@nekm/sveltekit-armor 0.4.3 → 0.5.0

package/dist/index.js

@@ -1,33 +1,106 @@
-var kit = require('@sveltejs/kit');
-var core = require('@nekm/core');
-var jose = require('jose');
-var node_crypto = require('node:crypto');
+"use strict";
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __async = (__this, __arguments, generator) => {
+  return new Promise((resolve, reject) => {
+    var fulfilled = (value) => {
+      try {
+        step(generator.next(value));
+      } catch (e) {
+        reject(e);
+      }
+    };
+    var rejected = (value) => {
+      try {
+        step(generator.throw(value));
+      } catch (e) {
+        reject(e);
+      }
+    };
+    var step = (x) => x.done ? resolve(x.value) : Promise.resolve(x.value).then(fulfilled, rejected);
+    step((generator = generator.apply(__this, __arguments)).next());
+  });
+};
 
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  armor: () => armor,
+  armorConfigFromOpenId: () => armorConfigFromOpenId,
+  armorCookieSession: () => armorCookieSession,
+  armorCookieSessionGet: () => armorCookieSessionGet,
+  armorRefreshFactory: () => armorRefreshFactory
+});
+module.exports = __toCommonJS(src_exports);
+var import_kit6 = require("@sveltejs/kit");
+
+// src/routes/login.ts
+var import_kit2 = require("@sveltejs/kit");
+var import_core4 = require("@nekm/core");
+
+// src/routes/redirect-login.ts
+var import_kit = require("@sveltejs/kit");
+var import_core3 = require("@nekm/core");
+var import_jose2 = require("jose");
+
+// src/utils/utils.ts
+var import_core = require("@nekm/core");
 function urlConcat(origin, path) {
-  return [core.strTrimEnd(origin, "/"), core.strTrimStart(path, "/")].join("/");
+  return [(0, import_core.strTrimEnd)(origin, "/"), (0, import_core.strTrimStart)(path, "/")].join("/");
 }
 function isTokenExchange(value) {
   if (typeof value !== "object" || value === null) return false;
   const obj = value;
-  return typeof obj.access_token === "string" && obj.token_type === "Bearer" && typeof obj.expires_in === "number" && (
-  // Optional fields
-  typeof obj.id_token === "string" || obj.id_token === undefined) && (typeof obj.refresh_token === "string" || obj.refresh_token === undefined) && (typeof obj.scope === "string" || obj.scope === undefined);
+  return typeof obj.access_token === "string" && obj.token_type === "Bearer" && typeof obj.expires_in === "number" && // Optional fields
+  (typeof obj.id_token === "string" || obj.id_token === void 0) && (typeof obj.refresh_token === "string" || obj.refresh_token === void 0) && (typeof obj.scope === "string" || obj.scope === void 0);
 }
-const MINUTES_MS = 60 * 1000;
+var MINUTES_MS = 60 * 1e3;
 function shouldRefresh(tokens) {
-  const idExpiry = tokens.idToken.exp * 1000;
-  const accessExpiry = typeof tokens.accessToken !== "string" && tokens.accessToken.exp !== undefined ? tokens.accessToken.exp * 1000 : Infinity;
+  const idExpiry = tokens.idToken.exp * 1e3;
+  const accessExpiry = typeof tokens.accessToken !== "string" && tokens.accessToken.exp !== void 0 ? tokens.accessToken.exp * 1e3 : Infinity;
   return Math.min(idExpiry, accessExpiry) < Date.now() + 5 * MINUTES_MS;
 }
 function createExpiresAt(seconds) {
-  const now = new Date();
+  const now = /* @__PURE__ */ new Date();
   now.setSeconds(now.getSeconds() + seconds);
   return now;
 }
 function exchangeToTokens(exchange, idToken, accessToken) {
   return {
     exchange,
-    idToken: idToken,
+    idToken,
     // Generally, IdP's require an audience to get a JWT
     // access token. Most cases, this doesn't matter.
     accessToken: accessToken != null ? accessToken : exchange.access_token,
@@ -35,61 +108,65 @@ function exchangeToTokens(exchange, idToken, accessToken) {
   };
 }
 
