@nekm/sveltekit-armor 0.4.1 → 0.5.0

package/dist/index.mjs

@@ -0,0 +1,504 @@
+import {
+  ARMOR_LOGIN,
+  ARMOR_LOGOUT,
+  __async,
+  __spreadProps,
+  __spreadValues
+} from "./chunk-XNOIZN7U.mjs";
+
+// src/index.ts
+import { redirect as redirect6 } from "@sveltejs/kit";
+
+// src/routes/login.ts
+import { redirect as redirect2 } from "@sveltejs/kit";
+import { queryParamsCreate as queryParamsCreate2 } from "@nekm/core";
+
+// src/routes/redirect-login.ts
+import { redirect } from "@sveltejs/kit";
+import { queryParamsCreate, throwIfUndefined as throwIfUndefined2 } from "@nekm/core";
+import { createRemoteJWKSet } from "jose";
+
+// src/utils/utils.ts
+import { strTrimEnd, strTrimStart } from "@nekm/core";
+function urlConcat(origin, path) {
+  return [strTrimEnd(origin, "/"), strTrimStart(path, "/")].join("/");
+}
+function isTokenExchange(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj.access_token === "string" && obj.token_type === "Bearer" && typeof obj.expires_in === "number" && // Optional fields
+  (typeof obj.id_token === "string" || obj.id_token === void 0) && (typeof obj.refresh_token === "string" || obj.refresh_token === void 0) && (typeof obj.scope === "string" || obj.scope === void 0);
+}
+var MINUTES_MS = 60 * 1e3;
+function shouldRefresh(tokens) {
+  const idExpiry = tokens.idToken.exp * 1e3;
+  const accessExpiry = typeof tokens.accessToken !== "string" && tokens.accessToken.exp !== void 0 ? tokens.accessToken.exp * 1e3 : Infinity;
+  return Math.min(idExpiry, accessExpiry) < Date.now() + 5 * MINUTES_MS;
+}
+function createExpiresAt(seconds) {
+  const now = /* @__PURE__ */ new Date();
+  now.setSeconds(now.getSeconds() + seconds);
+  return now;
+}
+function exchangeToTokens(exchange, idToken, accessToken) {
+  return {
+    exchange,
+    idToken,
+    // Generally, IdP's require an audience to get a JWT
+    // access token. Most cases, this doesn't matter.
+    accessToken: accessToken != null ? accessToken : exchange.access_token,
+    expiresAt: createExpiresAt(exchange.expires_in)
+  };
+}
+
+// src/utils/jwt.ts
+import { jwtVerify } from "jose";
+import { throwIfUndefined } from "@nekm/core";
+function jwtIsCompactJwt(token) {
+  const parts = token.trim().split(".");
+  return parts.length === 3 && parts.every((p) => p.length > 0);
+}
+function jwtVerifyIdToken(config, jwks, idToken) {
+  const payload = jwtVerifyToken(
+    jwks,
+    {
+      issuer: config.oauth.issuer,
+      audience: config.oauth.clientId
+    },
+    idToken
+  );
+  throwIfUndefined(payload);
+  return payload;
+}
+function jwtVerifyAccessToken(config, jwks, accessToken) {
+  const opts = { issuer: config.oauth.issuer };
+  if (config.oauth.audience) {
+    opts.audience = config.oauth.audience;
+  }
+  return jwtVerifyToken(jwks, opts, accessToken);
+}
+function isInvalidCompactJwt(error) {
+  return Boolean(
+    typeof error === "object" && error && "message" in error && typeof error.message === "string" && /invalid compact jws/gi.test(error.message)
+  );
+}
+function jwtVerifyToken(jwks, opts, token) {
+  return __async(this, null, function* () {
+    try {
+      if (!jwtIsCompactJwt(token)) {
+        return void 0;
+      }
+      const { payload } = yield jwtVerify(token, jwks, opts);
+      return payload;
+    } catch (error) {
+      if (isInvalidCompactJwt(error)) {
+        return void 0;
+      }
+      throw error;
+    }
+  });
+}
+
+// src/utils/cookie.ts
+var COOKIE_TOKENS = "tokens";
+var COOKIE_STATE = "state";
+var cookieDeleteOptions = Object.freeze({ path: "/" });
+var cookieSetOptions = Object.freeze(__spreadProps(__spreadValues({}, cookieDeleteOptions), {
+  httpOnly: true,
+  secure: true,
+  sameSite: "lax",
+  maxAge: 1800
+  // 30 minutes
+}));
+function cookieSet(cookies, key, value) {
+  cookies.set(key, JSON.stringify(value), cookieSetOptions);
+}
+function cookieGetAndDelete(cookies, key) {
+  const value = cookieGet(cookies, key);
+  if (value) {
+    cookies.delete(key, cookieDeleteOptions);
+  }
+  return value;
+}
+function cookieGet(cookies, key) {
+  const value = cookies.get(key);
+  return !value ? void 0 : JSON.parse(value);
+}
+function cookieDelete(cookies, key) {
+  cookies.delete(key, cookieDeleteOptions);
+}
+
+// src/utils/event.ts
+function eventStateValid(event) {
+  var _a;
+  const state = (_a = event.url.searchParams.get("state")) != null ? _a : void 0;
+  const stateCookie = cookieGetAndDelete(event.cookies, COOKIE_STATE);
+  return state !== stateCookie;
+}
+
+// src/routes/redirect-login.ts
+var ROUTE_PATH_REDIRECT_LOGIN = "/_armor/redirect/login";
+var routeRedirectLoginFactory = (config) => {
+  var _a, _b, _c;
+  const jwksUrl = new URL(
+    (_a = config.oauth.jwksEndpoint) != null ? _a : urlConcat(config.oauth.baseUrl, ".well-known/jwks.json")
+  );
+  const tokenUrl = (_b = config.oauth.tokenEndpoint) != null ? _b : urlConcat(config.oauth.baseUrl, "oauth2/token");
+  const scope = (_c = config.oauth.scope) != null ? _c : "openid profile email";
+  function exchangeCodeForToken(fetch2, origin, code) {
+    return __async(this, null, function* () {
+      const params = {
+        grant_type: "authorization_code",
+        client_id: config.oauth.clientId,
+        client_secret: config.oauth.clientSecret,
+        code,
+        redirect_uri: urlConcat(origin, ROUTE_PATH_REDIRECT_LOGIN),
+        scope
+      };
+      if (config.oauth.audience) {
+        params.audience = config.oauth.audience;
+      }
+      const response = yield fetch2(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: new URLSearchParams(params).toString()
+      });
+      if (!response.ok) {
+        const error = yield response.text();
+        throw new Error(`Token exchange failed: ${error}`);
+      }
+      const token = yield response.json();
+      if (!isTokenExchange(token)) {
+        throw new Error("Response is not a valid token exchange.");
+      }
+      return token;
+    });
+  }
+  return {
+    path: ROUTE_PATH_REDIRECT_LOGIN,
+    handle(_0) {
+      return __async(this, arguments, function* ({ event }) {
+        var _a2, _b2, _c2, _d2, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o;
+        (_b2 = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b2.call(_a2, "Handle login redirect callback.");
+        if (!eventStateValid(event)) {
+          (_d2 = (_c2 = config.logger) == null ? void 0 : _c2.warning) == null ? void 0 : _d2.call(_c2, "State missmatch");
+          throw redirect(302, ROUTE_PATH_LOGIN);
+        }
+        const error = (_e = event.url.searchParams.get("error")) != null ? _e : void 0;
+        if (error) {
+          const error_description = (_f = event.url.searchParams.get("error_description")) != null ? _f : void 0;
+          (_h = (_g = config.logger) == null ? void 0 : _g.error) == null ? void 0 : _h.call(_g, "Login returned error.", {
+            error,
+            errorDescription: error_description
+          });
+          if (!config.oauth.errorLoginRedirectPath) {
+            return new Response(`${error}
+${error_description}`.trimEnd(), {
+              headers: {
+                "Content-Type": "text/plain"
+              }
+            });
+          }
+          const errorParams = queryParamsCreate({ error, error_description });
+          throw redirect(
+            302,
+            `${config.oauth.errorLoginRedirectPath}?${errorParams}`
+          );
+        }
+        const code = (_i = event.url.searchParams.get("code")) != null ? _i : void 0;
+        (_k = (_j = config.logger) == null ? void 0 : _j.debug) == null ? void 0 : _k.call(_j, "Get code from query params.", { code });
+        throwIfUndefined2(code);
+        const exchange = yield exchangeCodeForToken(
+          event.fetch,
+          event.url.origin,
+          code
+        );
+        (_m = (_l = config.logger) == null ? void 0 : _l.debug) == null ? void 0 : _m.call(_l, "Exchange code for tokens.", { exchange });
+        const jwks = createRemoteJWKSet(jwksUrl);
+        const [idToken, accessToken] = yield Promise.all([
+          jwtVerifyIdToken(config, jwks, exchange.id_token),
