@saeris/hanko 0.0.0 → 0.2.1

package/dist/client/index.mjs

@@ -0,0 +1,215 @@
+import { d as isPollSettled, f as pollContextTransition, p as pollTransition, s as eventForTokenError } from "../machine-D_5DAFxi.mjs";
+import { t as DEVICE_CODE_GRANT_TYPE } from "../types-BvBIFPH6.mjs";
+//#region src/client/index.ts
+/**
+* Device-side polling loop (RFC 8628).
+*
+* Runs on the constrained device (TV, kiosk, Pi). Deliberately dependency-free
+* and DOM-free so it works in a Fire OS WebView, a browser, or Node.
+*
+* Transport is polling only, per the spec. No SSE, no WebSocket: this screen
+* may stay powered on for days, and a persistent connection is one more thing
+* to leak, reconnect, and debug on hardware we cannot attach a profiler to.
+*
+* The loop is a state machine (`machine.ts`) wrapped in a class that owns the
+* state and the in-flight `device_code`. Hooks let a UI render every transition
+* without reaching into that state.
+*/
+/**
+* Cancellable delay. Exported so callers (and tests) reuse the same abort-aware
+* behavior the loop relies on rather than reimplementing it.
+*/
+const sleep = async (ms, signal) => {
+	if (signal?.aborted) return;
+	await new Promise((resolve) => {
+		const finish = () => {
+			clearTimeout(timer);
+			signal?.removeEventListener(`abort`, finish);
+			resolve();
+		};
+		const timer = setTimeout(finish, ms);
+		signal?.addEventListener(`abort`, finish, { once: true });
+	});
+};
+var DeviceAuthClient = class {
+	#tokenUrl;
+	#deviceCode;
+	#clientId;
+	#hooks;
+	#fetch;
+	#now;
+	#sleep;
+	#state = `idle`;
+	#context;
+	#tokens;
+	constructor({ tokenUrl, deviceCode, interval, expiresIn, clientId, hooks = {}, fetchImpl = fetch, now = () => Date.now(), sleepImpl = sleep }) {
+		this.#tokenUrl = tokenUrl;
+		this.#deviceCode = deviceCode;
+		this.#clientId = clientId;
+		this.#hooks = hooks;
+		this.#fetch = fetchImpl;
+		this.#now = now;
+		this.#sleep = sleepImpl;
+		this.#context = {
+			intervalSeconds: interval,
+			deadline: now() + expiresIn * 1e3,
+			attempts: 0
+		};
+	}
+	get state() {
+		return this.#state;
+	}
+	/** Snapshot of the extended state — interval, deadline, attempts. */
+	get context() {
+		return { ...this.#context };
+	}
+	get settled() {
+		return isPollSettled(this.#state);
+	}
+	/** Apply an event to both reducers, then fire hooks. */
+	#send(event) {
+		const from = this.#state;
+		const to = pollTransition(from, event);
+		this.#context = pollContextTransition(this.#context, event);
+		if (to === from) return;
+		this.#state = to;
+		this.#hooks.onTransition?.(from, to, this.context);
+	}
+	/**
+	* Run until the flow resolves.
+	*
+	* Resolves rather than throws on every RFC-defined terminal state — denial
+	* and expiry are normal outcomes the UI must render, not exceptions.
+	*/
+	async run(signal) {
+		this.#send({ type: `START` });
+		while (!this.settled) {
+			if (signal?.aborted) {
+				this.#send({ type: `ABORT` });
+				break;
+			}
+			if (this.#now() >= this.#context.deadline) {
+				this.#send({ type: `DEADLINE` });
+				break;
+			}
+			await this.#sleep(this.#context.intervalSeconds * 1e3, signal);
+			if (signal?.aborted) {
+				this.#send({ type: `ABORT` });
+				break;
+			}
+			this.#send({ type: `TICK` });
+			await this.#poll(signal);
+		}
+		return this.#outcome();
+	}
+	/** One request, mapped to an event. */
+	async #poll(signal) {
+		let body;
+		try {
+			body = await (await this.#fetch(this.#tokenUrl, {
+				method: `POST`,
+				headers: { "content-type": `application/x-www-form-urlencoded` },
+				body: new URLSearchParams({
+					grant_type: DEVICE_CODE_GRANT_TYPE,
+					device_code: this.#deviceCode,
+					...this.#clientId === void 0 ? {} : { client_id: this.#clientId }
+				}),
+				signal
+			})).json();
+		} catch (error) {
+			if (signal?.aborted) {
+				this.#send({ type: `ABORT` });
+				return;
+			}
+			this.#send({ type: `NETWORK_ERROR` });
+			this.#hooks.onNetworkError?.(error, this.context);
+			return;
+		}
+		if (typeof body !== `object` || body === null) {
+			this.#send({ type: `AUTHORIZATION_PENDING` });
+			this.#hooks.onPending?.(this.context);
+			return;
+		}
+		const response = { ...body };
+		const event = eventForTokenError(errorCode(body));
+		if (event.type === `SUCCESS`) this.#tokens = response;
+		this.#send(event);
+		if (event.type === `AUTHORIZATION_PENDING`) this.#hooks.onPending?.(this.context);
+		else if (event.type === `SLOW_DOWN`) this.#hooks.onSlowDown?.(this.#context.intervalSeconds, this.context);
+	}
+	#outcome() {
+		switch (this.#state) {
+			case `authorized`: return {
+				status: `authorized`,
+				tokens: this.#tokens ?? {}
+			};
+			case `denied`: return { status: `denied` };
+			case `expired`: return { status: `expired` };
+			case `aborted`: return { status: `aborted` };
+			case `idle`:
+			case `waiting`:
+			case `polling`: return { status: `aborted` };
+		}
+	}
+};
+/**
+* Poll until the flow resolves.
+*
+* Function form of {@link DeviceAuthClient} for callers who do not need to
+* observe state — the common case on a TV screen that only cares about the
+* final outcome.
+*/
+const pollUntilAuthorized = async ({ signal, onPending, onSlowDown, ...options }) => new DeviceAuthClient({
+	...options,
+	hooks: {
+		...options.hooks,
+		onPending: (context) => {
+			onPending?.();
+			options.hooks?.onPending?.(context);
+		},
+		onSlowDown: (interval, context) => {
+			onSlowDown?.(interval);
+			options.hooks?.onSlowDown?.(interval, context);
+		}
+	}
+}).run(signal);
+/**
+* Read the `error` field of a token response.
+*
+* Returns `undefined` only when the field is genuinely absent — that is the
+* success signal. A present-but-non-string value is reported as a placeholder
+* so it maps to the unknown-code branch and keeps polling, rather than being
+* mistaken for success.
+*/
+const errorCode = (body) => {
+	if (!(`error` in body)) return void 0;
+	return typeof body.error === `string` ? body.error : `malformed_error`;
+};
+/**
+* Narrow an arbitrary JSON body to a device-authorization response.
