@samebase/identity-broker 0.0.0-stage → 0.2.0

package/dist/client/protocol.js

@@ -0,0 +1,279 @@
+/**
+ * Request validation for the OpenID Provider endpoints: pure functions over URLs, form bodies and
+ * headers, with the error shapes the handlers turn into OAuth responses.
+ */
+const MAX_STATE_LENGTH = 4096;
+const MAX_REDIRECT_URI_LENGTH = 2048;
+const MAX_CLIENT_NAME_LENGTH = 120;
+const pkceValuePattern = /^[A-Za-z0-9\-._~]{43,128}$/;
+export const TOKEN_ENDPOINT_AUTH_METHODS = ["client_secret_post", "client_secret_basic"];
+export const DEPLOYMENT_TYPES = ["production", "development", "preview"];
+/** The own enumerable entries of a JSON value, or an empty record for anything but an object. */
+export function asRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(value));
+}
+function invalid(status, error, description) {
+    return { ok: false, status, error, description };
+}
+function isLoopbackHost(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+/** A redirect URI: absolute, no fragment, https, or http on a loopback host for local development. */
+export function parseRedirectUri(value) {
+    if (value.length === 0 || value.length > MAX_REDIRECT_URI_LENGTH) {
+        return null;
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (url.hash.length > 0) {
+        return null;
+    }
+    if (url.protocol === "https:") {
+        return url;
+    }
+    if (url.protocol === "http:" && isLoopbackHost(url.hostname)) {
+        return url;
+    }
+    return null;
+}
+/**
+ * Whether `hostname` is covered by one of an app's allowed callback hosts: an exact host, or a
+ * `*.suffix` pattern whose wildcard stands for exactly one leading label.
+ */
+export function hostAllowed(hostname, allowedHosts) {
+    const host = hostname.toLowerCase();
+    return allowedHosts.some((allowed) => {
+        const pattern = allowed.toLowerCase();
+        if (!pattern.startsWith("*.")) {
+            return host === pattern;
+        }
+        const suffix = pattern.slice(1);
+        if (!host.endsWith(suffix)) {
+            return false;
+        }
+        const label = host.slice(0, host.length - suffix.length);
+        return label.length > 0 && !label.includes(".");
+    });
+}
+function readString(value, maxLength) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const trimmed = value.trim();
+    return trimmed.length === 0 || trimmed.length > maxLength ? null : trimmed;
+}
+/** RFC 7591 registration metadata as this provider accepts it: one redirect URI per client. */
+export function validateRegistration(payload) {
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+        return invalid(400, "invalid_client_metadata", "The request body must be a JSON object.");
+    }
+    const record = asRecord(payload);
+    const redirectUris = record["redirect_uris"];
+    if (!Array.isArray(redirectUris) || redirectUris.length !== 1) {
+        return invalid(400, "invalid_redirect_uri", "redirect_uris must hold exactly one URI: a client is one deployment.");
+    }
+    const redirectUri = typeof redirectUris[0] === "string" ? redirectUris[0] : "";
+    if (parseRedirectUri(redirectUri) === null) {
+        return invalid(400, "invalid_redirect_uri", "The redirect URI must be an absolute https URL without a fragment, or http on a loopback host.");
+    }
+    const clientName = readString(record["client_name"], MAX_CLIENT_NAME_LENGTH);
+    if (clientName === null) {
+        return invalid(400, "invalid_client_metadata", "client_name is required.");
+    }
+    const softwareVersion = readString(record["software_version"] ?? "unknown", 200);
+    if (softwareVersion === null) {
+        return invalid(400, "invalid_client_metadata", "software_version must be a non-empty string.");
+    }
+    const deploymentType = DEPLOYMENT_TYPES.find((type) => type === record["deployment_type"]);
+    if (deploymentType === undefined) {
+        return invalid(400, "invalid_client_metadata", `deployment_type must be one of ${DEPLOYMENT_TYPES.join(", ")}.`);
+    }
+    // RFC 7591 section 2: the default is client_secret_basic.
+    const authMethod = TOKEN_ENDPOINT_AUTH_METHODS.find((method) => method === (record["token_endpoint_auth_method"] ?? "client_secret_basic"));
+    if (authMethod === undefined) {
+        return invalid(400, "invalid_client_metadata", `token_endpoint_auth_method must be one of ${TOKEN_ENDPOINT_AUTH_METHODS.join(", ")}.`);
+    }
+    const grantTypes = record["grant_types"];
+    if (grantTypes !== undefined &&
+        (!Array.isArray(grantTypes) ||
+            grantTypes.length !== 1 ||
+            grantTypes[0] !== "authorization_code")) {
+        return invalid(400, "invalid_client_metadata", 'grant_types must be ["authorization_code"].');
+    }
+    const responseTypes = record["response_types"];
+    if (responseTypes !== undefined &&
+        (!Array.isArray(responseTypes) || responseTypes.length !== 1 || responseTypes[0] !== "code")) {
+        return invalid(400, "invalid_client_metadata", 'response_types must be ["code"].');
+    }
+    return {
+        ok: true,
+        value: {
+            redirectUri,
+            clientName,
+            softwareVersion,
+            deploymentType,
+            tokenEndpointAuthMethod: authMethod,
+        },
+    };
+}
+/**
+ * The first half of /authorize validation: the parameters that identify the client and where to
+ * send errors. Everything else is checked by `validateAuthorizeRest` once the client is known, so
+ * those errors can go back to the registered redirect URI.
+ */
+export function validateAuthorizeTarget(params) {
+    const clientId = params.get("client_id")?.trim() ?? "";
+    if (clientId.length === 0) {
+        return invalid(400, "invalid_request", "client_id is required.");
+    }
+    const redirectUri = params.get("redirect_uri") ?? "";
+    if (parseRedirectUri(redirectUri) === null) {
+        return invalid(400, "invalid_request", "redirect_uri is missing or invalid.");
+    }
+    return { ok: true, value: { clientId, redirectUri } };
+}
+export function validateAuthorizeRest(params, target) {
