@qlever-llc/trellis 0.10.18-rc.1 → 0.10.19

package/script/auth/browser/logout.d.ts

@@ -0,0 +1,23 @@
+import { type AuthLogoutResponse } from "../schemas.js";
+import { type SessionKeyHandle } from "./session.js";
+type LogoutLocation = Pick<Location, "href"> & Partial<Pick<Location, "assign">>;
+export type CompleteSessionLogoutArgs = {
+    authUrl: string;
+    handle: SessionKeyHandle;
+    returnTo?: string;
+    providerLogout?: boolean;
+    federatedProviderLogout?: boolean;
+    location?: LogoutLocation;
+};
+export declare function logoutSession(args: {
+    authUrl: string;
+    handle: SessionKeyHandle;
+    returnTo?: string;
+    providerLogout?: boolean;
+    federatedProviderLogout?: boolean;
+    responseMode?: "json";
+    fetch?: typeof fetch;
+}): Promise<AuthLogoutResponse>;
+export declare function completeSessionLogout(args: CompleteSessionLogoutArgs): Promise<never>;
+export {};
+//# sourceMappingURL=logout.d.ts.map

package/script/auth/browser/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/auth/browser/logout.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,KAAK,cAAc,GACf,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtC,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgD9B;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,KAAK,CAAC,CAuBhB"}

package/script/auth/browser/logout.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logoutSession = logoutSession;
+exports.completeSessionLogout = completeSessionLogout;
+const value_1 = require("typebox/value");
+const schemas_js_1 = require("../schemas.js");
+const session_js_1 = require("./session.js");
+async function logoutSession(args) {
+    const iat = Math.floor(Date.now() / 1000);
+    const responseMode = args.responseMode ?? "json";
+    const sig = await (0, session_js_1.logoutSessionSig)(args.handle, {
+        iat,
+        ...(args.providerLogout === undefined
+            ? {}
+            : { providerLogout: args.providerLogout }),
+        ...(args.federatedProviderLogout === undefined
+            ? {}
+            : { federatedProviderLogout: args.federatedProviderLogout }),
+        ...(args.returnTo === undefined ? {} : { returnTo: args.returnTo }),
+        responseMode,
+    });
+    const body = {
+        sessionKey: args.handle.sessionKey,
+        iat,
+        sig,
+        ...(args.providerLogout === undefined
+            ? {}
+            : { providerLogout: args.providerLogout }),
+        ...(args.federatedProviderLogout === undefined
+            ? {}
+            : { federatedProviderLogout: args.federatedProviderLogout }),
+        ...(args.returnTo === undefined ? {} : { returnTo: args.returnTo }),
+        responseMode,
+    };
+    const fetchImpl = args.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(logoutUrl(args.authUrl), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        throw new Error(`Logout request failed with HTTP ${response.status}`);
+    }
+    let parsed;
+    try {
+        parsed = await response.json();
+    }
+    catch (cause) {
+        throw new Error("Logout response was not valid JSON", { cause });
+    }
+    if (!value_1.Value.Check(schemas_js_1.AuthLogoutResponseSchema, parsed)) {
+        throw new Error("Logout response did not match expected schema");
+    }
+    return parsed;
+}
+async function completeSessionLogout(args) {
+    let response;
+    try {
+        response = await logoutSession(args);
+    }
+    catch {
+        response = undefined;
+    }
+    finally {
+        try {
+            await (0, session_js_1.clearSessionKey)();
+        }
+        catch {
+            // Preserve logout completion in non-browser/test runtimes without IndexedDB.
+        }
+    }
+    const target = response?.redirectTo ?? args.returnTo ?? "/";
+    const location = args.location ?? globalThis.location;
+    if (typeof location.assign === "function") {
+        location.assign(target);
+    }
+    else {
+        location.href = target;
+    }
+    throw new Error("Redirecting after logout");
+}
+function logoutUrl(authUrl) {
+    return `${authUrl.replace(/\/+$/, "")}/auth/sessions/logout`;
+}

package/script/auth/browser/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/auth/browser/portal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAY1B;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,MAAM,CAKR;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAkB1B;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,GAAG,IAAI,GAC5B,MAAM,GAAG,IAAI,CAIf"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/auth/browser/portal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAY1B;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,MAAM,CAKR;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC,CAkB1B;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,GAAG,IAAI,GAC5B,MAAM,GAAG,IAAI,CAKf"}

package/script/auth/browser/portal.js

@@ -40,5 +40,7 @@ function portalRedirectLocation(state) {
         return state.location;
     if (state?.status === "approval_denied")
         return state.returnLocation ?? null;
+    if (state?.status === "expired")
+        return state.returnLocation ?? null;
     return null;
 }

package/script/auth/browser/session.d.ts

@@ -1,3 +1,4 @@
+import { type LogoutSignaturePayloadInput } from "../schemas.js";
 export type SessionKeyHandle = {
     privateKey: CryptoKey;
     publicKey: CryptoKey;
@@ -23,6 +24,7 @@ export declare function getPublicSessionKey(handle: SessionKeyHandle): string;
 export declare function oauthInitSig(handle: SessionKeyHandle, redirectTo: string, context?: unknown, provider?: string, contract?: Record<string, unknown> | string): Promise<string>;
 export declare function bindFlowSig(handle: SessionKeyHandle, flowId: string): Promise<string>;
 export declare function natsConnectSigForIat(handle: SessionKeyHandle, iat: number, contractDigest: string): Promise<string>;
+export declare function logoutSessionSig(handle: SessionKeyHandle, input: LogoutSignaturePayloadInput): Promise<string>;
 export declare function createRpcProof(handle: SessionKeyHandle, subject: string, payload: Uint8Array, requestId: string, iat: number): Promise<string>;
 export declare function clearSessionKey(options?: Pick<SessionKeyOptions, "persistence">): Promise<void>;
 export declare function hasSessionKey(options?: Pick<SessionKeyOptions, "persistence">): Promise<boolean>;

package/script/auth/browser/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/auth/browser/session.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,WAAW,GAAG,YAAY,CAAC;AAEnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gDAAgD;IAChD,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACxC,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAWF,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAED,wBAAsB,cAAc,CAClC,OAAO,GAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAM,GACnD,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAalC;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAI3B;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAOrB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAEpE;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAC1C,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,eAAe,CACnC,OAAO,GAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAM,GACnD,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,aAAa,CACjC,OAAO,GAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAM,GACnD,OAAO,CAAC,OAAO,CAAC,CAIlB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/auth/browser/session.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,eAAe,CAAC;AASvB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,WAAW,GAAG,YAAY,CAAC;AAEnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gDAAgD;IAChD,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACxC,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAWF,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;AAED,wBAAsB,cAAc,CAClC,OAAO,GAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAM,GACnD,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAalC;AAED,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAI3B;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAOrB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAEpE;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAC1C,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,eAAe,CACnC,OAAO,GAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAM,GACnD,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,aAAa,CACjC,OAAO,GAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAM,GACnD,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/script/auth/browser/session.js