+          jwtVerifyAccessToken(config, jwks, exchange.access_token)
+        ]);
+        (_o = (_n = config.logger) == null ? void 0 : _n.debug) == null ? void 0 : _o.call(_n, "Extract and verify tokens.", {
+          idToken,
+          accessToken
+        });
+        yield config.session.login(
+          event,
+          exchangeToTokens(exchange, idToken, accessToken)
+        );
+        throw redirect(302, "/");
+      });
+    }
+  };
+};
+
+// src/routes/login.ts
+import { randomUUID } from "crypto";
+var ROUTE_PATH_LOGIN = ARMOR_LOGIN;
+var routeLoginFactory = (config) => {
+  var _a, _b;
+  const authorizeEndpoint = (_a = config.oauth.authorizeEndpoint) != null ? _a : urlConcat(config.oauth.baseUrl, "oauth2/authorize");
+  const scope = (_b = config.oauth.scope) != null ? _b : "openid profile email";
+  return {
+    path: ROUTE_PATH_LOGIN,
+    handle(_0) {
+      return __async(this, arguments, function* ({ event }) {
+        var _a2, _b2;
+        const state = randomUUID();
+        cookieSet(event.cookies, COOKIE_STATE, state);
+        const params = {
+          client_id: config.oauth.clientId,
+          response_type: "code",
+          redirect_uri: urlConcat(event.url.origin, ROUTE_PATH_REDIRECT_LOGIN),
+          state,
+          scope,
+          audience: config.oauth.audience
+        };
+        const paramsStr = queryParamsCreate2(params);
+        (_b2 = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b2.call(_a2, "Pre login redirect.", { params, state });
+        throw redirect2(302, `${authorizeEndpoint}?${paramsStr}`);
+      });
+    }
+  };
+};
+
+// src/routes/logout.ts
+import { redirect as redirect4 } from "@sveltejs/kit";
+import { queryParamsCreate as queryParamsCreate3 } from "@nekm/core";
+
+// src/routes/redirect-logout.ts
+import { redirect as redirect3 } from "@sveltejs/kit";
+var ROUTE_PATH_REDIRECT_LOGOUT = "/_armor/redirect/logout";
+var routeRedirectLogoutFactory = (config) => {
+  if (!config.oauth.logoutEndpoint) {
+    return void 0;
+  }
+  return {
+    path: ROUTE_PATH_REDIRECT_LOGOUT,
+    handle(_0) {
+      return __async(this, arguments, function* ({ event }) {
+        var _a2, _b;
+        (_b = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b.call(_a2, "Handle logout redirect callback.");
+        yield config.session.logout(event);
+        throw redirect3(302, "/");
+      });
+    }
+  };
+};
+
+// src/routes/logout.ts
+var ROUTE_PATH_LOGOUT = ARMOR_LOGOUT;
+var routeLogoutFactory = (config) => {
+  var _a;
+  if (!config.oauth.logoutEndpoint) {
+    return void 0;
+  }
+  const returnTo = (_a = config.oauth.logoutReturnToParam) != null ? _a : "logout_uri";
+  return {
+    path: ROUTE_PATH_LOGOUT,
+    handle(_0) {
+      return __async(this, arguments, function* ({ event }) {
+        var _a2, _b2;
+        const params = {
+          [returnTo]: urlConcat(event.url.origin, ROUTE_PATH_REDIRECT_LOGOUT),
+          client_id: config.oauth.clientId
+        };
+        const paramsStr = queryParamsCreate3(params);
+        (_b2 = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b2.call(_a2, "Pre logout redirect.", { params });
+        throw redirect4(302, `${config.oauth.logoutEndpoint}?${paramsStr}`);
+      });
+    }
+  };
+};
+
+// src/routes/routes.ts
+var routeFactories = Object.freeze([
+  routeLoginFactory,
+  routeLogoutFactory,
+  routeRedirectLoginFactory,
+  routeRedirectLogoutFactory
+]);
+function routeByPathFactory(config) {
+  return new Map(
+    routeFactories.map((routeFactory) => routeFactory(config)).filter((route) => Boolean(route)).map((route) => [route.path, route])
+  );
+}
+
+// src/errors.ts
+var ArmorError = class extends Error {
+};
+var ArmorOpenIdConfigError = class extends ArmorError {
+};
+var ArmorAuthMissingError = class extends ArmorError {
+};
+var ArmorRefreshError = class extends ArmorError {
+};
+
+// src/utils/refresh.ts
+import { createRemoteJWKSet as createRemoteJWKSet2 } from "jose";
+import { redirect as redirect5 } from "@sveltejs/kit";
+function armorRefreshFactory(config) {
+  var _a, _b;
+  const refreshEndpoint = (_a = config.oauth.refreshEndpoint) != null ? _a : urlConcat(config.oauth.baseUrl, "oauth2/token");
+  const jwksUrl = new URL(
+    (_b = config.oauth.jwksEndpoint) != null ? _b : urlConcat(config.oauth.baseUrl, ".well-known/jwks.json")
+  );
+  const refresh = (fetch2, refreshToken) => __async(null, null, function* () {
+    var _a2, _b2, _c2, _d, _e;
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: config.oauth.clientId,
+      client_secret: config.oauth.clientSecret,
+      refresh_token: refreshToken
+    });
+    if (config.oauth.scope) {
+      body.set("scope", config.oauth.scope);
+    }
+    const response = yield fetch2(refreshEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: body.toString()
+    });
+    if (!response.ok) {
+      const error = yield response.text();
+      throw new ArmorRefreshError(`Could not refresh token: ${error}`);
+    }
+    const json = yield response.json();
+    const newExchange = __spreadProps(__spreadValues({}, json), {
+      refresh_token: (_a2 = json.refresh_token) != null ? _a2 : refreshToken
+    });
+    (_c2 = (_b2 = config.logger) == null ? void 0 : _b2.debug) == null ? void 0 : _c2.call(_b2, "Exchange code for tokens.", { newExchange });
+    const jwks = createRemoteJWKSet2(jwksUrl);
+    const [idToken, accessToken] = yield Promise.all([
+      jwtVerifyIdToken(config, jwks, newExchange.id_token),
+      jwtVerifyAccessToken(config, jwks, newExchange.access_token)
+    ]);
+    (_e = (_d = config.logger) == null ? void 0 : _d.debug) == null ? void 0 : _e.call(_d, "Extract and verify tokens.", {
+      idToken,
+      accessToken
+    });
+    const validTokens = exchangeToTokens(
+      newExchange,
+      idToken,
+      accessToken
+    );
+    return validTokens;
+  });
+  return {
+    refresh,
+    ensureValidToken(event, tokens, fn) {
+      return __async(this, null, function* () {
+        var _a2, _b2;
+        try {
+          let validTokens = tokens;
+          if (shouldRefresh(tokens)) {
+            (_b2 = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b2.call(_a2, "Tokens has expired. Refreshing...");
+            if (!tokens.exchange.refresh_token) {
+              throw redirect5(302, ROUTE_PATH_LOGIN);
+            }
+            validTokens = yield refresh(fetch, tokens.exchange.refresh_token);
+            yield config.session.login(event, validTokens);
+          }
+          return fn(validTokens);
+        } catch (error) {
+          if (error instanceof ArmorRefreshError) {
+            throw redirect5(302, ROUTE_PATH_LOGIN);
+          }
+          throw error;
+        }
+      });
+    }
+  };
+}
+
+// src/session/cookie.ts
+function cookieSessionGetTokens({
+  cookies
+}) {
+  return cookies.get(COOKIE_TOKENS);
+}
+function cookieSessionLogin({ cookies }, tokens) {
+  cookieSet(cookies, COOKIE_TOKENS, tokens);
+}
+function cookieSessionLogout({ cookies }) {
+  cookieDelete(cookies, COOKIE_TOKENS);
+}
+function armorCookieSessionGet({ cookies }) {
+  const tokens = cookieGet(cookies, COOKIE_TOKENS);
+  if (!tokens) {
+    throw new ArmorAuthMissingError();
+  }
+  return tokens;
+}
+var armorCookieSession = {
+  getTokens: cookieSessionGetTokens,
+  login: cookieSessionLogin,
+  logout: cookieSessionLogout
+};
+
+// src/index.ts
+function armor(config) {
+  const routeByPath = routeByPathFactory(config);
+  const refresh = armorRefreshFactory(config);
+  return __spreadProps(__spreadValues({}, refresh), {
+    handle(_0) {
+      return __async(this, arguments, function* ({ event, resolve }) {
+        var _a2, _b;
+        const route = routeByPath.get(event.url.pathname);
+        if (route) {
+          return route.handle({ event, resolve });
+        }
+        const tokens = yield config.session.getTokens(event);
+        if (!tokens) {
+          (_b = (_a2 = config.logger) == null ? void 0 : _a2.warning) == null ? void 0 : _b.call(
+            _a2,
+            "Could not find tokens. Redirecting to login."
