@shware/security 8.0.0 → 8.0.1

package/README.md

@@ -362,14 +362,17 @@ any app; it is sent with an `appsecret_proof`, so the client needs its `clientSe
 ### Web redirect flow
 
 1. The browser opens `GET /oauth2/authorization/:provider`. `oauth2Authorization` stores the
-   state and PKCE verifier in the session and redirects to the provider.
+   state and PKCE verifier in the session and redirects to the provider. A browser without a
+   session gets one that lives 10 minutes, the life of the state, so an abandoned flow does not
+   keep a row for the default interval; a session it already carries keeps its own.
 2. The provider calls back `GET|POST /login/oauth2/code/:provider` (Apple uses `form_post`,
    so register both). `loginOAuth2Code` checks state, exchanges the code as the `web` client,
    calls `onAuthorized` and redirects to `successUri` with `status=success&provider=<key>`, or to
    `errorUri` with `error` and `error_description`.
 3. On success the user is signed in on a new session id, not the one the flow started on, which
    is deleted (session fixation protection). The attributes the host kept in that session move to
-   the new one; the single-use authorization request (state, PKCE verifier) does not.
+   the new one; the single-use authorization request (state, PKCE verifier) does not. The new
+   session has the repository's default inactive interval.
 
 Every failure of the callback lands on `errorUri` — never a raw JSON error in the popup:
 

package/dist/auth/index.cjs

@@ -228,7 +228,7 @@ var Auth = class {
 		return this.withSession(Response.json({ data: principal !== null }), session);
 	};
 	createPkceParameters() {
-		const code_verifier = (0, node_crypto.randomUUID)();
+		const code_verifier = (0, node_crypto.randomBytes)(32).toString("base64url");
 		return {
 			code_verifier,
 			code_challenge: (0, node_crypto.createHash)("sha256").update(code_verifier).digest().toString("base64url"),
@@ -275,7 +275,11 @@ var Auth = class {
 			state,
 			pkce
 		});
-		const session = await this.loadSession(request) ?? this.repository.createSession();
+		let session = await this.loadSession(request);
+		if (!session) {
+			session = this.repository.createSession();
+			session.setMaxInactiveInterval(OAUTH2_PARAMETER_TTL);
+		}
 		mark("fetch_session");
 		const authorizationRequest = {
 			state,

