@runinfra/cli 0.1.0

package/dist/lease.js

@@ -0,0 +1,91 @@
+import { CliError } from "./errors.js";
+export const LEASE_REFRESH_MARGIN_MS = 120_000;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function parseLeaseResponse(body) {
+    if (!isRecord(body))
+        return null;
+    const { url, expiresAt, version, checksumSha256 } = body;
+    if (typeof url !== "string" || url.length === 0)
+        return null;
+    if (typeof expiresAt !== "string")
+        return null;
+    if (typeof version !== "number" || !Number.isSafeInteger(version))
+        return null;
+    if (checksumSha256 !== null && typeof checksumSha256 !== "string")
+        return null;
+    const expiresAtMs = Date.parse(expiresAt);
+    if (!Number.isFinite(expiresAtMs))
+        return null;
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsedUrl.protocol !== "https:" && !isLoopback(parsedUrl.hostname)) {
+        return null;
+    }
+    return { url, expiresAtMs, packageVersion: version, checksumSha256 };
+}
+function isLoopback(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+export function leaseNeedsRefresh(lease, nowMs) {
+    return lease.expiresAtMs - nowMs <= LEASE_REFRESH_MARGIN_MS;
+}
+export function leaseExpiredStatus(status) {
+    return status === 401 || status === 403;
+}
+export function leaseChangeReason(sidecar, lease) {
+    if (sidecar.packageVersion !== lease.packageVersion)
+        return "version";
+    if (sidecar.checksumSha256 !== null &&
+        lease.checksumSha256 !== null &&
+        sidecar.checksumSha256.toLowerCase() !== lease.checksumSha256.toLowerCase()) {
+        return "checksum";
+    }
+    return null;
+}
+export function downloadFailure(status, body, slug) {
+    const code = isRecord(body) && typeof body.code === "string" ? body.code : null;
+    const retryAfter = isRecord(body) && typeof body.retryAfterSeconds === "number"
+        ? Math.max(1, Math.ceil(body.retryAfterSeconds))
+        : null;
+    if (code === "key_revoked") {
+        return new CliError("not_authenticated", "This terminal's access was revoked.", "Run `runinfra login` to connect it again.");
+    }
+    if (code === "key_expired") {
+        return new CliError("auth_expired", "This terminal's access expired.", "Run `runinfra login` to connect it again.");
+    }
+    if (code === "workspace_access_revoked") {
+        return new CliError("not_entitled", "Your account no longer has access to this workspace.", "Ask a workspace admin to re-invite you, then run `runinfra login` again.");
+    }
+    if (code === "invalid_key" || code === "missing_credentials") {
+        return new CliError("not_authenticated", "This machine's credentials were not accepted.", "Run `runinfra login` to connect this terminal again.");
+    }
+    if (code === "auth_unavailable") {
+        return new CliError("server_error", "Credentials could not be checked right now. Nothing was downloaded.", "Try again in a few minutes.");
+    }
+    if (status === 401) {
+        return new CliError("not_authenticated", "This machine is not signed in, or its access was revoked.", "Run `runinfra login` to connect this terminal again.");
+    }
+    if (status === 403 && code === "plan_gate") {
+        return new CliError("not_entitled", `Your plan does not include downloads for ${slug}.`, "Open the package page on runinfra.ai to see what your workspace owns.");
+    }
+    if (code === "not_found" || status === 404) {
+        return new CliError("not_found", `Your workspace does not own ${slug}, or that slug does not exist.`, "Check the slug on runinfra.ai, or buy the package first.");
+    }
+    if (code === "artifact_not_ready") {
+        return new CliError("artifact_not_ready", `${slug} is owned by this workspace but its files are not published yet.`, "This resolves on its own. Contact support if it persists.");
+    }
+    if (code === "rate_limited" || status === 429) {
+        return new CliError("rate_limited", `Too many download requests. Retry in ${retryAfter ?? 60} seconds.`, null);
+    }
+    if (status === 403) {
+        return new CliError("not_entitled", `This key is not allowed to download ${slug}.`, "Run `runinfra login` again, or ask a workspace admin for access.");
+    }
+    return new CliError("server_error", `The download request for ${slug} failed with HTTP ${status}.`, "Try again shortly. If it keeps failing, contact support with this status.");
+}