+    if (params.get("response_type") !== "code") {
+        return invalid(400, "unsupported_response_type", 'response_type must be "code".');
+    }
+    const scopes = (params.get("scope") ?? "").split(/\s+/).filter((scope) => scope.length > 0);
+    if (!scopes.includes("openid")) {
+        return invalid(400, "invalid_scope", 'scope must include "openid".');
+    }
+    const state = params.get("state") ?? undefined;
+    if (state !== undefined && state.length > MAX_STATE_LENGTH) {
+        return invalid(400, "invalid_request", `state must be at most ${MAX_STATE_LENGTH} characters.`);
+    }
+    const nonce = params.get("nonce") ?? undefined;
+    if (nonce !== undefined && nonce.length > MAX_STATE_LENGTH) {
+        return invalid(400, "invalid_request", `nonce must be at most ${MAX_STATE_LENGTH} characters.`);
+    }
+    const codeChallenge = params.get("code_challenge") ?? "";
+    if (!pkceValuePattern.test(codeChallenge)) {
+        return invalid(400, "invalid_request", "code_challenge is required: 43 to 128 URL-safe characters.");
+    }
+    if (params.get("code_challenge_method") !== "S256") {
+        return invalid(400, "invalid_request", 'code_challenge_method must be "S256".');
+    }
+    const prompt = (params.get("prompt") ?? "").split(/\s+/).filter((value) => value.length > 0);
+    if (prompt.some((value) => value !== "none" && value !== "login")) {
+        return invalid(400, "invalid_request", "prompt value not supported");
+    }
+    if (prompt.includes("none") && prompt.length > 1) {
+        return invalid(400, "invalid_request", "prompt=none cannot be combined with other values.");
+    }
+    const maxAgeRaw = params.get("max_age");
+    let maxAge;
+    if (maxAgeRaw !== null) {
+        maxAge = Number(maxAgeRaw);
+        if (!Number.isInteger(maxAge) || maxAge < 0) {
+            return invalid(400, "invalid_request", "max_age must be a non-negative integer.");
+        }
+    }
+    const connector = params.get("connector")?.trim() || undefined;
+    return {
+        ok: true,
+        value: {
+            clientId: target.clientId,
+            redirectUri: target.redirectUri,
+            scopes,
+            state,
+            nonce,
+            codeChallenge,
+            prompt,
+            maxAge,
+            connector,
+        },
+    };
+}
+/**
+ * Client credentials from HTTP Basic (RFC 6749 section 2.3.1) or the form body. The first look at a
+ * token request, so it also refuses a repeated parameter (RFC 6749 section 3.2) and a request that
+ * uses both methods (section 2.3).
+ */
+export function readClientAuthentication(authorization, params) {
+    const names = [...params.keys()];
+    if (new Set(names).size !== names.length) {
+        return invalid(400, "invalid_request", "A parameter is repeated.");
+    }
+    if (authorization !== null) {
+        if (params.has("client_secret")) {
+            return invalid(400, "invalid_request", "Use one client authentication method, not two.");
+        }
+        const match = authorization.trim().match(/^basic\s+(.+)$/i);
+        if (match === null || match[1] === undefined) {
+            return invalid(401, "invalid_client", "Only HTTP Basic client authentication is supported.");
+        }
+        let decoded;
+        try {
+            decoded = atob(match[1]);
+        }
+        catch {
+            return invalid(401, "invalid_client", "The Authorization header is not valid Base64.");
+        }
+        const separator = decoded.indexOf(":");
+        if (separator <= 0) {
+            return invalid(401, "invalid_client", "The Authorization header must hold client_id:client_secret.");
+        }
+        try {
+            return {
+                ok: true,
+                value: {
+                    clientId: decodeURIComponent(decoded.slice(0, separator)),
+                    clientSecret: decodeURIComponent(decoded.slice(separator + 1)),
+                    method: "client_secret_basic",
+                },
+            };
+        }
+        catch {
+            return invalid(401, "invalid_client", "The Authorization header is not valid form encoding.");
+        }
+    }
+    const clientId = params.get("client_id") ?? "";
+    const clientSecret = params.get("client_secret") ?? "";
+    if (clientId.length === 0 || clientSecret.length === 0) {
+        return invalid(401, "invalid_client", "client_id and client_secret are required.");
+    }
+    return { ok: true, value: { clientId, clientSecret, method: "client_secret_post" } };
+}
+export function validateTokenRequest(params, client) {
+    const grantType = params.get("grant_type");
+    if (grantType !== "authorization_code") {
+        return invalid(400, "unsupported_grant_type", 'grant_type must be "authorization_code".');
+    }
+    const code = params.get("code")?.trim() ?? "";
+    if (code.length === 0) {
+        return invalid(400, "invalid_request", "code is required.");
+    }
+    const redirectUri = params.get("redirect_uri") ?? undefined;
+    if (redirectUri !== undefined && parseRedirectUri(redirectUri) === null) {
+        return invalid(400, "invalid_request", "redirect_uri is invalid.");
+    }
+    const codeVerifier = params.get("code_verifier") ?? "";
+    if (!pkceValuePattern.test(codeVerifier)) {
+        return invalid(400, "invalid_request", "code_verifier is required: 43 to 128 URL-safe characters.");
+    }
+    return { ok: true, value: { code, redirectUri, codeVerifier, client } };
+}
+export function readBearerToken(authorization) {
+    const match = authorization?.trim().match(/^bearer\s+(.+)$/i);
+    return match?.[1]?.trim() || null;
+}
+/** An email address as the broker identifies it: trimmed, NFC-normalized, lowercased. */
+export function canonicalEmail(value) {
+    const email = value.trim().normalize("NFC").toLowerCase();
+    const at = email.indexOf("@");
+    if (at <= 0 || at === email.length - 1 || email.includes(" ") || email.length > 320) {
+        return null;
+    }
+    return email;
+}
+//# sourceMappingURL=protocol.js.map