+// src/utils/jwt.ts
+var import_jose = require("jose");
+var import_core2 = require("@nekm/core");
 function jwtIsCompactJwt(token) {
-  // Must be three base64url segments
   const parts = token.trim().split(".");
-  return parts.length === 3 && parts.every(p => p.length > 0);
+  return parts.length === 3 && parts.every((p) => p.length > 0);
 }
 function jwtVerifyIdToken(config, jwks, idToken) {
-  const payload = jwtVerifyToken(jwks, {
-    issuer: config.oauth.issuer,
-    audience: config.oauth.clientId
-  }, idToken);
-  core.throwIfUndefined(payload);
-  // @ts-expect-error We're already verifying non-null above.
+  const payload = jwtVerifyToken(
+    jwks,
+    {
+      issuer: config.oauth.issuer,
+      audience: config.oauth.clientId
+    },
+    idToken
+  );
+  (0, import_core2.throwIfUndefined)(payload);
   return payload;
 }
 function jwtVerifyAccessToken(config, jwks, accessToken) {
-  const opts = {
-    issuer: config.oauth.issuer
-  };
+  const opts = { issuer: config.oauth.issuer };
   if (config.oauth.audience) {
     opts.audience = config.oauth.audience;
   }
   return jwtVerifyToken(jwks, opts, accessToken);
 }
 function isInvalidCompactJwt(error) {
-  return Boolean(typeof error === "object" && error && "message" in error && typeof error.message === "string" && /invalid compact jws/gi.test(error.message));
+  return Boolean(
+    typeof error === "object" && error && "message" in error && typeof error.message === "string" && /invalid compact jws/gi.test(error.message)
+  );
 }
-async function jwtVerifyToken(jwks, opts, token) {
-  try {
-    if (!jwtIsCompactJwt(token)) {
-      return undefined;
-    }
-    const {
-      payload
-    } = await jose.jwtVerify(token, jwks, opts);
-    return payload;
-  } catch (error) {
-    if (isInvalidCompactJwt(error)) {
-      return undefined;
+function jwtVerifyToken(jwks, opts, token) {
+  return __async(this, null, function* () {
+    try {
+      if (!jwtIsCompactJwt(token)) {
+        return void 0;
+      }
+      const { payload } = yield (0, import_jose.jwtVerify)(token, jwks, opts);
+      return payload;
+    } catch (error) {
+      if (isInvalidCompactJwt(error)) {
+        return void 0;
+      }
+      throw error;
     }
-    throw error;
-  }
+  });
 }
 
-const COOKIE_TOKENS = "tokens";
-const COOKIE_STATE = "state";
-const cookieDeleteOptions = Object.freeze({
-  path: "/"
-});
-const cookieSetOptions = Object.freeze({
-  ...cookieDeleteOptions,
+// src/utils/cookie.ts
+var COOKIE_TOKENS = "tokens";
+var COOKIE_STATE = "state";
+var cookieDeleteOptions = Object.freeze({ path: "/" });
+var cookieSetOptions = Object.freeze(__spreadProps(__spreadValues({}, cookieDeleteOptions), {
   httpOnly: true,
   secure: true,
   sameSite: "lax",
-  maxAge: 1800 // 30 minutes
-});
+  maxAge: 1800
+  // 30 minutes
+}));
 function cookieSet(cookies, key, value) {
   cookies.set(key, JSON.stringify(value), cookieSetOptions);
 }
@@ -102,207 +179,239 @@ function cookieGetAndDelete(cookies, key) {
 }
 function cookieGet(cookies, key) {
   const value = cookies.get(key);
-  return !value ? undefined : JSON.parse(value);
+  return !value ? void 0 : JSON.parse(value);
 }
 function cookieDelete(cookies, key) {
   cookies.delete(key, cookieDeleteOptions);
 }
 
-class ArmorError extends Error {}
-class ArmorOpenIdConfigError extends ArmorError {}
-class ArmorInvalidStateError extends ArmorError {}
-class ArmorAuthMissingError extends ArmorError {}
-class ArmorRefreshError extends ArmorError {}
-
-function eventStateValidOrThrow(event) {
-  var _event$url$searchPara;
-  const state = (_event$url$searchPara = event.url.searchParams.get("state")) != null ? _event$url$searchPara : undefined;
+// src/utils/event.ts
+function eventStateValid(event) {
+  var _a;
+  const state = (_a = event.url.searchParams.get("state")) != null ? _a : void 0;
   const stateCookie = cookieGetAndDelete(event.cookies, COOKIE_STATE);
-  if (state !== stateCookie) {
-    throw new ArmorInvalidStateError();
-  }
+  return state !== stateCookie;
 }
 