package/dist/login.js

@@ -0,0 +1,207 @@
+import { exchangeAuthorizationCode, pollDeviceCode, startDeviceAuthorization, startLoopbackAuthorization, tokenRefusalError, } from "./auth-api.js";
+import { openBrowser, headlessReason } from "./browser.js";
+import { CREDENTIALS_FORMAT, writeCredentials } from "./credentials.js";
+import { sanitizeDeviceLabel } from "./endpoints.js";
+import { CliError } from "./errors.js";
+import { startLoopbackListener, parseCallback } from "./loopback.js";
+import { createPkcePair, isWellFormedAuthorizationCode } from "./pkce.js";
+import { promptLine } from "./prompt.js";
+import { CLI_REQUESTED_SCOPE } from "./scopes.js";
+import { sleep } from "./timers.js";
+import { deviceLabel } from "./context.js";
+const BROWSER_FLOW_TIMEOUT_MS = 10 * 60 * 1000;
+const PASTE_PROMPT = "  Or paste the code shown on the approval page and press Enter: ";
+export async function login(context, options) {
+    const raw = deviceLabel();
+    const label = raw === null ? null : sanitizeDeviceLabel(raw);
+    if (options.device) {
+        return await deviceLogin(context, label, null);
+    }
+    const blocked = headlessReason(context.platform, context.env);
+    if (blocked !== null) {
+        return await deviceLogin(context, label, blocked);
+    }
+    return await browserLogin(context, label);
+}
+async function browserLogin(context, label) {
+    const { output } = context;
+    const pkce = createPkcePair();
+    let listener;
+    try {
+        listener = await startLoopbackListener();
+    }
+    catch (error) {
+        output.warn(error instanceof CliError
+            ? `${error.message} Falling back to the device flow.`
+            : "Could not open a local port for the browser redirect. Falling back to the device flow.");
+        return await deviceLogin(context, label, "a local port could not be opened");
+    }
+    let requestId;
+    try {
+        const opened = await startLoopbackAuthorization({
+            endpoints: context.endpoints,
+            codeChallenge: pkce.challenge,
+            scope: CLI_REQUESTED_SCOPE,
+            redirectUri: listener.redirectUri,
+            deviceLabel: label,
+        });
+        if (!opened.ok) {
+            listener.close();
+            return await deviceLogin(context, label, "this deployment does not offer the browser redirect flow yet");
+        }
+        requestId = opened.requestId;
+    }
+    catch (error) {
+        listener.close();
+        throw error;
+    }
+    const consentUrl = context.endpoints.consentUrl(requestId);
+    const launch = await openBrowser(consentUrl, context.platform, context.env);
+    if (launch.opened) {
+        output.info("Opened your browser to approve this terminal.");
+    }
+    else {
+        output.info(launch.reason
+            ? `Could not open a browser (${launch.reason}). Open this URL yourself:`
+            : "Open this URL to approve this terminal:");
+    }
+    output.detail(consentUrl);
+    output.info("Waiting for approval. This request expires in 10 minutes.");
+    const prompt = promptLine(PASTE_PROMPT);
+    const outcome = await raceBrowserOutcome(listener.callback, prompt.answer);
+    prompt.cancel();
+    listener.close();
+    if (outcome.kind === "timeout") {
+        throw new CliError("auth_timeout", "The sign-in was not approved within 10 minutes.", "Run `runinfra login` again.");
+    }
+    const { code } = resolveBrowserCode(outcome, output);
+    const result = await exchangeAuthorizationCode({
+        endpoints: context.endpoints,
+        code,
+        codeVerifier: pkce.verifier,
+        redirectUri: listener.redirectUri,
+    });
+    if (!result.ok)
+        throw tokenRefusalError(result.code);
+    await persist(context, result.session);
+    return 0;
+}
+async function raceBrowserOutcome(callback, pasted) {
+    let timer = null;
+    const deadline = new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ kind: "timeout" }), BROWSER_FLOW_TIMEOUT_MS);
+    });
+    try {
+        return await Promise.race([
+            callback.then((result) => ({ kind: "callback", result })),
+            pasted.then((value) => value === null || value.length === 0
+                ? new Promise(() => undefined)
+                : { kind: "pasted", value }),
+            deadline,
+        ]);
+    }
+    finally {
+        if (timer !== null)
+            clearTimeout(timer);
+    }
+}
+function resolveBrowserCode(outcome, output) {
