@jcoder-stack/abp-react 0.1.0

package/dist/chunk-QQFH53SC.js

@@ -0,0 +1,700 @@
+// src/auth/base64url.ts
+function bytesToBase64Url(bytes) {
+  let bin = "";
+  for (const byte of bytes) bin += String.fromCharCode(byte);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+}
+
+// src/auth/codec.ts
+var IV_LENGTH = 12;
+var VERSION = 1;
+async function deriveKey(secret, usage) {
+  const ikm = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    "HKDF",
+    false,
+    ["deriveKey"]
+  );
+  return crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new TextEncoder().encode("jc-abp-auth-codec-v1"),
+      info: new TextEncoder().encode(usage)
+    },
+    ikm,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+function createCodec(secret, schema, opts) {
+  if (secret.length < 32) throw new Error("codec secret must be at least 32 characters");
+  const keyPromise = deriveKey(secret, opts.usage);
+  return {
+    async seal(data) {
+      const key = await keyPromise;
+      const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+      const plaintext = new TextEncoder().encode(JSON.stringify(data));
+      const ciphertext = new Uint8Array(
+        await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext)
+      );
+      const combined = new Uint8Array(1 + iv.length + ciphertext.length);
+      combined[0] = VERSION;
+      combined.set(iv, 1);
+      combined.set(ciphertext, 1 + iv.length);
+      return bytesToBase64Url(combined);
+    },
+    async open(token) {
+      try {
+        const key = await keyPromise;
+        const combined = base64UrlToBytes(token);
+        if (combined.length <= 1 + IV_LENGTH || combined[0] !== VERSION) return null;
+        const iv = Uint8Array.from(combined.slice(1, 1 + IV_LENGTH));
+        const ciphertext = Uint8Array.from(combined.slice(1 + IV_LENGTH));
+        const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
+        const parsed = schema.safeParse(JSON.parse(new TextDecoder().decode(plaintext)));
+        if (parsed.success) return parsed.data;
+        opts.onError?.(new Error("codec payload failed schema validation"));
+        return null;
+      } catch (error) {
+        opts.onError?.(error);
+        return null;
+      }
+    }
+  };
+}
+
+// src/auth/cookies.ts
+var COOKIE_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function serializeCookie(name, value, opts = {}) {
+  if (!COOKIE_NAME_PATTERN.test(name)) {
+    throw new Error(`invalid cookie name: ${JSON.stringify(name)}`);
+  }
+  const sameSite = opts.sameSite ?? "Lax";
+  if (sameSite === "None" && opts.secure === false) {
+    throw new Error("SameSite=None requires Secure");
+  }
+  const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${opts.path ?? "/"}`];
+  if (opts.httpOnly !== false) parts.push("HttpOnly");
+  if (opts.secure !== false) parts.push("Secure");
+  parts.push(`SameSite=${sameSite}`);
+  if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
+  return parts.join("; ");
+}
+function clearCookie(name, opts = {}) {
+  return serializeCookie(name, "", { ...opts, maxAge: 0 });
+}
+function parseCookieHeader(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(/;\s*/)) {
+    const eq = part.indexOf("=");
+    if (eq <= 0) continue;
+    const raw = part.slice(eq + 1);
+    try {
+      out[part.slice(0, eq).trim()] = decodeURIComponent(raw);
+    } catch {
+      out[part.slice(0, eq).trim()] = raw;
+    }
+  }
+  return out;
+}
+var COOKIE_CHUNK_SIZE = 3600;
+function splitByEncodedLength(value, limit) {
+  const chunks = [];
+  let chunk = "";
+  let encodedLength = 0;
+  for (const char of value) {
+    const charLength = encodeURIComponent(char).length;
+    if (chunk !== "" && encodedLength + charLength > limit) {
+      chunks.push(chunk);
+      chunk = "";
+      encodedLength = 0;
