@nyuchi/mzizi-mcp 0.11.1 → 0.12.0

package/README.md

@@ -12,7 +12,7 @@ Owned and operated by **Mzizi**.
 ---
 
 **Live at** `https://mcp.mzizi.dev/mcp` (Cloudflare Worker `mzizi-mcp`, version
-0.11.1 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
+0.12.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
 reports, and it moves in lockstep with `package.json` and `server.json`).
 
 ## Free, with no gate except Fundi
@@ -98,11 +98,11 @@ stdio bin, and `mzizi_fundi` is not offered there.
 
 Nothing is read from a database, and no registry data is fetched at request time.
 
-| Data                                                                                                                                                                                                                 | Source                                                                                                                                     | How it gets into the Worker                                                                                                                                          |
-| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Components, index, component docs, Rust (Mzizi Roots) implementations and their crates, brand tokens, architecture helix + nodes, Ubuntu pillars/principles, conventions, AI instruction sets, changelog, rename map | [mzizi-dev/mzizi-registry](https://github.com/mzizi-dev/mzizi-registry) at the commit pinned in [`registry.pin.json`](./registry.pin.json) | `scripts/generate-registry.mjs` fetches that exact commit and calls the registry's **own API route handlers** once per resource, writing `src/generated/registry.ts` |
-| Agent skills                                                                                                                                                                                                         | `../mzizi-skills/skills/*/SKILL.md` in this repo                                                                                           | `scripts/generate-skills.mjs` → `src/generated/skills.ts`                                                                                                            |
-| Documentation                                                                                                                                                                                                        | the Mintlify MCP at `https://docs.mzizi.dev/mcp`                                                                                           | federated live — see below                                                                                                                                           |
+| Data                                                                                                                                                                                                                 | Source                                                                                                                                     | How it gets into the Worker                                                                                                                                      |
+| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Components, index, component docs, Rust (Mzizi Roots) implementations and their crates, brand tokens, architecture helix + nodes, Ubuntu pillars/principles, conventions, AI instruction sets, changelog, rename map | [mzizi-dev/mzizi-registry](https://github.com/mzizi-dev/mzizi-registry) at the commit pinned in [`registry.pin.json`](./registry.pin.json) | `scripts/generate-registry.mjs` fetches that exact commit and calls the registry's **API route handlers** once per resource, writing `src/generated/registry.ts` |
+| Agent skills                                                                                                                                                                                                         | `../mzizi-skills/skills/*/SKILL.md` in this repo                                                                                           | `scripts/generate-skills.mjs` → `src/generated/skills.ts`                                                                                                        |
+| Documentation                                                                                                                                                                                                        | the Mintlify MCP at `https://docs.mzizi.dev/mcp`                                                                                           | federated live — see below                                                                                                                                       |
 
 Both generated files are build output: gitignored, never committed, rebuilt by
 `pnpm generate` (which `build`, `build:worker`, `cf:dev`, `cf:deploy`, `test`,
@@ -111,7 +111,15 @@ Both generated files are build output: gitignored, never committed, rebuilt by
 
 Because the generator runs the registry's route handlers rather than
 re-deriving their output, a tool here answers with the same payload
-`api.mzizi.dev/v1` would give at the pinned commit. The registry checkout has no
+`api.mzizi.dev/v1` would give at the pinned commit. The registry removed those
+handlers with its Next.js app
+([mzizi-registry#389](https://github.com/mzizi-dev/mzizi-registry/pull/389)), so
+the eleven the generator calls are ported, unchanged but for formatting, from
+its last commit with them,
+[`270af9f`](https://github.com/mzizi-dev/mzizi-registry/tree/270af9fbbded5dcca3fad4dcbc09ee3b7e307c7d/app/api/v1),
+into [`scripts/registry-handlers/`](./scripts/registry-handlers/). They still
+call the pinned registry's own `lib/` readers, so the data is the pin's; nothing
+imports the registry's `app/` tree. The registry checkout has no
 `node_modules`: every npm package a route imports is replaced with a module that
 throws on use, so a route that still reads a database **fails the build** rather
 than shipping an empty answer.
@@ -236,10 +244,10 @@ released_at}` with `meta.previousNames`. The database view it used to read is go
 