+*
+* A predicate rather than a cast: the two fields the device screen cannot
+* render without are actually checked, so the narrowing is proven rather than
+* asserted. The optional fields are left unverified — a missing `interval` has
+* a spec default, and a missing `verification_uri_complete` only costs the QR.
+*/
+const isDeviceAuthorizationResponse = (body) => typeof body === `object` && body !== null && `device_code` in body && typeof body.device_code === `string` && `user_code` in body && typeof body.user_code === `string`;
+/** Convenience: start a flow against the host's device-authorization endpoint. */
+const requestDeviceAuthorization = async ({ authorizationUrl, clientId, scope, fetchImpl = fetch }) => {
+	const res = await fetchImpl(authorizationUrl, {
+		method: `POST`,
+		headers: { "content-type": `application/x-www-form-urlencoded` },
+		body: new URLSearchParams({
+			...clientId === void 0 ? {} : { client_id: clientId },
+			...scope === void 0 ? {} : { scope }
+		})
+	});
+	if (!res.ok) throw new Error(`device authorization failed: ${res.status}`);
+	const body = await res.json();
+	if (!isDeviceAuthorizationResponse(body)) throw new Error(`device authorization returned an unexpected body`);
+	return body;
+};
+//#endregion
+export { DeviceAuthClient, pollUntilAuthorized, requestDeviceAuthorization, sleep };
+
+//# sourceMappingURL=index.mjs.map

package/dist/client/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["#tokenUrl","#deviceCode","#clientId","#hooks","#fetch","#now","#sleep","#context","#state","#send","#poll","#outcome","#tokens"],"sources":["../../src/client/index.ts"],"sourcesContent":["/**\n * Device-side polling loop (RFC 8628).\n *\n * Runs on the constrained device (TV, kiosk, Pi). Deliberately dependency-free\n * and DOM-free so it works in a Fire OS WebView, a browser, or Node.\n *\n * Transport is polling only, per the spec. No SSE, no WebSocket: this screen\n * may stay powered on for days, and a persistent connection is one more thing\n * to leak, reconnect, and debug on hardware we cannot attach a profiler to.\n *\n * The loop is a state machine (`machine.ts`) wrapped in a class that owns the\n * state and the in-flight `device_code`. Hooks let a UI render every transition\n * without reaching into that state.\n */\n\nimport {\n  eventForTokenError,\n  isPollSettled,\n  pollContextTransition,\n  pollTransition,\n  type PollContext,\n  type PollEvent,\n  type PollState\n} from \"../machine.js\";\nimport { DEVICE_CODE_GRANT_TYPE } from \"../types.js\";\nimport type {\n  DeviceAuthorizationError,\n  DeviceAuthorizationResponse\n} from \"../types.js\";\n\n/** What the host's token endpoint returns. Mirrors RFC 8628 §3.5. */\nexport interface TokenEndpointResponse {\n  error?: DeviceAuthorizationError;\n  [key: string]: unknown;\n}\n\n/** Observers of the poll loop. All optional, all fire after the move. */\nexport interface PollHooks {\n  /** Any successful transition, with the context that produced it. */\n  onTransition?: (from: PollState, to: PollState, context: PollContext) => void;\n  /** A poll returned `authorization_pending`. Good place for a \"still waiting\" cue. */\n  onPending?: (context: PollContext) => void;\n  /**\n   * The server asked us to slow down. Receives the NEW interval, so a UI can\n   * show the changed cadence rather than a stale one.\n   */\n  onSlowDown?: (intervalSeconds: number, context: PollContext) => void;\n  /** A request failed at the network level. The flow continues. */\n  onNetworkError?: (error: unknown, context: PollContext) => void;\n}\n\n/**\n * Cancellable delay. Exported so callers (and tests) reuse the same abort-aware\n * behavior the loop relies on rather than reimplementing it.\n */\nexport const sleep = async (\n  ms: number,\n  signal?: AbortSignal\n): Promise<void> => {\n  if (signal?.aborted) return;\n  // The timer and the abort listener race. Whichever fires first cancels the\n  // other. Without the abort path the loop finishes a full interval before\n  // noticing it was cancelled — a visibly stuck UI on a long cadence.\n  await new Promise<void>((resolve) => {\n    const finish = (): void => {\n      clearTimeout(timer);\n      signal?.removeEventListener(`abort`, finish);\n      // oxlint-disable-next-line promise/no-multiple-resolved\n      resolve();\n    };\n    const timer = setTimeout(finish, ms);\n    signal?.addEventListener(`abort`, finish, { once: true });\n  });\n};\n\nexport interface DeviceAuthClientOptions {\n  /** Token endpoint URL. */\n  tokenUrl: string;\n  /** From the authorization response. */\n  deviceCode: string;\n  /** Seconds between polls, from the authorization response. */\n  interval: number;\n  /** Seconds until both codes die, from the authorization response. */\n  expiresIn: number;\n  /** Sent as `client_id` when the host app tracks clients. */\n  clientId?: string;\n  /** Lifecycle observers. */\n  hooks?: PollHooks;\n  /** Injectable for tests. */\n  fetchImpl?: typeof fetch;\n  /** Injectable clock, for tests. */\n  now?: () => number;\n  /**\n   * Injectable delay, for tests.\n   *\n   * Exposed so the growing intervals (`slow_down`, network backoff) can be\n   * asserted without a suite that actually waits minutes for them.\n   */\n  sleepImpl?: (ms: number, signal?: AbortSignal) => Promise<void>;\n}\n\n/** Terminal outcomes of the loop. */\nexport type AuthorizationOutcome =\n  | { status: `authorized`; tokens: TokenEndpointResponse }\n  | { status: `denied` }\n  | { status: `expired` }\n  | { status: `aborted` };\n\nexport class DeviceAuthClient {\n  readonly #tokenUrl: string;\n  readonly #deviceCode: string;\n  readonly #clientId: string | undefined;\n  readonly #hooks: PollHooks;\n  readonly #fetch: typeof fetch;\n  readonly #now: () => number;\n  readonly #sleep: (ms: number, signal?: AbortSignal) => Promise<void>;\n\n  #state: PollState = `idle`;\n  #context: PollContext;\n  #tokens: TokenEndpointResponse | undefined;\n\n  constructor({\n    tokenUrl,\n    deviceCode,\n    interval,\n    expiresIn,\n    clientId,\n    hooks = {},\n    fetchImpl = fetch,\n    now = (): number => Date.now(),\n    sleepImpl = sleep\n  }: DeviceAuthClientOptions) {\n    this.