@@ -8,11 +8,13 @@ exports.getPublicSessionKey = getPublicSessionKey;
 exports.oauthInitSig = oauthInitSig;
 exports.bindFlowSig = bindFlowSig;
 exports.natsConnectSigForIat = natsConnectSigForIat;
+exports.logoutSessionSig = logoutSessionSig;
 exports.createRpcProof = createRpcProof;
 exports.clearSessionKey = clearSessionKey;
 exports.hasSessionKey = hasSessionKey;
 const utils_js_1 = require("../utils.js");
 const proof_js_1 = require("../proof.js");
+const schemas_js_1 = require("../schemas.js");
 const session_auth_js_1 = require("../session_auth.js");
 const storage_js_1 = require("./storage.js");
 let temporarySessionKey = null;
@@ -95,6 +97,11 @@ async function natsConnectSigForIat(handle, iat, contractDigest) {
     const sig = await signBytes(handle, digest);
     return (0, utils_js_1.base64urlEncode)(sig);
 }
+async function logoutSessionSig(handle, input) {
+    const digest = await (0, utils_js_1.sha256)((0, utils_js_1.utf8)(`logout-session:${(0, schemas_js_1.buildLogoutSignaturePayload)(input)}`));
+    const sig = await signBytes(handle, digest);
+    return (0, utils_js_1.base64urlEncode)(sig);
+}
 async function createRpcProof(handle, subject, payload, requestId, iat) {
     const payloadHash = await (0, utils_js_1.sha256)(payload);
     return await (0, proof_js_1.createProof)(handle.privateKey, {

package/script/auth/browser.d.ts

@@ -5,10 +5,13 @@
  */
 import "../_dnt.polyfills.js";
 export { type AuthConfig, type AuthStartFlowResponse, type AuthStartRequest, type AuthStartResponse, bindFlow, type BindResponse, type BindSuccessResponse, buildLoginUrl, isBindSuccessResponse, type SentinelCreds, startAuthRequest, } from "./browser/login.js";
+export { completeSessionLogout, type CompleteSessionLogoutArgs, logoutSession, } from "./browser/logout.js";
 export { type ApprovalDecision, fetchPortalFlowState, portalFlowIdFromUrl, type PortalFlowState, type PortalFlowState as BrowserPortalFlowState, portalProviderLoginUrl, portalRedirectLocation, submitPortalApproval, } from "./browser/portal.js";
-export { bindFlowSig, clearSessionKey, createRpcProof, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, loadSessionKey, natsConnectSigForIat, type SessionKeyHandle, type SessionKeyOptions, type SessionKeyPersistenceMode, signBytes, } from "./browser/session.js";
+export { bindFlowSig, clearSessionKey, createRpcProof, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, loadSessionKey, logoutSessionSig, natsConnectSigForIat, type SessionKeyHandle, type SessionKeyOptions, type SessionKeyPersistenceMode, signBytes, } from "./browser/session.js";
 export { deleteKeyPair, hasKeyPair } from "./browser/storage.js";
-export { approvalCapabilityKeys, type ApprovalDecision as ApprovalDecisionData, ApprovalDecisionSchema, type AuthStartFlowResponse as AuthStartFlowResponseData, AuthStartFlowResponseSchema, type AuthStartRequest as AuthStartRequestData, AuthStartRequestSchema, type AuthStartResponse as AuthStartResponseData, AuthStartResponseSchema, type BindResponse as BindResponseData, BindResponseSchema, type BindSuccessResponse as BindSuccessResponseData, BindSuccessResponseSchema, type ClientTransportEndpoints as ClientTransportEndpointsData, ClientTransportEndpointsSchema, type ClientTransports as ClientTransportsData, ClientTransportsSchema, type ContractApproval as ContractApprovalData, type ContractApprovalCapability as ContractApprovalCapabilityData, ContractApprovalSchema, type NatsAuthTokenV1 as NatsAuthTokenV1Data, NatsAuthTokenV1Schema, type SentinelCreds as SentinelCredsData, SentinelCredsSchema, } from "./schemas.js";
+export { classifyBrowserAuthError, isRecoverableBrowserAuthError, } from "./browser_recovery.js";
+export type { BrowserAuthRecoveryClassification, BrowserAuthRecoveryKind, } from "./browser_recovery.js";
+export { approvalCapabilityKeys, type ApprovalDecision as ApprovalDecisionData, ApprovalDecisionSchema, type AuthLogoutRequest as AuthLogoutRequestData, AuthLogoutRequestSchema, type AuthLogoutResponse as AuthLogoutResponseData, type AuthLogoutResponseMode as AuthLogoutResponseModeData, AuthLogoutResponseModeSchema, AuthLogoutResponseSchema, type AuthStartFlowResponse as AuthStartFlowResponseData, AuthStartFlowResponseSchema, type AuthStartRequest as AuthStartRequestData, AuthStartRequestSchema, type AuthStartResponse as AuthStartResponseData, AuthStartResponseSchema, type BindResponse as BindResponseData, BindResponseSchema, type BindSuccessResponse as BindSuccessResponseData, BindSuccessResponseSchema, buildLogoutSignaturePayload, type ClientTransportEndpoints as ClientTransportEndpointsData, ClientTransportEndpointsSchema, type ClientTransports as ClientTransportsData, ClientTransportsSchema, type ContractApproval as ContractApprovalData, type ContractApprovalCapability as ContractApprovalCapabilityData, ContractApprovalSchema, type LogoutSignaturePayloadInput as LogoutSignaturePayloadInputData, type NatsAuthTokenV1 as NatsAuthTokenV1Data, NatsAuthTokenV1Schema, type SentinelCreds as SentinelCredsData, SentinelCredsSchema, } from "./schemas.js";
 export type { NatsAuthTokenV1 } from "./types.js";
 export { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
 //# sourceMappingURL=browser.d.ts.map

package/script/auth/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,sBAAsB,CAAC;AAG9B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,aAAa,EACb,qBAAqB,EACrB,KAAK,aAAa,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,IAAI,sBAAsB,EAC9C,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,2BAA2B,EAC3B,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,iBAAiB,IAAI,qBAAqB,EAC/C,uBAAuB,EACvB,KAAK,YAAY,IAAI,gBAAgB,EACrC,kBAAkB,EAClB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,yBAAyB,EACzB,KAAK,wBAAwB,IAAI,4BAA4B,EAC7D,8BAA8B,EAC9B,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,KAAK,0BAA0B,IAAI,8BAA8B,EACjE,sBAAsB,EACtB,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,KAAK,aAAa,IAAI,iBAAiB,EACvC,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EACL,eAAe,EACf,eAAe,EACf,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/auth/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,sBAAsB,CAAC;AAG9B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,QAAQ,EACR,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,aAAa,EACb,qBAAqB,EACrB,KAAK,aAAa,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,IAAI,sBAAsB,EAC9C,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,iBAAiB,IAAI,qBAAqB,EAC/C,uBAAuB,EACvB,KAAK,kBAAkB,IAAI,sBAAsB,EACjD,KAAK,sBAAsB,IAAI,0BAA0B,EACzD,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,2BAA2B,EAC3B,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,iBAAiB,IAAI,qBAAqB,EAC/C,uBAAuB,EACvB,KAAK,YAAY,IAAI,gBAAgB,EACrC,kBAAkB,EAClB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,wBAAwB,IAAI,4BAA4B,EAC7D,8BAA8B,EAC9B,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,sBAAsB,EACtB,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,KAAK,0BAA0B,IAAI,8BAA8B,EACjE,sBAAsB,EACtB,KAAK,2BAA2B,IAAI,+BAA+B,EACnE,KAAK,eAAe,IAAI,mBAAmB,EAC3C,qBAAqB,EACrB,KAAK,aAAa,IAAI,iBAAiB,EACvC,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EACL,eAAe,EACf,eAAe,EACf,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}