+    }
+    chunk += char;
+    encodedLength += charLength;
+  }
+  if (chunk !== "") chunks.push(chunk);
+  return chunks;
+}
+function chunkCookieValue(name, value, opts = {}, existing) {
+  const cookies = [];
+  const fresh = /* @__PURE__ */ new Set();
+  let chunkCount = 0;
+  const chunks = splitByEncodedLength(value, COOKIE_CHUNK_SIZE);
+  if (chunks.length <= 1) {
+    cookies.push(serializeCookie(name, value, opts));
+    fresh.add(name);
+  } else {
+    cookies.push(clearCookie(name, opts));
+    for (const chunk of chunks) {
+      const chunkName = `${name}.${chunkCount}`;
+      cookies.push(serializeCookie(chunkName, chunk, opts));
+      fresh.add(chunkName);
+      chunkCount++;
+    }
+  }
+  const cleared = new Set(fresh.has(name) ? [] : [name]);
+  const clearOnce = (chunkName) => {
+    if (fresh.has(chunkName) || cleared.has(chunkName)) return;
+    cleared.add(chunkName);
+    cookies.push(clearCookie(chunkName, opts));
+  };
+  clearOnce(`${name}.${chunkCount}`);
+  if (existing !== void 0) {
+    const chunkPattern = new RegExp(`^${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.\\d+$`);
+    for (const key of Object.keys(existing)) {
+      if (chunkPattern.test(key)) clearOnce(key);
+    }
+  }
+  return cookies;
+}
+function readChunkedCookie(cookies, name) {
+  const whole = cookies[name];
+  if (whole !== void 0) return whole;
+  let value = "";
+  for (let index = 0; ; index++) {
+    const part = cookies[`${name}.${index}`];
+    if (part === void 0) break;
+    value += part;
+  }
+  return value === "" ? void 0 : value;
+}
+function clearChunkedCookie(name, cookies, opts = {}) {
+  const out = [clearCookie(name, opts)];
+  for (let index = 0; ; index++) {
+    if (cookies[`${name}.${index}`] === void 0) break;
+    out.push(clearCookie(`${name}.${index}`, opts));
+  }
+  return out;
+}
+
+// src/auth/types.ts
+import { z } from "zod";
+var authTokensSchema = z.object({
+  accessToken: z.string(),
+  refreshToken: z.string().optional(),
+  idToken: z.string().optional()
+});
+var authSessionSchema = z.object({
+  tokens: authTokensSchema,
+  expiresAt: z.number().optional(),
+  tenant: z.string().nullable().optional(),
+  culture: z.string().nullable().optional()
+});
+var handshakeSchema = z.object({
+  state: z.string(),
+  nonce: z.string(),
+  codeVerifier: z.string(),
+  returnUrl: z.string(),
+  issuedAt: z.number()
+});
+
+// src/auth/cookie-store.ts
+function createCookieSessionStore(opts) {
+  const codec = createCodec(opts.secret, authSessionSchema, {
+    usage: "session",
+    onError: (error) => opts.logger?.debug("session cookie open failed", { error: String(error) })
+  });
+  return {
+    load: async (cookieHeader) => {
+      const sealed = readChunkedCookie(parseCookieHeader(cookieHeader), opts.cookieName);
+      if (sealed === void 0) return null;
+      const session = await codec.open(sealed);
+      opts.logger?.debug("session opened", { found: session !== null, sealedBytes: sealed.length });
+      return session;
+    },
+    save: async (session, cookieHeader) => {
+      const sealed = await codec.seal(session);
+      const cookies = chunkCookieValue(
+        opts.cookieName,
+        sealed,
+        { ...opts.cookieOptions, maxAge: opts.maxAge },
+        parseCookieHeader(cookieHeader)
+      );
+      opts.logger?.debug("session sealed", { sealedBytes: sealed.length, cookies: cookies.length });
+      return cookies;
+    },
+    clear: async (cookieHeader) => clearChunkedCookie(opts.cookieName, parseCookieHeader(cookieHeader), opts.cookieOptions)
+  };
+}
+
+// src/auth/oidc/token-client.ts
+import { z as z3 } from "zod";
+
+// src/auth/errors.ts
+var AuthError = class extends Error {
+  code;
+  constructor(code, message, opts) {
+    super(message ?? code, opts);
+    this.name = "AuthError";
