@marktiderman/genesis-connect 0.0.0-stage → 0.1.1

package/dist/index.cjs

@@ -0,0 +1,847 @@
+'use strict';
+
+var chunkEUEVGKB6_cjs = require('./chunk-EUEVGKB6.cjs');
+
+// src/providers.ts
+var googleProvider = {
+  id: "google",
+  authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenUrl: "https://oauth2.googleapis.com/token",
+  revokeUrl: "https://oauth2.googleapis.com/revoke",
+  defaultScopes: [],
+  authorizeParams: {
+    access_type: "offline",
+    // Without consent on every sign-in, Google sends a refresh token only the first time.
+    prompt: "consent",
+    // Only the scopes asked for now, so the granted-scope check means what it says.
+    include_granted_scopes: "false"
+  },
+  tokenAuth: "client_secret_post",
+  scopeAliases: {
+    email: "https://www.googleapis.com/auth/userinfo.email",
+    profile: "https://www.googleapis.com/auth/userinfo.profile",
+    openid: "openid"
+  }
+};
+var GOOGLE_SCOPES = {
+  /** OpenID Connect: an ID token naming the account. */
+  openid: "openid",
+  /** The account's email address (Google grants it as `…/auth/userinfo.email`). */
+  email: "email",
+  /** The account's name and picture (granted as `…/auth/userinfo.profile`). */
+  profile: "profile",
+  /** Files the person picked or created through the app, and nothing else. */
+  driveFile: "https://www.googleapis.com/auth/drive.file",
+  /** Every spreadsheet the person can reach. Prefer `driveFile`. */
+  spreadsheets: "https://www.googleapis.com/auth/spreadsheets",
+  /** Events on the person's calendars. */
+  calendarEvents: "https://www.googleapis.com/auth/calendar.events",
+  /** Send mail as the person. */
+  gmailSend: "https://www.googleapis.com/auth/gmail.send"
+};
+
+// src/oauth.ts
+var CONNECT_RESULTS = [
+  "connected",
+  "expired",
+  "browser",
+  "denied",
+  "scope",
+  "failed"
+];
+var ConnectError = class extends Error {
+  name = "ConnectError";
+  code;
+  retryable;
+  status;
+  retryAfterSeconds;
+  /**
+   * Set when the provider rotated the refresh token but it could not be
+   * handed over (no `onRotate`, or `onRotate` threw): the new one, sealed to
+   * the same row. Store it in place of the old one, or the grant is lost.
+   */
+  sealedRefreshToken;
+  constructor(code, message, options = {}) {
+    super(message);
+    this.code = code;
+    this.retryable = code === "unavailable";
+    this.status = options.status;
+    this.retryAfterSeconds = options.retryAfterSeconds;
+    this.sealedRefreshToken = options.sealedRefreshToken;
+  }
+};
+var CONNECT_ERROR_CODES = [
+  "config",
+  "usage",
+  "revoked",
+  "unavailable",
+  "failed"
+];
+function isConnectError(error) {
+  return error instanceof Error && error.name === "ConnectError" && CONNECT_ERROR_CODES.includes(error.code);
+}
+var PUBLIC_SUFFIXES = /* @__PURE__ */ new Set([
+  "vercel.app",
+  "netlify.app",
+  "pages.dev",
+  "workers.dev",
+  "github.io",
+  "herokuapp.com",
+  "onrender.com",
+  "fly.dev",
+  "web.app",
+  "firebaseapp.com",
+  "azurewebsites.net",
+  "appspot.com",
+  "ngrok-free.app",
+  "ngrok.io",
+  "cloudfront.net",
+  "up.railway.app",
+  "deno.dev",
+  "co.uk",
+  "com.au",
+  "co.jp",
+  "com.br",
+  "co.in"
+]);
+var COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var SCOPE_TOKEN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+var HOSTNAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+var RESERVED_PARAMS = /* @__PURE__ */ new Set([
+  "client_id",
+  "redirect_uri",
+  "response_type",
+  "scope",
+  "state",
+  "code_challenge",
+  "code_challenge_method"
+]);
+var isLocal = (hostname) => hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+function checkOrigin(value, what) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConnectError("config", `${what} is not a URL`);
+  }
+  const origin = value.replace(/\/+$/, "");
+  if (url.origin !== origin)
+    throw new ConnectError(
+      "config",
+      `${what} must be an origin only (scheme, host and port)`
+    );
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocal(url.hostname))) {
+    throw new ConnectError(
+      "config",
+      `${what} must be https (http only on localhost)`
+    );
+  }
+  return origin;
+}