#tokenUrl = tokenUrl;\n    this.#deviceCode = deviceCode;\n    this.#clientId = clientId;\n    this.#hooks = hooks;\n    this.#fetch = fetchImpl;\n    this.#now = now;\n    this.#sleep = sleepImpl;\n    this.#context = {\n      intervalSeconds: interval,\n      deadline: now() + expiresIn * 1000,\n      attempts: 0\n    };\n  }\n\n  get state(): PollState {\n    return this.#state;\n  }\n\n  /** Snapshot of the extended state — interval, deadline, attempts. */\n  get context(): Readonly<PollContext> {\n    return { ...this.#context };\n  }\n\n  get settled(): boolean {\n    return isPollSettled(this.#state);\n  }\n\n  /** Apply an event to both reducers, then fire hooks. */\n  #send(event: PollEvent): void {\n    const from = this.#state;\n    const to = pollTransition(from, event);\n    this.#context = pollContextTransition(this.#context, event);\n\n    if (to === from) return;\n    this.#state = to;\n    this.#hooks.onTransition?.(from, to, this.context);\n  }\n\n  /**\n   * Run until the flow resolves.\n   *\n   * Resolves rather than throws on every RFC-defined terminal state — denial\n   * and expiry are normal outcomes the UI must render, not exceptions.\n   */\n  async run(signal?: AbortSignal): Promise<AuthorizationOutcome> {\n    this.#send({ type: `START` });\n\n    while (!this.settled) {\n      if (signal?.aborted) {\n        this.#send({ type: `ABORT` });\n        break;\n      }\n\n      // Stop on our own deadline even if the server never says `expired_token`\n      // — a device that polls a dead code forever is a support call.\n      if (this.#now() >= this.#context.deadline) {\n        this.#send({ type: `DEADLINE` });\n        break;\n      }\n\n      await this.#sleep(this.#context.intervalSeconds * 1000, signal);\n      if (signal?.aborted) {\n        this.#send({ type: `ABORT` });\n        break;\n      }\n\n      this.#send({ type: `TICK` });\n      await this.#poll(signal);\n    }\n\n    return this.#outcome();\n  }\n\n  /** One request, mapped to an event. */\n  async #poll(signal?: AbortSignal): Promise<void> {\n    let body: unknown;\n    try {\n      const res = await this.#fetch(this.#tokenUrl, {\n        method: `POST`,\n        headers: { \"content-type\": `application/x-www-form-urlencoded` },\n        body: new URLSearchParams({\n          grant_type: DEVICE_CODE_GRANT_TYPE,\n          device_code: this.#deviceCode,\n          ...(this.#clientId === undefined ? {} : { client_id: this.#clientId })\n        }),\n        signal\n      });\n      body = await res.json();\n    } catch (error) {\n      if (signal?.aborted) {\n        this.#send({ type: `ABORT` });\n        return;\n      }\n      // Venue wifi drops. A blip must not look like denial — the user has done\n      // nothing wrong and the code is still valid. The context reducer applies\n      // exponential backoff here, unlike `slow_down`'s fixed +5s.\n      this.#send({ type: `NETWORK_ERROR` });\n      this.#hooks.onNetworkError?.(error, this.context);\n      return;\n    }\n\n    // A non-object body cannot be a token response. Retrying is the safe\n    // reading: treating it as success would sign the device in on garbage, and\n    // treating it as denial would blame the user for a broken endpoint.\n    if (typeof body !== `object` || body === null) {\n      this.#send({ type: `AUTHORIZATION_PENDING` });\n      this.#hooks.onPending?.(this.context);\n      return;\n    }\n\n    const response: TokenEndpointResponse = { ...body };\n    // Only `error` is interpreted, and `errorCode` distinguishes \"absent\"\n    // (success) from \"present but not a string\" (malformed). Collapsing the\n    // second into the first would read a broken response as success and sign\n    // the device in on garbage.\n    const event = eventForTokenError(errorCode(body));\n\n    // Captured before the transition so the terminal outcome can return it;\n    // the body is the host app's credential payload, passed through\n    // uninterpreted.\n    if (event.type === `SUCCESS`) this.#tokens = response;\n\n    this.#send(event);\n\n    if (event.type === `AUTHORIZATION_PENDING`) {\n      this.#hooks.onPending?.(this.context);\n    } else if (event.type === `SLOW_DOWN`) {\n      this.#hooks.onSlowDown?.(this.#context.intervalSeconds, this.context);\n    }\n  }\n\n  #outcome(): AuthorizationOutcome {\n    switch (this.#state) {\n      case `authorized`:\n        return { status: `authorized`, tokens: this.#tokens ?? {} };\n      case `denied`:\n        return { status: `denied` };\n      case `expired`:\n        return { status: `expired` };\n      case `aborted`:\n        return { status: `aborted` };\n      // `run` only calls this once the machine has settled, so the live states\n      // are unreachable. Reported as aborted rather than thrown: a UI showing\n      // \"cancelled\" is a better failure than a crashed sign-in screen.\n      case `idle`:\n      case `waiting`:\n      case `polling`:\n        return { status: `aborted` };\n    }\n  }\n}\n\n/**\n * Poll until the flow resolves.\n *\n * Function form of {@link DeviceAuthClient} for callers who do not need to\n * observe state — the common case on a TV screen that only cares about the\n * final outcome.\n */\nexport const pollUntilAuthorized = async ({\n  signal,\n  onPending,\n  onSlowDown,\n  ...options\n}: DeviceAuthClientOptions & {\n  signal?: AbortSignal;\n  /** Convenience passthroughs, so existing callers keep working. */\n  onPending?: () => void;\n  onSlowDown?: (nextIntervalSeconds: number) => void;\n}): Promise<AuthorizationOutcome> =>\n  new DeviceAuthClient({\n    ...options,\n    hooks: {\n      ...options.hooks,\n      onPending: (context) => {\n        onPending?.();\n        options.hooks?.onPending?.(context);\n      },\n      onSlowDown: (interval, context) => {\n        onSlowDown?.(interval);\n        options.hooks?.onSlowDown?.(interval, context);\n      }\n    }\n  }).run(signal);\n\n/**\n * Read the `error` field of a token response.