@scalemule/news-publication 0.0.48 → 0.0.49

package/dist/meet-forms.d.cts

@@ -1,13 +1,14 @@
-import * as react from 'react';
-import { P as PublicPlace } from './meet-RWmfj3I3.cjs';
+import * as React from 'react';
+import { P as PublicPlace } from './meet-CO9Unz5M.cjs';
+import './pets.cjs';
 
 declare function MeetHostForm({ places }: {
     places: PublicPlace[];
-}): react.JSX.Element;
-declare function PhoneCheckForm(): react.JSX.Element;
-declare function BirthdayForm(): react.JSX.Element;
+}): React.JSX.Element;
+declare function PhoneCheckForm(): React.JSX.Element;
+declare function BirthdayForm(): React.JSX.Element;
 declare function MeetupChat({ meetupId }: {
     meetupId: string;
-}): react.JSX.Element;
+}): React.JSX.Element;
 
 export { BirthdayForm, MeetHostForm, MeetupChat, PhoneCheckForm };

package/dist/meet-forms.d.ts

@@ -1,13 +1,14 @@
-import * as react from 'react';
-import { P as PublicPlace } from './meet-RWmfj3I3.js';
+import * as React from 'react';
+import { P as PublicPlace } from './meet-BWpxY20X.js';
+import './pets.js';
 
 declare function MeetHostForm({ places }: {
     places: PublicPlace[];
-}): react.JSX.Element;
-declare function PhoneCheckForm(): react.JSX.Element;
-declare function BirthdayForm(): react.JSX.Element;
+}): React.JSX.Element;
+declare function PhoneCheckForm(): React.JSX.Element;
+declare function BirthdayForm(): React.JSX.Element;
 declare function MeetupChat({ meetupId }: {
     meetupId: string;
-}): react.JSX.Element;
+}): React.JSX.Element;
 
 export { BirthdayForm, MeetHostForm, MeetupChat, PhoneCheckForm };

package/dist/meet-forms.js

@@ -1,5 +1,6 @@
 "use client";
-import { MEET_ACTIVITIES } from './chunk-GB36YM56.js';
+import { MEET_ACTIVITIES } from './chunk-2MEYHM7M.js';
+import './chunk-MBBPEFDA.js';
 import { useState } from 'react';
 import { jsxs, jsx } from 'react/jsx-runtime';
 

package/dist/meet-view.cjs

@@ -2,6 +2,10 @@
 
 var jsxRuntime = require('react/jsx-runtime');
 
+// src/pets.ts
+var PET_SAFETY = {
+  walks: "Walks are independently organized. Bay Area Paw does not supervise meetups or guarantee participants\u2019 safety. Meet in a public place, follow leash rules and respect other people and animals."};
+
 // src/meet.ts
 var MEET_ACTIVITIES = [
   { value: "coffee", label: "Coffee" },
@@ -69,8 +73,24 @@ function MeetupDetail({ meetup, joined }) {
       meetup.capacity
     ] }),
     /* @__PURE__ */ jsxRuntime.jsx("div", { className: "body", children: meetup.notes }),
-    !joined && meetup.going < meetup.capacity && /* @__PURE__ */ jsxRuntime.jsx("form", { className: "actions", method: "post", action: `/api/meet/${encodeURIComponent(meetup.id)}/join`, children: /* @__PURE__ */ jsxRuntime.jsx("button", { className: "primary", type: "submit", children: "I\u2019ll be there" }) }),
-    joined && /* @__PURE__ */ jsxRuntime.jsx("p", { className: "meta", children: "You\u2019re going. Use the chat below. Keep phone numbers for when you meet." })
+    meetup.activity === "dogs" && /* @__PURE__ */ jsxRuntime.jsxs("aside", { children: [
+      meetup.walk && /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+        /* @__PURE__ */ jsxRuntime.jsxs("p", { children: [
+          meetup.walk.duration_minutes,
+          " minutes",
+          meetup.walk.distance_km !== void 0 ? ` \xB7 ${meetup.walk.distance_km} km` : "",
+          " \xB7 ",
+          meetup.walk.leash === "required" ? "Leashes required" : "Follow venue leash rules"
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { children: meetup.walk.size_guidance }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { children: meetup.walk.accessibility })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsx("p", { children: PET_SAFETY.walks })
+    ] }),
+    meetup.status === "cancelled" && /* @__PURE__ */ jsxRuntime.jsx("p", { role: "status", children: "This meetup has been cancelled." }),
+    meetup.status !== "cancelled" && !joined && meetup.going < meetup.capacity && /* @__PURE__ */ jsxRuntime.jsx("form", { className: "actions", method: "post", action: `/api/meet/${encodeURIComponent(meetup.id)}/join`, children: /* @__PURE__ */ jsxRuntime.jsx("button", { className: "primary", type: "submit", children: "I\u2019ll be there" }) }),
+    meetup.status !== "cancelled" && joined && /* @__PURE__ */ jsxRuntime.jsx("p", { className: "meta", children: "You\u2019re going. Use the chat below. Keep phone numbers for when you meet." }),
+    /* @__PURE__ */ jsxRuntime.jsx("p", { children: /* @__PURE__ */ jsxRuntime.jsx("a", { href: "/corrections?resource=" + encodeURIComponent(`/meet/${meetup.id}`), children: "Report this meetup to the publication" }) })
   ] });
 }
 function activityChoices() {

