@pontive/pontkit-server 1.1.0 → 1.2.0

package/dist/index.js

@@ -1,39 +1,6 @@
-import { jwtVerify as v, createLocalJWKSet as Y, jwtDecrypt as Z, EncryptJWT as Q } from "jose";
-const q = 10080 * 60;
-function ee(t) {
-  const e = ["issuer", "clientId", "sessionSecret"];
-  for (const r of e)
-    if (!t[r]) throw new Error(`@pontive/pontkit-server: ${r} is required`);
-  if (t.sessionSecret.length < 32)
-    throw new Error("@pontive/pontkit-server: sessionSecret must be at least 32 characters");
-  if (t.baseUrl)
-    try {
-      new URL(t.baseUrl);
-    } catch {
-      throw new Error(`@pontive/pontkit-server: baseUrl "${t.baseUrl}" is not an absolute URL`);
-    }
-  return {
-    issuer: t.issuer.replace(/\/+$/, ""),
-    clientId: t.clientId,
-    clientSecret: t.clientSecret || void 0,
-    sessionSecret: t.sessionSecret,
-    baseUrl: t.baseUrl ? new URL(t.baseUrl).origin : void 0,
-    scopes: t.scopes ?? "openid email profile offline_access",
-    basePath: (t.basePath ?? "/api/auth").replace(/\/+$/, ""),
-    redirectUri: t.redirectUri,
-    signInPath: t.signInPath ?? "/login",
-    afterSignInPath: t.afterSignInPath ?? "/",
-    prompt: t.prompt,
-    cookieName: t.cookieName ?? "pontive_session",
-    secureCookies: t.secureCookies,
-    sessionMaxAgeSeconds: t.sessionMaxAgeSeconds ?? q,
-    refreshSkewSeconds: t.refreshSkewSeconds ?? 60,
-    fetch: t.fetch ?? ((...r) => fetch(...r)),
-    logger: t.logger ?? console
-  };
-}
-const P = 3500, $ = 16;
-function x(t) {
+import { jwtVerify as I, createLocalJWKSet as Z, jwtDecrypt as Q, EncryptJWT as q } from "jose";
+const b = 3500, T = 16;
+function S(t) {
   const e = /* @__PURE__ */ new Map();
   if (!t) return e;
   for (const r of t.split(";")) {
@@ -44,49 +11,49 @@ function x(t) {
   }
   return e;
 }
-function I(t) {
+function $(t) {
   return [...t].map(([e, r]) => `${e}=${r}`).join("; ");
 }
-function _(t, e, r) {
+function C(t, e, r) {
   const n = [`${t}=${e}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${r.maxAge}`];
   return r.secure && n.push("Secure"), n.join("; ");
 }
-function y(t, e) {
+function U(t, e) {
   return e === 0 ? t : `${t}.${e}`;
 }
-function te(t, e) {
+function ee(t, e) {
   const r = t.get(e);
   if (r === void 0) return null;
   let n = r;
-  for (let s = 1; s < $; s++) {
-    const a = t.get(y(e, s));
+  for (let s = 1; s < T; s++) {
+    const a = t.get(U(e, s));
     if (a === void 0) break;
     n += a;
   }
   return n;
 }
-function re(t, e, r, n) {
-  const s = [], a = Math.max(1, Math.ceil(r.length / P));
-  for (let u = 0; u < a; u++) {
-    const d = r.slice(u * P, (u + 1) * P);
-    t.set(y(e, u), d), s.push(_(y(e, u), d, n));
+function te(t, e, r, n) {
+  const s = [], a = Math.max(1, Math.ceil(r.length / b));
+  for (let c = 0; c < a; c++) {
+    const d = r.slice(c * b, (c + 1) * b);
+    t.set(U(e, c), d), s.push(C(U(e, c), d, n));
   }
-  for (let u = a; u < $; u++) {
-    const d = y(e, u);
+  for (let c = a; c < T; c++) {
+    const d = U(e, c);
     if (!t.has(d)) break;
-    t.delete(d), s.push(_(d, "", { ...n, maxAge: 0 }));
+    t.delete(d), s.push(C(d, "", { ...n, maxAge: 0 }));
   }
   return s;
 }
 function R(t, e, r) {
   const n = [];
-  for (let s = 0; s < $; s++) {
-    const a = y(e, s);
+  for (let s = 0; s < T; s++) {
