@iwentsourcing/core 0.1.0

package/dist/authentication/providers/github-actions.d.ts

@@ -0,0 +1,6 @@
+import { OpenIDProvider } from '../open-id-provider.js';
+import { JwtStoreOptions } from '../jwt-store.js';
+export interface GithubActionsOptions {
+    jwt: JwtStoreOptions;
+}
+export declare function githubActions(opts: GithubActionsOptions): Readonly<OpenIDProvider>;

package/dist/authentication/providers/github-actions.js

@@ -0,0 +1,19 @@
+import { jwtStore } from '../jwt-store.js';
+export function githubActions(opts) {
+    return {
+        type: 'openid',
+        issuer: 'https://token.actions.githubusercontent.com',
+        jwks: {
+            url: 'https://token.actions.githubusercontent.com/.well-known/jwks',
+            subKey: 'oidc_extra->actor',
+        },
+        jwt: jwtStore(opts.jwt),
+        clientSecret: undefined,
+        clientId: undefined,
+        audience: undefined,
+        authorize: undefined,
+        token: undefined,
+        deviceCode: undefined,
+    };
+}
+//# sourceMappingURL=github-actions.js.map

package/dist/authentication/providers/github-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-actions.js","sourceRoot":"","sources":["../../../src/authentication/providers/github-actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAmB,MAAM,iBAAiB,CAAC;AAM5D,MAAM,UAAU,aAAa,CAC3B,IAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,QAAQ;QAEd,MAAM,EAAE,6CAA6C;QAErD,IAAI,EAAE;YACJ,GAAG,EAAE,8DAA8D;YACnE,MAAM,EAAE,mBAAmB;SAC5B;QAED,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAEvB,YAAY,EAAE,SAAS;QACvB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC"}

package/dist/authentication/providers/github.d.ts

@@ -0,0 +1,10 @@
+import { Secret } from '../../realm/secret.js';
+import { TokenProvider } from '../token-provider.js';
+import { JwtStoreOptions } from '../jwt-store.js';
+export interface GithubOAuthOptions {
+    clientId: string;
+    clientSecret: Secret;
+    scope?: string;
+    jwt?: Partial<JwtStoreOptions>;
+}
+export declare function createGithubOAuth(opts: GithubOAuthOptions): Readonly<TokenProvider>;

package/dist/authentication/providers/github.js

@@ -0,0 +1,39 @@
+import { jwtStore } from '../jwt-store.js';
+export function createGithubOAuth(opts) {
+    return {
+        type: 'token',
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        token: {
+            url: 'https://github.com/login/oauth/access_token',
+            formData: {},
+            tokenAttributes: [],
+        },
+        authorize: {
+            url: 'https://github.com/login/oauth/authorize',
+            queryParams: {
+                client_id: opts.clientId,
+                scope: opts.scope ?? 'user:email',
+            },
+        },
+        deviceCode: {
+            codeUrl: 'https://github.com/login/device/code',
+            grantType: 'urn:ietf:params:oauth:grant-type:device_code',
+            verificationUriName: 'verification_uri',
+            clientSecret: false,
+            scope: '',
+        },
+        user: {
+            url: 'https://api.github.com/user',
+            tokenAttributes: [],
+        },
+        issuer: 'github',
+        jwt: jwtStore({
+            algorithm: opts.jwt?.algorithm ?? 'HS256',
+            issuer: opts.jwt?.issuer ?? 'github',
+            audience: opts.jwt?.audience ?? opts.clientId,
+            secret: opts.jwt?.secret ?? opts.clientSecret,
+        }),
+    };
+}
+//# sourceMappingURL=github.js.map