\n *\n * Returns `undefined` only when the field is genuinely absent — that is the\n * success signal. A present-but-non-string value is reported as a placeholder\n * so it maps to the unknown-code branch and keeps polling, rather than being\n * mistaken for success.\n */\nconst errorCode = (body: object): string | undefined => {\n  if (!(`error` in body)) return undefined;\n  return typeof body.error === `string` ? body.error : `malformed_error`;\n};\n\n/**\n * Narrow an arbitrary JSON body to a device-authorization response.\n *\n * A predicate rather than a cast: the two fields the device screen cannot\n * render without are actually checked, so the narrowing is proven rather than\n * asserted. The optional fields are left unverified — a missing `interval` has\n * a spec default, and a missing `verification_uri_complete` only costs the QR.\n */\nconst isDeviceAuthorizationResponse = (\n  body: unknown\n): body is DeviceAuthorizationResponse =>\n  typeof body === `object` &&\n  body !== null &&\n  `device_code` in body &&\n  typeof body.device_code === `string` &&\n  `user_code` in body &&\n  typeof body.user_code === `string`;\n\n/** Convenience: start a flow against the host's device-authorization endpoint. */\nexport const requestDeviceAuthorization = async ({\n  authorizationUrl,\n  clientId,\n  scope,\n  fetchImpl = fetch\n}: {\n  authorizationUrl: string;\n  clientId?: string;\n  scope?: string;\n  fetchImpl?: typeof fetch;\n}): Promise<DeviceAuthorizationResponse> => {\n  const res = await fetchImpl(authorizationUrl, {\n    method: `POST`,\n    headers: { \"content-type\": `application/x-www-form-urlencoded` },\n    body: new URLSearchParams({\n      ...(clientId === undefined ? {} : { client_id: clientId }),\n      ...(scope === undefined ? {} : { scope })\n    })\n  });\n  if (!res.ok) throw new Error(`device authorization failed: ${res.status}`);\n\n  const body: unknown = await res.json();\n  // Fail loud at the boundary (CLAUDE.md Rule 11). Without the required fields\n  // the device screen would render a blank code and an unscannable QR, with no\n  // hint as to why — far worse than an error naming the bad response.\n  if (!isDeviceAuthorizationResponse(body)) {\n    throw new Error(`device authorization returned an unexpected body`);\n  }\n  return body;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuDA,MAAa,QAAQ,OACnB,IACA,WACkB;CAClB,IAAI,QAAQ,SAAS;CAIrB,MAAM,IAAI,SAAe,YAAY;EACnC,MAAM,eAAqB;GACzB,aAAa,KAAK;GAClB,QAAQ,oBAAoB,SAAS,MAAM;GAE3C,QAAQ;EACV;EACA,MAAM,QAAQ,WAAW,QAAQ,EAAE;EACnC,QAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;CAC1D,CAAC;AACH;AAmCA,IAAa,mBAAb,MAA8B;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,SAAoB;CACpB;CACA;CAEA,YAAY,EACV,UACA,YACA,UACA,WACA,UACA,QAAQ,CAAC,GACT,YAAY,OACZ,YAAoB,KAAK,IAAI,GAC7B,YAAY,SACc;EAC1B,KAAKA,YAAY;EACjB,KAAKC,cAAc;EACnB,KAAKC,YAAY;EACjB,KAAKC,SAAS;EACd,KAAKC,SAAS;EACd,KAAKC,OAAO;EACZ,KAAKC,SAAS;EACd,KAAKC,WAAW;GACd,iBAAiB;GACjB,UAAU,IAAI,IAAI,YAAY;GAC9B,UAAU;EACZ;CACF;CAEA,IAAI,QAAmB;EACrB,OAAO,KAAKC;CACd;;CAGA,IAAI,UAAiC;EACnC,OAAO,EAAE,GAAG,KAAKD,SAAS;CAC5B;CAEA,IAAI,UAAmB;EACrB,OAAO,cAAc,KAAKC,MAAM;CAClC;;CAGA,MAAM,OAAwB;EAC5B,MAAM,OAAO,KAAKA;EAClB,MAAM,KAAK,eAAe,MAAM,KAAK;EACrC,KAAKD,WAAW,sBAAsB,KAAKA,UAAU,KAAK;EAE1D,IAAI,OAAO,MAAM;EACjB,KAAKC,SAAS;EACd,KAAKL,OAAO,eAAe,MAAM,IAAI,KAAK,OAAO;CACnD;;;;;;;CAQA,MAAM,IAAI,QAAqD;EAC7D,KAAKM,MAAM,EAAE,MAAM,QAAQ,CAAC;EAE5B,OAAO,CAAC,KAAK,SAAS;GACpB,IAAI,QAAQ,SAAS;IACnB,KAAKA,MAAM,EAAE,MAAM,QAAQ,CAAC;IAC5B;GACF;GAIA,IAAI,KAAKJ,KAAK,KAAK,KAAKE,SAAS,UAAU;IACzC,KAAKE,MAAM,EAAE,MAAM,WAAW,CAAC;IAC/B;GACF;GAEA,MAAM,KAAKH,OAAO,KAAKC,SAAS,kBAAkB,KAAM,MAAM;GAC9D,IAAI,QAAQ,SAAS;IACnB,KAAKE,MAAM,EAAE,MAAM,QAAQ,CAAC;IAC5B;GACF;GAEA,KAAKA,MAAM,EAAE,MAAM,OAAO,CAAC;GAC3B,MAAM,KAAKC,MAAM,MAAM;EACzB;EAEA,OAAO,KAAKC,SAAS;CACvB;;CAGA,MAAMD,MAAM,QAAqC;EAC/C,IAAI;EACJ,IAAI;GAWF,OAAO,OAAM,MAVK,KAAKN,OAAO,KAAKJ,WAAW;IAC5C,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB,YAAY;KACZ,aAAa,KAAKC;KAClB,GAAI,KAAKC,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,KAAKA,UAAU;IACtE,CAAC;IACD;GACF,CAAC,EAAA,CACgB,KAAK;EACxB,SAAS,OAAO;GACd,IAAI,QAAQ,SAAS;IACnB,KAAKO,MAAM,EAAE,MAAM,QAAQ,CAAC;IAC5B;GACF;GAIA,KAAKA,MAAM,EAAE,MAAM,gBAAgB,CAAC;GACpC,KAAKN,OAAO,iBAAiB,OAAO,KAAK,OAAO;GAChD;EACF;EAKA,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;GAC7C,KAAKM,MAAM,EAAE,MAAM,wBAAwB,CAAC;GAC5C,KAAKN,OAAO,YAAY,KAAK,OAAO;GACpC;EACF;EAEA,MAAM,WAAkC,EAAE,GAAG,KAAK;EAKlD,MAAM,QAAQ,mBAAmB,UAAU,IAAI,CAAC;EAKhD,IAAI,MAAM,SAAS,WAAW,KAAKS,UAAU;EAE7C,KAAKH,MAAM,KAAK;EAEhB,IAAI,MAAM,SAAS,yBACjB,KAAKN,OAAO,YAAY,KAAK,OAAO;OAC/B,IAAI,MAAM,SAAS,aACxB,KAAKA,OAAO,aAAa,KAAKI,SAAS,iBAAiB,KAAK,OAAO;CAExE;CAEA,WAAiC;EAC/B,QAAQ,KAAKC,QAAb;GACE,KAAK,cACH,OAAO;IAAE,QAAQ;IAAc,QAAQ,KAAKI,WAAW,CAAC;GAAE;GAC5D,KAAK,UACH,OAAO,EAAE,QAAQ,SAAS;GAC5B,KAAK,WACH,OAAO,EAAE,QAAQ,UAAU;GAC7B,KAAK,WACH,OAAO,EAAE,QAAQ,UAAU;GAI7B,KAAK;GACL,KAAK;GACL,KAAK,WACH,OAAO,EAAE,QAAQ,UAAU;EAC/B;CACF;AACF;;;;;;;;AASA,MAAa,sBAAsB,OAAO,EACxC,QACA,WACA,YACA,GAAG,cAOH,IAAI,iBAAiB;CACnB,GAAG;CACH,OAAO;EACL,GAAG,QAAQ;EACX,YAAY,YAAY;GACtB,YAAY;GACZ,QAAQ,OAAO,YAAY,OAAO;EACpC;EACA,aAAa,UAAU,YAAY;GACjC,aAAa,QAAQ;GACrB,QAAQ,OAAO,aAAa,UAAU,OAAO;EAC/C;CACF;AACF,CAAC,CAAC,CAAC,IAAI,MAAM;;;;;;;;;AAUf,MAAM,aAAa,SAAqC;CACtD,IAAI,EAAE,WAAW,OAAO,OAAO,KAAA;CAC/B,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AACvD;;;;;;;;;AAUA,MAAM,iCACJ,SAEA,OAAO,SAAS,YAChB,SAAS,QACT,iBAAiB,QACjB,OAAO,KAAK,gBAAgB,YAC5B,eAAe,QACf,OAAO,KAAK,cAAc;;AAG5B,MAAa,6BAA6B,OAAO,EAC/C,kBACA,UACA,OACA,YAAY,YAM8B;CAC1C,MAAM,MAAM,MAAM,UAAU,kBAAkB;EAC5C,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GACxB,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,SAAS;GACxD,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EACzC,CAAC;CACH,CAAC;CACD,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,MAAM,gCAAgC,IAAI,QAAQ;CAEzE,MAAM,OAAgB,MAAM,IAAI,KAAK;CAIrC,IAAI,CAAC,8BAA8B,IAAI,GACrC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT"}

package/dist/codes-Ba_qYH6u.mjs

@@ -0,0 +1,93 @@
+//#region src/codes.ts
+/**
+* Code generation.