package/dist/meet-view.d.cts

@@ -1,22 +1,24 @@
-import * as react from 'react';
-import { a as PreparedMeetup } from './meet-RWmfj3I3.cjs';
+import * as React from 'react';
+import { a as PreparedMeetup } from './meet-CO9Unz5M.cjs';
+import './pets.cjs';
 
 type MeetupCard = PreparedMeetup & {
     id: string;
     hostName: string;
     going: number;
     conversationId?: string | null;
+    status?: "open" | "cancelled";
 };
 declare function MeetBoard({ region, meetups }: {
     region: string;
     meetups: MeetupCard[];
-}): react.JSX.Element;
+}): React.JSX.Element;
 declare function MeetupDetail({ meetup, joined }: {
     meetup: MeetupCard;
     joined: boolean;
-}): react.JSX.Element;
+}): React.JSX.Element;
 declare function activityChoices(): {
-    value: "coffee" | "walk" | "hike" | "pickleball" | "tennis" | "soccer" | "bike" | "dogs" | "books" | "games" | "kids" | "volunteer" | "other";
+    value: "other" | "walk" | "coffee" | "hike" | "pickleball" | "tennis" | "soccer" | "bike" | "dogs" | "books" | "games" | "kids" | "volunteer";
     label: string;
 }[];
 

package/dist/meet-view.d.ts

@@ -1,22 +1,24 @@
-import * as react from 'react';
-import { a as PreparedMeetup } from './meet-RWmfj3I3.js';
+import * as React from 'react';
+import { a as PreparedMeetup } from './meet-BWpxY20X.js';
+import './pets.js';
 
 type MeetupCard = PreparedMeetup & {
     id: string;
     hostName: string;
     going: number;
     conversationId?: string | null;
+    status?: "open" | "cancelled";
 };
 declare function MeetBoard({ region, meetups }: {
     region: string;
     meetups: MeetupCard[];
-}): react.JSX.Element;
+}): React.JSX.Element;
 declare function MeetupDetail({ meetup, joined }: {
     meetup: MeetupCard;
     joined: boolean;
-}): react.JSX.Element;
+}): React.JSX.Element;
 declare function activityChoices(): {
-    value: "coffee" | "walk" | "hike" | "pickleball" | "tennis" | "soccer" | "bike" | "dogs" | "books" | "games" | "kids" | "volunteer" | "other";
+    value: "other" | "walk" | "coffee" | "hike" | "pickleball" | "tennis" | "soccer" | "bike" | "dogs" | "books" | "games" | "kids" | "volunteer";
     label: string;
 }[];
 