-const ROUTE_PATH_REDIRECT_LOGIN = "/_armor/redirect/login";
-const routeRedirectLoginFactory = config => {
-  var _config$oauth$jwksEnd, _config$oauth$tokenEn, _config$oauth$scope;
-  const jwksUrl = new URL((_config$oauth$jwksEnd = config.oauth.jwksEndpoint) != null ? _config$oauth$jwksEnd : urlConcat(config.oauth.baseUrl, ".well-known/jwks.json"));
-  const tokenUrl = (_config$oauth$tokenEn = config.oauth.tokenEndpoint) != null ? _config$oauth$tokenEn : urlConcat(config.oauth.baseUrl, "oauth2/token");
-  const scope = (_config$oauth$scope = config.oauth.scope) != null ? _config$oauth$scope : "openid profile email";
-  async function exchangeCodeForToken(fetch, origin, code) {
-    const params = {
-      grant_type: "authorization_code",
-      client_id: config.oauth.clientId,
-      client_secret: config.oauth.clientSecret,
-      code,
-      redirect_uri: urlConcat(origin, ROUTE_PATH_REDIRECT_LOGIN),
-      scope
-    };
-    if (config.oauth.audience) {
-      params.audience = config.oauth.audience;
-    }
-    const response = await fetch(tokenUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        Accept: "application/json"
-      },
-      body: new URLSearchParams(params).toString()
+// src/routes/redirect-login.ts
+var ROUTE_PATH_REDIRECT_LOGIN = "/_armor/redirect/login";
+var routeRedirectLoginFactory = (config) => {
+  var _a, _b, _c;
+  const jwksUrl = new URL(
+    (_a = config.oauth.jwksEndpoint) != null ? _a : urlConcat(config.oauth.baseUrl, ".well-known/jwks.json")
+  );
+  const tokenUrl = (_b = config.oauth.tokenEndpoint) != null ? _b : urlConcat(config.oauth.baseUrl, "oauth2/token");
+  const scope = (_c = config.oauth.scope) != null ? _c : "openid profile email";
+  function exchangeCodeForToken(fetch2, origin, code) {
+    return __async(this, null, function* () {
+      const params = {
+        grant_type: "authorization_code",
+        client_id: config.oauth.clientId,
+        client_secret: config.oauth.clientSecret,
+        code,
+        redirect_uri: urlConcat(origin, ROUTE_PATH_REDIRECT_LOGIN),
+        scope
+      };
+      if (config.oauth.audience) {
+        params.audience = config.oauth.audience;
+      }
+      const response = yield fetch2(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: new URLSearchParams(params).toString()
+      });
+      if (!response.ok) {
+        const error = yield response.text();
+        throw new Error(`Token exchange failed: ${error}`);
+      }
+      const token = yield response.json();
+      if (!isTokenExchange(token)) {
+        throw new Error("Response is not a valid token exchange.");
+      }
+      return token;
     });
-    if (!response.ok) {
-      const error = await response.text();
-      throw new Error(`Token exchange failed: ${error}`);
-    }
-    const token = await response.json();
-    if (!isTokenExchange(token)) {
-      throw new Error("Response is not a valid token exchange.");
-    }
-    return token;
   }
   return {
     path: ROUTE_PATH_REDIRECT_LOGIN,
-    async handle({
-      event
-    }) {
-      var _config$logger, _event$url$searchPara, _event$url$searchPara3, _config$logger3, _config$logger4, _config$logger5;
-      (_config$logger = config.logger) == null || _config$logger.debug == null || _config$logger.debug("Handle login redirect callback.");
-      eventStateValidOrThrow(event);
-      const error = (_event$url$searchPara = event.url.searchParams.get("error")) != null ? _event$url$searchPara : undefined;
-      if (error) {
-        var _event$url$searchPara2, _config$logger2;
-        const error_description = (_event$url$searchPara2 = event.url.searchParams.get("error_description")) != null ? _event$url$searchPara2 : undefined;
-        (_config$logger2 = config.logger) == null || _config$logger2.error == null || _config$logger2.error("Login returned error.", {
-          error,
-          errorDescription: error_description
-        });
-        if (!config.oauth.errorLoginRedirectPath) {
-          return new Response(`${error}\n${error_description}`.trimEnd(), {