 Secrets (`wrangler secret put`):
 
-| Secret                  | Required | Notes                                                          |
-| ----------------------- | -------- | -------------------------------------------------------------- |
-| `COOKIE_ENCRYPTION_KEY` | yes      | HMAC key for the consent cookie (random bytes)                 |
-| `WORKOS_AUTHKIT_DOMAIN` | no       | AuthKit domain for `/oauth2/*` (`https://accounts.mukoko.com`) |
+| Secret                  | Required | Notes                                                                             |
+| ----------------------- | -------- | --------------------------------------------------------------------------------- |
+| `COOKIE_ENCRYPTION_KEY` | yes      | HMAC key for the consent cookie (random bytes)                                    |
+| `WORKOS_AUTHKIT_DOMAIN` | yes      | AuthKit domain for `/oauth2/*`; set per environment, never committed (no default) |
 
 **There is deliberately no `GITHUB_TOKEN` here.** The issue desk used to file GitHub issues
 itself with a PAT that was never set on this Worker, so every report parked at `drafted` and no

package/dist/auth/authkit-handler.d.ts

@@ -5,7 +5,7 @@
  * configured as a PUBLIC client: it has a client id only and NO secret, so the
  * worker holds no WorkOS API key. The flow is standard OAuth 2.0
  * authorization-code with **PKCE** against the AuthKit domain
- * (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://accounts.mukoko.com):
+ * (`WORKOS_AUTHKIT_DOMAIN` — required, set per environment; no default):
  *
  *   /authorize  → MCP-client consent, then 302 to <authkit>/oauth2/authorize
  *                 with a PKCE code_challenge

package/dist/auth/authkit-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authkit-handler.d.ts","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAEV,YAAY,EACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAiBrC,KAAK,OAAO,GAAG;IAAE,QAAQ,EAAE,GAAG,GAAG;QAAE,cAAc,EAAE,YAAY,CAAA;KAAE,CAAA;CAAE,CAAC;AAmVpE,eAAO,MAAM,cAAc,sDAAM,CAAC"}
+{"version":3,"file":"authkit-handler.d.ts","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAEV,YAAY,EACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAuBrC,KAAK,OAAO,GAAG;IAAE,QAAQ,EAAE,GAAG,GAAG;QAAE,cAAc,EAAE,YAAY,CAAA;KAAE,CAAA;CAAE,CAAC;AA8VpE,eAAO,MAAM,cAAc,sDAAM,CAAC"}