package/dist/meet-view.js

@@ -1,5 +1,6 @@
-import { MEET_ACTIVITIES, activityLabel } from './chunk-GB36YM56.js';
-import { jsxs, jsx } from 'react/jsx-runtime';
+import { MEET_ACTIVITIES, activityLabel } from './chunk-2MEYHM7M.js';
+import { PET_SAFETY } from './chunk-MBBPEFDA.js';
+import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 
 function MeetBoard({ region, meetups }) {
   return /* @__PURE__ */ jsxs("div", { className: "np-market", children: [
@@ -48,8 +49,24 @@ function MeetupDetail({ meetup, joined }) {
       meetup.capacity
     ] }),
     /* @__PURE__ */ jsx("div", { className: "body", children: meetup.notes }),
-    !joined && meetup.going < meetup.capacity && /* @__PURE__ */ jsx("form", { className: "actions", method: "post", action: `/api/meet/${encodeURIComponent(meetup.id)}/join`, children: /* @__PURE__ */ jsx("button", { className: "primary", type: "submit", children: "I\u2019ll be there" }) }),
-    joined && /* @__PURE__ */ jsx("p", { className: "meta", children: "You\u2019re going. Use the chat below. Keep phone numbers for when you meet." })
+    meetup.activity === "dogs" && /* @__PURE__ */ jsxs("aside", { children: [
+      meetup.walk && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsxs("p", { children: [
+          meetup.walk.duration_minutes,
+          " minutes",
+          meetup.walk.distance_km !== void 0 ? ` \xB7 ${meetup.walk.distance_km} km` : "",
+          " \xB7 ",
+          meetup.walk.leash === "required" ? "Leashes required" : "Follow venue leash rules"
+        ] }),
+        /* @__PURE__ */ jsx("p", { children: meetup.walk.size_guidance }),
+        /* @__PURE__ */ jsx("p", { children: meetup.walk.accessibility })
+      ] }),
+      /* @__PURE__ */ jsx("p", { children: PET_SAFETY.walks })
+    ] }),
+    meetup.status === "cancelled" && /* @__PURE__ */ jsx("p", { role: "status", children: "This meetup has been cancelled." }),
+    meetup.status !== "cancelled" && !joined && meetup.going < meetup.capacity && /* @__PURE__ */ jsx("form", { className: "actions", method: "post", action: `/api/meet/${encodeURIComponent(meetup.id)}/join`, children: /* @__PURE__ */ jsx("button", { className: "primary", type: "submit", children: "I\u2019ll be there" }) }),
+    meetup.status !== "cancelled" && joined && /* @__PURE__ */ jsx("p", { className: "meta", children: "You\u2019re going. Use the chat below. Keep phone numbers for when you meet." }),
+    /* @__PURE__ */ jsx("p", { children: /* @__PURE__ */ jsx("a", { href: "/corrections?resource=" + encodeURIComponent(`/meet/${meetup.id}`), children: "Report this meetup to the publication" }) })
   ] });
 }
 function activityChoices() {

package/dist/network-bar.d.cts

@@ -1,4 +1,4 @@
-import * as react from 'react';
+import * as React from 'react';
 import { CSSProperties } from 'react';
 
 interface LocalNetworkBarProps {
@@ -10,6 +10,6 @@ interface LocalNetworkBarProps {
  * Global navigation bar for the Bay Area Local News network.
  * Links across independent publication origins, transferring consent tokens automatically.
  */
-declare function LocalNetworkBar({ currentSlug, className, style }: LocalNetworkBarProps): react.JSX.Element;
+declare function LocalNetworkBar({ currentSlug, className, style }: LocalNetworkBarProps): React.JSX.Element;
 
 export { LocalNetworkBar, type LocalNetworkBarProps };

package/dist/network-bar.d.ts

@@ -1,4 +1,4 @@
-import * as react from 'react';
+import * as React from 'react';
 import { CSSProperties } from 'react';
 