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isKnownOAuth2ErrorType","attributesSize","MAX_ATTRIBUTES_BYTES","extend","googleOneTapSchema","attributesSchema","object","string","regex","literal","EmailVerificationCodes","DesktopCodes","OAuth2Client","getCookie","PRINCIPAL_NAME_INDEX_NAME","errorResponse","randomUUID","createHash","AuthenticationError","param","timing","query","oauth2RedirectQuerySchema","OAuth2Error","readJson","bodyAttributes","invalidArgument","readForm","parse","sendEmailVerificationCodeSchema","verifyTurnstileToken","loginEmailSchema","unauthenticated"],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { extend, literal, object, regex, string } from 'zod/mini';\nimport type { Principal } from '../core/index';\nimport { loginEmailSchema, sendEmailVerificationCodeSchema } from '../email/schema';\nimport { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2Error, type OAuth2ErrorType, isKnownOAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredential,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n  StandardClaims,\n} from '../oauth2/types';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport {\n  type CookieOptions,\n  deleteCookie,\n  getCookie,\n  param,\n  query,\n  setCookie,\n} from '../utils/http';\nimport { timing } from '../utils/timing';\nimport { parse, readForm, readJson, verifyTurnstileToken } from '../utils/valid';\nimport {\n  MAX_ATTRIBUTES_BYTES,\n  attributesSchema,\n  attributesSize,\n  bodyAttributes,\n} from './attributes';\nimport { DesktopCodes } from './desktop-codes';\nimport { type EmailSender, EmailVerificationCodes } from './email-codes';\nimport { AuthenticationError } from './error';\nimport { errorResponse, invalidArgument, unauthenticated } from './respond';\nimport type {\n  AuthConfig,\n  AuthService,\n  Authorization,\n  AuthorizedHandler,\n  LoggedHandler,\n  OAuth2AuthorizationOptions,\n} from './types';\n\n// PKCE per RFC 7636: code_verifier / code_challenge are 43-128 chars from\n// the unreserved set. We restrict to base64url (drops \".\" and \"~\") since\n// that's what S256 produces and what callers should be sending; rejecting\n// the rest shrinks the accepted input shape without losing legit clients.\n// A 32-byte random verifier base64url-encodes to exactly 43 chars.\nconst PKCE_FORMAT = /^[A-Za-z0-9_-]{43,128}$/;\n\n// A native app's `code_verifier` goes on to the provider, which checks it against the challenge\n// the app sent: accept the whole RFC 7636 unreserved set here, as the provider does.\nconst CODE_VERIFIER_FORMAT = /^[A-Za-z0-9._~-]{43,128}$/;\n\n/** The header a session id travels in besides the cookie, with `session.header` on. */\nconst SESSION_HEADER = 'X-Auth-Token';\n\n/** Seconds an OAuth2 state or nonce may be used within. */\nconst OAUTH2_PARAMETER_TTL = 10 * 60;\n\n// error_description forwarded to errorUri comes from the provider or an error message: cap it so\n// the redirect URL stays short and an attacker-crafted callback cannot stuff the page with text.\nconst MAX_ERROR_DESCRIPTION_LENGTH = 256;\n\n/** An error code safe to put on errorUri: a registered one as is, anything else as `fallback`. */\nfunction safeErrorType(error: string, fallback: OAuth2ErrorType): OAuth2ErrorType {\n  return isKnownOAuth2ErrorType(error) ? error : fallback;\n}\n\n/**\n * The codes a failure past validation keeps on errorUri, each one the user can act on: the code\n * expired or was used (start again), they declined, or the provider is briefly down. Every other\n * failure there (a rejected client, a user info request that failed) is the app's or the\n * provider's problem, which the user sees as `server_error`.\n */\nconst CALLBACK_ERROR_TYPES: ReadonlySet<OAuth2ErrorType> = new Set([\n  'invalid_grant',\n  'access_denied',\n  'temporarily_unavailable',\n]);\n\nfunction authorizationAttributes(\n  attributes: OAuth2AuthorizationOptions['attributes']\n): Record<string, string> | undefined {\n  if (!attributes) return undefined;\n  const defined: Record<string, string> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    if (value !== undefined) defined[key] = value;\n  }\n  if (Object.keys(defined).length === 0) return undefined;\n  // The host's own values, written with the session: oversized is a bug in the host, not a 400.\n  const size = attributesSize(defined);\n  invariant(\n    size <= MAX_ATTRIBUTES_BYTES,\n    `oauth2 authorization attributes are ${size} bytes, at most ${MAX_ATTRIBUTES_BYTES} allowed`\n  );\n  return defined;\n}\n\n/** Sign in with Apple answers with `response_mode=form_post`; a charset parameter may follow. */\nfunction isFormPost(request: Request) {\n  const contentType = request.headers.get('content-type')?.toLowerCase();\n  return (\n    request.method === 'POST' && !!contentType?.startsWith('application/x-www-form-urlencoded')\n  );\n}\n\n/** Google's own form post carries no attributes; an app posting JSON may add them. */\nconst oneTapBodySchema = extend(googleOneTapSchema, { attributes: attributesSchema });\n\nconst desktopAuthorizeSchema = object({\n  code_challenge: string().check(regex(PKCE_FORMAT)),\n  code_challenge_method: literal('S256'),\n});\n\nconst desktopExchangeSchema = object({\n  code: string(),\n  code_verifier: string().check(regex(PKCE_FORMAT)),\n});\n\nexport const PATH = {\n  CSRF: '/csrf',\n  LOGOUT: '/logout',\n  LOGGED: '/logged',\n\n  OAUTH2_STATE: '/oauth2/state/:provider',\n  OAUTH2_NONCE: '/oauth2/nonce/:provider',\n  OAUTH2_AUTHORIZATION: '/oauth2/authorization/:provider',\n  LOGIN_OAUTH2_CODE: '/login/oauth2/code/:provider',\n  LOGIN_OAUTH2_NATIVE: '/login/oauth2/native/:provider',\n  LOGIN_OAUTH2_ONETAP: '/login/oauth2/onetap/google',\n\n  LOGIN_EMAIL: '/login/email',\n  SEND_EMAIL_VERIFICATION_CODE: '/auth/sendEmailVerificationCode',\n\n  // Desktop / native app sign-in via web loopback (RFC 8252 + OAuth 2.1 Auth Code Flow):\n  //   1. user already authenticated with cookie session → POST DESKTOP_AUTHORIZE → { code }\n  //   2. web redirects to desktop's loopback callback with the code\n  //   3. desktop renderer POSTs DESKTOP_EXCHANGE with the code → server returns\n  //      Set-Cookie carrying a fresh session, single-use code is invalidated\n  // The two-step flow keeps the actual session id off the redirect URL — only a\n  // 5-minute single-use code transits via the loopback.