INCORTA_AUTH_SECRET,\n    \"secret\",\n    \"INCORTA_AUTH_SECRET\",\n  );\n  if (secret.length < 32) {\n    throw new Error(\n      \"[incorta-auth] `secret` must be at least 32 characters. Generate one with: openssl rand -base64 32\",\n    );\n  }\n\n  const basePath = input.basePath ?? \"/auth\";\n  if (!basePath.startsWith(\"/\") || basePath.endsWith(\"/\")) {\n    throw new Error(\n      `[incorta-auth] basePath must start with \"/\" and not end with \"/\" (got \"${basePath}\").`,\n    );\n  }\n\n  const appUrl = input.appUrl ?? env.INCORTA_APP_URL;\n  const cookieName = input.session?.cookieName ?? \"incorta_auth_session\";\n  const issuer = `${incortaUrl}/oauth/${tenant}`;\n\n  return {\n    incortaUrl,\n    tenant,\n    clientId,\n    clientSecret,\n    secret,\n    basePath,\n    appUrl: appUrl ? stripTrailingSlash(appUrl) : undefined,\n    scope: input.scope ?? \"openid profile email\",\n    cookieName,\n    stateCookieName: `${cookieName}_state`,\n    sessionMaxAge: input.session?.maxAge ?? 12 * 60 * 60,\n    secureCookies: input.cookies?.secure ?? \"auto\",\n    exposeAccessToken: input.exposeAccessToken ?? false,\n    issuer,\n    discoveryUrl:\n      input.advanced?.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`,\n    jwksOverride: input.advanced?.jwks,\n    fetch: input.advanced?.fetch ?? fetch,\n  };\n}\n","import { randomBytes } from \"node:crypto\";\nimport type { ResolvedConfig, SessionData, SessionInfo } from \"./config.js\";\nimport { deleteCookie, parseCookies, serializeCookie } from \"./cookies.js\";\nimport { getEndpoints } from \"./discovery.js\";\nimport {\n  sealLoginState,\n  sealSession,\n  unsealLoginState,\n  unsealSession,\n} from \"./session.js\";\nimport {\n  IncortaAuthError,\n  exchangeCode,\n  refreshTokens,\n  userFromAccessToken,\n  verifyIdToken,\n} from \"./tokens.js\";\n\n/** A read-only view of the current session for server-side app code. */\nexport interface AuthSession extends SessionInfo {\n  /** Incorta access token — pass as `Authorization: Bearer` to Incorta APIs. */\n  accessToken: string;\n}\n\nexport type AuthHandler = (request: Request) => Promise<Response>;\n\n/** Refresh the access token when it has less than this long left to live. */\nconst ACCESS_TOKEN_REFRESH_LEEWAY_MS = 60 * 1000;\n\nfunction requestOrigin(config: ResolvedConfig, request: Request): string {\n  if (config.appUrl) return config.appUrl;\n  const url = new URL(request.url);\n  const proto =\n    request.headers.get(\"x-forwarded-proto\")?.split(\",\")[0]?.trim() ??\n    url.protocol.replace(\":\", \"\");\n  const host =\n    request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim() ??\n    request.headers.get(\"host\") ??\n    url.host;\n  return `${proto}://${host}`;\n}\n\nfunction isSecureRequest(config: ResolvedConfig, request: Request): boolean {\n  if (config.secureCookies !== \"auto\") return config.secureCookies;\n  return requestOrigin(config, request).startsWith(\"https://\");\n}\n\n/**\n * Only same-origin destinations are allowed after login/logout — anything else\n * would let a crafted link bounce users through this app to an attacker page.\n */\nfunction validateReturnTo(raw: string | null, origin: string): string {\n  if (!raw) return \"/\";\n  if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n  try {\n    const url = new URL(raw);\n    if (url.origin === origin) return `${url.pathname}${url.search}${url.hash}` || \"/\";\n  } catch {\n    // Not a URL — fall through.\n  }\n  return \"/\";\n}\n\nfunction json(status: number, body: unknown, cookies: string[] = []): Response {\n  const headers = new Headers({\n    \"content-type\": \"application/json; charset=utf-8\",\n    \"cache-control\": \"no-store\",\n  });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(JSON.stringify(body), { status, headers });\n}\n\nfunction redirect(location: string, cookies: string[] = []): Response {\n  const headers = new Headers({ location, \"cache-control\": \"no-store\" });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(null, { status: 302, headers });\n}\n\nfunction withErrorParam(target: string, code: string): string {\n  const separator = target.includes(\"?\") ? \"&\" : \"?\";\n  return `${target}${separator}incorta_auth_error=${encodeURIComponent(code)}`;\n}\n\nfunction randomToken(): string {\n  return randomBytes(16).toString(\"base64url\");\n}\n\nexport function createHandler(config: ResolvedConfig): {\n  handler: AuthHandler;\n  getSession: (request: Request) => Promise<AuthSession | null>;\n} {\n  const sessionCookieOptions = (secure: boolean) => ({\n    httpOnly: true,\n    secure,\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  });\n\n  async function login(request: Request, url: URL): Promise<Response> {\n    const origin = requestOrigin(config, request);\n    const secure = isSecureRequest(config, request);\n    const returnTo = validateReturnTo(url.searchParams.get(\"redirect_to\"), origin);\n\n    // Already signed in — skip the OAuth round trip entirely.\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const existing = await unsealSession(config, cookies[config.cookieName]);\n    if (existing) return redirect(returnTo);\n\n    const state = randomToken();\n    const nonce = randomToken();\n    const stateCookie = serializeCookie(\n      config.stateCookieName,\n      await sealLoginState(config, { state, nonce, returnTo }),\n      { ...sessionCookieOptions(secure), maxAge: 600 },\n    );\n\n    const { authorizationEndpoint } = await getEndpoints(config);\n    const authorizeUrl = new URL(authorizationEndpoint);\n    authorizeUrl.searchParams.set(\"response_type\", \"code\");\n    authorizeUrl.searchParams.set(\"client_id\", config.clientId);\n    authorizeUrl.searchParams.set(\"redirect_uri\", `${origin}${config.basePath}/callback`);\n    authorizeUrl.searchParams.set(\"scope\", config.scope);\n    authorizeUrl.searchParams.set(\"state\", state);\n    authorizeUrl.searchParams.set(\"nonce\", nonce);\n\n    return redirect(authorizeUrl.toString(), [stateCookie]);\n  }\n\n  async function callback(request: Request, url: URL): Promise<Response> {\n    const origin = requestOrigin(config, request);\n    const secure = isSecureRequest(config, request);\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const clearState = deleteCookie(config.stateCookieName, sessionCookieOptions(secure));\n\n    const loginState = await unsealLoginState(config, cookies[config.stateCookieName]);\n    const returnTo = validateReturnTo(loginState?.returnTo ?? null, origin);\n\n    const fail = (code: string) => redirect(withErrorParam(returnTo, code), [clearState]);\n\n    const oauthError = url.searchParams.get(\"error\");\n    if (oauthError) return fail(oauthError);\n\n    const code = url.searchParams.get(\"code\");\n    const state = url.searchParams.get(\"state\");\n    if (!code || !state) return fail(\"missing_code\");\n    if (!loginState) return fail(\"state_missing\");\n    if (state !== loginState.state) return fail(\"state_mismatch\");\n\n    try {\n      const tokens = await exchangeCode(config, code, `${origin}${config.basePath}/callback`);\n      const user = tokens.idToken\n        ? await verifyIdToken(config, tokens.idToken, loginState.nonce)\n        : await userFromAccessToken(config, tokens.accessToken);\n\n      const session: SessionData = {\n        user,\n        accessToken: tokens.accessToken,\n        accessTokenExpiresAt: tokens.accessTokenExpiresAt,\n        refreshToken: tokens.refreshToken,\n        createdAt: Date.now(),\n      };\n      const sessionCookie = serializeCookie(\n        config.cookieName,\n        await sealSession(config, session),\n        { ...sessionCookieOptions(secure), maxAge: config.sessionMaxAge },\n      );\n      return redirect(returnTo, [sessionCookie, clearState]);\n    } catch (error) {\n      const code = error instanceof IncortaAuthError ? error.code : \"callback_failed\";\n      return fail(code);\n    }\n  }\n\n  /**\n   * Loads the session from the request cookie; refreshes the Incorta access\n   * token (rotating the refresh token) when it is about to expire, and renews\n   * the sliding session cookie past its half-life. Returns the cookies to set.\n   */\n  async function loadSession(request: Request): Promise<{\n    session: SessionData | null;\n    sessionExpiresAt: number;\n    setCookies: string[];\n  }> {\n    const secure = isSecureRequest(config, request);\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const unsealed = await unsealSession(config, cookies[config.cookieName]);\n    if (!unsealed) return { session: null, sessionExpiresAt: 0, setCookies: [] };\n\n    let { session } = unsealed;\n    let mustReseal = false;\n    const now = Date.now();\n\n    if (session.accessTokenExpiresAt - now < ACCESS_TOKEN_REFRESH_LEEWAY_MS) {\n      if (session.refreshToken) {\n        try {\n          const tokens = await refreshTokens(config, session.refreshToken);\n          session = {\n            ...session,\n            accessToken: tokens.accessToken,\n            accessTokenExpiresAt: tokens.accessTokenExpiresAt,\n            refreshToken: tokens.refreshToken ?? session.refreshToken,\n          };\n          mustReseal = true;\n        } catch {\n          // Refresh failed (expired/rotated elsewhere). Keep the session while\n          // the current access token is still usable; otherwise sign out.\n          if (session.accessTokenExpiresAt <= now) {\n            return {\n              session: null,\n              sessionExpiresAt: 0,\n              setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))],\n            };\n          }\n        }\n      } else if (session.accessTokenExpiresAt <= now) {\n        return {\n          session: null,\n          sessionExpiresAt: 0,\n          setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))],\n        };\n      }\n    }\n\n    const halfLifeMs = (config.sessionMaxAge * 1000) / 2;\n    if (now - unsealed.issuedAt > halfLifeMs) mustReseal = true;\n\n    if (!mustReseal) {\n      return { session, sessionExpiresAt: unsealed.expiresAt, setCookies: [] };\n    }\n    const resealed = serializeCookie(config.cookieName, await sealSession(config, session), {\n      ...sessionCookieOptions(secure),\n      maxAge: config.sessionMaxAge,\n    });\n    return {\n      session,\n      sessionExpiresAt: now + config.sessionMaxAge * 1000,\n      setCookies: [resealed],\n    };\n  }\n\n  async function sessionRoute(request: Request): Promise<Response> {\n    const { session, sessionExpiresAt, setCookies } = await loadSession(request);\n    if (!session) return json(200, { user: null }, setCookies);\n    return json(\n      200,\n      {\n        user: session.user,\n        session: {\n          expiresAt: sessionExpiresAt,\n          accessTokenExpiresAt: session.accessTokenExpiresAt,\n        },\n      },\n      setCookies,\n    );\n  }\n\n  async function tokenRoute(request: Request): Promise<Response> {\n    if (!config.exposeAccessToken) return json(404, { error: \"not_found\" });\n    const { session, setCookies } = await loadSession(request);\n    if (!session) return json(401, { error: \"unauthenticated\" }, setCookies);\n    return json(\n      200,\n      { accessToken: session.accessToken, expiresAt: session.accessTokenExpiresAt },\n      setCookies,\n    );\n  }\n\n  async function logout(request: Request, url: URL): Promise<Response> {\n    const secure = isSecureRequest(config, request);\n    const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));\n    if (request.method === \"GET\") {\n      const origin = requestOrigin(config, request);\n      const returnTo = validateReturnTo(url.searchParams.get(\"redirect_to\"), origin);\n      return redirect(returnTo, [clearSession]);\n    }\n    return json(200, { ok: true }, [clearSession]);\n  }\n\n  async function handler(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    if (url.pathname !== config.basePath && !url.pathname.startsWith(`${config.basePath}/`)) {\n      return json(404, { error: \"not_found\" });\n    }\n    const route = url.pathname.slice(config.basePath.length) || \"/\";\n    const method = request.method.toUpperCase();\n\n    try {\n      if (route === \"/login\" && method === \"GET\") return await login(request, url);\n      if (route === \"/callback\" && method === \"GET\") return await callback(request, url);\n      if (route === \"/session\" && method === \"GET\") return await sessionRoute(request);\n      if (route === \"/token\" && method === \"GET\") return await tokenRoute(request);\n      if (route === \"/logout\" && (method === \"POST\" || method === \"GET\")) {\n        return await logout(request, url);\n      }\n      return json(404, { error: \"not_found\" });\n    } catch (error) {\n      const code = error instanceof IncortaAuthError ? error.code : \"internal_error\";\n      const message =\n        error instanceof Error ? error.message : \"Unexpected incorta-auth handler error\";\n      console.error(`[incorta-auth] ${route} failed:`, message);\n      return json(500, { error: code });\n    }\n  }\n\n  async function getSession(request: Request): Promise<AuthSession | null> {\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const unsealed = await unsealSession(config, cookies[config.cookieName]);\n    if (!unsealed) return null;\n    const { session, expiresAt } = unsealed;\n    if (session.accessTokenExpiresAt <= Date.now() && !session.refreshToken) return null;\n    return {\n      user: session.user,\n      accessToken: session.accessToken,\n      accessTokenExpiresAt: session.accessTokenExpiresAt,\n      expiresAt,\n    };\n  }\n\n  return { handler, getSession };\n}\n","export interface CookieOptions {\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: \"lax\" | \"strict\" | \"none\";\n  path?: string;\n  /** Seconds. 0 deletes the cookie. */\n  maxAge?: number;\n}\n\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const name = part.slice(0, eq).trim();\n    if (!name) continue;\n    let value = part.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"')) value = value.slice(1, -1);\n    try {\n      out[name] = decodeURIComponent(value);\n    } catch {\n      out[name] = value;\n    }\n  }\n  return out;\n}\n\nexport function serializeCookie(\n  name: string,\n  value: string,\n  options: CookieOptions = {},\n): string {\n  const parts = [`${name}=${encodeURIComponent(value)}`];\n  parts.push(`Path=${options.path ?? \"/\"}`);\n  if (options.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.floor(options.maxAge)}`);\n    // Expires for compatibility with clients that ignore Max-Age.\n    parts.push(`Expires=${new Date(Date.now() + options.maxAge * 1000).toUTCString()}`);\n  }\n  if (options.httpOnly ?? true) parts.push(\"HttpOnly\");\n  if (options.secure) parts.push(\"Secure\");\n  const sameSite = options.sameSite ?? \"lax\";\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  return parts.join(\"; \");\n}\n\nexport function deleteCookie(name: string, options: CookieOptions = {}): string {\n  return serializeCookie(name, \"\", { ...options, maxAge: 0 });\n}\n","import { createRemoteJWKSet } from \"jose\";\nimport type { JWTVerifyGetKey } from \"jose\";\nimport type { ResolvedConfig } from \"./config.js\";\n\ninterface DiscoveryDocument {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  jwks_uri: string;\n}\n\nexport interface Endpoints {\n  issuer: string;\n  authorizationEndpoint: string;\n  tokenEndpoint: string;\n  jwks: JWTVerifyGetKey;\n}\n\nconst endpointsCache = new Map<string, Promise<Endpoints>>();\n\n/**\n * Resolves the tenant's OAuth endpoints, preferring the OIDC discovery document\n * and falling back to Incorta's fixed `/oauth/{tenant}/...` layout when the\n * document is unreachable. Cached per issuer for the process lifetime.\n */\nexport function getEndpoints(config: ResolvedConfig): Promise<Endpoints> {\n  const cached = endpointsCache.get(config.issuer);\n  if (cached) return cached;\n\n  const promise = resolve(config).catch((error) => {\n    // Do not cache failures — a temporarily unreachable Incorta should not\n    // poison the process.\n    endpointsCache.delete(config.issuer);\n    throw error;\n  });\n  endpointsCache.set(config.issuer, promise);\n  return promise;\n}\n\nasync function resolve(config: ResolvedConfig): Promise<Endpoints> {\n  const fallback: DiscoveryDocument = {\n    issuer: config.issuer,\n    authorization_endpoint: `${config.issuer}/authorize`,\n    token_endpoint: `${config.issuer}/token`,\n    jwks_uri: `${config.issuer}/.well-known/jwks.json`,\n  };\n\n  let doc = fallback;\n  try {\n    const response = await config.fetch(config.discoveryUrl, {\n      headers: { accept: \"application/json\" },\n    });\n    if (response.ok) {\n      const body = (await response.json()) as Partial<DiscoveryDocument>;\n      doc = {\n        issuer: body.issuer ?? fallback.issuer,\n        authorization_endpoint: body.authorization_endpoint ?? fallback.authorization_endpoint,\n        token_endpoint: body.token_endpoint ?? fallback.token_endpoint,\n        jwks_uri: body.jwks_uri ?? fallback.jwks_uri,\n      };\n    }\n  } catch {\n    // Fall through to the fixed layout.\n  }\n\n  const jwks =\n    config.jwksOverride ??\n    createRemoteJWKSet(new URL(doc.jwks_uri), {\n      cacheMaxAge: 10 * 60 * 1000,\n      cooldownDuration: 30 * 1000,\n    });\n\n  return {\n    issuer: doc.issuer,\n    authorizationEndpoint: doc.authorization_endpoint,\n    tokenEndpoint: doc.token_endpoint,\n    jwks,\n  };\n}\n\n/** Test hook: clears the per-process endpoint cache. */\nexport function clearEndpointsCache(): void {\n  endpointsCache.clear();\n}\n","import { createHash } from \"node:crypto\";\nimport { EncryptJWT, jwtDecrypt } from \"jose\";\nimport type { ResolvedConfig, SessionData } from \"./config.js\";\n\n/**\n * Session and state cookies are sealed as encrypted JWTs (JWE, dir + A256GCM):\n * tamper-proof AND opaque, since the session carries the Incorta access/refresh\n * tokens. The 256-bit key is derived from the configured secret.\n */\nfunction sealKey(config: ResolvedConfig): Uint8Array {\n  return new Uint8Array(\n    createHash(\"sha256\").update(`incorta-auth:${config.secret}`).digest(),\n  );\n}\n\ninterface SealedPayload {\n  /** Guards against replaying one cookie kind as the other. */\n  purpose: \"session\" | \"state\";\n  data: unknown;\n}\n\nasync function seal(\n  config: ResolvedConfig,\n  purpose: SealedPayload[\"purpose\"],\n  data: unknown,\n  maxAgeSeconds: number,\n): Promise<string> {\n  return new EncryptJWT({ purpose, data })\n    .setProtectedHeader({ alg: \"dir\", enc: \"A256GCM\" })\n    .setIssuedAt()\n    .setExpirationTime(`${maxAgeSeconds}s`)\n    .encrypt(sealKey(config));\n}\n\nasync function unseal<T>(\n  config: ResolvedConfig,\n  purpose: SealedPayload[\"purpose\"],\n  cookieValue: string | undefined,\n): Promise<{ data: T; issuedAt: number; expiresAt: number } | null> {\n  if (!cookieValue) return null;\n  try {\n    const { payload } = await jwtDecrypt(cookieValue, sealKey(config));\n    if (payload.purpose !== purpose) return null;\n    return {\n      data: payload.data as T,\n      issuedAt: (payload.iat ?? 0) * 1000,\n      expiresAt: (payload.exp ?? 0) * 1000,\n    };\n  } catch {\n    // Expired, tampered, or sealed with a different secret — treat as absent.\n    return null;\n  }\n}\n\nexport function sealSession(config: ResolvedConfig, session: SessionData): Promise<string> {\n  return seal(config, \"session\", session, config.sessionMaxAge);\n}\n\nexport async function unsealSession(\n  config: ResolvedConfig,\n  cookieValue: string | undefined,\n): Promise<{ session: SessionData; issuedAt: number; expiresAt: number } | null> {\n  const result = await unseal<SessionData>(config, \"session\", cookieValue);\n  if (!result) return null;\n  const { data, issuedAt, expiresAt } = result;\n  if (!data || typeof data !== \"object\" || !data.user || !data.accessToken) return null;\n  return { session: data, issuedAt, expiresAt };\n}\n\n/** Login round-trip state (CSRF protection + post-login destination). */\nexport interface LoginState {\n  state: string;\n  nonce: string;\n  returnTo: string;\n}\n\nconst STATE_MAX_AGE_SECONDS = 10 * 60;\n\nexport function sealLoginState(config: ResolvedConfig, state: LoginState): Promise<string> {\n  return seal(config, \"state\", state, STATE_MAX_AGE_SECONDS);\n}\n\nexport async function unsealLoginState(\n  config: ResolvedConfig,\n  cookieValue: string | undefined,\n): Promise<LoginState | null> {\n  const result = await unseal<LoginState>(config, \"state\", cookieValue);\n  if (!result) return null;\n  const { data } = result;\n  if (!data || typeof data.state !== \"string\" || typeof data.nonce !== \"string\") return null;\n  return data;\n}\n","import { decodeJwt, jwtVerify } from \"jose\";\nimport type { JWTPayload } from \"jose\";\nimport type { IncortaUser, ResolvedConfig } from \"./config.js\";\nimport { getEndpoints } from \"./discovery.js\";\n\nexport interface TokenSet {\n  accessToken: string;\n  /** Epoch millis derived from the access token's `exp` claim. */\n  accessTokenExpiresAt: number;\n  idToken?: string;\n  refreshToken?: string;\n}\n\ninterface TokenEndpointResponse {\n  access_token?: string;\n  id_token?: string;\n  refresh_token?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport class IncortaAuthError extends Error {\n  constructor(\n    readonly code: string,\n    message: string,\n  ) {\n    super(`[incorta-auth] ${message}`);\n    this.name = \"IncortaAuthError\";\n  }\n}\n\nfunction basicAuth(config: ResolvedConfig): string {\n  const raw = `${config.clientId}:${config.clientSecret}`;\n  return `Basic ${Buffer.from(raw, \"utf8\").toString(\"base64\")}`;\n}\n\nasync function callTokenEndpoint(\n  config: ResolvedConfig,\n  params: Record<string, string>,\n): Promise<TokenSet> {\n  const { tokenEndpoint } = await getEndpoints(config);\n\n  let response: Response;\n  try {\n    response = await config.fetch(tokenEndpoint, {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        accept: \"application/json\",\n        authorization: basicAuth(config),\n      },\n      body: new URLSearchParams(params).toString(),\n    });\n  } catch (error) {\n    throw new IncortaAuthError(\n      \"incorta_unreachable\",\n      `Could not reach the Incorta token endpoint (${tokenEndpoint}): ${(error as Error).message}`,\n    );\n  }\n\n  let body: TokenEndpointResponse;\n  try {\n    body = (await response.json()) as TokenEndpointResponse;\n  } catch {\n    throw new IncortaAuthError(\n      \"invalid_token_response\",\n      `Token endpoint returned a non-JSON response (HTTP ${response.status}).`,\n    );\n  }\n\n  if (!response.ok || !body.access_token) {\n    throw new IncortaAuthError(\n      body.error ?? \"token_exchange_failed\",\n      body.error_description ?? `Token exchange failed (HTTP ${response.status}).`,\n    );\n  }\n\n  const { exp } = decodeJwt(body.access_token);\n  return {\n    accessToken: body.access_token,\n    accessTokenExpiresAt: exp ? exp * 1000 : Date.now() + 60 * 60 * 1000,\n    idToken: body.id_token,\n    refreshToken: body.refresh_token,\n  };\n}\n\nexport function exchangeCode(\n  config: ResolvedConfig,\n  code: string,\n  redirectUri: string,\n): Promise<TokenSet> {\n  return callTokenEndpoint(config, {\n    grant_type: \"authorization_code\",\n    code,\n    redirect_uri: redirectUri,\n  });\n}\n\nexport function refreshTokens(config: ResolvedConfig, refreshToken: string): Promise<TokenSet> {\n  return callTokenEndpoint(config, {\n    grant_type: \"refresh_token\",\n    refresh_token: refreshToken,\n  });\n}\n\nasync function verifyJwt(config: ResolvedConfig, token: string): Promise<JWTPayload> {\n  const { jwks, issuer } = await getEndpoints(config);\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer,\n      audience: config.clientId,\n      algorithms: [\"RS256\"],\n    });\n    return payload;\n  } catch (error) {\n    throw new IncortaAuthError(\n      \"invalid_token\",\n      `Token verification failed: ${(error as Error).message}`,\n    );\n  }\n}\n\nexport async function verifyAccessToken(\n  config: ResolvedConfig,\n  accessToken: string,\n): Promise<JWTPayload> {\n  return verifyJwt(config, accessToken);\n}\n\n/**\n * Verifies the ID token (signature, issuer, audience, nonce) and maps its\n * claims to the SDK's user shape.\n */\nexport async function verifyIdToken(\n  config: ResolvedConfig,\n  idToken: string,\n  expectedNonce: string,\n): Promise<IncortaUser> {\n  const payload = await verifyJwt(config, idToken);\n\n  if (payload.nonce !== expectedNonce) {\n    throw new IncortaAuthError(\"nonce_mismatch\", \"ID token nonce does not match the login request.\");\n  }\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\n    throw new IncortaAuthError(\"invalid_token\", \"ID token is missing the sub claim.\");\n  }\n\n  const roles = Array.isArray(payload.roles)\n    ? payload.roles.filter((role): role is string => typeof role === \"string\")\n    : [];\n\n  return {\n    sub: payload.sub,\n    name: typeof payload.name === \"string\" ? payload.name : undefined,\n    email: typeof payload.email === \"string\" ? payload.email : undefined,\n    roles,\n    tenant: typeof payload.tenant === \"string\" ? payload.tenant : config.tenant,\n  };\n}\n\n/**\n * Fallback identity when the client was registered without the `openid` scope\n * (no ID token in the response): identify the user from the verified access\n * token instead. Name/email/roles are unavailable in that case.\n */\nexport async function userFromAccessToken(\n  config: ResolvedConfig,\n  accessToken: string,\n): Promise<IncortaUser> {\n  const payload = await verifyAccessToken(config, accessToken);\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\n    throw new IncortaAuthError(\"invalid_token\", \"Access token is missing the sub claim.\");\n  }\n  return {\n    sub: payload.sub,\n    roles: [],\n    tenant: typeof payload.tenant === \"string\" ? payload.tenant : config.tenant,\n  };\n}\n","export interface RegisterClientOptions {\n  /** Incorta base URL, e.g. `http://localhost:8080/incorta`. */\n  incortaUrl: string;\n  /** Tenant to register the client in. */\n  tenant: string;\n  /** Display name of the client. */\n  name: string;\n  /** Allowed OAuth callback URLs, e.g. `http://localhost:4000/auth/callback`. */\n  redirectUris: string[];\n  /** @default \"openid profile email\" */\n  scope?: string;\n  /** @default [\"authorization_code\", \"refresh_token\"] */\n  grantTypes?: string[];\n  fetchImpl?: typeof fetch;\n}\n\nexport interface RegisteredClient {\n  clientId: string;\n  clientSecret: string;\n  /** Bearer token for managing this registration (GET/PUT/DELETE it later). */\n  registrationAccessToken?: string;\n  /** URL to manage this registration. */\n  registrationClientUri?: string;\n}\n\n/**\n * Registers an OAuth client in Incorta via RFC 7591 dynamic client\n * registration (`POST {incortaUrl}/oauth/{tenant}/register`). Incorta allows\n * unauthenticated registration for authorization_code clients; the response\n * carries the generated client_id/client_secret — store them once, e.g. in the\n * app's `.env`.