 interface LocalNetworkBarProps {
@@ -10,6 +10,6 @@ interface LocalNetworkBarProps {
  * Global navigation bar for the Bay Area Local News network.
  * Links across independent publication origins, transferring consent tokens automatically.
  */
-declare function LocalNetworkBar({ currentSlug, className, style }: LocalNetworkBarProps): react.JSX.Element;
+declare function LocalNetworkBar({ currentSlug, className, style }: LocalNetworkBarProps): React.JSX.Element;
 
 export { LocalNetworkBar, type LocalNetworkBarProps };

package/dist/network-copyright.d.cts

@@ -1,4 +1,4 @@
-import react__default, { CSSProperties } from 'react';
+import React__default, { CSSProperties } from 'react';
 
 interface NetworkCopyrightNoticeProps {
     className?: string;
@@ -13,6 +13,6 @@ interface NetworkCopyrightNoticeProps {
  * Reusable copyright and institutional network parent attribution notice for all ScaleMule news publications.
  * Links to the official Bay Area News Network institutional website.
  */
-declare function NetworkCopyrightNotice({ className, style, publicationName, showPublicationNotice, targetBlank, prefix, showRightsReserved, }: NetworkCopyrightNoticeProps): react__default.JSX.Element;
+declare function NetworkCopyrightNotice({ className, style, publicationName, showPublicationNotice, targetBlank, prefix, showRightsReserved, }: NetworkCopyrightNoticeProps): React__default.JSX.Element;
 
 export { NetworkCopyrightNotice, type NetworkCopyrightNoticeProps };

package/dist/network-copyright.d.ts

@@ -1,4 +1,4 @@
-import react__default, { CSSProperties } from 'react';
+import React__default, { CSSProperties } from 'react';
 
 interface NetworkCopyrightNoticeProps {
     className?: string;
@@ -13,6 +13,6 @@ interface NetworkCopyrightNoticeProps {
  * Reusable copyright and institutional network parent attribution notice for all ScaleMule news publications.
  * Links to the official Bay Area News Network institutional website.
  */
-declare function NetworkCopyrightNotice({ className, style, publicationName, showPublicationNotice, targetBlank, prefix, showRightsReserved, }: NetworkCopyrightNoticeProps): react__default.JSX.Element;
+declare function NetworkCopyrightNotice({ className, style, publicationName, showPublicationNotice, targetBlank, prefix, showRightsReserved, }: NetworkCopyrightNoticeProps): React__default.JSX.Element;
 
 export { NetworkCopyrightNotice, type NetworkCopyrightNoticeProps };