+*
+* Two codes with opposite constraints:
+*
+* - `user_code` is read off a TV across a room and typed on a phone, so it must
+*   be SHORT. That caps its entropy, which is why RFC 8628 §5.1 requires the
+*   server to rate-limit attempts — the code alone is not brute-force safe.
+* - `device_code` is never displayed, so it has no usability ceiling. The spec
+*   says "a very high entropy code SHOULD be used".
+*
+* @see https://datatracker.ietf.org/doc/html/rfc8628#section-5.1
+*/
+/**
+* RFC 8628 §6.1's recommended base-20 alphabet: consonants only.
+*
+* No vowels, so generated codes cannot accidentally spell words. No digits, so
+* there is no 0/O or 1/l/I confusion. 20^8 ≈ 34.5 bits at 8 characters, which
+* the spec pairs with a 5-attempt rate limit.
+*/
+const BASE20_ALPHABET = `BCDFGHJKLMNPQRSTVWXZ`;
+/**
+* Digits only — better for non-Latin locales and numeric TV remotes, which is
+* why Plex-style flows often use them. Lower entropy per character than base-20
+* (10 vs 20), so prefer a longer code when using this.
+*/
+const NUMERIC_ALPHABET = `0123456789`;
+/** Bytes of entropy for `device_code`. 32 bytes = 256 bits. */
+const DEVICE_CODE_BYTES = 32;
+/**
+* Rejection-sampled index into `alphabet`.
+*
+* A naive `byte % alphabet.length` is biased whenever 256 is not a multiple of
+* the alphabet size (it is not, for 20): low indices would come up more often.
+* We discard bytes above the largest clean multiple instead. This matters — a
+* skewed distribution shrinks the effective keyspace an attacker must search.
+*/
+const unbiasedIndex = (alphabet) => {
+	const limit = Math.floor(256 / alphabet.length) * alphabet.length;
+	const buf = /* @__PURE__ */ new Uint8Array(1);
+	let byte;
+	do {
+		crypto.getRandomValues(buf);
+		byte = buf[0];
+	} while (byte >= limit);
+	return byte % alphabet.length;
+};
+/**
+* Generate a user-facing code, formatted for display.
+*
+* Defaults follow the spec's worked example: 8 base-20 characters shown as
+* `WDJB-MJHT`.
+*/
+const generateUserCode = ({ length = 8, alphabet = BASE20_ALPHABET, separator = `-`, groupSize = 4 } = {}) => {
+	if (length < 1) throw new RangeError(`user code length must be >= 1`);
+	if (alphabet.length < 2) throw new RangeError(`alphabet needs >= 2 characters`);
+	let code = ``;
+	for (let i = 0; i < length; i++) code += alphabet[unbiasedIndex(alphabet)];
+	if (!separator || groupSize < 1) return code;
+	const groups = [];
+	for (let i = 0; i < code.length; i += groupSize) groups.push(code.slice(i, i + groupSize));
+	return groups.join(separator);
+};
+/**
+* Canonicalize user input before comparison.
+*
+* RFC 8628 §6.1: the server strips punctuation it added for readability, and
+* uppercases A-Z codes. Without this, a user typing `wdjb mjht` — which is what
+* a phone keyboard will autocorrect toward — fails against `WDJB-MJHT` for no
+* reason the user can see.
+*
+* Strips ALL non-alphanumerics, so it is agnostic to whichever separator the
+* display format used.
+*/
+const normalizeUserCode = (input) => input.replace(/[^a-zA-Z0-9]/gu, ``).toUpperCase();
+/**
+* Generate a `device_code`: 256 bits, base64url, no padding.
+*
+* base64url (not base64) because this value travels in URLs and form bodies,
+* where `+` and `/` would need escaping.