+          );
+          throw redirect6(302, ROUTE_PATH_LOGIN);
+        }
+        return refresh.ensureValidToken(event, tokens, () => resolve(event));
+      });
+    }
+  });
+}
+function armorConfigFromOpenId(config, fetch2) {
+  return __async(this, null, function* () {
+    var _a;
+    const fetchToUse = fetch2 != null ? fetch2 : global.fetch;
+    const response = yield fetchToUse(config.oauth.openIdConfigEndpoint, {
+      headers: {
+        Accept: "application/json"
+      }
+    });
+    if (!response.ok) {
+      const text = yield response.text();
+      throw new ArmorOpenIdConfigError(text);
+    }
+    const body = yield response.json();
+    return __spreadProps(__spreadValues({}, config), {
+      oauth: __spreadProps(__spreadValues({}, config.oauth), {
+        tokenEndpoint: body.token_endpoint,
+        authorizeEndpoint: body.authorization_endpoint,
+        issuer: body.issuer,
+        jwksEndpoint: body.jwks_uri,
+        logoutEndpoint: (_a = body.end_session_endpoint) != null ? _a : void 0,
+        refreshEndpoint: body.token_endpoint
+      })
+    });
+  });
+}
+export {
+  armor,
+  armorConfigFromOpenId,
+  armorCookieSession,
+  armorCookieSessionGet,
+  armorRefreshFactory
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/routes/login.ts","../src/routes/redirect-login.ts","../src/utils/utils.ts","../src/utils/jwt.ts","../src/utils/cookie.ts","../src/utils/event.ts","../src/routes/logout.ts","../src/routes/redirect-logout.ts","../src/routes/routes.ts","../src/errors.ts","../src/utils/refresh.ts","../src/session/cookie.ts"],"sourcesContent":["import { redirect, type Handle } from \"@sveltejs/kit\";\nimport { ROUTE_PATH_LOGIN } from \"./routes/login\";\nimport type { ArmorConfig, ArmorOpenIdConfig, ArmorTokens } from \"./contracts\";\nimport { routeByPathFactory } from \"./routes/routes\";\nimport { ArmorOpenIdConfigError } from \"./errors\";\nimport { ArmorRefresh, armorRefreshFactory } from \"./utils/refresh\";\n\nexport type { ArmorConfig, ArmorTokens };\nexport { armorCookieSession, armorCookieSessionGet } from \"./session/cookie\";\nexport { armorRefreshFactory } from \"./utils/refresh\";\n\nexport interface Armor extends ArmorRefresh {\n\treadonly handle: Handle;\n}\n\nexport function armor(config: ArmorConfig): Armor {\n\tconst routeByPath = routeByPathFactory(config);\n\tconst refresh = armorRefreshFactory(config);\n\n\treturn {\n\t\t...refresh,\n\t\tasync handle({ event, resolve }) {\n\t\t\tconst route = routeByPath.get(event.url.pathname);\n\n\t\t\tif (route) {\n\t\t\t\treturn route.handle({ event, resolve });\n\t\t\t}\n\n\t\t\tconst tokens = await config.session.getTokens(event);\n\n\t\t\tif (!tokens) {\n\t\t\t\tconfig.logger?.warning?.(\n\t\t\t\t\t\"Could not find tokens. Redirecting to login.\",\n\t\t\t\t);\n\t\t\t\tthrow redirect(302, ROUTE_PATH_LOGIN);\n\t\t\t}\n\n\t\t\treturn refresh.ensureValidToken(event, tokens, () => resolve(event));\n\t\t},\n\t};\n}\n\n/**\n * Some IdP's expose a /.well-known/openid-configuration that specifies how to configure.\n * Use that to create your config.\n * @param config\n * @param fetch\n */\nexport async function armorConfigFromOpenId(\n\tconfig: ArmorOpenIdConfig,\n\tfetch?: typeof global.fetch,\n): Promise<ArmorConfig> {\n\tconst fetchToUse = fetch ?? global.fetch;\n\n\tconst response = await fetchToUse(config.oauth.openIdConfigEndpoint, {\n\t\theaders: {\n\t\t\tAccept: \"application/json\",\n\t\t},\n\t});\n\n\tif (!response.ok) {\n\t\tconst text = await response.text();\n\t\tthrow new ArmorOpenIdConfigError(text);\n\t}\n\n\tconst body = await response.json();\n\n\treturn {\n\t\t...config,\n\t\toauth: {\n\t\t\t...config.oauth,\n\t\t\ttokenEndpoint: body.token_endpoint,\n\t\t\tauthorizeEndpoint: body.authorization_endpoint,\n\t\t\tissuer: body.issuer,\n\t\t\tjwksEndpoint: body.jwks_uri,\n\t\t\tlogoutEndpoint: body.end_session_endpoint ?? undefined,\n\t\t\trefreshEndpoint: body.token_endpoint,\n\t\t},\n\t};\n}\n","import { redirect } from \"@sveltejs/kit\";\nimport type { ArmorConfig } from \"../contracts\";\nimport { queryParamsCreate } from \"@nekm/core\";\nimport { ROUTE_PATH_REDIRECT_LOGIN } from \"./redirect-login\";\nimport { randomUUID } from \"node:crypto\";\nimport type { RouteFactory } from \"./routes\";\nimport { COOKIE_STATE, cookieSet } from \"../utils/cookie\";\nimport { urlConcat } from \"../utils/utils\";\nimport { ARMOR_LOGIN } from \"../browser\";\n\nexport const ROUTE_PATH_LOGIN = ARMOR_LOGIN;\n\nexport const routeLoginFactory: RouteFactory = (config: ArmorConfig) => {\n\tconst authorizeEndpoint =\n\t\tconfig.oauth.authorizeEndpoint ??\n\t\turlConcat(config.oauth.baseUrl, \"oauth2/authorize\");\n\n\tconst scope = config.oauth.scope ?? \"openid profile email\";\n\n\treturn {\n\t\tpath: ROUTE_PATH_LOGIN,\n\t\tasync handle({ event }) {\n\t\t\tconst state = randomUUID();\n\t\t\tcookieSet(event.cookies, COOKIE_STATE, state);\n\n\t\t\tconst params = {\n\t\t\t\tclient_id: config.oauth.clientId,\n\t\t\t\tresponse_type: \"code\",\n\t\t\t\tredirect_uri: urlConcat(event.url.origin, ROUTE_PATH_REDIRECT_LOGIN),\n\t\t\t\tstate,\n\t\t\t\tscope,\n\t\t\t\taudience: config.oauth.audience,\n\t\t\t};\n\n\t\t\tconst paramsStr = queryParamsCreate(params);\n\n\t\t\tconfig.logger?.debug?.(\"Pre login redirect.\", { params, state });\n\n\t\t\tthrow redirect(302, `${authorizeEndpoint}?${paramsStr}`);\n\t\t},\n\t};\n};\n","import { redirect } from \"@sveltejs/kit\";\nimport type {\n\tArmorConfig,\n\tArmorIdToken,\n\tArmorTokenExchange,\n} from \"../contracts\";\nimport { queryParamsCreate, throwIfUndefined } from \"@nekm/core\";\nimport { createRemoteJWKSet } from \"jose\";\nimport type { RouteFactory } from \"./routes\";\nimport { urlConcat, isTokenExchange, exchangeToTokens } from \"../utils/utils\";\nimport { jwtVerifyAccessToken, jwtVerifyIdToken } from \"../utils/jwt\";\nimport { eventStateValid } from \"../utils/event\";\nimport { ROUTE_PATH_LOGIN } from \"./login\";\n\nexport const ROUTE_PATH_REDIRECT_LOGIN = \"/_armor/redirect/login\";\n\nexport const routeRedirectLoginFactory: RouteFactory = (\n\tconfig: ArmorConfig,\n) => {\n\tconst jwksUrl = new URL(\n\t\tconfig.oauth.jwksEndpoint ??