package/script/auth/browser.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.utf8 = exports.toArrayBuffer = exports.sha256 = exports.base64urlEncode = exports.base64urlDecode = exports.SentinelCredsSchema = exports.NatsAuthTokenV1Schema = exports.ContractApprovalSchema = exports.ClientTransportsSchema = exports.ClientTransportEndpointsSchema = exports.BindSuccessResponseSchema = exports.BindResponseSchema = exports.AuthStartResponseSchema = exports.AuthStartRequestSchema = exports.AuthStartFlowResponseSchema = exports.ApprovalDecisionSchema = exports.approvalCapabilityKeys = exports.hasKeyPair = exports.deleteKeyPair = exports.signBytes = exports.natsConnectSigForIat = exports.loadSessionKey = exports.hasSessionKey = exports.getPublicSessionKey = exports.getOrCreateSessionKey = exports.generateSessionKey = exports.createRpcProof = exports.clearSessionKey = exports.bindFlowSig = exports.submitPortalApproval = exports.portalRedirectLocation = exports.portalProviderLoginUrl = exports.portalFlowIdFromUrl = exports.fetchPortalFlowState = exports.startAuthRequest = exports.isBindSuccessResponse = exports.buildLoginUrl = exports.bindFlow = void 0;
+exports.utf8 = exports.toArrayBuffer = exports.sha256 = exports.base64urlEncode = exports.base64urlDecode = exports.SentinelCredsSchema = exports.NatsAuthTokenV1Schema = exports.ContractApprovalSchema = exports.ClientTransportsSchema = exports.ClientTransportEndpointsSchema = exports.buildLogoutSignaturePayload = exports.BindSuccessResponseSchema = exports.BindResponseSchema = exports.AuthStartResponseSchema = exports.AuthStartRequestSchema = exports.AuthStartFlowResponseSchema = exports.AuthLogoutResponseSchema = exports.AuthLogoutResponseModeSchema = exports.AuthLogoutRequestSchema = exports.ApprovalDecisionSchema = exports.approvalCapabilityKeys = exports.isRecoverableBrowserAuthError = exports.classifyBrowserAuthError = exports.hasKeyPair = exports.deleteKeyPair = exports.signBytes = exports.natsConnectSigForIat = exports.logoutSessionSig = exports.loadSessionKey = exports.hasSessionKey = exports.getPublicSessionKey = exports.getOrCreateSessionKey = exports.generateSessionKey = exports.createRpcProof = exports.clearSessionKey = exports.bindFlowSig = exports.submitPortalApproval = exports.portalRedirectLocation = exports.portalProviderLoginUrl = exports.portalFlowIdFromUrl = exports.fetchPortalFlowState = exports.logoutSession = exports.completeSessionLogout = exports.startAuthRequest = exports.isBindSuccessResponse = exports.buildLoginUrl = exports.bindFlow = void 0;
 /**
  * @module
  * Browser-based authentication utilities for session-key based authentication.
@@ -11,6 +11,9 @@ Object.defineProperty(exports, "bindFlow", { enumerable: true, get: function ()
 Object.defineProperty(exports, "buildLoginUrl", { enumerable: true, get: function () { return login_js_1.buildLoginUrl; } });
 Object.defineProperty(exports, "isBindSuccessResponse", { enumerable: true, get: function () { return login_js_1.isBindSuccessResponse; } });
 Object.defineProperty(exports, "startAuthRequest", { enumerable: true, get: function () { return login_js_1.startAuthRequest; } });
+var logout_js_1 = require("./browser/logout.js");
+Object.defineProperty(exports, "completeSessionLogout", { enumerable: true, get: function () { return logout_js_1.completeSessionLogout; } });
+Object.defineProperty(exports, "logoutSession", { enumerable: true, get: function () { return logout_js_1.logoutSession; } });
 var portal_js_1 = require("./browser/portal.js");
 Object.defineProperty(exports, "fetchPortalFlowState", { enumerable: true, get: function () { return portal_js_1.fetchPortalFlowState; } });
 Object.defineProperty(exports, "portalFlowIdFromUrl", { enumerable: true, get: function () { return portal_js_1.portalFlowIdFromUrl; } });
@@ -26,19 +29,27 @@ Object.defineProperty(exports, "getOrCreateSessionKey", { enumerable: true, get:
 Object.defineProperty(exports, "getPublicSessionKey", { enumerable: true, get: function () { return session_js_1.getPublicSessionKey; } });
 Object.defineProperty(exports, "hasSessionKey", { enumerable: true, get: function () { return session_js_1.hasSessionKey; } });
 Object.defineProperty(exports, "loadSessionKey", { enumerable: true, get: function () { return session_js_1.loadSessionKey; } });
+Object.defineProperty(exports, "logoutSessionSig", { enumerable: true, get: function () { return session_js_1.logoutSessionSig; } });
 Object.defineProperty(exports, "natsConnectSigForIat", { enumerable: true, get: function () { return session_js_1.natsConnectSigForIat; } });
 Object.defineProperty(exports, "signBytes", { enumerable: true, get: function () { return session_js_1.signBytes; } });
 var storage_js_1 = require("./browser/storage.js");
 Object.defineProperty(exports, "deleteKeyPair", { enumerable: true, get: function () { return storage_js_1.deleteKeyPair; } });
 Object.defineProperty(exports, "hasKeyPair", { enumerable: true, get: function () { return storage_js_1.hasKeyPair; } });
+var browser_recovery_js_1 = require("./browser_recovery.js");
+Object.defineProperty(exports, "classifyBrowserAuthError", { enumerable: true, get: function () { return browser_recovery_js_1.classifyBrowserAuthError; } });
+Object.defineProperty(exports, "isRecoverableBrowserAuthError", { enumerable: true, get: function () { return browser_recovery_js_1.isRecoverableBrowserAuthError; } });
 var schemas_js_1 = require("./schemas.js");
 Object.defineProperty(exports, "approvalCapabilityKeys", { enumerable: true, get: function () { return schemas_js_1.approvalCapabilityKeys; } });
 Object.defineProperty(exports, "ApprovalDecisionSchema", { enumerable: true, get: function () { return schemas_js_1.ApprovalDecisionSchema; } });
+Object.defineProperty(exports, "AuthLogoutRequestSchema", { enumerable: true, get: function () { return schemas_js_1.AuthLogoutRequestSchema; } });
+Object.defineProperty(exports, "AuthLogoutResponseModeSchema", { enumerable: true, get: function () { return schemas_js_1.AuthLogoutResponseModeSchema; } });
+Object.defineProperty(exports, "AuthLogoutResponseSchema", { enumerable: true, get: function () { return schemas_js_1.AuthLogoutResponseSchema; } });
 Object.defineProperty(exports, "AuthStartFlowResponseSchema", { enumerable: true, get: function () { return schemas_js_1.AuthStartFlowResponseSchema; } });
 Object.defineProperty(exports, "AuthStartRequestSchema", { enumerable: true, get: function () { return schemas_js_1.AuthStartRequestSchema; } });
 Object.defineProperty(exports, "AuthStartResponseSchema", { enumerable: true, get: function () { return schemas_js_1.AuthStartResponseSchema; } });
 Object.defineProperty(exports, "BindResponseSchema", { enumerable: true, get: function () { return schemas_js_1.BindResponseSchema; } });
 Object.defineProperty(exports, "BindSuccessResponseSchema", { enumerable: true, get: function () { return schemas_js_1.BindSuccessResponseSchema; } });
+Object.defineProperty(exports, "buildLogoutSignaturePayload", { enumerable: true, get: function () { return schemas_js_1.buildLogoutSignaturePayload; } });
 Object.defineProperty(exports, "ClientTransportEndpointsSchema", { enumerable: true, get: function () { return schemas_js_1.ClientTransportEndpointsSchema; } });
 Object.defineProperty(exports, "ClientTransportsSchema", { enumerable: true, get: function () { return schemas_js_1.ClientTransportsSchema; } });
 Object.defineProperty(exports, "ContractApprovalSchema", { enumerable: true, get: function () { return schemas_js_1.ContractApprovalSchema; } });