+*/
+const generateDeviceCode = () => {
+	const bytes = new Uint8Array(DEVICE_CODE_BYTES);
+	crypto.getRandomValues(bytes);
+	let binary = ``;
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/gu, `-`).replace(/\//gu, `_`).replace(/=+$/u, ``);
+};
+//#endregion
+export { normalizeUserCode as a, generateUserCode as i, NUMERIC_ALPHABET as n, generateDeviceCode as r, BASE20_ALPHABET as t };
+
+//# sourceMappingURL=codes-Ba_qYH6u.mjs.map

package/dist/codes-Ba_qYH6u.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes-Ba_qYH6u.mjs","names":[],"sources":["../src/codes.ts"],"sourcesContent":["/**\n * Code generation.\n *\n * Two codes with opposite constraints:\n *\n * - `user_code` is read off a TV across a room and typed on a phone, so it must\n *   be SHORT. That caps its entropy, which is why RFC 8628 §5.1 requires the\n *   server to rate-limit attempts — the code alone is not brute-force safe.\n * - `device_code` is never displayed, so it has no usability ceiling. The spec\n *   says \"a very high entropy code SHOULD be used\".\n *\n * @see https://datatracker.ietf.org/doc/html/rfc8628#section-5.1\n */\n\n/**\n * RFC 8628 §6.1's recommended base-20 alphabet: consonants only.\n *\n * No vowels, so generated codes cannot accidentally spell words. No digits, so\n * there is no 0/O or 1/l/I confusion. 20^8 ≈ 34.5 bits at 8 characters, which\n * the spec pairs with a 5-attempt rate limit.\n */\nexport const BASE20_ALPHABET = `BCDFGHJKLMNPQRSTVWXZ`;\n\n/**\n * Digits only — better for non-Latin locales and numeric TV remotes, which is\n * why Plex-style flows often use them. Lower entropy per character than base-20\n * (10 vs 20), so prefer a longer code when using this.\n */\nexport const NUMERIC_ALPHABET = `0123456789`;\n\n/** Bytes of entropy for `device_code`. 32 bytes = 256 bits. */\nconst DEVICE_CODE_BYTES = 32;\n\n/**\n * Rejection-sampled index into `alphabet`.\n *\n * A naive `byte % alphabet.length` is biased whenever 256 is not a multiple of\n * the alphabet size (it is not, for 20): low indices would come up more often.\n * We discard bytes above the largest clean multiple instead. This matters — a\n * skewed distribution shrinks the effective keyspace an attacker must search.\n */\nconst unbiasedIndex = (alphabet: string): number => {\n  const limit = Math.floor(256 / alphabet.length) * alphabet.length;\n  const buf = new Uint8Array(1);\n  let byte: number;\n  do {\n    crypto.getRandomValues(buf);\n    byte = buf[0]!;\n  } while (byte >= limit);\n  return byte % alphabet.length;\n};\n\nexport interface UserCodeOptions {\n  /** Significant characters, excluding any separator. Spec example uses 8. */\n  length?: number;\n  /** Character set to draw from. Defaults to {@link BASE20_ALPHABET}. */\n  alphabet?: string;\n  /**\n   * Inserted every `groupSize` characters purely for legibility.\n   * The stored/compared form never contains it — see {@link normalizeUserCode}.\n   */\n  separator?: string;\n  /** Characters per visual group. Ignored when `separator` is empty. */\n  groupSize?: number;\n}\n\n/**\n * Generate a user-facing code, formatted for display.\n *\n * Defaults follow the spec's worked example: 8 base-20 characters shown as\n * `WDJB-MJHT`.\n */\nexport const generateUserCode = ({\n  length = 8,\n  alphabet = BASE20_ALPHABET,\n  separator = `-`,\n  groupSize = 4\n}: UserCodeOptions = {}): string => {\n  if (length < 1) throw new RangeError(`user code length must be >= 1`);\n  if (alphabet.length < 2)\n    throw new RangeError(`alphabet needs >= 2 characters`);\n\n  let code = ``;\n  for (let i = 0; i < length; i++) code += alphabet[unbiasedIndex(alphabet)];\n\n  if (!separator || groupSize < 1) return code;\n\n  const groups: string[] = [];\n  for (let i = 0; i < code.length; i += groupSize) {\n    groups.push(code.slice(i, i + groupSize));\n  }\n  return groups.join(separator);\n};\n\n/**\n * Canonicalize user input before comparison.\n *\n * RFC 8628 §6.1: the server strips punctuation it added for readability, and\n * uppercases A-Z codes. Without this, a user typing `wdjb mjht` — which is what\n * a phone keyboard will autocorrect toward — fails against `WDJB-MJHT` for no\n * reason the user can see.\n *\n * Strips ALL non-alphanumerics, so it is agnostic to whichever separator the\n * display format used.\n */\nexport const normalizeUserCode = (input: string): string =>\n  input.replace(/[^a-zA-Z0-9]/gu, ``).toUpperCase();\n\n/**\n * Generate a `device_code`: 256 bits, base64url, no padding.\n *\n * base64url (not base64) because this value travels in URLs and form bodies,\n * where `+` and `/` would need escaping.\n */\nexport const generateDeviceCode = (): string => {\n  const bytes = new Uint8Array(DEVICE_CODE_BYTES);\n  crypto.getRandomValues(bytes);\n  let binary = ``;\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary)\n    .replace(/\\+/gu, `-`)\n    .replace(/\\//gu, `_`)\n    .replace(/=+$/u, ``);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,kBAAkB;;;;;;AAO/B,MAAa,mBAAmB;;AAGhC,MAAM,oBAAoB;;;;;;;;;AAU1B,MAAM,iBAAiB,aAA6B;CAClD,MAAM,QAAQ,KAAK,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;CAC3D,MAAM,sBAAM,IAAI,WAAW,CAAC;CAC5B,IAAI;CACJ,GAAG;EACD,OAAO,gBAAgB,GAAG;EAC1B,OAAO,IAAI;CACb,SAAS,QAAQ;CACjB,OAAO,OAAO,SAAS;AACzB;;;;;;;AAsBA,MAAa,oBAAoB,EAC/B,SAAS,GACT,WAAW,iBACX,YAAY,KACZ,YAAY,MACO,CAAC,MAAc;CAClC,IAAI,SAAS,GAAG,MAAM,IAAI,WAAW,+BAA+B;CACpE,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,WAAW,gCAAgC;CAEvD,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,KAAK,QAAQ,SAAS,cAAc,QAAQ;CAExE,IAAI,CAAC,aAAa,YAAY,GAAG,OAAO;CAExC,MAAM,SAAmB,CAAC;CAC1B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,WACpC,OAAO,KAAK,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC;CAE1C,OAAO,OAAO,KAAK,SAAS;AAC9B;;;;;;;;;;;;AAaA,MAAa,qBAAqB,UAChC,MAAM,QAAQ,kBAAkB,EAAE,CAAC,CAAC,YAAY;;;;;;;AAQlD,MAAa,2BAAmC;CAC9C,MAAM,QAAQ,IAAI,WAAW,iBAAiB;CAC9C,OAAO,gBAAgB,KAAK;CAC5B,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAChB,QAAQ,QAAQ,GAAG,CAAC,CACpB,QAAQ,QAAQ,GAAG,CAAC,CACpB,QAAQ,QAAQ,EAAE;AACvB"}

package/dist/handlers.d.mts

@@ -0,0 +1,113 @@
+import { n as HankoServer } from "./server-BhoYRkCm.mjs";
+//#region src/handlers.d.ts
+/**
+ * Hook for the rate limiting RFC 8628 §5.1 requires.
+ *
+ * hanko deliberately does not implement it: an effective limiter needs the IP,
+ * which lives in a platform-specific header (`CF-Connecting-IP`,
+ * `x-forwarded-for`), and needs storage this library should not assume. What
+ * it can do is make the seam explicit so the requirement is not silently
+ * skipped.
+ *
+ * Return `false` to reject with 429.
+ */
+type RateLimiter = (request: Request, userCode: string) => Promise<boolean> | boolean;
+interface HandlerOptions {
+  server: HankoServer;
+  /**
+   * Identify the approving user from their session.
+   *
+   * The trust boundary of the whole flow: whatever this returns becomes the
+   * `subject` the device is signed in as. Read it from YOUR session — never
+   * from the request body, which the client controls.
+   *
+   * Return `null` when unauthenticated, and the approval endpoint answers 401.
+   */
+  authenticate: (request: Request) => Promise<string | null> | string | null;
+  /**
+   * Guard the approval endpoint. Strongly recommended — see {@link RateLimiter}.