package/dist/auth/authkit-handler.js

@@ -5,7 +5,7 @@
  * configured as a PUBLIC client: it has a client id only and NO secret, so the
  * worker holds no WorkOS API key. The flow is standard OAuth 2.0
  * authorization-code with **PKCE** against the AuthKit domain
- * (`WORKOS_AUTHKIT_DOMAIN`, e.g. https://accounts.mukoko.com):
+ * (`WORKOS_AUTHKIT_DOMAIN` — required, set per environment; no default):
  *
  *   /authorize  → MCP-client consent, then 302 to <authkit>/oauth2/authorize
  *                 with a PKCE code_challenge
@@ -25,8 +25,10 @@
 import { Hono } from "hono";
 import * as jose from "jose";
 import { fundiConfigured } from "../fundi-client.js";
-import { authkitDomain } from "../identity.js";
+import { AUTHKIT_DOMAIN_MISSING, authkitDomain, hasAuthkitDomain, } from "../identity.js";
 import { mziziToolCatalogue } from "../server.js";
+import { parseAuthRequestOrReject } from "./authorize-request.js";
+import { verifyIdToken } from "./id-token.js";
 import { addApprovedClient, bindStateToSession, createOAuthState, generateCSRFProtection, isClientApproved, OAuthError, renderApprovalDialog, validateCSRFToken, validateOAuthState, } from "./oauth-utils.js";
 const SERVER_NAME = "Mzizi Design System Registry";
 const SERVER_DESCRIPTION = "Free, public MCP over the Mzizi design-system registry — components, design tokens, brand, the ecosystem architecture nodes, agent skills and the docs. No account needed; sign in (free) only to use Fundi.";
@@ -72,13 +74,10 @@ async function deriveCodeChallenge(verifier) {
     return base64url(digest);
 }
 function authkitOrigin(c) {
-    // Accept a bare host or a full origin, and tolerate the secret being unset —
-    // `authkitDomain` falls back to a live issuer rather than throwing on
-    // `undefined.trim()`. The bare-host case is real: at least one Worker on this
-    // account stores the hostname with no scheme, so a find-and-replace that
-    // assumes one produces `https://https://…`.
-    const raw = authkitDomain(c.env);
-    return /^https?:\/\//.test(raw) ? raw : `https://${raw}`;
+    // From configuration only — `authkitDomain` normalises a bare host or a full
+    // origin and throws when `WORKOS_AUTHKIT_DOMAIN` is unset. The routes that
+    // reach this are guarded below so that case answers a clear 503.
+    return authkitDomain(c.env);
 }
 function callbackUrl(c) {
     return new URL("/callback", c.req.url).href;
@@ -121,8 +120,21 @@ app.options("/catalogue.json", () => new Response(null, {
 }));
 app.get("/favicon.ico", () => redirectToIcon());
 app.get("/icon.png", () => redirectToIcon());
+// The sign-in flow needs the identity tenant, which comes only from
+// configuration. Without it, fail closed and say which setting is missing.
+for (const path of ["/authorize", "/callback"]) {
+    app.use(path, async (c, next) => {
+        if (!hasAuthkitDomain(c.env)) {
+            return c.text(`Service Unavailable: ${AUTHKIT_DOMAIN_MISSING}`, 503);
+        }
+        await next();
+    });
+}
 app.get("/authorize", async (c) => {
-    const oauthReqInfo = await c.env.OAUTH_PROVIDER.parseAuthRequest(c.req.raw);
+    const parsed = await parseAuthRequestOrReject(c.req.raw, c.env.OAUTH_PROVIDER);
+    if (parsed instanceof Response)
+        return parsed;
+    const oauthReqInfo = parsed;
     const { clientId } = oauthReqInfo;
     if (!clientId)
         return c.text("Invalid request", 400);
@@ -239,16 +251,22 @@ app.get("/callback", async (c) => {
         return c.text("Sign-in failed at the token exchange", 502);
     }
     const tokens = (await tokenResponse.json());
-    const idToken = tokens.id_token ?? tokens.access_token;
+    // The ID token only — never the access token in its place: it is the token
+    // whose `aud` is this OAuth application, and the one `openid` guarantees.
+    const idToken = tokens.id_token;
     if (!idToken)
         return c.text("No id token returned", 502);
-    // Verify the token's signature against the AuthKit JWKS (authenticity); the
-    // token was obtained over a direct TLS exchange, so this is defense in depth.
+    // Verify the ID token: signature against the AuthKit JWKS, `iss` bound to
+    // the normalised AuthKit origin, `aud` bound to our WorkOS client ID, and
+    // expiry. Any failure — including a missing client ID — fails closed.
     let claims;
     try {
-        const jwks = jose.createRemoteJWKSet(new URL("/oauth2/jwks", authkitOrigin(c)));
-        const verified = await jose.jwtVerify(idToken, jwks);
-        claims = verified.payload;
+        const issuer = authkitOrigin(c);
+        const jwks = jose.createRemoteJWKSet(new URL("/oauth2/jwks", issuer));
+        claims = await verifyIdToken(idToken, jwks, {
+            issuer,
+            clientId: c.env.WORKOS_CLIENT_ID,
+        });
     }
     catch (error) {
         console.error("id-token verification failed:", error);