package/script/auth/browser_recovery.d.ts

@@ -0,0 +1,22 @@
+/** Browser auth recovery classification helpers. */
+/** Stable browser-auth recovery categories for app-owned recovery flows. */
+export type BrowserAuthRecoveryKind = "recoverable_stale_session" | "recoverable_expired_flow" | "recoverable_auth_required" | "policy_denied" | "insufficient_capabilities" | "runtime_unavailable" | "unknown";
+/** Classification result for a browser-auth related failure. */
+export type BrowserAuthRecoveryClassification = {
+    kind: BrowserAuthRecoveryKind;
+    recoverable: boolean;
+    reason?: string;
+    code?: string;
+};
+/**
+ * Classifies browser auth, bootstrap, callback, and transport-like failures.
+ *
+ * The classifier accepts raw errors, serialized Trellis errors, nested causes,
+ * and nested remote errors. Recoverable classifications are intended for
+ * app-owned flows that can clear stale auth and restart sign-in without showing a
+ * user-facing terminal error.
+ */
+export declare function classifyBrowserAuthError(error: unknown): BrowserAuthRecoveryClassification;
+/** Returns whether a browser auth error can silently restart sign-in. */
+export declare function isRecoverableBrowserAuthError(error: unknown): boolean;
+//# sourceMappingURL=browser_recovery.d.ts.map

package/script/auth/browser_recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser_recovery.d.ts","sourceRoot":"","sources":["../../src/auth/browser_recovery.ts"],"names":[],"mappings":"AAAA,oDAAoD;AAEpD,4EAA4E;AAC5E,MAAM,MAAM,uBAAuB,GAC/B,2BAA2B,GAC3B,0BAA0B,GAC1B,2BAA2B,GAC3B,eAAe,GACf,2BAA2B,GAC3B,qBAAqB,GACrB,SAAS,CAAC;AAEd,gEAAgE;AAChE,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,uBAAuB,CAAC;IAC9B,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAsNF;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,iCAAiC,CAuEnC;AAED,yEAAyE;AACzE,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErE"}