\n */\nexport async function registerClient(\n  options: RegisterClientOptions,\n): Promise<RegisteredClient> {\n  const {\n    incortaUrl,\n    tenant,\n    name,\n    redirectUris,\n    scope = \"openid profile email\",\n    grantTypes = [\"authorization_code\", \"refresh_token\"],\n    fetchImpl = fetch,\n  } = options;\n\n  if (!redirectUris.length) {\n    throw new Error(\"[incorta-auth] registerClient requires at least one redirect URI.\");\n  }\n\n  const endpoint = `${incortaUrl.replace(/\\/+$/, \"\")}/oauth/${tenant}/register`;\n  const response = await fetchImpl(endpoint, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n    body: JSON.stringify({\n      client_name: name,\n      redirect_uris: redirectUris,\n      grant_types: grantTypes,\n      scope,\n      token_endpoint_auth_method: \"client_secret_basic\",\n    }),\n  });\n\n  interface RegistrationResponse {\n    client_id?: string;\n    client_secret?: string;\n    registration_access_token?: string;\n    registration_client_uri?: string;\n    error?: string;\n    error_description?: string;\n  }\n\n  let body: RegistrationResponse;\n  try {\n    body = (await response.json()) as RegistrationResponse;\n  } catch {\n    throw new Error(\n      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). ` +\n        \"Is the OAuth authorization server enabled on this cluster?\",\n    );\n  }\n\n  if (!response.ok || !body.client_id || !body.client_secret) {\n    throw new Error(\n      `[incorta-auth] Client registration failed (HTTP ${response.status}): ` +\n        `${body.error ?? \"unknown_error\"} — ${body.error_description ?? \"no description\"}`,\n    );\n  }\n\n  return {\n    clientId: body.client_id,\n    clientSecret: body.client_secret,\n    registrationAccessToken: body.registration_access_token,\n    registrationClientUri: body.registration_client_uri,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACuHA,SAAS,SAAS,OAA2B,MAAc,QAAwB;AACjF,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,2CAA2C,IAAI,iBAAiB,MAAM;AAAA,IACxE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAEO,SAAS,cAAc,QAA2B,CAAC,GAAmB;AAC3E,QAAM,MAAO,WACV,SAAS,OAAO,CAAC;AAEpB,QAAM,aAAa;AAAA,IACjB,SAAS,MAAM,cAAc,IAAI,aAAa,cAAc,aAAa;AAAA,EAC3E;AACA,QAAM,SAAS,SAAS,MAAM,UAAU,IAAI,gBAAgB,UAAU,gBAAgB;AACtF,QAAM,WAAW;AAAA,IACf,MAAM,YAAY,IAAI;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe;AAAA,IACnB,MAAM,gBAAgB,IAAI;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS;AAAA,IACb,MAAM,UAAU,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,EACF;AACA,MAAI,OAAO,SAAS,IAAI;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,GAAG;AACvD,UAAM,IAAI;AAAA,MACR,0EAA0E,QAAQ;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,UAAU,IAAI;AACnC,QAAM,aAAa,MAAM,SAAS,cAAc;AAChD,QAAM,SAAS,GAAG,UAAU,UAAU,MAAM;AAE5C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,SAAS,mBAAmB,MAAM,IAAI;AAAA,IAC9C,OAAO,MAAM,SAAS;AAAA,IACtB;AAAA,IACA,iBAAiB,GAAG,UAAU;AAAA,IAC9B,eAAe,MAAM,SAAS,UAAU,KAAK,KAAK;AAAA,IAClD,eAAe,MAAM,SAAS,UAAU;AAAA,IACxC,mBAAmB,MAAM,qBAAqB;AAAA,IAC9C;AAAA,IACA,cACE,MAAM,UAAU,gBAAgB,GAAG,MAAM;AAAA,IAC3C,cAAc,MAAM,UAAU;AAAA,IAC9B,OAAO,MAAM,UAAU,SAAS;AAAA,EAClC;AACF;;;AChMA,IAAAA,sBAA4B;;;ACSrB,SAAS,aAAa,QAA2D;AACtF,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,OAAO,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,QAAI,CAAC,KAAM;AACX,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,EAAG,SAAQ,MAAM,MAAM,GAAG,EAAE;AAC3E,QAAI;AACF,UAAI,IAAI,IAAI,mBAAmB,KAAK;AAAA,IACtC,QAAQ;AACN,UAAI,IAAI,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,gBACd,MACA,OACA,UAAyB,CAAC,GAClB;AACR,QAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC,EAAE;AACrD,QAAM,KAAK,QAAQ,QAAQ,QAAQ,GAAG,EAAE;AACxC,MAAI,QAAQ,WAAW,QAAW;AAChC,UAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,CAAC,EAAE;AAElD,UAAM,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,SAAS,GAAI,EAAE,YAAY,CAAC,EAAE;AAAA,EACpF;AACA,MAAI,QAAQ,YAAY,KAAM,OAAM,KAAK,UAAU;AACnD,MAAI,QAAQ,OAAQ,OAAM,KAAK,QAAQ;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,KAAK,YAAY,SAAS,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE;AAC7E,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,aAAa,MAAc,UAAyB,CAAC,GAAW;AAC9E,SAAO,gBAAgB,MAAM,IAAI,EAAE,GAAG,SAAS,QAAQ,EAAE,CAAC;AAC5D;;;ACjDA,kBAAmC;AAkBnC,IAAM,iBAAiB,oBAAI,IAAgC;AAOpD,SAAS,aAAa,QAA4C;AACvE,QAAM,SAAS,eAAe,IAAI,OAAO,MAAM;AAC/C,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,QAAQ,MAAM,EAAE,MAAM,CAAC,UAAU;AAG/C,mBAAe,OAAO,OAAO,MAAM;AACnC,UAAM;AAAA,EACR,CAAC;AACD,iBAAe,IAAI,OAAO,QAAQ,OAAO;AACzC,SAAO;AACT;AAEA,eAAe,QAAQ,QAA4C;AACjE,QAAM,WAA8B;AAAA,IAClC,QAAQ,OAAO;AAAA,IACf,wBAAwB,GAAG,OAAO,MAAM;AAAA,IACxC,gBAAgB,GAAG,OAAO,MAAM;AAAA,IAChC,UAAU,GAAG,OAAO,MAAM;AAAA,EAC5B;AAEA,MAAI,MAAM;AACV,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,MAAM,OAAO,cAAc;AAAA,MACvD,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACxC,CAAC;AACD,QAAI,SAAS,IAAI;AACf,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,YAAM;AAAA,QACJ,QAAQ,KAAK,UAAU,SAAS;AAAA,QAChC,wBAAwB,KAAK,0BAA0B,SAAS;AAAA,QAChE,gBAAgB,KAAK,kBAAkB,SAAS;AAAA,QAChD,UAAU,KAAK,YAAY,SAAS;AAAA,MACtC;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,OACJ,OAAO,oBACP,gCAAmB,IAAI,IAAI,IAAI,QAAQ,GAAG;AAAA,IACxC,aAAa,KAAK,KAAK;AAAA,IACvB,kBAAkB,KAAK;AAAA,EACzB,CAAC;AAEH,SAAO;AAAA,IACL,QAAQ,IAAI;AAAA,IACZ,uBAAuB,IAAI;AAAA,IAC3B,eAAe,IAAI;AAAA,IACnB;AAAA,EACF;AACF;;;AC9EA,yBAA2B;AAC3B,IAAAC,eAAuC;AAQvC,SAAS,QAAQ,QAAoC;AACnD,SAAO,IAAI;AAAA,QACT,+BAAW,QAAQ,EAAE,OAAO,gBAAgB,OAAO,MAAM,EAAE,EAAE,OAAO;AAAA,EACtE;AACF;AAQA,eAAe,KACb,QACA,SACA,MACA,eACiB;AACjB,SAAO,IAAI,wBAAW,EAAE,SAAS,KAAK,CAAC,EACpC,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,GAAG,aAAa,GAAG,EACrC,QAAQ,QAAQ,MAAM,CAAC;AAC5B;AAEA,eAAe,OACb,QACA,SACA,aACkE;AAClE,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,UAAM,yBAAW,aAAa,QAAQ,MAAM,CAAC;AACjE,QAAI,QAAQ,YAAY,QAAS,QAAO;AACxC,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,WAAW,QAAQ,OAAO,KAAK;AAAA,MAC/B,YAAY,QAAQ,OAAO,KAAK;AAAA,IAClC;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,YAAY,QAAwB,SAAuC;AACzF,SAAO,KAAK,QAAQ,WAAW,SAAS,OAAO,aAAa;AAC9D;AAEA,eAAsB,cACpB,QACA,aAC+E;AAC/E,QAAM,SAAS,MAAM,OAAoB,QAAQ,WAAW,WAAW;AACvE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,MAAM,UAAU,UAAU,IAAI;AACtC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,KAAK,QAAQ,CAAC,KAAK,YAAa,QAAO;AACjF,SAAO,EAAE,SAAS,MAAM,UAAU,UAAU;AAC9C;AASA,IAAM,wBAAwB,KAAK;AAE5B,SAAS,eAAe,QAAwB,OAAoC;AACzF,SAAO,KAAK,QAAQ,SAAS,OAAO,qBAAqB;AAC3D;AAEA,eAAsB,iBACpB,QACA,aAC4B;AAC5B,QAAM,SAAS,MAAM,OAAmB,QAAQ,SAAS,WAAW;AACpE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,KAAK,IAAI;AACjB,MAAI,CAAC,QAAQ,OAAO,KAAK,UAAU,YAAY,OAAO,KAAK,UAAU,SAAU,QAAO;AACtF,SAAO;AACT;;;AC3FA,IAAAC,eAAqC;AAqB9B,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACW,MACT,SACA;AACA,UAAM,kBAAkB,OAAO,EAAE;AAHxB;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAEA,SAAS,UAAU,QAAgC;AACjD,QAAM,MAAM,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY;AACrD,SAAO,SAAS,OAAO,KAAK,KAAK,MAAM,EAAE,SAAS,QAAQ,CAAC;AAC7D;AAEA,eAAe,kBACb,QACA,QACmB;AACnB,QAAM,EAAE,cAAc,IAAI,MAAM,aAAa,MAAM;AAEnD,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,OAAO,MAAM,eAAe;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,IAAI,gBAAgB,MAAM,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+CAA+C,aAAa,MAAO,MAAgB,OAAO;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,SAAS,MAAM;AAAA,IACtE;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,MAAM,CAAC,KAAK,cAAc;AACtC,UAAM,IAAI;AAAA,MACR,KAAK,SAAS;AAAA,MACd,KAAK,qBAAqB,+BAA+B,SAAS,MAAM;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,EAAE,IAAI,QAAI,wBAAU,KAAK,YAAY;AAC3C,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,IAClB,sBAAsB,MAAM,MAAM,MAAO,KAAK,IAAI,IAAI,KAAK,KAAK;AAAA,IAChE,SAAS,KAAK;AAAA,IACd,cAAc,KAAK;AAAA,EACrB;AACF;AAEO,SAAS,aACd,QACA,MACA,aACmB;AACnB,SAAO,kBAAkB,QAAQ;AAAA,IAC/B,YAAY;AAAA,IACZ;AAAA,IACA,cAAc;AAAA,EAChB,CAAC;AACH;AAEO,SAAS,cAAc,QAAwB,cAAyC;AAC7F,SAAO,kBAAkB,QAAQ;AAAA,IAC/B,YAAY;AAAA,IACZ,eAAe;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,UAAU,QAAwB,OAAoC;AACnF,QAAM,EAAE,MAAM,OAAO,IAAI,MAAM,aAAa,MAAM;AAClD,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,UAAM,wBAAU,OAAO,MAAM;AAAA,MAC/C;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA+B,MAAgB,OAAO;AAAA,IACxD;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,QACA,aACqB;AACrB,SAAO,UAAU,QAAQ,WAAW;AACtC;AAMA,eAAsB,cACpB,QACA,SACA,eACsB;AACtB,QAAM,UAAU,MAAM,UAAU,QAAQ,OAAO;AAE/C,MAAI,QAAQ,UAAU,eAAe;AACnC,UAAM,IAAI,iBAAiB,kBAAkB,kDAAkD;AAAA,EACjG;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,iBAAiB,iBAAiB,oCAAoC;AAAA,EAClF;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IACrC,QAAQ,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,IACvE,CAAC;AAEL,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAC3D;AAAA,IACA,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAOA,eAAsB,oBACpB,QACA,aACsB;AACtB,QAAM,UAAU,MAAM,kBAAkB,QAAQ,WAAW;AAC3D,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,iBAAiB,iBAAiB,wCAAwC;AAAA,EACtF;AACA,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,OAAO,CAAC;AAAA,IACR,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;;;AJvJA,IAAM,iCAAiC,KAAK;AAE5C,SAAS,cAAc,QAAwB,SAA0B;AACvE,MAAI,OAAO,OAAQ,QAAO,OAAO;AACjC,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,QACJ,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC9D,IAAI,SAAS,QAAQ,KAAK,EAAE;AAC9B,QAAM,OACJ,QAAQ,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC7D,QAAQ,QAAQ,IAAI,MAAM,KAC1B,IAAI;AACN,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEA,SAAS,gBAAgB,QAAwB,SAA2B;AAC1E,MAAI,OAAO,kBAAkB,OAAQ,QAAO,OAAO;AACnD,SAAO,cAAc,QAAQ,OAAO,EAAE,WAAW,UAAU;AAC7D;AAMA,SAAS,iBAAiB,KAAoB,QAAwB;AACpE,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAI,IAAI,WAAW,OAAQ,QAAO,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI,MAAM;AAAA,EACjF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,KAAK,QAAgB,MAAe,UAAoB,CAAC,GAAa;AAC7E,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,EACnB,CAAC;AACD,aAAW,UAAU,QAAS,SAAQ,OAAO,cAAc,MAAM;AACjE,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,QAAQ,CAAC;AAC/D;AAEA,SAAS,SAAS,UAAkB,UAAoB,CAAC,GAAa;AACpE,QAAM,UAAU,IAAI,QAAQ,EAAE,UAAU,iBAAiB,WAAW,CAAC;AACrE,aAAW,UAAU,QAAS,SAAQ,OAAO,cAAc,MAAM;AACjE,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAEA,SAAS,eAAe,QAAgB,MAAsB;AAC5D,QAAM,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM;AAC/C,SAAO,GAAG,MAAM,GAAG,SAAS,sBAAsB,mBAAmB,IAAI,CAAC;AAC5E;AAEA,SAAS,cAAsB;AAC7B,aAAO,iCAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEO,SAAS,cAAc,QAG5B;AACA,QAAM,uBAAuB,CAAC,YAAqB;AAAA,IACjD,UAAU;AAAA,IACV;AAAA,IACA,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AAEA,iBAAe,MAAM,SAAkB,KAA6B;AAClE,UAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,WAAW,iBAAiB,IAAI,aAAa,IAAI,aAAa,GAAG,MAAM;AAG7E,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,SAAU,QAAO,SAAS,QAAQ;AAEtC,UAAM,QAAQ,YAAY;AAC1B,UAAM,QAAQ,YAAY;AAC1B,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,MACP,MAAM,eAAe,QAAQ,EAAE,OAAO,OAAO,SAAS,CAAC;AAAA,MACvD,EAAE,GAAG,qBAAqB,MAAM,GAAG,QAAQ,IAAI;AAAA,IACjD;AAEA,UAAM,EAAE,sBAAsB,IAAI,MAAM,aAAa,MAAM;AAC3D,UAAM,eAAe,IAAI,IAAI,qBAAqB;AAClD,iBAAa,aAAa,IAAI,iBAAiB,MAAM;AACrD,iBAAa,aAAa,IAAI,aAAa,OAAO,QAAQ;AAC1D,iBAAa,aAAa,IAAI,gBAAgB,GAAG,MAAM,GAAG,OAAO,QAAQ,WAAW;AACpF,iBAAa,aAAa,IAAI,SAAS,OAAO,KAAK;AACnD,iBAAa,aAAa,IAAI,SAAS,KAAK;AAC5C,iBAAa,aAAa,IAAI,SAAS,KAAK;AAE5C,WAAO,SAAS,aAAa,SAAS,GAAG,CAAC,WAAW,CAAC;AAAA,EACxD;AAEA,iBAAe,SAAS,SAAkB,KAA6B;AACrE,UAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,aAAa,aAAa,OAAO,iBAAiB,qBAAqB,MAAM,CAAC;AAEpF,UAAM,aAAa,MAAM,iBAAiB,QAAQ,QAAQ,OAAO,eAAe,CAAC;AACjF,UAAM,WAAW,iBAAiB,YAAY,YAAY,MAAM,MAAM;AAEtE,UAAM,OAAO,CAACC,UAAiB,SAAS,eAAe,UAAUA,KAAI,GAAG,CAAC,UAAU,CAAC;AAEpF,UAAM,aAAa,IAAI,aAAa,IAAI,OAAO;AAC/C,QAAI,WAAY,QAAO,KAAK,UAAU;AAEtC,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,QAAI,CAAC,QAAQ,CAAC,MAAO,QAAO,KAAK,cAAc;AAC/C,QAAI,CAAC,WAAY,QAAO,KAAK,eAAe;AAC5C,QAAI,UAAU,WAAW,MAAO,QAAO,KAAK,gBAAgB;AAE5D,QAAI;AACF,YAAM,SAAS,MAAM,aAAa,QAAQ,MAAM,GAAG,MAAM,GAAG,OAAO,QAAQ,WAAW;AACtF,YAAM,OAAO,OAAO,UAChB,MAAM,cAAc,QAAQ,OAAO,SAAS,WAAW,KAAK,IAC5D,MAAM,oBAAoB,QAAQ,OAAO,WAAW;AAExD,YAAM,UAAuB;AAAA,QAC3B;AAAA,QACA,aAAa,OAAO;AAAA,QACpB,sBAAsB,OAAO;AAAA,QAC7B,cAAc,OAAO;AAAA,QACrB,WAAW,KAAK,IAAI;AAAA,MACtB;AACA,YAAM,gBAAgB;AAAA,QACpB,OAAO;AAAA,QACP,MAAM,YAAY,QAAQ,OAAO;AAAA,QACjC,EAAE,GAAG,qBAAqB,MAAM,GAAG,QAAQ,OAAO,cAAc;AAAA,MAClE;AACA,aAAO,SAAS,UAAU,CAAC,eAAe,UAAU,CAAC;AAAA,IACvD,SAAS,OAAO;AACd,YAAMA,QAAO,iBAAiB,mBAAmB,MAAM,OAAO;AAC9D,aAAO,KAAKA,KAAI;AAAA,IAClB;AAAA,EACF;AAOA,iBAAe,YAAY,SAIxB;AACD,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,kBAAkB,GAAG,YAAY,CAAC,EAAE;AAE3E,QAAI,EAAE,QAAQ,IAAI;AAClB,QAAI,aAAa;AACjB,UAAM,MAAM,KAAK,IAAI;AAErB,QAAI,QAAQ,uBAAuB,MAAM,gCAAgC;AACvE,UAAI,QAAQ,cAAc;AACxB,YAAI;AACF,gBAAM,SAAS,MAAM,cAAc,QAAQ,QAAQ,YAAY;AAC/D,oBAAU;AAAA,YACR,GAAG;AAAA,YACH,aAAa,OAAO;AAAA,YACpB,sBAAsB,OAAO;AAAA,YAC7B,cAAc,OAAO,gBAAgB,QAAQ;AAAA,UAC/C;AACA,uBAAa;AAAA,QACf,QAAQ;AAGN,cAAI,QAAQ,wBAAwB,KAAK;AACvC,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,kBAAkB;AAAA,cAClB,YAAY,CAAC,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC,CAAC;AAAA,YAC5E;AAAA,UACF;AAAA,QACF;AAAA,MACF,WAAW,QAAQ,wBAAwB,KAAK;AAC9C,eAAO;AAAA,UACL,SAAS;AAAA,UACT,kBAAkB;AAAA,UAClB,YAAY,CAAC,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC,CAAC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAc,OAAO,gBAAgB,MAAQ;AACnD,QAAI,MAAM,SAAS,WAAW,WAAY,cAAa;AAEvD,QAAI,CAAC,YAAY;AACf,aAAO,EAAE,SAAS,kBAAkB,SAAS,WAAW,YAAY,CAAC,EAAE;AAAA,IACzE;AACA,UAAM,WAAW,gBAAgB,OAAO,YAAY,MAAM,YAAY,QAAQ,OAAO,GAAG;AAAA,MACtF,GAAG,qBAAqB,MAAM;AAAA,MAC9B,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,WAAO;AAAA,MACL;AAAA,MACA,kBAAkB,MAAM,OAAO,gBAAgB;AAAA,MAC/C,YAAY,CAAC,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,iBAAe,aAAa,SAAqC;AAC/D,UAAM,EAAE,SAAS,kBAAkB,WAAW,IAAI,MAAM,YAAY,OAAO;AAC3E,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,EAAE,MAAM,KAAK,GAAG,UAAU;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM,QAAQ;AAAA,QACd,SAAS;AAAA,UACP,WAAW;AAAA,UACX,sBAAsB,QAAQ;AAAA,QAChC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,WAAW,SAAqC;AAC7D,QAAI,CAAC,OAAO,kBAAmB,QAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AACtE,UAAM,EAAE,SAAS,WAAW,IAAI,MAAM,YAAY,OAAO;AACzD,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,EAAE,OAAO,kBAAkB,GAAG,UAAU;AACvE,WAAO;AAAA,MACL;AAAA,MACA,EAAE,aAAa,QAAQ,aAAa,WAAW,QAAQ,qBAAqB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OAAO,SAAkB,KAA6B;AACnE,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,eAAe,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC;AACjF,QAAI,QAAQ,WAAW,OAAO;AAC5B,YAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,YAAM,WAAW,iBAAiB,IAAI,aAAa,IAAI,aAAa,GAAG,MAAM;AAC7E,aAAO,SAAS,UAAU,CAAC,YAAY,CAAC;AAAA,IAC1C;AACA,WAAO,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,CAAC,YAAY,CAAC;AAAA,EAC/C;AAEA,iBAAe,QAAQ,SAAqC;AAC1D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,IAAI,aAAa,OAAO,YAAY,CAAC,IAAI,SAAS,WAAW,GAAG,OAAO,QAAQ,GAAG,GAAG;AACvF,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AACA,UAAM,QAAQ,IAAI,SAAS,MAAM,OAAO,SAAS,MAAM,KAAK;AAC5D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAE1C,QAAI;AACF,UAAI,UAAU,YAAY,WAAW,MAAO,QAAO,MAAM,MAAM,SAAS,GAAG;AAC3E,UAAI,UAAU,eAAe,WAAW,MAAO,QAAO,MAAM,SAAS,SAAS,GAAG;AACjF,UAAI,UAAU,cAAc,WAAW,MAAO,QAAO,MAAM,aAAa,OAAO;AAC/E,UAAI,UAAU,YAAY,WAAW,MAAO,QAAO,MAAM,WAAW,OAAO;AAC3E,UAAI,UAAU,cAAc,WAAW,UAAU,WAAW,QAAQ;AAClE,eAAO,MAAM,OAAO,SAAS,GAAG;AAAA,MAClC;AACA,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC,SAAS,OAAO;AACd,YAAM,OAAO,iBAAiB,mBAAmB,MAAM,OAAO;AAC9D,YAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,cAAQ,MAAM,kBAAkB,KAAK,YAAY,OAAO;AACxD,aAAO,KAAK,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,IAClC;AAAA,EACF;AAEA,iBAAe,WAAW,SAA+C;AACvE,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,EAAE,SAAS,UAAU,IAAI;AAC/B,QAAI,QAAQ,wBAAwB,KAAK,IAAI,KAAK,CAAC,QAAQ,aAAc,QAAO;AAChF,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,sBAAsB,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,WAAW;AAC/B;;;AK/RA,eAAsB,eACpB,SAC2B;AAC3B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,aAAa,CAAC,sBAAsB,eAAe;AAAA,IACnD,YAAY;AAAA,EACd,IAAI;AAEJ,MAAI,CAAC,aAAa,QAAQ;AACxB,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAEA,QAAM,WAAW,GAAG,WAAW,QAAQ,QAAQ,EAAE,CAAC,UAAU,MAAM;AAClE,QAAM,WAAW,MAAM,UAAU,UAAU;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oBAAoB,QAAQ,mBAAmB;AAAA,IAC1E,MAAM,KAAK,UAAU;AAAA,MACnB,aAAa;AAAA,MACb,eAAe;AAAA,MACf,aAAa;AAAA,MACb;AAAA,MACA,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH,CAAC;AAWD,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,yEAAyE,SAAS,MAAM;AAAA,IAE1F;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,MAAM,CAAC,KAAK,aAAa,CAAC,KAAK,eAAe;AAC1D,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,MAC7D,KAAK,SAAS,eAAe,WAAM,KAAK,qBAAqB,gBAAgB;AAAA,IACpF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,cAAc,KAAK;AAAA,IACnB,yBAAyB,KAAK;AAAA,IAC9B,uBAAuB,KAAK;AAAA,EAC9B;AACF;;;APrDO,SAAS,kBAAkB,SAA4B,CAAC,GAAgB;AAC7E,QAAM,WAAW,cAAc,MAAM;AACrC,QAAM,EAAE,SAAS,WAAW,IAAI,cAAc,QAAQ;AACtD,SAAO,EAAE,SAAS,YAAY,QAAQ,SAAS;AACjD;","names":["import_node_crypto","import_jose","import_jose","code"]}
+{"version":3,"sources":["../src/index.ts","../src/core/config.ts","../src/core/handler.ts","../src/core/cookies.ts","../src/core/discovery.ts","../src/core/session.ts","../src/core/tokens.ts","../src/core/register.ts"],"sourcesContent":["import { resolveConfig } from \"./core/config.js\";\nimport type { IncortaAuthConfig, ResolvedConfig } from \"./core/config.js\";\nimport { createHandler } from \"./core/handler.js\";\nimport type { AuthHandler, AuthSession } from \"./core/handler.js\";\n\nexport type {\n  IncortaAuthConfig,\n  IncortaUser,\n  SessionData,\n  SessionInfo,\n} from \"./core/config.js\";\nexport type { AuthHandler, AuthSession } from \"./core/handler.js\";\nexport { IncortaAuthError } from \"./core/tokens.js\";\nexport { getClient, registerClient, updateClientRedirectUris } from \"./core/register.js\";\nexport type {\n  ClientInfo,\n  ManageClientOptions,\n  RegisterClientOptions,\n  RegisteredClient,\n  UpdateRedirectUrisOptions,\n} from \"./core/register.js\";\n\nexport interface IncortaAuth {\n  /**\n   * Web-standard request handler serving the auth routes under\n   * `config.basePath` (default `/auth`): `/login`, `/callback`, `/session`,\n   * `/logout` (+ `/token` when `exposeAccessToken` is on).\n   *\n   * Wire it to anything that speaks `Request`/`Response` — a TanStack Start\n   * server route, Bun.serve, or via `@incorta/auth/node` / `@incorta/auth/express`\n   * for Node servers.\n   */\n  handler: AuthHandler;\n  /**\n   * Reads the session from a web-standard `Request` (server-side gating, API\n   * routes, server functions). Returns null when the user is not signed in.\n   */\n  getSession: (request: Request) => Promise<AuthSession | null>;\n  /** The resolved configuration (secrets included — do not log). */\n  config: ResolvedConfig;\n}\n\n/**\n * Creates an IncortaAuth instance: OAuth 2.0 authorization-code flow against\n * Incorta's built-in authorization server. Unauthenticated users are redirected\n * to the Incorta login page and returned to your app once signed in.\n */\nexport function createIncortaAuth(config: IncortaAuthConfig = {}): IncortaAuth {\n  const resolved = resolveConfig(config);\n  const { handler, getSession } = createHandler(resolved);\n  return { handler, getSession, config: resolved };\n}\n","import type { JWTVerifyGetKey } from \"jose\";\n\n/** The Incorta user identity carried by the session (claims from the ID token). */\nexport interface IncortaUser {\n  /** Incorta login name (`sub` claim). */\n  sub: string;\n  name?: string;\n  email?: string;\n  /** Incorta role names, as minted into the ID token. */\n  roles: string[];\n  /** Tenant the user authenticated against. */\n  tenant: string;\n}\n\n/** What the sealed session cookie holds. */\nexport interface SessionData {\n  user: IncortaUser;\n  /** Incorta-issued access token (RS256 JWT, aud = client_id). */\n  accessToken: string;\n  /** Epoch millis when the access token expires. */\n  accessTokenExpiresAt: number;\n  /** Rotating refresh token, present when the client has the refresh_token grant. */\n  refreshToken?: string;\n  /** Epoch millis when this session was first created (login time). */\n  createdAt: number;\n}\n\nexport interface SessionInfo {\n  user: IncortaUser;\n  /** Epoch millis when the session cookie expires (sliding). */\n  expiresAt: number;\n  /** Epoch millis when the access token expires. */\n  accessTokenExpiresAt: number;\n}\n\nexport interface IncortaAuthConfig {\n  /**\n   * Base URL of the Incorta web application, e.g. `https://acme.cloud.incorta.com/incorta`\n   * or `http://localhost:8080/incorta`. Defaults to `INCORTA_URL`.\n   */\n  incortaUrl?: string;\n  /** Incorta tenant name, e.g. `demo`. Defaults to `INCORTA_TENANT`. */\n  tenant?: string;\n  /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */\n  clientId?: string;\n  /** OAuth client secret. Defaults to `INCORTA_CLIENT_SECRET`. */\n  clientSecret?: string;\n  /**\n   * Secret used to encrypt the session cookie (any long random string, >= 32 chars).\n   * Defaults to `INCORTA_AUTH_SECRET`.\n   */\n  secret?: string;\n  /**\n   * Path prefix the auth routes are mounted under. The SDK serves\n   * `{basePath}/login`, `{basePath}/callback`, `{basePath}/session`,\n   * `{basePath}/logout` (and optionally `{basePath}/token`).\n   * @default \"/auth\"\n   */\n  basePath?: string;\n  /**\n   * External origin of THIS app, e.g. `http://localhost:4000`. Used to build the\n   * OAuth callback URL and to validate `redirect_to` targets. When omitted it is\n   * derived per request from `x-forwarded-proto`/`x-forwarded-host`/`host`.\n   * Defaults to `INCORTA_APP_URL`.\n   */\n  appUrl?: string;\n  /** OAuth scopes to request. @default \"openid profile email\" */\n  scope?: string;\n  session?: {\n    /** @default \"incorta_auth_session\" */\n    cookieName?: string;\n    /** Session lifetime in seconds (sliding — renewed on activity). @default 43200 (12h) */\n    maxAge?: number;\n  };\n  cookies?: {\n    /**\n     * `Secure` attribute for cookies. `\"auto\"` sets it when the request is HTTPS.\n     * @default \"auto\"\n     */\n    secure?: boolean | \"auto\";\n  };\n  /**\n   * Expose `GET {basePath}/token` returning the raw Incorta access token to the\n   * browser (for calling Incorta public APIs directly from the frontend). Off by\n   * default — prefer proxying through your backend.\n   * @default false\n   */\n  exposeAccessToken?: boolean;\n  advanced?: {\n    /** Override the OIDC discovery document URL (rarely needed). */\n    discoveryUrl?: string;\n    /** Override JWKS resolution (used by tests to verify against a local key). */\n    jwks?: JWTVerifyGetKey;\n    /** Override fetch (used by tests). */\n    fetch?: typeof fetch;\n  };\n}\n\nexport interface ResolvedConfig {\n  incortaUrl: string;\n  tenant: string;\n  clientId: string;\n  clientSecret: string;\n  secret: string;\n  basePath: string;\n  appUrl?: string;\n  scope: string;\n  cookieName: string;\n  stateCookieName: string;\n  sessionMaxAge: number;\n  secureCookies: boolean | \"auto\";\n  exposeAccessToken: boolean;\n  /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */\n  issuer: string;\n  discoveryUrl: string;\n  jwksOverride?: JWTVerifyGetKey;\n  fetch: typeof fetch;\n}\n\nfunction required(value: string | undefined, name: string, envVar: string): string {\n  if (!value) {\n    throw new Error(\n      `[incorta-auth] Missing required config \"${name}\" (or env var ${envVar}).`,\n    );\n  }\n  return value;\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\nexport function resolveConfig(input: IncortaAuthConfig = {}): ResolvedConfig {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } })\n    .process?.env ?? {};\n\n  const incortaUrl = stripTrailingSlash(\n    required(input.incortaUrl ?? env.INCORTA_URL, \"incortaUrl\", \"INCORTA_URL\"),\n  );\n  const tenant = required(input.tenant ?? env.INCORTA_TENANT, \"tenant\", \"INCORTA_TENANT\");\n  const clientId = required(\n    input.clientId ?? env.INCORTA_CLIENT_ID,\n    \"clientId\",\n    \"INCORTA_CLIENT_ID\",\n  );\n  const clientSecret = required(\n    input.clientSecret ?? env.INCORTA_CLIENT_SECRET,\n    \"clientSecret\",\n    \"INCORTA_CLIENT_SECRET\",\n  );\n  const secret = required(\n    input.secret ?? env.INCORTA_AUTH_SECRET,\n    \"secret\",\n    \"INCORTA_AUTH_SECRET\",\n  );\n  if (secret.length < 32) {\n    throw new Error(\n      \"[incorta-auth] `secret` must be at least 32 characters. Generate one with: openssl rand -base64 32\",\n    );\n  }\n\n  const basePath = input.basePath ?? \"/auth\";\n  if (!basePath.startsWith(\"/\") || basePath.endsWith(\"/\")) {\n    throw new Error(\n      `[incorta-auth] basePath must start with \"/\" and not end with \"/\" (got \"${basePath}\").`,\n    );\n  }\n\n  const appUrl = input.appUrl ?? env.INCORTA_APP_URL;\n  const cookieName = input.session?.cookieName ?? \"incorta_auth_session\";\n  const issuer = `${incortaUrl}/oauth/${tenant}`;\n\n  return {\n    incortaUrl,\n    tenant,\n    clientId,\n    clientSecret,\n    secret,\n    basePath,\n    appUrl: appUrl ? stripTrailingSlash(appUrl) : undefined,\n    scope: input.scope ?? \"openid profile email\",\n    cookieName,\n    stateCookieName: `${cookieName}_state`,\n    sessionMaxAge: input.session?.maxAge ?? 12 * 60 * 60,\n    secureCookies: input.cookies?.secure ?? \"auto\",\n    exposeAccessToken: input.exposeAccessToken ?? false,\n    issuer,\n    discoveryUrl:\n      input.advanced?.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`,\n    jwksOverride: input.advanced?.jwks,\n    fetch: input.advanced?.fetch ?? fetch,\n  };\n}\n","import { randomBytes } from \"node:crypto\";\nimport type { ResolvedConfig, SessionData, SessionInfo } from \"./config.js\";\nimport { deleteCookie, parseCookies, serializeCookie } from \"./cookies.js\";\nimport { getEndpoints } from \"./discovery.js\";\nimport {\n  sealLoginState,\n  sealSession,\n  unsealLoginState,\n  unsealSession,\n} from \"./session.js\";\nimport {\n  IncortaAuthError,\n  exchangeCode,\n  refreshTokens,\n  userFromAccessToken,\n  verifyIdToken,\n} from \"./tokens.js\";\n\n/** A read-only view of the current session for server-side app code. */\nexport interface AuthSession extends SessionInfo {\n  /** Incorta access token — pass as `Authorization: Bearer` to Incorta APIs. */\n  accessToken: string;\n}\n\nexport type AuthHandler = (request: Request) => Promise<Response>;\n\n/** Refresh the access token when it has less than this long left to live. */\nconst ACCESS_TOKEN_REFRESH_LEEWAY_MS = 60 * 1000;\n\nfunction requestOrigin(config: ResolvedConfig, request: Request): string {\n  if (config.appUrl) return config.appUrl;\n  const url = new URL(request.url);\n  const proto =\n    request.headers.get(\"x-forwarded-proto\")?.split(\",\")[0]?.trim() ??\n    url.protocol.replace(\":\", \"\");\n  const host =\n    request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim() ??\n    request.headers.get(\"host\") ??\n    url.host;\n  return `${proto}://${host}`;\n}\n\nfunction isSecureRequest(config: ResolvedConfig, request: Request): boolean {\n  if (config.secureCookies !== \"auto\") return config.secureCookies;\n  return requestOrigin(config, request).startsWith(\"https://\");\n}\n\n/**\n * Only same-origin destinations are allowed after login/logout — anything else\n * would let a crafted link bounce users through this app to an attacker page.