\n\t\t\turlConcat(config.oauth.baseUrl, \".well-known/jwks.json\"),\n\t);\n\n\tconst tokenUrl =\n\t\tconfig.oauth.tokenEndpoint ??\n\t\turlConcat(config.oauth.baseUrl, \"oauth2/token\");\n\n\tconst scope = config.oauth.scope ?? \"openid profile email\";\n\n\tasync function exchangeCodeForToken(\n\t\tfetch: typeof global.fetch,\n\t\torigin: string,\n\t\tcode: string,\n\t): Promise<ArmorTokenExchange> {\n\t\tconst params: Record<string, string> = {\n\t\t\tgrant_type: \"authorization_code\",\n\t\t\tclient_id: config.oauth.clientId,\n\t\t\tclient_secret: config.oauth.clientSecret,\n\t\t\tcode,\n\t\t\tredirect_uri: urlConcat(origin, ROUTE_PATH_REDIRECT_LOGIN),\n\t\t\tscope,\n\t\t};\n\n\t\tif (config.oauth.audience) {\n\t\t\tparams.audience = config.oauth.audience;\n\t\t}\n\n\t\tconst response = await fetch(tokenUrl, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\tAccept: \"application/json\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams(params).toString(),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst error = await response.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst token = await response.json();\n\n\t\tif (!isTokenExchange(token)) {\n\t\t\tthrow new Error(\"Response is not a valid token exchange.\");\n\t\t}\n\n\t\treturn token;\n\t}\n\n\treturn {\n\t\tpath: ROUTE_PATH_REDIRECT_LOGIN,\n\t\tasync handle({ event }) {\n\t\t\tconfig.logger?.debug?.(\"Handle login redirect callback.\");\n\n\t\t\t// If the states does not match, redirect the user to login.\n\t\t\t// People bookmark the wrong pages all the time. Lets not\n\t\t\t// do a throw here.\n\t\t\tif (!eventStateValid(event)) {\n\t\t\t\tconfig.logger?.warning?.(\"State missmatch\");\n\t\t\t\tthrow redirect(302, ROUTE_PATH_LOGIN);\n\t\t\t}\n\n\t\t\tconst error = event.url.searchParams.get(\"error\") ?? undefined;\n\n\t\t\tif (error) {\n\t\t\t\tconst error_description =\n\t\t\t\t\tevent.url.searchParams.get(\"error_description\") ?? undefined;\n\n\t\t\t\tconfig.logger?.error?.(\"Login returned error.\", {\n\t\t\t\t\terror,\n\t\t\t\t\terrorDescription: error_description,\n\t\t\t\t});\n\n\t\t\t\tif (!config.oauth.errorLoginRedirectPath) {\n\t\t\t\t\treturn new Response(`${error}\\n${error_description}`.trimEnd(), {\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t\"Content-Type\": \"text/plain\",\n\t\t\t\t\t\t},\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\tconst errorParams = queryParamsCreate({ error, error_description });\n\t\t\t\tthrow redirect(\n\t\t\t\t\t302,\n\t\t\t\t\t`${config.oauth.errorLoginRedirectPath}?${errorParams}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst code = event.url.searchParams.get(\"code\") ?? undefined;\n\t\t\tconfig.logger?.debug?.(\"Get code from query params.\", { code });\n\t\t\tthrowIfUndefined(code);\n\n\t\t\tconst exchange = await exchangeCodeForToken(\n\t\t\t\tevent.fetch,\n\t\t\t\tevent.url.origin,\n\t\t\t\tcode,\n\t\t\t);\n\n\t\t\tconfig.logger?.debug?.(\"Exchange code for tokens.\", { exchange });\n\n\t\t\tconst jwks = createRemoteJWKSet(jwksUrl);\n\n\t\t\tconst [idToken, accessToken] = await Promise.all([\n\t\t\t\tjwtVerifyIdToken(config, jwks, exchange.id_token),\n\t\t\t\tjwtVerifyAccessToken(config, jwks, exchange.access_token),\n\t\t\t]);\n\n\t\t\tconfig.logger?.debug?.(\"Extract and verify tokens.\", {\n\t\t\t\tidToken,\n\t\t\t\taccessToken,\n\t\t\t});\n\n\t\t\tawait config.session.login(\n\t\t\t\tevent,\n\t\t\t\texchangeToTokens(exchange, idToken as ArmorIdToken, accessToken),\n\t\t\t);\n\n\t\t\tthrow redirect(302, \"/\");\n\t\t},\n\t};\n};\n","import { strTrimEnd, strTrimStart } from \"@nekm/core\";\nimport type {\n\tArmorAccessToken,\n\tArmorIdToken,\n\tArmorTokenExchange,\n\tArmorTokens,\n} from \"../contracts\";\n\nexport function urlConcat(origin: string, path: string): string {\n\treturn [strTrimEnd(origin, \"/\"), strTrimStart(path, \"/\")].join(\"/\");\n}\n\nexport function isTokenExchange(value: unknown): value is ArmorTokenExchange {\n\tif (typeof value !== \"object\" || value === null) return false;\n\n\tconst obj = value as Record<string, unknown>;\n\n\treturn (\n\t\ttypeof obj.access_token === \"string\" &&\n\t\tobj.token_type === \"Bearer\" &&\n\t\ttypeof obj.expires_in === \"number\" &&\n\t\t// Optional fields\n\t\t(typeof obj.id_token === \"string\" || obj.id_token === undefined) &&\n\t\t(typeof obj.refresh_token === \"string\" ||\n\t\t\tobj.refresh_token === undefined) &&\n\t\t(typeof obj.scope === \"string\" || obj.scope === undefined)\n\t);\n}\n\nconst MINUTES_MS = 60 * 1000;\n\nexport function shouldRefresh(\n\ttokens: Pick<ArmorTokens, \"idToken\" | \"accessToken\">,\n): boolean {\n\tconst idExpiry = tokens.idToken.exp * 1000;\n\n\tconst accessExpiry =\n\t\ttypeof tokens.accessToken !== \"string\" &&\n\t\ttokens.accessToken.exp !== undefined\n\t\t\t? tokens.accessToken.exp * 1000\n\t\t\t: Infinity;\n\n\treturn Math.min(idExpiry, accessExpiry) < Date.now() + 5 * MINUTES_MS;\n}\n\nexport function createExpiresAt(seconds: number): Date {\n\tconst now = new Date();\n\tnow.setSeconds(now.getSeconds() + seconds);\n\treturn now;\n}\n\nexport function exchangeToTokens(\n\texchange: ArmorTokenExchange,\n\tidToken: ArmorIdToken,\n\taccessToken?: ArmorAccessToken,\n): ArmorTokens {\n\treturn {\n\t\texchange,\n\t\tidToken: idToken as ArmorIdToken,\n\t\t// Generally, IdP's require an audience to get a JWT\n\t\t// access token. Most cases, this doesn't matter.\n\t\taccessToken: accessToken ?? exchange.access_token,\n\t\texpiresAt: createExpiresAt(exchange.expires_in),\n\t};\n}\n","import { ArmorConfig } from \"../contracts\";\nimport { JWTPayload, jwtVerify, JWTVerifyGetKey, JWTVerifyOptions } from \"jose\";\nimport { throwIfUndefined } from \"@nekm/core\";\n\nfunction jwtIsCompactJwt(token: string): boolean {\n\t// Must be three base64url segments\n\tconst parts = token.trim().split(\".