+    this.code = code;
+  }
+};
+
+// src/auth/oidc/metadata.ts
+import { z as z2 } from "zod";
+var oidcMetadataSchema = z2.object({
+  issuer: z2.string(),
+  authorization_endpoint: z2.string(),
+  token_endpoint: z2.string(),
+  end_session_endpoint: z2.string().optional(),
+  revocation_endpoint: z2.string().optional()
+});
+async function discoverMetadata(issuer, opts = {}) {
+  const fetchFn = opts.fetchFn ?? fetch;
+  const url = `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+  try {
+    const res = await fetchFn(url, { signal: AbortSignal.timeout(opts.timeoutMs ?? 3e4) });
+    if (!res.ok) throw new Error(`discovery returned ${res.status}`);
+    const metadata = oidcMetadataSchema.parse(await res.json());
+    const normalize = (v) => v.replace(/\/$/, "");
+    if (normalize(metadata.issuer) !== normalize(issuer)) {
+      throw new Error(`issuer mismatch: expected ${issuer}, got ${metadata.issuer}`);
+    }
+    return metadata;
+  } catch (error) {
+    throw new AuthError("discovery_failed", `OIDC discovery failed for ${issuer}`, {
+      cause: error
+    });
+  }
+}
+
+// src/auth/oidc/token-client.ts
+var tokenResponseSchema = z3.object({
+  access_token: z3.string(),
+  refresh_token: z3.string().optional(),
+  id_token: z3.string().optional(),
+  expires_in: z3.number().optional()
+});
+function toTokenResult(grant, nowMs) {
+  return {
+    tokens: {
+      accessToken: grant.accessToken,
+      refreshToken: grant.refreshToken,
+      idToken: grant.idToken
+    },
+    expiresAt: grant.expiresIn !== void 0 ? nowMs + grant.expiresIn * 1e3 : void 0
+  };
+}
+function createTokenClient(cfg) {
+  const fetchFn = cfg.fetchFn ?? fetch;
+  const timeoutMs = cfg.timeoutMs ?? 3e4;
+  let metadataPromise;
+  const metadata = () => {
+    metadataPromise ??= discoverMetadata(cfg.issuer, { fetchFn, timeoutMs }).catch((error) => {
+      metadataPromise = void 0;
+      throw error;
+    });
+    return metadataPromise;
+  };
+  async function postToken(form, errorOf, headers = {}) {
+    const grantType = form.grant_type;
+    const md = await metadata();
+    let res;
+    try {
+      res = await fetchFn(md.token_endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+          ...headers
+        },
+        body: new URLSearchParams({ client_id: cfg.clientId, ...form }).toString(),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (error) {
+      throw new AuthError(errorOf(0), `token request (${grantType}) failed`, { cause: error });
+    }
+    cfg.logger?.debug("token endpoint responded", { grantType, status: res.status });
+    if (!res.ok) {
+      throw new AuthError(
+        errorOf(res.status),
+        `token request (${grantType}) returned ${res.status}`
+      );
+    }
+    try {
+      const parsed = tokenResponseSchema.parse(await res.json());
+      return {
+        accessToken: parsed.access_token,
+        refreshToken: parsed.refresh_token,
+        idToken: parsed.id_token,
+        expiresIn: parsed.expires_in
+      };
+    } catch (error) {
+      throw new AuthError(errorOf(0), `token response (${grantType}) malformed`, { cause: error });
+    }
+  }
+  const withSecret = (form) => cfg.clientSecret === void 0 ? form : { ...form, client_secret: cfg.clientSecret };
+  const tenantParts = (tenant) => tenant && cfg.tenantPropagation !== void 0 ? cfg.tenantPropagation(tenant) : {};
+  return {
+    metadata,
+    exchangeCode: (p) => postToken(
+      withSecret({
+        grant_type: "authorization_code",
+        code: p.code,
+        code_verifier: p.codeVerifier,
+        redirect_uri: p.redirectUri
+      }),
+      () => "exchange_failed"
+    ),
+    passwordGrant: (p) => postToken(
+      withSecret({
+        grant_type: "password",
+        username: p.userName,
+        password: p.password,