package/dist/auth/authkit-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"authkit-handler.js","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,kBAAkB,GACtB,8MAA8M,CAAC;AACjN,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAW,CAAC;AAEhC,gFAAgF;AAChF,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,CAAmB;IACxC,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,CAAmB;IACtC,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,QAAQ,EAAE,aAAa;YACvB,eAAe,EAAE,uBAAuB;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,IAAI,CACJ,2IAA2I,WAAW,0UAA0U,WAAW,WAAW,kBAAkB,4eAA4e,EACp/B,GAAG,EACH,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAC3C,CACF,CAAC;AACF;;;;;;;;;;;;GAYG;AACH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE;IACvE,kEAAkE;IAClE,6BAA6B,EAAE,GAAG;IAClC,eAAe,EAAE,qBAAqB;CACvC,CAAC,CACH,CAAC;AACF,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAClC,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE;QACP,6BAA6B,EAAE,GAAG;QAClC,8BAA8B,EAAE,cAAc;QAC9C,8BAA8B,EAAE,cAAc;KAC/C;CACF,CAAC,CACH,CAAC;AAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAChD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAErD,IACE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,EACxE,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAEjE,OAAO,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC;QACzD,SAAS;QACT,MAAM,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE;QAC9D,SAAS;QACT,KAAK,EAAE,EAAE,YAAY,EAAE;KACxB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5C,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,iBAAiB,CAClD,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CAAC,QAAQ,EAC3B,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAC5B,CAAC;QAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAC3C,KAAK,CAAC,YAAY,EAClB,CAAC,CAAC,GAAG,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAEnD,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,KAAK,UAAU,UAAU,CACvB,CAAmB,EACnB,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,UAAU,EAAE,EAAE,YAAY,EAAE;QACjE,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAUD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,IAAI,YAAyB,CAAC;IAC9B,IAAI,kBAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnE,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACnC,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,YAAY;QACf,OAAO,CAAC,CAAC,IAAI,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,WAAW;QAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE1D,iEAAiE;IACjE,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,IAAI,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAC1C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;YACjC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5B,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CACF,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CACX,wBAAwB,EACxB,aAAa,CAAC,MAAM,EACpB,MAAM,aAAa,CAAC,IAAI,EAAE,CAC3B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAkB,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,MAMH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAClC,IAAI,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAEzD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;QACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjE,SAAS,CAAC;IACZ,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,EAAE,CAAC;IAEP,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,KAAK,GAAU;QACnB,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,WAAW,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW;KACZ,CAAC;IAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;QACtE,OAAO,EAAE,YAAY;QACrB,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,WAAW;QAClB,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,IAAI,kBAAkB;QAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAEtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC"}
+{"version":3,"file":"authkit-handler.js","sourceRoot":"","sources":["../../src/auth/authkit-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAsB,aAAa,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,kBAAkB,GACtB,8MAA8M,CAAC;AACjN,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAW,CAAC;AAEhC,gFAAgF;AAChF,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,CAAmB;IACxC,6EAA6E;IAC7E,2EAA2E;IAC3E,iEAAiE;IACjE,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,CAAmB;IACtC,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,QAAQ,EAAE,aAAa;YACvB,eAAe,EAAE,uBAAuB;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,CAAC,CAAC,IAAI,CACJ,2IAA2I,WAAW,0UAA0U,WAAW,WAAW,kBAAkB,4eAA4e,EACp/B,GAAG,EACH,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAC3C,CACF,CAAC;AACF;;;;;;;;;;;;GAYG;AACH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE;IACvE,kEAAkE;IAClE,6BAA6B,EAAE,GAAG;IAClC,eAAe,EAAE,qBAAqB;CACvC,CAAC,CACH,CAAC;AACF,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAClC,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE;QACP,6BAA6B,EAAE,GAAG;QAClC,8BAA8B,EAAE,cAAc;QAC9C,8BAA8B,EAAE,cAAc;KAC/C;CACF,CAAC,CACH,CAAC;AAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAChD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7C,oEAAoE;AACpE,2EAA2E;AAC3E,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;IAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,CAAC,CAAC,GAAG,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAErD,IACE,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,EACxE,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAEjE,OAAO,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC;QACzD,SAAS;QACT,MAAM,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE;QAC9D,SAAS;QACT,KAAK,EAAE,EAAE,YAAY,EAAE;KACxB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5C,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,iBAAiB,CAClD,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CAAC,QAAQ,EAC3B,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAC5B,CAAC;QAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,gBAAgB,CAC3C,KAAK,CAAC,YAAY,EAClB,CAAC,CAAC,GAAG,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GACvC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAEnD,OAAO,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,KAAK,UAAU,UAAU,CACvB,CAAmB,EACnB,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,UAAU,EAAE,EAAE,YAAY,EAAE;QACjE,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAUD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,IAAI,YAAyB,CAAC;IAC9B,IAAI,kBAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnE,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACnC,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,YAAY;QACf,OAAO,CAAC,CAAC,IAAI,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,WAAW;QAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE1D,iEAAiE;IACjE,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,IAAI,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAC1C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;YACjC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5B,aAAa,EAAE,YAAY;SAC5B,CAAC;KACH,CACF,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CACX,wBAAwB,EACxB,aAAa,CAAC,MAAM,EACpB,MAAM,aAAa,CAAC,IAAI,EAAE,CAC3B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAkB,CAAC;IAC7D,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAEzD,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE;YAC1C,MAAM;YACN,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAEzD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;QACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACjE,SAAS,CAAC;IACZ,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,EAAE,CAAC;IAEP,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,KAAK,GAAU;QACnB,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,IAAI,IAAI,SAAS;QACvB,WAAW,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,WAAW;KACZ,CAAC;IAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;QACtE,OAAO,EAAE,YAAY;QACrB,MAAM;QACN,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,WAAW;QAClB,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,IAAI,kBAAkB;QAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAEtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC"}