+    const a = U(e, s);
     if (!t.has(a)) {
       if (s > 0) break;
       continue;
     }
-    t.delete(a), n.push(_(a, "", { maxAge: 0, secure: r }));
+    t.delete(a), n.push(C(a, "", { maxAge: 0, secure: r }));
   }
   return n;
 }
@@ -97,111 +64,193 @@ class W extends Error {
   status;
   code;
 }
-const ne = 600 * 1e3, T = /* @__PURE__ */ new Map(), L = /* @__PURE__ */ new Map();
-function se(t) {
+const re = 600 * 1e3, A = /* @__PURE__ */ new Map(), L = /* @__PURE__ */ new Map();
+function ne(t) {
   return t.replace(/\/+$/, "");
 }
-function b(t, e) {
-  const r = se(t);
-  let n = T.get(r);
+function P(t, e) {
+  const r = ne(t);
+  let n = A.get(r);
   return n || (n = e(`${r}/.well-known/openid-configuration`).then(async (s) => {
     if (!s.ok) throw new Error(`OIDC discovery failed for ${r}: ${s.status}`);
     return await s.json();
   }).catch((s) => {
-    throw T.delete(r), s;
-  }), T.set(r, n)), n;
+    throw A.delete(r), s;
+  }), A.set(r, n)), n;
 }
 async function M(t, e, r) {
   const n = L.get(t);
-  if (n && !r && Date.now() - n.at < ne) return n.set;
+  if (n && !r && Date.now() - n.at < re) return n.set;
   const s = await e(t);
   if (!s.ok) throw new Error(`JWKS fetch failed for ${t}: ${s.status}`);
-  const a = Y(await s.json());
+  const a = Z(await s.json());
   return L.set(t, { at: Date.now(), set: a }), a;
 }
-function F(t) {
+function K(t) {
   let e = "";
   for (const r of t) e += String.fromCharCode(r);
   return btoa(e).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function E() {
-  return F(crypto.getRandomValues(new Uint8Array(32)));
+function v() {
+  return K(crypto.getRandomValues(new Uint8Array(32)));
 }
-async function oe(t) {
+async function se(t) {
   const e = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(t));
-  return F(new Uint8Array(e));
+  return K(new Uint8Array(e));
 }
-async function ie(t) {
+async function oe(t) {
   return [...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(t)))].map((r) => r.toString(16).padStart(2, "0")).join("");
 }
-async function ae(t, e, r) {
-  const n = await b(t.issuer, e), s = new URL(n.authorization_endpoint);
+async function ie(t, e, r) {
+  const n = await P(t.issuer, e), s = new URL(n.authorization_endpoint);
   return s.searchParams.set("response_type", "code"), s.searchParams.set("client_id", t.clientId), s.searchParams.set("redirect_uri", r.redirectUri), s.searchParams.set("scope", r.scopes), s.searchParams.set("state", r.state), s.searchParams.set("nonce", r.nonce), s.searchParams.set("code_challenge", r.codeChallenge), s.searchParams.set("code_challenge_method", "S256"), r.prompt && s.searchParams.set("prompt", r.prompt), s.toString();
 }
-async function K(t, e, r) {
-  const n = await b(t.issuer, e), s = new URLSearchParams(r);
+async function F(t, e, r) {
+  const n = await P(t.issuer, e), s = new URLSearchParams(r);
   s.set("client_id", t.clientId);
   const a = { "content-type": "application/x-www-form-urlencoded" };
   if (t.clientSecret) {
     const d = `${encodeURIComponent(t.clientId)}:${encodeURIComponent(t.clientSecret)}`;
     a.authorization = `Basic ${btoa(d)}`;
   }
-  const u = await e(n.token_endpoint, { method: "POST", headers: a, body: s });
-  if (!u.ok) {
-    let d = "unknown_error", k = "";