+    if (outcome.kind === "callback") {
+        const result = outcome.result;
+        if (!result.ok) {
+            if (result.reason === "authorization_error") {
+                throw new CliError("auth_denied", `The browser reported: ${result.description}`, null);
+            }
+            throw new CliError("auth_failed", "The browser redirect did not carry an authorization code.", "Run `runinfra login` again, or use `runinfra login --device`.");
+        }
+        return { code: result.code };
+    }
+    const pasted = outcome.value.trim();
+    if (pasted.includes("://")) {
+        const parsed = parseCallback(pasted);
+        if (!parsed.ok) {
+            throw new CliError("auth_failed", "That URL does not contain an authorization code.", "Paste just the code from the approval page.");
+        }
+        return { code: parsed.code };
+    }
+    if (!isWellFormedAuthorizationCode(pasted)) {
+        throw new CliError("auth_failed", "That does not look like an authorization code.", "Copy the whole code from the approval page and try `runinfra login` again.");
+    }
+    output.warn("Using the pasted code. The redirect never reached this terminal.");
+    return { code: pasted };
+}
+async function deviceLogin(context, label, reason) {
+    const { output } = context;
+    if (reason !== null) {
+        output.info(`Using the device flow because ${reason}.`);
+    }
+    const pkce = createPkcePair();
+    const authorization = await startDeviceAuthorization({
+        endpoints: context.endpoints,
+        codeChallenge: pkce.challenge,
+        scope: CLI_REQUESTED_SCOPE,
+        deviceLabel: label,
+    });
+    output.info("To connect this terminal:");
+    output.detail(`1. On any device, open  ${authorization.verificationUri}`);
+    output.detail(`2. Type this code:      ${authorization.userCode}`);
+    output.info("The page will not fill the code in for you. If a link ever arrives with the code already in it, it did not come from RunInfra.");
+    const session = await pollForDeviceApproval(context, authorization);
+    await persist(context, session);
+    return 0;
+}
+async function pollForDeviceApproval(context, authorization) {
+    const deadline = Date.now() + authorization.expiresInSeconds * 1000;
+    let intervalSeconds = authorization.intervalSeconds;
+    while (Date.now() < deadline) {
+        await sleep(intervalSeconds * 1000);
+        const remaining = Math.max(0, Math.ceil((deadline - Date.now()) / 1000));
+        context.output.status(`  Waiting for approval, ${remaining}s left`);
+        const result = await pollDeviceCode({
+            endpoints: context.endpoints,
+            deviceCode: authorization.deviceCode,
+        });
+        if (result.ok) {
+            context.output.endStatus();
+            return result.session;
+        }
+        if (result.code === "authorization_pending")
+            continue;
+        if (result.code === "slow_down") {
+            intervalSeconds += 5;
+            continue;
+        }
+        if (result.code === "rate_limited" || result.code === "temporarily_unavailable") {
+            intervalSeconds = Math.max(intervalSeconds, result.retryAfterSeconds ?? intervalSeconds + 5);
+            continue;
+        }
+        context.output.endStatus();
+        throw tokenRefusalError(result.code);
+    }
+    context.output.endStatus();
+    throw new CliError("auth_timeout", "The code expired before it was approved.", "Run `runinfra login --device` again to get a new code.");
+}
+async function persist(context, session) {
+    const write = await writeCredentials({
+        location: context.location,
+        platform: context.platform,
+        env: context.env,
+        credentials: {
+            format: CREDENTIALS_FORMAT,
+            apiBase: context.apiBase,
+            apiKey: session.apiKey,
+            keyPrefix: session.keyPrefix,
+            workspaceId: session.workspaceId,
+            scope: session.scope,
+            expiresAt: session.expiresAt,
+            createdAt: new Date().toISOString(),
+        },
+    });
+    context.output.info(`Connected to workspace ${session.workspaceId}.`);
+    context.output.detail(`Credentials stored at ${context.location.file}`);
+    context.output.detail(`This access expires ${session.expiresAt}.`);
+    if (write.warning !== null) {
+        context.output.warn(write.warning);
+    }
+    context.output.detail("Revoke this terminal any time from Settings, API keys.");
+}