+   */
+  rateLimit?: RateLimiter;
+}
+/**
+ * The device-authorization endpoint. `POST /device/authorize`.
+ *
+ * Unauthenticated: the whole point is that the device has no credentials yet.
+ */
+declare const createAuthorizationHandler: ({ server, verificationPath, trustForwardedHost }: Pick<HandlerOptions, `server`> & {
+  /** Path of the approval page, appended to the detected origin. */
+  verificationPath?: string;
+  /**
+   * Derive the verification URI from the request's forwarded headers.
+   *
+   * On by default because it is what makes one deployment work across a
+   * preview URL, a custom domain, and a tunnel without a redeploy. Set false
+   * to always use the configured `verificationUri` — worth doing if your
+   * platform does not strip client-sent `x-forwarded-*` headers and you would
+   * rather pin the origin than trust them.
+   */
+  trustForwardedHost?: boolean;
+}) => (request: Request) => Promise<Response>;
+/**
+ * The token endpoint. `POST /device/token`.
+ *
+ * Maps poll results onto the status codes RFC 8628 §3.5 specifies: pending and
+ * slow_down are 400s carrying an error code, not 200s, because a compliant
+ * client distinguishes them by body rather than status.
+ */
+declare const createTokenHandler: ({ server, createSession }: Pick<HandlerOptions, `server`> & {
+  /**
+   * Mint whatever credential the device should receive.
+   *
+   * hanko carries the `subject` and stops there — issuing sessions is your
+   * auth system's job, and duplicating it would make this library compete
+   * with Better-Auth instead of composing with it.
+   */
+  createSession: (subject: string) => unknown;
+}) => (request: Request) => Promise<Response>;
+/**
+ * The approval endpoint. `GET` to resolve a code, `POST` to decide.
+ *
+ * Both require an authenticated user: this runs on the phone that is already
+ * signed in, and the identity it resolves is what the device inherits.
+ */
+declare const createApprovalHandler: ({ server, authenticate, rateLimit }: HandlerOptions) => (request: Request) => Promise<Response>;
+/**
+ * All three handlers, plus a router for hosts that prefer one entry point.
+ *
+ * The router is a convenience — a Workers `fetch` can delegate to it wholesale
+ * — but the individual handlers exist so file-based routing (Astro, Next,
+ * SvelteKit) can mount each at its own path.
+ */
+declare const createHandlers: (options: HandlerOptions & {
+  createSession: (subject: string) => unknown;
+}) => {
+  authorize: (request: Request) => Promise<Response>;
+  token: (request: Request) => Promise<Response>;
+  approval: (request: Request) => Promise<Response>;
+  fetch: (request: Request) => Promise<Response>;
+};
+/**
+ * Serve the association files that make universal/app links work.
+ *
+ * Both must be served from the SAME origin as the approval page, over HTTPS,
+ * with no redirects. Apple and Google fetch them directly; a redirect or a
+ * wrong content-type makes the association fail silently, which is the usual
+ * reason "universal links don't work" with nothing in any log to explain it.
+ *
+ * Mount at `/.well-known/*`. Cached rather than `no-store` — unlike the auth
+ * endpoints these are static, and the platforms re-fetch them on their own
+ * schedule anyway.
+ */
+declare const createWellKnownHandler: ({ appleAppIds, androidPackageName, androidFingerprints, paths }: {
+  /** `<TEAM_ID>.<BUNDLE_ID>` for each iOS app that may open these links. */
+  appleAppIds?: string[];
+  androidPackageName?: string;
+  /** SHA-256 of the PLAY-signed certificate, not the local keystore. */
+  androidFingerprints?: string[];
+  /** Paths the apps claim. Defaults to the approval route. */
+  paths?: string[];
+}) => (request: Request) => Response | null;
+//#endregion
+export { HandlerOptions, RateLimiter, createApprovalHandler, createAuthorizationHandler, createHandlers, createTokenHandler, createWellKnownHandler };
+//# sourceMappingURL=handlers.d.mts.map

package/dist/handlers.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.mts","names":[],"sources":["../src/handlers.ts"],"mappings":";;;;;;;;;;;;;KAuEY,eACV,SAAS,SACT,qBACG;UAEY;EACf,QAAQ;;;;;;;;;;EAUR,eAAe,SAAS,YAAY;;;;EAIpC,YAAY;;;;;;;cAsCD,+BACV,QAAA,kBAAA,sBAIE,KAAK;;EAEN;;;;;;;;;;EAUA;OAEK,SAAS,YAAU,QAAQ;;;;;;;;cAwBvB,uBACV,QAAA,iBAGE,KAAK;;;;;;;;EAQN,gBAAgB;OAEX,SAAS,YAAU,QAAQ;;;;;;;cA+BvB,0BACV,QAAA,cAAA,aAAqC,oBAC/B,SAAS,YAAU,QAAQ;;;;;;;;cAwEvB,iBACX,SAAS;EACP,gBAAgB;;EAGlB,YAAY,SAAS,YAAY,QAAQ;EACzC,QAAQ,SAAS,YAAY,QAAQ;EACrC,WAAW,SAAS,YAAY,QAAQ;EACxC,QAAQ,SAAS,YAAY,QAAQ;;;;;;;;;;;;;;cAgC1B,2BAA0B,aAAA,oBAAA,qBAAA;;EAOrC;EACA;;EAEA;;EAEA;OAUQ,SAAS,YAAU"}

package/dist/handlers.mjs

@@ -0,0 +1,194 @@
+import { a as digitalAssetLinks, t as appleAppSiteAssociation } from "./linking-DcQSMgem.mjs";
+//#region src/handlers.ts
+/**
+* Request → Response glue for the three endpoints the flow needs.
+*
+* Built on the WinterTC `Request`/`Response` pair, so the same handlers run on
+* Cloudflare Workers, Vercel Functions, Deno Deploy, Bun, and Node 18+ without
+* a framework adapter. This is the layer hanko ships so a host app writes
+* routing, not protocol.
+*
+* Stateless by construction: nothing is held between invocations. Every
+* request loads its grant from the store, applies one transition, and writes
+* it back — which is what makes this safe on an edge runtime where the next
+* request may land on a different instance, or on an instance that was frozen
+* mid-flow.
+*/
+/** JSON with a status. Kept local so nothing imports a framework helper. */
+const json = (body, status = 200) => new Response(JSON.stringify(body), {
+	status,
+	headers: {
+		"content-type": `application/json`,
+		"cache-control": `no-store`
+	}
+});
+/**
+* Read parameters from a form body or JSON.
+*
+* RFC 8628 specifies form encoding, but hosts routinely post JSON from their
+* own front end, and rejecting that would be pedantry rather than security.
+*/
+const readParams = async (request) => {
+	if ((request.headers.get(`content-type`) ?? ``).includes(`application/json`)) {
+		const body = await request.json();
+		if (typeof body !== `object` || body === null) return {};
+		return Object.fromEntries(Object.entries(body).map(([key, value]) => [key, String(value)]));
+	}
+	const params = {};
+	for (const [key, value] of new URLSearchParams(await request.text())) params[key] = value;
+	return params;
+};
+/**
+* Public origin this request actually arrived on.