package/dist/auth/authorize-request.d.ts

@@ -0,0 +1,12 @@
+import type { AuthRequest, OAuthHelpers } from "@cloudflare/workers-oauth-provider";
+/**
+ * Parse an /authorize request, answering a bad one with a 400 rather than
+ * letting the provider's throw surface as a 500.
+ *
+ * An unknown client_id or a redirect_uri that does not match a registered one
+ * must not be redirected (RFC 6749 §4.1.2.1): the error goes straight back to
+ * the user agent. An unknown client gets `invalid_client`; anything else the
+ * provider rejects gets `invalid_request` with its description.
+ */
+export declare function parseAuthRequestOrReject(request: Request, provider: Pick<OAuthHelpers, "parseAuthRequest" | "lookupClient">): Promise<AuthRequest | Response>;
+//# sourceMappingURL=authorize-request.d.ts.map

package/dist/auth/authorize-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-request.d.ts","sourceRoot":"","sources":["../../src/auth/authorize-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACb,MAAM,oCAAoC,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,CA0BjC"}

package/dist/auth/authorize-request.js

@@ -0,0 +1,37 @@
+/**
+ * Parse an /authorize request, answering a bad one with a 400 rather than
+ * letting the provider's throw surface as a 500.
+ *
+ * An unknown client_id or a redirect_uri that does not match a registered one
+ * must not be redirected (RFC 6749 §4.1.2.1): the error goes straight back to
+ * the user agent. An unknown client gets `invalid_client`; anything else the
+ * provider rejects gets `invalid_request` with its description.
+ */
+export async function parseAuthRequestOrReject(request, provider) {
+    const clientId = new URL(request.url).searchParams.get("client_id");
+    if (!clientId) {
+        return authorizeError("invalid_request", "client_id is required");
+    }
+    let client = null;
+    try {
+        client = await provider.lookupClient(clientId);
+    }
+    catch {
+        client = null;
+    }
+    if (!client) {
+        return authorizeError("invalid_client", "Unknown client_id");
+    }
+    try {
+        return await provider.parseAuthRequest(request);
+    }
+    catch (error) {
+        return authorizeError("invalid_request", error instanceof Error && error.message
+            ? error.message
+            : "Invalid authorization request");
+    }
+}
+function authorizeError(error, description) {
+    return Response.json({ error, error_description: description }, { status: 400, headers: { "Cache-Control": "no-store" } });
+}
+//# sourceMappingURL=authorize-request.js.map