\n  DESKTOP_AUTHORIZE: '/auth/desktop/authorize',\n  DESKTOP_EXCHANGE: '/auth/desktop/exchange',\n\n  CLEANUP_EXPIRED_SESSIONS: '/sessions/expired/cleanup',\n} as const;\n\n/**\n * The login routes and session helpers. Every route is one straight line: read and validate the\n * request, check the credential, call the host's `onAuthorized`, sign in. Failures are thrown and\n * answered in one place per kind of route: a JSON route runs under `guard`, which maps a\n * `RequestError`, an `AuthenticationError` or an `OAuth2Error` to its google.rpc body (see\n * `respond.ts`); the redirect callback maps the same errors to `errorUri` parameters (`redirect`).\n */\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n  private readonly turnstileSecretKey?: string;\n  private readonly emailCodes: EmailVerificationCodes;\n  private readonly desktopCodes: DesktopCodes;\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly onetapRequireNonce: boolean;\n  private readonly touchInterval: number;\n  private readonly sessionHeader: boolean;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({\n    sessionRepository,\n    kvRepository,\n    turnstileSecretKey,\n    verificationCode,\n    oauth2,\n    cookie,\n    session,\n    timing,\n  }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    this.turnstileSecretKey = turnstileSecretKey;\n    const maxAttempts = verificationCode?.maxAttempts ?? 5;\n    const resendCooldown = verificationCode?.resendCooldown ?? 60;\n    invariant(maxAttempts >= 1, 'verificationCode.maxAttempts must be at least 1');\n    invariant(resendCooldown >= 1, 'verificationCode.resendCooldown must be at least 1 second');\n    this.emailCodes = new EmailVerificationCodes(kvRepository, { maxAttempts, resendCooldown });\n    this.desktopCodes = new DesktopCodes(kvRepository);\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n    this.onetapRequireNonce = oauth2?.onetap?.requireNonce ?? true;\n    this.touchInterval = (session?.touchInterval ?? 3600) * 1000;\n    this.sessionHeader = session?.header ?? false;\n    invariant(this.touchInterval >= 0, 'session.touchInterval must not be negative');\n  }\n\n  // ---- sessions and responses ------------------------------------------------------------------\n\n  private getSessionId(request: Request): string | undefined {\n    const fromCookie = getCookie(request, this.cookieName);\n    if (fromCookie) return fromCookie;\n    return (this.sessionHeader && request.headers.get(SESSION_HEADER)) || undefined;\n  }\n\n  /** The session the request carries, if it exists. */\n  private async loadSession(request: Request): Promise<Session | null> {\n    const sessionId = this.getSessionId(request);\n    return sessionId ? this.repository.findById(sessionId) : null;\n  }\n\n  /** The signed-in principal of a session, if any. */\n  private principalOf(session: Session): Principal | null {\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    return name ? { name: String(name) } : null;\n  }\n\n  /**\n   * A new session signed in as `principal`. With `carryOver`, what the host kept in the pre-login\n   * session moves to the new one; the authorization request (state, PKCE verifier, flow\n   * attributes) is single-use and was consumed, and a principal left there from an earlier\n   * sign-in is replaced. The new id is never the one the browser brought, which may have been\n   * planted by an attacker who started the flow (session fixation).\n   */\n  private async signIn(principal: Principal, carryOver?: Session): Promise<Session> {\n    const session = this.repository.createSession();\n    for (const attribute of carryOver?.getAttributeNames() ?? []) {\n      if (attribute === this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) continue;\n      if (attribute === PRINCIPAL_NAME_INDEX_NAME) continue;\n      const value = carryOver?.getAttribute(attribute);\n      if (value !== null && value !== undefined) session.setAttribute(attribute, value);\n    }\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    return session;\n  }\n\n  /**\n   * `response` carrying `session`: its cookie, renewed for the whole inactive interval, and with\n   * `session.header` on, the `X-Auth-Token` header a client without a cookie jar reads.\n   */\n  private withSession(response: Response, session: Session, cookie?: CookieOptions): Response {\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), {\n      ...this.cookieOptions,\n      ...cookie,\n      maxAge,\n    });\n    if (this.sessionHeader) response.headers.set(SESSION_HEADER, session.getId());\n    return response;\n  }\n\n  /** Runs a JSON route: a failure it knows is its response, anything else is the host's. */\n  private async guard(run: () => Promise<Response>): Promise<Response> {\n    try {\n      return await run();\n    } catch (error) {\n      const response = errorResponse(error);\n      if (response) return response;\n      throw error;\n    }\n  }\n\n  /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */\n  private redirect(\n    error: OAuth2ErrorType,\n    description?: string,\n    refusal?: AuthenticationError\n  ): Response {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    // Metadata never replaces a parameter: not one errorUri carries itself, nor one set below.