+function checkPath(value, what) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || /[\\\s\x00-\x1f\x7f]/.test(value) || value.length > 512) {
+    throw new ConnectError(
+      "usage",
+      `${what} must be a path on this app, starting with one /`
+    );
+  }
+  const url = new URL(value, "https://origin.invalid");
+  if (url.origin !== "https://origin.invalid")
+    throw new ConnectError(
+      "usage",
+      `${what} must be a path on this app, starting with one /`
+    );
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+var onDomain = (hostname, domain) => hostname === domain || hostname.endsWith(`.${domain}`);
+function isSafeReturnOrigin(origin, domain) {
+  try {
+    const url = new URL(origin);
+    return url.protocol === "https:" && url.port === "" && url.origin === origin && onDomain(url.hostname, domain);
+  } catch {
+    return false;
+  }
+}
+function scopeList(scopes, separator) {
+  const list = [...new Set(scopes ?? [])];
+  for (const scope of list) {
+    if (typeof scope !== "string" || !SCOPE_TOKEN.test(scope) || scope.includes(separator))
+      throw new ConnectError(
+        "usage",
+        "A scope is malformed (no spaces, quotes or the provider's separator)"
+      );
+  }
+  return list;
+}
+var DEFAULT_TIMEOUT_MS = 1e4;
+async function timedFetch(deps, url, init, signal) {
+  const timeout = AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  const combined = signal ? anySignal([timeout, signal]) : timeout;
+  try {
+    return await (deps.fetch ?? fetch)(url, {
+      ...init,
+      redirect: "error",
+      signal: combined
+    });
+  } catch (error) {
+    const name = error instanceof Error ? error.name : "";
+    if (name === "TimeoutError")
+      throw new ConnectError(
+        "unavailable",
+        "The provider did not answer in time"
+      );
+    if (name === "AbortError")
+      throw new ConnectError("unavailable", "The request was aborted");
+    throw new ConnectError("unavailable", "The provider could not be reached");
+  }
+}
+function anySignal(signals) {
+  const any = AbortSignal.any;
+  if (any) return any(signals);
+  const controller = new AbortController();
+  for (const signal of signals) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      break;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), {
+      once: true
+    });
+  }
+  return controller.signal;
+}
+function discard(response) {
+  try {
+    void response.body?.cancel().catch(() => {
+    });
+  } catch {
+  }
+}
+async function jsonBody(response) {
+  const value = await response.json().catch(() => null);
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function errorCode(body) {
+  const code = body["error"];
+  return typeof code === "string" && /^[a-z_]{1,64}$/.test(code) ? code : void 0;
+}
+function retryAfter(response) {
+  const header = response.headers.get("retry-after")?.trim();
+  return header && /^\d+$/.test(header) ? Math.min(86400, Math.max(1, Number(header))) : void 0;
+}
+var isRetryableStatus = (status) => status === 408 || status === 425 || status === 429 || status >= 500;
+var tokenCache = /* @__PURE__ */ new Map();
+var inFlight = /* @__PURE__ */ new Map();
+var TOKEN_CACHE_LIMIT = 1e3;
+function clearAccessTokenCache() {
+  tokenCache.clear();
+}
+function createConnector(config) {
+  const { provider } = config;
+  if (!provider?.id || !provider.authorizeUrl || !provider.tokenUrl)
+    throw new ConnectError(
+      "config",
+      "The provider needs an id, an authorize URL and a token URL"
+    );
+  if (!config.clientId || !config.clientSecret)
+    throw new ConnectError(
+      "config",
+      `The ${provider.id} OAuth client id or secret is not set`
+    );
+  if (!config.secrets)
+    throw new ConnectError(
+      "config",
+      "The connector needs secrets (createSecrets) to seal refresh tokens"
+    );
+  if (typeof config.store !== "function")
+    throw new ConnectError("config", "The connector needs a store function");
+  let stateKeyBytes;
+  try {
+    stateKeyBytes = chunkEUEVGKB6_cjs.secretKeyBytes(config.stateSecret);
+  } catch (error) {
+    throw new ConnectError(
+      "config",
+      `The state secret: ${error.message}`
+    );
+  }
+  const callbackPath = checkPath(config.callbackPath, "callbackPath");