package/dist/auth/authorize-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-request.js","sourceRoot":"","sources":["../../src/auth/authorize-request.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,QAAiE;IAEjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,cAAc,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,GAAsD,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,cAAc,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,cAAc,CACnB,iBAAiB,EACjB,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,+BAA+B,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,WAAmB;IACxD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAC1D,CAAC;AACJ,CAAC"}

package/dist/auth/id-token.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Verify the ID token returned by the AuthKit token exchange in `/callback`.
+ *
+ * A valid signature alone only proves WorkOS signed the token — not that it was
+ * issued by OUR AuthKit tenant, nor for OUR OAuth application. So the check is
+ * bound three ways, and fails closed on any mismatch:
+ *
+ * - signature against the tenant's JWKS (`<authkit origin>/oauth2/jwks`);
+ * - `iss` — exactly the normalised AuthKit origin (WorkOS issues AuthKit ID
+ *   tokens with `iss` = `https://<authkit domain>`, no trailing slash, which is
+ *   what the domain normaliser returns);
+ * - `aud` — the WorkOS client ID the sign-in flow uses (`WORKOS_CLIENT_ID`).
+ *
+ * `exp` / `nbf` are checked by `jose.jwtVerify` itself.
+ */
+import * as jose from "jose";
+export type IdTokenClaims = jose.JWTPayload & {
+    email?: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    permissions?: string[];
+};
+export declare function verifyIdToken(idToken: string, jwks: jose.JWTVerifyGetKey, expected: {
+    issuer: string;
+    clientId: string | undefined;
+}): Promise<IdTokenClaims>;
+//# sourceMappingURL=id-token.d.ts.map

package/dist/auth/id-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token.d.ts","sourceRoot":"","sources":["../../src/auth/id-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,GAAG;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,IAAI,CAAC,eAAe,EAC1B,QAAQ,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzD,OAAO,CAAC,aAAa,CAAC,CAYxB"}

package/dist/auth/id-token.js

@@ -0,0 +1,32 @@
+/**
+ * Verify the ID token returned by the AuthKit token exchange in `/callback`.
+ *
+ * A valid signature alone only proves WorkOS signed the token — not that it was
+ * issued by OUR AuthKit tenant, nor for OUR OAuth application. So the check is
+ * bound three ways, and fails closed on any mismatch:
+ *
+ * - signature against the tenant's JWKS (`<authkit origin>/oauth2/jwks`);
+ * - `iss` — exactly the normalised AuthKit origin (WorkOS issues AuthKit ID
+ *   tokens with `iss` = `https://<authkit domain>`, no trailing slash, which is
+ *   what the domain normaliser returns);
+ * - `aud` — the WorkOS client ID the sign-in flow uses (`WORKOS_CLIENT_ID`).
+ *
+ * `exp` / `nbf` are checked by `jose.jwtVerify` itself.
+ */
+import * as jose from "jose";
+export async function verifyIdToken(idToken, jwks, expected) {
+    const issuer = expected.issuer;
+    const clientId = expected.clientId?.trim();
+    // Never verify without a binding: an empty issuer or client ID would turn the
+    // claim checks off rather than make them fail.
+    if (!issuer)
+        throw new Error("id-token verification: no issuer configured");
+    if (!clientId)
+        throw new Error("id-token verification: WORKOS_CLIENT_ID is not configured");
+    const { payload } = await jose.jwtVerify(idToken, jwks, {
+        issuer,
+        audience: clientId,
+    });
+    return payload;
+}
+//# sourceMappingURL=id-token.js.map

package/dist/auth/id-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token.js","sourceRoot":"","sources":["../../src/auth/id-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAU7B,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,IAA0B,EAC1B,QAA0D;IAE1D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,8EAA8E;IAC9E,+CAA+C;IAC/C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC5F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACtD,MAAM;QACN,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,OAAwB,CAAC;AAClC,CAAC"}