package/dist/client/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/client/protocol.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,CAAU,CAAC;AAGlG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAGlF,iGAAiG;AACjG,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAI,MAAc,EAAE,KAAa,EAAE,WAAmB;IACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,YAA+B;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,KAAK,OAAO,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,SAAS,UAAU,CAAC,KAAc,EAAE,SAAiB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CACZ,GAAG,EACH,sBAAsB,EACtB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,OAAO,CACZ,GAAG,EACH,sBAAsB,EACtB,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC3F,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,OAAO,CACZ,GAAG,EACH,yBAAyB,EACzB,kCAAkC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjE,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,UAAU,GAAG,2BAA2B,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,CAAC,IAAI,qBAAqB,CAAC,CACvF,CAAC;IACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,GAAG,EACH,yBAAyB,EACzB,6CAA6C,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YACzB,UAAU,CAAC,MAAM,KAAK,CAAC;YACvB,UAAU,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,EACzC,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,6CAA6C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IACE,aAAa,KAAK,SAAS;QAC3B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAC5F,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;IACrF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,WAAW;YACX,UAAU;YACV,eAAe;YACf,cAAc;YACd,uBAAuB,EAAE,UAAU;SACpC;KACF,CAAC;AACJ,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAuB,EACvB,MAAiD;IAEjD,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE,2BAA2B,EAAE,+BAA+B,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,8BAA8B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,gBAAgB,cAAc,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,gBAAgB,cAAc,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CACZ,GAAG,EACH,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM;YACN,KAAK;YACL,KAAK;YACL,aAAa;YACb,MAAM;YACN,MAAM;YACN,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAA4B,EAC5B,MAAuB;IAEvB,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,qDAAqD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,CACZ,GAAG,EACH,gBAAgB,EAChB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBACzD,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;oBAC9D,MAAM,EAAE,qBAAqB;iBAC9B;aACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAuB,EACvB,MAA4B;IAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE,0CAA0C,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAC5D,IAAI,WAAW,KAAK,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,OAAO,OAAO,CACZ,GAAG,EACH,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,aAA4B;IAC1D,MAAM,KAAK,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/client/responses.d.ts