package/dist/authentication/providers/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/authentication/providers/github.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAmB,MAAM,iBAAiB,CAAC;AAS5D,MAAM,UAAU,iBAAiB,CAC/B,IAAwB;IAExB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAE/B,KAAK,EAAE;YACL,GAAG,EAAE,6CAA6C;YAClD,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,EAAE;SACpB;QAED,SAAS,EAAE;YACT,GAAG,EAAE,0CAA0C;YAC/C,WAAW,EAAE;gBACX,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY;aAClC;SACF;QAED,UAAU,EAAE;YACV,OAAO,EAAE,sCAAsC;YAC/C,SAAS,EAAE,8CAA8C;YACzD,mBAAmB,EAAE,kBAAkB;YACvC,YAAY,EAAE,KAAK;YACnB,KAAK,EAAE,EAAE;SACV;QAED,IAAI,EAAE;YACJ,GAAG,EAAE,6BAA6B;YAClC,eAAe,EAAE,EAAE;SACpB;QAED,MAAM,EAAE,QAAQ;QAEhB,GAAG,EAAE,QAAQ,CAAC;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO;YACzC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,QAAQ;YACpC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAC7C,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,YAAY;SAC9C,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/authentication/providers/google.d.ts

@@ -0,0 +1,11 @@
+import { OpenIDProvider } from '../open-id-provider.js';
+import { Secret } from '../../realm/secret.js';
+import { JwtStoreOptions } from '../jwt-store.js';
+export interface GoogleOAuthOptions {
+    clientId: string;
+    clientSecret: Secret;
+    scope?: string;
+    tokenAttributes?: string[];
+    jwt?: Partial<JwtStoreOptions>;
+}
+export declare function createGoogleOAuth(opts: GoogleOAuthOptions): Readonly<OpenIDProvider>;

package/dist/authentication/providers/google.js

@@ -0,0 +1,52 @@
+import { jwtStore } from '../jwt-store.js';
+export function createGoogleOAuth(opts) {
+    return {
+        type: 'openid',
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        audience: undefined,
+        issuer: 'https://accounts.google.com',
+        // openIdConfigurationUrl: 'https://accounts.google.com/.well-known/openid-configuration',
+        token: {
+            url: 'https://oauth2.googleapis.com/token',
+            formData: {
+                tenant: 'common',
+            },
+            tokenAttributes: opts.tokenAttributes ?? [
+                'picture',
+                'given_name',
+                'family_name',
+                'email',
+                'name',
+            ],
+        },
+        deviceCode: {
+            codeUrl: 'https://oauth2.googleapis.com/device/code',
+            grantType: 'urn:ietf:params:oauth:grant-type:device_code',
+            verificationUriName: 'verification_url',
+            clientSecret: true,
+            scope: 'openid',
+        },
+        jwks: {
+            url: 'https://www.googleapis.com/oauth2/v3/certs',
+            subKey: 'sub',
+        },
+        authorize: {
+            url: 'https://accounts.google.com/o/oauth2/v2/auth',
+            queryParams: {
+                client_id: opts.clientId,
+                response_type: 'code',
+                access_type: 'offline',
+                prompt: 'consent',
+                scope: opts.scope ?? 'openid email profile',
+            },
+        },
+        jwt: jwtStore({
+            algorithm: opts.jwt?.algorithm ?? 'HS256',
+            issuer: opts.jwt?.issuer ?? 'google',
+            audience: opts.jwt?.audience ?? opts.clientId,
+            secret: opts.jwt?.secret ?? opts.clientSecret,
+        }),
+    };
+}
+//# sourceMappingURL=google.js.map

package/dist/authentication/providers/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/authentication/providers/google.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAmB,MAAM,iBAAiB,CAAC;AAU5D,MAAM,UAAU,iBAAiB,CAC/B,IAAwB;IAExB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAE/B,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,6BAA6B;QAErC,0FAA0F;QAC1F,KAAK,EAAE;YACL,GAAG,EAAE,qCAAqC;YAC1C,QAAQ,EAAE;gBACR,MAAM,EAAE,QAAQ;aACjB;YACD,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI;gBACvC,SAAS;gBACT,YAAY;gBACZ,aAAa;gBACb,OAAO;gBACP,MAAM;aACP;SACF;QAED,UAAU,EAAE;YACV,OAAO,EAAE,2CAA2C;YACpD,SAAS,EAAE,8CAA8C;YACzD,mBAAmB,EAAE,kBAAkB;YACvC,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,QAAQ;SAChB;QAED,IAAI,EAAE;YACJ,GAAG,EAAE,4CAA4C;YACjD,MAAM,EAAE,KAAK;SACd;QAED,SAAS,EAAE;YACT,GAAG,EAAE,8CAA8C;YACnD,WAAW,EAAE;gBACX,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,MAAM;gBACrB,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,sBAAsB;aAC5C;SACF;QAED,GAAG,EAAE,QAAQ,CAAC;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO;YACzC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,QAAQ;YACpC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAC7C,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,YAAY;SAC9C,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/authentication/providers/microsoft.d.ts