package/script/auth/browser_recovery.js

@@ -0,0 +1,242 @@
+"use strict";
+/** Browser auth recovery classification helpers. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyBrowserAuthError = classifyBrowserAuthError;
+exports.isRecoverableBrowserAuthError = isRecoverableBrowserAuthError;
+const MAX_ERROR_DEPTH = 8;
+function isRecord(value) {
+    return value !== null && typeof value === "object";
+}
+function stringProperty(record, property) {
+    const value = record[property];
+    return typeof value === "string" ? value : undefined;
+}
+function normalize(value) {
+    return value.trim().toLowerCase().replaceAll("-", "_").replaceAll(" ", "_");
+}
+function signalValue(signal) {
+    return signal.code ?? signal.reason ?? signal.message;
+}
+function classification(kind, recoverable, signal) {
+    const reason = signal?.reason ?? signalValue(signal ?? {});
+    return {
+        kind,
+        recoverable,
+        ...(reason ? { reason } : {}),
+        ...(signal?.code ? { code: signal.code } : {}),
+    };
+}
+function maybeSerializable(value) {
+    if (!isRecord(value))
+        return undefined;
+    const toSerializable = value.toSerializable;
+    if (typeof toSerializable !== "function")
+        return undefined;
+    try {
+        return toSerializable.call(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function pushRecordSignals(record, signals, queue) {
+    const message = stringProperty(record, "message");
+    const code = stringProperty(record, "code") ??
+        stringProperty(record, "error");
+    const reason = stringProperty(record, "reason") ??
+        stringProperty(record, "status");
+    if (message || code || reason) {
+        signals.push({
+            ...(code ? { code } : {}),
+            ...(reason ? { reason } : {}),
+            ...(message ? { message } : {}),
+        });
+    }
+    const context = record.context;
+    if (isRecord(context)) {
+        const contextReason = stringProperty(context, "reason");
+        const causeMessage = stringProperty(context, "causeMessage");
+        const contextCode = stringProperty(context, "code");
+        const contextMessage = stringProperty(context, "message");
+        if (contextReason || causeMessage || contextCode || contextMessage) {
+            signals.push({
+                ...(contextCode ? { code: contextCode } : {}),
+                ...(contextReason ? { reason: contextReason } : {}),
+                ...(causeMessage ?? contextMessage
+                    ? { message: causeMessage ?? contextMessage }
+                    : {}),
+            });
+        }
+        for (const nested of [context.cause, context.error, context.remoteError]) {
+            if (nested !== undefined)
+                queue.push(nested);
+        }
+    }
+    for (const nested of [record.cause, record.error, record.remoteError]) {
+        if (nested !== undefined)
+            queue.push(nested);
+    }
+}
+function collectErrorSignals(error) {
+    const signals = [];
+    const queue = [error];
+    const seen = new WeakSet();
+    let depth = 0;
+    while (queue.length > 0 && depth < MAX_ERROR_DEPTH) {
+        depth += 1;
+        const value = queue.shift();
+        if (typeof value === "string") {
+            signals.push({ message: value });
+            continue;
+        }
+        if (!isRecord(value))
+            continue;
+        if (seen.has(value))
+            continue;
+        seen.add(value);
+        if (value instanceof Error) {
+            signals.push({ message: value.message });
+        }
+        pushRecordSignals(value, signals, queue);
+        const serialized = maybeSerializable(value);
+        if (serialized && serialized !== value)
+            queue.push(serialized);
+    }
+    return signals;
+}
+function hasNormalizedValue(signals, values) {
+    for (const signal of signals) {
+        for (const value of [signal.code, signal.reason]) {
+            if (value && values.has(normalize(value)))
+                return signal;
+        }
+    }
+    return undefined;
+}
+function hasMessagePattern(signals, patterns) {
+    for (const signal of signals) {
+        const message = signal.message;
+        if (!message)
+            continue;
+        const normalized = message.toLowerCase();
+        if (patterns.some((pattern) => pattern.test(normalized)))
+            return signal;
+    }
+    return undefined;
+}
+function insufficientPermissionsAuthSignal(signals) {
+    for (const signal of signals) {
+        const reason = signal.reason ? normalize(signal.reason) : undefined;
+        const code = signal.code ? normalize(signal.code) : undefined;
+        if (reason !== "insufficient_permissions")
+            continue;
+        if (code === "trellis.bootstrap.auth_required")
+            return signal;
+        const message = signal.message?.toLowerCase() ?? "";
+        if (message.includes("auth required") ||
+            message.includes("requires sign-in") ||
+            message.includes("requires signin") ||
+            message.includes("stale") ||
+            message.includes("session")) {
+            return signal;
+        }
+    }
+    return undefined;
+}
+const APPROVAL_DENIED_VALUES = new Set([
+    "approval_denied",
+    "trellis.auth.approval_denied",
+]);
+const INSUFFICIENT_CAPABILITIES_VALUES = new Set([
+    "insufficient_capabilities",
+    "trellis.auth.insufficient_capabilities",
+]);
+const RUNTIME_UNAVAILABLE_VALUES = new Set([
+    "trellis.bootstrap.not_ready",
+    "trellis.runtime.unavailable",
+    "runtime_unavailable",
+]);
+const EXPIRED_FLOW_VALUES = new Set([
+    "flow_expired",
+    "expired",
+    "trellis.auth.bind_expired",
+    "trellis.auth.flow_expired",
+]);
+const STALE_SESSION_VALUES = new Set([
+    "session_not_found",
+    "session_expired",
+    "user_not_found",
+    "contract_not_active",
+    "trellis.auth.session_not_found",
+    "trellis.auth.session_expired",
+    "trellis.auth.user_not_found",
+    "trellis.auth.contract_not_active",
+]);
+const AUTH_REQUIRED_VALUES = new Set([
+    "auth_required",
+    "trellis.bootstrap.auth_required",
+    "trellis.auth.login_failed",
+]);
+/**
+ * Classifies browser auth, bootstrap, callback, and transport-like failures.
+ *
+ * The classifier accepts raw errors, serialized Trellis errors, nested causes,
+ * and nested remote errors. Recoverable classifications are intended for
+ * app-owned flows that can clear stale auth and restart sign-in without showing a
+ * user-facing terminal error.
+ */
+function classifyBrowserAuthError(error) {
+    const signals = collectErrorSignals(error);
+    const approvalDenied = hasNormalizedValue(signals, APPROVAL_DENIED_VALUES) ??
+        hasMessagePattern(signals, [/approval .*denied/, /access .*denied/]);
+    if (approvalDenied) {
+        return classification("policy_denied", false, approvalDenied);
+    }
+    const inactiveOrInvalid = hasNormalizedValue(signals, new Set(["invalid_credentials", "user_inactive", "inactive_account"])) ?? hasMessagePattern(signals, [
+        /invalid credential/,
+        /inactive account/,
+        /user inactive/,
+    ]);
+    if (inactiveOrInvalid) {
+        return classification("policy_denied", false, inactiveOrInvalid);
+    }
+    const insufficientCapabilities = hasNormalizedValue(signals, INSUFFICIENT_CAPABILITIES_VALUES) ?? hasMessagePattern(signals, [/insufficient capabilit/]);
+    if (insufficientCapabilities) {
+        return classification("insufficient_capabilities", false, insufficientCapabilities);
+    }
+    const runtimeUnavailable = hasNormalizedValue(signals, RUNTIME_UNAVAILABLE_VALUES) ?? hasMessagePattern(signals, [/runtime unavailable/]);
+    if (runtimeUnavailable) {
+        return classification("runtime_unavailable", false, runtimeUnavailable);
+    }
+    const expiredFlow = hasNormalizedValue(signals, EXPIRED_FLOW_VALUES) ??
+        hasMessagePattern(signals, [/flow .*expired/, /sign\-in .*expired/]);
+    if (expiredFlow) {
+        return classification("recoverable_expired_flow", true, expiredFlow);
+    }
+    const staleSession = hasNormalizedValue(signals, STALE_SESSION_VALUES) ??
+        hasMessagePattern(signals, [
+            /session .*expired/,
+            /session .*not found/,
+            /user .*not found/,
+            /contract .*not active/,
+        ]);
+    if (staleSession) {
+        return classification("recoverable_stale_session", true, staleSession);
+    }
+    const authRequired = hasNormalizedValue(signals, AUTH_REQUIRED_VALUES) ??
+        insufficientPermissionsAuthSignal(signals) ??
+        hasMessagePattern(signals, [
+            /auth required/,
+            /requires sign\-in/,
+            /requires signin/,
+            /requires authentication/,
+        ]);
+    if (authRequired) {
+        return classification("recoverable_auth_required", true, authRequired);
+    }
+    return classification("unknown", false);
+}
+/** Returns whether a browser auth error can silently restart sign-in. */
+function isRecoverableBrowserAuthError(error) {
+    return classifyBrowserAuthError(error).recoverable;
+}