\");\n\treturn parts.length === 3 && parts.every((p) => p.length > 0);\n}\n\nexport function jwtVerifyIdToken(\n\tconfig: ArmorConfig,\n\tjwks: JWTVerifyGetKey,\n\tidToken: string,\n): Promise<JWTPayload> {\n\tconst payload = jwtVerifyToken(\n\t\tjwks,\n\t\t{\n\t\t\tissuer: config.oauth.issuer,\n\t\t\taudience: config.oauth.clientId,\n\t\t},\n\t\tidToken,\n\t);\n\tthrowIfUndefined(payload);\n\t// @ts-expect-error We're already verifying non-null above.\n\treturn payload;\n}\n\nexport function jwtVerifyAccessToken(\n\tconfig: ArmorConfig,\n\tjwks: JWTVerifyGetKey,\n\taccessToken: string,\n): Promise<JWTPayload | undefined> {\n\tconst opts: JWTVerifyOptions = { issuer: config.oauth.issuer };\n\n\tif (config.oauth.audience) {\n\t\topts.audience = config.oauth.audience;\n\t}\n\n\treturn jwtVerifyToken(jwks, opts, accessToken);\n}\n\nfunction isInvalidCompactJwt(error: unknown): boolean {\n\treturn Boolean(\n\t\ttypeof error === \"object\" &&\n\t\terror &&\n\t\t\"message\" in error &&\n\t\ttypeof error.message === \"string\" &&\n\t\t/invalid compact jws/gi.test(error.message),\n\t);\n}\n\nasync function jwtVerifyToken(\n\tjwks: JWTVerifyGetKey,\n\topts: JWTVerifyOptions,\n\ttoken: string,\n): Promise<JWTPayload | undefined> {\n\ttry {\n\t\tif (!jwtIsCompactJwt(token)) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst { payload } = await jwtVerify(token, jwks, opts);\n\t\treturn payload;\n\t} catch (error) {\n\t\tif (isInvalidCompactJwt(error)) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tthrow error;\n\t}\n}\n","import { Cookies } from \"@sveltejs/kit\";\n\nexport const COOKIE_TOKENS = \"tokens\" as const;\nexport const COOKIE_STATE = \"state\" as const;\n\nconst cookieDeleteOptions = Object.freeze({ path: \"/\" });\n\nconst cookieSetOptions = Object.freeze({\n\t...cookieDeleteOptions,\n\thttpOnly: true,\n\tsecure: true,\n\tsameSite: \"lax\",\n\tmaxAge: 1800, // 30 minutes\n});\n\nexport function cookieSet(\n\tcookies: Cookies,\n\tkey: string,\n\tvalue: string | object,\n) {\n\tcookies.set(key, JSON.stringify(value), cookieSetOptions);\n}\n\nexport function cookieGetAndDelete<T>(\n\tcookies: Cookies,\n\tkey: string,\n): T | undefined {\n\tconst value = cookieGet<T>(cookies, key);\n\n\tif (value) {\n\t\tcookies.delete(key, cookieDeleteOptions);\n\t}\n\n\treturn value;\n}\n\nexport function cookieGet<T>(cookies: Cookies, key: string): T | undefined {\n\tconst value = cookies.get(key);\n\n\treturn !value ? undefined : JSON.parse(value);\n}\n\nexport function cookieDelete(cookies: Cookies, key: string): void {\n\tcookies.delete(key, cookieDeleteOptions);\n}\n","import { RequestEvent } from \"@sveltejs/kit\";\nimport { COOKIE_STATE, cookieGetAndDelete } from \"./cookie\";\n\nexport function eventStateValid(event: RequestEvent): boolean {\n\tconst state = event.url.searchParams.get(\"state\") ?? undefined;\n\tconst stateCookie = cookieGetAndDelete(event.cookies, COOKIE_STATE);\n\n\treturn state !== stateCookie;\n}\n","import { redirect } from \"@sveltejs/kit\";\nimport type { ArmorConfig } from \"../contracts\";\nimport { queryParamsCreate } from \"@nekm/core\";\nimport { ROUTE_PATH_REDIRECT_LOGOUT } from \"./redirect-logout\";\nimport type { RouteFactory } from \"./routes\";\nimport { urlConcat } from \"../utils/utils\";\nimport { ARMOR_LOGOUT } from \"../browser\";\n\nexport const ROUTE_PATH_LOGOUT = ARMOR_LOGOUT;\n\nexport const routeLogoutFactory: RouteFactory = (config: ArmorConfig) => {\n\t// Check if the oauth provider supports a logout path.\n\tif (!config.oauth.logoutEndpoint) {\n\t\treturn undefined;\n\t}\n\n\tconst returnTo = config.oauth.logoutReturnToParam ?? \"logout_uri\";\n\n\treturn {\n\t\tpath: ROUTE_PATH_LOGOUT,\n\t\tasync handle({ event }) {\n\t\t\tconst params = {\n\t\t\t\t[returnTo]: urlConcat(event.url.origin, ROUTE_PATH_REDIRECT_LOGOUT),\n\t\t\t\tclient_id: config.oauth.clientId,\n\t\t\t};\n\n\t\t\tconst paramsStr = queryParamsCreate(params);\n\n\t\t\tconfig.logger?.debug?.(\"Pre logout redirect.\", { params });\n\n\t\t\tthrow redirect(302, `${config.oauth.logoutEndpoint}?${paramsStr}`);\n\t\t},\n\t};\n};\n","import { redirect } from \"@sveltejs/kit\";\nimport type { ArmorConfig } from \"../contracts\";\nimport type { RouteFactory } from \"./routes\";\n\nexport const ROUTE_PATH_REDIRECT_LOGOUT = \"/_armor/redirect/logout\";\n\nexport const routeRedirectLogoutFactory: RouteFactory = (\n\tconfig: ArmorConfig,\n) => {\n\t// Check if the oauth provider supports a logout path.\n\tif (!config.oauth.logoutEndpoint) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\tpath: ROUTE_PATH_REDIRECT_LOGOUT,\n\t\tasync handle({ event }) {\n\t\t\tconfig.logger?.debug?.(\"Handle logout redirect callback.\");\n\n\t\t\tawait config.session.logout(event);\n\n\t\t\tthrow redirect(302, \"/\");\n\t\t},\n\t};\n};\n","import type { Handle } from \"@sveltejs/kit\";\nimport type { ArmorConfig } from \"../contracts\";\nimport { routeLoginFactory } from \"./login\";\nimport { routeLogoutFactory } from \"./logout\";\nimport { routeRedirectLogoutFactory } from \"./redirect-logout\";\nimport { routeRedirectLoginFactory } from \"./redirect-login\";\n\nexport interface Route {\n\treadonly path: string;\n\treadonly handle: Handle;\n}\n\nexport type RouteFactory = (config: ArmorConfig) => Route | undefined;\n\nconst routeFactories = Object.freeze([\n\trouteLoginFactory,\n\trouteLogoutFactory,\n\trouteRedirectLoginFactory,\n\trouteRedirectLogoutFactory,\n]);\n\nexport function routeByPathFactory(config: ArmorConfig): Map<string, Route> {\n\t// @ts-expect-error Incorrect typing error.\n\treturn new Map(\n\t\trouteFactories\n\t\t\t.map((routeFactory) => routeFactory(config))\n\t\t\t.filter((route) => Boolean(route))\n\t\t\t// @ts-expect-error Incorrect typing error.