@@ -0,0 +1,12 @@
+import { OpenIDProvider } from '../open-id-provider.js';
+import { Secret } from '../../realm/secret.js';
+import { JwtStoreOptions } from '../jwt-store.js';
+export interface MicrosoftOAuthOptions {
+    clientId: string;
+    clientSecret: Secret;
+    tenant: string;
+    scope?: string;
+    tokenAttributes?: string[];
+    jwt?: Partial<JwtStoreOptions>;
+}
+export declare function createMicrosoftOAuth(opts: MicrosoftOAuthOptions): Readonly<OpenIDProvider>;

package/dist/authentication/providers/microsoft.js

@@ -0,0 +1,49 @@
+import { jwtStore } from '../jwt-store.js';
+export function createMicrosoftOAuth(opts) {
+    return {
+        type: 'openid',
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        audience: undefined,
+        issuer: 'https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0',
+        //openIdConfigurationUrl: 'https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration',
+        jwks: {
+            url: `https://login.microsoftonline.com/${opts.tenant}/discovery/v2.0/keys`,
+            subKey: 'sub',
+        },
+        token: {
+            url: `https://login.microsoftonline.com/${opts.tenant}/oauth2/v2.0/token`,
+            formData: {},
+            tokenAttributes: opts.tokenAttributes ?? [
+                'tid',
+                'oid',
+                'preferred_username',
+                'email',
+                'name',
+            ],
+        },
+        deviceCode: {
+            codeUrl: `https://login.microsoftonline.com/${opts.tenant}/oauth2/v2.0/devicecode`,
+            grantType: 'urn:ietf:params:oauth:grant-type:device_code',
+            verificationUriName: 'verification_uri',
+            clientSecret: false,
+            scope: opts.scope ?? 'openid email offline_access profile',
+        },
+        authorize: {
+            url: `https://login.microsoftonline.com/${opts.tenant}/oauth2/v2.0/authorize`,
+            queryParams: {
+                client_id: opts.clientId,
+                tenant: opts.tenant,
+                scope: opts.scope ?? 'openid email offline_access profile',
+                response_type: 'code',
+            },
+        },
+        jwt: jwtStore({
+            algorithm: opts.jwt?.algorithm ?? 'HS256',
+            issuer: opts.jwt?.issuer ?? 'microsoft',
+            audience: opts.jwt?.audience ?? opts.tenant,
+            secret: opts.jwt?.secret ?? opts.clientSecret,
+        }),
+    };
+}
+//# sourceMappingURL=microsoft.js.map

package/dist/authentication/providers/microsoft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.js","sourceRoot":"","sources":["../../../src/authentication/providers/microsoft.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAmB,MAAM,iBAAiB,CAAC;AAW5D,MAAM,UAAU,oBAAoB,CAClC,IAA2B;IAE3B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;QAE/B,QAAQ,EAAE,SAAS;QACnB,MAAM,EACJ,6EAA6E;QAE/E,2GAA2G;QAC3G,IAAI,EAAE;YACJ,GAAG,EAAE,qCAAqC,IAAI,CAAC,MAAM,sBAAsB;YAC3E,MAAM,EAAE,KAAK;SACd;QAED,KAAK,EAAE;YACL,GAAG,EAAE,qCAAqC,IAAI,CAAC,MAAM,oBAAoB;YACzE,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI;gBACvC,KAAK;gBACL,KAAK;gBACL,oBAAoB;gBACpB,OAAO;gBACP,MAAM;aACP;SACF;QAED,UAAU,EAAE;YACV,OAAO,EAAE,qCAAqC,IAAI,CAAC,MAAM,yBAAyB;YAClF,SAAS,EAAE,8CAA8C;YACzD,mBAAmB,EAAE,kBAAkB;YACvC,YAAY,EAAE,KAAK;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,qCAAqC;SAC3D;QAED,SAAS,EAAE;YACT,GAAG,EAAE,qCAAqC,IAAI,CAAC,MAAM,wBAAwB;YAC7E,WAAW,EAAE;gBACX,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,qCAAqC;gBAC1D,aAAa,EAAE,MAAM;aACtB;SACF;QAED,GAAG,EAAE,QAAQ,CAAC;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,OAAO;YACzC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,WAAW;YACvC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC,MAAM;YAC3C,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,YAAY;SAC9C,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/authentication/public-auth-providers.d.ts