+  const c = await e(n.token_endpoint, { method: "POST", headers: a, body: s });
+  if (!c.ok) {
+    let d = "unknown_error", h = "";
     try {
-      const S = await u.json();
-      d = S.error ?? d, k = S.error_description ?? "";
+      const _ = await c.json();
+      d = _.error ?? d, h = _.error_description ?? "";
     } catch {
     }
-    throw new W(u.status, d, k);
+    throw new W(c.status, d, h);
   }
-  return await u.json();
+  return await c.json();
 }
-function ce(t, e, r) {
-  return K(t, e, {
+function ae(t, e, r) {
+  return F(t, e, {
     grant_type: "authorization_code",
     code: r.code,
     code_verifier: r.codeVerifier,
     redirect_uri: r.redirectUri
   });
 }
-function ue(t, e, r) {
-  return K(t, e, { grant_type: "refresh_token", refresh_token: r });
+function ce(t, e, r) {
+  return F(t, e, { grant_type: "refresh_token", refresh_token: r });
 }
-async function de(t, e, r, n) {
-  const s = await b(t.issuer, e), a = { issuer: s.issuer, audience: t.clientId };
-  let u;
+async function V(t, e, r) {
+  const n = await P(t.issuer, e), s = { issuer: n.issuer, audience: t.clientId };
   try {
-    u = await v(r, await M(s.jwks_uri, e, !1), a);
-  } catch (d) {
-    if (d.code !== "ERR_JWKS_NO_MATCHING_KEY") throw d;
-    u = await v(r, await M(s.jwks_uri, e, !0), a);
+    return (await I(r, await M(n.jwks_uri, e, !1), s)).payload;
+  } catch (a) {
+    if (a.code !== "ERR_JWKS_NO_MATCHING_KEY") throw a;
+    return (await I(r, await M(n.jwks_uri, e, !0), s)).payload;
   }
-  if (u.payload.nonce !== n) throw new Error("id_token nonce does not match the sign-in request");
-  return u.payload;
 }
-async function le(t, e, r) {
-  const n = await b(t.issuer, e);
+async function ue(t, e, r, n) {
+  const s = await V(t, e, r);
+  if (s.nonce !== n) throw new Error("id_token nonce does not match the sign-in request");
+  return s;
+}
+async function de(t, e, r) {
+  const n = await P(t.issuer, e);
   if (!n.end_session_endpoint) return null;
   const s = new URL(n.end_session_endpoint);
   return s.searchParams.set("client_id", t.clientId), s.searchParams.set("post_logout_redirect_uri", r.postLogoutRedirectUri), r.sessionId && s.searchParams.set("logout_hint", r.sessionId), s.toString();
 }
-const he = 3e4;
-class fe {
-  constructor(e = he) {
+const le = "__Host-pontive_access", he = "__Secure-pontive_session_state";
+function fe(t) {
+  const e = (r) => typeof t[r] == "string" ? t[r] : void 0;
+  return {
+    id: t.sub ?? "",
+    email: e("email"),
+    name: e("name") ?? e("email"),
+    username: e("preferred_username"),
+    picture: e("picture"),
+    emailVerified: t.email_verified === !0
+  };
+}
+function we(t) {
+  const e = { issuer: t.issuer, clientId: t.clientId };
+  async function r(n) {
+    const s = S(n).get(le);
+    if (!s) return null;
+    let a;
+    try {
+      a = await V(e, t.fetch, s);
+    } catch (c) {
+      return c.code !== "ERR_JWT_EXPIRED" && t.logger.warn("[pontive] access token cookie refused:", c instanceof Error ? c.message : String(c)), null;
+    }
+    return {
+      user: fe(a),
+      accessToken: s,
+      expiresAt: (a.exp ?? 0) * 1e3,
+      sessionId: typeof a.sid == "string" ? a.sid : void 0
+    };
+  }
+  return {
+    // Sign-in and sign-out belong to the browser SDK's widgets in this mode.