\n\t\t\t.map((route) => [route.path, route]),\n\t);\n}\n","export class ArmorError extends Error {}\nexport class ArmorOpenIdConfigError extends ArmorError {}\nexport class ArmorAuthMissingError extends ArmorError {}\nexport class ArmorRefreshError extends ArmorError {}\n","import { createRemoteJWKSet } from \"jose\";\nimport {\n\tArmorConfig,\n\tArmorIdToken,\n\tArmorTokenExchange,\n\tArmorTokens,\n} from \"../contracts\";\nimport { ArmorRefreshError } from \"../errors\";\nimport { exchangeToTokens, shouldRefresh, urlConcat } from \"./utils\";\nimport { jwtVerifyAccessToken, jwtVerifyIdToken } from \"./jwt\";\nimport { redirect, RequestEvent } from \"@sveltejs/kit\";\nimport { ROUTE_PATH_LOGIN } from \"../routes/login\";\n\nexport interface ArmorRefresh {\n\treadonly refresh: (\n\t\tfetch: typeof global.fetch,\n\t\trefreshToken: string,\n\t) => Promise<ArmorTokens>;\n\treadonly ensureValidToken: <T>(\n\t\tevent: RequestEvent,\n\t\ttokens: ArmorTokens,\n\t\tfn: (tokens: ArmorTokens) => T | Promise<T>,\n\t) => Promise<T>;\n}\n\nexport function armorRefreshFactory(config: ArmorConfig): ArmorRefresh {\n\tconst refreshEndpoint =\n\t\tconfig.oauth.refreshEndpoint ??\n\t\turlConcat(config.oauth.baseUrl, \"oauth2/token\");\n\n\tconst jwksUrl = new URL(\n\t\tconfig.oauth.jwksEndpoint ??\n\t\t\turlConcat(config.oauth.baseUrl, \".well-known/jwks.json\"),\n\t);\n\n\tconst refresh = async (\n\t\tfetch: typeof global.fetch,\n\t\trefreshToken: string,\n\t): Promise<ArmorTokens> => {\n\t\tconst body = new URLSearchParams({\n\t\t\tgrant_type: \"refresh_token\",\n\t\t\tclient_id: config.oauth.clientId,\n\t\t\tclient_secret: config.oauth.clientSecret,\n\t\t\trefresh_token: refreshToken,\n\t\t});\n\n\t\tif (config.oauth.scope) {\n\t\t\tbody.set(\"scope\", config.oauth.scope);\n\t\t}\n\n\t\tconst response = await fetch(refreshEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\tAccept: \"application/json\",\n\t\t\t},\n\t\t\tbody: body.toString(),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst error = await response.text();\n\t\t\tthrow new ArmorRefreshError(`Could not refresh token: ${error}`);\n\t\t}\n\n\t\tconst json: ArmorTokenExchange = await response.json();\n\n\t\tconst newExchange = {\n\t\t\t...json,\n\t\t\trefresh_token: json.refresh_token ?? refreshToken,\n\t\t};\n\n\t\tconfig.logger?.debug?.(\"Exchange code for tokens.\", { newExchange });\n\n\t\tconst jwks = createRemoteJWKSet(jwksUrl);\n\n\t\tconst [idToken, accessToken] = await Promise.all([\n\t\t\tjwtVerifyIdToken(config, jwks, newExchange.id_token),\n\t\t\tjwtVerifyAccessToken(config, jwks, newExchange.access_token),\n\t\t]);\n\n\t\tconfig.logger?.debug?.(\"Extract and verify tokens.\", {\n\t\t\tidToken,\n\t\t\taccessToken,\n\t\t});\n\n\t\tconst validTokens = exchangeToTokens(\n\t\t\tnewExchange,\n\t\t\tidToken as ArmorIdToken,\n\t\t\taccessToken,\n\t\t);\n\n\t\treturn validTokens;\n\t};\n\n\treturn {\n\t\trefresh,\n\t\tasync ensureValidToken<T>(\n\t\t\tevent: RequestEvent,\n\t\t\ttokens: ArmorTokens,\n\t\t\tfn: (tokens: ArmorTokens) => T | Promise<T>,\n\t\t): Promise<T> {\n\t\t\ttry {\n\t\t\t\tlet validTokens = tokens;\n\n\t\t\t\tif (shouldRefresh(tokens)) {\n\t\t\t\t\tconfig.logger?.debug?.(\"Tokens has expired. Refreshing...\");\n\n\t\t\t\t\tif (!tokens.exchange.refresh_token) {\n\t\t\t\t\t\tthrow redirect(302, ROUTE_PATH_LOGIN);\n\t\t\t\t\t}\n\n\t\t\t\t\tvalidTokens = await refresh(fetch, tokens.exchange.refresh_token);\n\n\t\t\t\t\tawait config.session.login(event, validTokens);\n\t\t\t\t}\n\n\t\t\t\treturn fn(validTokens);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof ArmorRefreshError) {\n\t\t\t\t\tthrow redirect(302, ROUTE_PATH_LOGIN);\n\t\t\t\t}\n\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t},\n\t};\n}\n","import { RequestEvent } from \"@sveltejs/kit\";\nimport {\n\tCOOKIE_TOKENS,\n\tcookieDelete,\n\tcookieGet,\n\tcookieSet,\n} from \"../utils/cookie\";\nimport { ArmorConfig, ArmorTokens } from \"../contracts\";\nimport { ArmorAuthMissingError } from \"../errors\";\n\nfunction cookieSessionGetTokens({\n\tcookies,\n}: RequestEvent): ArmorTokens | undefined {\n\treturn cookies.get(COOKIE_TOKENS) as ArmorTokens | undefined;\n}\n\nexport function cookieSessionLogin(\n\t{ cookies }: RequestEvent,\n\ttokens: ArmorTokens,\n): void {\n\tcookieSet(cookies, COOKIE_TOKENS, tokens);\n}\n\nfunction cookieSessionLogout({ cookies }: RequestEvent): void {\n\tcookieDelete(cookies, COOKIE_TOKENS);\n}\n\nexport function armorCookieSessionGet({ cookies }: RequestEvent): ArmorTokens {\n\tconst tokens = cookieGet<ArmorTokens>(cookies, COOKIE_TOKENS);\n\n\tif (!tokens) {\n\t\tthrow new ArmorAuthMissingError();\n\t}\n\n\treturn tokens;\n}\n\nexport const armorCookieSession: ArmorConfig[\"session\"] = {\n\tgetTokens: cookieSessionGetTokens,\n\tlogin: cookieSessionLogin,\n\tlogout: cookieSessionLogout,\n};\n"],"mappings":";;;;;;;;;AAAA,SAAS,YAAAA,iBAA6B;;;ACAtC,SAAS,YAAAC,iBAAgB;AAEzB,SAAS,qBAAAC,0BAAyB;;;ACFlC,SAAS,gBAAgB;AAMzB,SAAS,mBAAmB,oBAAAC,yBAAwB;AACpD,SAAS,0BAA0B;;;ACPnC,SAAS,YAAY,oBAAoB;AAQlC,SAAS,UAAU,QAAgB,MAAsB;AAC/D,SAAO,CAAC,WAAW,QAAQ,GAAG,GAAG,aAAa,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG;AACnE;AAEO,SAAS,gBAAgB,OAA6C;AAC5E,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AAExD,QAAM,MAAM;AAEZ,SACC,OAAO,IAAI,iBAAiB,YAC5B,IAAI,eAAe,YACnB,OAAO,IAAI,eAAe;AAAA,GAEzB,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,YACrD,OAAO,IAAI,kBAAkB,YAC7B,IAAI,kBAAkB,YACtB,OAAO,IAAI,UAAU,YAAY,IAAI,UAAU;AAElD;AAEA,IAAM,aAAa,KAAK;AAEjB,SAAS,cACf,QACU;AACV,QAAM,WAAW,OAAO,QAAQ,MAAM;AAEtC,QAAM,eACL,OAAO,OAAO,gBAAgB,YAC9B,OAAO,YAAY,QAAQ,SACxB,OAAO,YAAY,MAAM,MACzB;AAEJ,SAAO,KAAK,IAAI,UAAU,YAAY,IAAI,KAAK,IAAI,IAAI,IAAI;AAC5D;AAEO,SAAS,gBAAgB,SAAuB;AACtD,QAAM,MAAM,oBAAI,KAAK;AACrB,MAAI,WAAW,IAAI,WAAW,IAAI,OAAO;AACzC,SAAO;AACR;AAEO,SAAS,iBACf,UACA,SACA,aACc;AACd,SAAO;AAAA,IACN;AAAA,IACA;AAAA;AAAA;AAAA,IAGA,aAAa,oCAAe,SAAS;AAAA,IACrC,WAAW,gBAAgB,SAAS,UAAU;AAAA,EAC/C;AACD;;;AC/DA,SAAqB,iBAAoD;AACzE,SAAS,wBAAwB;AAEjC,SAAS,gBAAgB,OAAwB;AAEhD,QAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,GAAG;AACpC,SAAO,MAAM,WAAW,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;AAC7D;AAEO,SAAS,iBACf,QACA,MACA,SACsB;AACtB,QAAM,UAAU;AAAA,IACf;AAAA,IACA;AAAA,MACC,QAAQ,OAAO,MAAM;AAAA,MACrB,UAAU,OAAO,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,EACD;AACA,mBAAiB,OAAO;AAExB,SAAO;AACR;AAEO,SAAS,qBACf,QACA,MACA,aACkC;AAClC,QAAM,OAAyB,EAAE,QAAQ,OAAO,MAAM,OAAO;AAE7D,MAAI,OAAO,MAAM,UAAU;AAC1B,SAAK,WAAW,OAAO,MAAM;AAAA,EAC9B;