@@ -0,0 +1,69 @@
+import { AuthProviders } from './auth-providers.js';
+import { TypeOf } from '../typing/type-of.js';
+export declare const PublicJwtClientSchema: import("../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "jwt";
+}>;
+export declare const PublicOpenIDClientSchema: import("../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "openid";
+    authorize: {
+        url: string;
+        queryParams: {
+            [key: string]: string;
+        };
+    } | undefined;
+}>;
+export declare const PublicTokenClientSchema: import("../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "token";
+    authorize: {
+        url: string;
+        queryParams: {
+            [key: string]: string;
+        };
+    } | undefined;
+}>;
+export declare const PublicAuthProvider: import("../typing/union-type-description.js").UnionTypeDescription<{
+    type: "jwt";
+} | {
+    type: "openid";
+    authorize: {
+        url: string;
+        queryParams: {
+            [key: string]: string;
+        };
+    } | undefined;
+} | {
+    type: "token";
+    authorize: {
+        url: string;
+        queryParams: {
+            [key: string]: string;
+        };
+    } | undefined;
+}>;
+export declare const PublicAuthProvidersResponseSchema: import("../typing/object-type-description.js").ObjectTypeDescription<{
+    realm: string;
+    providers: {
+        [key: string]: {
+            type: "jwt";
+        } | {
+            type: "openid";
+            authorize: {
+                url: string;
+                queryParams: {
+                    [key: string]: string;
+                };
+            } | undefined;
+        } | {
+            type: "token";
+            authorize: {
+                url: string;
+                queryParams: {
+                    [key: string]: string;
+                };
+            } | undefined;
+        };
+    };
+}>;
+export type PublicAuthProvidersResponse = TypeOf<typeof PublicAuthProvidersResponseSchema>;
+export type PublicAuthProvider = TypeOf<typeof PublicAuthProvider>;
+export declare function serializePublicAuthProviders(providers: AuthProviders): Record<string, PublicAuthProvider>;

package/dist/authentication/public-auth-providers.js

@@ -0,0 +1,62 @@
+import { object } from '../typing/object.js';
+import { string } from '../typing/string.js';
+import { record } from '../typing/record.js';
+import { union } from '../typing/union.js';
+import { literal } from '../typing/literal.js';
+import { optional } from '../typing/optional.js';
+export const PublicJwtClientSchema = object('PublicJwtClient', {
+    type: literal('jwt'),
+});
+export const PublicOpenIDClientSchema = object('PublicOpenIDClient', {
+    type: literal('openid'),
+    authorize: optional(object('PublicOpenIDAuthorize', {
+        url: string(),
+        queryParams: record(string(), string()),
+    })),
+});
+export const PublicTokenClientSchema = object('PublicTokenClient', {
+    type: literal('token'),
+    authorize: optional(object('PublicTokenAuthorize', {
+        url: string(),
+        queryParams: record(string(), string()),
+    })),
+});
+export const PublicAuthProvider = union('PublicAuthProvider', [PublicOpenIDClientSchema, PublicJwtClientSchema, PublicTokenClientSchema], 'type');
+export const PublicAuthProvidersResponseSchema = object('PublicAuthProvidersResponse', {
+    realm: string(),
+    providers: record(string(), PublicAuthProvider),
+});
+function publicOpenIDClient(p) {
+    const o = {
+        type: 'openid',
+    };
+    if (p.authorize) {
+        o.authorize = p.authorize;
+    }
+    return o;
+}
+function publicTokenClient(p) {
+    const o = {
+        type: 'token',
+    };
+    if (p.authorize) {
+        o.authorize = p.authorize;
+    }
+    return o;
+}
+export function serializePublicAuthProviders(providers) {
+    const out = {};
+    for (const [key, p] of Object.entries(providers)) {
+        if (p.type === 'openid') {
+            out[key] = publicOpenIDClient(p);
+        }
+        else if (p.type === 'jwt') {
+            out[key] = { type: 'jwt' };
+        }
+        else {
+            out[key] = publicTokenClient(p);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=public-auth-providers.js.map