package/script/auth/mod.d.ts

@@ -8,10 +8,10 @@
  * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
  */
 export { type AuthDeviceUserAuthoritiesListInput, type AuthDeviceUserAuthoritiesListOutput, type AuthDeviceUserAuthoritiesRevokeInput, type AuthDeviceUserAuthoritiesRevokeResponse, type AuthResolveDeviceUserAuthoritiesInput, type AuthResolveDeviceUserAuthoritiesOperation, type AuthResolveDeviceUserAuthoritiesOutput, type AuthResolveDeviceUserAuthoritiesProgress, buildDeviceActivationPayload, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, type DeviceActivationPayload, type DeviceActivationTransport, type DeviceActivationWaitRequest, type DeviceIdentity, encodeDeviceActivationPayload, getDeviceConnectInfo, type GetDeviceConnectInfoInput, type GetDeviceConnectInfoOutput, parseDeviceActivationPayload, signDeviceWaitRequest, startDeviceActivationRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, type WaitForDeviceActivationResponse, } from "./device_activation.js";
-export { type AuthConfig, bindFlow, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForIat, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, type SessionKeyHandle, type SessionKeyOptions, type SessionKeyPersistenceMode, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.js";
+export { type AuthConfig, bindFlow, type BrowserAuthRecoveryClassification, type BrowserAuthRecoveryKind, buildLoginUrl, classifyBrowserAuthError, clearSessionKey, completeSessionLogout, type CompleteSessionLogoutArgs, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, isRecoverableBrowserAuthError, loadSessionKey, logoutSession, logoutSessionSig, natsConnectSigForIat, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, type SessionKeyHandle, type SessionKeyOptions, type SessionKeyPersistenceMode, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.js";
 export { buildProofInput, createProof, type ProofParams, verifyProof, } from "./proof.js";
 export { ApprovalRecordViewSchema, AuthCapabilitiesListResponseSchema, AuthCapabilitiesListSchema, AuthCapabilityGroupsDeleteResponseSchema, AuthCapabilityGroupsDeleteSchema, AuthCapabilityGroupsGetResponseSchema, AuthCapabilityGroupsGetSchema, AuthCapabilityGroupsListResponseSchema, AuthCapabilityGroupsListSchema, AuthCapabilityGroupsPutResponseSchema, AuthCapabilityGroupsPutSchema, type AuthDeployment, type AuthDeploymentAuthorityAcceptMigrationInput, AuthDeploymentAuthorityAcceptMigrationSchema, type AuthDeploymentAuthorityAcceptResponse, AuthDeploymentAuthorityAcceptResponseSchema, type AuthDeploymentAuthorityAcceptUpdateInput, AuthDeploymentAuthorityAcceptUpdateSchema, type AuthDeploymentAuthorityGetInput, type AuthDeploymentAuthorityGetResponse, AuthDeploymentAuthorityGetResponseSchema, AuthDeploymentAuthorityGetSchema, type AuthDeploymentAuthorityGrantOverridesListInput, type AuthDeploymentAuthorityGrantOverridesListResponse, AuthDeploymentAuthorityGrantOverridesListResponseSchema, AuthDeploymentAuthorityGrantOverridesListSchema, type AuthDeploymentAuthorityGrantOverridesPutInput, AuthDeploymentAuthorityGrantOverridesPutSchema, type AuthDeploymentAuthorityGrantOverridesRemoveInput, AuthDeploymentAuthorityGrantOverridesRemoveSchema, type AuthDeploymentAuthorityGrantOverridesResponse, AuthDeploymentAuthorityGrantOverridesResponseSchema, type AuthDeploymentAuthorityListInput, type AuthDeploymentAuthorityListResponse, AuthDeploymentAuthorityListResponseSchema, AuthDeploymentAuthorityListSchema, type AuthDeploymentAuthorityPlanInput, type AuthDeploymentAuthorityPlanResponse, AuthDeploymentAuthorityPlanResponseSchema, AuthDeploymentAuthorityPlanSchema, type AuthDeploymentAuthorityPlansGetInput, type AuthDeploymentAuthorityPlansGetResponse, AuthDeploymentAuthorityPlansGetResponseSchema, AuthDeploymentAuthorityPlansGetSchema, type AuthDeploymentAuthorityPlansListInput, type AuthDeploymentAuthorityPlansListResponse, AuthDeploymentAuthorityPlansListResponseSchema, AuthDeploymentAuthorityPlansListSchema, type AuthDeploymentAuthorityReconcileInput, type AuthDeploymentAuthorityReconcileResponse, AuthDeploymentAuthorityReconcileResponseSchema, AuthDeploymentAuthorityReconcileSchema, type AuthDeploymentAuthorityRejectInput, type AuthDeploymentAuthorityRejectResponse, AuthDeploymentAuthorityRejectResponseSchema, AuthDeploymentAuthorityRejectSchema, type AuthDeploymentKind, AuthDeploymentKindSchema, AuthDeploymentSchema, AuthDeploymentsCreateResponseSchema, AuthDeploymentsCreateSchema, AuthDeploymentsDisableResponseSchema, AuthDeploymentsDisableSchema, AuthDeploymentsEnableResponseSchema, AuthDeploymentsEnableSchema, AuthDeploymentsListResponseSchema, AuthDeploymentsListSchema, AuthDeploymentsRemoveResponseSchema, AuthDeploymentsRemoveSchema, AuthDevicesConnectInfoGetResponseSchema, AuthDevicesConnectInfoGetSchema, AuthDevicesDisableResponseSchema, AuthDevicesDisableSchema, AuthDevicesEnableResponseSchema, AuthDevicesEnableSchema, AuthDevicesListResponseSchema, AuthDevicesListSchema, AuthDevicesProvisionResponseSchema, AuthDevicesProvisionSchema, AuthDevicesRemoveResponseSchema, AuthDevicesRemoveSchema, AuthDeviceUserAuthoritiesApprovedEventSchema, AuthDeviceUserAuthoritiesListResponseSchema, AuthDeviceUserAuthoritiesListSchema, AuthDeviceUserAuthoritiesRequestedEventSchema, AuthDeviceUserAuthoritiesResolvedEventSchema, AuthDeviceUserAuthoritiesReviewRequestedEventSchema, AuthDeviceUserAuthoritiesReviewsDecideResponseSchema, AuthDeviceUserAuthoritiesReviewsDecideSchema, AuthDeviceUserAuthoritiesReviewsListResponseSchema, AuthDeviceUserAuthoritiesReviewsListSchema, AuthDeviceUserAuthoritiesRevokeResponseSchema, AuthDeviceUserAuthoritiesRevokeSchema, type AuthenticatedDevice, AuthenticatedDeviceSchema, type AuthenticatedService, type