\n */\nfunction validateReturnTo(raw: string | null, origin: string): string {\n  if (!raw) return \"/\";\n  if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n  try {\n    const url = new URL(raw);\n    if (url.origin === origin) return `${url.pathname}${url.search}${url.hash}` || \"/\";\n  } catch {\n    // Not a URL — fall through.\n  }\n  return \"/\";\n}\n\nfunction json(status: number, body: unknown, cookies: string[] = []): Response {\n  const headers = new Headers({\n    \"content-type\": \"application/json; charset=utf-8\",\n    \"cache-control\": \"no-store\",\n  });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(JSON.stringify(body), { status, headers });\n}\n\nfunction redirect(location: string, cookies: string[] = []): Response {\n  const headers = new Headers({ location, \"cache-control\": \"no-store\" });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(null, { status: 302, headers });\n}\n\nfunction withErrorParam(target: string, code: string): string {\n  const separator = target.includes(\"?\") ? \"&\" : \"?\";\n  return `${target}${separator}incorta_auth_error=${encodeURIComponent(code)}`;\n}\n\nfunction randomToken(): string {\n  return randomBytes(16).toString(\"base64url\");\n}\n\nexport function createHandler(config: ResolvedConfig): {\n  handler: AuthHandler;\n  getSession: (request: Request) => Promise<AuthSession | null>;\n} {\n  const sessionCookieOptions = (secure: boolean) => ({\n    httpOnly: true,\n    secure,\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  });\n\n  async function login(request: Request, url: URL): Promise<Response> {\n    const origin = requestOrigin(config, request);\n    const secure = isSecureRequest(config, request);\n    const returnTo = validateReturnTo(url.searchParams.get(\"redirect_to\"), origin);\n\n    // Already signed in — skip the OAuth round trip entirely.\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const existing = await unsealSession(config, cookies[config.cookieName]);\n    if (existing) return redirect(returnTo);\n\n    const state = randomToken();\n    const nonce = randomToken();\n    const stateCookie = serializeCookie(\n      config.stateCookieName,\n      await sealLoginState(config, { state, nonce, returnTo }),\n      { ...sessionCookieOptions(secure), maxAge: 600 },\n    );\n\n    const { authorizationEndpoint } = await getEndpoints(config);\n    const authorizeUrl = new URL(authorizationEndpoint);\n    authorizeUrl.searchParams.set(\"response_type\", \"code\");\n    authorizeUrl.searchParams.set(\"client_id\", config.clientId);\n    authorizeUrl.searchParams.set(\"redirect_uri\", `${origin}${config.basePath}/callback`);\n    authorizeUrl.searchParams.set(\"scope\", config.scope);\n    authorizeUrl.searchParams.set(\"state\", state);\n    authorizeUrl.searchParams.set(\"nonce\", nonce);\n\n    return redirect(authorizeUrl.toString(), [stateCookie]);\n  }\n\n  async function callback(request: Request, url: URL): Promise<Response> {\n    const origin = requestOrigin(config, request);\n    const secure = isSecureRequest(config, request);\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const clearState = deleteCookie(config.stateCookieName, sessionCookieOptions(secure));\n\n    const loginState = await unsealLoginState(config, cookies[config.stateCookieName]);\n    const returnTo = validateReturnTo(loginState?.returnTo ?? null, origin);\n\n    const fail = (code: string) => redirect(withErrorParam(returnTo, code), [clearState]);\n\n    const oauthError = url.searchParams.get(\"error\");\n    if (oauthError) return fail(oauthError);\n\n    const code = url.searchParams.get(\"code\");\n    const state = url.searchParams.get(\"state\");\n    if (!code || !state) return fail(\"missing_code\");\n    if (!loginState) return fail(\"state_missing\");\n    if (state !== loginState.state) return fail(\"state_mismatch\");\n\n    try {\n      const tokens = await exchangeCode(config, code, `${origin}${config.basePath}/callback`);\n      const user = tokens.idToken\n        ? await verifyIdToken(config, tokens.idToken, loginState.nonce)\n        : await userFromAccessToken(config, tokens.accessToken);\n\n      const session: SessionData = {\n        user,\n        accessToken: tokens.accessToken,\n        accessTokenExpiresAt: tokens.accessTokenExpiresAt,\n        refreshToken: tokens.refreshToken,\n        createdAt: Date.now(),\n      };\n      const sessionCookie = serializeCookie(\n        config.cookieName,\n        await sealSession(config, session),\n        { ...sessionCookieOptions(secure), maxAge: config.sessionMaxAge },\n      );\n      return redirect(returnTo, [sessionCookie, clearState]);\n    } catch (error) {\n      const code = error instanceof IncortaAuthError ? error.code : \"callback_failed\";\n      return fail(code);\n    }\n  }\n\n  /**\n   * Loads the session from the request cookie; refreshes the Incorta access\n   * token (rotating the refresh token) when it is about to expire, and renews\n   * the sliding session cookie past its half-life. Returns the cookies to set.\n   */\n  async function loadSession(request: Request): Promise<{\n    session: SessionData | null;\n    sessionExpiresAt: number;\n    setCookies: string[];\n  }> {\n    const secure = isSecureRequest(config, request);\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const unsealed = await unsealSession(config, cookies[config.cookieName]);\n    if (!unsealed) return { session: null, sessionExpiresAt: 0, setCookies: [] };\n\n    let { session } = unsealed;\n    let mustReseal = false;\n    const now = Date.now();\n\n    if (session.accessTokenExpiresAt - now < ACCESS_TOKEN_REFRESH_LEEWAY_MS) {\n      if (session.refreshToken) {\n        try {\n          const tokens = await refreshTokens(config, session.refreshToken);\n          session = {\n            ...session,\n            accessToken: tokens.accessToken,\n            accessTokenExpiresAt: tokens.accessTokenExpiresAt,\n            refreshToken: tokens.refreshToken ?? session.refreshToken,\n          };\n          mustReseal = true;\n        } catch {\n          // Refresh failed (expired/rotated elsewhere). Keep the session while\n          // the current access token is still usable; otherwise sign out.\n          if (session.accessTokenExpiresAt <= now) {\n            return {\n              session: null,\n              sessionExpiresAt: 0,\n              setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))],\n            };\n          }\n        }\n      } else if (session.accessTokenExpiresAt <= now) {\n        return {\n          session: null,\n          sessionExpiresAt: 0,\n          setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))],\n        };\n      }\n    }\n\n    const halfLifeMs = (config.sessionMaxAge * 1000) / 2;\n    if (now - unsealed.issuedAt > halfLifeMs) mustReseal = true;\n\n    if (!mustReseal) {\n      return { session, sessionExpiresAt: unsealed.expiresAt, setCookies: [] };\n    }\n    const resealed = serializeCookie(config.cookieName, await sealSession(config, session), {\n      ...sessionCookieOptions(secure),\n      maxAge: config.sessionMaxAge,\n    });\n    return {\n      session,\n      sessionExpiresAt: now + config.sessionMaxAge * 1000,\n      setCookies: [resealed],\n    };\n  }\n\n  async function sessionRoute(request: Request): Promise<Response> {\n    const { session, sessionExpiresAt, setCookies } = await loadSession(request);\n    if (!session) return json(200, { user: null }, setCookies);\n    return json(\n      200,\n      {\n        user: session.user,\n        session: {\n          expiresAt: sessionExpiresAt,\n          accessTokenExpiresAt: session.accessTokenExpiresAt,\n        },\n      },\n      setCookies,\n    );\n  }\n\n  async function tokenRoute(request: Request): Promise<Response> {\n    if (!config.exposeAccessToken) return json(404, { error: \"not_found\" });\n    const { session, setCookies } = await loadSession(request);\n    if (!session) return json(401, { error: \"unauthenticated\" }, setCookies);\n    return json(\n      200,\n      { accessToken: session.accessToken, expiresAt: session.accessTokenExpiresAt },\n      setCookies,\n    );\n  }\n\n  async function logout(request: Request, url: URL): Promise<Response> {\n    const secure = isSecureRequest(config, request);\n    const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));\n    if (request.method === \"GET\") {\n      const origin = requestOrigin(config, request);\n      const returnTo = validateReturnTo(url.searchParams.get(\"redirect_to\"), origin);\n      return redirect(returnTo, [clearSession]);\n    }\n    return json(200, { ok: true }, [clearSession]);\n  }\n\n  async function handler(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    if (url.pathname !== config.basePath && !url.pathname.startsWith(`${config.basePath}/`)) {\n      return json(404, { error: \"not_found\" });\n    }\n    const route = url.pathname.slice(config.basePath.length) || \"/\";\n    const method = request.method.toUpperCase();\n\n    try {\n      if (route === \"/login\" && method === \"GET\") return await login(request, url);\n      if (route === \"/callback\" && method === \"GET\") return await callback(request, url);\n      if (route === \"/session\" && method === \"GET\") return await sessionRoute(request);\n      if (route === \"/token\" && method === \"GET\") return await tokenRoute(request);\n      if (route === \"/logout\" && (method === \"POST\" || method === \"GET\")) {\n        return await logout(request, url);\n      }\n      return json(404, { error: \"not_found\" });\n    } catch (error) {\n      const code = error instanceof IncortaAuthError ? error.code : \"internal_error\";\n      const message =\n        error instanceof Error ? error.message : \"Unexpected incorta-auth handler error\";\n      console.error(`[incorta-auth] ${route} failed:`, message);\n      return json(500, { error: code });\n    }\n  }\n\n  async function getSession(request: Request): Promise<AuthSession | null> {\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const unsealed = await unsealSession(config, cookies[config.cookieName]);\n    if (!unsealed) return null;\n    const { session, expiresAt } = unsealed;\n    if (session.accessTokenExpiresAt <= Date.now() && !session.refreshToken) return null;\n    return {\n      user: session.user,\n      accessToken: session.accessToken,\n      accessTokenExpiresAt: session.accessTokenExpiresAt,\n      expiresAt,\n    };\n  }\n\n  return { handler, getSession };\n}\n","export interface CookieOptions {\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: \"lax\" | \"strict\" | \"none\";\n  path?: string;\n  /** Seconds. 0 deletes the cookie. */\n  maxAge?: number;\n}\n\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const name = part.slice(0, eq).trim();\n    if (!name) continue;\n    let value = part.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"')) value = value.slice(1, -1);\n    try {\n      out[name] = decodeURIComponent(value);\n    } catch {\n      out[name] = value;\n    }\n  }\n  return out;\n}\n\nexport function serializeCookie(\n  name: string,\n  value: string,\n  options: CookieOptions = {},\n): string {\n  const parts = [`${name}=${encodeURIComponent(value)}`];\n  parts.push(`Path=${options.path ?? \"/\"}`);\n  if (options.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.floor(options.maxAge)}`);\n    // Expires for compatibility with clients that ignore Max-Age.\n    parts.push(`Expires=${new Date(Date.now() + options.maxAge * 1000).toUTCString()}`);\n  }\n  if (options.httpOnly ?? true) parts.push(\"HttpOnly\");\n  if (options.secure) parts.push(\"Secure\");\n  const sameSite = options.sameSite ?? \"lax\";\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  return parts.join(\"; \");\n}\n\nexport function deleteCookie(name: string, options: CookieOptions = {}): string {\n  return serializeCookie(name, \"\", { ...options, maxAge: 0 });\n}\n","import { createRemoteJWKSet } from \"jose\";\nimport type { JWTVerifyGetKey } from \"jose\";\nimport type { ResolvedConfig } from \"./config.js\";\n\ninterface DiscoveryDocument {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  jwks_uri: string;\n}\n\nexport interface Endpoints {\n  issuer: string;\n  authorizationEndpoint: string;\n  tokenEndpoint: string;\n  jwks: JWTVerifyGetKey;\n}\n\nconst endpointsCache = new Map<string, Promise<Endpoints>>();\n\n/**\n * Resolves the tenant's OAuth endpoints, preferring the OIDC discovery document\n * and falling back to Incorta's fixed `/oauth/{tenant}/...` layout when the\n * document is unreachable. Cached per issuer for the process lifetime.\n */\nexport function getEndpoints(config: ResolvedConfig): Promise<Endpoints> {\n  const cached = endpointsCache.get(config.issuer);\n  if (cached) return cached;\n\n  const promise = resolve(config).catch((error) => {\n    // Do not cache failures — a temporarily unreachable Incorta should not\n    // poison the process.\n    endpointsCache.delete(config.issuer);\n    throw error;\n  });\n  endpointsCache.set(config.issuer, promise);\n  return promise;\n}\n\nasync function resolve(config: ResolvedConfig): Promise<Endpoints> {\n  const fallback: DiscoveryDocument = {\n    issuer: config.issuer,\n    authorization_endpoint: `${config.issuer}/authorize`,\n    token_endpoint: `${config.issuer}/token`,\n    jwks_uri: `${config.issuer}/.well-known/jwks.json`,\n  };\n\n  let doc = fallback;\n  try {\n    const response = await config.fetch(config.discoveryUrl, {\n      headers: { accept: \"application/json\" },\n    });\n    if (response.ok) {\n      const body = (await response.json()) as Partial<DiscoveryDocument>;\n      doc = {\n        issuer: body.issuer ?? fallback.issuer,\n        authorization_endpoint: body.authorization_endpoint ?? fallback.authorization_endpoint,\n        token_endpoint: body.token_endpoint ?? fallback.token_endpoint,\n        jwks_uri: body.jwks_uri ?? fallback.jwks_uri,\n      };\n    }\n  } catch {\n    // Fall through to the fixed layout.\n  }\n\n  const jwks =\n    config.jwksOverride ??\n    createRemoteJWKSet(new URL(doc.jwks_uri), {\n      cacheMaxAge: 10 * 60 * 1000,\n      cooldownDuration: 30 * 1000,\n    });\n\n  return {\n    issuer: doc.issuer,\n    authorizationEndpoint: doc.authorization_endpoint,\n    tokenEndpoint: doc.token_endpoint,\n    jwks,\n  };\n}\n\n/** Test hook: clears the per-process endpoint cache. */\nexport function clearEndpointsCache(): void {\n  endpointsCache.clear();\n}\n","import { createHash } from \"node:crypto\";\nimport { EncryptJWT, jwtDecrypt } from \"jose\";\nimport type { ResolvedConfig, SessionData } from \"./config.js\";\n\n/**\n * Session and state cookies are sealed as encrypted JWTs (JWE, dir + A256GCM):\n * tamper-proof AND opaque, since the session carries the Incorta access/refresh\n * tokens. The 256-bit key is derived from the configured secret.\n */\nfunction sealKey(config: ResolvedConfig): Uint8Array {\n  return new Uint8Array(\n    createHash(\"sha256\").update(`incorta-auth:${config.secret}`).digest(),\n  );\n}\n\ninterface SealedPayload {\n  /** Guards against replaying one cookie kind as the other. */\n  purpose: \"session\" | \"state\";\n  data: unknown;\n}\n\nasync function seal(\n  config: ResolvedConfig,\n  purpose: SealedPayload[\"purpose\"],\n  data: unknown,\n  maxAgeSeconds: number,\n): Promise<string> {\n  return new EncryptJWT({ purpose, data })\n    .setProtectedHeader({ alg: \"dir\", enc: \"A256GCM\" })\n    .setIssuedAt()\n    .setExpirationTime(`${maxAgeSeconds}s`)\n    .encrypt(sealKey(config));\n}\n\nasync function unseal<T>(\n  config: ResolvedConfig,\n  purpose: SealedPayload[\"purpose\"],\n  cookieValue: string | undefined,\n): Promise<{ data: T; issuedAt: number; expiresAt: number } | null> {\n  if (!cookieValue) return null;\n  try {\n    const { payload } = await jwtDecrypt(cookieValue, sealKey(config));\n    if (payload.purpose !== purpose) return null;\n    return {\n      data: payload.data as T,\n      issuedAt: (payload.iat ?? 0) * 1000,\n      expiresAt: (payload.exp ?? 0) * 1000,\n    };\n  } catch {\n    // Expired, tampered, or sealed with a different secret — treat as absent.\n    return null;\n  }\n}\n\nexport function sealSession(config: ResolvedConfig, session: SessionData): Promise<string> {\n  return seal(config, \"session\", session, config.sessionMaxAge);\n}\n\nexport async function unsealSession(\n  config: ResolvedConfig,\n  cookieValue: string | undefined,\n): Promise<{ session: SessionData; issuedAt: number; expiresAt: number } | null> {\n  const result = await unseal<SessionData>(config, \"session\", cookieValue);\n  if (!result) return null;\n  const { data, issuedAt, expiresAt } = result;\n  if (!data || typeof data !== \"object\" || !data.user || !data.accessToken) return null;\n  return { session: data, issuedAt, expiresAt };\n}\n\n/** Login round-trip state (CSRF protection + post-login destination). */\nexport interface LoginState {\n  state: string;\n  nonce: string;\n  returnTo: string;\n}\n\nconst STATE_MAX_AGE_SECONDS = 10 * 60;\n\nexport function sealLoginState(config: ResolvedConfig, state: LoginState): Promise<string> {\n  return seal(config, \"state\", state, STATE_MAX_AGE_SECONDS);\n}\n\nexport async function unsealLoginState(\n  config: ResolvedConfig,\n  cookieValue: string | undefined,\n): Promise<LoginState | null> {\n  const result = await unseal<LoginState>(config, \"state\", cookieValue);\n  if (!result) return null;\n  const { data } = result;\n  if (!data || typeof data.state !== \"string\" || typeof data.nonce !== \"string\") return null;\n  return data;\n}\n","import { decodeJwt, jwtVerify } from \"jose\";\nimport type { JWTPayload } from \"jose\";\nimport type { IncortaUser, ResolvedConfig } from \"./config.js\";\nimport { getEndpoints } from \"./discovery.js\";\n\nexport interface TokenSet {\n  accessToken: string;\n  /** Epoch millis derived from the access token's `exp` claim. */\n  accessTokenExpiresAt: number;\n  idToken?: string;\n  refreshToken?: string;\n}\n\ninterface TokenEndpointResponse {\n  access_token?: string;\n  id_token?: string;\n  refresh_token?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport class IncortaAuthError extends Error {\n  constructor(\n    readonly code: string,\n    message: string,\n  ) {\n    super(`[incorta-auth] ${message}`);\n    this.name = \"IncortaAuthError\";\n  }\n}\n\nfunction basicAuth(config: ResolvedConfig): string {\n  const raw = `${config.clientId}:${config.clientSecret}`;\n  return `Basic ${Buffer.from(raw, \"utf8\").toString(\"base64\")}`;\n}\n\nasync function callTokenEndpoint(\n  config: ResolvedConfig,\n  params: Record<string, string>,\n): Promise<TokenSet> {\n  const { tokenEndpoint } = await getEndpoints(config);\n\n  let response: Response;\n  try {\n    response = await config.fetch(tokenEndpoint, {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        accept: \"application/json\",\n        authorization: basicAuth(config),\n      },\n      body: new URLSearchParams(params).toString(),\n    });\n  } catch (error) {\n    throw new IncortaAuthError(\n      \"incorta_unreachable\",\n      `Could not reach the Incorta token endpoint (${tokenEndpoint}): ${(error as Error).message}`,\n    );\n  }\n\n  let body: TokenEndpointResponse;\n  try {\n    body = (await response.json()) as TokenEndpointResponse;\n  } catch {\n    throw new IncortaAuthError(\n      \"invalid_token_response\",\n      `Token endpoint returned a non-JSON response (HTTP ${response.status}).`,\n    );\n  }\n\n  if (!response.ok || !body.access_token) {\n    throw new IncortaAuthError(\n      body.error ?? \"token_exchange_failed\",\n      body.error_description ?? `Token exchange failed (HTTP ${response.status}).`,\n    );\n  }\n\n  const { exp } = decodeJwt(body.access_token);\n  return {\n    accessToken: body.access_token,\n    accessTokenExpiresAt: exp ? exp * 1000 : Date.now() + 60 * 60 * 1000,\n    idToken: body.id_token,\n    refreshToken: body.refresh_token,\n  };\n}\n\nexport function exchangeCode(\n  config: ResolvedConfig,\n  code: string,\n  redirectUri: string,\n): Promise<TokenSet> {\n  return callTokenEndpoint(config, {\n    grant_type: \"authorization_code\",\n    code,\n    redirect_uri: redirectUri,\n  });\n}\n\nexport function refreshTokens(config: ResolvedConfig, refreshToken: string): Promise<TokenSet> {\n  return callTokenEndpoint(config, {\n    grant_type: \"refresh_token\",\n    refresh_token: refreshToken,\n  });\n}\n\nasync function verifyJwt(config: ResolvedConfig, token: string): Promise<JWTPayload> {\n  const { jwks, issuer } = await getEndpoints(config);\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer,\n      audience: config.clientId,\n      algorithms: [\"RS256\"],\n    });\n    return payload;\n  } catch (error) {\n    throw new IncortaAuthError(\n      \"invalid_token\",\n      `Token verification failed: ${(error as Error).message}`,\n    );\n  }\n}\n\nexport async function verifyAccessToken(\n  config: ResolvedConfig,\n  accessToken: string,\n): Promise<JWTPayload> {\n  return verifyJwt(config, accessToken);\n}\n\n/**\n * Verifies the ID token (signature, issuer, audience, nonce) and maps its\n * claims to the SDK's user shape.\n */\nexport async function verifyIdToken(\n  config: ResolvedConfig,\n  idToken: string,\n  expectedNonce: string,\n): Promise<IncortaUser> {\n  const payload = await verifyJwt(config, idToken);\n\n  if (payload.nonce !== expectedNonce) {\n    throw new IncortaAuthError(\"nonce_mismatch\", \"ID token nonce does not match the login request.\");\n  }\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\n    throw new IncortaAuthError(\"invalid_token\", \"ID token is missing the sub claim.\");\n  }\n\n  const roles = Array.isArray(payload.roles)\n    ? payload.roles.filter((role): role is string => typeof role === \"string\")\n    : [];\n\n  return {\n    sub: payload.sub,\n    name: typeof payload.name === \"string\" ? payload.name : undefined,\n    email: typeof payload.email === \"string\" ? payload.email : undefined,\n    roles,\n    tenant: typeof payload.tenant === \"string\" ? payload.tenant : config.tenant,\n  };\n}\n\n/**\n * Fallback identity when the client was registered without the `openid` scope\n * (no ID token in the response): identify the user from the verified access\n * token instead. Name/email/roles are unavailable in that case.\n */\nexport async function userFromAccessToken(\n  config: ResolvedConfig,\n  accessToken: string,\n): Promise<IncortaUser> {\n  const payload = await verifyAccessToken(config, accessToken);\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\n    throw new IncortaAuthError(\"invalid_token\", \"Access token is missing the sub claim.\");\n  }\n  return {\n    sub: payload.sub,\n    roles: [],\n    tenant: typeof payload.tenant === \"string\" ? payload.tenant : config.tenant,\n  };\n}\n","interface ManagementErrorBody {\n  error?: string;\n  error_description?: string;\n}\n\nfunction registrationEndpoint(incortaUrl: string, tenant: string, clientId?: string): string {\n  const base = `${incortaUrl.replace(/\\/+$/, \"\")}/oauth/${tenant}/register`;\n  return clientId ? `${base}/${clientId}` : base;\n}\n\nasync function readJson<T extends ManagementErrorBody>(\n  response: Response,\n  what: string,\n): Promise<T> {\n  let body: T;\n  try {\n    body = (await response.json()) as T;\n  } catch {\n    throw new Error(\n      `[incorta-auth] ${what} returned a non-JSON response (HTTP ${response.status}). ` +\n        \"Is the OAuth authorization server enabled on this cluster?\",\n    );\n  }\n  if (!response.ok) {\n    throw new Error(\n      `[incorta-auth] ${what} failed (HTTP ${response.status}): ` +\n        `${body.error ?? \"unknown_error\"} — ${body.error_description ?? \"no description\"}`,\n    );\n  }\n  return body;\n}\n\nexport interface RegisterClientOptions {\n  /** Incorta base URL, e.g. `http://localhost:8080/incorta`. */\n  incortaUrl: string;\n  /** Tenant to register the client in. */\n  tenant: string;\n  /** Display name of the client. */\n  name: string;\n  /** Allowed OAuth callback URLs, e.g. `http://localhost:4000/auth/callback`. */\n  redirectUris: string[];\n  /** @default \"openid profile email\" */\n  scope?: string;\n  /** @default [\"authorization_code\", \"refresh_token\"] */\n  grantTypes?: string[];\n  fetchImpl?: typeof fetch;\n}\n\nexport interface RegisteredClient {\n  clientId: string;\n  clientSecret: string;\n  /** Bearer token for managing this registration (GET/PUT/DELETE it later). */\n  registrationAccessToken?: string;\n  /** URL to manage this registration. */\n  registrationClientUri?: string;\n}\n\n/**\n * Registers an OAuth client in Incorta via RFC 7591 dynamic client\n * registration (`POST {incortaUrl}/oauth/{tenant}/register`). Incorta allows\n * unauthenticated registration for authorization_code clients; the response\n * carries the generated client_id/client_secret — store them once, e.g. in the\n * app's `.env`.\n */\nexport async function registerClient(\n  options: RegisterClientOptions,\n): Promise<RegisteredClient> {\n  const {\n    incortaUrl,\n    tenant,\n    name,\n    redirectUris,\n    scope = \"openid profile email\",\n    grantTypes = [\"authorization_code\", \"refresh_token\"],\n    fetchImpl = fetch,\n  } = options;\n\n  if (!redirectUris.length) {\n    throw new Error(\"[incorta-auth] registerClient requires at least one redirect URI.\");\n  }\n\n  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant), {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n    body: JSON.stringify({\n      client_name: name,\n      redirect_uris: redirectUris,\n      grant_types: grantTypes,\n      scope,\n      token_endpoint_auth_method: \"client_secret_basic\",\n    }),\n  });\n\n  interface RegistrationResponse extends ManagementErrorBody {\n    client_id?: string;\n    client_secret?: string;\n    registration_access_token?: string;\n    registration_client_uri?: string;\n  }\n\n  const body = await readJson<RegistrationResponse>(response, \"Client registration\");\n  if (!body.client_id || !body.client_secret) {\n    throw new Error(\n      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`,\n    );\n  }\n\n  return {\n    clientId: body.client_id,\n    clientSecret: body.client_secret,\n    registrationAccessToken: body.registration_access_token,\n    registrationClientUri: body.registration_client_uri,\n  };\n}\n\nexport interface ManageClientOptions {\n  /** Incorta base URL, e.g. `http://localhost:8080/incorta`. */\n  incortaUrl: string;\n  tenant: string;\n  clientId: string;\n  /** The registration access token returned when the client was registered. */\n  registrationAccessToken: string;\n  fetchImpl?: typeof fetch;\n}\n\n/** Current metadata of a registered client. */\nexport interface ClientInfo {\n  clientId: string;\n  name?: string;\n  redirectUris: string[];\n  grantTypes: string[];\n  scope?: string;\n}\n\ninterface ClientMetadataResponse extends ManagementErrorBody {\n  client_id?: string;\n  client_name?: string;\n  redirect_uris?: string[];\n  grant_types?: string[];\n  scope?: string;\n}\n\nfunction toClientInfo(body: ClientMetadataResponse, fallbackClientId: string): ClientInfo {\n  return {\n    clientId: body.client_id ?? fallbackClientId,\n    name: body.client_name,\n    redirectUris: body.redirect_uris ?? [],\n    grantTypes: body.grant_types ?? [],\n    scope: body.scope,\n  };\n}\n\n/**\n * Reads a registered client's current metadata (RFC 7592-style management,\n * `GET {incortaUrl}/oauth/{tenant}/register/{clientId}` with the registration\n * access token).