+  const redirectOrigin = config.redirectOrigin ? checkOrigin(config.redirectOrigin, "redirectOrigin") : void 0;
+  const sharedDomain = config.sharedDomain?.trim().toLowerCase().replace(/^\./, "") || void 0;
+  if (sharedDomain) {
+    if (!HOSTNAME.test(sharedDomain) || PUBLIC_SUFFIXES.has(sharedDomain) || config.isPublicSuffix?.(sharedDomain)) {
+      throw new ConnectError(
+        "config",
+        "sharedDomain must be a registrable domain such as example.com, not a public suffix"
+      );
+    }
+    if (redirectOrigin && !onDomain(new URL(redirectOrigin).hostname, sharedDomain)) {
+      throw new ConnectError(
+        "config",
+        "redirectOrigin must be on sharedDomain"
+      );
+    }
+  }
+  const cookieName = config.cookieName ?? `genesis_connect_${provider.id.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+  if (!COOKIE_NAME.test(cookieName))
+    throw new ConnectError("config", "cookieName is not a valid cookie name");
+  const cookiePath = checkPath(
+    config.cookiePath ?? callbackPath,
+    "cookiePath"
+  ).replace(/[?#].*$/, "");
+  if (/[;,]/.test(cookiePath)) {
+    throw new ConnectError("config", "cookiePath can't hold ; or ,");
+  }
+  const callbackPathOnly = callbackPath.replace(/[?#].*$/, "");
+  if (cookiePath !== callbackPathOnly && !callbackPathOnly.startsWith(
+    cookiePath.endsWith("/") ? cookiePath : `${cookiePath}/`
+  ))
+    throw new ConnectError("config", "cookiePath must cover callbackPath");
+  const ttl = Math.floor(config.stateTtlSeconds ?? 600);
+  if (!(ttl >= 60 && ttl <= 3600))
+    throw new ConnectError(
+      "config",
+      "stateTtlSeconds must be between 60 and 3600"
+    );
+  const resultParam = config.resultParam ?? "connect";
+  const fallbackPath = checkPath(config.fallbackPath ?? "/", "fallbackPath");
+  const aadFor = config.aad ?? ((id) => `${provider.id}-grant:${id}`);
+  const separator = provider.scopeSeparator ?? " ";
+  const defaultScopes = scopeList(
+    config.scopes ?? provider.defaultScopes,
+    separator
+  );
+  const aliases = provider.scopeAliases ?? {};
+  const normalScope = (scope) => aliases[scope] ?? scope;
+  const now = () => config.now?.() ?? Date.now();
+  const log = (event) => {
+    try {
+      config.log?.(event);
+    } catch {
+    }
+  };
+  let stateKey;
+  const hmacKey = () => stateKey ??= crypto.subtle.importKey("raw", stateKeyBytes, "HKDF", false, ["deriveKey"]).then(
+    (base) => crypto.subtle.deriveKey(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(0),
+        info: chunkEUEVGKB6_cjs.utf8.encode(`genesis-connect/state/${provider.id}`)
+      },
+      base,
+      { name: "HMAC", hash: "SHA-256", length: 256 },
+      false,
+      ["sign", "verify"]
+    )
+  );
+  async function signState(state) {
+    const body = chunkEUEVGKB6_cjs.base64url(
+      JSON.stringify({
+        v: 1,
+        s: state.subject,
+        i: state.intent,
+        r: state.returnTo,
+        o: state.origin,
+        n: state.nonce,
+        e: state.expiresAt,
+        c: state.scopes,
+        d: state.data
+      })
+    );
+    const mac = await crypto.subtle.sign(
+      "HMAC",
+      await hmacKey(),
+      chunkEUEVGKB6_cjs.utf8.encode(body)
+    );
+    return `${body}.${chunkEUEVGKB6_cjs.base64url(new Uint8Array(mac))}`;
+  }
+  async function verifyState(signed) {
+    if (!signed || signed.length > 4096) return null;
+    const [body, mac, extra] = signed.split(".");
+    if (!body || !mac || extra !== void 0) return null;
+    try {
+      if (!await crypto.subtle.verify(
+        "HMAC",
+        await hmacKey(),
+        chunkEUEVGKB6_cjs.fromBase64(mac),
+        chunkEUEVGKB6_cjs.utf8.encode(body)
+      ))
+        return null;
+      const raw = JSON.parse(
+        new TextDecoder().decode(chunkEUEVGKB6_cjs.fromBase64(body))
+      );
+      const state = {
+        subject: String(raw["s"] ?? ""),
+        intent: String(raw["i"] ?? ""),
+        returnTo: checkPath(String(raw["r"] ?? ""), "returnTo"),
+        origin: String(raw["o"] ?? ""),
+        nonce: String(raw["n"] ?? ""),
+        expiresAt: Number(raw["e"]),
+        scopes: Array.isArray(raw["c"]) ? raw["c"].filter((s) => typeof s === "string") : [],
+        data: raw["d"] && typeof raw["d"] === "object" && !Array.isArray(raw["d"]) ? raw["d"] : {}