package/dist/pets-auth-server.cjs

@@ -0,0 +1,212 @@
+'use strict';
+
+var crypto = require('crypto');
+var sdk = require('@scalemule/sdk');
+
+// src/pets-auth-server.ts
+
+// src/pets.ts
+var PET_SLUG = /^[a-z0-9][a-z0-9-]{0,190}$/;
+
+// src/pets-server.ts
+var PetRequestError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+var petPrivateHeaders = {
+  "cache-control": "private, no-store",
+  "x-robots-tag": "noindex, nofollow",
+  "referrer-policy": "no-referrer",
+  "x-content-type-options": "nosniff"
+};
+function config(scope) {
+  const url = new URL(scope.gatewayUrl);
+  if (!scope.apiKey || !PET_SLUG.test(scope.collectionSlug) || url.username || url.password || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname)))
+    throw new PetRequestError(503, "The pet community is not available yet.");
+  return url.origin;
+}
+async function petRequest(scope, path, init = {}, fetcher = fetch) {
+  const gateway = config(scope);
+  if (!path.startsWith("/v1/") || path.includes("..") || /[\\\r\n]/.test(path))
+    throw new Error("Invalid platform path");
+  const response = await fetcher(gateway + path, {
+    method: init.method || "GET",
+    headers: {
+      ...sdk.buildClientContextHeaders(scope.clientContext),
+      "x-api-key": scope.apiKey,
+      "content-type": "application/json",
+      ...scope.accessToken ? { authorization: `Bearer ${scope.accessToken}` } : {}
+    },
+    body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
+    cache: "no-store",
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!response.ok)
+    throw new PetRequestError(
+      response.status,
+      response.status === 401 ? "Please sign in to continue." : response.status === 404 ? "This pet resource is not available." : response.status === 409 ? "This contribution changed. Reload before saving." : response.status === 429 ? "Please wait before trying again." : "We couldn\u2019t complete that request. Please try again."
+    );
+  const json = await response.json();
+  return json?.data ?? json;
+}
+
+// src/pets-auth-server.ts
+var PAW_SESSION_COOKIE = "__Host-paw-reader";
+var FLOW = "__Host-paw-signin";
+var attrs = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function pawCookie(request, name = PAW_SESSION_COOKIE) {
+  return request.headers.get("cookie")?.split(";").map((v) => v.trim()).find((v) => v.startsWith(name + "="))?.slice(name.length + 1);
+}
+function digest(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+function returnPath(value) {
+  return typeof value === "string" && value.startsWith("/") && !value.startsWith("//") && value.length <= 500 && !/[\\\r\n]/.test(value) ? value : "/account";
+}
+function sealPawFlow(state, next, key, now = Date.now()) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      state: digest(state),
+      next: returnPath(next),
+      expires: now + 6e5
+    })
+  ).toString("base64url");
+  return payload + "." + crypto.createHmac("sha256", key).update("paw-signin:v1:" + payload).digest("hex");
+}
+function openPawFlow(raw, state, key, now = Date.now()) {
+  if (!key || !raw || raw.length > 2048 || !state || state.length > 2048)
+    return null;
+  const [payload, signature, extra] = raw.split(".");
+  if (!payload || extra || !/^[a-f0-9]{64}$/.test(signature || "")) return null;
+  if (!crypto.timingSafeEqual(
+    Buffer.from(signature, "hex"),
+    crypto.createHmac("sha256", key).update("paw-signin:v1:" + payload).digest()
+  ))
+    return null;
+  try {
+    const flow = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!Number.isFinite(flow.expires) || flow.expires <= now || !/^[a-f0-9]{64}$/.test(flow.state) || !crypto.timingSafeEqual(
+      Buffer.from(flow.state, "hex"),
+      Buffer.from(digest(state), "hex")
+    ))
+      return null;
+    return returnPath(flow.next);
+  } catch {
+    return null;
+  }
+}
+function createPawAuthHandler(options) {
+  return async (request, action) => {
+    const json = (body, status = 200) => Response.json(body, { status, headers: petPrivateHeaders });
+    try {
+      if (!options.enabled)
+        return json({ error: "Community sign-in is not available yet." }, 503);
+      const scope = await options.resolve(request), origin = new URL(scope.origin).origin;
+      if (!origin.startsWith("https://") || !scope.apiKey)
+        return json({ error: "Sign-in is not configured." }, 503);