\n */\nexport async function getClient(options: ManageClientOptions): Promise<ClientInfo> {\n  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;\n  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {\n    headers: {\n      accept: \"application/json\",\n      authorization: `Bearer ${registrationAccessToken}`,\n    },\n  });\n  const body = await readJson<ClientMetadataResponse>(response, \"Reading the client\");\n  return toClientInfo(body, clientId);\n}\n\nexport interface UpdateRedirectUrisOptions extends ManageClientOptions {\n  redirectUris: string[];\n  /**\n   * `\"add\"` (default) merges the given URIs into the client's current set;\n   * `\"replace\"` makes the given list the exact new set (also how URIs are\n   * removed).\n   */\n  mode?: \"add\" | \"replace\";\n}\n\n/**\n * Updates the allowed OAuth callback URLs of a registered client. Incorta's\n * management endpoint applies `redirect_uris` from the PUT body (other\n * metadata is unchanged server-side).\n */\nexport async function updateClientRedirectUris(\n  options: UpdateRedirectUrisOptions,\n): Promise<ClientInfo> {\n  const {\n    incortaUrl,\n    tenant,\n    clientId,\n    registrationAccessToken,\n    redirectUris,\n    mode = \"add\",\n    fetchImpl = fetch,\n  } = options;\n\n  if (!redirectUris.length) {\n    // An empty replace would leave the client unable to complete the\n    // authorization-code flow at all — delete the registration instead.\n    throw new Error(\"[incorta-auth] updateClientRedirectUris requires at least one redirect URI.\");\n  }\n\n  const current = await getClient(options);\n  const nextUris =\n    mode === \"add\" ? [...new Set([...current.redirectUris, ...redirectUris])] : redirectUris;\n\n  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {\n    method: \"PUT\",\n    headers: {\n      \"content-type\": \"application/json\",\n      accept: \"application/json\",\n      authorization: `Bearer ${registrationAccessToken}`,\n    },\n    // RFC 7592 update: client_id + full metadata. Incorta applies\n    // redirect_uris only, but nimbus-side parsing wants the full shape.\n    body: JSON.stringify({\n      client_id: clientId,\n      redirect_uris: nextUris,\n      grant_types: current.grantTypes,\n      scope: current.scope,\n      client_name: current.name,\n    }),\n  });\n\n  if (!response.ok) {\n    await readJson<ManagementErrorBody>(response, \"Updating the client\"); // throws with details\n  }\n  // The PUT response body is empty on success — re-read for the fresh state.\n  return getClient(options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACuHA,SAAS,SAAS,OAA2B,MAAc,QAAwB;AACjF,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,2CAA2C,IAAI,iBAAiB,MAAM;AAAA,IACxE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAEO,SAAS,cAAc,QAA2B,CAAC,GAAmB;AAC3E,QAAM,MAAO,WACV,SAAS,OAAO,CAAC;AAEpB,QAAM,aAAa;AAAA,IACjB,SAAS,MAAM,cAAc,IAAI,aAAa,cAAc,aAAa;AAAA,EAC3E;AACA,QAAM,SAAS,SAAS,MAAM,UAAU,IAAI,gBAAgB,UAAU,gBAAgB;AACtF,QAAM,WAAW;AAAA,IACf,MAAM,YAAY,IAAI;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe;AAAA,IACnB,MAAM,gBAAgB,IAAI;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS;AAAA,IACb,MAAM,UAAU,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,EACF;AACA,MAAI,OAAO,SAAS,IAAI;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,GAAG;AACvD,UAAM,IAAI;AAAA,MACR,0EAA0E,QAAQ;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,UAAU,IAAI;AACnC,QAAM,aAAa,MAAM,SAAS,cAAc;AAChD,QAAM,SAAS,GAAG,UAAU,UAAU,MAAM;AAE5C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,SAAS,mBAAmB,MAAM,IAAI;AAAA,IAC9C,OAAO,MAAM,SAAS;AAAA,IACtB;AAAA,IACA,iBAAiB,GAAG,UAAU;AAAA,IAC9B,eAAe,MAAM,SAAS,UAAU,KAAK,KAAK;AAAA,IAClD,eAAe,MAAM,SAAS,UAAU;AAAA,IACxC,mBAAmB,MAAM,qBAAqB;AAAA,IAC9C;AAAA,IACA,cACE,MAAM,UAAU,gBAAgB,GAAG,MAAM;AAAA,IAC3C,cAAc,MAAM,UAAU;AAAA,IAC9B,OAAO,MAAM,UAAU,SAAS;AAAA,EAClC;AACF;;;AChMA,IAAAA,sBAA4B;;;ACSrB,SAAS,aAAa,QAA2D;AACtF,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,OAAO,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,QAAI,CAAC,KAAM;AACX,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,EAAG,SAAQ,MAAM,MAAM,GAAG,EAAE;AAC3E,QAAI;AACF,UAAI,IAAI,IAAI,mBAAmB,KAAK;AAAA,IACtC,QAAQ;AACN,UAAI,IAAI,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,gBACd,MACA,OACA,UAAyB,CAAC,GAClB;AACR,QAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC,EAAE;AACrD,QAAM,KAAK,QAAQ,QAAQ,QAAQ,GAAG,EAAE;AACxC,MAAI,QAAQ,WAAW,QAAW;AAChC,UAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,CAAC,EAAE;AAElD,UAAM,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,SAAS,GAAI,EAAE,YAAY,CAAC,EAAE;AAAA,EACpF;AACA,MAAI,QAAQ,YAAY,KAAM,OAAM,KAAK,UAAU;AACnD,MAAI,QAAQ,OAAQ,OAAM,KAAK,QAAQ;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,KAAK,YAAY,SAAS,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE;AAC7E,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,aAAa,MAAc,UAAyB,CAAC,GAAW;AAC9E,SAAO,gBAAgB,MAAM,IAAI,EAAE,GAAG,SAAS,QAAQ,EAAE,CAAC;AAC5D;;;ACjDA,kBAAmC;AAkBnC,IAAM,iBAAiB,oBAAI,IAAgC;AAOpD,SAAS,aAAa,QAA4C;AACvE,QAAM,SAAS,eAAe,IAAI,OAAO,MAAM;AAC/C,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,QAAQ,MAAM,EAAE,MAAM,CAAC,UAAU;AAG/C,mBAAe,OAAO,OAAO,MAAM;AACnC,UAAM;AAAA,EACR,CAAC;AACD,iBAAe,IAAI,OAAO,QAAQ,OAAO;AACzC,SAAO;AACT;AAEA,eAAe,QAAQ,QAA4C;AACjE,QAAM,WAA8B;AAAA,IAClC,QAAQ,OAAO;AAAA,IACf,wBAAwB,GAAG,OAAO,MAAM;AAAA,IACxC,gBAAgB,GAAG,OAAO,MAAM;AAAA,IAChC,UAAU,GAAG,OAAO,MAAM;AAAA,EAC5B;AAEA,MAAI,MAAM;AACV,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,MAAM,OAAO,cAAc;AAAA,MACvD,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACxC,CAAC;AACD,QAAI,SAAS,IAAI;AACf,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,YAAM;AAAA,QACJ,QAAQ,KAAK,UAAU,SAAS;AAAA,QAChC,wBAAwB,KAAK,0BAA0B,SAAS;AAAA,QAChE,gBAAgB,KAAK,kBAAkB,SAAS;AAAA,QAChD,UAAU,KAAK,YAAY,SAAS;AAAA,MACtC;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,OACJ,OAAO,oBACP,gCAAmB,IAAI,IAAI,IAAI,QAAQ,GAAG;AAAA,IACxC,aAAa,KAAK,KAAK;AAAA,IACvB,kBAAkB,KAAK;AAAA,EACzB,CAAC;AAEH,SAAO;AAAA,IACL,QAAQ,IAAI;AAAA,IACZ,uBAAuB,IAAI;AAAA,IAC3B,eAAe,IAAI;AAAA,IACnB;AAAA,EACF;AACF;;;AC9EA,yBAA2B;AAC3B,IAAAC,eAAuC;AAQvC,SAAS,QAAQ,QAAoC;AACnD,SAAO,IAAI;AAAA,QACT,+BAAW,QAAQ,EAAE,OAAO,gBAAgB,OAAO,MAAM,EAAE,EAAE,OAAO;AAAA,EACtE;AACF;AAQA,eAAe,KACb,QACA,SACA,MACA,eACiB;AACjB,SAAO,IAAI,wBAAW,EAAE,SAAS,KAAK,CAAC,EACpC,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,GAAG,aAAa,GAAG,EACrC,QAAQ,QAAQ,MAAM,CAAC;AAC5B;AAEA,eAAe,OACb,QACA,SACA,aACkE;AAClE,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,UAAM,yBAAW,aAAa,QAAQ,MAAM,CAAC;AACjE,QAAI,QAAQ,YAAY,QAAS,QAAO;AACxC,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,WAAW,QAAQ,OAAO,KAAK;AAAA,MAC/B,YAAY,QAAQ,OAAO,KAAK;AAAA,IAClC;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,YAAY,QAAwB,SAAuC;AACzF,SAAO,KAAK,QAAQ,WAAW,SAAS,OAAO,aAAa;AAC9D;AAEA,eAAsB,cACpB,QACA,aAC+E;AAC/E,QAAM,SAAS,MAAM,OAAoB,QAAQ,WAAW,WAAW;AACvE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,MAAM,UAAU,UAAU,IAAI;AACtC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,KAAK,QAAQ,CAAC,KAAK,YAAa,QAAO;AACjF,SAAO,EAAE,SAAS,MAAM,UAAU,UAAU;AAC9C;AASA,IAAM,wBAAwB,KAAK;AAE5B,SAAS,eAAe,QAAwB,OAAoC;AACzF,SAAO,KAAK,QAAQ,SAAS,OAAO,qBAAqB;AAC3D;AAEA,eAAsB,iBACpB,QACA,aAC4B;AAC5B,QAAM,SAAS,MAAM,OAAmB,QAAQ,SAAS,WAAW;AACpE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,KAAK,IAAI;AACjB,MAAI,CAAC,QAAQ,OAAO,KAAK,UAAU,YAAY,OAAO,KAAK,UAAU,SAAU,QAAO;AACtF,SAAO;AACT;;;AC3FA,IAAAC,eAAqC;AAqB9B,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACW,MACT,SACA;AACA,UAAM,kBAAkB,OAAO,EAAE;AAHxB;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAEA,SAAS,UAAU,QAAgC;AACjD,QAAM,MAAM,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY;AACrD,SAAO,SAAS,OAAO,KAAK,KAAK,MAAM,EAAE,SAAS,QAAQ,CAAC;AAC7D;AAEA,eAAe,kBACb,QACA,QACmB;AACnB,QAAM,EAAE,cAAc,IAAI,MAAM,aAAa,MAAM;AAEnD,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,OAAO,MAAM,eAAe;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,IAAI,gBAAgB,MAAM,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+CAA+C,aAAa,MAAO,MAAgB,OAAO;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,SAAS,MAAM;AAAA,IACtE;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,MAAM,CAAC,KAAK,cAAc;AACtC,UAAM,IAAI;AAAA,MACR,KAAK,SAAS;AAAA,MACd,KAAK,qBAAqB,+BAA+B,SAAS,MAAM;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,EAAE,IAAI,QAAI,wBAAU,KAAK,YAAY;AAC3C,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,IAClB,sBAAsB,MAAM,MAAM,MAAO,KAAK,IAAI,IAAI,KAAK,KAAK;AAAA,IAChE,SAAS,KAAK;AAAA,IACd,cAAc,KAAK;AAAA,EACrB;AACF;AAEO,SAAS,aACd,QACA,MACA,aACmB;AACnB,SAAO,kBAAkB,QAAQ;AAAA,IAC/B,YAAY;AAAA,IACZ;AAAA,IACA,cAAc;AAAA,EAChB,CAAC;AACH;AAEO,SAAS,cAAc,QAAwB,cAAyC;AAC7F,SAAO,kBAAkB,QAAQ;AAAA,IAC/B,YAAY;AAAA,IACZ,eAAe;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,UAAU,QAAwB,OAAoC;AACnF,QAAM,EAAE,MAAM,OAAO,IAAI,MAAM,aAAa,MAAM;AAClD,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,UAAM,wBAAU,OAAO,MAAM;AAAA,MAC/C;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA+B,MAAgB,OAAO;AAAA,IACxD;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,QACA,aACqB;AACrB,SAAO,UAAU,QAAQ,WAAW;AACtC;AAMA,eAAsB,cACpB,QACA,SACA,eACsB;AACtB,QAAM,UAAU,MAAM,UAAU,QAAQ,OAAO;AAE/C,MAAI,QAAQ,UAAU,eAAe;AACnC,UAAM,IAAI,iBAAiB,kBAAkB,kDAAkD;AAAA,EACjG;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,iBAAiB,iBAAiB,oCAAoC;AAAA,EAClF;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IACrC,QAAQ,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,IACvE,CAAC;AAEL,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAC3D;AAAA,IACA,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAOA,eAAsB,oBACpB,QACA,aACsB;AACtB,QAAM,UAAU,MAAM,kBAAkB,QAAQ,WAAW;AAC3D,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,iBAAiB,iBAAiB,wCAAwC;AAAA,EACtF;AACA,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,OAAO,CAAC;AAAA,IACR,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;;;AJvJA,IAAM,iCAAiC,KAAK;AAE5C,SAAS,cAAc,QAAwB,SAA0B;AACvE,MAAI,OAAO,OAAQ,QAAO,OAAO;AACjC,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,QACJ,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC9D,IAAI,SAAS,QAAQ,KAAK,EAAE;AAC9B,QAAM,OACJ,QAAQ,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC7D,QAAQ,QAAQ,IAAI,MAAM,KAC1B,IAAI;AACN,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEA,SAAS,gBAAgB,QAAwB,SAA2B;AAC1E,MAAI,OAAO,kBAAkB,OAAQ,QAAO,OAAO;AACnD,SAAO,cAAc,QAAQ,OAAO,EAAE,WAAW,UAAU;AAC7D;AAMA,SAAS,iBAAiB,KAAoB,QAAwB;AACpE,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAI,IAAI,WAAW,OAAQ,QAAO,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI,MAAM;AAAA,EACjF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,KAAK,QAAgB,MAAe,UAAoB,CAAC,GAAa;AAC7E,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,EACnB,CAAC;AACD,aAAW,UAAU,QAAS,SAAQ,OAAO,cAAc,MAAM;AACjE,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,QAAQ,CAAC;AAC/D;AAEA,SAAS,SAAS,UAAkB,UAAoB,CAAC,GAAa;AACpE,QAAM,UAAU,IAAI,QAAQ,EAAE,UAAU,iBAAiB,WAAW,CAAC;AACrE,aAAW,UAAU,QAAS,SAAQ,OAAO,cAAc,MAAM;AACjE,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAEA,SAAS,eAAe,QAAgB,MAAsB;AAC5D,QAAM,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM;AAC/C,SAAO,GAAG,MAAM,GAAG,SAAS,sBAAsB,mBAAmB,IAAI,CAAC;AAC5E;AAEA,SAAS,cAAsB;AAC7B,aAAO,iCAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEO,SAAS,cAAc,QAG5B;AACA,QAAM,uBAAuB,CAAC,YAAqB;AAAA,IACjD,UAAU;AAAA,IACV;AAAA,IACA,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AAEA,iBAAe,MAAM,SAAkB,KAA6B;AAClE,UAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,WAAW,iBAAiB,IAAI,aAAa,IAAI,aAAa,GAAG,MAAM;AAG7E,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,SAAU,QAAO,SAAS,QAAQ;AAEtC,UAAM,QAAQ,YAAY;AAC1B,UAAM,QAAQ,YAAY;AAC1B,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,MACP,MAAM,eAAe,QAAQ,EAAE,OAAO,OAAO,SAAS,CAAC;AAAA,MACvD,EAAE,GAAG,qBAAqB,MAAM,GAAG,QAAQ,IAAI;AAAA,IACjD;AAEA,UAAM,EAAE,sBAAsB,IAAI,MAAM,aAAa,MAAM;AAC3D,UAAM,eAAe,IAAI,IAAI,qBAAqB;AAClD,iBAAa,aAAa,IAAI,iBAAiB,MAAM;AACrD,iBAAa,aAAa,IAAI,aAAa,OAAO,QAAQ;AAC1D,iBAAa,aAAa,IAAI,gBAAgB,GAAG,MAAM,GAAG,OAAO,QAAQ,WAAW;AACpF,iBAAa,aAAa,IAAI,SAAS,OAAO,KAAK;AACnD,iBAAa,aAAa,IAAI,SAAS,KAAK;AAC5C,iBAAa,aAAa,IAAI,SAAS,KAAK;AAE5C,WAAO,SAAS,aAAa,SAAS,GAAG,CAAC,WAAW,CAAC;AAAA,EACxD;AAEA,iBAAe,SAAS,SAAkB,KAA6B;AACrE,UAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,aAAa,aAAa,OAAO,iBAAiB,qBAAqB,MAAM,CAAC;AAEpF,UAAM,aAAa,MAAM,iBAAiB,QAAQ,QAAQ,OAAO,eAAe,CAAC;AACjF,UAAM,WAAW,iBAAiB,YAAY,YAAY,MAAM,MAAM;AAEtE,UAAM,OAAO,CAACC,UAAiB,SAAS,eAAe,UAAUA,KAAI,GAAG,CAAC,UAAU,CAAC;AAEpF,UAAM,aAAa,IAAI,aAAa,IAAI,OAAO;AAC/C,QAAI,WAAY,QAAO,KAAK,UAAU;AAEtC,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,QAAI,CAAC,QAAQ,CAAC,MAAO,QAAO,KAAK,cAAc;AAC/C,QAAI,CAAC,WAAY,QAAO,KAAK,eAAe;AAC5C,QAAI,UAAU,WAAW,MAAO,QAAO,KAAK,gBAAgB;AAE5D,QAAI;AACF,YAAM,SAAS,MAAM,aAAa,QAAQ,MAAM,GAAG,MAAM,GAAG,OAAO,QAAQ,WAAW;AACtF,YAAM,OAAO,OAAO,UAChB,MAAM,cAAc,QAAQ,OAAO,SAAS,WAAW,KAAK,IAC5D,MAAM,oBAAoB,QAAQ,OAAO,WAAW;AAExD,YAAM,UAAuB;AAAA,QAC3B;AAAA,QACA,aAAa,OAAO;AAAA,QACpB,sBAAsB,OAAO;AAAA,QAC7B,cAAc,OAAO;AAAA,QACrB,WAAW,KAAK,IAAI;AAAA,MACtB;AACA,YAAM,gBAAgB;AAAA,QACpB,OAAO;AAAA,QACP,MAAM,YAAY,QAAQ,OAAO;AAAA,QACjC,EAAE,GAAG,qBAAqB,MAAM,GAAG,QAAQ,OAAO,cAAc;AAAA,MAClE;AACA,aAAO,SAAS,UAAU,CAAC,eAAe,UAAU,CAAC;AAAA,IACvD,SAAS,OAAO;AACd,YAAMA,QAAO,iBAAiB,mBAAmB,MAAM,OAAO;AAC9D,aAAO,KAAKA,KAAI;AAAA,IAClB;AAAA,EACF;AAOA,iBAAe,YAAY,SAIxB;AACD,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,kBAAkB,GAAG,YAAY,CAAC,EAAE;AAE3E,QAAI,EAAE,QAAQ,IAAI;AAClB,QAAI,aAAa;AACjB,UAAM,MAAM,KAAK,IAAI;AAErB,QAAI,QAAQ,uBAAuB,MAAM,gCAAgC;AACvE,UAAI,QAAQ,cAAc;AACxB,YAAI;AACF,gBAAM,SAAS,MAAM,cAAc,QAAQ,QAAQ,YAAY;AAC/D,oBAAU;AAAA,YACR,GAAG;AAAA,YACH,aAAa,OAAO;AAAA,YACpB,sBAAsB,OAAO;AAAA,YAC7B,cAAc,OAAO,gBAAgB,QAAQ;AAAA,UAC/C;AACA,uBAAa;AAAA,QACf,QAAQ;AAGN,cAAI,QAAQ,wBAAwB,KAAK;AACvC,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,kBAAkB;AAAA,cAClB,YAAY,CAAC,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC,CAAC;AAAA,YAC5E;AAAA,UACF;AAAA,QACF;AAAA,MACF,WAAW,QAAQ,wBAAwB,KAAK;AAC9C,eAAO;AAAA,UACL,SAAS;AAAA,UACT,kBAAkB;AAAA,UAClB,YAAY,CAAC,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC,CAAC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAc,OAAO,gBAAgB,MAAQ;AACnD,QAAI,MAAM,SAAS,WAAW,WAAY,cAAa;AAEvD,QAAI,CAAC,YAAY;AACf,aAAO,EAAE,SAAS,kBAAkB,SAAS,WAAW,YAAY,CAAC,EAAE;AAAA,IACzE;AACA,UAAM,WAAW,gBAAgB,OAAO,YAAY,MAAM,YAAY,QAAQ,OAAO,GAAG;AAAA,MACtF,GAAG,qBAAqB,MAAM;AAAA,MAC9B,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,WAAO;AAAA,MACL;AAAA,MACA,kBAAkB,MAAM,OAAO,gBAAgB;AAAA,MAC/C,YAAY,CAAC,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,iBAAe,aAAa,SAAqC;AAC/D,UAAM,EAAE,SAAS,kBAAkB,WAAW,IAAI,MAAM,YAAY,OAAO;AAC3E,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,EAAE,MAAM,KAAK,GAAG,UAAU;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM,QAAQ;AAAA,QACd,SAAS;AAAA,UACP,WAAW;AAAA,UACX,sBAAsB,QAAQ;AAAA,QAChC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,WAAW,SAAqC;AAC7D,QAAI,CAAC,OAAO,kBAAmB,QAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AACtE,UAAM,EAAE,SAAS,WAAW,IAAI,MAAM,YAAY,OAAO;AACzD,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,EAAE,OAAO,kBAAkB,GAAG,UAAU;AACvE,WAAO;AAAA,MACL;AAAA,MACA,EAAE,aAAa,QAAQ,aAAa,WAAW,QAAQ,qBAAqB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OAAO,SAAkB,KAA6B;AACnE,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,eAAe,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC;AACjF,QAAI,QAAQ,WAAW,OAAO;AAC5B,YAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,YAAM,WAAW,iBAAiB,IAAI,aAAa,IAAI,aAAa,GAAG,MAAM;AAC7E,aAAO,SAAS,UAAU,CAAC,YAAY,CAAC;AAAA,IAC1C;AACA,WAAO,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,CAAC,YAAY,CAAC;AAAA,EAC/C;AAEA,iBAAe,QAAQ,SAAqC;AAC1D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,IAAI,aAAa,OAAO,YAAY,CAAC,IAAI,SAAS,WAAW,GAAG,OAAO,QAAQ,GAAG,GAAG;AACvF,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AACA,UAAM,QAAQ,IAAI,SAAS,MAAM,OAAO,SAAS,MAAM,KAAK;AAC5D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAE1C,QAAI;AACF,UAAI,UAAU,YAAY,WAAW,MAAO,QAAO,MAAM,MAAM,SAAS,GAAG;AAC3E,UAAI,UAAU,eAAe,WAAW,MAAO,QAAO,MAAM,SAAS,SAAS,GAAG;AACjF,UAAI,UAAU,cAAc,WAAW,MAAO,QAAO,MAAM,aAAa,OAAO;AAC/E,UAAI,UAAU,YAAY,WAAW,MAAO,QAAO,MAAM,WAAW,OAAO;AAC3E,UAAI,UAAU,cAAc,WAAW,UAAU,WAAW,QAAQ;AAClE,eAAO,MAAM,OAAO,SAAS,GAAG;AAAA,MAClC;AACA,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC,SAAS,OAAO;AACd,YAAM,OAAO,iBAAiB,mBAAmB,MAAM,OAAO;AAC9D,YAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,cAAQ,MAAM,kBAAkB,KAAK,YAAY,OAAO;AACxD,aAAO,KAAK,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,IAClC;AAAA,EACF;AAEA,iBAAe,WAAW,SAA+C;AACvE,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,EAAE,SAAS,UAAU,IAAI;AAC/B,QAAI,QAAQ,wBAAwB,KAAK,IAAI,KAAK,CAAC,QAAQ,aAAc,QAAO;AAChF,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,sBAAsB,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,WAAW;AAC/B;;;AK1TA,SAAS,qBAAqB,YAAoB,QAAgB,UAA2B;AAC3F,QAAM,OAAO,GAAG,WAAW,QAAQ,QAAQ,EAAE,CAAC,UAAU,MAAM;AAC9D,SAAO,WAAW,GAAG,IAAI,IAAI,QAAQ,KAAK;AAC5C;AAEA,eAAe,SACb,UACA,MACY;AACZ,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,kBAAkB,IAAI,uCAAuC,SAAS,MAAM;AAAA,IAE9E;AAAA,EACF;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR,kBAAkB,IAAI,iBAAiB,SAAS,MAAM,MACjD,KAAK,SAAS,eAAe,WAAM,KAAK,qBAAqB,gBAAgB;AAAA,IACpF;AAAA,EACF;AACA,SAAO;AACT;AAkCA,eAAsB,eACpB,SAC2B;AAC3B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,aAAa,CAAC,sBAAsB,eAAe;AAAA,IACnD,YAAY;AAAA,EACd,IAAI;AAEJ,MAAI,CAAC,aAAa,QAAQ;AACxB,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAEA,QAAM,WAAW,MAAM,UAAU,qBAAqB,YAAY,MAAM,GAAG;AAAA,IACzE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oBAAoB,QAAQ,mBAAmB;AAAA,IAC1E,MAAM,KAAK,UAAU;AAAA,MACnB,aAAa;AAAA,MACb,eAAe;AAAA,MACf,aAAa;AAAA,MACb;AAAA,MACA,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH,CAAC;AASD,QAAM,OAAO,MAAM,SAA+B,UAAU,qBAAqB;AACjF,MAAI,CAAC,KAAK,aAAa,CAAC,KAAK,eAAe;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,cAAc,KAAK;AAAA,IACnB,yBAAyB,KAAK;AAAA,IAC9B,uBAAuB,KAAK;AAAA,EAC9B;AACF;AA6BA,SAAS,aAAa,MAA8B,kBAAsC;AACxF,SAAO;AAAA,IACL,UAAU,KAAK,aAAa;AAAA,IAC5B,MAAM,KAAK;AAAA,IACX,cAAc,KAAK,iBAAiB,CAAC;AAAA,IACrC,YAAY,KAAK,eAAe,CAAC;AAAA,IACjC,OAAO,KAAK;AAAA,EACd;AACF;AAOA,eAAsB,UAAU,SAAmD;AACjF,QAAM,EAAE,YAAY,QAAQ,UAAU,yBAAyB,YAAY,MAAM,IAAI;AACrF,QAAM,WAAW,MAAM,UAAU,qBAAqB,YAAY,QAAQ,QAAQ,GAAG;AAAA,IACnF,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe,UAAU,uBAAuB;AAAA,IAClD;AAAA,EACF,CAAC;AACD,QAAM,OAAO,MAAM,SAAiC,UAAU,oBAAoB;AAClF,SAAO,aAAa,MAAM,QAAQ;AACpC;AAiBA,eAAsB,yBACpB,SACqB;AACrB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,EACd,IAAI;AAEJ,MAAI,CAAC,aAAa,QAAQ;AAGxB,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AAEA,QAAM,UAAU,MAAM,UAAU,OAAO;AACvC,QAAM,WACJ,SAAS,QAAQ,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,QAAQ,cAAc,GAAG,YAAY,CAAC,CAAC,IAAI;AAE9E,QAAM,WAAW,MAAM,UAAU,qBAAqB,YAAY,QAAQ,QAAQ,GAAG;AAAA,IACnF,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,eAAe,UAAU,uBAAuB;AAAA,IAClD;AAAA;AAAA;AAAA,IAGA,MAAM,KAAK,UAAU;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,aAAa,QAAQ;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,SAA8B,UAAU,qBAAqB;AAAA,EACrE;AAEA,SAAO,UAAU,OAAO;AAC1B;;;APvLO,SAAS,kBAAkB,SAA4B,CAAC,GAAgB;AAC7E,QAAM,WAAW,cAAc,MAAM;AACrC,QAAM,EAAE,SAAS,WAAW,IAAI,cAAc,QAAQ;AACtD,SAAO,EAAE,SAAS,YAAY,QAAQ,SAAS;AACjD;","names":["import_node_crypto","import_jose","import_jose","code"]}

package/dist/index.d.cts

@@ -45,6 +45,44 @@ interface RegisteredClient {
  * app's `.env`.
  */
 declare function registerClient(options: RegisterClientOptions): Promise<RegisteredClient>;
+interface ManageClientOptions {
+    /** Incorta base URL, e.g. `http://localhost:8080/incorta`. */
+    incortaUrl: string;
+    tenant: string;
+    clientId: string;
+    /** The registration access token returned when the client was registered. */
+    registrationAccessToken: string;
+    fetchImpl?: typeof fetch;
+}
+/** Current metadata of a registered client. */
+interface ClientInfo {
+    clientId: string;
+    name?: string;
+    redirectUris: string[];
+    grantTypes: string[];
+    scope?: string;
+}
+/**
+ * Reads a registered client's current metadata (RFC 7592-style management,
+ * `GET {incortaUrl}/oauth/{tenant}/register/{clientId}` with the registration
+ * access token).
+ */
+declare function getClient(options: ManageClientOptions): Promise<ClientInfo>;
+interface UpdateRedirectUrisOptions extends ManageClientOptions {
+    redirectUris: string[];
+    /**
+     * `"add"` (default) merges the given URIs into the client's current set;
+     * `"replace"` makes the given list the exact new set (also how URIs are
+     * removed).
+     */
+    mode?: "add" | "replace";
+}
+/**
+ * Updates the allowed OAuth callback URLs of a registered client. Incorta's
+ * management endpoint applies `redirect_uris` from the PUT body (other
+ * metadata is unchanged server-side).
+ */
+declare function updateClientRedirectUris(options: UpdateRedirectUrisOptions): Promise<ClientInfo>;
 
 interface IncortaAuth {
     /**
@@ -72,4 +110,4 @@ interface IncortaAuth {
  */
 declare function createIncortaAuth(config?: IncortaAuthConfig): IncortaAuth;
 
-export { type AuthHandler, type AuthSession, type IncortaAuth, IncortaAuthConfig, IncortaAuthError, type RegisterClientOptions, type RegisteredClient, SessionInfo, createIncortaAuth, registerClient };
+export { type AuthHandler, type AuthSession, type ClientInfo, type IncortaAuth, IncortaAuthConfig, IncortaAuthError, type ManageClientOptions, type RegisterClientOptions, type RegisteredClient, SessionInfo, type UpdateRedirectUrisOptions, createIncortaAuth, getClient, registerClient, updateClientRedirectUris };

package/dist/index.d.ts

@@ -45,6 +45,44 @@ interface RegisteredClient {
  * app's `.env`.
  */
 declare function registerClient(options: RegisterClientOptions): Promise<RegisteredClient>;
+interface ManageClientOptions {
+    /** Incorta base URL, e.g. `http://localhost:8080/incorta`. */
+    incortaUrl: string;
+    tenant: string;
+    clientId: string;
+    /** The registration access token returned when the client was registered. */
+    registrationAccessToken: string;
+    fetchImpl?: typeof fetch;
+}
+/** Current metadata of a registered client. */
+interface ClientInfo {
+    clientId: string;
+    name?: string;
+    redirectUris: string[];
+    grantTypes: string[];
+    scope?: string;
+}
+/**
+ * Reads a registered client's current metadata (RFC 7592-style management,
+ * `GET {incortaUrl}/oauth/{tenant}/register/{clientId}` with the registration
+ * access token).
+ */
+declare function getClient(options: ManageClientOptions): Promise<ClientInfo>;
+interface UpdateRedirectUrisOptions extends ManageClientOptions {
+    redirectUris: string[];
+    /**
+     * `"add"` (default) merges the given URIs into the client's current set;
+     * `"replace"` makes the given list the exact new set (also how URIs are
+     * removed).
+     */
+    mode?: "add" | "replace";
+}
+/**
+ * Updates the allowed OAuth callback URLs of a registered client. Incorta's
+ * management endpoint applies `redirect_uris` from the PUT body (other
+ * metadata is unchanged server-side).
+ */
+declare function updateClientRedirectUris(options: UpdateRedirectUrisOptions): Promise<ClientInfo>;
 
 interface IncortaAuth {
     /**
@@ -72,4 +110,4 @@ interface IncortaAuth {
  */
 declare function createIncortaAuth(config?: IncortaAuthConfig): IncortaAuth;
 
-export { type AuthHandler, type AuthSession, type IncortaAuth, IncortaAuthConfig, IncortaAuthError, type RegisterClientOptions, type RegisteredClient, SessionInfo, createIncortaAuth, registerClient };
+export { type AuthHandler, type AuthSession, type ClientInfo, type IncortaAuth, IncortaAuthConfig, IncortaAuthError, type ManageClientOptions, type RegisterClientOptions, type RegisteredClient, SessionInfo, type UpdateRedirectUrisOptions, createIncortaAuth, getClient, registerClient, updateClientRedirectUris };

package/dist/index.js

@@ -553,6 +553,26 @@ function createHandler(config) {
 }
 
 // src/core/register.ts
+function registrationEndpoint(incortaUrl, tenant, clientId) {
+  const base = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
+  return clientId ? `${base}/${clientId}` : base;
+}
+async function readJson(response, what) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error(
+      `[incorta-auth] ${what} returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
+    );
+  }
+  if (!response.ok) {
+    throw new Error(
+      `[incorta-auth] ${what} failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+    );
+  }
+  return body;
+}
 async function registerClient(options) {
   const {
     incortaUrl,
@@ -566,8 +586,7 @@ async function registerClient(options) {
   if (!redirectUris.length) {
     throw new Error("[incorta-auth] registerClient requires at least one redirect URI.");
   }
-  const endpoint = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
-  const response = await fetchImpl(endpoint, {
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant), {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
     body: JSON.stringify({
@@ -578,17 +597,10 @@ async function registerClient(options) {
       token_endpoint_auth_method: "client_secret_basic"
     })
   });
-  let body;
-  try {
-    body = await response.json();
-  } catch {
+  const body = await readJson(response, "Client registration");
+  if (!body.client_id || !body.client_secret) {
     throw new Error(
-      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
-    );
-  }
-  if (!response.ok || !body.client_id || !body.client_secret) {
-    throw new Error(
-      `[incorta-auth] Client registration failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`
     );
   }
   return {
@@ -598,6 +610,63 @@ async function registerClient(options) {
     registrationClientUri: body.registration_client_uri
   };
 }
+function toClientInfo(body, fallbackClientId) {
+  return {
+    clientId: body.client_id ?? fallbackClientId,
+    name: body.client_name,
+    redirectUris: body.redirect_uris ?? [],
+    grantTypes: body.grant_types ?? [],
+    scope: body.scope
+  };
+}
+async function getClient(options) {
+  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    }
+  });
+  const body = await readJson(response, "Reading the client");
+  return toClientInfo(body, clientId);
+}
+async function updateClientRedirectUris(options) {
+  const {
+    incortaUrl,
+    tenant,
+    clientId,
+    registrationAccessToken,
+    redirectUris,
+    mode = "add",
+    fetchImpl = fetch
+  } = options;
+  if (!redirectUris.length) {
+    throw new Error("[incorta-auth] updateClientRedirectUris requires at least one redirect URI.");
+  }
+  const current = await getClient(options);
+  const nextUris = mode === "add" ? [.../* @__PURE__ */ new Set([...current.redirectUris, ...redirectUris])] : redirectUris;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    method: "PUT",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    },
+    // RFC 7592 update: client_id + full metadata. Incorta applies
+    // redirect_uris only, but nimbus-side parsing wants the full shape.