package/dist/authentication/public-auth-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-auth-providers.js","sourceRoot":"","sources":["../../src/authentication/public-auth-providers.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,iBAAiB,EAAE;IAC7D,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,oBAAoB,EAAE;IACnE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC;IACvB,SAAS,EAAE,QAAQ,CACjB,MAAM,CAAC,uBAAuB,EAAE;QAC9B,GAAG,EAAE,MAAM,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,mBAAmB,EAAE;IACjE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;IACtB,SAAS,EAAE,QAAQ,CACjB,MAAM,CAAC,sBAAsB,EAAE;QAC7B,GAAG,EAAE,MAAM,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CACrC,oBAAoB,EACpB,CAAC,wBAAwB,EAAE,qBAAqB,EAAE,uBAAuB,CAAC,EAC1E,MAAM,CACP,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CACrD,6BAA6B,EAC7B;IACE,KAAK,EAAE,MAAM,EAAE;IACf,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC;CAChD,CACF,CAAC;AAQF,SAAS,kBAAkB,CAAC,CAAiB;IAC3C,MAAM,CAAC,GAAgE;QACrE,IAAI,EAAE,QAAQ;KACf,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC5B,CAAC;IACD,OAAO,CAAuB,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAgB;IACzC,MAAM,CAAC,GAA8D;QACnE,IAAI,EAAE,OAAO;KACd,CAAC;IACF,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC5B,CAAC;IACD,OAAO,CAAuB,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,SAAwB;IAExB,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAwB,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/authentication/public-auth-providers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/authentication/public-auth-providers.test.js

@@ -0,0 +1,40 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import { serializePublicAuthProviders } from './public-auth-providers.js';
+import { jwtStore } from './jwt-store.js';
+import { secret } from '../realm/secret.js';
+import { createGithubOAuth } from './providers/github.js';
+describe('serializePublicAuthProviders', () => {
+    it('exposes only client-safe fields (no secrets, no server-only URLs)', () => {
+        const providers = {
+            github: createGithubOAuth({
+                clientId: 'public-client-id',
+                clientSecret: secret('GITHUB_CLIENT_SECRET'),
+            }),
+            store: jwtStore({
+                secret: secret('JWT_STORE_SECRET'),
+                issuer: 'iss',
+                audience: 'aud',
+            }),
+        };
+        const pub = serializePublicAuthProviders(providers);
+        const gh = pub.github;
+        const store = pub.store;
+        assert.ok(gh && gh.type === 'token');
+        assert.ok(!('clientSecret' in gh));
+        assert.ok(!('clientId' in gh));
+        assert.ok(!('issuer' in gh));
+        assert.ok(!('token' in gh));
+        assert.ok(!('user' in gh));
+        assert.ok(!('jwt' in gh));
+        assert.strictEqual(gh.authorize?.url, 'https://github.com/login/oauth/authorize');
+        assert.ok(store && store.type === 'jwt');
+        assert.deepStrictEqual(Object.keys(store).sort(), ['type']);
+        const raw = JSON.stringify(pub);
+        assert.ok(!raw.includes('GITHUB_CLIENT_SECRET'));
+        assert.ok(!raw.includes('JWT_STORE_SECRET'));
+        assert.ok(!raw.includes('"type":"secret"'));
+        assert.ok(!raw.includes('api.github.com'));
+    });
+});
+//# sourceMappingURL=public-auth-providers.test.js.map

package/dist/authentication/public-auth-providers.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-auth-providers.test.js","sourceRoot":"","sources":["../../src/authentication/public-auth-providers.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,SAAS,GAAG;YAChB,MAAM,EAAE,iBAAiB,CAAC;gBACxB,QAAQ,EAAE,kBAAkB;gBAC5B,YAAY,EAAE,MAAM,CAAC,sBAAsB,CAAC;aAC7C,CAAC;YACF,KAAK,EAAE,QAAQ,CAAC;gBACd,MAAM,EAAE,MAAM,CAAC,kBAAkB,CAAC;gBAClC,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,KAAK;aAChB,CAAC;SACH,CAAC;QACF,MAAM,GAAG,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACxB,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,WAAW,CAChB,EAAE,CAAC,SAAS,EAAE,GAAG,EACjB,0CAA0C,CAC3C,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAEtE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/authentication/resolve-secret.d.ts