+    async handle() {
+      return null;
+    },
+    getSession: r,
+    async refresh(n) {
+      const s = n.headers.get("cookie"), a = await r(s), c = { session: a, setCookies: [], cookieHeader: s ?? "" };
+      if (a || !S(s).has(he)) return c;
+      const d = new URL(n.url), h = new URL(`${t.authPath}/oauth2/session`, d.origin);
+      return h.searchParams.set("client_id", t.clientId), h.searchParams.set("return_to", d.pathname + d.search), { ...c, handshake: h.pathname + h.search };
+    }
+  };
+}
+const pe = 10080 * 60;
+function ge(t) {
+  const e = t.clientSecret ? "server" : "browser", r = ["issuer", "clientId"];
+  e === "server" && r.push("sessionSecret");
+  for (const n of r)
+    if (!t[n]) throw new Error(`@pontive/pontkit-server: ${n} is required`);
+  if (e === "server" && t.sessionSecret.length < 32)
+    throw new Error("@pontive/pontkit-server: sessionSecret must be at least 32 characters");
+  if (t.baseUrl)
+    try {
+      new URL(t.baseUrl);
+    } catch {
+      throw new Error(`@pontive/pontkit-server: baseUrl "${t.baseUrl}" is not an absolute URL`);
+    }
+  return {
+    mode: e,
+    authPath: (t.authPath ?? "/__auth").replace(/\/+$/, ""),
+    issuer: t.issuer.replace(/\/+$/, ""),
+    clientId: t.clientId,
+    clientSecret: t.clientSecret || void 0,
+    sessionSecret: t.sessionSecret ?? "",
+    baseUrl: t.baseUrl ? new URL(t.baseUrl).origin : void 0,
+    scopes: t.scopes ?? "openid email profile offline_access",
+    basePath: (t.basePath ?? "/api/auth").replace(/\/+$/, ""),
+    redirectUri: t.redirectUri,
+    signInPath: t.signInPath ?? "/login",
+    afterSignInPath: t.afterSignInPath ?? "/",
+    prompt: t.prompt,
+    cookieName: t.cookieName ?? "pontive_session",
+    secureCookies: t.secureCookies,
+    sessionMaxAgeSeconds: t.sessionMaxAgeSeconds ?? pe,
+    refreshSkewSeconds: t.refreshSkewSeconds ?? 60,
+    fetch: t.fetch ?? ((...n) => fetch(...n)),
+    logger: t.logger ?? console
+  };
+}
+const ke = 3e4;
+class me {
+  constructor(e = ke) {
     this.recentMs = e;
   }
   recentMs;
   inFlight = /* @__PURE__ */ new Map();
   recent = /* @__PURE__ */ new Map();
   async run(e, r) {
-    const n = await ie(e);
+    const n = await oe(e);
     this.sweep();
     const s = this.recent.get(n);
     if (s) return s.result;
     let a = this.inFlight.get(n);
-    return a || (a = r().then((u) => (this.recent.set(n, { at: Date.now(), result: u }), u)).finally(() => this.inFlight.delete(n)), this.inFlight.set(n, a)), a;
+    return a || (a = r().then((c) => (this.recent.set(n, { at: Date.now(), result: c }), c)).finally(() => this.inFlight.delete(n)), this.inFlight.set(n, a)), a;
   }
   sweep() {
     const e = Date.now() - this.recentMs;
@@ -210,23 +259,23 @@ class fe {
   }
 }
 const N = /* @__PURE__ */ new Map();
-function V(t) {
+function J(t) {
   let e = N.get(t);
   return e || (e = crypto.subtle.digest("SHA-256", new TextEncoder().encode(t)).then((r) => new Uint8Array(r)), N.set(t, e)), e;
 }
-async function j(t, e, r) {
-  return new Q(t).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${r}s`).encrypt(await V(e));
+async function H(t, e, r) {
+  return new q(t).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${r}s`).encrypt(await J(e));
 }
 async function D(t, e) {
   try {
-    const { payload: r } = await Z(t, await V(e));
+    const { payload: r } = await Q(t, await J(e));
     return r;
   } catch {
     return null;
   }
 }
-const we = 900, H = 600;
-function pe(t, e) {
+const Se = 900, O = 600;
+function _e(t, e) {
   return t && t.startsWith("/") && !t.startsWith("//") && !t.startsWith("/\\") ? t : e;