AuthenticatedUser, AuthIdentitiesListResponseSchema, AuthIdentitiesListSchema, AuthIdentityGrantsListResponseSchema, AuthIdentityGrantsListSchema, AuthIdentityGrantsRevokeResponseSchema, AuthIdentityGrantsRevokeSchema, AuthPortalsGetResponseSchema, AuthPortalsGetSchema, AuthPortalsListResponseSchema, AuthPortalsListSchema, AuthPortalsLoginSettingsGetSchema, AuthPortalsLoginSettingsResponseSchema, AuthPortalsLoginSettingsUpdateSchema, AuthPortalsRoutesPutResponseSchema, AuthPortalsRoutesPutSchema, AuthPortalsRoutesRemoveResponseSchema, AuthPortalsRoutesRemoveSchema, AuthRequestsValidateResponseSchema, AuthRequestsValidateSchema, AuthResolveDeviceUserAuthoritiesProgressSchema, AuthResolveDeviceUserAuthoritiesResponseSchema, AuthResolveDeviceUserAuthoritiesSchema, AuthServiceInstancesDisableResponseSchema, AuthServiceInstancesDisableSchema, AuthServiceInstancesEnableResponseSchema, AuthServiceInstancesEnableSchema, AuthServiceInstancesListResponseSchema, AuthServiceInstancesListSchema, AuthServiceInstancesProvisionResponseSchema, AuthServiceInstancesProvisionSchema, AuthServiceInstancesRemoveResponseSchema, AuthServiceInstancesRemoveSchema, type AuthSessionsMeResponse, AuthSessionsMeResponseSchema, AuthSessionsMeSchema, AuthUserIdentitiesListResponseSchema, AuthUserIdentitiesListSchema, AuthUserIdentitiesUnlinkResponseSchema, AuthUserIdentitiesUnlinkSchema, AuthUsersAccountFlowCreateResponseSchema, AuthUsersCreateResponseSchema, AuthUsersCreateSchema, AuthUsersGetResponseSchema, AuthUsersGetSchema, AuthUsersIdentityLinkCreateSchema, AuthUsersListResponseSchema, AuthUsersListSchema, AuthUsersPasswordChangeResponseSchema, AuthUsersPasswordChangeSchema, AuthUsersPasswordResetCreateSchema, AuthUsersUpdateResponseSchema, AuthUsersUpdateSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, type DeploymentAuthority, type DeploymentAuthorityCapability, type DeploymentAuthorityCapabilityNeed, DeploymentAuthorityCapabilityNeedSchema, DeploymentAuthorityCapabilitySchema, type DeploymentAuthorityContractNeed, DeploymentAuthorityContractNeedSchema, type DeploymentAuthorityGrantOverride, DeploymentAuthorityGrantOverrideSchema, type DeploymentAuthorityKind, DeploymentAuthorityKindSchema, type DeploymentAuthorityMaterialization, DeploymentAuthorityMaterializationSchema, type DeploymentAuthorityMigration, DeploymentAuthorityMigrationSchema, type DeploymentAuthorityNeeds, DeploymentAuthorityNeedsSchema, type DeploymentAuthorityPlan, DeploymentAuthorityPlanSchema, type DeploymentAuthorityProposal, DeploymentAuthorityProposalSchema, type DeploymentAuthorityReconciliationStatus, DeploymentAuthorityReconciliationStatusSchema, type DeploymentAuthorityResource, DeploymentAuthorityResourceKindSchema, type DeploymentAuthorityResourceNeed, DeploymentAuthorityResourceNeedSchema, DeploymentAuthorityResourceSchema, DeploymentAuthoritySchema, type DeploymentAuthoritySurface, DeploymentAuthoritySurfaceActionSchema, DeploymentAuthoritySurfaceKindSchema, type DeploymentAuthoritySurfaceNeed, DeploymentAuthoritySurfaceNeedSchema, DeploymentAuthoritySurfaceSchema, type DeploymentAuthorityUpdate, DeploymentAuthorityUpdateSchema, DeploymentPortalRouteSchema, DeploymentResourceBindingSchema, type DeviceActivationRecord, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, DeviceDeploymentSchema, DeviceSchema, DigestSchema, type FlowRegistrationAvailability, FlowRegistrationAvailabilitySchema, IdentityGrantViewSchema, ImplementationOfferSchema, type LoginPortalRecord, LoginPortalRecordSchema, type LoginPortalRoute, LoginPortalRouteSchema, type LoginPortalSettings, LoginPortalSettingsSchema, type LoginPortalSummary, LoginPortalSummarySchema, type MaterializedAuthorityCapabilityGrant, MaterializedAuthorityCapabilityGrantSchema, type MaterializedAuthorityGrant, type MaterializedAuthorityGrants, MaterializedAuthorityGrantsSchema, type MaterializedAuthorityNatsGrant, MaterializedAuthorityNatsGrantSchema, type MaterializedAuthorityNatsGrantSource, MaterializedAuthorityNatsGrantSourceSchema, type MaterializedAuthoritySurfaceGrant, MaterializedAuthoritySurfaceGrantSchema, OpenObjectSchema, type ParticipantKind, ParticipantKindSchema, type PortalFlowApp, type PortalFlowApproval, type PortalFlowApprovalDeniedState, type PortalFlowApprovalRequiredState, type PortalFlowChooseProviderState, type PortalFlowExpiredState, type PortalFlowInsufficientCapabilitiesState, type PortalFlowProvider, type PortalFlowRedirectState, type PortalFlowState, PortalFlowStateSchema, type PortalFlowUser, ServiceDeploymentSchema, ServiceInstanceSchema, UserViewSchema, WaitForDeviceActivationRequestSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
-export { approvalCapabilityKeys, type ApprovalDecision, ApprovalDecisionSchema, type AuthStartFlowResponse, AuthStartFlowResponseSchema, type AuthStartRequest, AuthStartRequestSchema, type AuthStartResponse, AuthStartResponseSchema, type BindResponse, BindResponseSchema, type BindSuccessResponse, BindSuccessResponseSchema, type ClientTransportEndpoints, ClientTransportEndpointsSchema, type ClientTransports, ClientTransportsSchema, type ContractApproval, type ContractApprovalCapability, ContractApprovalSchema, type NatsAuthTokenV1, NatsAuthTokenV1Schema, type SentinelCreds, SentinelCredsSchema, type UserParticipantKind, UserParticipantKindSchema, } from "./schemas.js";
+export { approvalCapabilityKeys, type ApprovalDecision, ApprovalDecisionSchema, type AuthLogoutRequest, AuthLogoutRequestSchema, type AuthLogoutResponse, type AuthLogoutResponseMode, AuthLogoutResponseModeSchema, AuthLogoutResponseSchema, type AuthStartFlowResponse, AuthStartFlowResponseSchema, type AuthStartRequest, AuthStartRequestSchema, type AuthStartResponse, AuthStartResponseSchema, type BindResponse, BindResponseSchema, type BindSuccessResponse, BindSuccessResponseSchema, buildLogoutSignaturePayload, type ClientTransportEndpoints, ClientTransportEndpointsSchema, type ClientTransports, ClientTransportsSchema, type ContractApproval, type ContractApprovalCapability, ContractApprovalSchema, type LogoutSignaturePayloadInput, type NatsAuthTokenV1, NatsAuthTokenV1Schema, type SentinelCreds, SentinelCredsSchema, type UserParticipantKind, UserParticipantKindSchema, } from "./schemas.js";
 export { buildNatsConnectSignaturePayload, createAuth, type NatsConnectOptions, type TrellisAuth, } from "./session_auth.js";
 export { correctedIatSeconds, estimateMidpointClockOffsetMs } from "./time.js";
 export { trellisIdFromOriginId } from "./trellis_id.js";