package/dist/logout.js

@@ -0,0 +1,17 @@
+import { deleteCredentials, readCredentials } from "./credentials.js";
+import { redact } from "./redact.js";
+export async function logout(context) {
+    const credentials = await readCredentials(context.location);
+    if (credentials === null) {
+        const removed = await deleteCredentials(context.location);
+        context.output.info(removed
+            ? "Removed an unreadable credentials file. This machine is signed out."
+            : "This machine was not signed in.");
+        return 0;
+    }
+    await deleteCredentials(context.location);
+    context.output.info("Removed this machine's credentials.");
+    context.output.detail(`The key ${credentials.keyPrefix} (${redact(credentials.apiKey)}) is still valid until ${credentials.expiresAt}.`);
+    context.output.detail("To end its access now, revoke it in Settings, API keys on runinfra.ai.");
+    return 0;
+}

package/dist/loopback.js

@@ -0,0 +1,142 @@
+import { createServer } from "node:http";
+import { CliError } from "./errors.js";
+export const LOOPBACK_CALLBACK_PATH = "/callback";
+export const LOOPBACK_BIND_ATTEMPTS = 3;
+export function loopbackRedirectUri(family, port, path = LOOPBACK_CALLBACK_PATH) {
+    const host = family === "IPv6" ? "[::1]" : "127.0.0.1";
+    return `http://${host}:${port}${path}`;
+}
+export function parseCallback(requestTarget) {
+    let url;
+    try {
+        url = new URL(requestTarget, "http://127.0.0.1");
+    }
+    catch {
+        return { ok: false, reason: "wrong_path", description: null };
+    }
+    if (url.pathname !== LOOPBACK_CALLBACK_PATH) {
+        return { ok: false, reason: "wrong_path", description: null };
+    }
+    const error = url.searchParams.get("error");
+    if (error) {
+        const description = url.searchParams.get("error_description");
+        return {
+            ok: false,
+            reason: "authorization_error",
+            description: description && description.length > 0 ? description : error,
+        };
+    }
+    const code = url.searchParams.get("code");
+    if (!code)
+        return { ok: false, reason: "missing_code", description: null };
+    return { ok: true, code, state: url.searchParams.get("state") };
+}
+export function callbackPage(kind, headline, body) {
+    const accent = kind === "ok" ? "#76b900" : "#c76f6f";
+    return [
+        "<!doctype html>",
+        '<html lang="en"><head><meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width,initial-scale=1">',
+        "<title>RunInfra CLI</title>",
+        "<style>",
+        "body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;",
+        "background:#0f0f0e;color:#f7f7f6;font:14px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif}",
+        "main{max-width:26rem;padding:2rem;border-left:2px solid " + accent + "}",
+        "h1{font-size:20px;font-weight:500;margin:0 0 .75rem}",
+        "p{margin:0;color:#9a998e}",
+        "</style></head><body><main>",
+        `<h1>${escapeHtml(headline)}</h1>`,
+        `<p>${escapeHtml(body)}</p>`,
+        "</main></body></html>",
+    ].join("");
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/gu, "&amp;")
+        .replace(/</gu, "&lt;")
+        .replace(/>/gu, "&gt;")
+        .replace(/"/gu, "&quot;");
+}
+async function bindOnce(host) {
+    const server = createServer();
+    return await new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.close();
+            reject(error);
+        };
+        server.once("error", onError);
+        server.listen({ host, port: 0, exclusive: true }, () => {
+            server.removeListener("error", onError);
+            const address = server.address();
+            if (address === null || typeof address === "string") {
+                server.close();
+                reject(new Error("the loopback socket did not report a port"));
+                return;
+            }
+            resolve({
+                server,
+                family: address.family === "IPv6" ? "IPv6" : "IPv4",
+                port: address.port,
+            });
+        });
+    });
+}
+export async function startLoopbackListener() {
+    let bound = null;
+    let lastError = null;
+    for (let attempt = 0; attempt < LOOPBACK_BIND_ATTEMPTS && bound === null; attempt += 1) {
+        for (const host of ["127.0.0.1", "::1"]) {
+            try {
+                bound = await bindOnce(host);
+                break;
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+    }
+    if (bound === null) {
+        const detail = lastError instanceof Error ? lastError.message : String(lastError);
+        throw new CliError("network", `Could not open a loopback listener for the browser redirect: ${detail}`, "Run `runinfra login --device` instead; it needs no local port.");
+    }
+    const { server, family, port } = bound;
+    const redirectUri = loopbackRedirectUri(family, port);
+    const expectedHosts = new Set([`127.0.0.1:${port}`, `[::1]:${port}`, `localhost:${port}`]);
+    let settle = null;
+    const callback = new Promise((resolve) => {
+        settle = resolve;
+    });
+    server.on("request", (request, response) => {
+        const host = request.headers.host ?? "";
+        if (!expectedHosts.has(host)) {
+            response.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+            response.end("bad host\n");
+            return;
+        }
+        const parsed = parseCallback(request.url ?? "/");
+        if (!parsed.ok && parsed.reason === "wrong_path") {
+            response.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+            response.end("not found\n");
+            return;
+        }
+        const page = parsed.ok
+            ? callbackPage("ok", "Terminal connected", "You can close this tab and return to your terminal.")
+            : callbackPage("error", "Sign-in was not completed", parsed.reason === "authorization_error"
+                ? parsed.description
+                : "The browser did not send an authorization code. Return to your terminal for the next step.");
+        response.writeHead(parsed.ok ? 200 : 400, {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+        });
+        response.end(page);
+        settle?.(parsed);
+    });
+    return {
+        redirectUri,
+        callback,
+        close() {
+            server.close();
+            server.closeAllConnections();
+        },
+    };
+}