+      const redirect = (path) => new Response(null, {
+        status: 303,
+        headers: {
+          ...petPrivateHeaders,
+          location: origin + returnPath(path)
+        }
+      });
+      if (action === "start" && request.method === "POST") {
+        if (request.headers.get("origin") !== origin)
+          return json({ error: "Sign in from this website." }, 403);
+        const callback = origin + "/api/paw-auth/callback";
+        const result = await petRequest(
+          scope,
+          "/v1/auth/oauth/ledvery/authorize?" + new URLSearchParams({ redirect_uri: callback }),
+          {},
+          options.fetch
+        );
+        const url = new URL(result.url);
+        if (url.origin !== new URL(options.issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.searchParams.get("state") !== result.state || url.searchParams.get("redirect_uri") !== callback || url.searchParams.get("code_challenge_method") !== "S256" || !url.searchParams.get("code_challenge"))
+          throw new Error("Invalid authorization response");
+        const response = json({ url: url.href });
+        response.headers.append(
+          "set-cookie",
+          `${FLOW}=${sealPawFlow(result.state, returnPath(new URL(request.url).searchParams.get("next")), scope.apiKey)}; ${attrs}; Max-Age=600`
+        );
+        return response;
+      }
+      if (action === "callback" && request.method === "GET") {
+        const query = new URL(request.url).searchParams, code = query.get("code"), state = query.get("state");
+        const next = openPawFlow(pawCookie(request, FLOW), state, scope.apiKey);
+        const response = redirect(next || "/account?signin=retry");
+        response.headers.append("set-cookie", `${FLOW}=; ${attrs}; Max-Age=0`);
+        if (!next || !code || code.length > 4096 || query.has("error"))
+          return response;
+        try {
+          const session = await petRequest(
+            scope,
+            "/v1/auth/oauth/ledvery/callback?" + new URLSearchParams({ code, state }),
+            {},
+            options.fetch
+          );
+          const expiry = Date.parse(session.expires_at);
+          if (!session.session_token || !/^[A-Za-z0-9._~-]{1,2048}$/.test(session.session_token) || !Number.isFinite(expiry) || expiry <= Date.now())
+            throw new Error("Invalid session");
+          const me = await petRequest(
+            { ...scope, accessToken: session.session_token },
+            "/v1/auth/me",
+            {},
+            options.fetch
+          );
+          if (!me.id || !me.email_verified)
+            throw new Error("Verified reader required");
+          response.headers.append(
+            "set-cookie",
+            `${PAW_SESSION_COOKIE}=${session.session_token}; ${attrs}; Expires=${new Date(expiry).toUTCString()}`
+          );
+          return response;
+        } catch {
+          response.headers.set("location", origin + "/account?signin=retry");
+          return response;
+        }
+      }
+      if (action === "session" && request.method === "GET") {
+        if (!scope.accessToken) return json({ authenticated: false });
+        const me = await petRequest(scope, "/v1/auth/me", {}, options.fetch);
+        return json({
+          authenticated: Boolean(me.id && me.email_verified),
+          name: me.full_name || "Neighbor"
+        });
+      }
+      if (action === "logout" && request.method === "POST") {
+        if (request.headers.get("origin") !== origin)
+          return json({ error: "Continue from this website." }, 403);
+        if (scope.accessToken)
+          await petRequest(
+            scope,
+            "/v1/auth/logout",
+            { method: "POST", body: { session_token: scope.accessToken } },
+            options.fetch
+          );
+        const response = json({ authenticated: false });
+        response.headers.append(
+          "set-cookie",
+          `${PAW_SESSION_COOKIE}=; ${attrs}; Max-Age=0`
+        );
+        return response;
+      }
+      return json({ error: "Route not found" }, 404);
+    } catch {
+      return json(
+        { error: "Sign-in is temporarily unavailable. Please try again." },
+        503
+      );
+    }
+  };
+}
+
+exports.PAW_SESSION_COOKIE = PAW_SESSION_COOKIE;
+exports.createPawAuthHandler = createPawAuthHandler;
+exports.openPawFlow = openPawFlow;
+exports.pawCookie = pawCookie;
+exports.sealPawFlow = sealPawFlow;