 }
 function m(t, e = []) {
@@ -234,7 +283,7 @@ function m(t, e = []) {
   for (const n of e) r.append("set-cookie", n);
   return new Response(null, { status: 302, headers: r });
 }
-function C(t, e) {
+function E(t, e) {
   if (t.baseUrl) return t.baseUrl;
   const r = e.headers.get("x-forwarded-host")?.split(",")[0]?.trim() || e.headers.get("host")?.trim();
   if (r) {
@@ -246,7 +295,7 @@ function C(t, e) {
   }
   return new URL(e.url).origin;
 }
-function ge(t) {
+function ye(t) {
   const e = (n) => typeof t[n] == "string" ? t[n] : void 0, r = e("name") ?? ([e("given_name"), e("family_name")].filter(Boolean).join(" ") || void 0) ?? e("email");
   return {
     id: t.sub ?? "",
@@ -257,92 +306,94 @@ function ge(t) {
     emailVerified: t.email_verified === !0
   };
 }
-function O(t) {
-  return Date.now() + (t.expires_in ?? we) * 1e3;
+function j(t) {
+  return Date.now() + (t.expires_in ?? Se) * 1e3;
 }
-function me(t) {
-  const e = ee(t), r = { issuer: e.issuer, clientId: e.clientId, clientSecret: e.clientSecret }, n = `${e.cookieName}_tx`, s = new fe(), a = (o) => e.secureCookies ?? C(e, o).startsWith("https:"), u = (o) => e.redirectUri ?? `${C(e, o)}${e.basePath}/callback`, d = (o, i) => {
-    const c = new URL(e.signInPath, C(e, o));
-    return i && c.searchParams.set("error", i), c.toString();
+function Ce(t) {
+  const e = ge(t);
+  if (e.mode === "browser") return we(e);
+  const r = { issuer: e.issuer, clientId: e.clientId, clientSecret: e.clientSecret }, n = `${e.cookieName}_tx`, s = new me(), a = (o) => e.secureCookies ?? E(e, o).startsWith("https:"), c = (o) => e.redirectUri ?? `${E(e, o)}${e.basePath}/callback`, d = (o, i) => {
+    const u = new URL(e.signInPath, E(e, o));
+    return i && u.searchParams.set("error", i), u.toString();
   };
-  async function k(o) {
-    const i = te(o, e.cookieName);
+  async function h(o) {
+    const i = ee(o, e.cookieName);
     if (i === null) return null;
-    const c = await D(i, e.sessionSecret);
-    return c || e.logger.warn("[pontive] session cookie could not be read (sealed with another secret, or truncated)"), c;
+    const u = await D(i, e.sessionSecret);
+    return u || e.logger.warn("[pontive] session cookie could not be read (sealed with another secret, or truncated)"), u;
   }
-  async function S(o, i, c) {
-    const l = await j({ ...i }, e.sessionSecret, e.sessionMaxAgeSeconds);
-    return re(o, e.cookieName, l, { maxAge: e.sessionMaxAgeSeconds, secure: a(c) });
+  async function _(o, i, u) {
+    const l = await H({ ...i }, e.sessionSecret, e.sessionMaxAgeSeconds);
+    return te(o, e.cookieName, l, { maxAge: e.sessionMaxAgeSeconds, secure: a(u) });
   }
-  function U(o) {
-    const { refreshToken: i, ...c } = o;
-    return c;
+  function y(o) {
+    const { refreshToken: i, ...u } = o;
+    return u;
   }
   async function G(o) {
-    const i = new URL(o.url), c = {
-      state: E(),
-      verifier: E(),
-      nonce: E(),
-      returnTo: pe(i.searchParams.get("returnTo") ?? i.searchParams.get("next"), e.afterSignInPath)
-    }, l = await ae(r, e.fetch, {
-      redirectUri: u(o),
+    const i = new URL(o.url), u = {
+      state: v(),
+      verifier: v(),
+      nonce: v(),
+      returnTo: _e(i.searchParams.get("returnTo") ?? i.searchParams.get("next"), e.afterSignInPath)
+    }, l = await ie(r, e.fetch, {
+      redirectUri: c(o),
       scopes: e.scopes,
-      state: c.state,
-      nonce: c.nonce,
-      codeChallenge: await oe(c.verifier),
+      state: u.state,
+      nonce: u.nonce,
+      codeChallenge: await se(u.verifier),
       prompt: e.prompt