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAiBlB,gBAAgB,EAAE,MAAM,CAAA;IAWxB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAO9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAM7B,UAAU,EAAE,sBAAsB,CAAC,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAA;IAMvE,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAA;IAGvD,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAiBlB,gBAAgB,EAAE,MAAM,CAAA;IAYxB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAO9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAM7B,UAAU,EAAE,sBAAsB,CAAC,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAA;IAMvE,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAA;IAGvD,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}

package/dist/fundi-client.d.ts

@@ -32,12 +32,12 @@ export interface FundiToolContext {
 /**
  * True when either path to fundi is wired: the Service Binding or HTTP + M2M.
  *
- * `WORKOS_AUTHKIT_DOMAIN` is deliberately NOT in this condition. It is now a
- * secret with a live default, so it always resolves — and gating on it would
- * reintroduce the exact failure this Worker already shipped once: a capability
- * conditioned on a credential that turned out not to be set does not error, it
- * DISAPPEARS. All four fundi tools were absent from the deployed public surface
- * for weeks because `fundiConfigured` answered false and nothing said so.
+ * `WORKOS_AUTHKIT_DOMAIN` is deliberately NOT in this condition. A capability
+ * conditioned on a setting that turned out not to be set does not error, it
+ * DISAPPEARS — all four fundi tools were once absent from the deployed public
+ * surface for weeks because `fundiConfigured` answered false and nothing said
+ * so. Leaving it out keeps the tools visible; a call made while it is unset
+ * fails loudly with "WORKOS_AUTHKIT_DOMAIN is not configured" instead.
  *
  * The values that remain are the ones with no usable default: without the M2M
  * client id, secret and fundi URL there is genuinely no HTTP path to fundi.

package/dist/fundi-client.js

@@ -49,12 +49,12 @@ const BINDING_ORIGIN = "https://fundi.internal";
 /**
  * True when either path to fundi is wired: the Service Binding or HTTP + M2M.
  *
- * `WORKOS_AUTHKIT_DOMAIN` is deliberately NOT in this condition. It is now a
- * secret with a live default, so it always resolves — and gating on it would
- * reintroduce the exact failure this Worker already shipped once: a capability
- * conditioned on a credential that turned out not to be set does not error, it
- * DISAPPEARS. All four fundi tools were absent from the deployed public surface
- * for weeks because `fundiConfigured` answered false and nothing said so.
+ * `WORKOS_AUTHKIT_DOMAIN` is deliberately NOT in this condition. A capability
+ * conditioned on a setting that turned out not to be set does not error, it
+ * DISAPPEARS — all four fundi tools were once absent from the deployed public
+ * surface for weeks because `fundiConfigured` answered false and nothing said
+ * so. Leaving it out keeps the tools visible; a call made while it is unset
+ * fails loudly with "WORKOS_AUTHKIT_DOMAIN is not configured" instead.
  *
  * The values that remain are the ones with no usable default: without the M2M
  * client id, secret and fundi URL there is genuinely no HTTP path to fundi.

package/dist/generated/registry-pin.d.ts

@@ -1,5 +1,5 @@
 export declare const REGISTRY_PIN: {
     readonly repository: "https://github.com/mzizi-dev/mzizi-registry";
-    readonly ref: "9b86e034ffd84cff9ae0214201dc4bc4b15b2885";
+    readonly ref: "5067b5e4c1cd46d61a0f26b721e382d4c1eb7ed8";
 };
 //# sourceMappingURL=registry-pin.d.ts.map