+*
+* `request.url` is unreliable behind a proxy: it carries the internal host the
+* proxy forwarded to, not the one the client typed. `x-forwarded-host` and
+* `x-forwarded-proto` carry the real ones, and every common proxy sets them —
+* ngrok, Cloudflare, Vercel, nginx.
+*
+* Returns `null` when nothing usable is present, so the caller falls back to
+* its configured value rather than guessing.
+*
+* These headers are CLIENT-CONTROLLABLE when no proxy strips them, so this is
+* only safe for building a URL the same client will visit. Never use it for an
+* authorization decision.
+*/
+const forwardedOrigin = (request) => {
+	const host = request.headers.get(`x-forwarded-host`);
+	if (host === null || host.length === 0) return null;
+	const [first] = host.split(`,`);
+	const cleaned = first.trim();
+	if (cleaned.length === 0) return null;
+	const proto = request.headers.get(`x-forwarded-proto`)?.split(`,`)[0]?.trim();
+	return `${proto === void 0 || proto.length === 0 ? `https` : proto}://${cleaned}`;
+};
+/**
+* The device-authorization endpoint. `POST /device/authorize`.
+*
+* Unauthenticated: the whole point is that the device has no credentials yet.
+*/
+const createAuthorizationHandler = ({ server, verificationPath = `/link`, trustForwardedHost = true }) => async (request) => {
+	if (request.method !== `POST`) return json({ error: `method_not_allowed` }, 405);
+	const origin = trustForwardedHost ? forwardedOrigin(request) : null;
+	const params = await readParams(request);
+	const grant = await server.requestAuthorization({
+		clientId: params.client_id,
+		scope: params.scope,
+		verificationUri: origin === null ? void 0 : `${origin}${verificationPath}`
+	});
+	return json(grant);
+};
+/**
+* The token endpoint. `POST /device/token`.
+*
+* Maps poll results onto the status codes RFC 8628 §3.5 specifies: pending and
+* slow_down are 400s carrying an error code, not 200s, because a compliant
+* client distinguishes them by body rather than status.
+*/
+const createTokenHandler = ({ server, createSession }) => async (request) => {
+	if (request.method !== `POST`) return json({ error: `method_not_allowed` }, 405);
+	const deviceCode = (await readParams(request)).device_code;
+	if (deviceCode === void 0) return json({ error: `invalid_request` }, 400);
+	const result = await server.poll(deviceCode);
+	switch (result.status) {
+		case `approved`: return json(await createSession(result.subject));
+		case `slow_down`: return json({
+			error: result.error,
+			interval: result.interval
+		}, 400);
+		case `pending`:
+		case `denied`:
+		case `expired`: return json({ error: result.error }, 400);
+	}
+};
+/**
+* The approval endpoint. `GET` to resolve a code, `POST` to decide.
+*
+* Both require an authenticated user: this runs on the phone that is already
+* signed in, and the identity it resolves is what the device inherits.
+*/
+const createApprovalHandler = ({ server, authenticate, rateLimit }) => async (request) => {
+	const subject = await authenticate(request);
+	if (subject === null) return json({ error: `unauthorized` }, 401);
+	if (request.method === `GET`) {
+		const userCode = new URL(request.url).searchParams.get(`user_code`);
+		if (userCode === null) return json({ error: `invalid_request` }, 400);
+		if (rateLimit && !await rateLimit(request, userCode)) return json({ error: `slow_down` }, 429);
+		const grant = await server.lookupByUserCode(userCode);
+		if (!grant || grant.status !== `pending`) return json({ error: `invalid_code` }, 404);
+		return json({
+			user_code: grant.user_code,
+			client_id: grant.clientId,
+			scope: grant.scope
+		});
+	}
+	if (request.method === `POST`) {
+		const params = await readParams(request);
+		const userCode = params.user_code;
+		if (userCode === void 0) return json({ error: `invalid_request` }, 400);
+		if (rateLimit && !await rateLimit(request, userCode)) return json({ error: `slow_down` }, 429);
+		const approved = params.approved === `true`;
+		const result = approved ? await server.approve(userCode, subject) : await server.deny(userCode);
+		return result.ok ? json({
+			ok: true,
+			approved
+		}) : json({ error: result.reason ?? `invalid_code` }, 400);
+	}
+	return json({ error: `method_not_allowed` }, 405);
+};
+/**
+* All three handlers, plus a router for hosts that prefer one entry point.
+*
+* The router is a convenience — a Workers `fetch` can delegate to it wholesale
+* — but the individual handlers exist so file-based routing (Astro, Next,
+* SvelteKit) can mount each at its own path.
+*/
+const createHandlers = (options) => {
+	const authorize = createAuthorizationHandler(options);
+	const token = createTokenHandler(options);
+	const approval = createApprovalHandler(options);
+	return {
+		authorize,
+		token,
+		approval,
+		fetch: async (request) => {
+			const { pathname } = new URL(request.url);
+			if (pathname.endsWith(`/device/authorize`)) return authorize(request);
+			if (pathname.endsWith(`/device/token`)) return token(request);
+			if (pathname.endsWith(`/link`)) return approval(request);
+			return json({ error: `not_found` }, 404);
+		}
+	};
+};
+/**
+* Serve the association files that make universal/app links work.
+*
+* Both must be served from the SAME origin as the approval page, over HTTPS,
+* with no redirects. Apple and Google fetch them directly; a redirect or a
+* wrong content-type makes the association fail silently, which is the usual
+* reason "universal links don't work" with nothing in any log to explain it.
+*
+* Mount at `/.well-known/*`. Cached rather than `no-store` — unlike the auth
+* endpoints these are static, and the platforms re-fetch them on their own
+* schedule anyway.
+*/
+const createWellKnownHandler = ({ appleAppIds = [], androidPackageName, androidFingerprints = [], paths }) => {
+	const aasa = JSON.stringify(appleAppSiteAssociation(appleAppIds, { paths }));
+	const assetlinks = androidPackageName === void 0 ? `[]` : JSON.stringify(digitalAssetLinks(androidPackageName, androidFingerprints));
+	return (request) => {
+		const { pathname } = new URL(request.url);
+		if (pathname.endsWith(`/.well-known/apple-app-site-association`)) return new Response(aasa, { headers: {
+			"content-type": `application/json`,
+			"cache-control": `public, max-age=3600`
+		} });
+		if (pathname.endsWith(`/.well-known/assetlinks.json`)) return new Response(assetlinks, { headers: {
+			"content-type": `application/json`,
+			"cache-control": `public, max-age=3600`
+		} });
+		return null;
+	};
+};
+//#endregion
+export { createApprovalHandler, createAuthorizationHandler, createHandlers, createTokenHandler, createWellKnownHandler };
+
+//# sourceMappingURL=handlers.mjs.map