+      };
+      if (raw["v"] !== 1 || !state.subject || !state.nonce || !Number.isFinite(state.expiresAt))
+        return null;
+      if (state.expiresAt * 1e3 <= now()) return null;
+      return state;
+    } catch {
+      return null;
+    }
+  }
+  const originOf = (request) => new URL(request.url).origin;
+  const redirectUri = (request) => `${redirectOrigin ?? originOf(request)}${callbackPath}`;
+  const cookieDomain = (request) => sharedDomain && onDomain(new URL(request.url).hostname, sharedDomain) ? sharedDomain : void 0;
+  const isLocalRequest = (request) => isLocal(new URL(request.url).hostname);
+  function cookie(request, value, maxAge, domain = cookieDomain(request) ?? null) {
+    const secure = isLocalRequest(request) ? "" : "; Secure";
+    return `${cookieName}=${value}; Path=${cookiePath}; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}${domain ? `; Domain=${domain}` : ""}`;
+  }
+  function cookieValues(request) {
+    const values = [];
+    for (const part of (request.headers.get("cookie") ?? "").split(";")) {
+      const at = part.indexOf("=");
+      if (at > 0 && part.slice(0, at).trim() === cookieName)
+        values.push(part.slice(at + 1).trim());
+    }
+    return values;
+  }
+  function returnOrigin(request, started) {
+    const here = originOf(request);
+    if (!started || started === here) return here;
+    if (sharedDomain && cookieDomain(request) && isSafeReturnOrigin(started, sharedDomain))
+      return started;
+    return here;
+  }
+  function back(request, state, result, extra = {}, detail) {
+    const url = new URL(
+      state?.returnTo ?? fallbackPath,
+      returnOrigin(request, state?.origin)
+    );
+    for (const [key, value] of Object.entries(extra)) {
+      if (key !== resultParam && typeof value === "string")
+        url.searchParams.set(key, value);
+    }
+    url.searchParams.set(resultParam, result);
+    log({ step: "callback", result, ...detail ? { detail } : {} });
+    const headers = new Headers({
+      location: url.toString(),
+      "cache-control": "no-store",
+      "referrer-policy": "no-referrer"
+    });
+    headers.append("set-cookie", cookie(request, "", 0, null));
+    const domain = cookieDomain(request);
+    if (domain) headers.append("set-cookie", cookie(request, "", 0, domain));
+    return new Response(null, { status: 303, headers });
+  }
+  function clientAuth(body, headers) {
+    if (provider.tokenAuth === "client_secret_basic") {
+      const encode = (s) => encodeURIComponent(s).replace(/%20/g, "+");
+      headers["authorization"] = `Basic ${btoa(`${encode(config.clientId)}:${encode(config.clientSecret)}`)}`;
+    } else {
+      body.set("client_id", config.clientId);
+      body.set("client_secret", config.clientSecret);
+    }
+  }
+  async function tokenRequest(params, signal) {
+    const body = new URLSearchParams(params);
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    };
+    clientAuth(body, headers);
+    return timedFetch(
+      config,
+      provider.tokenUrl,
+      { method: "POST", headers, body: body.toString() },
+      signal
+    );
+  }
+  const granted = (body, asked) => {
+    const scope = typeof body["scope"] === "string" ? body["scope"] : asked.join(separator);
+    return {
+      scope,
+      scopes: scope.split(separator).filter(Boolean).map(normalScope)
+    };
+  };
+  const expiresIn = (body) => {
+    const value = Number(body["expires_in"]);
+    return Number.isFinite(value) && value > 0 ? value : 3600;
+  };
+  async function cacheKey(refreshToken) {
+    return chunkEUEVGKB6_cjs.sha256Hex(`${provider.id}
+${config.clientId}
+${refreshToken}`);
+  }
+  async function refreshWith(refreshToken, aad, signal) {
+    const response = await tokenRequest(
+      { grant_type: "refresh_token", refresh_token: refreshToken },
+      signal
+    );
+    if (!response.ok) {
+      const body2 = await jsonBody(response);
+      const code = errorCode(body2);
+      if (response.status === 400 && code === "invalid_grant") {
+        log({ step: "refresh", result: "revoked" });
+        throw new ConnectError(
+          "revoked",
+          `The ${provider.id} connection was removed. Connect it again.`,
+          { status: 400 }