+        ...cfg.scope === void 0 ? {} : { scope: cfg.scope }
+      }),
+      (status) => status === 400 ? "invalid_credentials" : "exchange_failed",
+      tenantParts(p.tenant).headers
+    ),
+    refreshGrant: (refreshToken) => postToken(
+      withSecret({ grant_type: "refresh_token", refresh_token: refreshToken }),
+      () => "refresh_failed"
+    ),
+    revoke: async (refreshToken) => {
+      const md = await metadata();
+      if (md.revocation_endpoint === void 0) return;
+      await fetchFn(md.revocation_endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(
+          withSecret({
+            token: refreshToken,
+            token_type_hint: "refresh_token",
+            client_id: cfg.clientId
+          })
+        ).toString(),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    },
+    authorizeUrl: async (p) => {
+      const md = await metadata();
+      const url = new URL(md.authorization_endpoint);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", cfg.clientId);
+      url.searchParams.set("redirect_uri", p.redirectUri);
+      url.searchParams.set("scope", cfg.scope ?? "openid profile");
+      url.searchParams.set("state", p.state);
+      url.searchParams.set("nonce", p.nonce);
+      url.searchParams.set("code_challenge", p.codeChallenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      for (const [key, value] of Object.entries(tenantParts(p.tenant).query ?? {})) {
+        url.searchParams.set(key, value);
+      }
+      return url.toString();
+    },
+    endSessionUrl: async (p) => {
+      const md = await metadata();
+      if (md.end_session_endpoint === void 0) return null;
+      const url = new URL(md.end_session_endpoint);
+      if (p.idToken !== void 0) url.searchParams.set("id_token_hint", p.idToken);
+      if (p.postLogoutRedirectUri !== void 0)
+        url.searchParams.set("post_logout_redirect_uri", p.postLogoutRedirectUri);
+      return url.toString();
+    }
+  };
+}
+
+// src/auth/manager.ts
+function createSessionManager(deps) {
+  const now = deps.now ?? (() => Date.now());
+  const skewMs = (deps.skewSeconds ?? 60) * 1e3;
+  const ttlMs = deps.coalesceTtlMs ?? 1e4;
+  const revokeTimeoutMs = deps.revokeTimeoutMs ?? 2e3;
+  const inflight = /* @__PURE__ */ new Map();
+  const coalescedGrant = (refreshToken) => {
+    const at = now();
+    for (const [key, entry] of inflight) {
+      if (at - entry.at >= ttlMs) inflight.delete(key);
+    }
+    const hit = inflight.get(refreshToken);
+    if (hit !== void 0) return hit.promise;
+    const promise = deps.refreshGrant(refreshToken);
+    inflight.set(refreshToken, { at, promise });
+    promise.catch(() => inflight.delete(refreshToken));
+    return promise;
+  };
+  const revokeWithTimeout = async (revoke, refreshToken) => {
+    const revoking = revoke(refreshToken);
+    revoking.catch(() => {
+    });
+    let timer;
+    try {
+      await Promise.race([
+        revoking,
+        new Promise((_, reject) => {
+          timer = setTimeout(
+            () => reject(new Error(`revoke timed out after ${revokeTimeoutMs}ms`)),
+            revokeTimeoutMs
+          );
+        })
+      ]);
+    } catch (error) {
+      deps.logger?.warn("token revocation failed", { error: String(error) });
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  return {
+    establish: (result, ctx) => deps.store.save(
+      {
+        tokens: result.tokens,
+        expiresAt: result.expiresAt,
+        tenant: ctx?.tenant,
+        culture: ctx?.culture
+      },
+      ctx?.cookieHeader
+    ),
+    current: (cookieHeader) => deps.store.load(cookieHeader),
+    isExpired: (session) => session.expiresAt !== void 0 && now() >= session.expiresAt - skewMs,
+    refresh: async (session, cookieHeader) => {
+      const refreshToken = session.tokens.refreshToken;