-    }), h = await j({ ...c }, e.sessionSecret, H);
-    return m(l, [_(n, h, { maxAge: H, secure: a(o) })]);
+    }), f = await H({ ...u }, e.sessionSecret, O);
+    return m(l, [C(n, f, { maxAge: O, secure: a(o) })]);
   }
   async function z(o) {
-    const i = new URL(o.url), c = x(o.headers.get("cookie")), l = [_(n, "", { maxAge: 0, secure: a(o) })], h = i.searchParams.get("error");
-    if (h) return m(d(o, h), l);
-    const f = c.get(n), g = f ? await D(f, e.sessionSecret) : null, w = i.searchParams.get("code");
-    if (!g || !w || i.searchParams.get("state") !== g.state)
+    const i = new URL(o.url), u = S(o.headers.get("cookie")), l = [C(n, "", { maxAge: 0, secure: a(o) })], f = i.searchParams.get("error");
+    if (f) return m(d(o, f), l);
+    const w = u.get(n), k = w ? await D(w, e.sessionSecret) : null, p = i.searchParams.get("code");
+    if (!k || !p || i.searchParams.get("state") !== k.state)
       return m(d(o, "invalid_state"), l);
     try {
-      const p = await ce(r, e.fetch, {
-        code: w,
-        codeVerifier: g.verifier,
-        redirectUri: u(o)
+      const g = await ae(r, e.fetch, {
+        code: p,
+        codeVerifier: k.verifier,
+        redirectUri: c(o)
       });
-      if (!p.id_token) throw new Error("the token response carried no id_token; is the openid scope requested?");
-      const A = await de(r, e.fetch, p.id_token, g.nonce), X = {
-        user: ge(A),
-        accessToken: p.access_token,
-        refreshToken: p.refresh_token,
-        expiresAt: O(p),
-        sessionId: typeof A.sid == "string" ? A.sid : void 0
+      if (!g.id_token) throw new Error("the token response carried no id_token; is the openid scope requested?");
+      const x = await ue(r, e.fetch, g.id_token, k.nonce), Y = {
+        user: ye(x),
+        accessToken: g.access_token,
+        refreshToken: g.refresh_token,
+        expiresAt: j(g),
+        sessionId: typeof x.sid == "string" ? x.sid : void 0
       };
-      l.push(...await S(c, X, o));
-    } catch (p) {
-      return e.logger.warn("[pontive] sign-in failed:", p instanceof Error ? p.message : String(p)), m(d(o, "exchange_failed"), l);
+      l.push(...await _(u, Y, o));
+    } catch (g) {
+      return e.logger.warn("[pontive] sign-in failed:", g instanceof Error ? g.message : String(g)), m(d(o, "exchange_failed"), l);
     }
-    return m(new URL(g.returnTo, C(e, o)).toString(), l);
+    return m(new URL(k.returnTo, E(e, o)).toString(), l);
   }
-  async function J(o) {
-    const i = x(o.headers.get("cookie")), c = await k(i), l = R(i, e.cookieName, a(o));
-    let h = d(o);
+  async function B(o) {
+    const i = S(o.headers.get("cookie")), u = await h(i), l = R(i, e.cookieName, a(o));
+    let f = d(o);
     try {
-      h = await le(r, e.fetch, {
+      f = await de(r, e.fetch, {
         postLogoutRedirectUri: d(o),
-        sessionId: c?.sessionId
-      }) ?? h;
-    } catch (f) {
-      e.logger.warn("[pontive] could not reach the issuer to end its session:", f instanceof Error ? f.message : String(f));
+        sessionId: u?.sessionId
+      }) ?? f;
+    } catch (w) {
+      e.logger.warn("[pontive] could not reach the issuer to end its session:", w instanceof Error ? w.message : String(w));
     }
-    return m(h, l);
+    return m(f, l);
   }
-  async function B(o) {
+  async function X(o) {
     try {
-      const i = await ue(r, e.fetch, o.refreshToken);
+      const i = await ce(r, e.fetch, o.refreshToken);
       return {
         ...o,
         accessToken: i.access_token,
         // A response without one means rotation is off: the token in hand is still current.