package/dist/pets-auth-server.d.cts

@@ -0,0 +1,17 @@
+import { PetScope } from './pets-server.cjs';
+import '@scalemule/sdk';
+import './sponsorships-CtnBe3S8.cjs';
+import './pets.cjs';
+
+declare const PAW_SESSION_COOKIE = "__Host-paw-reader";
+declare function pawCookie(request: Request, name?: string): string | undefined;
+declare function sealPawFlow(state: string, next: string, key: string, now?: number): string;
+declare function openPawFlow(raw: string | undefined, state: string | null, key: string, now?: number): string | null;
+declare function createPawAuthHandler(options: {
+    resolve(request: Request): Promise<PetScope>;
+    enabled: boolean;
+    issuerOrigin: string;
+    fetch?: typeof fetch;
+}): (request: Request, action: string) => Promise<Response>;
+
+export { PAW_SESSION_COOKIE, createPawAuthHandler, openPawFlow, pawCookie, sealPawFlow };

package/dist/pets-auth-server.d.ts

@@ -0,0 +1,17 @@
+import { PetScope } from './pets-server.js';
+import '@scalemule/sdk';
+import './sponsorships-CtnBe3S8.js';
+import './pets.js';
+
+declare const PAW_SESSION_COOKIE = "__Host-paw-reader";
+declare function pawCookie(request: Request, name?: string): string | undefined;
+declare function sealPawFlow(state: string, next: string, key: string, now?: number): string;
+declare function openPawFlow(raw: string | undefined, state: string | null, key: string, now?: number): string | null;
+declare function createPawAuthHandler(options: {
+    resolve(request: Request): Promise<PetScope>;
+    enabled: boolean;
+    issuerOrigin: string;
+    fetch?: typeof fetch;
+}): (request: Request, action: string) => Promise<Response>;
+
+export { PAW_SESSION_COOKIE, createPawAuthHandler, openPawFlow, pawCookie, sealPawFlow };