@@ -0,0 +1,3 @@
+import { RuntimeEnv } from '../environment/runtime-env.js';
+import { Secret } from '../realm/secret.js';
+export declare function resolveSecret(env: RuntimeEnv, secret: Secret | string): string;

package/dist/authentication/resolve-secret.js

@@ -0,0 +1,11 @@
+export function resolveSecret(env, secret) {
+    if (typeof secret === 'string') {
+        return secret;
+    }
+    const value = env.env(secret.name);
+    if (!value) {
+        throw new Error('unable to get secret ' + secret.name);
+    }
+    return value;
+}
+//# sourceMappingURL=resolve-secret.js.map

package/dist/authentication/resolve-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-secret.js","sourceRoot":"","sources":["../../src/authentication/resolve-secret.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,aAAa,CAC3B,GAAe,EACf,MAAuB;IAEvB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/authentication/sha1.d.ts

@@ -0,0 +1,2 @@
+import { RuntimeEnv } from '../environment/runtime-env.js';
+export declare function sha1(env: RuntimeEnv, value: string): Promise<string>;

package/dist/authentication/sha1.js

@@ -0,0 +1,11 @@
+export async function sha1(env, value) {
+    const encoder = env.encoder();
+    const msgBuffer = encoder.encode(value);
+    // hash the message
+    const hashBuffer = await env.crypto().subtle.digest('SHA-1', msgBuffer);
+    // convert ArrayBuffer to Array
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    // convert bytes to hex string
+    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+//# sourceMappingURL=sha1.js.map

package/dist/authentication/sha1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha1.js","sourceRoot":"","sources":["../../src/authentication/sha1.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,GAAe,EAAE,KAAa;IACvD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAExC,mBAAmB;IACnB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAExE,+BAA+B;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAEzD,8BAA8B;IAC9B,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/authentication/sha256.d.ts

@@ -0,0 +1,2 @@
+import { RuntimeEnv } from '../environment/runtime-env.js';
+export declare function sha256(env: RuntimeEnv, value: string): Promise<string>;

package/dist/authentication/sha256.js

@@ -0,0 +1,11 @@
+export async function sha256(env, value) {
+    const encoder = env.encoder();
+    const msgBuffer = encoder.encode(value);
+    // hash the message
+    const hashBuffer = await env.crypto().subtle.digest('SHA-256', msgBuffer);
+    // convert ArrayBuffer to Array
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    // convert bytes to hex string
+    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+//# sourceMappingURL=sha256.js.map

package/dist/authentication/sha256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.js","sourceRoot":"","sources":["../../src/authentication/sha256.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,KAAa;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAExC,mBAAmB;IACnB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAE1E,+BAA+B;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAEzD,8BAA8B;IAC9B,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/authentication/token-auth-definitions.d.ts

@@ -0,0 +1,6 @@
+import { AuthProviders } from './auth-providers.js';
+export type TokenAuthDefinitions<TAuth extends AuthProviders> = {
+    [Prop in keyof TAuth as TAuth[Prop] extends {
+        type: 'token';
+    } ? Prop : never]: TAuth[Prop];
+};

package/dist/authentication/token-auth-definitions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-auth-definitions.js.map

package/dist/authentication/token-auth-definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-auth-definitions.js","sourceRoot":"","sources":["../../src/authentication/token-auth-definitions.ts"],"names":[],"mappings":""}

package/dist/authentication/token-parse-result.d.ts

@@ -0,0 +1,12 @@
+export interface TokenParseResult {
+    payload: {
+        sub: string;
+        aud: string;
+        iss: string;
+    };
+    token: {
+        refresh_token: string | undefined;
+        id_token: string;
+    } | null;
+    attributes: Record<string, string>;
+}

package/dist/authentication/token-parse-result.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-parse-result.js.map