package/dist/main.js

@@ -0,0 +1,70 @@
+import { parseArgs } from "./args.js";
+import { createContext } from "./context.js";
+import { describeError, exitCodeFor, CliError } from "./errors.js";
+import { helpText } from "./help.js";
+import { login } from "./login.js";
+import { logout } from "./logout.js";
+import { createOutput } from "./output.js";
+import { pull } from "./pull.js";
+import { CLI_NAME, CLI_VERSION, isSupportedNodeVersion, MINIMUM_NODE_MAJOR } from "./version.js";
+import { whoami } from "./whoami.js";
+export async function run(argv, options = {}) {
+    const output = options.output ?? createOutput();
+    const parsed = parseArgs(argv);
+    if (!parsed.ok) {
+        output.error(parsed.message);
+        return 2;
+    }
+    if (parsed.args.command === "help") {
+        output.result(helpText());
+        return 0;
+    }
+    if (parsed.args.command === "version") {
+        output.result(`${CLI_NAME} ${CLI_VERSION}`);
+        return 0;
+    }
+    const nodeVersion = options.nodeVersion ?? process.versions.node;
+    if (!isSupportedNodeVersion(nodeVersion)) {
+        output.error(`Node ${MINIMUM_NODE_MAJOR} or newer is required, found ${nodeVersion}.`);
+        return 2;
+    }
+    const signal = options.signal ?? neverAborted();
+    try {
+        const context = createContext({
+            output,
+            ...(options.env ? { env: options.env } : {}),
+            ...(options.platform ? { platform: options.platform } : {}),
+        });
+        switch (parsed.args.command) {
+            case "login":
+                return await login(context, { device: parsed.args.device });
+            case "logout":
+                return await logout(context);
+            case "whoami":
+                return await whoami(context);
+            case "pull": {
+                const slug = parsed.args.slug;
+                if (slug === null) {
+                    output.error("runinfra pull needs a package slug.");
+                    return 2;
+                }
+                return await pull(context, { slug, out: parsed.args.out, concurrency: parsed.args.concurrency }, signal);
+            }
+        }
+    }
+    catch (error) {
+        output.endStatus();
+        const described = describeError(error);
+        output.error(described.message);
+        if (described.hint !== null)
+            output.detail(described.hint);
+        if (described.code === "unexpected") {
+            output.detail("This is a bug in the CLI. Report it with the command you ran and this message.");
+        }
+        return exitCodeFor(error);
+    }
+}
+function neverAborted() {
+    return new AbortController().signal;
+}
+export { CliError };