+    body: JSON.stringify({
+      client_id: clientId,
+      redirect_uris: nextUris,
+      grant_types: current.grantTypes,
+      scope: current.scope,
+      client_name: current.name
+    })
+  });
+  if (!response.ok) {
+    await readJson(response, "Updating the client");
+  }
+  return getClient(options);
+}
 
 // src/index.ts
 function createIncortaAuth(config = {}) {
@@ -608,6 +677,8 @@ function createIncortaAuth(config = {}) {
 export {
   IncortaAuthError,
   createIncortaAuth,
-  registerClient
+  getClient,
+  registerClient,
+  updateClientRedirectUris
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/config.ts","../src/core/handler.ts","../src/core/cookies.ts","../src/core/discovery.ts","../src/core/session.ts","../src/core/tokens.ts","../src/core/register.ts","../src/index.ts"],"sourcesContent":["import type { JWTVerifyGetKey } from \"jose\";\n\n/** The Incorta user identity carried by the session (claims from the ID token). */\nexport interface IncortaUser {\n  /** Incorta login name (`sub` claim). */\n  sub: string;\n  name?: string;\n  email?: string;\n  /** Incorta role names, as minted into the ID token. */\n  roles: string[];\n  /** Tenant the user authenticated against. */\n  tenant: string;\n}\n\n/** What the sealed session cookie holds. */\nexport interface SessionData {\n  user: IncortaUser;\n  /** Incorta-issued access token (RS256 JWT, aud = client_id). */\n  accessToken: string;\n  /** Epoch millis when the access token expires. */\n  accessTokenExpiresAt: number;\n  /** Rotating refresh token, present when the client has the refresh_token grant. */\n  refreshToken?: string;\n  /** Epoch millis when this session was first created (login time). */\n  createdAt: number;\n}\n\nexport interface SessionInfo {\n  user: IncortaUser;\n  /** Epoch millis when the session cookie expires (sliding). */\n  expiresAt: number;\n  /** Epoch millis when the access token expires. */\n  accessTokenExpiresAt: number;\n}\n\nexport interface IncortaAuthConfig {\n  /**\n   * Base URL of the Incorta web application, e.g. `https://acme.cloud.incorta.com/incorta`\n   * or `http://localhost:8080/incorta`. Defaults to `INCORTA_URL`.\n   */\n  incortaUrl?: string;\n  /** Incorta tenant name, e.g. `demo`. Defaults to `INCORTA_TENANT`. */\n  tenant?: string;\n  /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */\n  clientId?: string;\n  /** OAuth client secret. Defaults to `INCORTA_CLIENT_SECRET`. */\n  clientSecret?: string;\n  /**\n   * Secret used to encrypt the session cookie (any long random string, >= 32 chars).\n   * Defaults to `INCORTA_AUTH_SECRET`.\n   */\n  secret?: string;\n  /**\n   * Path prefix the auth routes are mounted under. The SDK serves\n   * `{basePath}/login`, `{basePath}/callback`, `{basePath}/session`,\n   * `{basePath}/logout` (and optionally `{basePath}/token`).\n   * @default \"/auth\"\n   */\n  basePath?: string;\n  /**\n   * External origin of THIS app, e.g. `http://localhost:4000`. Used to build the\n   * OAuth callback URL and to validate `redirect_to` targets. When omitted it is\n   * derived per request from `x-forwarded-proto`/`x-forwarded-host`/`host`.\n   * Defaults to `INCORTA_APP_URL`.\n   */\n  appUrl?: string;\n  /** OAuth scopes to request. @default \"openid profile email\" */\n  scope?: string;\n  session?: {\n    /** @default \"incorta_auth_session\" */\n    cookieName?: string;\n    /** Session lifetime in seconds (sliding — renewed on activity). @default 43200 (12h) */\n    maxAge?: number;\n  };\n  cookies?: {\n    /**\n     * `Secure` attribute for cookies. `\"auto\"` sets it when the request is HTTPS.\n     * @default \"auto\"\n     */\n    secure?: boolean | \"auto\";\n  };\n  /**\n   * Expose `GET {basePath}/token` returning the raw Incorta access token to the\n   * browser (for calling Incorta public APIs directly from the frontend). Off by\n   * default — prefer proxying through your backend.\n   * @default false\n   */\n  exposeAccessToken?: boolean;\n  advanced?: {\n    /** Override the OIDC discovery document URL (rarely needed). */\n    discoveryUrl?: string;\n    /** Override JWKS resolution (used by tests to verify against a local key). */\n    jwks?: JWTVerifyGetKey;\n    /** Override fetch (used by tests). */\n    fetch?: typeof fetch;\n  };\n}\n\nexport interface ResolvedConfig {\n  incortaUrl: string;\n  tenant: string;\n  clientId: string;\n  clientSecret: string;\n  secret: string;\n  basePath: string;\n  appUrl?: string;\n  scope: string;\n  cookieName: string;\n  stateCookieName: string;\n  sessionMaxAge: number;\n  secureCookies: boolean | \"auto\";\n  exposeAccessToken: boolean;\n  /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */\n  issuer: string;\n  discoveryUrl: string;\n  jwksOverride?: JWTVerifyGetKey;\n  fetch: typeof fetch;\n}\n\nfunction required(value: string | undefined, name: string, envVar: string): string {\n  if (!value) {\n    throw new Error(\n      `[incorta-auth] Missing required config \"${name}\" (or env var ${envVar}).`,\n    );\n  }\n  return value;\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\nexport function resolveConfig(input: IncortaAuthConfig = {}): ResolvedConfig {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } })\n    .process?.env ?? {};\n\n  const incortaUrl = stripTrailingSlash(\n    required(input.incortaUrl ?? env.INCORTA_URL, \"incortaUrl\", \"INCORTA_URL\"),\n  );\n  const tenant = required(input.tenant ?? env.INCORTA_TENANT, \"tenant\", \"INCORTA_TENANT\");\n  const clientId = required(\n    input.clientId ?? env.INCORTA_CLIENT_ID,\n    \"clientId\",\n    \"INCORTA_CLIENT_ID\",\n  );\n  const clientSecret = required(\n    input.clientSecret ?? env.INCORTA_CLIENT_SECRET,\n    \"clientSecret\",\n    \"INCORTA_CLIENT_SECRET\",\n  );\n  const secret = required(\n    input.secret ?? env.INCORTA_AUTH_SECRET,\n    \"secret\",\n    \"INCORTA_AUTH_SECRET\",\n  );\n  if (secret.length < 32) {\n    throw new Error(\n      \"[incorta-auth] `secret` must be at least 32 characters. Generate one with: openssl rand -base64 32\",\n    );\n  }\n\n  const basePath = input.basePath ?? \"/auth\";\n  if (!basePath.startsWith(\"/\") || basePath.endsWith(\"/\")) {\n    throw new Error(\n      `[incorta-auth] basePath must start with \"/\" and not end with \"/\" (got \"${basePath}\").`,\n    );\n  }\n\n  const appUrl = input.appUrl ?? env.INCORTA_APP_URL;\n  const cookieName = input.session?.cookieName ?? \"incorta_auth_session\";\n  const issuer = `${incortaUrl}/oauth/${tenant}`;\n\n  return {\n    incortaUrl,\n    tenant,\n    clientId,\n    clientSecret,\n    secret,\n    basePath,\n    appUrl: appUrl ? stripTrailingSlash(appUrl) : undefined,\n    scope: input.scope ?? \"openid profile email\",\n    cookieName,\n    stateCookieName: `${cookieName}_state`,\n    sessionMaxAge: input.session?.maxAge ?? 12 * 60 * 60,\n    secureCookies: input.cookies?.secure ?? \"auto\",\n    exposeAccessToken: input.exposeAccessToken ?? false,\n    issuer,\n    discoveryUrl:\n      input.advanced?.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`,\n    jwksOverride: input.advanced?.jwks,\n    fetch: input.advanced?.fetch ?? fetch,\n  };\n}\n","import { randomBytes } from \"node:crypto\";\nimport type { ResolvedConfig, SessionData, SessionInfo } from \"./config.js\";\nimport { deleteCookie, parseCookies, serializeCookie } from \"./cookies.js\";\nimport { getEndpoints } from \"./discovery.js\";\nimport {\n  sealLoginState,\n  sealSession,\n  unsealLoginState,\n  unsealSession,\n} from \"./session.js\";\nimport {\n  IncortaAuthError,\n  exchangeCode,\n  refreshTokens,\n  userFromAccessToken,\n  verifyIdToken,\n} from \"./tokens.js\";\n\n/** A read-only view of the current session for server-side app code. */\nexport interface AuthSession extends SessionInfo {\n  /** Incorta access token — pass as `Authorization: Bearer` to Incorta APIs. */\n  accessToken: string;\n}\n\nexport type AuthHandler = (request: Request) => Promise<Response>;\n\n/** Refresh the access token when it has less than this long left to live. */\nconst ACCESS_TOKEN_REFRESH_LEEWAY_MS = 60 * 1000;\n\nfunction requestOrigin(config: ResolvedConfig, request: Request): string {\n  if (config.appUrl) return config.appUrl;\n  const url = new URL(request.url);\n  const proto =\n    request.headers.get(\"x-forwarded-proto\")?.split(\",\")[0]?.trim() ??\n    url.protocol.replace(\":\", \"\");\n  const host =\n    request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim() ??\n    request.headers.get(\"host\") ??\n    url.host;\n  return `${proto}://${host}`;\n}\n\nfunction isSecureRequest(config: ResolvedConfig, request: Request): boolean {\n  if (config.secureCookies !== \"auto\") return config.secureCookies;\n  return requestOrigin(config, request).startsWith(\"https://\");\n}\n\n/**\n * Only same-origin destinations are allowed after login/logout — anything else\n * would let a crafted link bounce users through this app to an attacker page.\n */\nfunction validateReturnTo(raw: string | null, origin: string): string {\n  if (!raw) return \"/\";\n  if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n  try {\n    const url = new URL(raw);\n    if (url.origin === origin) return `${url.pathname}${url.search}${url.hash}` || \"/\";\n  } catch {\n    // Not a URL — fall through.\n  }\n  return \"/\";\n}\n\nfunction json(status: number, body: unknown, cookies: string[] = []): Response {\n  const headers = new Headers({\n    \"content-type\": \"application/json; charset=utf-8\",\n    \"cache-control\": \"no-store\",\n  });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(JSON.stringify(body), { status, headers });\n}\n\nfunction redirect(location: string, cookies: string[] = []): Response {\n  const headers = new Headers({ location, \"cache-control\": \"no-store\" });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(null, { status: 302, headers });\n}\n\nfunction withErrorParam(target: string, code: string): string {\n  const separator = target.includes(\"?\") ? \"&\" : \"?\";\n  return `${target}${separator}incorta_auth_error=${encodeURIComponent(code)}`;\n}\n\nfunction randomToken(): string {\n  return randomBytes(16).toString(\"base64url\");\n}\n\nexport function createHandler(config: ResolvedConfig): {\n  handler: AuthHandler;\n  getSession: (request: Request) => Promise<AuthSession | null>;\n} {\n  const sessionCookieOptions = (secure: boolean) => ({\n    httpOnly: true,\n    secure,\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  });\n\n  async function login(request: Request, url: URL): Promise<Response> {\n    const origin = requestOrigin(config, request);\n    const secure = isSecureRequest(config, request);\n    const returnTo = validateReturnTo(url.searchParams.get(\"redirect_to\"), origin);\n\n    // Already signed in — skip the OAuth round trip entirely.\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const existing = await unsealSession(config, cookies[config.cookieName]);\n    if (existing) return redirect(returnTo);\n\n    const state = randomToken();\n    const nonce = randomToken();\n    const stateCookie = serializeCookie(\n      config.stateCookieName,\n      await sealLoginState(config, { state, nonce, returnTo }),\n      { ...sessionCookieOptions(secure), maxAge: 600 },\n    );\n\n    const { authorizationEndpoint } = await getEndpoints(config);\n    const authorizeUrl = new URL(authorizationEndpoint);\n    authorizeUrl.searchParams.set(\"response_type\", \"code\");\n    authorizeUrl.searchParams.set(\"client_id\", config.clientId);\n    authorizeUrl.searchParams.set(\"redirect_uri\", `${origin}${config.basePath}/callback`);\n    authorizeUrl.searchParams.set(\"scope\", config.scope);\n    authorizeUrl.searchParams.set(\"state\", state);\n    authorizeUrl.searchParams.set(\"nonce\", nonce);\n\n    return redirect(authorizeUrl.toString(), [stateCookie]);\n  }\n\n  async function callback(request: Request, url: URL): Promise<Response> {\n    const origin = requestOrigin(config, request);\n    const secure = isSecureRequest(config, request);\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const clearState = deleteCookie(config.stateCookieName, sessionCookieOptions(secure));\n\n    const loginState = await unsealLoginState(config, cookies[config.stateCookieName]);\n    const returnTo = validateReturnTo(loginState?.returnTo ?? null, origin);\n\n    const fail = (code: string) => redirect(withErrorParam(returnTo, code), [clearState]);\n\n    const oauthError = url.searchParams.get(\"error\");\n    if (oauthError) return fail(oauthError);\n\n    const code = url.searchParams.get(\"code\");\n    const state = url.searchParams.get(\"state\");\n    if (!code || !state) return fail(\"missing_code\");\n    if (!loginState) return fail(\"state_missing\");\n    if (state !== loginState.state) return fail(\"state_mismatch\");\n\n    try {\n      const tokens = await exchangeCode(config, code, `${origin}${config.basePath}/callback`);\n      const user = tokens.idToken\n        ? await verifyIdToken(config, tokens.idToken, loginState.nonce)\n        : await userFromAccessToken(config, tokens.accessToken);\n\n      const session: SessionData = {\n        user,\n        accessToken: tokens.accessToken,\n        accessTokenExpiresAt: tokens.accessTokenExpiresAt,\n        refreshToken: tokens.refreshToken,\n        createdAt: Date.now(),\n      };\n      const sessionCookie = serializeCookie(\n        config.cookieName,\n        await sealSession(config, session),\n        { ...sessionCookieOptions(secure), maxAge: config.sessionMaxAge },\n      );\n      return redirect(returnTo, [sessionCookie, clearState]);\n    } catch (error) {\n      const code = error instanceof IncortaAuthError ? error.code : \"callback_failed\";\n      return fail(code);\n    }\n  }\n\n  /**\n   * Loads the session from the request cookie; refreshes the Incorta access\n   * token (rotating the refresh token) when it is about to expire, and renews\n   * the sliding session cookie past its half-life. Returns the cookies to set.\n   */\n  async function loadSession(request: Request): Promise<{\n    session: SessionData | null;\n    sessionExpiresAt: number;\n    setCookies: string[];\n  }> {\n    const secure = isSecureRequest(config, request);\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const unsealed = await unsealSession(config, cookies[config.cookieName]);\n    if (!unsealed) return { session: null, sessionExpiresAt: 0, setCookies: [] };\n\n    let { session } = unsealed;\n    let mustReseal = false;\n    const now = Date.now();\n\n    if (session.accessTokenExpiresAt - now < ACCESS_TOKEN_REFRESH_LEEWAY_MS) {\n      if (session.refreshToken) {\n        try {\n          const tokens = await refreshTokens(config, session.refreshToken);\n          session = {\n            ...session,\n            accessToken: tokens.accessToken,\n            accessTokenExpiresAt: tokens.accessTokenExpiresAt,\n            refreshToken: tokens.refreshToken ?? session.refreshToken,\n          };\n          mustReseal = true;\n        } catch {\n          // Refresh failed (expired/rotated elsewhere). Keep the session while\n          // the current access token is still usable; otherwise sign out.\n          if (session.accessTokenExpiresAt <= now) {\n            return {\n              session: null,\n              sessionExpiresAt: 0,\n              setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))],\n            };\n          }\n        }\n      } else if (session.accessTokenExpiresAt <= now) {\n        return {\n          session: null,\n          sessionExpiresAt: 0,\n          setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))],\n        };\n      }\n    }\n\n    const halfLifeMs = (config.sessionMaxAge * 1000) / 2;\n    if (now - unsealed.issuedAt > halfLifeMs) mustReseal = true;\n\n    if (!mustReseal) {\n      return { session, sessionExpiresAt: unsealed.expiresAt, setCookies: [] };\n    }\n    const resealed = serializeCookie(config.cookieName, await sealSession(config, session), {\n      ...sessionCookieOptions(secure),\n      maxAge: config.sessionMaxAge,\n    });\n    return {\n      session,\n      sessionExpiresAt: now + config.sessionMaxAge * 1000,\n      setCookies: [resealed],\n    };\n  }\n\n  async function sessionRoute(request: Request): Promise<Response> {\n    const { session, sessionExpiresAt, setCookies } = await loadSession(request);\n    if (!session) return json(200, { user: null }, setCookies);\n    return json(\n      200,\n      {\n        user: session.user,\n        session: {\n          expiresAt: sessionExpiresAt,\n          accessTokenExpiresAt: session.accessTokenExpiresAt,\n        },\n      },\n      setCookies,\n    );\n  }\n\n  async function tokenRoute(request: Request): Promise<Response> {\n    if (!config.exposeAccessToken) return json(404, { error: \"not_found\" });\n    const { session, setCookies } = await loadSession(request);\n    if (!session) return json(401, { error: \"unauthenticated\" }, setCookies);\n    return json(\n      200,\n      { accessToken: session.accessToken, expiresAt: session.accessTokenExpiresAt },\n      setCookies,\n    );\n  }\n\n  async function logout(request: Request, url: URL): Promise<Response> {\n    const secure = isSecureRequest(config, request);\n    const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));\n    if (request.method === \"GET\") {\n      const origin = requestOrigin(config, request);\n      const returnTo = validateReturnTo(url.searchParams.get(\"redirect_to\"), origin);\n      return redirect(returnTo, [clearSession]);\n    }\n    return json(200, { ok: true }, [clearSession]);\n  }\n\n  async function handler(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    if (url.pathname !== config.basePath && !url.pathname.startsWith(`${config.basePath}/`)) {\n      return json(404, { error: \"not_found\" });\n    }\n    const route = url.pathname.slice(config.basePath.length) || \"/\";\n    const method = request.method.toUpperCase();\n\n    try {\n      if (route === \"/login\" && method === \"GET\") return await login(request, url);\n      if (route === \"/callback\" && method === \"GET\") return await callback(request, url);\n      if (route === \"/session\" && method === \"GET\") return await sessionRoute(request);\n      if (route === \"/token\" && method === \"GET\") return await tokenRoute(request);\n      if (route === \"/logout\" && (method === \"POST\" || method === \"GET\")) {\n        return await logout(request, url);\n      }\n      return json(404, { error: \"not_found\" });\n    } catch (error) {\n      const code = error instanceof IncortaAuthError ? error.code : \"internal_error\";\n      const message =\n        error instanceof Error ? error.message : \"Unexpected incorta-auth handler error\";\n      console.error(`[incorta-auth] ${route} failed:`, message);\n      return json(500, { error: code });\n    }\n  }\n\n  async function getSession(request: Request): Promise<AuthSession | null> {\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const unsealed = await unsealSession(config, cookies[config.cookieName]);\n    if (!unsealed) return null;\n    const { session, expiresAt } = unsealed;\n    if (session.accessTokenExpiresAt <= Date.now() && !session.refreshToken) return null;\n    return {\n      user: session.user,\n      accessToken: session.accessToken,\n      accessTokenExpiresAt: session.accessTokenExpiresAt,\n      expiresAt,\n    };\n  }\n\n  return { handler, getSession };\n}\n","export interface CookieOptions {\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: \"lax\" | \"strict\" | \"none\";\n  path?: string;\n  /** Seconds. 0 deletes the cookie. */\n  maxAge?: number;\n}\n\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const name = part.slice(0, eq).trim();\n    if (!name) continue;\n    let value = part.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"')) value = value.slice(1, -1);\n    try {\n      out[name] = decodeURIComponent(value);\n    } catch {\n      out[name] = value;\n    }\n  }\n  return out;\n}\n\nexport function serializeCookie(\n  name: string,\n  value: string,\n  options: CookieOptions = {},\n): string {\n  const parts = [`${name}=${encodeURIComponent(value)}`];\n  parts.push(`Path=${options.path ?? \"/\"}`);\n  if (options.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.floor(options.maxAge)}`);\n    // Expires for compatibility with clients that ignore Max-Age.\n    parts.push(`Expires=${new Date(Date.now() + options.maxAge * 1000).toUTCString()}`);\n  }\n  if (options.httpOnly ?? true) parts.push(\"HttpOnly\");\n  if (options.secure) parts.push(\"Secure\");\n  const sameSite = options.sameSite ?? \"lax\";\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  return parts.join(\"; \");\n}\n\nexport function deleteCookie(name: string, options: CookieOptions = {}): string {\n  return serializeCookie(name, \"\", { ...options, maxAge: 0 });\n}\n","import { createRemoteJWKSet } from \"jose\";\nimport type { JWTVerifyGetKey } from \"jose\";\nimport type { ResolvedConfig } from \"./config.js\";\n\ninterface DiscoveryDocument {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  jwks_uri: string;\n}\n\nexport interface Endpoints {\n  issuer: string;\n  authorizationEndpoint: string;\n  tokenEndpoint: string;\n  jwks: JWTVerifyGetKey;\n}\n\nconst endpointsCache = new Map<string, Promise<Endpoints>>();\n\n/**\n * Resolves the tenant's OAuth endpoints, preferring the OIDC discovery document\n * and falling back to Incorta's fixed `/oauth/{tenant}/...` layout when the\n * document is unreachable. Cached per issuer for the process lifetime.\n */\nexport function getEndpoints(config: ResolvedConfig): Promise<Endpoints> {\n  const cached = endpointsCache.get(config.issuer);\n  if (cached) return cached;\n\n  const promise = resolve(config).catch((error) => {\n    // Do not cache failures — a temporarily unreachable Incorta should not\n    // poison the process.\n    endpointsCache.delete(config.issuer);\n    throw error;\n  });\n  endpointsCache.set(config.issuer, promise);\n  return promise;\n}\n\nasync function resolve(config: ResolvedConfig): Promise<Endpoints> {\n  const fallback: DiscoveryDocument = {\n    issuer: config.issuer,\n    authorization_endpoint: `${config.issuer}/authorize`,\n    token_endpoint: `${config.issuer}/token`,\n    jwks_uri: `${config.issuer}/.well-known/jwks.json`,\n  };\n\n  let doc = fallback;\n  try {\n    const response = await config.fetch(config.discoveryUrl, {\n      headers: { accept: \"application/json\" },\n    });\n    if (response.ok) {\n      const body = (await response.json()) as Partial<DiscoveryDocument>;\n      doc = {\n        issuer: body.issuer ?? fallback.issuer,\n        authorization_endpoint: body.authorization_endpoint ?? fallback.authorization_endpoint,\n        token_endpoint: body.token_endpoint ?? fallback.token_endpoint,\n        jwks_uri: body.jwks_uri ?? fallback.jwks_uri,\n      };\n    }\n  } catch {\n    // Fall through to the fixed layout.\n  }\n\n  const jwks =\n    config.jwksOverride ??\n    createRemoteJWKSet(new URL(doc.jwks_uri), {\n      cacheMaxAge: 10 * 60 * 1000,\n      cooldownDuration: 30 * 1000,\n    });\n\n  return {\n    issuer: doc.issuer,\n    authorizationEndpoint: doc.authorization_endpoint,\n    tokenEndpoint: doc.token_endpoint,\n    jwks,\n  };\n}\n\n/** Test hook: clears the per-process endpoint cache. */\nexport function clearEndpointsCache(): void {\n  endpointsCache.clear();\n}\n","import { createHash } from \"node:crypto\";\nimport { EncryptJWT, jwtDecrypt } from \"jose\";\nimport type { ResolvedConfig, SessionData } from \"./config.js\";\n\n/**\n * Session and state cookies are sealed as encrypted JWTs (JWE, dir + A256GCM):\n * tamper-proof AND opaque, since the session carries the Incorta access/refresh\n * tokens. The 256-bit key is derived from the configured secret.\n */\nfunction sealKey(config: ResolvedConfig): Uint8Array {\n  return new Uint8Array(\n    createHash(\"sha256\").update(`incorta-auth:${config.secret}`).digest(),\n  );\n}\n\ninterface SealedPayload {\n  /** Guards against replaying one cookie kind as the other. */\n  purpose: \"session\" | \"state\";\n  data: unknown;\n}\n\nasync function seal(\n  config: ResolvedConfig,\n  purpose: SealedPayload[\"purpose\"],\n  data: unknown,\n  maxAgeSeconds: number,\n): Promise<string> {\n  return new EncryptJWT({ purpose, data })\n    .setProtectedHeader({ alg: \"dir\", enc: \"A256GCM\" })\n    .setIssuedAt()\n    .setExpirationTime(`${maxAgeSeconds}s`)\n    .encrypt(sealKey(config));\n}\n\nasync function unseal<T>(\n  config: ResolvedConfig,\n  purpose: SealedPayload[\"purpose\"],\n  cookieValue: string | undefined,\n): Promise<{ data: T; issuedAt: number; expiresAt: number } | null> {\n  if (!cookieValue) return null;\n  try {\n    const { payload } = await jwtDecrypt(cookieValue, sealKey(config));\n    if (payload.purpose !== purpose) return null;\n    return {\n      data: payload.data as T,\n      issuedAt: (payload.iat ?? 0) * 1000,\n      expiresAt: (payload.exp ?? 0) * 1000,\n    };\n  } catch {\n    // Expired, tampered, or sealed with a different secret — treat as absent.\n    return null;\n  }\n}\n\nexport function sealSession(config: ResolvedConfig, session: SessionData): Promise<string> {\n  return seal(config, \"session\", session, config.sessionMaxAge);\n}\n\nexport async function unsealSession(\n  config: ResolvedConfig,\n  cookieValue: string | undefined,\n): Promise<{ session: SessionData; issuedAt: number; expiresAt: number } | null> {\n  const result = await unseal<SessionData>(config, \"session\", cookieValue);\n  if (!result) return null;\n  const { data, issuedAt, expiresAt } = result;\n  if (!data || typeof data !== \"object\" || !data.user || !data.accessToken) return null;\n  return { session: data, issuedAt, expiresAt };\n}\n\n/** Login round-trip state (CSRF protection + post-login destination). */\nexport interface LoginState {\n  state: string;\n  nonce: string;\n  returnTo: string;\n}\n\nconst STATE_MAX_AGE_SECONDS = 10 * 60;\n\nexport function sealLoginState(config: ResolvedConfig, state: LoginState): Promise<string> {\n  return seal(config, \"state\", state, STATE_MAX_AGE_SECONDS);\n}\n\nexport async function unsealLoginState(\n  config: ResolvedConfig,\n  cookieValue: string | undefined,\n): Promise<LoginState | null> {\n  const result = await unseal<LoginState>(config, \"state\", cookieValue);\n  if (!result) return null;\n  const { data } = result;\n  if (!data || typeof data.state !== \"string\" || typeof data.nonce !== \"string\") return null;\n  return data;\n}\n","import { decodeJwt, jwtVerify } from \"jose\";\nimport type { JWTPayload } from \"jose\";\nimport type { IncortaUser, ResolvedConfig } from \"./config.js\";\nimport { getEndpoints } from \"./discovery.js\";\n\nexport interface TokenSet {\n  accessToken: string;\n  /** Epoch millis derived from the access token's `exp` claim. */\n  accessTokenExpiresAt: number;\n  idToken?: string;\n  refreshToken?: string;\n}\n\ninterface TokenEndpointResponse {\n  access_token?: string;\n  id_token?: string;\n  refresh_token?