-            headers: {
-              "Content-Type": "text/plain"
-            }
+    handle(_0) {
+      return __async(this, arguments, function* ({ event }) {
+        var _a2, _b2, _c2, _d2, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o;
+        (_b2 = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b2.call(_a2, "Handle login redirect callback.");
+        if (!eventStateValid(event)) {
+          (_d2 = (_c2 = config.logger) == null ? void 0 : _c2.warning) == null ? void 0 : _d2.call(_c2, "State missmatch");
+          throw (0, import_kit.redirect)(302, ROUTE_PATH_LOGIN);
+        }
+        const error = (_e = event.url.searchParams.get("error")) != null ? _e : void 0;
+        if (error) {
+          const error_description = (_f = event.url.searchParams.get("error_description")) != null ? _f : void 0;
+          (_h = (_g = config.logger) == null ? void 0 : _g.error) == null ? void 0 : _h.call(_g, "Login returned error.", {
+            error,
+            errorDescription: error_description
           });
+          if (!config.oauth.errorLoginRedirectPath) {
+            return new Response(`${error}
+${error_description}`.trimEnd(), {
+              headers: {
+                "Content-Type": "text/plain"
+              }
+            });
+          }
+          const errorParams = (0, import_core3.queryParamsCreate)({ error, error_description });
+          throw (0, import_kit.redirect)(
+            302,
+            `${config.oauth.errorLoginRedirectPath}?${errorParams}`
+          );
         }
-        const errorParams = core.queryParamsCreate({
-          error,
-          error_description
+        const code = (_i = event.url.searchParams.get("code")) != null ? _i : void 0;
+        (_k = (_j = config.logger) == null ? void 0 : _j.debug) == null ? void 0 : _k.call(_j, "Get code from query params.", { code });
+        (0, import_core3.throwIfUndefined)(code);
+        const exchange = yield exchangeCodeForToken(
+          event.fetch,
+          event.url.origin,
+          code
+        );
+        (_m = (_l = config.logger) == null ? void 0 : _l.debug) == null ? void 0 : _m.call(_l, "Exchange code for tokens.", { exchange });
+        const jwks = (0, import_jose2.createRemoteJWKSet)(jwksUrl);
+        const [idToken, accessToken] = yield Promise.all([
+          jwtVerifyIdToken(config, jwks, exchange.id_token),
+          jwtVerifyAccessToken(config, jwks, exchange.access_token)
+        ]);
+        (_o = (_n = config.logger) == null ? void 0 : _n.debug) == null ? void 0 : _o.call(_n, "Extract and verify tokens.", {
+          idToken,
+          accessToken
         });
-        throw kit.redirect(302, `${config.oauth.errorLoginRedirectPath}?${errorParams}`);
-      }
-      const code = (_event$url$searchPara3 = event.url.searchParams.get("code")) != null ? _event$url$searchPara3 : undefined;
-      (_config$logger3 = config.logger) == null || _config$logger3.debug == null || _config$logger3.debug("Get code from query params.", {
-        code
-      });
-      core.throwIfUndefined(code);
-      const exchange = await exchangeCodeForToken(event.fetch, event.url.origin, code);
-      (_config$logger4 = config.logger) == null || _config$logger4.debug == null || _config$logger4.debug("Exchange code for tokens.", {
-        exchange
-      });
-      const jwks = jose.createRemoteJWKSet(jwksUrl);
-      const [idToken, accessToken] = await Promise.all([jwtVerifyIdToken(config, jwks, exchange.id_token), jwtVerifyAccessToken(config, jwks, exchange.access_token)]);
-      (_config$logger5 = config.logger) == null || _config$logger5.debug == null || _config$logger5.debug("Extract and verify tokens.", {
-        idToken,
-        accessToken
+        yield config.session.login(
+          event,
+          exchangeToTokens(exchange, idToken, accessToken)
+        );
+        throw (0, import_kit.redirect)(302, "/");
       });
-      await config.session.login(event, exchangeToTokens(exchange, idToken, accessToken));
-      throw kit.redirect(302, "/");
     }
   };
 };
 