package/dist/output.js

@@ -0,0 +1,58 @@
+const STATUS_LOG_INTERVAL_MS = 10_000;
+function isTty(stream) {
+    return stream.isTTY === true;
+}
+function columnsOf(stream) {
+    const columns = stream.columns;
+    return typeof columns === "number" && columns > 20 ? columns : 80;
+}
+export function createOutput(streams = { stdout: process.stdout, stderr: process.stderr }, now = Date.now) {
+    const interactive = isTty(streams.stderr);
+    let statusActive = false;
+    let lastStatusLogMs = 0;
+    const endStatus = () => {
+        if (!statusActive)
+            return;
+        statusActive = false;
+        if (interactive)
+            streams.stderr.write("\n");
+    };
+    const writeLine = (stream, text) => {
+        endStatus();
+        stream.write(`${text}\n`);
+    };
+    return {
+        interactive,
+        result(text) {
+            endStatus();
+            streams.stdout.write(`${text}\n`);
+        },
+        info(text) {
+            writeLine(streams.stderr, text);
+        },
+        detail(text) {
+            writeLine(streams.stderr, `  ${text}`);
+        },
+        warn(text) {
+            writeLine(streams.stderr, `warning: ${text}`);
+        },
+        error(text) {
+            writeLine(streams.stderr, `error: ${text}`);
+        },
+        status(text) {
+            if (!interactive) {
+                const nowMs = now();
+                if (nowMs - lastStatusLogMs < STATUS_LOG_INTERVAL_MS)
+                    return;
+                lastStatusLogMs = nowMs;
+                streams.stderr.write(`${text}\n`);
+                return;
+            }
+            const width = columnsOf(streams.stderr) - 1;
+            const clipped = text.length > width ? `${text.slice(0, width - 1)}~` : text.padEnd(width, " ");
+            streams.stderr.write(`\r${clipped}`);
+            statusActive = true;
+        },
+        endStatus,
+    };
+}

package/dist/paths.js

@@ -0,0 +1,20 @@
+import { posix as posixPath, win32 as winPath } from "node:path";
+export const CONFIG_DIR_ENV = "RUNINFRA_CONFIG_DIR";
+export const CREDENTIALS_FILE_NAME = "credentials.json";
+export function credentialLocation(input) {
+    const override = input.env[CONFIG_DIR_ENV]?.trim();
+    const isWindows = input.platform === "win32";
+    const path = isWindows ? winPath : posixPath;
+    if (override) {
+        return { dir: override, file: path.join(override, CREDENTIALS_FILE_NAME) };
+    }
+    if (isWindows) {
+        const localAppData = input.env.LOCALAPPDATA?.trim() ||
+            winPath.join(input.homeDir, "AppData", "Local");
+        const dir = winPath.join(localAppData, "runinfra");
+        return { dir, file: winPath.join(dir, CREDENTIALS_FILE_NAME) };
+    }
+    const configHome = input.env.XDG_CONFIG_HOME?.trim() || posixPath.join(input.homeDir, ".config");
+    const dir = posixPath.join(configHome, "runinfra");
+    return { dir, file: posixPath.join(dir, CREDENTIALS_FILE_NAME) };
+}

package/dist/pkce.js

@@ -0,0 +1,24 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export function createPkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: deriveChallenge(verifier) };
+}
+export function deriveChallenge(verifier) {
+    return createHash("sha256").update(verifier, "utf8").digest("base64url");
+}
+export function createState() {
+    return randomBytes(32).toString("base64url");
+}
+export function statesMatch(expected, received) {
+    const left = Buffer.from(expected, "utf8");
+    const right = Buffer.from(received, "utf8");
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+export function isWellFormedCodeVerifier(verifier) {
+    return /^[A-Za-z0-9._~-]{43,128}$/u.test(verifier);
+}
+export function isWellFormedAuthorizationCode(code) {
+    return /^[A-Za-z0-9_-]{43}$/u.test(code);
+}