AAEA,SAAO,eAAe,MAAM,MAAM,WAAW;AAC9C;AAEA,SAAS,oBAAoB,OAAyB;AACrD,SAAO;AAAA,IACN,OAAO,UAAU,YACjB,SACA,aAAa,SACb,OAAO,MAAM,YAAY,YACzB,wBAAwB,KAAK,MAAM,OAAO;AAAA,EAC3C;AACD;AAEA,SAAe,eACd,MACA,MACA,OACkC;AAAA;AAClC,QAAI;AACH,UAAI,CAAC,gBAAgB,KAAK,GAAG;AAC5B,eAAO;AAAA,MACR;AAEA,YAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM,IAAI;AACrD,aAAO;AAAA,IACR,SAAS,OAAO;AACf,UAAI,oBAAoB,KAAK,GAAG;AAC/B,eAAO;AAAA,MACR;AAEA,YAAM;AAAA,IACP;AAAA,EACD;AAAA;;;ACrEO,IAAM,gBAAgB;AACtB,IAAM,eAAe;AAE5B,IAAM,sBAAsB,OAAO,OAAO,EAAE,MAAM,IAAI,CAAC;AAEvD,IAAM,mBAAmB,OAAO,OAAO,iCACnC,sBADmC;AAAA,EAEtC,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,QAAQ;AAAA;AACT,EAAC;AAEM,SAAS,UACf,SACA,KACA,OACC;AACD,UAAQ,IAAI,KAAK,KAAK,UAAU,KAAK,GAAG,gBAAgB;AACzD;AAEO,SAAS,mBACf,SACA,KACgB;AAChB,QAAM,QAAQ,UAAa,SAAS,GAAG;AAEvC,MAAI,OAAO;AACV,YAAQ,OAAO,KAAK,mBAAmB;AAAA,EACxC;AAEA,SAAO;AACR;AAEO,SAAS,UAAa,SAAkB,KAA4B;AAC1E,QAAM,QAAQ,QAAQ,IAAI,GAAG;AAE7B,SAAO,CAAC,QAAQ,SAAY,KAAK,MAAM,KAAK;AAC7C;AAEO,SAAS,aAAa,SAAkB,KAAmB;AACjE,UAAQ,OAAO,KAAK,mBAAmB;AACxC;;;ACzCO,SAAS,gBAAgB,OAA8B;AAH9D;AAIC,QAAM,SAAQ,WAAM,IAAI,aAAa,IAAI,OAAO,MAAlC,YAAuC;AACrD,QAAM,cAAc,mBAAmB,MAAM,SAAS,YAAY;AAElE,SAAO,UAAU;AAClB;;;AJMO,IAAM,4BAA4B;AAElC,IAAM,4BAA0C,CACtD,WACI;AAlBL;AAmBC,QAAM,UAAU,IAAI;AAAA,KACnB,YAAO,MAAM,iBAAb,YACC,UAAU,OAAO,MAAM,SAAS,uBAAuB;AAAA,EACzD;AAEA,QAAM,YACL,YAAO,MAAM,kBAAb,YACA,UAAU,OAAO,MAAM,SAAS,cAAc;AAE/C,QAAM,SAAQ,YAAO,MAAM,UAAb,YAAsB;AAEpC,WAAe,qBACdC,QACA,QACA,MAC8B;AAAA;AAC9B,YAAM,SAAiC;AAAA,QACtC,YAAY;AAAA,QACZ,WAAW,OAAO,MAAM;AAAA,QACxB,eAAe,OAAO,MAAM;AAAA,QAC5B;AAAA,QACA,cAAc,UAAU,QAAQ,yBAAyB;AAAA,QACzD;AAAA,MACD;AAEA,UAAI,OAAO,MAAM,UAAU;AAC1B,eAAO,WAAW,OAAO,MAAM;AAAA,MAChC;AAEA,YAAM,WAAW,MAAMA,OAAM,UAAU;AAAA,QACtC,QAAQ;AAAA,QACR,SAAS;AAAA,UACR,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACT;AAAA,QACA,MAAM,IAAI,gBAAgB,MAAM,EAAE,SAAS;AAAA,MAC5C,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AACjB,cAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,cAAM,IAAI,MAAM,0BAA0B,KAAK,EAAE;AAAA,MAClD;AAEA,YAAM,QAAQ,MAAM,SAAS,KAAK;AAElC,UAAI,CAAC,gBAAgB,KAAK,GAAG;AAC5B,cAAM,IAAI,MAAM,yCAAyC;AAAA,MAC1D;AAEA,aAAO;AAAA,IACR;AAAA;AAEA,SAAO;AAAA,IACN,MAAM;AAAA,IACA,OAAO,IAAW;AAAA,iDAAX,EAAE,MAAM,GAAG;AAzE1B,YAAAC,KAAAC,KAAAC,KAAAC,KAAA;AA0EG,SAAAF,OAAAD,MAAA,OAAO,WAAP,gBAAAA,IAAe,UAAf,gBAAAC,IAAA,KAAAD,KAAuB;AAKvB,YAAI,CAAC,gBAAgB,KAAK,GAAG;AAC5B,WAAAG,OAAAD,MAAA,OAAO,WAAP,gBAAAA,IAAe,YAAf,gBAAAC,IAAA,KAAAD,KAAyB;AACzB,gBAAM,SAAS,KAAK,gBAAgB;AAAA,QACrC;AAEA,cAAM,SAAQ,WAAM,IAAI,aAAa,IAAI,OAAO,MAAlC,YAAuC;AAErD,YAAI,OAAO;AACV,gBAAM,qBACL,WAAM,IAAI,aAAa,IAAI,mBAAmB,MAA9C,YAAmD;AAEpD,6BAAO,WAAP,mBAAe,UAAf,4BAAuB,yBAAyB;AAAA,YAC/C;AAAA,YACA,kBAAkB;AAAA,UACnB;AAEA,cAAI,CAAC,OAAO,MAAM,wBAAwB;AACzC,mBAAO,IAAI,SAAS,GAAG,KAAK;AAAA,EAAK,iBAAiB,GAAG,QAAQ,GAAG;AAAA,cAC/D,SAAS;AAAA,gBACR,gBAAgB;AAAA,cACjB;AAAA,YACD,CAAC;AAAA,UACF;AAEA,gBAAM,cAAc,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;AAClE,gBAAM;AAAA,YACL;AAAA,YACA,GAAG,OAAO,MAAM,sBAAsB,IAAI,WAAW;AAAA,UACtD;AAAA,QACD;AAEA,cAAM,QAAO,WAAM,IAAI,aAAa,IAAI,MAAM,MAAjC,YAAsC;AACnD,2BAAO,WAAP,mBAAe,UAAf,4BAAuB,+BAA+B,EAAE,KAAK;AAC7D,QAAAE,kBAAiB,IAAI;AAErB,cAAM,WAAW,MAAM;AAAA,UACtB,MAAM;AAAA,UACN,MAAM,IAAI;AAAA,UACV;AAAA,QACD;AAEA,2BAAO,WAAP,mBAAe,UAAf,4BAAuB,6BAA6B,EAAE,SAAS;AAE/D,cAAM,OAAO,mBAAmB,OAAO;AAEvC,cAAM,CAAC,SAAS,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,UAChD,iBAAiB,QAAQ,MAAM,SAAS,QAAQ;AAAA,UAChD,qBAAqB,QAAQ,MAAM,SAAS,YAAY;AAAA,QACzD,CAAC;AAED,2BAAO,WAAP,mBAAe,UAAf,4BAAuB,8BAA8B;AAAA,UACpD;AAAA,UACA;AAAA,QACD;AAEA,cAAM,OAAO,QAAQ;AAAA,UACpB;AAAA,UACA,iBAAiB,UAAU,SAAyB,WAAW;AAAA,QAChE;AAEA,cAAM,SAAS,KAAK,GAAG;AAAA,MACxB;AAAA;AAAA,EACD;AACD;;;AD1IA,SAAS,kBAAkB;AAMpB,IAAM,mBAAmB;AAEzB,IAAM,oBAAkC,CAAC,WAAwB;AAZxE;AAaC,QAAM,qBACL,YAAO,MAAM,sBAAb,YACA,UAAU,OAAO,MAAM,SAAS,kBAAkB;AAEnD,QAAM,SAAQ,YAAO,MAAM,UAAb,YAAsB;AAEpC,SAAO;AAAA,IACN,MAAM;AAAA,IACA,OAAO,IAAW;AAAA,iDAAX,EAAE,MAAM,GAAG;AArB1B,YAAAC,KAAAC;AAsBG,cAAM,QAAQ,WAAW;AACzB,kBAAU,MAAM,SAAS,cAAc,KAAK;AAE5C,cAAM,SAAS;AAAA,UACd,WAAW,OAAO,MAAM;AAAA,UACxB,eAAe;AAAA,UACf,cAAc,UAAU,MAAM,IAAI,QAAQ,yBAAyB;AAAA,UACnE;AAAA,UACA;AAAA,UACA,UAAU,OAAO,MAAM;AAAA,QACxB;AAEA,cAAM,YAAYC,mBAAkB,MAAM;AAE1C,SAAAD,OAAAD,MAAA,OAAO,WAAP,gBAAAA,IAAe,UAAf,gBAAAC,IAAA,KAAAD,KAAuB,uBAAuB,EAAE,QAAQ,MAAM;AAE9D,cAAMG,UAAS,KAAK,GAAG,iBAAiB,IAAI,SAAS,EAAE;AAAA,MACxD;AAAA;AAAA,EACD;AACD;;;AMzCA,SAAS,YAAAC,iBAAgB;AAEzB,SAAS,qBAAAC,0BAAyB;;;ACFlC,SAAS,YAAAC,iBAAgB;AAIlB,IAAM,6BAA6B;AAEnC,IAAM,6BAA2C,CACvD,WACI;AAEJ,MAAI,CAAC,OAAO,MAAM,gBAAgB;AACjC,WAAO;AAAA,EACR;AAEA,SAAO;AAAA,IACN,MAAM;AAAA,IACA,OAAO,IAAW;AAAA,iDAAX,EAAE,MAAM,GAAG;AAhB1B,YAAAC,KAAA;AAiBG,eAAAA,MAAA,OAAO,WAAP,gBAAAA,IAAe,UAAf,wBAAAA,KAAuB;AAEvB,cAAM,OAAO,QAAQ,OAAO,KAAK;AAEjC,cAAMC,UAAS,KAAK,GAAG;AAAA,MACxB;AAAA;AAAA,EACD;AACD;;;ADhBO,IAAM,oBAAoB;AAE1B,IAAM,qBAAmC,CAAC,WAAwB;AAVzE;AAYC,MAAI,CAAC,OAAO,MAAM,gBAAgB;AACjC,WAAO;AAAA,EACR;AAEA,QAAM,YAAW,YAAO,MAAM,wBAAb,YAAoC;AAErD,SAAO;AAAA,IACN,MAAM;AAAA,IACA,OAAO,IAAW;AAAA,iDAAX,EAAE,MAAM,GAAG;AApB1B,YAAAC,KAAAC;AAqBG,cAAM,SAAS;AAAA,UACd,CAAC,QAAQ,GAAG,UAAU,MAAM,IAAI,QAAQ,0BAA0B;AAAA,UAClE,WAAW,OAAO,MAAM;AAAA,QACzB;AAEA,cAAM,YAAYC,mBAAkB,MAAM;AAE1C,SAAAD,OAAAD,MAAA,OAAO,WAAP,gBAAAA,IAAe,UAAf,gBAAAC,IAAA,KAAAD,KAAuB,wBAAwB,EAAE,OAAO;AAExD,cAAMG,UAAS,KAAK,GAAG,OAAO,MAAM,cAAc,IAAI,SAAS,EAAE;AAAA,MAClE;AAAA;AAAA,EACD;AACD;;;AEnBA,IAAM,iBAAiB,OAAO,OAAO;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAEM,SAAS,mBAAmB,QAAyC;AAE3E,SAAO,IAAI;AAAA,IACV,eACE,IAAI,CAAC,iBAAiB,aAAa,MAAM,CAAC,EAC1C,OAAO,CAAC,UAAU,QAAQ,KAAK,CAAC,EAEhC,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC;AAAA,EACrC;AACD;;;AC9BO,IAAM,aAAN,cAAyB,MAAM;AAAC;AAChC,IAAM,yBAAN,cAAqC,WAAW;AAAC;AACjD,IAAM,wBAAN,cAAoC,WAAW;AAAC;AAChD,IAAM,oBAAN,cAAgC,WAAW;AAAC;;;ACHnD,SAAS,sBAAAC,2BAA0B;AAUnC,SAAS,YAAAC,iBAA8B;AAehC,SAAS,oBAAoB,QAAmC;AAzBvE;AA0BC,QAAM,mBACL,YAAO,MAAM,oBAAb,YACA,UAAU,OAAO,MAAM,SAAS,cAAc;AAE/C,QAAM,UAAU,IAAI;AAAA,KACnB,YAAO,MAAM,iBAAb,YACC,UAAU,OAAO,MAAM,SAAS,uBAAuB;AAAA,EACzD;AAEA,QAAM,UAAU,CACfC,QACA,iBAC0B;AAtC5B,QAAAC,KAAAC,KAAAC,KAAA;AAuCE,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAChC,YAAY;AAAA,MACZ,WAAW,OAAO,MAAM;AAAA,MACxB,eAAe,OAAO,MAAM;AAAA,MAC5B,eAAe;AAAA,IAChB,CAAC;AAED,QAAI,OAAO,MAAM,OAAO;AACvB,WAAK,IAAI,SAAS,OAAO,MAAM,KAAK;AAAA,IACrC;AAEA,UAAM,WAAW,MAAMH,OAAM,iBAAiB;AAAA,MAC7C,QAAQ;AAAA,MACR,SAAS;AAAA,QACR,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACT;AAAA,MACA,MAAM,KAAK,SAAS;AAAA,IACrB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAM,IAAI,kBAAkB,4BAA4B,KAAK,EAAE;AAAA,IAChE;AAEA,UAAM,OAA2B,MAAM,SAAS,KAAK;AAErD,UAAM,cAAc,iCAChB,OADgB;AAAA,MAEnB,gBAAeC,MAAA,KAAK,kBAAL,OAAAA,MAAsB;AAAA,IACtC;AAEA,KAAAE,OAAAD,MAAA,OAAO,WAAP,gBAAAA,IAAe,UAAf,gBAAAC,IAAA,KAAAD,KAAuB,6BAA6B,EAAE,YAAY;AAElE,UAAM,OAAOE,oBAAmB,OAAO;AAEvC,UAAM,CAAC,SAAS,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,MAChD,iBAAiB,QAAQ,MAAM,YAAY,QAAQ;AAAA,MACnD,qBAAqB,QAAQ,MAAM,YAAY,YAAY;AAAA,IAC5D,CAAC;AAED,uBAAO,WAAP,mBAAe,UAAf,4BAAuB,8BAA8B;AAAA,MACpD;AAAA,MACA;AAAA,IACD;AAEA,UAAM,cAAc;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACD;AAEA,WAAO;AAAA,EACR;AAEA,SAAO;AAAA,IACN;AAAA,IACM,iBACL,OACA,QACA,IACa;AAAA;AApGhB,YAAAH,KAAAC;AAqGG,YAAI;AACH,cAAI,cAAc;AAElB,cAAI,cAAc,MAAM,GAAG;AAC1B,aAAAA,OAAAD,MAAA,OAAO,WAAP,gBAAAA,IAAe,UAAf,gBAAAC,IAAA,KAAAD,KAAuB;AAEvB,gBAAI,CAAC,OAAO,SAAS,eAAe;AACnC,oBAAMI,UAAS,KAAK,gBAAgB;AAAA,YACrC;AAEA,0BAAc,MAAM,QAAQ,OAAO,OAAO,SAAS,aAAa;AAEhE,kBAAM,OAAO,QAAQ,MAAM,OAAO,WAAW;AAAA,UAC9C;AAEA,iBAAO,GAAG,WAAW;AAAA,QACtB,SAAS,OAAO;AACf,cAAI,iBAAiB,mBAAmB;AACvC,kBAAMA,UAAS,KAAK,gBAAgB;AAAA,UACrC;AAEA,gBAAM;AAAA,QACP;AAAA,MACD;AAAA;AAAA,EACD;AACD;;;ACpHA,SAAS,uBAAuB;AAAA,EAC/B;AACD,GAA0C;AACzC,SAAO,QAAQ,IAAI,aAAa;AACjC;AAEO,SAAS,mBACf,EAAE,QAAQ,GACV,QACO;AACP,YAAU,SAAS,eAAe,MAAM;AACzC;AAEA,SAAS,oBAAoB,EAAE,QAAQ,GAAuB;AAC7D,eAAa,SAAS,aAAa;AACpC;AAEO,SAAS,sBAAsB,EAAE,QAAQ,GAA8B;AAC7E,QAAM,SAAS,UAAuB,SAAS,aAAa;AAE5D,MAAI,CAAC,QAAQ;AACZ,UAAM,IAAI,sBAAsB;AAAA,EACjC;AAEA,SAAO;AACR;AAEO,IAAM,qBAA6C;AAAA,EACzD,WAAW;AAAA,EACX,OAAO;AAAA,EACP,QAAQ;AACT;;;AZ1BO,SAAS,MAAM,QAA4B;AACjD,QAAM,cAAc,mBAAmB,MAAM;AAC7C,QAAM,UAAU,oBAAoB,MAAM;AAE1C,SAAO,iCACH,UADG;AAAA,IAEA,OAAO,IAAoB;AAAA,iDAApB,EAAE,OAAO,QAAQ,GAAG;AArBnC,YAAAC,KAAA;AAsBG,cAAM,QAAQ,YAAY,IAAI,MAAM,IAAI,QAAQ;AAEhD,YAAI,OAAO;AACV,iBAAO,MAAM,OAAO,EAAE,OAAO,QAAQ,CAAC;AAAA,QACvC;AAEA,cAAM,SAAS,MAAM,OAAO,QAAQ,UAAU,KAAK;AAEnD,YAAI,CAAC,QAAQ;AACZ,iBAAAA,MAAA,OAAO,WAAP,gBAAAA,IAAe,YAAf;AAAA,YAAAA;AAAA,YACC;AAAA;AAED,gBAAMC,UAAS,KAAK,gBAAgB;AAAA,QACrC;AAEA,eAAO,QAAQ,iBAAiB,OAAO,QAAQ,MAAM,QAAQ,KAAK,CAAC;AAAA,MACpE;AAAA;AAAA,EACD;AACD;AAQA,SAAsB,sBACrB,QACAC,QACuB;AAAA;AAnDxB;AAoDC,UAAM,aAAaA,UAAA,OAAAA,SAAS,OAAO;AAEnC,UAAM,WAAW,MAAM,WAAW,OAAO,MAAM,sBAAsB;AAAA,MACpE,SAAS;AAAA,QACR,QAAQ;AAAA,MACT;AAAA,IACD,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,IAAI,uBAAuB,IAAI;AAAA,IACtC;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,WAAO,iCACH,SADG;AAAA,MAEN,OAAO,iCACH,OAAO,QADJ;AAAA,QAEN,eAAe,KAAK;AAAA,QACpB,mBAAmB,KAAK;AAAA,QACxB,QAAQ,KAAK;AAAA,QACb,cAAc,KAAK;AAAA,QACnB,iBAAgB,UAAK,yBAAL,YAA6B;AAAA,QAC7C,iBAAiB,KAAK;AAAA,MACvB;AAAA,IACD;AAAA,EACD;AAAA;","names":["redirect","redirect","queryParamsCreate","throwIfUndefined","fetch","_a","_b","_c","_d","throwIfUndefined","_a","_b","queryParamsCreate","redirect","redirect","queryParamsCreate","redirect","_a","redirect","_a","_b","queryParamsCreate","redirect","createRemoteJWKSet","redirect","fetch","_a","_b","_c","createRemoteJWKSet","redirect","_a","redirect","fetch"]}

package/dist/utils/event.d.ts

@@ -1,2 +1,2 @@
 import { RequestEvent } from "@sveltejs/kit";
-export declare function eventStateValidOrThrow(event: RequestEvent): void;
+export declare function eventStateValid(event: RequestEvent): boolean;

package/package.json

@@ -1,28 +1,25 @@
 {
   "name": "@nekm/sveltekit-armor",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Zero-config OAuth protection for SvelteKit",
   "license": "MIT",
-  "source": "./src/index.ts",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "source": "./src/index.ts",
-      "import": "./dist/index.esm.js",
+      "import": "./dist/index.mjs",
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
     "./browser": {
-      "source": "./src/browser/index.ts",
-      "import": "./dist/browser/index.esm.js",
+      "import": "./dist/browser/index.mjs",
       "types": "./dist/browser/index.d.ts",
       "default": "./dist/browser/index.js"
     }
   },
   "main": "./dist/index.js",
-  "module": "./dist/index.esm.js",
+  "module": "./dist/index.mjs",
   "scripts": {
-    "build": "microbundle --format esm,cjs --target node",
+    "build": "tsup && tsc --declaration --emitDeclarationOnly",
     "test": "vitest run",
     "format": "eslint --fix --max-warnings=0 --cache src && prettier --log-level warn --write src"
   },
@@ -68,19 +65,19 @@
   "sideEffects": false,
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@sveltejs/kit": "^2.55.0",
+    "@sveltejs/kit": "^2.56.1",
     "@tsconfig/recommended": "^1.0.13",
     "@types/node": "^24",
-    "@typescript-eslint/eslint-plugin": "^8.57.1",
-    "@typescript-eslint/parser": "^8.57.1",
+    "@typescript-eslint/eslint-plugin": "^8.58.0",
+    "@typescript-eslint/parser": "^8.58.0",
     "eslint": "^10",
     "globals": "^17.4.0",
-    "microbundle": "^0.15.1",
     "prettier": "^3.8.1",
-    "ts-jest": "^29.4.6",
+    "ts-jest": "^29.4.9",
     "ts-node": "^10.9.2",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "tsup": "^8",
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.3"
   },
   "dependencies": {
     "@nekm/core": "^1",

package/src/errors.ts

@@ -1,5 +1,4 @@
 export class ArmorError extends Error {}
 export class ArmorOpenIdConfigError extends ArmorError {}
-export class ArmorInvalidStateError extends ArmorError {}
 export class ArmorAuthMissingError extends ArmorError {}
 export class ArmorRefreshError extends ArmorError {}

package/src/index.ts

@@ -9,7 +9,7 @@ export type { ArmorConfig, ArmorTokens };
 export { armorCookieSession, armorCookieSessionGet } from "./session/cookie";
 export { armorRefreshFactory } from "./utils/refresh";
 
-interface Armor extends ArmorRefresh {
+export interface Armor extends ArmorRefresh {
 	readonly handle: Handle;
 }