-const ARMOR_LOGIN = "/_armor/login";
-const ARMOR_LOGOUT = "/_armor/logout";
+// src/routes/login.ts
+var import_node_crypto = require("crypto");
+
+// src/browser/index.ts
+var ARMOR_LOGIN = "/_armor/login";
+var ARMOR_LOGOUT = "/_armor/logout";
 
-const ROUTE_PATH_LOGIN = ARMOR_LOGIN;
-const routeLoginFactory = config => {
-  var _config$oauth$authori, _config$oauth$scope;
-  const authorizeEndpoint = (_config$oauth$authori = config.oauth.authorizeEndpoint) != null ? _config$oauth$authori : urlConcat(config.oauth.baseUrl, "oauth2/authorize");
-  const scope = (_config$oauth$scope = config.oauth.scope) != null ? _config$oauth$scope : "openid profile email";
+// src/routes/login.ts
+var ROUTE_PATH_LOGIN = ARMOR_LOGIN;
+var routeLoginFactory = (config) => {
+  var _a, _b;
+  const authorizeEndpoint = (_a = config.oauth.authorizeEndpoint) != null ? _a : urlConcat(config.oauth.baseUrl, "oauth2/authorize");
+  const scope = (_b = config.oauth.scope) != null ? _b : "openid profile email";
   return {
     path: ROUTE_PATH_LOGIN,
-    async handle({
-      event
-    }) {
-      var _config$logger;
-      const state = node_crypto.randomUUID();
-      cookieSet(event.cookies, COOKIE_STATE, state);
-      const params = {
-        client_id: config.oauth.clientId,
-        response_type: "code",
-        redirect_uri: urlConcat(event.url.origin, ROUTE_PATH_REDIRECT_LOGIN),
-        state,
-        scope,
-        audience: config.oauth.audience
-      };
-      const paramsStr = core.queryParamsCreate(params);
-      (_config$logger = config.logger) == null || _config$logger.debug == null || _config$logger.debug("Pre login redirect.", {
-        params,
-        state
+    handle(_0) {
+      return __async(this, arguments, function* ({ event }) {
+        var _a2, _b2;
+        const state = (0, import_node_crypto.randomUUID)();
+        cookieSet(event.cookies, COOKIE_STATE, state);
+        const params = {
+          client_id: config.oauth.clientId,
+          response_type: "code",
+          redirect_uri: urlConcat(event.url.origin, ROUTE_PATH_REDIRECT_LOGIN),
+          state,
+          scope,
+          audience: config.oauth.audience
+        };
+        const paramsStr = (0, import_core4.queryParamsCreate)(params);
+        (_b2 = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b2.call(_a2, "Pre login redirect.", { params, state });
+        throw (0, import_kit2.redirect)(302, `${authorizeEndpoint}?${paramsStr}`);
       });
-      throw kit.redirect(302, `${authorizeEndpoint}?${paramsStr}`);
     }
   };
 };
 
-const ROUTE_PATH_REDIRECT_LOGOUT = "/_armor/redirect/logout";
-const routeRedirectLogoutFactory = config => {
-  // Check if the oauth provider supports a logout path.
+// src/routes/logout.ts
+var import_kit4 = require("@sveltejs/kit");
+var import_core5 = require("@nekm/core");
+
+// src/routes/redirect-logout.ts
+var import_kit3 = require("@sveltejs/kit");
+var ROUTE_PATH_REDIRECT_LOGOUT = "/_armor/redirect/logout";
+var routeRedirectLogoutFactory = (config) => {
   if (!config.oauth.logoutEndpoint) {
-    return undefined;
+    return void 0;
   }
   return {
     path: ROUTE_PATH_REDIRECT_LOGOUT,
-    async handle({
-      event
-    }) {
-      var _config$logger;
-      (_config$logger = config.logger) == null || _config$logger.debug == null || _config$logger.debug("Handle logout redirect callback.");
-      await config.session.logout(event);
-      throw kit.redirect(302, "/");
+    handle(_0) {
+      return __async(this, arguments, function* ({ event }) {
+        var _a2, _b;
+        (_b = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b.call(_a2, "Handle logout redirect callback.");
+        yield config.session.logout(event);
+        throw (0, import_kit3.redirect)(302, "/");
+      });
     }
   };
 };
 