+      if (refreshToken === void 0) return null;
+      try {
+        const grant = await coalescedGrant(refreshToken);
+        const result = toTokenResult(grant, now());
+        const next = {
+          tokens: {
+            ...result.tokens,
+            // IdP 未轮换时沿用旧 refresh token，否则会话将失去续期能力。
+            refreshToken: result.tokens.refreshToken ?? refreshToken
+          },
+          expiresAt: result.expiresAt,
+          tenant: session.tenant,
+          culture: session.culture
+        };
+        const setCookies = await deps.store.save(next, cookieHeader);
+        deps.logger?.debug("session refreshed", {
+          rotated: result.tokens.refreshToken !== void 0 && result.tokens.refreshToken !== refreshToken
+        });
+        return { session: next, setCookies };
+      } catch (error) {
+        deps.logger?.warn("session refresh failed", { error: String(error) });
+        return null;
+      }
+    },
+    destroy: async (cookieHeader) => {
+      const session = await deps.store.load(cookieHeader);
+      const refreshToken = session?.tokens.refreshToken;
+      if (refreshToken !== void 0 && deps.revoke !== void 0) {
+        await revokeWithTimeout(deps.revoke, refreshToken);
+      }
+      deps.logger?.debug("session destroyed", { hadSession: session !== null });
+      return deps.store.clear(cookieHeader);
+    }
+  };
+}
+
+// src/auth/create-auth.ts
+function createAuth(opts) {
+  const strategies = new Map(opts.strategies.map((s) => [s.name, s]));
+  const session = createSessionManager({
+    store: opts.store,
+    refreshGrant: opts.refreshGrant,
+    revoke: opts.revoke,
+    logger: opts.logger,
+    now: opts.now,
+    revokeTimeoutMs: opts.revokeTimeoutMs,
+    skewSeconds: opts.skewSeconds,
+    coalesceTtlMs: opts.coalesceTtlMs
+  });
+  return {
+    strategy: (name) => {
+      const strategy = strategies.get(name);
+      if (strategy === void 0) throw new Error(`unknown auth strategy: ${name}`);
+      return strategy;
+    },
+    session,
+    identity: async (session2, ctx = { cookieHeader: null }) => {
+      const startedAt = (opts.now ?? Date.now)();
+      const identity = await opts.resolveIdentity(session2, ctx);
+      opts.logger?.debug("identity resolved", {
+        isAuthenticated: identity.isAuthenticated,
+        policies: Object.keys(identity.grantedPolicies).length,
+        ms: (opts.now ?? Date.now)() - startedAt
+      });
+      return identity;
+    }
+  };
+}
+
+// src/auth/culture.ts
+function parseCultureCookie(value) {
+  if (!value) return null;
+  for (const part of value.split("|")) {
+    if (part.startsWith("c=")) return part.slice(2);
+  }
+  return null;
+}
+function formatCultureCookie(culture) {
+  return `c=${culture}|uic=${culture}`;
+}
+
+// src/auth/oidc/claims.ts
+function decodeIdTokenClaims(idToken) {
+  const payload = idToken.split(".")[1];
+  if (payload === void 0) return {};
+  try {
+    return JSON.parse(new TextDecoder().decode(base64UrlToBytes(payload)));
+  } catch {
+    return {};
+  }
+}
+
+// src/auth/pkce.ts
+function generateRandomString(byteLength = 32) {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return bytesToBase64Url(bytes);
+}
+async function generatePkce() {
+  const verifier = generateRandomString(32);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: bytesToBase64Url(new Uint8Array(digest)) };
+}
+
+// src/auth/return-url.ts
+function hasBrowserStrippedChars(value) {
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0;
+    if (code <= 32 || code === 127) return true;
+  }
+  return false;
+}
+function sanitizeReturnUrl(value) {
+  if (!value?.startsWith("/") || value.startsWith("//") || value.startsWith("/\\")) {
+    return "/";
+  }
+  if (hasBrowserStrippedChars(value)) {
+    return "/";
+  }
+  return value;