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport class IncortaAuthError extends Error {\n  constructor(\n    readonly code: string,\n    message: string,\n  ) {\n    super(`[incorta-auth] ${message}`);\n    this.name = \"IncortaAuthError\";\n  }\n}\n\nfunction basicAuth(config: ResolvedConfig): string {\n  const raw = `${config.clientId}:${config.clientSecret}`;\n  return `Basic ${Buffer.from(raw, \"utf8\").toString(\"base64\")}`;\n}\n\nasync function callTokenEndpoint(\n  config: ResolvedConfig,\n  params: Record<string, string>,\n): Promise<TokenSet> {\n  const { tokenEndpoint } = await getEndpoints(config);\n\n  let response: Response;\n  try {\n    response = await config.fetch(tokenEndpoint, {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        accept: \"application/json\",\n        authorization: basicAuth(config),\n      },\n      body: new URLSearchParams(params).toString(),\n    });\n  } catch (error) {\n    throw new IncortaAuthError(\n      \"incorta_unreachable\",\n      `Could not reach the Incorta token endpoint (${tokenEndpoint}): ${(error as Error).message}`,\n    );\n  }\n\n  let body: TokenEndpointResponse;\n  try {\n    body = (await response.json()) as TokenEndpointResponse;\n  } catch {\n    throw new IncortaAuthError(\n      \"invalid_token_response\",\n      `Token endpoint returned a non-JSON response (HTTP ${response.status}).`,\n    );\n  }\n\n  if (!response.ok || !body.access_token) {\n    throw new IncortaAuthError(\n      body.error ?? \"token_exchange_failed\",\n      body.error_description ?? `Token exchange failed (HTTP ${response.status}).`,\n    );\n  }\n\n  const { exp } = decodeJwt(body.access_token);\n  return {\n    accessToken: body.access_token,\n    accessTokenExpiresAt: exp ? exp * 1000 : Date.now() + 60 * 60 * 1000,\n    idToken: body.id_token,\n    refreshToken: body.refresh_token,\n  };\n}\n\nexport function exchangeCode(\n  config: ResolvedConfig,\n  code: string,\n  redirectUri: string,\n): Promise<TokenSet> {\n  return callTokenEndpoint(config, {\n    grant_type: \"authorization_code\",\n    code,\n    redirect_uri: redirectUri,\n  });\n}\n\nexport function refreshTokens(config: ResolvedConfig, refreshToken: string): Promise<TokenSet> {\n  return callTokenEndpoint(config, {\n    grant_type: \"refresh_token\",\n    refresh_token: refreshToken,\n  });\n}\n\nasync function verifyJwt(config: ResolvedConfig, token: string): Promise<JWTPayload> {\n  const { jwks, issuer } = await getEndpoints(config);\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer,\n      audience: config.clientId,\n      algorithms: [\"RS256\"],\n    });\n    return payload;\n  } catch (error) {\n    throw new IncortaAuthError(\n      \"invalid_token\",\n      `Token verification failed: ${(error as Error).message}`,\n    );\n  }\n}\n\nexport async function verifyAccessToken(\n  config: ResolvedConfig,\n  accessToken: string,\n): Promise<JWTPayload> {\n  return verifyJwt(config, accessToken);\n}\n\n/**\n * Verifies the ID token (signature, issuer, audience, nonce) and maps its\n * claims to the SDK's user shape.\n */\nexport async function verifyIdToken(\n  config: ResolvedConfig,\n  idToken: string,\n  expectedNonce: string,\n): Promise<IncortaUser> {\n  const payload = await verifyJwt(config, idToken);\n\n  if (payload.nonce !== expectedNonce) {\n    throw new IncortaAuthError(\"nonce_mismatch\", \"ID token nonce does not match the login request.\");\n  }\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\n    throw new IncortaAuthError(\"invalid_token\", \"ID token is missing the sub claim.\");\n  }\n\n  const roles = Array.isArray(payload.roles)\n    ? payload.roles.filter((role): role is string => typeof role === \"string\")\n    : [];\n\n  return {\n    sub: payload.sub,\n    name: typeof payload.name === \"string\" ? payload.name : undefined,\n    email: typeof payload.email === \"string\" ? payload.email : undefined,\n    roles,\n    tenant: typeof payload.tenant === \"string\" ? payload.tenant : config.tenant,\n  };\n}\n\n/**\n * Fallback identity when the client was registered without the `openid` scope\n * (no ID token in the response): identify the user from the verified access\n * token instead. Name/email/roles are unavailable in that case.\n */\nexport async function userFromAccessToken(\n  config: ResolvedConfig,\n  accessToken: string,\n): Promise<IncortaUser> {\n  const payload = await verifyAccessToken(config, accessToken);\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\n    throw new IncortaAuthError(\"invalid_token\", \"Access token is missing the sub claim.\");\n  }\n  return {\n    sub: payload.sub,\n    roles: [],\n    tenant: typeof payload.tenant === \"string\" ? payload.tenant : config.tenant,\n  };\n}\n","export interface RegisterClientOptions {\n  /** Incorta base URL, e.g. `http://localhost:8080/incorta`. */\n  incortaUrl: string;\n  /** Tenant to register the client in. */\n  tenant: string;\n  /** Display name of the client. */\n  name: string;\n  /** Allowed OAuth callback URLs, e.g. `http://localhost:4000/auth/callback`. */\n  redirectUris: string[];\n  /** @default \"openid profile email\" */\n  scope?: string;\n  /** @default [\"authorization_code\", \"refresh_token\"] */\n  grantTypes?: string[];\n  fetchImpl?: typeof fetch;\n}\n\nexport interface RegisteredClient {\n  clientId: string;\n  clientSecret: string;\n  /** Bearer token for managing this registration (GET/PUT/DELETE it later). */\n  registrationAccessToken?: string;\n  /** URL to manage this registration. */\n  registrationClientUri?: string;\n}\n\n/**\n * Registers an OAuth client in Incorta via RFC 7591 dynamic client\n * registration (`POST {incortaUrl}/oauth/{tenant}/register`). Incorta allows\n * unauthenticated registration for authorization_code clients; the response\n * carries the generated client_id/client_secret — store them once, e.g. in the\n * app's `.env`.\n */\nexport async function registerClient(\n  options: RegisterClientOptions,\n): Promise<RegisteredClient> {\n  const {\n    incortaUrl,\n    tenant,\n    name,\n    redirectUris,\n    scope = \"openid profile email\",\n    grantTypes = [\"authorization_code\", \"refresh_token\"],\n    fetchImpl = fetch,\n  } = options;\n\n  if (!redirectUris.length) {\n    throw new Error(\"[incorta-auth] registerClient requires at least one redirect URI.\");\n  }\n\n  const endpoint = `${incortaUrl.replace(/\\/+$/, \"\")}/oauth/${tenant}/register`;\n  const response = await fetchImpl(endpoint, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n    body: JSON.stringify({\n      client_name: name,\n      redirect_uris: redirectUris,\n      grant_types: grantTypes,\n      scope,\n      token_endpoint_auth_method: \"client_secret_basic\",\n    }),\n  });\n\n  interface RegistrationResponse {\n    client_id?: string;\n    client_secret?: string;\n    registration_access_token?: string;\n    registration_client_uri?: string;\n    error?: string;\n    error_description?: string;\n  }\n\n  let body: RegistrationResponse;\n  try {\n    body = (await response.json()) as RegistrationResponse;\n  } catch {\n    throw new Error(\n      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). ` +\n        \"Is the OAuth authorization server enabled on this cluster?\",\n    );\n  }\n\n  if (!response.ok || !body.client_id || !body.client_secret) {\n    throw new Error(\n      `[incorta-auth] Client registration failed (HTTP ${response.status}): ` +\n        `${body.error ?? \"unknown_error\"} — ${body.error_description ?? \"no description\"}`,\n    );\n  }\n\n  return {\n    clientId: body.client_id,\n    clientSecret: body.client_secret,\n    registrationAccessToken: body.registration_access_token,\n    registrationClientUri: body.registration_client_uri,\n  };\n}\n","import { resolveConfig } from \"./core/config.js\";\nimport type { IncortaAuthConfig, ResolvedConfig } from \"./core/config.js\";\nimport { createHandler } from \"./core/handler.js\";\nimport type { AuthHandler, AuthSession } from \"./core/handler.js\";\n\nexport type {\n  IncortaAuthConfig,\n  IncortaUser,\n  SessionData,\n  SessionInfo,\n} from \"./core/config.js\";\nexport type { AuthHandler, AuthSession } from \"./core/handler.js\";\nexport { IncortaAuthError } from \"./core/tokens.js\";\nexport { registerClient } from \"./core/register.js\";\nexport type { RegisterClientOptions, RegisteredClient } from \"./core/register.js\";\n\nexport interface IncortaAuth {\n  /**\n   * Web-standard request handler serving the auth routes under\n   * `config.basePath` (default `/auth`): `/login`, `/callback`, `/session`,\n   * `/logout` (+ `/token` when `exposeAccessToken` is on).\n   *\n   * Wire it to anything that speaks `Request`/`Response` — a TanStack Start\n   * server route, Bun.serve, or via `@incorta/auth/node` / `@incorta/auth/express`\n   * for Node servers.\n   */\n  handler: AuthHandler;\n  /**\n   * Reads the session from a web-standard `Request` (server-side gating, API\n   * routes, server functions). Returns null when the user is not signed in.\n   */\n  getSession: (request: Request) => Promise<AuthSession | null>;\n  /** The resolved configuration (secrets included — do not log). */\n  config: ResolvedConfig;\n}\n\n/**\n * Creates an IncortaAuth instance: OAuth 2.0 authorization-code flow against\n * Incorta's built-in authorization server. Unauthenticated users are redirected\n * to the Incorta login page and returned to your app once signed in.\n */\nexport function createIncortaAuth(config: IncortaAuthConfig = {}): IncortaAuth {\n  const resolved = resolveConfig(config);\n  const { handler, getSession } = createHandler(resolved);\n  return { handler, getSession, config: resolved };\n}\n"],"mappings":";AAuHA,SAAS,SAAS,OAA2B,MAAc,QAAwB;AACjF,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,2CAA2C,IAAI,iBAAiB,MAAM;AAAA,IACxE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAEO,SAAS,cAAc,QAA2B,CAAC,GAAmB;AAC3E,QAAM,MAAO,WACV,SAAS,OAAO,CAAC;AAEpB,QAAM,aAAa;AAAA,IACjB,SAAS,MAAM,cAAc,IAAI,aAAa,cAAc,aAAa;AAAA,EAC3E;AACA,QAAM,SAAS,SAAS,MAAM,UAAU,IAAI,gBAAgB,UAAU,gBAAgB;AACtF,QAAM,WAAW;AAAA,IACf,MAAM,YAAY,IAAI;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe;AAAA,IACnB,MAAM,gBAAgB,IAAI;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS;AAAA,IACb,MAAM,UAAU,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,EACF;AACA,MAAI,OAAO,SAAS,IAAI;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,GAAG;AACvD,UAAM,IAAI;AAAA,MACR,0EAA0E,QAAQ;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,UAAU,IAAI;AACnC,QAAM,aAAa,MAAM,SAAS,cAAc;AAChD,QAAM,SAAS,GAAG,UAAU,UAAU,MAAM;AAE5C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,SAAS,mBAAmB,MAAM,IAAI;AAAA,IAC9C,OAAO,MAAM,SAAS;AAAA,IACtB;AAAA,IACA,iBAAiB,GAAG,UAAU;AAAA,IAC9B,eAAe,MAAM,SAAS,UAAU,KAAK,KAAK;AAAA,IAClD,eAAe,MAAM,SAAS,UAAU;AAAA,IACxC,mBAAmB,MAAM,qBAAqB;AAAA,IAC9C;AAAA,IACA,cACE,MAAM,UAAU,gBAAgB,GAAG,MAAM;AAAA,IAC3C,cAAc,MAAM,UAAU;AAAA,IAC9B,OAAO,MAAM,UAAU,SAAS;AAAA,EAClC;AACF;;;AChMA,SAAS,mBAAmB;;;ACSrB,SAAS,aAAa,QAA2D;AACtF,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,OAAO,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,QAAI,CAAC,KAAM;AACX,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,EAAG,SAAQ,MAAM,MAAM,GAAG,EAAE;AAC3E,QAAI;AACF,UAAI,IAAI,IAAI,mBAAmB,KAAK;AAAA,IACtC,QAAQ;AACN,UAAI,IAAI,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,gBACd,MACA,OACA,UAAyB,CAAC,GAClB;AACR,QAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC,EAAE;AACrD,QAAM,KAAK,QAAQ,QAAQ,QAAQ,GAAG,EAAE;AACxC,MAAI,QAAQ,WAAW,QAAW;AAChC,UAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,CAAC,EAAE;AAElD,UAAM,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,SAAS,GAAI,EAAE,YAAY,CAAC,EAAE;AAAA,EACpF;AACA,MAAI,QAAQ,YAAY,KAAM,OAAM,KAAK,UAAU;AACnD,MAAI,QAAQ,OAAQ,OAAM,KAAK,QAAQ;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,KAAK,YAAY,SAAS,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE;AAC7E,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,aAAa,MAAc,UAAyB,CAAC,GAAW;AAC9E,SAAO,gBAAgB,MAAM,IAAI,EAAE,GAAG,SAAS,QAAQ,EAAE,CAAC;AAC5D;;;ACjDA,SAAS,0BAA0B;AAkBnC,IAAM,iBAAiB,oBAAI,IAAgC;AAOpD,SAAS,aAAa,QAA4C;AACvE,QAAM,SAAS,eAAe,IAAI,OAAO,MAAM;AAC/C,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,QAAQ,MAAM,EAAE,MAAM,CAAC,UAAU;AAG/C,mBAAe,OAAO,OAAO,MAAM;AACnC,UAAM;AAAA,EACR,CAAC;AACD,iBAAe,IAAI,OAAO,QAAQ,OAAO;AACzC,SAAO;AACT;AAEA,eAAe,QAAQ,QAA4C;AACjE,QAAM,WAA8B;AAAA,IAClC,QAAQ,OAAO;AAAA,IACf,wBAAwB,GAAG,OAAO,MAAM;AAAA,IACxC,gBAAgB,GAAG,OAAO,MAAM;AAAA,IAChC,UAAU,GAAG,OAAO,MAAM;AAAA,EAC5B;AAEA,MAAI,MAAM;AACV,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,MAAM,OAAO,cAAc;AAAA,MACvD,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACxC,CAAC;AACD,QAAI,SAAS,IAAI;AACf,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,YAAM;AAAA,QACJ,QAAQ,KAAK,UAAU,SAAS;AAAA,QAChC,wBAAwB,KAAK,0BAA0B,SAAS;AAAA,QAChE,gBAAgB,KAAK,kBAAkB,SAAS;AAAA,QAChD,UAAU,KAAK,YAAY,SAAS;AAAA,MACtC;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,OACJ,OAAO,gBACP,mBAAmB,IAAI,IAAI,IAAI,QAAQ,GAAG;AAAA,IACxC,aAAa,KAAK,KAAK;AAAA,IACvB,kBAAkB,KAAK;AAAA,EACzB,CAAC;AAEH,SAAO;AAAA,IACL,QAAQ,IAAI;AAAA,IACZ,uBAAuB,IAAI;AAAA,IAC3B,eAAe,IAAI;AAAA,IACnB;AAAA,EACF;AACF;;;AC9EA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,kBAAkB;AAQvC,SAAS,QAAQ,QAAoC;AACnD,SAAO,IAAI;AAAA,IACT,WAAW,QAAQ,EAAE,OAAO,gBAAgB,OAAO,MAAM,EAAE,EAAE,OAAO;AAAA,EACtE;AACF;AAQA,eAAe,KACb,QACA,SACA,MACA,eACiB;AACjB,SAAO,IAAI,WAAW,EAAE,SAAS,KAAK,CAAC,EACpC,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,GAAG,aAAa,GAAG,EACrC,QAAQ,QAAQ,MAAM,CAAC;AAC5B;AAEA,eAAe,OACb,QACA,SACA,aACkE;AAClE,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,WAAW,aAAa,QAAQ,MAAM,CAAC;AACjE,QAAI,QAAQ,YAAY,QAAS,QAAO;AACxC,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,WAAW,QAAQ,OAAO,KAAK;AAAA,MAC/B,YAAY,QAAQ,OAAO,KAAK;AAAA,IAClC;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,YAAY,QAAwB,SAAuC;AACzF,SAAO,KAAK,QAAQ,WAAW,SAAS,OAAO,aAAa;AAC9D;AAEA,eAAsB,cACpB,QACA,aAC+E;AAC/E,QAAM,SAAS,MAAM,OAAoB,QAAQ,WAAW,WAAW;AACvE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,MAAM,UAAU,UAAU,IAAI;AACtC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,KAAK,QAAQ,CAAC,KAAK,YAAa,QAAO;AACjF,SAAO,EAAE,SAAS,MAAM,UAAU,UAAU;AAC9C;AASA,IAAM,wBAAwB,KAAK;AAE5B,SAAS,eAAe,QAAwB,OAAoC;AACzF,SAAO,KAAK,QAAQ,SAAS,OAAO,qBAAqB;AAC3D;AAEA,eAAsB,iBACpB,QACA,aAC4B;AAC5B,QAAM,SAAS,MAAM,OAAmB,QAAQ,SAAS,WAAW;AACpE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,KAAK,IAAI;AACjB,MAAI,CAAC,QAAQ,OAAO,KAAK,UAAU,YAAY,OAAO,KAAK,UAAU,SAAU,QAAO;AACtF,SAAO;AACT;;;AC3FA,SAAS,WAAW,iBAAiB;AAqB9B,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACW,MACT,SACA;AACA,UAAM,kBAAkB,OAAO,EAAE;AAHxB;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAEA,SAAS,UAAU,QAAgC;AACjD,QAAM,MAAM,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY;AACrD,SAAO,SAAS,OAAO,KAAK,KAAK,MAAM,EAAE,SAAS,QAAQ,CAAC;AAC7D;AAEA,eAAe,kBACb,QACA,QACmB;AACnB,QAAM,EAAE,cAAc,IAAI,MAAM,aAAa,MAAM;AAEnD,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,OAAO,MAAM,eAAe;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,IAAI,gBAAgB,MAAM,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+CAA+C,aAAa,MAAO,MAAgB,OAAO;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,SAAS,MAAM;AAAA,IACtE;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,MAAM,CAAC,KAAK,cAAc;AACtC,UAAM,IAAI;AAAA,MACR,KAAK,SAAS;AAAA,MACd,KAAK,qBAAqB,+BAA+B,SAAS,MAAM;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,EAAE,IAAI,IAAI,UAAU,KAAK,YAAY;AAC3C,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,IAClB,sBAAsB,MAAM,MAAM,MAAO,KAAK,IAAI,IAAI,KAAK,KAAK;AAAA,IAChE,SAAS,KAAK;AAAA,IACd,cAAc,KAAK;AAAA,EACrB;AACF;AAEO,SAAS,aACd,QACA,MACA,aACmB;AACnB,SAAO,kBAAkB,QAAQ;AAAA,IAC/B,YAAY;AAAA,IACZ;AAAA,IACA,cAAc;AAAA,EAChB,CAAC;AACH;AAEO,SAAS,cAAc,QAAwB,cAAyC;AAC7F,SAAO,kBAAkB,QAAQ;AAAA,IAC/B,YAAY;AAAA,IACZ,eAAe;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,UAAU,QAAwB,OAAoC;AACnF,QAAM,EAAE,MAAM,OAAO,IAAI,MAAM,aAAa,MAAM;AAClD,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA+B,MAAgB,OAAO;AAAA,IACxD;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,QACA,aACqB;AACrB,SAAO,UAAU,QAAQ,WAAW;AACtC;AAMA,eAAsB,cACpB,QACA,SACA,eACsB;AACtB,QAAM,UAAU,MAAM,UAAU,QAAQ,OAAO;AAE/C,MAAI,QAAQ,UAAU,eAAe;AACnC,UAAM,IAAI,iBAAiB,kBAAkB,kDAAkD;AAAA,EACjG;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,iBAAiB,iBAAiB,oCAAoC;AAAA,EAClF;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IACrC,QAAQ,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,IACvE,CAAC;AAEL,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAC3D;AAAA,IACA,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAOA,eAAsB,oBACpB,QACA,aACsB;AACtB,QAAM,UAAU,MAAM,kBAAkB,QAAQ,WAAW;AAC3D,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,iBAAiB,iBAAiB,wCAAwC;AAAA,EACtF;AACA,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,OAAO,CAAC;AAAA,IACR,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;;;AJvJA,IAAM,iCAAiC,KAAK;AAE5C,SAAS,cAAc,QAAwB,SAA0B;AACvE,MAAI,OAAO,OAAQ,QAAO,OAAO;AACjC,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,QACJ,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC9D,IAAI,SAAS,QAAQ,KAAK,EAAE;AAC9B,QAAM,OACJ,QAAQ,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC7D,QAAQ,QAAQ,IAAI,MAAM,KAC1B,IAAI;AACN,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEA,SAAS,gBAAgB,QAAwB,SAA2B;AAC1E,MAAI,OAAO,kBAAkB,OAAQ,QAAO,OAAO;AACnD,SAAO,cAAc,QAAQ,OAAO,EAAE,WAAW,UAAU;AAC7D;AAMA,SAAS,iBAAiB,KAAoB,QAAwB;AACpE,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAI,IAAI,WAAW,OAAQ,QAAO,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI,MAAM;AAAA,EACjF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,KAAK,QAAgB,MAAe,UAAoB,CAAC,GAAa;AAC7E,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,EACnB,CAAC;AACD,aAAW,UAAU,QAAS,SAAQ,OAAO,cAAc,MAAM;AACjE,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,QAAQ,CAAC;AAC/D;AAEA,SAAS,SAAS,UAAkB,UAAoB,CAAC,GAAa;AACpE,QAAM,UAAU,IAAI,QAAQ,EAAE,UAAU,iBAAiB,WAAW,CAAC;AACrE,aAAW,UAAU,QAAS,SAAQ,OAAO,cAAc,MAAM;AACjE,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAEA,SAAS,eAAe,QAAgB,MAAsB;AAC5D,QAAM,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM;AAC/C,SAAO,GAAG,MAAM,GAAG,SAAS,sBAAsB,mBAAmB,IAAI,CAAC;AAC5E;AAEA,SAAS,cAAsB;AAC7B,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEO,SAAS,cAAc,QAG5B;AACA,QAAM,uBAAuB,CAAC,YAAqB;AAAA,IACjD,UAAU;AAAA,IACV;AAAA,IACA,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AAEA,iBAAe,MAAM,SAAkB,KAA6B;AAClE,UAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,WAAW,iBAAiB,IAAI,aAAa,IAAI,aAAa,GAAG,MAAM;AAG7E,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,SAAU,QAAO,SAAS,QAAQ;AAEtC,UAAM,QAAQ,YAAY;AAC1B,UAAM,QAAQ,YAAY;AAC1B,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,MACP,MAAM,eAAe,QAAQ,EAAE,OAAO,OAAO,SAAS,CAAC;AAAA,MACvD,EAAE,GAAG,qBAAqB,MAAM,GAAG,QAAQ,IAAI;AAAA,IACjD;AAEA,UAAM,EAAE,sBAAsB,IAAI,MAAM,aAAa,MAAM;AAC3D,UAAM,eAAe,IAAI,IAAI,qBAAqB;AAClD,iBAAa,aAAa,IAAI,iBAAiB,MAAM;AACrD,iBAAa,aAAa,IAAI,aAAa,OAAO,QAAQ;AAC1D,iBAAa,aAAa,IAAI,gBAAgB,GAAG,MAAM,GAAG,OAAO,QAAQ,WAAW;AACpF,iBAAa,aAAa,IAAI,SAAS,OAAO,KAAK;AACnD,iBAAa,aAAa,IAAI,SAAS,KAAK;AAC5C,iBAAa,aAAa,IAAI,SAAS,KAAK;AAE5C,WAAO,SAAS,aAAa,SAAS,GAAG,CAAC,WAAW,CAAC;AAAA,EACxD;AAEA,iBAAe,SAAS,SAAkB,KAA6B;AACrE,UAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,aAAa,aAAa,OAAO,iBAAiB,qBAAqB,MAAM,CAAC;AAEpF,UAAM,aAAa,MAAM,iBAAiB,QAAQ,QAAQ,OAAO,eAAe,CAAC;AACjF,UAAM,WAAW,iBAAiB,YAAY,YAAY,MAAM,MAAM;AAEtE,UAAM,OAAO,CAACA,UAAiB,SAAS,eAAe,UAAUA,KAAI,GAAG,CAAC,UAAU,CAAC;AAEpF,UAAM,aAAa,IAAI,aAAa,IAAI,OAAO;AAC/C,QAAI,WAAY,QAAO,KAAK,UAAU;AAEtC,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,QAAI,CAAC,QAAQ,CAAC,MAAO,QAAO,KAAK,cAAc;AAC/C,QAAI,CAAC,WAAY,QAAO,KAAK,eAAe;AAC5C,QAAI,UAAU,WAAW,MAAO,QAAO,KAAK,gBAAgB;AAE5D,QAAI;AACF,YAAM,SAAS,MAAM,aAAa,QAAQ,MAAM,GAAG,MAAM,GAAG,OAAO,QAAQ,WAAW;AACtF,YAAM,OAAO,OAAO,UAChB,MAAM,cAAc,QAAQ,OAAO,SAAS,WAAW,KAAK,IAC5D,MAAM,oBAAoB,QAAQ,OAAO,WAAW;AAExD,YAAM,UAAuB;AAAA,QAC3B;AAAA,QACA,aAAa,OAAO;AAAA,QACpB,sBAAsB,OAAO;AAAA,QAC7B,cAAc,OAAO;AAAA,QACrB,WAAW,KAAK,IAAI;AAAA,MACtB;AACA,YAAM,gBAAgB;AAAA,QACpB,OAAO;AAAA,QACP,MAAM,YAAY,QAAQ,OAAO;AAAA,QACjC,EAAE,GAAG,qBAAqB,MAAM,GAAG,QAAQ,OAAO,cAAc;AAAA,MAClE;AACA,aAAO,SAAS,UAAU,CAAC,eAAe,UAAU,CAAC;AAAA,IACvD,SAAS,OAAO;AACd,YAAMA,QAAO,iBAAiB,mBAAmB,MAAM,OAAO;AAC9D,aAAO,KAAKA,KAAI;AAAA,IAClB;AAAA,EACF;AAOA,iBAAe,YAAY,SAIxB;AACD,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,kBAAkB,GAAG,YAAY,CAAC,EAAE;AAE3E,QAAI,EAAE,QAAQ,IAAI;AAClB,QAAI,aAAa;AACjB,UAAM,MAAM,KAAK,IAAI;AAErB,QAAI,QAAQ,uBAAuB,MAAM,gCAAgC;AACvE,UAAI,QAAQ,cAAc;AACxB,YAAI;AACF,gBAAM,SAAS,MAAM,cAAc,QAAQ,QAAQ,YAAY;AAC/D,oBAAU;AAAA,YACR,GAAG;AAAA,YACH,aAAa,OAAO;AAAA,YACpB,sBAAsB,OAAO;AAAA,YAC7B,cAAc,OAAO,gBAAgB,QAAQ;AAAA,UAC/C;AACA,uBAAa;AAAA,QACf,QAAQ;AAGN,cAAI,QAAQ,wBAAwB,KAAK;AACvC,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,kBAAkB;AAAA,cAClB,YAAY,CAAC,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC,CAAC;AAAA,YAC5E;AAAA,UACF;AAAA,QACF;AAAA,MACF,WAAW,QAAQ,wBAAwB,KAAK;AAC9C,eAAO;AAAA,UACL,SAAS;AAAA,UACT,kBAAkB;AAAA,UAClB,YAAY,CAAC,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC,CAAC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAc,OAAO,gBAAgB,MAAQ;AACnD,QAAI,MAAM,SAAS,WAAW,WAAY,cAAa;AAEvD,QAAI,CAAC,YAAY;AACf,aAAO,EAAE,SAAS,kBAAkB,SAAS,WAAW,YAAY,CAAC,EAAE;AAAA,IACzE;AACA,UAAM,WAAW,gBAAgB,OAAO,YAAY,MAAM,YAAY,QAAQ,OAAO,GAAG;AAAA,MACtF,GAAG,qBAAqB,MAAM;AAAA,MAC9B,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,WAAO;AAAA,MACL;AAAA,MACA,kBAAkB,MAAM,OAAO,gBAAgB;AAAA,MAC/C,YAAY,CAAC,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,iBAAe,aAAa,SAAqC;AAC/D,UAAM,EAAE,SAAS,kBAAkB,WAAW,IAAI,MAAM,YAAY,OAAO;AAC3E,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,EAAE,MAAM,KAAK,GAAG,UAAU;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM,QAAQ;AAAA,QACd,SAAS;AAAA,UACP,WAAW;AAAA,UACX,sBAAsB,QAAQ;AAAA,QAChC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,WAAW,SAAqC;AAC7D,QAAI,CAAC,OAAO,kBAAmB,QAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AACtE,UAAM,EAAE,SAAS,WAAW,IAAI,MAAM,YAAY,OAAO;AACzD,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,EAAE,OAAO,kBAAkB,GAAG,UAAU;AACvE,WAAO;AAAA,MACL;AAAA,MACA,EAAE,aAAa,QAAQ,aAAa,WAAW,QAAQ,qBAAqB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OAAO,SAAkB,KAA6B;AACnE,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,eAAe,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC;AACjF,QAAI,QAAQ,WAAW,OAAO;AAC5B,YAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,YAAM,WAAW,iBAAiB,IAAI,aAAa,IAAI,aAAa,GAAG,MAAM;AAC7E,aAAO,SAAS,UAAU,CAAC,YAAY,CAAC;AAAA,IAC1C;AACA,WAAO,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,CAAC,YAAY,CAAC;AAAA,EAC/C;AAEA,iBAAe,QAAQ,SAAqC;AAC1D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,IAAI,aAAa,OAAO,YAAY,CAAC,IAAI,SAAS,WAAW,GAAG,OAAO,QAAQ,GAAG,GAAG;AACvF,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AACA,UAAM,QAAQ,IAAI,SAAS,MAAM,OAAO,SAAS,MAAM,KAAK;AAC5D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAE1C,QAAI;AACF,UAAI,UAAU,YAAY,WAAW,MAAO,QAAO,MAAM,MAAM,SAAS,GAAG;AAC3E,UAAI,UAAU,eAAe,WAAW,MAAO,QAAO,MAAM,SAAS,SAAS,GAAG;AACjF,UAAI,UAAU,cAAc,WAAW,MAAO,QAAO,MAAM,aAAa,OAAO;AAC/E,UAAI,UAAU,YAAY,WAAW,MAAO,QAAO,MAAM,WAAW,OAAO;AAC3E,UAAI,UAAU,cAAc,WAAW,UAAU,WAAW,QAAQ;AAClE,eAAO,MAAM,OAAO,SAAS,GAAG;AAAA,MAClC;AACA,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC,SAAS,OAAO;AACd,YAAM,OAAO,iBAAiB,mBAAmB,MAAM,OAAO;AAC9D,YAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,cAAQ,MAAM,kBAAkB,KAAK,YAAY,OAAO;AACxD,aAAO,KAAK,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,IAClC;AAAA,EACF;AAEA,iBAAe,WAAW,SAA+C;AACvE,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,EAAE,SAAS,UAAU,IAAI;AAC/B,QAAI,QAAQ,wBAAwB,KAAK,IAAI,KAAK,CAAC,QAAQ,aAAc,QAAO;AAChF,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,sBAAsB,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,WAAW;AAC/B;;;AK/RA,eAAsB,eACpB,SAC2B;AAC3B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,aAAa,CAAC,sBAAsB,eAAe;AAAA,IACnD,YAAY;AAAA,EACd,IAAI;AAEJ,MAAI,CAAC,aAAa,QAAQ;AACxB,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAEA,QAAM,WAAW,GAAG,WAAW,QAAQ,QAAQ,EAAE,CAAC,UAAU,MAAM;AAClE,QAAM,WAAW,MAAM,UAAU,UAAU;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oBAAoB,QAAQ,mBAAmB;AAAA,IAC1E,MAAM,KAAK,UAAU;AAAA,MACnB,aAAa;AAAA,MACb,eAAe;AAAA,MACf,aAAa;AAAA,MACb;AAAA,MACA,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH,CAAC;AAWD,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,yEAAyE,SAAS,MAAM;AAAA,IAE1F;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,MAAM,CAAC,KAAK,aAAa,CAAC,KAAK,eAAe;AAC1D,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,MAC7D,KAAK,SAAS,eAAe,WAAM,KAAK,qBAAqB,gBAAgB;AAAA,IACpF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,cAAc,KAAK;AAAA,IACnB,yBAAyB,KAAK;AAAA,IAC9B,uBAAuB,KAAK;AAAA,EAC9B;AACF;;;ACrDO,SAAS,kBAAkB,SAA4B,CAAC,GAAgB;AAC7E,QAAM,WAAW,cAAc,MAAM;AACrC,QAAM,EAAE,SAAS,WAAW,IAAI,cAAc,QAAQ;AACtD,SAAO,EAAE,SAAS,YAAY,QAAQ,SAAS;AACjD;","names":["code"]}