-const ROUTE_PATH_LOGOUT = ARMOR_LOGOUT;
-const routeLogoutFactory = config => {
-  var _config$oauth$logoutR;
-  // Check if the oauth provider supports a logout path.
+// src/routes/logout.ts
+var ROUTE_PATH_LOGOUT = ARMOR_LOGOUT;
+var routeLogoutFactory = (config) => {
+  var _a;
   if (!config.oauth.logoutEndpoint) {
-    return undefined;
+    return void 0;
   }
-  const returnTo = (_config$oauth$logoutR = config.oauth.logoutReturnToParam) != null ? _config$oauth$logoutR : "logout_uri";
+  const returnTo = (_a = config.oauth.logoutReturnToParam) != null ? _a : "logout_uri";
   return {
     path: ROUTE_PATH_LOGOUT,
-    async handle({
-      event
-    }) {
-      var _config$logger;
-      const params = {
-        [returnTo]: urlConcat(event.url.origin, ROUTE_PATH_REDIRECT_LOGOUT),
-        client_id: config.oauth.clientId
-      };
-      const paramsStr = core.queryParamsCreate(params);
-      (_config$logger = config.logger) == null || _config$logger.debug == null || _config$logger.debug("Pre logout redirect.", {
-        params
+    handle(_0) {
+      return __async(this, arguments, function* ({ event }) {
+        var _a2, _b2;
+        const params = {
+          [returnTo]: urlConcat(event.url.origin, ROUTE_PATH_REDIRECT_LOGOUT),
+          client_id: config.oauth.clientId
+        };
+        const paramsStr = (0, import_core5.queryParamsCreate)(params);
+        (_b2 = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b2.call(_a2, "Pre logout redirect.", { params });
+        throw (0, import_kit4.redirect)(302, `${config.oauth.logoutEndpoint}?${paramsStr}`);
       });
-      throw kit.redirect(302, `${config.oauth.logoutEndpoint}?${paramsStr}`);
     }
   };
 };
 
-const routeFactories = Object.freeze([routeLoginFactory, routeLogoutFactory, routeRedirectLoginFactory, routeRedirectLogoutFactory]);
+// src/routes/routes.ts
+var routeFactories = Object.freeze([
+  routeLoginFactory,
+  routeLogoutFactory,
+  routeRedirectLoginFactory,
+  routeRedirectLogoutFactory
+]);
 function routeByPathFactory(config) {
-  // @ts-expect-error Incorrect typing error.
-  return new Map(routeFactories.map(routeFactory => routeFactory(config)).filter(route => Boolean(route))
-  // @ts-expect-error Incorrect typing error.
-  .map(route => [route.path, route]));
+  return new Map(
+    routeFactories.map((routeFactory) => routeFactory(config)).filter((route) => Boolean(route)).map((route) => [route.path, route])
+  );
 }
 