+        );
+      }
+      const detail = `token endpoint answered ${response.status}${code ? ` (${code})` : ""}`;
+      if (isRetryableStatus(response.status)) {
+        log({ step: "refresh", result: "unavailable", detail });
+        throw new ConnectError("unavailable", `The ${provider.id} ${detail}`, {
+          status: response.status,
+          retryAfterSeconds: retryAfter(response)
+        });
+      }
+      log({ step: "refresh", result: "failed", detail });
+      throw new ConnectError("failed", `The ${provider.id} ${detail}`, {
+        status: response.status
+      });
+    }
+    const body = await jsonBody(response);
+    const accessToken = body["access_token"];
+    if (typeof accessToken !== "string" || !accessToken)
+      throw new ConnectError(
+        "unavailable",
+        `The ${provider.id} token endpoint sent no access token`
+      );
+    const rotated = typeof body["refresh_token"] === "string" && body["refresh_token"] && body["refresh_token"] !== refreshToken ? body["refresh_token"] : void 0;
+    const sealedRefreshToken = rotated ? await config.secrets.seal(rotated, aad) : void 0;
+    return {
+      accessToken,
+      expiresIn: expiresIn(body),
+      scope: granted(body, []).scope,
+      ...sealedRefreshToken ? { sealedRefreshToken, rotatedPlain: rotated } : {}
+    };
+  }
+  async function handOver(fresh, options, required) {
+    const sealedRefreshToken = fresh.sealedRefreshToken;
+    if (!sealedRefreshToken) return;
+    if (!options.onRotate) {
+      if (!required) return;
+      log({
+        step: "refresh",
+        result: "usage",
+        detail: "rotated without onRotate"
+      });
+      throw new ConnectError(
+        "usage",
+        `The ${provider.id} refresh token was rotated and no onRotate was given to store it: store this error's sealedRefreshToken`,
+        { sealedRefreshToken }
+      );
+    }
+    try {
+      await options.onRotate(sealedRefreshToken);
+    } catch {
+      log({ step: "refresh", result: "failed", detail: "onRotate threw" });
+      throw new ConnectError(
+        "failed",
+        `Storing the rotated ${provider.id} refresh token failed: store this error's sealedRefreshToken`,
+        { sealedRefreshToken }
+      );
+    }
+  }
+  const publicResult = (fresh) => ({
+    accessToken: fresh.accessToken,
+    expiresIn: fresh.expiresIn,
+    scope: fresh.scope,
+    ...fresh.sealedRefreshToken ? { sealedRefreshToken: fresh.sealedRefreshToken } : {}
+  });
+  async function cacheToken(refreshToken, fresh, at) {
+    const entry = {
+      token: fresh.accessToken,
+      expiresAt: at + fresh.expiresIn * 1e3
+    };
+    for (const plain of [refreshToken, fresh.rotatedPlain]) {
+      if (!plain) continue;
+      if (tokenCache.size >= TOKEN_CACHE_LIMIT)
+        tokenCache.delete(tokenCache.keys().next().value);
+      tokenCache.set(await cacheKey(plain), entry);
+    }
+  }
+  return {
+    provider,
+    redirectUri,
+    async start(request, options) {
+      const subject = typeof options.subject === "string" ? options.subject.trim() : "";
+      if (!subject || subject.length > 256)
+        throw new ConnectError(
+          "usage",
+          "start needs the signed-in subject (at most 256 characters)"
+        );
+      const intent = options.intent ?? "";
+      if (typeof intent !== "string" || intent.length > 64)
+        throw new ConnectError("usage", "intent must be at most 64 characters");
+      const returnTo = checkPath(options.returnTo, "returnTo");
+      if (new URL(request.url).protocol !== "https:" && !isLocalRequest(request)) {
+        throw new ConnectError(
+          "config",
+          "start needs https (http only on localhost); behind a TLS-ending proxy, pass a Request with the public https URL"
+        );
+      }
+      if (redirectOrigin && originOf(request) !== redirectOrigin && !cookieDomain(request)) {
+        throw new ConnectError(
+          "config",
+          "This origin can't finish on the pinned redirectOrigin: it is not on sharedDomain"
+        );
+      }
+      const scopes = options.scopes ? scopeList(options.scopes, separator) : defaultScopes;
+      if (scopes.length === 0)
+        throw new ConnectError(
+          "usage",