+{"version":3,"sources":["../src/core/config.ts","../src/core/handler.ts","../src/core/cookies.ts","../src/core/discovery.ts","../src/core/session.ts","../src/core/tokens.ts","../src/core/register.ts","../src/index.ts"],"sourcesContent":["import type { JWTVerifyGetKey } from \"jose\";\n\n/** The Incorta user identity carried by the session (claims from the ID token). */\nexport interface IncortaUser {\n  /** Incorta login name (`sub` claim). */\n  sub: string;\n  name?: string;\n  email?: string;\n  /** Incorta role names, as minted into the ID token. */\n  roles: string[];\n  /** Tenant the user authenticated against. */\n  tenant: string;\n}\n\n/** What the sealed session cookie holds. */\nexport interface SessionData {\n  user: IncortaUser;\n  /** Incorta-issued access token (RS256 JWT, aud = client_id). */\n  accessToken: string;\n  /** Epoch millis when the access token expires. */\n  accessTokenExpiresAt: number;\n  /** Rotating refresh token, present when the client has the refresh_token grant. */\n  refreshToken?: string;\n  /** Epoch millis when this session was first created (login time). */\n  createdAt: number;\n}\n\nexport interface SessionInfo {\n  user: IncortaUser;\n  /** Epoch millis when the session cookie expires (sliding). */\n  expiresAt: number;\n  /** Epoch millis when the access token expires. */\n  accessTokenExpiresAt: number;\n}\n\nexport interface IncortaAuthConfig {\n  /**\n   * Base URL of the Incorta web application, e.g. `https://acme.cloud.incorta.com/incorta`\n   * or `http://localhost:8080/incorta`. Defaults to `INCORTA_URL`.\n   */\n  incortaUrl?: string;\n  /** Incorta tenant name, e.g. `demo`. Defaults to `INCORTA_TENANT`. */\n  tenant?: string;\n  /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */\n  clientId?: string;\n  /** OAuth client secret. Defaults to `INCORTA_CLIENT_SECRET`. */\n  clientSecret?: string;\n  /**\n   * Secret used to encrypt the session cookie (any long random string, >= 32 chars).\n   * Defaults to `INCORTA_AUTH_SECRET`.\n   */\n  secret?: string;\n  /**\n   * Path prefix the auth routes are mounted under. The SDK serves\n   * `{basePath}/login`, `{basePath}/callback`, `{basePath}/session`,\n   * `{basePath}/logout` (and optionally `{basePath}/token`).\n   * @default \"/auth\"\n   */\n  basePath?: string;\n  /**\n   * External origin of THIS app, e.g. `http://localhost:4000`. Used to build the\n   * OAuth callback URL and to validate `redirect_to` targets. When omitted it is\n   * derived per request from `x-forwarded-proto`/`x-forwarded-host`/`host`.\n   * Defaults to `INCORTA_APP_URL`.\n   */\n  appUrl?: string;\n  /** OAuth scopes to request. @default \"openid profile email\" */\n  scope?: string;\n  session?: {\n    /** @default \"incorta_auth_session\" */\n    cookieName?: string;\n    /** Session lifetime in seconds (sliding — renewed on activity). @default 43200 (12h) */\n    maxAge?: number;\n  };\n  cookies?: {\n    /**\n     * `Secure` attribute for cookies. `\"auto\"` sets it when the request is HTTPS.\n     * @default \"auto\"\n     */\n    secure?: boolean | \"auto\";\n  };\n  /**\n   * Expose `GET {basePath}/token` returning the raw Incorta access token to the\n   * browser (for calling Incorta public APIs directly from the frontend). Off by\n   * default — prefer proxying through your backend.\n   * @default false\n   */\n  exposeAccessToken?: boolean;\n  advanced?: {\n    /** Override the OIDC discovery document URL (rarely needed). */\n    discoveryUrl?: string;\n    /** Override JWKS resolution (used by tests to verify against a local key). */\n    jwks?: JWTVerifyGetKey;\n    /** Override fetch (used by tests). */\n    fetch?: typeof fetch;\n  };\n}\n\nexport interface ResolvedConfig {\n  incortaUrl: string;\n  tenant: string;\n  clientId: string;\n  clientSecret: string;\n  secret: string;\n  basePath: string;\n  appUrl?: string;\n  scope: string;\n  cookieName: string;\n  stateCookieName: string;\n  sessionMaxAge: number;\n  secureCookies: boolean | \"auto\";\n  exposeAccessToken: boolean;\n  /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */\n  issuer: string;\n  discoveryUrl: string;\n  jwksOverride?: JWTVerifyGetKey;\n  fetch: typeof fetch;\n}\n\nfunction required(value: string | undefined, name: string, envVar: string): string {\n  if (!value) {\n    throw new Error(\n      `[incorta-auth] Missing required config \"${name}\" (or env var ${envVar}).`,\n    );\n  }\n  return value;\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n\nexport function resolveConfig(input: IncortaAuthConfig = {}): ResolvedConfig {\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } })\n    .process?.env ?? {};\n\n  const incortaUrl = stripTrailingSlash(\n    required(input.incortaUrl ?? env.INCORTA_URL, \"incortaUrl\", \"INCORTA_URL\"),\n  );\n  const tenant = required(input.tenant ?? env.INCORTA_TENANT, \"tenant\", \"INCORTA_TENANT\");\n  const clientId = required(\n    input.clientId ?? env.INCORTA_CLIENT_ID,\n    \"clientId\",\n    \"INCORTA_CLIENT_ID\",\n  );\n  const clientSecret = required(\n    input.clientSecret ?? env.INCORTA_CLIENT_SECRET,\n    \"clientSecret\",\n    \"INCORTA_CLIENT_SECRET\",\n  );\n  const secret = required(\n    input.secret ?? env.INCORTA_AUTH_SECRET,\n    \"secret\",\n    \"INCORTA_AUTH_SECRET\",\n  );\n  if (secret.length < 32) {\n    throw new Error(\n      \"[incorta-auth] `secret` must be at least 32 characters. Generate one with: openssl rand -base64 32\",\n    );\n  }\n\n  const basePath = input.basePath ?? \"/auth\";\n  if (!basePath.startsWith(\"/\") || basePath.endsWith(\"/\")) {\n    throw new Error(\n      `[incorta-auth] basePath must start with \"/\" and not end with \"/\" (got \"${basePath}\").`,\n    );\n  }\n\n  const appUrl = input.appUrl ?? env.INCORTA_APP_URL;\n  const cookieName = input.session?.cookieName ?? \"incorta_auth_session\";\n  const issuer = `${incortaUrl}/oauth/${tenant}`;\n\n  return {\n    incortaUrl,\n    tenant,\n    clientId,\n    clientSecret,\n    secret,\n    basePath,\n    appUrl: appUrl ? stripTrailingSlash(appUrl) : undefined,\n    scope: input.scope ?? \"openid profile email\",\n    cookieName,\n    stateCookieName: `${cookieName}_state`,\n    sessionMaxAge: input.session?.maxAge ?? 12 * 60 * 60,\n    secureCookies: input.cookies?.secure ?? \"auto\",\n    exposeAccessToken: input.exposeAccessToken ?? false,\n    issuer,\n    discoveryUrl:\n      input.advanced?.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`,\n    jwksOverride: input.advanced?.jwks,\n    fetch: input.advanced?.fetch ?? fetch,\n  };\n}\n","import { randomBytes } from \"node:crypto\";\nimport type { ResolvedConfig, SessionData, SessionInfo } from \"./config.js\";\nimport { deleteCookie, parseCookies, serializeCookie } from \"./cookies.js\";\nimport { getEndpoints } from \"./discovery.js\";\nimport {\n  sealLoginState,\n  sealSession,\n  unsealLoginState,\n  unsealSession,\n} from \"./session.js\";\nimport {\n  IncortaAuthError,\n  exchangeCode,\n  refreshTokens,\n  userFromAccessToken,\n  verifyIdToken,\n} from \"./tokens.js\";\n\n/** A read-only view of the current session for server-side app code. */\nexport interface AuthSession extends SessionInfo {\n  /** Incorta access token — pass as `Authorization: Bearer` to Incorta APIs. */\n  accessToken: string;\n}\n\nexport type AuthHandler = (request: Request) => Promise<Response>;\n\n/** Refresh the access token when it has less than this long left to live. */\nconst ACCESS_TOKEN_REFRESH_LEEWAY_MS = 60 * 1000;\n\nfunction requestOrigin(config: ResolvedConfig, request: Request): string {\n  if (config.appUrl) return config.appUrl;\n  const url = new URL(request.url);\n  const proto =\n    request.headers.get(\"x-forwarded-proto\")?.split(\",\")[0]?.trim() ??\n    url.protocol.replace(\":\", \"\");\n  const host =\n    request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim() ??\n    request.headers.get(\"host\") ??\n    url.host;\n  return `${proto}://${host}`;\n}\n\nfunction isSecureRequest(config: ResolvedConfig, request: Request): boolean {\n  if (config.secureCookies !== \"auto\") return config.secureCookies;\n  return requestOrigin(config, request).startsWith(\"https://\");\n}\n\n/**\n * Only same-origin destinations are allowed after login/logout — anything else\n * would let a crafted link bounce users through this app to an attacker page.\n */\nfunction validateReturnTo(raw: string | null, origin: string): string {\n  if (!raw) return \"/\";\n  if (raw.startsWith(\"/\") && !raw.startsWith(\"//\")) return raw;\n  try {\n    const url = new URL(raw);\n    if (url.origin === origin) return `${url.pathname}${url.search}${url.hash}` || \"/\";\n  } catch {\n    // Not a URL — fall through.\n  }\n  return \"/\";\n}\n\nfunction json(status: number, body: unknown, cookies: string[] = []): Response {\n  const headers = new Headers({\n    \"content-type\": \"application/json; charset=utf-8\",\n    \"cache-control\": \"no-store\",\n  });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(JSON.stringify(body), { status, headers });\n}\n\nfunction redirect(location: string, cookies: string[] = []): Response {\n  const headers = new Headers({ location, \"cache-control\": \"no-store\" });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(null, { status: 302, headers });\n}\n\nfunction withErrorParam(target: string, code: string): string {\n  const separator = target.includes(\"?\") ? \"&\" : \"?\";\n  return `${target}${separator}incorta_auth_error=${encodeURIComponent(code)}`;\n}\n\nfunction randomToken(): string {\n  return randomBytes(16).toString(\"base64url\");\n}\n\nexport function createHandler(config: ResolvedConfig): {\n  handler: AuthHandler;\n  getSession: (request: Request) => Promise<AuthSession | null>;\n} {\n  const sessionCookieOptions = (secure: boolean) => ({\n    httpOnly: true,\n    secure,\n    sameSite: \"lax\" as const,\n    path: \"/\",\n  });\n\n  async function login(request: Request, url: URL): Promise<Response> {\n    const origin = requestOrigin(config, request);\n    const secure = isSecureRequest(config, request);\n    const returnTo = validateReturnTo(url.searchParams.get(\"redirect_to\"), origin);\n\n    // Already signed in — skip the OAuth round trip entirely.\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const existing = await unsealSession(config, cookies[config.cookieName]);\n    if (existing) return redirect(returnTo);\n\n    const state = randomToken();\n    const nonce = randomToken();\n    const stateCookie = serializeCookie(\n      config.stateCookieName,\n      await sealLoginState(config, { state, nonce, returnTo }),\n      { ...sessionCookieOptions(secure), maxAge: 600 },\n    );\n\n    const { authorizationEndpoint } = await getEndpoints(config);\n    const authorizeUrl = new URL(authorizationEndpoint);\n    authorizeUrl.searchParams.set(\"response_type\", \"code\");\n    authorizeUrl.searchParams.set(\"client_id\", config.clientId);\n    authorizeUrl.searchParams.set(\"redirect_uri\", `${origin}${config.basePath}/callback`);\n    authorizeUrl.searchParams.set(\"scope\", config.scope);\n    authorizeUrl.searchParams.set(\"state\", state);\n    authorizeUrl.searchParams.set(\"nonce\", nonce);\n\n    return redirect(authorizeUrl.toString(), [stateCookie]);\n  }\n\n  async function callback(request: Request, url: URL): Promise<Response> {\n    const origin = requestOrigin(config, request);\n    const secure = isSecureRequest(config, request);\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const clearState = deleteCookie(config.stateCookieName, sessionCookieOptions(secure));\n\n    const loginState = await unsealLoginState(config, cookies[config.stateCookieName]);\n    const returnTo = validateReturnTo(loginState?.returnTo ?? null, origin);\n\n    const fail = (code: string) => redirect(withErrorParam(returnTo, code), [clearState]);\n\n    const oauthError = url.searchParams.get(\"error\");\n    if (oauthError) return fail(oauthError);\n\n    const code = url.searchParams.get(\"code\");\n    const state = url.searchParams.get(\"state\");\n    if (!code || !state) return fail(\"missing_code\");\n    if (!loginState) return fail(\"state_missing\");\n    if (state !== loginState.state) return fail(\"state_mismatch\");\n\n    try {\n      const tokens = await exchangeCode(config, code, `${origin}${config.basePath}/callback`);\n      const user = tokens.idToken\n        ? await verifyIdToken(config, tokens.idToken, loginState.nonce)\n        : await userFromAccessToken(config, tokens.accessToken);\n\n      const session: SessionData = {\n        user,\n        accessToken: tokens.accessToken,\n        accessTokenExpiresAt: tokens.accessTokenExpiresAt,\n        refreshToken: tokens.refreshToken,\n        createdAt: Date.now(),\n      };\n      const sessionCookie = serializeCookie(\n        config.cookieName,\n        await sealSession(config, session),\n        { ...sessionCookieOptions(secure), maxAge: config.sessionMaxAge },\n      );\n      return redirect(returnTo, [sessionCookie, clearState]);\n    } catch (error) {\n      const code = error instanceof IncortaAuthError ? error.code : \"callback_failed\";\n      return fail(code);\n    }\n  }\n\n  /**\n   * Loads the session from the request cookie; refreshes the Incorta access\n   * token (rotating the refresh token) when it is about to expire, and renews\n   * the sliding session cookie past its half-life. Returns the cookies to set.\n   */\n  async function loadSession(request: Request): Promise<{\n    session: SessionData | null;\n    sessionExpiresAt: number;\n    setCookies: string[];\n  }> {\n    const secure = isSecureRequest(config, request);\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const unsealed = await unsealSession(config, cookies[config.cookieName]);\n    if (!unsealed) return { session: null, sessionExpiresAt: 0, setCookies: [] };\n\n    let { session } = unsealed;\n    let mustReseal = false;\n    const now = Date.now();\n\n    if (session.accessTokenExpiresAt - now < ACCESS_TOKEN_REFRESH_LEEWAY_MS) {\n      if (session.refreshToken) {\n        try {\n          const tokens = await refreshTokens(config, session.refreshToken);\n          session = {\n            ...session,\n            accessToken: tokens.accessToken,\n            accessTokenExpiresAt: tokens.accessTokenExpiresAt,\n            refreshToken: tokens.refreshToken ?? session.refreshToken,\n          };\n          mustReseal = true;\n        } catch {\n          // Refresh failed (expired/rotated elsewhere). Keep the session while\n          // the current access token is still usable; otherwise sign out.\n          if (session.accessTokenExpiresAt <= now) {\n            return {\n              session: null,\n              sessionExpiresAt: 0,\n              setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))],\n            };\n          }\n        }\n      } else if (session.accessTokenExpiresAt <= now) {\n        return {\n          session: null,\n          sessionExpiresAt: 0,\n          setCookies: [deleteCookie(config.cookieName, sessionCookieOptions(secure))],\n        };\n      }\n    }\n\n    const halfLifeMs = (config.sessionMaxAge * 1000) / 2;\n    if (now - unsealed.issuedAt > halfLifeMs) mustReseal = true;\n\n    if (!mustReseal) {\n      return { session, sessionExpiresAt: unsealed.expiresAt, setCookies: [] };\n    }\n    const resealed = serializeCookie(config.cookieName, await sealSession(config, session), {\n      ...sessionCookieOptions(secure),\n      maxAge: config.sessionMaxAge,\n    });\n    return {\n      session,\n      sessionExpiresAt: now + config.sessionMaxAge * 1000,\n      setCookies: [resealed],\n    };\n  }\n\n  async function sessionRoute(request: Request): Promise<Response> {\n    const { session, sessionExpiresAt, setCookies } = await loadSession(request);\n    if (!session) return json(200, { user: null }, setCookies);\n    return json(\n      200,\n      {\n        user: session.user,\n        session: {\n          expiresAt: sessionExpiresAt,\n          accessTokenExpiresAt: session.accessTokenExpiresAt,\n        },\n      },\n      setCookies,\n    );\n  }\n\n  async function tokenRoute(request: Request): Promise<Response> {\n    if (!config.exposeAccessToken) return json(404, { error: \"not_found\" });\n    const { session, setCookies } = await loadSession(request);\n    if (!session) return json(401, { error: \"unauthenticated\" }, setCookies);\n    return json(\n      200,\n      { accessToken: session.accessToken, expiresAt: session.accessTokenExpiresAt },\n      setCookies,\n    );\n  }\n\n  async function logout(request: Request, url: URL): Promise<Response> {\n    const secure = isSecureRequest(config, request);\n    const clearSession = deleteCookie(config.cookieName, sessionCookieOptions(secure));\n    if (request.method === \"GET\") {\n      const origin = requestOrigin(config, request);\n      const returnTo = validateReturnTo(url.searchParams.get(\"redirect_to\"), origin);\n      return redirect(returnTo, [clearSession]);\n    }\n    return json(200, { ok: true }, [clearSession]);\n  }\n\n  async function handler(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    if (url.pathname !== config.basePath && !url.pathname.startsWith(`${config.basePath}/`)) {\n      return json(404, { error: \"not_found\" });\n    }\n    const route = url.pathname.slice(config.basePath.length) || \"/\";\n    const method = request.method.toUpperCase();\n\n    try {\n      if (route === \"/login\" && method === \"GET\") return await login(request, url);\n      if (route === \"/callback\" && method === \"GET\") return await callback(request, url);\n      if (route === \"/session\" && method === \"GET\") return await sessionRoute(request);\n      if (route === \"/token\" && method === \"GET\") return await tokenRoute(request);\n      if (route === \"/logout\" && (method === \"POST\" || method === \"GET\")) {\n        return await logout(request, url);\n      }\n      return json(404, { error: \"not_found\" });\n    } catch (error) {\n      const code = error instanceof IncortaAuthError ? error.code : \"internal_error\";\n      const message =\n        error instanceof Error ? error.message : \"Unexpected incorta-auth handler error\";\n      console.error(`[incorta-auth] ${route} failed:`, message);\n      return json(500, { error: code });\n    }\n  }\n\n  async function getSession(request: Request): Promise<AuthSession | null> {\n    const cookies = parseCookies(request.headers.get(\"cookie\"));\n    const unsealed = await unsealSession(config, cookies[config.cookieName]);\n    if (!unsealed) return null;\n    const { session, expiresAt } = unsealed;\n    if (session.accessTokenExpiresAt <= Date.now() && !session.refreshToken) return null;\n    return {\n      user: session.user,\n      accessToken: session.accessToken,\n      accessTokenExpiresAt: session.accessTokenExpiresAt,\n      expiresAt,\n    };\n  }\n\n  return { handler, getSession };\n}\n","export interface CookieOptions {\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: \"lax\" | \"strict\" | \"none\";\n  path?: string;\n  /** Seconds. 0 deletes the cookie. */\n  maxAge?: number;\n}\n\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const name = part.slice(0, eq).trim();\n    if (!name) continue;\n    let value = part.slice(eq + 1).trim();\n    if (value.startsWith('\"') && value.endsWith('\"')) value = value.slice(1, -1);\n    try {\n      out[name] = decodeURIComponent(value);\n    } catch {\n      out[name] = value;\n    }\n  }\n  return out;\n}\n\nexport function serializeCookie(\n  name: string,\n  value: string,\n  options: CookieOptions = {},\n): string {\n  const parts = [`${name}=${encodeURIComponent(value)}`];\n  parts.push(`Path=${options.path ?? \"/\"}`);\n  if (options.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.floor(options.maxAge)}`);\n    // Expires for compatibility with clients that ignore Max-Age.\n    parts.push(`Expires=${new Date(Date.now() + options.maxAge * 1000).toUTCString()}`);\n  }\n  if (options.httpOnly ?? true) parts.push(\"HttpOnly\");\n  if (options.secure) parts.push(\"Secure\");\n  const sameSite = options.sameSite ?? \"lax\";\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  return parts.join(\"; \");\n}\n\nexport function deleteCookie(name: string, options: CookieOptions = {}): string {\n  return serializeCookie(name, \"\", { ...options, maxAge: 0 });\n}\n","import { createRemoteJWKSet } from \"jose\";\nimport type { JWTVerifyGetKey } from \"jose\";\nimport type { ResolvedConfig } from \"./config.js\";\n\ninterface DiscoveryDocument {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  jwks_uri: string;\n}\n\nexport interface Endpoints {\n  issuer: string;\n  authorizationEndpoint: string;\n  tokenEndpoint: string;\n  jwks: JWTVerifyGetKey;\n}\n\nconst endpointsCache = new Map<string, Promise<Endpoints>>();\n\n/**\n * Resolves the tenant's OAuth endpoints, preferring the OIDC discovery document\n * and falling back to Incorta's fixed `/oauth/{tenant}/...` layout when the\n * document is unreachable. Cached per issuer for the process lifetime.\n */\nexport function getEndpoints(config: ResolvedConfig): Promise<Endpoints> {\n  const cached = endpointsCache.get(config.issuer);\n  if (cached) return cached;\n\n  const promise = resolve(config).catch((error) => {\n    // Do not cache failures — a temporarily unreachable Incorta should not\n    // poison the process.\n    endpointsCache.delete(config.issuer);\n    throw error;\n  });\n  endpointsCache.set(config.issuer, promise);\n  return promise;\n}\n\nasync function resolve(config: ResolvedConfig): Promise<Endpoints> {\n  const fallback: DiscoveryDocument = {\n    issuer: config.issuer,\n    authorization_endpoint: `${config.issuer}/authorize`,\n    token_endpoint: `${config.issuer}/token`,\n    jwks_uri: `${config.issuer}/.well-known/jwks.json`,\n  };\n\n  let doc = fallback;\n  try {\n    const response = await config.fetch(config.discoveryUrl, {\n      headers: { accept: \"application/json\" },\n    });\n    if (response.ok) {\n      const body = (await response.json()) as Partial<DiscoveryDocument>;\n      doc = {\n        issuer: body.issuer ?? fallback.issuer,\n        authorization_endpoint: body.authorization_endpoint ?? fallback.authorization_endpoint,\n        token_endpoint: body.token_endpoint ?? fallback.token_endpoint,\n        jwks_uri: body.jwks_uri ?? fallback.jwks_uri,\n      };\n    }\n  } catch {\n    // Fall through to the fixed layout.\n  }\n\n  const jwks =\n    config.jwksOverride ??\n    createRemoteJWKSet(new URL(doc.jwks_uri), {\n      cacheMaxAge: 10 * 60 * 1000,\n      cooldownDuration: 30 * 1000,\n    });\n\n  return {\n    issuer: doc.issuer,\n    authorizationEndpoint: doc.authorization_endpoint,\n    tokenEndpoint: doc.token_endpoint,\n    jwks,\n  };\n}\n\n/** Test hook: clears the per-process endpoint cache. */\nexport function clearEndpointsCache(): void {\n  endpointsCache.clear();\n}\n","import { createHash } from \"node:crypto\";\nimport { EncryptJWT, jwtDecrypt } from \"jose\";\nimport type { ResolvedConfig, SessionData } from \"./config.js\";\n\n/**\n * Session and state cookies are sealed as encrypted JWTs (JWE, dir + A256GCM):\n * tamper-proof AND opaque, since the session carries the Incorta access/refresh\n * tokens. The 256-bit key is derived from the configured secret.\n */\nfunction sealKey(config: ResolvedConfig): Uint8Array {\n  return new Uint8Array(\n    createHash(\"sha256\").update(`incorta-auth:${config.secret}`).digest(),\n  );\n}\n\ninterface SealedPayload {\n  /** Guards against replaying one cookie kind as the other. */\n  purpose: \"session\" | \"state\";\n  data: unknown;\n}\n\nasync function seal(\n  config: ResolvedConfig,\n  purpose: SealedPayload[\"purpose\"],\n  data: unknown,\n  maxAgeSeconds: number,\n): Promise<string> {\n  return new EncryptJWT({ purpose, data })\n    .setProtectedHeader({ alg: \"dir\", enc: \"A256GCM\" })\n    .setIssuedAt()\n    .setExpirationTime(`${maxAgeSeconds}s`)\n    .encrypt(sealKey(config));\n}\n\nasync function unseal<T>(\n  config: ResolvedConfig,\n  purpose: SealedPayload[\"purpose\"],\n  cookieValue: string | undefined,\n): Promise<{ data: T; issuedAt: number; expiresAt: number } | null> {\n  if (!cookieValue) return null;\n  try {\n    const { payload } = await jwtDecrypt(cookieValue, sealKey(config));\n    if (payload.purpose !== purpose) return null;\n    return {\n      data: payload.data as T,\n      issuedAt: (payload.iat ?? 0) * 1000,\n      expiresAt: (payload.exp ?? 0) * 1000,\n    };\n  } catch {\n    // Expired, tampered, or sealed with a different secret — treat as absent.\n    return null;\n  }\n}\n\nexport function sealSession(config: ResolvedConfig, session: SessionData): Promise<string> {\n  return seal(config, \"session\", session, config.sessionMaxAge);\n}\n\nexport async function unsealSession(\n  config: ResolvedConfig,\n  cookieValue: string | undefined,\n): Promise<{ session: SessionData; issuedAt: number; expiresAt: number } | null> {\n  const result = await unseal<SessionData>(config, \"session\", cookieValue);\n  if (!result) return null;\n  const { data, issuedAt, expiresAt } = result;\n  if (!data || typeof data !== \"object\" || !data.user || !data.accessToken) return null;\n  return { session: data, issuedAt, expiresAt };\n}\n\n/** Login round-trip state (CSRF protection + post-login destination). */\nexport interface LoginState {\n  state: string;\n  nonce: string;\n  returnTo: string;\n}\n\nconst STATE_MAX_AGE_SECONDS = 10 * 60;\n\nexport function sealLoginState(config: ResolvedConfig, state: LoginState): Promise<string> {\n  return seal(config, \"state\", state, STATE_MAX_AGE_SECONDS);\n}\n\nexport async function unsealLoginState(\n  config: ResolvedConfig,\n  cookieValue: string | undefined,\n): Promise<LoginState | null> {\n  const result = await unseal<LoginState>(config, \"state\", cookieValue);\n  if (!result) return null;\n  const { data } = result;\n  if (!data || typeof data.state !== \"string\" || typeof data.nonce !== \"string\") return null;\n  return data;\n}\n","import { decodeJwt, jwtVerify } from \"jose\";\nimport type { JWTPayload } from \"jose\";\nimport type { IncortaUser, ResolvedConfig } from \"./config.js\";\nimport { getEndpoints } from \"./discovery.js\";\n\nexport interface TokenSet {\n  accessToken: string;\n  /** Epoch millis derived from the access token's `exp` claim. */\n  accessTokenExpiresAt: number;\n  idToken?: string;\n  refreshToken?: string;\n}\n\ninterface TokenEndpointResponse {\n  access_token?: string;\n  id_token?: string;\n  refresh_token?: string;\n  error?: string;\n  error_description?: string;\n}\n\nexport class IncortaAuthError extends Error {\n  constructor(\n    readonly code: string,\n    message: string,\n  ) {\n    super(`[incorta-auth] ${message}`);\n    this.name = \"IncortaAuthError\";\n  }\n}\n\nfunction basicAuth(config: ResolvedConfig): string {\n  const raw = `${config.clientId}:${config.clientSecret}`;\n  return `Basic ${Buffer.from(raw, \"utf8\").toString(\"base64\")}`;\n}\n\nasync function callTokenEndpoint(\n  config: ResolvedConfig,\n  params: Record<string, string>,\n): Promise<TokenSet> {\n  const { tokenEndpoint } = await getEndpoints(config);\n\n  let response: Response;\n  try {\n    response = await config.fetch(tokenEndpoint, {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/x-www-form-urlencoded\",\n        accept: \"application/json\",\n        authorization: basicAuth(config),\n      },\n      body: new URLSearchParams(params).toString(),\n    });\n  } catch (error) {\n    throw new IncortaAuthError(\n      \"incorta_unreachable\",\n      `Could not reach the Incorta token endpoint (${tokenEndpoint}): ${(error as Error).message}`,\n    );\n  }\n\n  let body: TokenEndpointResponse;\n  try {\n    body = (await response.json()) as TokenEndpointResponse;\n  } catch {\n    throw new IncortaAuthError(\n      \"invalid_token_response\",\n      `Token endpoint returned a non-JSON response (HTTP ${response.status}).`,\n    );\n  }\n\n  if (!response.ok || !body.access_token) {\n    throw new IncortaAuthError(\n      body.error ?? \"token_exchange_failed\",\n      body.error_description ?? `Token exchange failed (HTTP ${response.status}).`,\n    );\n  }\n\n  const { exp } = decodeJwt(body.access_token);\n  return {\n    accessToken: body.access_token,\n    accessTokenExpiresAt: exp ? exp * 1000 : Date.now() + 60 * 60 * 1000,\n    idToken: body.id_token,\n    refreshToken: body.refresh_token,\n  };\n}\n\nexport function exchangeCode(\n  config: ResolvedConfig,\n  code: string,\n  redirectUri: string,\n): Promise<TokenSet> {\n  return callTokenEndpoint(config, {\n    grant_type: \"authorization_code\",\n    code,\n    redirect_uri: redirectUri,\n  });\n}\n\nexport function refreshTokens(config: ResolvedConfig, refreshToken: string): Promise<TokenSet> {\n  return callTokenEndpoint(config, {\n    grant_type: \"refresh_token\",\n    refresh_token: refreshToken,\n  });\n}\n\nasync function verifyJwt(config: ResolvedConfig, token: string): Promise<JWTPayload> {\n  const { jwks, issuer } = await getEndpoints(config);\n  try {\n    const { payload } = await jwtVerify(token, jwks, {\n      issuer,\n      audience: config.clientId,\n      algorithms: [\"RS256\"],\n    });\n    return payload;\n  } catch (error) {\n    throw new IncortaAuthError(\n      \"invalid_token\",\n      `Token verification failed: ${(error as Error).message}`,\n    );\n  }\n}\n\nexport async function verifyAccessToken(\n  config: ResolvedConfig,\n  accessToken: string,\n): Promise<JWTPayload> {\n  return verifyJwt(config, accessToken);\n}\n\n/**\n * Verifies the ID token (signature, issuer, audience, nonce) and maps its\n * claims to the SDK's user shape.\n */\nexport async function verifyIdToken(\n  config: ResolvedConfig,\n  idToken: string,\n  expectedNonce: string,\n): Promise<IncortaUser> {\n  const payload = await verifyJwt(config, idToken);\n\n  if (payload.nonce !== expectedNonce) {\n    throw new IncortaAuthError(\"nonce_mismatch\", \"ID token nonce does not match the login request.\");\n  }\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\n    throw new IncortaAuthError(\"invalid_token\", \"ID token is missing the sub claim.