         refreshToken: i.refresh_token ?? o.refreshToken,
-        expiresAt: O(i)
+        expiresAt: j(i)
       };
     } catch (i) {
       if (i instanceof W && i.status >= 400 && i.status < 500)
@@ -354,38 +405,42 @@ function me(t) {
     async handle(o) {
       const { pathname: i } = new URL(o.url);
       if (!i.startsWith(`${e.basePath}/`)) return null;
-      const c = i.slice(e.basePath.length + 1);
-      return c === "login" && o.method === "GET" ? G(o) : c === "callback" && o.method === "GET" ? z(o) : c === "logout" && (o.method === "GET" || o.method === "POST") ? J(o) : null;
+      const u = i.slice(e.basePath.length + 1);
+      return u === "login" && o.method === "GET" ? G(o) : u === "callback" && o.method === "GET" ? z(o) : u === "logout" && (o.method === "GET" || o.method === "POST") ? B(o) : null;
     },
     async getSession(o) {
-      const i = await k(x(o));
+      const i = await h(S(o));
       return i ? Date.now() >= i.expiresAt ? (e.logger.warn(
         "[pontive] the session's access token has expired and getSession cannot refresh it. Run the SDK's middleware on this path so it refreshes before the request is handled."
-      ), null) : U(i) : null;
+      ), null) : y(i) : null;
     },
     async refresh(o) {
-      const i = x(o.headers.get("cookie")), c = (w) => ({
-        session: w,
+      const i = S(o.headers.get("cookie")), u = (p) => ({
+        session: p,
         setCookies: [],
         cookieHeader: o.headers.get("cookie") ?? ""
-      }), l = await k(i);
-      if (!l) return c(null);
-      if (Date.now() < l.expiresAt - e.refreshSkewSeconds * 1e3) return c(U(l));
-      const h = () => ({ session: null, setCookies: R(i, e.cookieName, a(o)), cookieHeader: I(i) });
-      if (!l.refreshToken) return h();
-      let f;
+      }), l = await h(i);
+      if (!l) return u(null);
+      if (new URL(o.url).pathname.startsWith(`${e.basePath}/`))
+        return u(Date.now() < l.expiresAt ? y(l) : null);
+      if (Date.now() < l.expiresAt - e.refreshSkewSeconds * 1e3) return u(y(l));
+      const f = () => ({ session: null, setCookies: R(i, e.cookieName, a(o)), cookieHeader: $(i) });
+      if (!l.refreshToken) return f();
+      let w;
       try {
-        f = await s.run(l.refreshToken, () => B(l));
-      } catch (w) {
-        return e.logger.warn("[pontive] refresh failed, will retry:", w instanceof Error ? w.message : String(w)), c(Date.now() < l.expiresAt ? U(l) : null);
+        w = await s.run(l.refreshToken, () => X(l));
+      } catch (p) {
+        return e.logger.warn("[pontive] refresh failed, will retry:", p instanceof Error ? p.message : String(p)), u(Date.now() < l.expiresAt ? y(l) : null);
       }
-      if (!f) return h();
-      const g = await S(i, f, o);
-      return { session: U(f), setCookies: g, cookieHeader: I(i) };
+      if (!w) return f();
+      const k = await _(i, w, o);
+      return { session: y(w), setCookies: k, cookieHeader: $(i) };
     }
   };
 }
 export {
-  me as createServerAuth
+  le as ACCESS_COOKIE,
+  he as SESSION_HINT_COOKIE,
+  Ce as createServerAuth
 };
 //# sourceMappingURL=index.js.map