package/dist/generated/registry-pin.js

@@ -1,3 +1,3 @@
 // GENERATED by scripts/generate-registry.mjs — do not edit, do not commit.
-export const REGISTRY_PIN = { "repository": "https://github.com/mzizi-dev/mzizi-registry", "ref": "9b86e034ffd84cff9ae0214201dc4bc4b15b2885" };
+export const REGISTRY_PIN = { "repository": "https://github.com/mzizi-dev/mzizi-registry", "ref": "5067b5e4c1cd46d61a0f26b721e382d4c1eb7ed8" };
 //# sourceMappingURL=registry-pin.js.map

package/dist/generated/registry.d.ts

@@ -1,14 +1,15 @@
 /**
  * GENERATED by scripts/generate-registry.mjs — do not edit, do not commit.
  *
- * The mzizi registry at https://github.com/mzizi-dev/mzizi-registry/tree/9b86e034ffd84cff9ae0214201dc4bc4b15b2885
- * (pinned in registry.pin.json), produced by calling the registry's own API
- * route handlers at build time. Every value is a JSON string, parsed lazily by
- * src/registry.ts, so a cold start pays only for what a request reads.
+ * The mzizi registry at https://github.com/mzizi-dev/mzizi-registry/tree/5067b5e4c1cd46d61a0f26b721e382d4c1eb7ed8
+ * (pinned in registry.pin.json), produced by calling the registry's API route
+ * handlers (ported from 270af9f into scripts/registry-handlers/) at build
+ * time. Every value is a JSON string, parsed lazily by src/registry.ts, so a
+ * cold start pays only for what a request reads.
  */
 export declare const REGISTRY_PIN: {
     readonly repository: "https://github.com/mzizi-dev/mzizi-registry";
-    readonly ref: "9b86e034ffd84cff9ae0214201dc4bc4b15b2885";
+    readonly ref: "5067b5e4c1cd46d61a0f26b721e382d4c1eb7ed8";
 };
 /** Whole-resource payloads, keyed by section. */
 export declare const SECTIONS: Readonly<Record<string, string>>;
@@ -26,6 +27,12 @@ export declare const RUST: Readonly<Record<string, string>>;
 export declare const RUST_CRATES: Readonly<Record<string, string>>;
 /** `/rs/{name}` for a component with no Rust, with `{name}` in place of the name. */
 export declare const RUST_MISSING: string;
+/**
+ * `/astro/{name}` per component WITH an Astro implementation: the registry
+ * document (files with targets under src/components/mzizi/, npm dependencies,
+ * /v1/astro registryDependencies) from mzizi-registry lib/astro.ts.
+ */
+export declare const ASTRO: Readonly<Record<string, string>>;
 /** `/architecture/nodes/{n}` per node or rung. */
 export declare const NODES: Readonly<Record<string, string>>;
 /** `/ai/instructions/{name}` per instruction set. */

package/dist/generated/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/generated/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,eAAO,MAAM,YAAY;;;CAAyH,CAAA;AAElJ,iDAAiD;AACjD,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUrD,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkkBvD,CAAA;AAED,uCAAuC;AACvC,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkkB3D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwDjD,CAAA;AAED,uGAAuG;AACvG,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA6yD,CAAA;AAEt2D,qFAAqF;AACrF,eAAO,MAAM,YAAY,EAAE,MAAyP,CAAA;AAEpR,kDAAkD;AAClD,eAAO,MAAM,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAalD,CAAA;AAED,qDAAqD;AACrD,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI5D,CAAA"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/generated/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,eAAO,MAAM,YAAY;;;CAAyH,CAAA;AAElJ,iDAAiD;AACjD,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUrD,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgpBvD,CAAA;AAED,uCAAuC;AACvC,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgpB3D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4DjD,CAAA;AAED,uGAAuG;AACvG,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA64D,CAAA;AAEt8D,qFAAqF;AACrF,eAAO,MAAM,YAAY,EAAE,MAAyP,CAAA;AAEpR;;;;GAIG;AACH,eAAO,MAAM,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0FlD,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAalD,CAAA;AAED,qDAAqD;AACrD,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI5D,CAAA"}