\");\n  }\n\n  const roles = Array.isArray(payload.roles)\n    ? payload.roles.filter((role): role is string => typeof role === \"string\")\n    : [];\n\n  return {\n    sub: payload.sub,\n    name: typeof payload.name === \"string\" ? payload.name : undefined,\n    email: typeof payload.email === \"string\" ? payload.email : undefined,\n    roles,\n    tenant: typeof payload.tenant === \"string\" ? payload.tenant : config.tenant,\n  };\n}\n\n/**\n * Fallback identity when the client was registered without the `openid` scope\n * (no ID token in the response): identify the user from the verified access\n * token instead. Name/email/roles are unavailable in that case.\n */\nexport async function userFromAccessToken(\n  config: ResolvedConfig,\n  accessToken: string,\n): Promise<IncortaUser> {\n  const payload = await verifyAccessToken(config, accessToken);\n  if (typeof payload.sub !== \"string\" || !payload.sub) {\n    throw new IncortaAuthError(\"invalid_token\", \"Access token is missing the sub claim.\");\n  }\n  return {\n    sub: payload.sub,\n    roles: [],\n    tenant: typeof payload.tenant === \"string\" ? payload.tenant : config.tenant,\n  };\n}\n","interface ManagementErrorBody {\n  error?: string;\n  error_description?: string;\n}\n\nfunction registrationEndpoint(incortaUrl: string, tenant: string, clientId?: string): string {\n  const base = `${incortaUrl.replace(/\\/+$/, \"\")}/oauth/${tenant}/register`;\n  return clientId ? `${base}/${clientId}` : base;\n}\n\nasync function readJson<T extends ManagementErrorBody>(\n  response: Response,\n  what: string,\n): Promise<T> {\n  let body: T;\n  try {\n    body = (await response.json()) as T;\n  } catch {\n    throw new Error(\n      `[incorta-auth] ${what} returned a non-JSON response (HTTP ${response.status}). ` +\n        \"Is the OAuth authorization server enabled on this cluster?\",\n    );\n  }\n  if (!response.ok) {\n    throw new Error(\n      `[incorta-auth] ${what} failed (HTTP ${response.status}): ` +\n        `${body.error ?? \"unknown_error\"} — ${body.error_description ?? \"no description\"}`,\n    );\n  }\n  return body;\n}\n\nexport interface RegisterClientOptions {\n  /** Incorta base URL, e.g. `http://localhost:8080/incorta`. */\n  incortaUrl: string;\n  /** Tenant to register the client in. */\n  tenant: string;\n  /** Display name of the client. */\n  name: string;\n  /** Allowed OAuth callback URLs, e.g. `http://localhost:4000/auth/callback`. */\n  redirectUris: string[];\n  /** @default \"openid profile email\" */\n  scope?: string;\n  /** @default [\"authorization_code\", \"refresh_token\"] */\n  grantTypes?: string[];\n  fetchImpl?: typeof fetch;\n}\n\nexport interface RegisteredClient {\n  clientId: string;\n  clientSecret: string;\n  /** Bearer token for managing this registration (GET/PUT/DELETE it later). */\n  registrationAccessToken?: string;\n  /** URL to manage this registration. */\n  registrationClientUri?: string;\n}\n\n/**\n * Registers an OAuth client in Incorta via RFC 7591 dynamic client\n * registration (`POST {incortaUrl}/oauth/{tenant}/register`). Incorta allows\n * unauthenticated registration for authorization_code clients; the response\n * carries the generated client_id/client_secret — store them once, e.g. in the\n * app's `.env`.\n */\nexport async function registerClient(\n  options: RegisterClientOptions,\n): Promise<RegisteredClient> {\n  const {\n    incortaUrl,\n    tenant,\n    name,\n    redirectUris,\n    scope = \"openid profile email\",\n    grantTypes = [\"authorization_code\", \"refresh_token\"],\n    fetchImpl = fetch,\n  } = options;\n\n  if (!redirectUris.length) {\n    throw new Error(\"[incorta-auth] registerClient requires at least one redirect URI.\");\n  }\n\n  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant), {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n    body: JSON.stringify({\n      client_name: name,\n      redirect_uris: redirectUris,\n      grant_types: grantTypes,\n      scope,\n      token_endpoint_auth_method: \"client_secret_basic\",\n    }),\n  });\n\n  interface RegistrationResponse extends ManagementErrorBody {\n    client_id?: string;\n    client_secret?: string;\n    registration_access_token?: string;\n    registration_client_uri?: string;\n  }\n\n  const body = await readJson<RegistrationResponse>(response, \"Client registration\");\n  if (!body.client_id || !body.client_secret) {\n    throw new Error(\n      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`,\n    );\n  }\n\n  return {\n    clientId: body.client_id,\n    clientSecret: body.client_secret,\n    registrationAccessToken: body.registration_access_token,\n    registrationClientUri: body.registration_client_uri,\n  };\n}\n\nexport interface ManageClientOptions {\n  /** Incorta base URL, e.g. `http://localhost:8080/incorta`. */\n  incortaUrl: string;\n  tenant: string;\n  clientId: string;\n  /** The registration access token returned when the client was registered. */\n  registrationAccessToken: string;\n  fetchImpl?: typeof fetch;\n}\n\n/** Current metadata of a registered client. */\nexport interface ClientInfo {\n  clientId: string;\n  name?: string;\n  redirectUris: string[];\n  grantTypes: string[];\n  scope?: string;\n}\n\ninterface ClientMetadataResponse extends ManagementErrorBody {\n  client_id?: string;\n  client_name?: string;\n  redirect_uris?: string[];\n  grant_types?: string[];\n  scope?: string;\n}\n\nfunction toClientInfo(body: ClientMetadataResponse, fallbackClientId: string): ClientInfo {\n  return {\n    clientId: body.client_id ?? fallbackClientId,\n    name: body.client_name,\n    redirectUris: body.redirect_uris ?? [],\n    grantTypes: body.grant_types ?? [],\n    scope: body.scope,\n  };\n}\n\n/**\n * Reads a registered client's current metadata (RFC 7592-style management,\n * `GET {incortaUrl}/oauth/{tenant}/register/{clientId}` with the registration\n * access token).\n */\nexport async function getClient(options: ManageClientOptions): Promise<ClientInfo> {\n  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;\n  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {\n    headers: {\n      accept: \"application/json\",\n      authorization: `Bearer ${registrationAccessToken}`,\n    },\n  });\n  const body = await readJson<ClientMetadataResponse>(response, \"Reading the client\");\n  return toClientInfo(body, clientId);\n}\n\nexport interface UpdateRedirectUrisOptions extends ManageClientOptions {\n  redirectUris: string[];\n  /**\n   * `\"add\"` (default) merges the given URIs into the client's current set;\n   * `\"replace\"` makes the given list the exact new set (also how URIs are\n   * removed).\n   */\n  mode?: \"add\" | \"replace\";\n}\n\n/**\n * Updates the allowed OAuth callback URLs of a registered client. Incorta's\n * management endpoint applies `redirect_uris` from the PUT body (other\n * metadata is unchanged server-side).\n */\nexport async function updateClientRedirectUris(\n  options: UpdateRedirectUrisOptions,\n): Promise<ClientInfo> {\n  const {\n    incortaUrl,\n    tenant,\n    clientId,\n    registrationAccessToken,\n    redirectUris,\n    mode = \"add\",\n    fetchImpl = fetch,\n  } = options;\n\n  if (!redirectUris.length) {\n    // An empty replace would leave the client unable to complete the\n    // authorization-code flow at all — delete the registration instead.\n    throw new Error(\"[incorta-auth] updateClientRedirectUris requires at least one redirect URI.\");\n  }\n\n  const current = await getClient(options);\n  const nextUris =\n    mode === \"add\" ? [...new Set([...current.redirectUris, ...redirectUris])] : redirectUris;\n\n  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {\n    method: \"PUT\",\n    headers: {\n      \"content-type\": \"application/json\",\n      accept: \"application/json\",\n      authorization: `Bearer ${registrationAccessToken}`,\n    },\n    // RFC 7592 update: client_id + full metadata. Incorta applies\n    // redirect_uris only, but nimbus-side parsing wants the full shape.\n    body: JSON.stringify({\n      client_id: clientId,\n      redirect_uris: nextUris,\n      grant_types: current.grantTypes,\n      scope: current.scope,\n      client_name: current.name,\n    }),\n  });\n\n  if (!response.ok) {\n    await readJson<ManagementErrorBody>(response, \"Updating the client\"); // throws with details\n  }\n  // The PUT response body is empty on success — re-read for the fresh state.\n  return getClient(options);\n}\n","import { resolveConfig } from \"./core/config.js\";\nimport type { IncortaAuthConfig, ResolvedConfig } from \"./core/config.js\";\nimport { createHandler } from \"./core/handler.js\";\nimport type { AuthHandler, AuthSession } from \"./core/handler.js\";\n\nexport type {\n  IncortaAuthConfig,\n  IncortaUser,\n  SessionData,\n  SessionInfo,\n} from \"./core/config.js\";\nexport type { AuthHandler, AuthSession } from \"./core/handler.js\";\nexport { IncortaAuthError } from \"./core/tokens.js\";\nexport { getClient, registerClient, updateClientRedirectUris } from \"./core/register.js\";\nexport type {\n  ClientInfo,\n  ManageClientOptions,\n  RegisterClientOptions,\n  RegisteredClient,\n  UpdateRedirectUrisOptions,\n} from \"./core/register.js\";\n\nexport interface IncortaAuth {\n  /**\n   * Web-standard request handler serving the auth routes under\n   * `config.basePath` (default `/auth`): `/login`, `/callback`, `/session`,\n   * `/logout` (+ `/token` when `exposeAccessToken` is on).\n   *\n   * Wire it to anything that speaks `Request`/`Response` — a TanStack Start\n   * server route, Bun.serve, or via `@incorta/auth/node` / `@incorta/auth/express`\n   * for Node servers.\n   */\n  handler: AuthHandler;\n  /**\n   * Reads the session from a web-standard `Request` (server-side gating, API\n   * routes, server functions). Returns null when the user is not signed in.\n   */\n  getSession: (request: Request) => Promise<AuthSession | null>;\n  /** The resolved configuration (secrets included — do not log). */\n  config: ResolvedConfig;\n}\n\n/**\n * Creates an IncortaAuth instance: OAuth 2.0 authorization-code flow against\n * Incorta's built-in authorization server. Unauthenticated users are redirected\n * to the Incorta login page and returned to your app once signed in.\n */\nexport function createIncortaAuth(config: IncortaAuthConfig = {}): IncortaAuth {\n  const resolved = resolveConfig(config);\n  const { handler, getSession } = createHandler(resolved);\n  return { handler, getSession, config: resolved };\n}\n"],"mappings":";AAuHA,SAAS,SAAS,OAA2B,MAAc,QAAwB;AACjF,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,2CAA2C,IAAI,iBAAiB,MAAM;AAAA,IACxE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAEO,SAAS,cAAc,QAA2B,CAAC,GAAmB;AAC3E,QAAM,MAAO,WACV,SAAS,OAAO,CAAC;AAEpB,QAAM,aAAa;AAAA,IACjB,SAAS,MAAM,cAAc,IAAI,aAAa,cAAc,aAAa;AAAA,EAC3E;AACA,QAAM,SAAS,SAAS,MAAM,UAAU,IAAI,gBAAgB,UAAU,gBAAgB;AACtF,QAAM,WAAW;AAAA,IACf,MAAM,YAAY,IAAI;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe;AAAA,IACnB,MAAM,gBAAgB,IAAI;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS;AAAA,IACb,MAAM,UAAU,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,EACF;AACA,MAAI,OAAO,SAAS,IAAI;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,YAAY;AACnC,MAAI,CAAC,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,GAAG;AACvD,UAAM,IAAI;AAAA,MACR,0EAA0E,QAAQ;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,UAAU,IAAI;AACnC,QAAM,aAAa,MAAM,SAAS,cAAc;AAChD,QAAM,SAAS,GAAG,UAAU,UAAU,MAAM;AAE5C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,SAAS,mBAAmB,MAAM,IAAI;AAAA,IAC9C,OAAO,MAAM,SAAS;AAAA,IACtB;AAAA,IACA,iBAAiB,GAAG,UAAU;AAAA,IAC9B,eAAe,MAAM,SAAS,UAAU,KAAK,KAAK;AAAA,IAClD,eAAe,MAAM,SAAS,UAAU;AAAA,IACxC,mBAAmB,MAAM,qBAAqB;AAAA,IAC9C;AAAA,IACA,cACE,MAAM,UAAU,gBAAgB,GAAG,MAAM;AAAA,IAC3C,cAAc,MAAM,UAAU;AAAA,IAC9B,OAAO,MAAM,UAAU,SAAS;AAAA,EAClC;AACF;;;AChMA,SAAS,mBAAmB;;;ACSrB,SAAS,aAAa,QAA2D;AACtF,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,UAAM,OAAO,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,QAAI,CAAC,KAAM;AACX,QAAI,QAAQ,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AACpC,QAAI,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,EAAG,SAAQ,MAAM,MAAM,GAAG,EAAE;AAC3E,QAAI;AACF,UAAI,IAAI,IAAI,mBAAmB,KAAK;AAAA,IACtC,QAAQ;AACN,UAAI,IAAI,IAAI;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,gBACd,MACA,OACA,UAAyB,CAAC,GAClB;AACR,QAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC,EAAE;AACrD,QAAM,KAAK,QAAQ,QAAQ,QAAQ,GAAG,EAAE;AACxC,MAAI,QAAQ,WAAW,QAAW;AAChC,UAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,CAAC,EAAE;AAElD,UAAM,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,SAAS,GAAI,EAAE,YAAY,CAAC,EAAE;AAAA,EACpF;AACA,MAAI,QAAQ,YAAY,KAAM,OAAM,KAAK,UAAU;AACnD,MAAI,QAAQ,OAAQ,OAAM,KAAK,QAAQ;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,KAAK,YAAY,SAAS,OAAO,CAAC,EAAE,YAAY,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE;AAC7E,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,aAAa,MAAc,UAAyB,CAAC,GAAW;AAC9E,SAAO,gBAAgB,MAAM,IAAI,EAAE,GAAG,SAAS,QAAQ,EAAE,CAAC;AAC5D;;;ACjDA,SAAS,0BAA0B;AAkBnC,IAAM,iBAAiB,oBAAI,IAAgC;AAOpD,SAAS,aAAa,QAA4C;AACvE,QAAM,SAAS,eAAe,IAAI,OAAO,MAAM;AAC/C,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,QAAQ,MAAM,EAAE,MAAM,CAAC,UAAU;AAG/C,mBAAe,OAAO,OAAO,MAAM;AACnC,UAAM;AAAA,EACR,CAAC;AACD,iBAAe,IAAI,OAAO,QAAQ,OAAO;AACzC,SAAO;AACT;AAEA,eAAe,QAAQ,QAA4C;AACjE,QAAM,WAA8B;AAAA,IAClC,QAAQ,OAAO;AAAA,IACf,wBAAwB,GAAG,OAAO,MAAM;AAAA,IACxC,gBAAgB,GAAG,OAAO,MAAM;AAAA,IAChC,UAAU,GAAG,OAAO,MAAM;AAAA,EAC5B;AAEA,MAAI,MAAM;AACV,MAAI;AACF,UAAM,WAAW,MAAM,OAAO,MAAM,OAAO,cAAc;AAAA,MACvD,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACxC,CAAC;AACD,QAAI,SAAS,IAAI;AACf,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,YAAM;AAAA,QACJ,QAAQ,KAAK,UAAU,SAAS;AAAA,QAChC,wBAAwB,KAAK,0BAA0B,SAAS;AAAA,QAChE,gBAAgB,KAAK,kBAAkB,SAAS;AAAA,QAChD,UAAU,KAAK,YAAY,SAAS;AAAA,MACtC;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,OACJ,OAAO,gBACP,mBAAmB,IAAI,IAAI,IAAI,QAAQ,GAAG;AAAA,IACxC,aAAa,KAAK,KAAK;AAAA,IACvB,kBAAkB,KAAK;AAAA,EACzB,CAAC;AAEH,SAAO;AAAA,IACL,QAAQ,IAAI;AAAA,IACZ,uBAAuB,IAAI;AAAA,IAC3B,eAAe,IAAI;AAAA,IACnB;AAAA,EACF;AACF;;;AC9EA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,kBAAkB;AAQvC,SAAS,QAAQ,QAAoC;AACnD,SAAO,IAAI;AAAA,IACT,WAAW,QAAQ,EAAE,OAAO,gBAAgB,OAAO,MAAM,EAAE,EAAE,OAAO;AAAA,EACtE;AACF;AAQA,eAAe,KACb,QACA,SACA,MACA,eACiB;AACjB,SAAO,IAAI,WAAW,EAAE,SAAS,KAAK,CAAC,EACpC,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,GAAG,aAAa,GAAG,EACrC,QAAQ,QAAQ,MAAM,CAAC;AAC5B;AAEA,eAAe,OACb,QACA,SACA,aACkE;AAClE,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,WAAW,aAAa,QAAQ,MAAM,CAAC;AACjE,QAAI,QAAQ,YAAY,QAAS,QAAO;AACxC,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,WAAW,QAAQ,OAAO,KAAK;AAAA,MAC/B,YAAY,QAAQ,OAAO,KAAK;AAAA,IAClC;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,YAAY,QAAwB,SAAuC;AACzF,SAAO,KAAK,QAAQ,WAAW,SAAS,OAAO,aAAa;AAC9D;AAEA,eAAsB,cACpB,QACA,aAC+E;AAC/E,QAAM,SAAS,MAAM,OAAoB,QAAQ,WAAW,WAAW;AACvE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,MAAM,UAAU,UAAU,IAAI;AACtC,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,KAAK,QAAQ,CAAC,KAAK,YAAa,QAAO;AACjF,SAAO,EAAE,SAAS,MAAM,UAAU,UAAU;AAC9C;AASA,IAAM,wBAAwB,KAAK;AAE5B,SAAS,eAAe,QAAwB,OAAoC;AACzF,SAAO,KAAK,QAAQ,SAAS,OAAO,qBAAqB;AAC3D;AAEA,eAAsB,iBACpB,QACA,aAC4B;AAC5B,QAAM,SAAS,MAAM,OAAmB,QAAQ,SAAS,WAAW;AACpE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,KAAK,IAAI;AACjB,MAAI,CAAC,QAAQ,OAAO,KAAK,UAAU,YAAY,OAAO,KAAK,UAAU,SAAU,QAAO;AACtF,SAAO;AACT;;;AC3FA,SAAS,WAAW,iBAAiB;AAqB9B,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACW,MACT,SACA;AACA,UAAM,kBAAkB,OAAO,EAAE;AAHxB;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAEA,SAAS,UAAU,QAAgC;AACjD,QAAM,MAAM,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY;AACrD,SAAO,SAAS,OAAO,KAAK,KAAK,MAAM,EAAE,SAAS,QAAQ,CAAC;AAC7D;AAEA,eAAe,kBACb,QACA,QACmB;AACnB,QAAM,EAAE,cAAc,IAAI,MAAM,aAAa,MAAM;AAEnD,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,OAAO,MAAM,eAAe;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,eAAe,UAAU,MAAM;AAAA,MACjC;AAAA,MACA,MAAM,IAAI,gBAAgB,MAAM,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,+CAA+C,aAAa,MAAO,MAAgB,OAAO;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA,qDAAqD,SAAS,MAAM;AAAA,IACtE;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,MAAM,CAAC,KAAK,cAAc;AACtC,UAAM,IAAI;AAAA,MACR,KAAK,SAAS;AAAA,MACd,KAAK,qBAAqB,+BAA+B,SAAS,MAAM;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,EAAE,IAAI,IAAI,UAAU,KAAK,YAAY;AAC3C,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,IAClB,sBAAsB,MAAM,MAAM,MAAO,KAAK,IAAI,IAAI,KAAK,KAAK;AAAA,IAChE,SAAS,KAAK;AAAA,IACd,cAAc,KAAK;AAAA,EACrB;AACF;AAEO,SAAS,aACd,QACA,MACA,aACmB;AACnB,SAAO,kBAAkB,QAAQ;AAAA,IAC/B,YAAY;AAAA,IACZ;AAAA,IACA,cAAc;AAAA,EAChB,CAAC;AACH;AAEO,SAAS,cAAc,QAAwB,cAAyC;AAC7F,SAAO,kBAAkB,QAAQ;AAAA,IAC/B,YAAY;AAAA,IACZ,eAAe;AAAA,EACjB,CAAC;AACH;AAEA,eAAe,UAAU,QAAwB,OAAoC;AACnF,QAAM,EAAE,MAAM,OAAO,IAAI,MAAM,aAAa,MAAM;AAClD,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC/C;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA+B,MAAgB,OAAO;AAAA,IACxD;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,QACA,aACqB;AACrB,SAAO,UAAU,QAAQ,WAAW;AACtC;AAMA,eAAsB,cACpB,QACA,SACA,eACsB;AACtB,QAAM,UAAU,MAAM,UAAU,QAAQ,OAAO;AAE/C,MAAI,QAAQ,UAAU,eAAe;AACnC,UAAM,IAAI,iBAAiB,kBAAkB,kDAAkD;AAAA,EACjG;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,iBAAiB,iBAAiB,oCAAoC;AAAA,EAClF;AAEA,QAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IACrC,QAAQ,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,IACvE,CAAC;AAEL,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,IAC3D;AAAA,IACA,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAOA,eAAsB,oBACpB,QACA,aACsB;AACtB,QAAM,UAAU,MAAM,kBAAkB,QAAQ,WAAW;AAC3D,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,iBAAiB,iBAAiB,wCAAwC;AAAA,EACtF;AACA,SAAO;AAAA,IACL,KAAK,QAAQ;AAAA,IACb,OAAO,CAAC;AAAA,IACR,QAAQ,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;;;AJvJA,IAAM,iCAAiC,KAAK;AAE5C,SAAS,cAAc,QAAwB,SAA0B;AACvE,MAAI,OAAO,OAAQ,QAAO,OAAO;AACjC,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,QACJ,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC9D,IAAI,SAAS,QAAQ,KAAK,EAAE;AAC9B,QAAM,OACJ,QAAQ,QAAQ,IAAI,kBAAkB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC7D,QAAQ,QAAQ,IAAI,MAAM,KAC1B,IAAI;AACN,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAEA,SAAS,gBAAgB,QAAwB,SAA2B;AAC1E,MAAI,OAAO,kBAAkB,OAAQ,QAAO,OAAO;AACnD,SAAO,cAAc,QAAQ,OAAO,EAAE,WAAW,UAAU;AAC7D;AAMA,SAAS,iBAAiB,KAAoB,QAAwB;AACpE,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAI,IAAI,WAAW,OAAQ,QAAO,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI,MAAM;AAAA,EACjF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,KAAK,QAAgB,MAAe,UAAoB,CAAC,GAAa;AAC7E,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,EACnB,CAAC;AACD,aAAW,UAAU,QAAS,SAAQ,OAAO,cAAc,MAAM;AACjE,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,QAAQ,CAAC;AAC/D;AAEA,SAAS,SAAS,UAAkB,UAAoB,CAAC,GAAa;AACpE,QAAM,UAAU,IAAI,QAAQ,EAAE,UAAU,iBAAiB,WAAW,CAAC;AACrE,aAAW,UAAU,QAAS,SAAQ,OAAO,cAAc,MAAM;AACjE,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAEA,SAAS,eAAe,QAAgB,MAAsB;AAC5D,QAAM,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM;AAC/C,SAAO,GAAG,MAAM,GAAG,SAAS,sBAAsB,mBAAmB,IAAI,CAAC;AAC5E;AAEA,SAAS,cAAsB;AAC7B,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAEO,SAAS,cAAc,QAG5B;AACA,QAAM,uBAAuB,CAAC,YAAqB;AAAA,IACjD,UAAU;AAAA,IACV;AAAA,IACA,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AAEA,iBAAe,MAAM,SAAkB,KAA6B;AAClE,UAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,WAAW,iBAAiB,IAAI,aAAa,IAAI,aAAa,GAAG,MAAM;AAG7E,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,SAAU,QAAO,SAAS,QAAQ;AAEtC,UAAM,QAAQ,YAAY;AAC1B,UAAM,QAAQ,YAAY;AAC1B,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,MACP,MAAM,eAAe,QAAQ,EAAE,OAAO,OAAO,SAAS,CAAC;AAAA,MACvD,EAAE,GAAG,qBAAqB,MAAM,GAAG,QAAQ,IAAI;AAAA,IACjD;AAEA,UAAM,EAAE,sBAAsB,IAAI,MAAM,aAAa,MAAM;AAC3D,UAAM,eAAe,IAAI,IAAI,qBAAqB;AAClD,iBAAa,aAAa,IAAI,iBAAiB,MAAM;AACrD,iBAAa,aAAa,IAAI,aAAa,OAAO,QAAQ;AAC1D,iBAAa,aAAa,IAAI,gBAAgB,GAAG,MAAM,GAAG,OAAO,QAAQ,WAAW;AACpF,iBAAa,aAAa,IAAI,SAAS,OAAO,KAAK;AACnD,iBAAa,aAAa,IAAI,SAAS,KAAK;AAC5C,iBAAa,aAAa,IAAI,SAAS,KAAK;AAE5C,WAAO,SAAS,aAAa,SAAS,GAAG,CAAC,WAAW,CAAC;AAAA,EACxD;AAEA,iBAAe,SAAS,SAAkB,KAA6B;AACrE,UAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,aAAa,aAAa,OAAO,iBAAiB,qBAAqB,MAAM,CAAC;AAEpF,UAAM,aAAa,MAAM,iBAAiB,QAAQ,QAAQ,OAAO,eAAe,CAAC;AACjF,UAAM,WAAW,iBAAiB,YAAY,YAAY,MAAM,MAAM;AAEtE,UAAM,OAAO,CAACA,UAAiB,SAAS,eAAe,UAAUA,KAAI,GAAG,CAAC,UAAU,CAAC;AAEpF,UAAM,aAAa,IAAI,aAAa,IAAI,OAAO;AAC/C,QAAI,WAAY,QAAO,KAAK,UAAU;AAEtC,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,QAAI,CAAC,QAAQ,CAAC,MAAO,QAAO,KAAK,cAAc;AAC/C,QAAI,CAAC,WAAY,QAAO,KAAK,eAAe;AAC5C,QAAI,UAAU,WAAW,MAAO,QAAO,KAAK,gBAAgB;AAE5D,QAAI;AACF,YAAM,SAAS,MAAM,aAAa,QAAQ,MAAM,GAAG,MAAM,GAAG,OAAO,QAAQ,WAAW;AACtF,YAAM,OAAO,OAAO,UAChB,MAAM,cAAc,QAAQ,OAAO,SAAS,WAAW,KAAK,IAC5D,MAAM,oBAAoB,QAAQ,OAAO,WAAW;AAExD,YAAM,UAAuB;AAAA,QAC3B;AAAA,QACA,aAAa,OAAO;AAAA,QACpB,sBAAsB,OAAO;AAAA,QAC7B,cAAc,OAAO;AAAA,QACrB,WAAW,KAAK,IAAI;AAAA,MACtB;AACA,YAAM,gBAAgB;AAAA,QACpB,OAAO;AAAA,QACP,MAAM,YAAY,QAAQ,OAAO;AAAA,QACjC,EAAE,GAAG,qBAAqB,MAAM,GAAG,QAAQ,OAAO,cAAc;AAAA,MAClE;AACA,aAAO,SAAS,UAAU,CAAC,eAAe,UAAU,CAAC;AAAA,IACvD,SAAS,OAAO;AACd,YAAMA,QAAO,iBAAiB,mBAAmB,MAAM,OAAO;AAC9D,aAAO,KAAKA,KAAI;AAAA,IAClB;AAAA,EACF;AAOA,iBAAe,YAAY,SAIxB;AACD,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,CAAC,SAAU,QAAO,EAAE,SAAS,MAAM,kBAAkB,GAAG,YAAY,CAAC,EAAE;AAE3E,QAAI,EAAE,QAAQ,IAAI;AAClB,QAAI,aAAa;AACjB,UAAM,MAAM,KAAK,IAAI;AAErB,QAAI,QAAQ,uBAAuB,MAAM,gCAAgC;AACvE,UAAI,QAAQ,cAAc;AACxB,YAAI;AACF,gBAAM,SAAS,MAAM,cAAc,QAAQ,QAAQ,YAAY;AAC/D,oBAAU;AAAA,YACR,GAAG;AAAA,YACH,aAAa,OAAO;AAAA,YACpB,sBAAsB,OAAO;AAAA,YAC7B,cAAc,OAAO,gBAAgB,QAAQ;AAAA,UAC/C;AACA,uBAAa;AAAA,QACf,QAAQ;AAGN,cAAI,QAAQ,wBAAwB,KAAK;AACvC,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,kBAAkB;AAAA,cAClB,YAAY,CAAC,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC,CAAC;AAAA,YAC5E;AAAA,UACF;AAAA,QACF;AAAA,MACF,WAAW,QAAQ,wBAAwB,KAAK;AAC9C,eAAO;AAAA,UACL,SAAS;AAAA,UACT,kBAAkB;AAAA,UAClB,YAAY,CAAC,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC,CAAC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAc,OAAO,gBAAgB,MAAQ;AACnD,QAAI,MAAM,SAAS,WAAW,WAAY,cAAa;AAEvD,QAAI,CAAC,YAAY;AACf,aAAO,EAAE,SAAS,kBAAkB,SAAS,WAAW,YAAY,CAAC,EAAE;AAAA,IACzE;AACA,UAAM,WAAW,gBAAgB,OAAO,YAAY,MAAM,YAAY,QAAQ,OAAO,GAAG;AAAA,MACtF,GAAG,qBAAqB,MAAM;AAAA,MAC9B,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,WAAO;AAAA,MACL;AAAA,MACA,kBAAkB,MAAM,OAAO,gBAAgB;AAAA,MAC/C,YAAY,CAAC,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,iBAAe,aAAa,SAAqC;AAC/D,UAAM,EAAE,SAAS,kBAAkB,WAAW,IAAI,MAAM,YAAY,OAAO;AAC3E,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,EAAE,MAAM,KAAK,GAAG,UAAU;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM,QAAQ;AAAA,QACd,SAAS;AAAA,UACP,WAAW;AAAA,UACX,sBAAsB,QAAQ;AAAA,QAChC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,WAAW,SAAqC;AAC7D,QAAI,CAAC,OAAO,kBAAmB,QAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AACtE,UAAM,EAAE,SAAS,WAAW,IAAI,MAAM,YAAY,OAAO;AACzD,QAAI,CAAC,QAAS,QAAO,KAAK,KAAK,EAAE,OAAO,kBAAkB,GAAG,UAAU;AACvE,WAAO;AAAA,MACL;AAAA,MACA,EAAE,aAAa,QAAQ,aAAa,WAAW,QAAQ,qBAAqB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OAAO,SAAkB,KAA6B;AACnE,UAAM,SAAS,gBAAgB,QAAQ,OAAO;AAC9C,UAAM,eAAe,aAAa,OAAO,YAAY,qBAAqB,MAAM,CAAC;AACjF,QAAI,QAAQ,WAAW,OAAO;AAC5B,YAAM,SAAS,cAAc,QAAQ,OAAO;AAC5C,YAAM,WAAW,iBAAiB,IAAI,aAAa,IAAI,aAAa,GAAG,MAAM;AAC7E,aAAO,SAAS,UAAU,CAAC,YAAY,CAAC;AAAA,IAC1C;AACA,WAAO,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,CAAC,YAAY,CAAC;AAAA,EAC/C;AAEA,iBAAe,QAAQ,SAAqC;AAC1D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,IAAI,aAAa,OAAO,YAAY,CAAC,IAAI,SAAS,WAAW,GAAG,OAAO,QAAQ,GAAG,GAAG;AACvF,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC;AACA,UAAM,QAAQ,IAAI,SAAS,MAAM,OAAO,SAAS,MAAM,KAAK;AAC5D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAE1C,QAAI;AACF,UAAI,UAAU,YAAY,WAAW,MAAO,QAAO,MAAM,MAAM,SAAS,GAAG;AAC3E,UAAI,UAAU,eAAe,WAAW,MAAO,QAAO,MAAM,SAAS,SAAS,GAAG;AACjF,UAAI,UAAU,cAAc,WAAW,MAAO,QAAO,MAAM,aAAa,OAAO;AAC/E,UAAI,UAAU,YAAY,WAAW,MAAO,QAAO,MAAM,WAAW,OAAO;AAC3E,UAAI,UAAU,cAAc,WAAW,UAAU,WAAW,QAAQ;AAClE,eAAO,MAAM,OAAO,SAAS,GAAG;AAAA,MAClC;AACA,aAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACzC,SAAS,OAAO;AACd,YAAM,OAAO,iBAAiB,mBAAmB,MAAM,OAAO;AAC9D,YAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,cAAQ,MAAM,kBAAkB,KAAK,YAAY,OAAO;AACxD,aAAO,KAAK,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,IAClC;AAAA,EACF;AAEA,iBAAe,WAAW,SAA+C;AACvE,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,WAAW,MAAM,cAAc,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACvE,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,EAAE,SAAS,UAAU,IAAI;AAC/B,QAAI,QAAQ,wBAAwB,KAAK,IAAI,KAAK,CAAC,QAAQ,aAAc,QAAO;AAChF,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,sBAAsB,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,WAAW;AAC/B;;;AK1TA,SAAS,qBAAqB,YAAoB,QAAgB,UAA2B;AAC3F,QAAM,OAAO,GAAG,WAAW,QAAQ,QAAQ,EAAE,CAAC,UAAU,MAAM;AAC9D,SAAO,WAAW,GAAG,IAAI,IAAI,QAAQ,KAAK;AAC5C;AAEA,eAAe,SACb,UACA,MACY;AACZ,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,kBAAkB,IAAI,uCAAuC,SAAS,MAAM;AAAA,IAE9E;AAAA,EACF;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR,kBAAkB,IAAI,iBAAiB,SAAS,MAAM,MACjD,KAAK,SAAS,eAAe,WAAM,KAAK,qBAAqB,gBAAgB;AAAA,IACpF;AAAA,EACF;AACA,SAAO;AACT;AAkCA,eAAsB,eACpB,SAC2B;AAC3B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,aAAa,CAAC,sBAAsB,eAAe;AAAA,IACnD,YAAY;AAAA,EACd,IAAI;AAEJ,MAAI,CAAC,aAAa,QAAQ;AACxB,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAEA,QAAM,WAAW,MAAM,UAAU,qBAAqB,YAAY,MAAM,GAAG;AAAA,IACzE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oBAAoB,QAAQ,mBAAmB;AAAA,IAC1E,MAAM,KAAK,UAAU;AAAA,MACnB,aAAa;AAAA,MACb,eAAe;AAAA,MACf,aAAa;AAAA,MACb;AAAA,MACA,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH,CAAC;AASD,QAAM,OAAO,MAAM,SAA+B,UAAU,qBAAqB;AACjF,MAAI,CAAC,KAAK,aAAa,CAAC,KAAK,eAAe;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,cAAc,KAAK;AAAA,IACnB,yBAAyB,KAAK;AAAA,IAC9B,uBAAuB,KAAK;AAAA,EAC9B;AACF;AA6BA,SAAS,aAAa,MAA8B,kBAAsC;AACxF,SAAO;AAAA,IACL,UAAU,KAAK,aAAa;AAAA,IAC5B,MAAM,KAAK;AAAA,IACX,cAAc,KAAK,iBAAiB,CAAC;AAAA,IACrC,YAAY,KAAK,eAAe,CAAC;AAAA,IACjC,OAAO,KAAK;AAAA,EACd;AACF;AAOA,eAAsB,UAAU,SAAmD;AACjF,QAAM,EAAE,YAAY,QAAQ,UAAU,yBAAyB,YAAY,MAAM,IAAI;AACrF,QAAM,WAAW,MAAM,UAAU,qBAAqB,YAAY,QAAQ,QAAQ,GAAG;AAAA,IACnF,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe,UAAU,uBAAuB;AAAA,IAClD;AAAA,EACF,CAAC;AACD,QAAM,OAAO,MAAM,SAAiC,UAAU,oBAAoB;AAClF,SAAO,aAAa,MAAM,QAAQ;AACpC;AAiBA,eAAsB,yBACpB,SACqB;AACrB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,EACd,IAAI;AAEJ,MAAI,CAAC,aAAa,QAAQ;AAGxB,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AAEA,QAAM,UAAU,MAAM,UAAU,OAAO;AACvC,QAAM,WACJ,SAAS,QAAQ,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,QAAQ,cAAc,GAAG,YAAY,CAAC,CAAC,IAAI;AAE9E,QAAM,WAAW,MAAM,UAAU,qBAAqB,YAAY,QAAQ,QAAQ,GAAG;AAAA,IACnF,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,eAAe,UAAU,uBAAuB;AAAA,IAClD;AAAA;AAAA;AAAA,IAGA,MAAM,KAAK,UAAU;AAAA,MACnB,WAAW;AAAA,MACX,eAAe;AAAA,MACf,aAAa,QAAQ;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,aAAa,QAAQ;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,SAA8B,UAAU,qBAAqB;AAAA,EACrE;AAEA,SAAO,UAAU,OAAO;AAC1B;;;ACvLO,SAAS,kBAAkB,SAA4B,CAAC,GAAgB;AAC7E,QAAM,WAAW,cAAc,MAAM;AACrC,QAAM,EAAE,SAAS,WAAW,IAAI,cAAc,QAAQ;AACtD,SAAO,EAAE,SAAS,YAAY,QAAQ,SAAS;AACjD;","names":["code"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@incorta/auth",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Authenticate Incorta users in any Node.js app — OAuth 2.0/OIDC against Incorta's built-in authorization server, with a React provider and Express/TanStack Start integrations.",
   "license": "MIT",
   "repository": {