package/dist/pets-auth-server.js

@@ -0,0 +1,155 @@
+import { petPrivateHeaders, petRequest } from './chunk-ZXH3O537.js';
+import './chunk-MBBPEFDA.js';
+import { createHmac, timingSafeEqual, createHash } from 'crypto';
+
+var PAW_SESSION_COOKIE = "__Host-paw-reader";
+var FLOW = "__Host-paw-signin";
+var attrs = "Path=/; HttpOnly; Secure; SameSite=Lax";
+function pawCookie(request, name = PAW_SESSION_COOKIE) {
+  return request.headers.get("cookie")?.split(";").map((v) => v.trim()).find((v) => v.startsWith(name + "="))?.slice(name.length + 1);
+}
+function digest(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function returnPath(value) {
+  return typeof value === "string" && value.startsWith("/") && !value.startsWith("//") && value.length <= 500 && !/[\\\r\n]/.test(value) ? value : "/account";
+}
+function sealPawFlow(state, next, key, now = Date.now()) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      state: digest(state),
+      next: returnPath(next),
+      expires: now + 6e5
+    })
+  ).toString("base64url");
+  return payload + "." + createHmac("sha256", key).update("paw-signin:v1:" + payload).digest("hex");
+}
+function openPawFlow(raw, state, key, now = Date.now()) {
+  if (!key || !raw || raw.length > 2048 || !state || state.length > 2048)
+    return null;
+  const [payload, signature, extra] = raw.split(".");
+  if (!payload || extra || !/^[a-f0-9]{64}$/.test(signature || "")) return null;
+  if (!timingSafeEqual(
+    Buffer.from(signature, "hex"),
+    createHmac("sha256", key).update("paw-signin:v1:" + payload).digest()
+  ))
+    return null;
+  try {
+    const flow = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!Number.isFinite(flow.expires) || flow.expires <= now || !/^[a-f0-9]{64}$/.test(flow.state) || !timingSafeEqual(
+      Buffer.from(flow.state, "hex"),
+      Buffer.from(digest(state), "hex")
+    ))
+      return null;
+    return returnPath(flow.next);
+  } catch {
+    return null;
+  }
+}
+function createPawAuthHandler(options) {
+  return async (request, action) => {
+    const json = (body, status = 200) => Response.json(body, { status, headers: petPrivateHeaders });
+    try {
+      if (!options.enabled)
+        return json({ error: "Community sign-in is not available yet." }, 503);
+      const scope = await options.resolve(request), origin = new URL(scope.origin).origin;
+      if (!origin.startsWith("https://") || !scope.apiKey)
+        return json({ error: "Sign-in is not configured." }, 503);
+      const redirect = (path) => new Response(null, {
+        status: 303,
+        headers: {
+          ...petPrivateHeaders,
+          location: origin + returnPath(path)
+        }
+      });
+      if (action === "start" && request.method === "POST") {
+        if (request.headers.get("origin") !== origin)
+          return json({ error: "Sign in from this website." }, 403);
+        const callback = origin + "/api/paw-auth/callback";
+        const result = await petRequest(
+          scope,
+          "/v1/auth/oauth/ledvery/authorize?" + new URLSearchParams({ redirect_uri: callback }),
+          {},
+          options.fetch
+        );
+        const url = new URL(result.url);
+        if (url.origin !== new URL(options.issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.searchParams.get("state") !== result.state || url.searchParams.get("redirect_uri") !== callback || url.searchParams.get("code_challenge_method") !== "S256" || !url.searchParams.get("code_challenge"))
+          throw new Error("Invalid authorization response");
+        const response = json({ url: url.href });
+        response.headers.append(
+          "set-cookie",
+          `${FLOW}=${sealPawFlow(result.state, returnPath(new URL(request.url).searchParams.get("next")), scope.apiKey)}; ${attrs}; Max-Age=600`
+        );
+        return response;
+      }
+      if (action === "callback" && request.method === "GET") {
+        const query = new URL(request.url).searchParams, code = query.get("code"), state = query.get("state");
+        const next = openPawFlow(pawCookie(request, FLOW), state, scope.apiKey);
+        const response = redirect(next || "/account?signin=retry");
+        response.headers.append("set-cookie", `${FLOW}=; ${attrs}; Max-Age=0`);
+        if (!next || !code || code.length > 4096 || query.has("error"))
+          return response;
+        try {
+          const session = await petRequest(
+            scope,
+            "/v1/auth/oauth/ledvery/callback?" + new URLSearchParams({ code, state }),
+            {},
+            options.fetch
+          );
+          const expiry = Date.parse(session.expires_at);
+          if (!session.session_token || !/^[A-Za-z0-9._~-]{1,2048}$/.test(session.session_token) || !Number.isFinite(expiry) || expiry <= Date.now())
+            throw new Error("Invalid session");
+          const me = await petRequest(
+            { ...scope, accessToken: session.session_token },
+            "/v1/auth/me",
+            {},
+            options.fetch
+          );
+          if (!me.id || !me.email_verified)
+            throw new Error("Verified reader required");
+          response.headers.append(
+            "set-cookie",
+            `${PAW_SESSION_COOKIE}=${session.session_token}; ${attrs}; Expires=${new Date(expiry).toUTCString()}`
+          );
+          return response;
+        } catch {
+          response.headers.set("location", origin + "/account?signin=retry");
+          return response;
+        }
+      }
+      if (action === "session" && request.method === "GET") {
+        if (!scope.accessToken) return json({ authenticated: false });
+        const me = await petRequest(scope, "/v1/auth/me", {}, options.fetch);
+        return json({
+          authenticated: Boolean(me.id && me.email_verified),
+          name: me.full_name || "Neighbor"
+        });
+      }
+      if (action === "logout" && request.method === "POST") {
+        if (request.headers.get("origin") !== origin)
+          return json({ error: "Continue from this website." }, 403);
+        if (scope.accessToken)
+          await petRequest(
+            scope,
+            "/v1/auth/logout",
+            { method: "POST", body: { session_token: scope.accessToken } },
+            options.fetch
+          );
+        const response = json({ authenticated: false });
+        response.headers.append(
+          "set-cookie",
+          `${PAW_SESSION_COOKIE}=; ${attrs}; Max-Age=0`
+        );
+        return response;
+      }
+      return json({ error: "Route not found" }, 404);
+    } catch {
+      return json(
+        { error: "Sign-in is temporarily unavailable. Please try again." },
+        503
+      );
+    }
+  };
+}
+
+export { PAW_SESSION_COOKIE, createPawAuthHandler, openPawFlow, pawCookie, sealPawFlow };