package/script/auth/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/auth/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,KAAK,uCAAuC,EAC5C,KAAK,qCAAqC,EAC1C,KAAK,yCAAyC,EAC9C,KAAK,sCAAsC,EAC3C,KAAK,wCAAwC,EAC7C,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,cAAc,EACnB,6BAA6B,EAC7B,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,+BAA+B,GACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,UAAU,EACf,QAAQ,EACR,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,SAAS,EACT,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,qCAAqC,EACrC,6BAA6B,EAC7B,sCAAsC,EACtC,8BAA8B,EAC9B,qCAAqC,EACrC,6BAA6B,EAC7B,KAAK,cAAc,EACnB,KAAK,2CAA2C,EAChD,4CAA4C,EAC5C,KAAK,qCAAqC,EAC1C,2CAA2C,EAC3C,KAAK,wCAAwC,EAC7C,yCAAyC,EACzC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,wCAAwC,EACxC,gCAAgC,EAChC,KAAK,8CAA8C,EACnD,KAAK,iDAAiD,EACtD,uDAAuD,EACvD,+CAA+C,EAC/C,KAAK,6CAA6C,EAClD,8CAA8C,EAC9C,KAAK,gDAAgD,EACrD,iDAAiD,EACjD,KAAK,6CAA6C,EAClD,mDAAmD,EACnD,KAAK,gCAAgC,EACrC,KAAK,mCAAmC,EACxC,yCAAyC,EACzC,iCAAiC,EACjC,KAAK,gCAAgC,EACrC,KAAK,mCAAmC,EACxC,yCAAyC,EACzC,iCAAiC,EACjC,KAAK,oCAAoC,EACzC,KAAK,uCAAuC,EAC5C,6CAA6C,EAC7C,qCAAqC,EACrC,KAAK,qCAAqC,EAC1C,KAAK,wCAAwC,EAC7C,8CAA8C,EAC9C,sCAAsC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,wCAAwC,EAC7C,8CAA8C,EAC9C,sCAAsC,EACtC,KAAK,kCAAkC,EACvC,KAAK,qCAAqC,EAC1C,2CAA2C,EAC3C,mCAAmC,EACnC,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,mCAAmC,EACnC,2BAA2B,EAC3B,oCAAoC,EACpC,4BAA4B,EAC5B,mCAAmC,EACnC,2BAA2B,EAC3B,iCAAiC,EACjC,yBAAyB,EACzB,mCAAmC,EACnC,2BAA2B,EAC3B,uCAAuC,EACvC,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,kCAAkC,EAClC,0BAA0B,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,mCAAmC,EACnC,6CAA6C,EAC7C,4CAA4C,EAC5C,mDAAmD,EACnD,oDAAoD,EACpD,4CAA4C,EAC5C,kDAAkD,EAClD,0CAA0C,EAC1C,6CAA6C,EAC7C,qCAAqC,EACrC,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,gCAAgC,EAChC,wBAAwB,EACxB,oCAAoC,EACpC,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,qBAAqB,EACrB,iCAAiC,EACjC,sCAAsC,EACtC,oCAAoC,EACpC,kCAAkC,EAClC,0BAA0B,EAC1B,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,0BAA0B,EAC1B,8CAA8C,EAC9C,8CAA8C,EAC9C,sCAAsC,EACtC,yCAAyC,EACzC,iCAAiC,EACjC,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EACxC,gCAAgC,EAChC,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,oCAAoC,EACpC,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,wCAAwC,EACxC,6BAA6B,EAC7B,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,iCAAiC,EACjC,2BAA2B,EAC3B,mBAAmB,EACnB,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,uCAAuC,EACvC,mCAAmC,EACnC,KAAK,+BAA+B,EACpC,qCAAqC,EACrC,KAAK,gCAAgC,EACrC,sCAAsC,EACtC,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,wCAAwC,EACxC,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,iCAAiC,EACjC,KAAK,uCAAuC,EAC5C,6CAA6C,EAC7C,KAAK,2BAA2B,EAChC,qCAAqC,EACrC,KAAK,+BAA+B,EACpC,qCAAqC,EACrC,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,KAAK,8BAA8B,EACnC,oCAAoC,EACpC,gCAAgC,EAChC,KAAK,yBAAyB,EAC9B,+BAA+B,EAC/B,2BAA2B,EAC3B,+BAA+B,EAC/B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,oCAAoC,EACzC,0CAA0C,EAC1C,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,iCAAiC,EACjC,KAAK,8BAA8B,EACnC,oCAAoC,EACpC,KAAK,oCAAoC,EACzC,0CAA0C,EAC1C,KAAK,iCAAiC,EACtC,uCAAuC,EACvC,gBAAgB,EAChB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,YAAY,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAC/B,sBAAsB,EACtB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gCAAgC,EAChC,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/auth/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,KAAK,uCAAuC,EAC5C,KAAK,qCAAqC,EAC1C,KAAK,yCAAyC,EAC9C,KAAK,sCAAsC,EAC3C,KAAK,wCAAwC,EAC7C,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,cAAc,EACnB,6BAA6B,EAC7B,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,+BAA+B,GACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,UAAU,EACf,QAAQ,EACR,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,6BAA6B,EAC7B,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,SAAS,EACT,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,0BAA0B,EAC1B,wCAAwC,EACxC,gCAAgC,EAChC,qCAAqC,EACrC,6BAA6B,EAC7B,sCAAsC,EACtC,8BAA8B,EAC9B,qCAAqC,EACrC,6BAA6B,EAC7B,KAAK,cAAc,EACnB,KAAK,2CAA2C,EAChD,4CAA4C,EAC5C,KAAK,qCAAqC,EAC1C,2CAA2C,EAC3C,KAAK,wCAAwC,EAC7C,yCAAyC,EACzC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,wCAAwC,EACxC,gCAAgC,EAChC,KAAK,8CAA8C,EACnD,KAAK,iDAAiD,EACtD,uDAAuD,EACvD,+CAA+C,EAC/C,KAAK,6CAA6C,EAClD,8CAA8C,EAC9C,KAAK,gDAAgD,EACrD,iDAAiD,EACjD,KAAK,6CAA6C,EAClD,mDAAmD,EACnD,KAAK,gCAAgC,EACrC,KAAK,mCAAmC,EACxC,yCAAyC,EACzC,iCAAiC,EACjC,KAAK,gCAAgC,EACrC,KAAK,mCAAmC,EACxC,yCAAyC,EACzC,iCAAiC,EACjC,KAAK,oCAAoC,EACzC,KAAK,uCAAuC,EAC5C,6CAA6C,EAC7C,qCAAqC,EACrC,KAAK,qCAAqC,EAC1C,KAAK,wCAAwC,EAC7C,8CAA8C,EAC9C,sCAAsC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,wCAAwC,EAC7C,8CAA8C,EAC9C,sCAAsC,EACtC,KAAK,kCAAkC,EACvC,KAAK,qCAAqC,EAC1C,2CAA2C,EAC3C,mCAAmC,EACnC,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,mCAAmC,EACnC,2BAA2B,EAC3B,oCAAoC,EACpC,4BAA4B,EAC5B,mCAAmC,EACnC,2BAA2B,EAC3B,iCAAiC,EACjC,yBAAyB,EACzB,mCAAmC,EACnC,2BAA2B,EAC3B,uCAAuC,EACvC,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,kCAAkC,EAClC,0BAA0B,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,mCAAmC,EACnC,6CAA6C,EAC7C,4CAA4C,EAC5C,mDAAmD,EACnD,oDAAoD,EACpD,4CAA4C,EAC5C,kDAAkD,EAClD,0CAA0C,EAC1C,6CAA6C,EAC7C,qCAAqC,EACrC,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,gCAAgC,EAChC,wBAAwB,EACxB,oCAAoC,EACpC,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,qBAAqB,EACrB,iCAAiC,EACjC,sCAAsC,EACtC,oCAAoC,EACpC,kCAAkC,EAClC,0BAA0B,EAC1B,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,0BAA0B,EAC1B,8CAA8C,EAC9C,8CAA8C,EAC9C,sCAAsC,EACtC,yCAAyC,EACzC,iCAAiC,EACjC,wCAAwC,EACxC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EACxC,gCAAgC,EAChC,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,oCAAoC,EACpC,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,wCAAwC,EACxC,6BAA6B,EAC7B,qBAAqB,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,iCAAiC,EACjC,2BAA2B,EAC3B,mBAAmB,EACnB,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,uCAAuC,EACvC,mCAAmC,EACnC,KAAK,+BAA+B,EACpC,qCAAqC,EACrC,KAAK,gCAAgC,EACrC,sCAAsC,EACtC,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,wCAAwC,EACxC,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,iCAAiC,EACjC,KAAK,uCAAuC,EAC5C,6CAA6C,EAC7C,KAAK,2BAA2B,EAChC,qCAAqC,EACrC,KAAK,+BAA+B,EACpC,qCAAqC,EACrC,iCAAiC,EACjC,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,KAAK,8BAA8B,EACnC,oCAAoC,EACpC,gCAAgC,EAChC,KAAK,yBAAyB,EAC9B,+BAA+B,EAC/B,2BAA2B,EAC3B,+BAA+B,EAC/B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,KAAK,4BAA4B,EACjC,kCAAkC,EAClC,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,oCAAoC,EACzC,0CAA0C,EAC1C,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,iCAAiC,EACjC,KAAK,8BAA8B,EACnC,oCAAoC,EACpC,KAAK,oCAAoC,EACzC,0CAA0C,EAC1C,KAAK,iCAAiC,EACtC,uCAAuC,EACvC,gBAAgB,EAChB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,YAAY,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAC/B,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gCAAgC,EAChC,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,aAAa,EACb,IAAI,GACL,MAAM,YAAY,CAAC"}