@@ -0,0 +1,24 @@
+/** Response helpers shared by the endpoints. */
+export declare function json(body: unknown, status?: number, headers?: Record<string, string>): Response;
+/** An OAuth error body (RFC 6749 section 5.2), for the endpoints that answer the client directly. */
+export declare function oauthError(status: number, error: string, description: string, headers?: Record<string, string>): Response;
+export declare function redirect(location: string): Response;
+/**
+ * The authorization response (OAuth 2.1 section 4.1.2): parameters on the registered redirect URI,
+ * with `iss` on every response (RFC 9207) and `state` when the client sent one.
+ */
+export declare function authorizationResponse(args: {
+    redirectUri: string;
+    issuer: string;
+    state: string | undefined;
+    params: Record<string, string>;
+}): Response;
+export declare function authorizationError(args: {
+    redirectUri: string;
+    issuer: string;
+    state: string | undefined;
+    error: string;
+    description: string;
+}): Response;
+/** The parameters of a GET query or a form POST, which the authorization endpoint accepts alike. */
+export declare function readParameters(request: Request): Promise<URLSearchParams | null>;

package/dist/client/responses.js

@@ -0,0 +1,57 @@
+/** Response helpers shared by the endpoints. */
+export function json(body, status = 200, headers = {}) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            "Content-Type": "application/json; charset=utf-8",
+            "Cache-Control": "no-store",
+            Pragma: "no-cache",
+            ...headers,
+        },
+    });
+}
+/** An OAuth error body (RFC 6749 section 5.2), for the endpoints that answer the client directly. */
+export function oauthError(status, error, description, headers = {}) {
+    return json({ error, error_description: description }, status, headers);
+}
+export function redirect(location) {
+    return new Response(null, {
+        status: 302,
+        headers: { Location: location, "Cache-Control": "no-store" },
+    });
+}
+/**
+ * The authorization response (OAuth 2.1 section 4.1.2): parameters on the registered redirect URI,
+ * with `iss` on every response (RFC 9207) and `state` when the client sent one.
+ */
+export function authorizationResponse(args) {
+    const url = new URL(args.redirectUri);
+    for (const [key, value] of Object.entries(args.params)) {
+        url.searchParams.set(key, value);
+    }
+    if (args.state !== undefined) {
+        url.searchParams.set("state", args.state);
+    }
+    url.searchParams.set("iss", args.issuer);
+    return redirect(url.toString());
+}
+export function authorizationError(args) {
+    return authorizationResponse({
+        redirectUri: args.redirectUri,
+        issuer: args.issuer,
+        state: args.state,
+        params: { error: args.error, error_description: args.description },
+    });
+}
+/** The parameters of a GET query or a form POST, which the authorization endpoint accepts alike. */
+export async function readParameters(request) {
+    if (request.method === "GET") {
+        return new URL(request.url).searchParams;
+    }
+    const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+    if (!contentType.startsWith("application/x-www-form-urlencoded")) {
+        return null;
+    }
+    return new URLSearchParams(await request.text());
+}
+//# sourceMappingURL=responses.js.map

package/dist/client/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/client/responses.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAEhD,MAAM,UAAU,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,GAA2B,EAAE;IACpF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,eAAe,EAAE,UAAU;YAC3B,MAAM,EAAE,UAAU;YAClB,GAAG,OAAO;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,KAAa,EACb,WAAmB,EACnB,OAAO,GAA2B,EAAE;IAEpC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAKrC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAMlC;IACC,OAAO,qBAAqB,CAAC;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7E,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/client/subject.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The pairwise subject of OIDC Core 8.1 with the app as the sector: deterministic, not reversible,
+ * and the same for every deployment of an app.
+ */
+export declare function pairwiseSubject(args: {
+    appId: string;
+    connector: string;
+    upstreamId: string;
+    salt: string;
+}): Promise<string>;
+export declare function sha256Hex(input: string): Promise<string>;
+/** URL-safe random token of `bytes` random bytes. */
+export declare function randomToken(bytes?: number): string;
+/** A six-digit code for the email connector, uniform over 000000 to 999999. */
+export declare function randomDigits(count?: number): string;