+// src/errors.ts
+var ArmorError = class extends Error {
+};
+var ArmorOpenIdConfigError = class extends ArmorError {
+};
+var ArmorAuthMissingError = class extends ArmorError {
+};
+var ArmorRefreshError = class extends ArmorError {
+};
+
+// src/utils/refresh.ts
+var import_jose3 = require("jose");
+var import_kit5 = require("@sveltejs/kit");
 function armorRefreshFactory(config) {
-  var _config$oauth$refresh, _config$oauth$jwksEnd;
-  const refreshEndpoint = (_config$oauth$refresh = config.oauth.refreshEndpoint) != null ? _config$oauth$refresh : urlConcat(config.oauth.baseUrl, "oauth2/token");
-  const jwksUrl = new URL((_config$oauth$jwksEnd = config.oauth.jwksEndpoint) != null ? _config$oauth$jwksEnd : urlConcat(config.oauth.baseUrl, ".well-known/jwks.json"));
-  const refresh = async (fetch, refreshToken) => {
-    var _json$refresh_token, _config$logger, _config$logger2;
+  var _a, _b;
+  const refreshEndpoint = (_a = config.oauth.refreshEndpoint) != null ? _a : urlConcat(config.oauth.baseUrl, "oauth2/token");
+  const jwksUrl = new URL(
+    (_b = config.oauth.jwksEndpoint) != null ? _b : urlConcat(config.oauth.baseUrl, ".well-known/jwks.json")
+  );
+  const refresh = (fetch2, refreshToken) => __async(null, null, function* () {
+    var _a2, _b2, _c2, _d, _e;
     const body = new URLSearchParams({
       grant_type: "refresh_token",
       client_id: config.oauth.clientId,
@@ -312,7 +421,7 @@ function armorRefreshFactory(config) {
     if (config.oauth.scope) {
       body.set("scope", config.oauth.scope);
     }
-    const response = await fetch(refreshEndpoint, {
+    const response = yield fetch2(refreshEndpoint, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
@@ -321,143 +430,139 @@ function armorRefreshFactory(config) {
       body: body.toString()
     });
     if (!response.ok) {
-      const error = await response.text();
+      const error = yield response.text();
       throw new ArmorRefreshError(`Could not refresh token: ${error}`);
     }
-    const json = await response.json();
-    const newExchange = {
-      ...json,
-      refresh_token: (_json$refresh_token = json.refresh_token) != null ? _json$refresh_token : refreshToken
-    };
-    (_config$logger = config.logger) == null || _config$logger.debug == null || _config$logger.debug("Exchange code for tokens.", {
-      newExchange
+    const json = yield response.json();
+    const newExchange = __spreadProps(__spreadValues({}, json), {
+      refresh_token: (_a2 = json.refresh_token) != null ? _a2 : refreshToken
     });
-    const jwks = jose.createRemoteJWKSet(jwksUrl);
-    const [idToken, accessToken] = await Promise.all([jwtVerifyIdToken(config, jwks, newExchange.id_token), jwtVerifyAccessToken(config, jwks, newExchange.access_token)]);
-    (_config$logger2 = config.logger) == null || _config$logger2.debug == null || _config$logger2.debug("Extract and verify tokens.", {
+    (_c2 = (_b2 = config.logger) == null ? void 0 : _b2.debug) == null ? void 0 : _c2.call(_b2, "Exchange code for tokens.", { newExchange });
+    const jwks = (0, import_jose3.createRemoteJWKSet)(jwksUrl);
+    const [idToken, accessToken] = yield Promise.all([
+      jwtVerifyIdToken(config, jwks, newExchange.id_token),
+      jwtVerifyAccessToken(config, jwks, newExchange.access_token)
+    ]);
+    (_e = (_d = config.logger) == null ? void 0 : _d.debug) == null ? void 0 : _e.call(_d, "Extract and verify tokens.", {
       idToken,
       accessToken
     });
-    const validTokens = exchangeToTokens(newExchange, idToken, accessToken);
+    const validTokens = exchangeToTokens(
+      newExchange,
+      idToken,
+      accessToken
+    );
     return validTokens;
-  };
+  });
   return {
     refresh,
-    async ensureValidToken(event, tokens, fn) {
-      try {
-        let validTokens = tokens;
-        if (shouldRefresh(tokens)) {
-          var _config$logger3;
-          (_config$logger3 = config.logger) == null || _config$logger3.debug == null || _config$logger3.debug("Tokens has expired. Refreshing...");
-          if (!tokens.exchange.refresh_token) {
-            throw kit.redirect(302, ROUTE_PATH_LOGIN);
+    ensureValidToken(event, tokens, fn) {
+      return __async(this, null, function* () {
+        var _a2, _b2;
+        try {
+          let validTokens = tokens;
+          if (shouldRefresh(tokens)) {
+            (_b2 = (_a2 = config.logger) == null ? void 0 : _a2.debug) == null ? void 0 : _b2.call(_a2, "Tokens has expired. Refreshing...");
+            if (!tokens.exchange.refresh_token) {
+              throw (0, import_kit5.redirect)(302, ROUTE_PATH_LOGIN);
+            }
+            validTokens = yield refresh(fetch, tokens.exchange.refresh_token);
+            yield config.session.login(event, validTokens);
           }
-          validTokens = await refresh(fetch, tokens.exchange.refresh_token);
-          await config.session.login(event, validTokens);
-        }
-        return fn(validTokens);
-      } catch (error) {
-        if (error instanceof ArmorRefreshError) {
-          throw kit.redirect(302, ROUTE_PATH_LOGIN);
+          return fn(validTokens);
+        } catch (error) {
+          if (error instanceof ArmorRefreshError) {
+            throw (0, import_kit5.redirect)(302, ROUTE_PATH_LOGIN);
+          }
+          throw error;
         }
-        throw error;
-      }
+      });
     }
   };
 }
 
+// src/session/cookie.ts
 function cookieSessionGetTokens({
   cookies
 }) {
   return cookies.get(COOKIE_TOKENS);
 }
-function cookieSessionLogin({
-  cookies
-}, tokens) {
+function cookieSessionLogin({ cookies }, tokens) {
   cookieSet(cookies, COOKIE_TOKENS, tokens);
 }
-function cookieSessionLogout({
-  cookies
-}) {
+function cookieSessionLogout({ cookies }) {
   cookieDelete(cookies, COOKIE_TOKENS);
 }
-function armorCookieSessionGet({
-  cookies
-}) {
+function armorCookieSessionGet({ cookies }) {
   const tokens = cookieGet(cookies, COOKIE_TOKENS);
   if (!tokens) {
     throw new ArmorAuthMissingError();
   }
   return tokens;
 }
-const armorCookieSession = {
+var armorCookieSession = {
   getTokens: cookieSessionGetTokens,
   login: cookieSessionLogin,
   logout: cookieSessionLogout
 };
 