+}
+
+// src/auth/strategies/oidc.ts
+function oidcStrategy(cfg) {
+  const now = cfg.now ?? (() => Date.now());
+  const random = cfg.random ?? generateRandomString;
+  const pkce = cfg.pkce ?? generatePkce;
+  const handshakeMaxAgeMs = (cfg.handshakeMaxAgeSeconds ?? 600) * 1e3;
+  return {
+    name: "oidc",
+    async begin(input) {
+      const { verifier, challenge } = await pkce();
+      const handshake = {
+        state: random(),
+        nonce: random(),
+        codeVerifier: verifier,
+        returnUrl: input.returnUrl,
+        issuedAt: now()
+      };
+      const redirectUrl = await cfg.tokenClient.authorizeUrl({
+        state: handshake.state,
+        nonce: handshake.nonce,
+        codeChallenge: challenge,
+        redirectUri: cfg.redirectUri,
+        tenant: input.tenant
+      });
+      cfg.logger?.debug("oidc begin", {
+        host: new URL(redirectUrl).host,
+        stateBytes: handshake.state.length
+      });
+      return { redirectUrl, handshake };
+    },
+    async complete(input) {
+      if (input.kind !== "callback") {
+        throw new AuthError("invalid_input", "oidc strategy only completes callback inputs");
+      }
+      if (now() - input.handshake.issuedAt > handshakeMaxAgeMs) {
+        throw new AuthError("handshake_expired", "handshake outlived its server-side lifetime");
+      }
+      const code = input.params.get("code");
+      const state = input.params.get("state");
+      if (state !== input.handshake.state) throw new AuthError("invalid_state");
+      const providerError = input.params.get("error");
+      if (providerError !== null) {
+        cfg.logger?.debug("oidc provider error", {
+          error: providerError,
+          description: input.params.get("error_description") ?? void 0
+        });
+        throw new AuthError("provider_denied", `provider returned error: ${providerError}`);
+      }
+      if (code === null) throw new AuthError("exchange_failed", "callback carried no code");
+      const grant = await cfg.tokenClient.exchangeCode({
+        code,
+        codeVerifier: input.handshake.codeVerifier,
+        redirectUri: cfg.redirectUri
+      });
+      if (grant.idToken !== void 0) {
+        if (decodeIdTokenClaims(grant.idToken).nonce !== input.handshake.nonce) {
+          throw new AuthError("invalid_nonce");
+        }
+      }
+      cfg.logger?.debug("oidc complete", { hasRefreshToken: grant.refreshToken !== void 0 });
+      return toTokenResult(grant, now());
+    },
+    logoutUrl: (p) => cfg.tokenClient.endSessionUrl(p)
+  };
+}
+
+// src/auth/strategies/password.ts
+function passwordStrategy(cfg) {
+  const now = cfg.now ?? (() => Date.now());
+  return {
+    name: "password",
+    async complete(input) {
+      if (input.kind !== "credentials") {
+        throw new AuthError("invalid_input", "password strategy only completes credentials");
+      }
+      const grant = await cfg.tokenClient.passwordGrant({
+        userName: input.userName,
+        password: input.password,
+        tenant: input.tenant
+      });
+      cfg.logger?.debug("password attempt succeeded", {
+        userName: `${input.userName[0] ?? ""}***`
+      });
+      return toTokenResult(grant, now());
+    }
+  };
+}
+
+export {
+  createCodec,
+  serializeCookie,
+  clearCookie,
+  parseCookieHeader,
+  COOKIE_CHUNK_SIZE,
+  chunkCookieValue,
+  readChunkedCookie,
+  clearChunkedCookie,
+  authTokensSchema,
+  authSessionSchema,
+  handshakeSchema,
+  createCookieSessionStore,
+  AuthError,
+  oidcMetadataSchema,
+  discoverMetadata,
+  toTokenResult,
+  createTokenClient,
+  createSessionManager,
+  createAuth,
+  parseCultureCookie,
+  formatCultureCookie,
+  decodeIdTokenClaims,
+  generateRandomString,
+  generatePkce,
+  sanitizeReturnUrl,
+  oidcStrategy,
+  passwordStrategy
+};