package/dist/client/subject.js

@@ -0,0 +1,32 @@
+/**
+ * The pairwise subject of OIDC Core 8.1 with the app as the sector: deterministic, not reversible,
+ * and the same for every deployment of an app.
+ */
+export async function pairwiseSubject(args) {
+    const input = `${args.appId}\u0000${args.connector}\u0000${args.upstreamId}\u0000${args.salt}`;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+    return btoa(String.fromCharCode(...new Uint8Array(digest)))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+export async function sha256Hex(input) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** URL-safe random token of `bytes` random bytes. */
+export function randomToken(bytes = 32) {
+    const buffer = new Uint8Array(bytes);
+    crypto.getRandomValues(buffer);
+    return btoa(String.fromCharCode(...buffer))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+/** A six-digit code for the email connector, uniform over 000000 to 999999. */
+export function randomDigits(count = 6) {
+    const buffer = new Uint32Array(count);
+    crypto.getRandomValues(buffer);
+    return Array.from(buffer, (value) => String(value % 10)).join("");
+}
+//# sourceMappingURL=subject.js.map

package/dist/client/subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject.js","sourceRoot":"","sources":["../../src/client/subject.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAKrC;IACC,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,SAAS,IAAI,CAAC,UAAU,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACxD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC;SACxC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,KAAK,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/dist/component/_generated/api.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Generated `api` utility.
+ *
+ * THIS CODE IS AUTOMATICALLY GENERATED.
+ *
+ * To regenerate, run `npx convex dev`.
+ * @module
+ */
+import type * as apps from "../apps.js";
+import type * as authRequests from "../authRequests.js";
+import type * as clients from "../clients.js";
+import type * as crypto from "../crypto.js";
+import type * as lifecycle from "../lifecycle.js";
+import type * as registration from "../registration.js";
+import type * as signIns from "../signIns.js";
+import type { ApiFromModules, FilterApi, FunctionReference } from "convex/server";
+declare const fullApi: ApiFromModules<{
+    apps: typeof apps;
+    authRequests: typeof authRequests;
+    clients: typeof clients;
+    crypto: typeof crypto;
+    lifecycle: typeof lifecycle;
+    registration: typeof registration;
+    signIns: typeof signIns;
+}>;
+/**
+ * A utility for referencing Convex functions in your app's public API.
+ *
+ * Usage:
+ * ```js
+ * const myFunctionReference = api.myModule.myFunction;
+ * ```
+ */
+export declare const api: FilterApi<typeof fullApi, FunctionReference<any, "public">>;
+/**
+ * A utility for referencing Convex functions in your app's internal API.
+ *
+ * Usage:
+ * ```js
+ * const myFunctionReference = internal.myModule.myFunction;
+ * ```
+ */
+export declare const internal: FilterApi<typeof fullApi, FunctionReference<any, "internal">>;
+export declare const components: {};
+export {};

package/dist/component/_generated/api.js

@@ -0,0 +1,31 @@
+/* eslint-disable */
+/**
+ * Generated `api` utility.
+ *
+ * THIS CODE IS AUTOMATICALLY GENERATED.
+ *
+ * To regenerate, run `npx convex dev`.
+ * @module
+ */
+import { anyApi, componentsGeneric } from "convex/server";
+const fullApi = anyApi;
+/**
+ * A utility for referencing Convex functions in your app's public API.
+ *
+ * Usage:
+ * ```js
+ * const myFunctionReference = api.myModule.myFunction;
+ * ```
+ */
+export const api = anyApi;
+/**
+ * A utility for referencing Convex functions in your app's internal API.
+ *
+ * Usage:
+ * ```js
+ * const myFunctionReference = internal.myModule.myFunction;
+ * ```
+ */
+export const internal = anyApi;
+export const components = componentsGeneric();
+//# sourceMappingURL=api.js.map

package/dist/component/_generated/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/component/_generated/api.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB;;;;;;;GAOG;AAeH,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,OAAO,GAQR,MAAa,CAAC;AAEnB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,GAAG,GAGZ,MAAa,CAAC;AAElB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAGjB,MAAa,CAAC;AAElB,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,EAAmB,CAAC"}