+// src/index.ts
 function armor(config) {
   const routeByPath = routeByPathFactory(config);
   const refresh = armorRefreshFactory(config);
-  return {
-    ...refresh,
-    async handle({
-      event,
-      resolve
-    }) {
-      const route = routeByPath.get(event.url.pathname);
-      if (route) {
-        return route.handle({
-          event,
-          resolve
-        });
-      }
-      const tokens = await config.session.getTokens(event);
-      if (!tokens) {
-        var _config$logger;
-        (_config$logger = config.logger) == null || _config$logger.warning == null || _config$logger.warning("Could not find tokens. Redirecting to login.");
-        throw kit.redirect(302, ROUTE_PATH_LOGIN);
-      }
-      return refresh.ensureValidToken(event, tokens, () => resolve(event));
+  return __spreadProps(__spreadValues({}, refresh), {
+    handle(_0) {
+      return __async(this, arguments, function* ({ event, resolve }) {
+        var _a2, _b;
+        const route = routeByPath.get(event.url.pathname);
+        if (route) {
+          return route.handle({ event, resolve });
+        }
+        const tokens = yield config.session.getTokens(event);
+        if (!tokens) {
+          (_b = (_a2 = config.logger) == null ? void 0 : _a2.warning) == null ? void 0 : _b.call(
+            _a2,
+            "Could not find tokens. Redirecting to login."
+          );
+          throw (0, import_kit6.redirect)(302, ROUTE_PATH_LOGIN);
+        }
+        return refresh.ensureValidToken(event, tokens, () => resolve(event));
+      });
     }
-  };
+  });
 }
-/**
- * Some IdP's expose a /.well-known/openid-configuration that specifies how to configure.
- * Use that to create your config.
- * @param config
- * @param fetch
- */
-async function armorConfigFromOpenId(config, fetch) {
-  var _body$end_session_end;
-  const fetchToUse = fetch != null ? fetch : global.fetch;
-  const response = await fetchToUse(config.oauth.openIdConfigEndpoint, {
-    headers: {
-      Accept: "application/json"
+function armorConfigFromOpenId(config, fetch2) {
+  return __async(this, null, function* () {
+    var _a;
+    const fetchToUse = fetch2 != null ? fetch2 : global.fetch;
+    const response = yield fetchToUse(config.oauth.openIdConfigEndpoint, {
+      headers: {
+        Accept: "application/json"
+      }
+    });
+    if (!response.ok) {
+      const text = yield response.text();
+      throw new ArmorOpenIdConfigError(text);
     }
+    const body = yield response.json();
+    return __spreadProps(__spreadValues({}, config), {
+      oauth: __spreadProps(__spreadValues({}, config.oauth), {
+        tokenEndpoint: body.token_endpoint,
+        authorizeEndpoint: body.authorization_endpoint,
+        issuer: body.issuer,
+        jwksEndpoint: body.jwks_uri,
+        logoutEndpoint: (_a = body.end_session_endpoint) != null ? _a : void 0,
+        refreshEndpoint: body.token_endpoint
+      })
+    });
   });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new ArmorOpenIdConfigError(text);
-  }
-  const body = await response.json();
-  return {
-    ...config,
-    oauth: {
-      ...config.oauth,
-      tokenEndpoint: body.token_endpoint,
-      authorizeEndpoint: body.authorization_endpoint,
-      issuer: body.issuer,
-      jwksEndpoint: body.jwks_uri,
-      logoutEndpoint: (_body$end_session_end = body.end_session_endpoint) != null ? _body$end_session_end : undefined,
-      refreshEndpoint: body.token_endpoint
-    }
-  };
 }
-
-exports.armor = armor;
-exports.armorConfigFromOpenId = armorConfigFromOpenId;
-exports.armorCookieSession = armorCookieSession;
-exports.armorCookieSessionGet = armorCookieSessionGet;
-exports.armorRefreshFactory = armorRefreshFactory;
-//# sourceMappingURL=index.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  armor,
+  armorConfigFromOpenId,
+  armorCookieSession,
+  armorCookieSessionGet,
+  armorRefreshFactory
+});
+//# sourceMappingURL=index.js.map