+          "No scopes to ask for: give the connector or start some"
+        );
+      const nonce = chunkEUEVGKB6_cjs.randomToken(16);
+      const verifier = chunkEUEVGKB6_cjs.randomToken(32);
+      const state = await signState({
+        subject,
+        intent,
+        returnTo,
+        origin: originOf(request),
+        nonce,
+        expiresAt: Math.floor(now() / 1e3) + ttl,
+        scopes,
+        data: options.data ?? {}
+      });
+      if (state.length > 2048)
+        throw new ConnectError(
+          "usage",
+          "The state is too large: keep data small"
+        );
+      const challenge = chunkEUEVGKB6_cjs.base64url(
+        new Uint8Array(
+          await crypto.subtle.digest("SHA-256", chunkEUEVGKB6_cjs.utf8.encode(verifier))
+        )
+      );
+      const url = new URL(provider.authorizeUrl);
+      for (const [key, value] of Object.entries(provider.authorizeParams ?? {}))
+        url.searchParams.set(key, value);
+      for (const [key, value] of Object.entries(options.params ?? {})) {
+        if (RESERVED_PARAMS.has(key))
+          throw new ConnectError(
+            "usage",
+            `start can't set the ${key} parameter`
+          );
+        url.searchParams.set(key, value);
+      }
+      url.searchParams.set("client_id", config.clientId);
+      url.searchParams.set("redirect_uri", redirectUri(request));
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("scope", scopes.join(separator));
+      url.searchParams.set("state", state);
+      url.searchParams.set("code_challenge", challenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      const href = url.toString();
+      const setCookie = cookie(request, `${nonce}.${verifier}`, ttl);
+      const headers = { "set-cookie": setCookie, "cache-control": "no-store" };
+      return {
+        url: href,
+        setCookie,
+        redirect: () => new Response(null, {
+          status: 303,
+          headers: { ...headers, location: href }
+        }),
+        json: () => Response.json({ url: href }, { headers })
+      };
+    },
+    async callback(request) {
+      const query = new URL(request.url).searchParams;
+      const state = await verifyState(query.get("state"));
+      if (!state) return back(request, null, "expired");
+      const verifier = cookieValues(request).map((value) => value.split(".")).find(
+        ([nonce, v, extra2]) => nonce === state.nonce && v && extra2 === void 0
+      )?.[1];
+      if (!verifier) return back(request, state, "browser");
+      if (query.get("error"))
+        return back(
+          request,
+          state,
+          query.get("error") === "access_denied" ? "denied" : "failed"
+        );
+      const code = query.get("code");
+      if (!code) return back(request, state, "denied");
+      let body;
+      try {
+        const response = await tokenRequest({
+          grant_type: "authorization_code",
+          code,
+          code_verifier: verifier,
+          redirect_uri: redirectUri(request)
+        });
+        body = await jsonBody(response);
+        if (!response.ok) {
+          const code2 = errorCode(body);
+          return back(
+            request,
+            state,
+            "failed",
+            {},
+            `token endpoint answered ${response.status}${code2 ? ` (${code2})` : ""}`
+          );
+        }
+      } catch (error) {
+        return back(
+          request,
+          state,
+          "failed",
+          {},
+          error instanceof ConnectError ? error.message : "token request failed"
+        );
+      }
+      const accessToken = body["access_token"];
+      const refreshToken = body["refresh_token"];
+      if (typeof accessToken !== "string" || !accessToken) {
+        return back(request, state, "failed", {}, "no access token");
+      }
+      const { scope, scopes } = granted(body, state.scopes);
+      if (!state.scopes.every((s) => scopes.includes(normalScope(s))))
+        return back(request, state, "scope");
+      if ((config.requireRefreshToken ?? true) && (typeof refreshToken !== "string" || !refreshToken)) {
+        return back(
+          request,
+          state,
+          "failed",
+          {},
+          "no refresh token (is offline access asked for?)"