package/dist/authentication/token-parse-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-parse-result.js","sourceRoot":"","sources":["../../src/authentication/token-parse-result.ts"],"names":[],"mappings":""}

package/dist/authentication/token-provider.d.ts

@@ -0,0 +1,46 @@
+import { TypeOf } from '../typing/type-of.js';
+export declare const TokenProvider: import("../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "token";
+    jwt: {
+        type: "jwt";
+        secret: string | {
+            type: "secret";
+            name: string;
+        };
+        algorithm: "HS256";
+        issuer: string;
+        audience: string;
+        expirationTime: string;
+    };
+    issuer: string;
+    clientId: string;
+    clientSecret: string | {
+        type: "secret";
+        name: string;
+    };
+    token: {
+        url: string;
+        formData: {
+            [key: string]: string;
+        };
+        tokenAttributes: string[] | undefined;
+    };
+    authorize: {
+        url: string;
+        queryParams: {
+            [key: string]: string;
+        };
+    };
+    deviceCode: {
+        clientSecret: boolean;
+        verificationUriName: string;
+        codeUrl: string;
+        grantType: string;
+        scope: string | undefined;
+    };
+    user: {
+        url: string;
+        tokenAttributes: string[] | undefined;
+    };
+}>;
+export type TokenProvider = TypeOf<typeof TokenProvider>;

package/dist/authentication/token-provider.js

@@ -0,0 +1,38 @@
+import { object } from '../typing/object.js';
+import { string } from '../typing/string.js';
+import { record } from '../typing/record.js';
+import { union } from '../typing/union.js';
+import { literal } from '../typing/literal.js';
+import { Secret } from '../realm/secret.js';
+import { JwtStore } from './jwt-store.js';
+import { boolean } from '../typing/boolean.js';
+import { optional } from '../typing/optional.js';
+import { array } from '../typing/array.js';
+export const TokenProvider = object('TokenProvider', {
+    type: literal('token'),
+    clientId: string(),
+    issuer: string(),
+    clientSecret: union('TokenClientSecret', [string(), Secret]),
+    token: object('TokenToken', {
+        url: string(),
+        formData: record(string(), string()),
+        tokenAttributes: optional(array(string())),
+    }),
+    authorize: object('TokenAuthorize', {
+        url: string(),
+        queryParams: record(string(), string()),
+    }),
+    deviceCode: object('OpenIDDeviceCode', {
+        verificationUriName: string(),
+        codeUrl: string(),
+        grantType: string(),
+        clientSecret: boolean(),
+        scope: optional(string()),
+    }),
+    user: object('TokenUser', {
+        url: string(),
+        tokenAttributes: optional(array(string())),
+    }),
+    jwt: JwtStore,
+});
+//# sourceMappingURL=token-provider.js.map

package/dist/authentication/token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-provider.js","sourceRoot":"","sources":["../../src/authentication/token-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,eAAe,EAAE;IACnD,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE;IAClB,MAAM,EAAE,MAAM,EAAE;IAChB,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5D,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;QAC1B,GAAG,EAAE,MAAM,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;QACpC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;KAC3C,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE;QAClC,GAAG,EAAE,MAAM,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,UAAU,EAAE,MAAM,CAAC,kBAAkB,EAAE;QACrC,mBAAmB,EAAE,MAAM,EAAE;QAC7B,OAAO,EAAE,MAAM,EAAE;QACjB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,OAAO,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC1B,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE;QACxB,GAAG,EAAE,MAAM,EAAE;QACb,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;KAC3C,CAAC;IACF,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC"}

package/dist/authentication/token-request.d.ts

@@ -0,0 +1,5 @@
+export interface TokenRequest {
+    username: string;
+    refresh_token: string;
+    attributes: Record<string, string>;
+}

package/dist/authentication/token-request.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-request.js.map

package/dist/authentication/token-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-request.js","sourceRoot":"","sources":["../../src/authentication/token-request.ts"],"names":[],"mappings":""}

package/dist/cache/cache-once.d.ts

@@ -0,0 +1,4 @@
+export declare function cacheOnce<T>(fn: () => Promise<T | null>): {
+    get(): Promise<T | null>;
+    isEmpty(): Promise<boolean>;
+};