+        );
+      }
+      let extra;
+      try {
+        const id = config.randomId?.() ?? crypto.randomUUID();
+        const aad = aadFor(id);
+        const sealedRefreshToken = typeof refreshToken === "string" && refreshToken ? await config.secrets.seal(refreshToken, aad) : "";
+        extra = await config.store(
+          {
+            id,
+            aad,
+            sealedRefreshToken,
+            accessToken,
+            expiresIn: expiresIn(body),
+            scope,
+            scopes,
+            ...typeof body["id_token"] === "string" ? { idToken: body["id_token"] } : {},
+            subject: state.subject,
+            intent: state.intent,
+            returnTo: state.returnTo,
+            data: state.data
+          },
+          { request }
+        );
+      } catch {
+        return back(request, state, "failed", {}, "store threw");
+      }
+      return back(request, state, "connected", extra ?? {});
+    },
+    async refresh(sealedRefreshToken, aad, options = {}) {
+      const refreshToken = await config.secrets.open(sealedRefreshToken, aad);
+      const fresh = await refreshWith(refreshToken, aad, options.signal);
+      await handOver(fresh, options, false);
+      return publicResult(fresh);
+    },
+    async accessToken(sealedRefreshToken, aad, options = {}) {
+      const refreshToken = await config.secrets.open(sealedRefreshToken, aad);
+      const key = await cacheKey(refreshToken);
+      const hit = tokenCache.get(key);
+      if (hit && hit.expiresAt - 6e4 > now()) return hit.token;
+      let flight = inFlight.get(key);
+      if (!flight) {
+        const at = now();
+        flight = refreshWith(refreshToken, aad, options.signal).then(async (fresh2) => {
+          await cacheToken(refreshToken, fresh2, at);
+          return fresh2;
+        }).finally(() => inFlight.delete(key));
+        inFlight.set(key, flight);
+      }
+      const fresh = await flight;
+      await handOver(fresh, options, true);
+      return fresh.accessToken;
+    },
+    async revoke(sealedRefreshToken, aad, options = {}) {
+      const refreshToken = await config.secrets.open(sealedRefreshToken, aad);
+      tokenCache.delete(await cacheKey(refreshToken));
+      if (!provider.revokeUrl) return false;
+      const body = new URLSearchParams({
+        token: refreshToken,
+        token_type_hint: "refresh_token"
+      });
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      };
+      if (provider.revokeWithClientAuth) clientAuth(body, headers);
+      try {
+        const response = await timedFetch(
+          config,
+          provider.revokeUrl,
+          { method: "POST", headers, body: body.toString() },
+          options.signal
+        );
+        let gone = response.ok;
+        if (!gone && response.status === 400) {
+          gone = errorCode(await jsonBody(response)) === "invalid_token";
+        } else {
+          discard(response);
+        }
+        log({
+          step: "revoke",
+          result: gone ? "revoked" : "failed",
+          ...gone ? {} : { detail: `revoke endpoint answered ${response.status}` }
+        });
+        return gone;
+      } catch {
+        log({ step: "revoke", result: "unavailable" });
+        return false;
+      }
+    }
+  };
+}
+
+Object.defineProperty(exports, "KEY_ID", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.KEY_ID; }
+});
+Object.defineProperty(exports, "SecretError", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.SecretError; }
+});
+Object.defineProperty(exports, "createSecrets", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.createSecrets; }
+});
+Object.defineProperty(exports, "deriveSecretKey", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.deriveSecretKey; }
+});
+Object.defineProperty(exports, "isSecretError", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.isSecretError; }
+});
+Object.defineProperty(exports, "openWithKey", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.openWithKey; }
+});
+Object.defineProperty(exports, "parseKeyring", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.parseKeyring; }
+});
+Object.defineProperty(exports, "sealWithKey", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.sealWithKey; }
+});
+Object.defineProperty(exports, "secretKeyBytes", {
+  enumerable: true,
+  get: function () { return chunkEUEVGKB6_cjs.secretKeyBytes; }
+});
+exports.CONNECT_RESULTS = CONNECT_RESULTS;
+exports.ConnectError = ConnectError;
+exports.GOOGLE_SCOPES = GOOGLE_SCOPES;
+exports.clearAccessTokenCache = clearAccessTokenCache;
+exports.createConnector = createConnector;
+exports.googleProvider = googleProvider;
+exports.isConnectError = isConnectError;
+exports.isSafeReturnOrigin = isSafeReturnOrigin;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map