\n    for (const [key, value] of Object.entries(refusal?.metadata ?? {})) {\n      if (!uri.searchParams.has(key)) uri.searchParams.set(key, value);\n    }\n    uri.searchParams.set('error', error);\n    if (description) {\n      uri.searchParams.set('error_description', description.slice(0, MAX_ERROR_DESCRIPTION_LENGTH));\n    }\n    if (refusal) uri.searchParams.set('reason', refusal.reason);\n    return Response.redirect(uri.href, 302);\n  }\n\n  // ---- basic -----------------------------------------------------------------------------------\n\n  csrf = async (_request: Request): Promise<Response> => {\n    const token = randomUUID();\n    const response = Response.json({\n      token,\n      parameterName: '_csrf',\n      headerName: 'X-XSRF-TOKEN',\n    });\n\n    // Double Submit Cookie Protection\n    setCookie(response, 'XSRF-TOKEN', token, {\n      path: '/',\n      secure: true,\n      httpOnly: false,\n      sameSite: 'none',\n      domain: this.cookieOptions.domain,\n    });\n    return response;\n  };\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = this.getSessionId(request);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    // A Set-Cookie only replaces the stored cookie when Domain and Path match (RFC 6265),\n    // so clear it with the same attributes it was set with.\n    deleteCookie(response, this.cookieName, this.cookieOptions);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    const session = await this.loadSession(request);\n    if (!session) return Response.json({ data: false });\n\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    const principal = this.principalOf(session);\n    if (principal) await onLogged?.(principal);\n    return this.withSession(Response.json({ data: principal !== null }), session);\n  };\n\n  // ---- oauth2 ----------------------------------------------------------------------------------\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  /**\n   * Spends a nonce `oauth2Nonce` issued for `provider`: `NONCE_MISMATCH` for one that was not,\n   * or was used already. An id token is replayable until it expires; the nonce it carries makes\n   * it sign in once.\n   */\n  private async consumeNonce(nonce: string, provider: string): Promise<void> {\n    const key = this.getOauth2NonceKey(nonce);\n    if ((await this.kv.getItem(key)) !== provider) throw new AuthenticationError('NONCE_MISMATCH');\n    await this.kv.removeItem(key);\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = (\n    request: Request,\n    options?: OAuth2AuthorizationOptions\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const attributes = authorizationAttributes(options?.attributes);\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.OAUTH2_AUTHORIZATION);\n      const state = randomUUID();\n      const pkce = this.createPkceParameters();\n      const uri = await this.oauth2Client.createAuthorizationUri({ provider, state, pkce });\n      const session = (await this.loadSession(request)) ?? this.repository.createSession();\n      mark('fetch_session');\n\n      const authorizationRequest: OAuth2AuthorizationRequest = {\n        state,\n        provider,\n        authorizationRequestUri: uri.href,\n        additionalParameters: pkce,\n        ...(attributes ? { attributes } : {}),\n      };\n      session.setAttribute(\n        this.ATTR_OAUTH2_AUTHORIZATION_REQUEST,\n        JSON.stringify(authorizationRequest)\n      );\n      await this.repository.save(session);\n      mark('save_session');\n\n      const response = new Response(null, { status: 302, headers: { location: uri.href } });\n      setTiming(response);\n      return this.withSession(response, session);\n    });\n\n  loginOAuth2Code = async (request: Request, handler: AuthorizedHandler): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. the session the flow started on, and the authorization request it stored\n    const session = await this.loadSession(request);\n    if (!session) return this.redirect('invalid_request', 'session not found');\n    mark('load_session');\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) return this.redirect('invalid_request', 'authorization request not found');\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 2. the provider's answer: query, or a form for Apple's response_mode=form_post\n    const { provider } = param(request, PATH.LOGIN_OAUTH2_CODE);\n    const data = isFormPost(request)\n      ? Object.fromEntries(new URLSearchParams(await request.text()))\n      : query(request);\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) return this.redirect('invalid_request', 'invalid redirect query');\n    // The provider answered with an error instead of a code (the user pressed Cancel →\n    // access_denied, invalid_scope, server_error, ...). Forward it rather than reporting a\n    // malformed query. This runs before the state check on purpose: providers echo state on\n    // error responses, but not all reliably do, and a forged error callback can only make the\n    // victim's popup show an error — nothing is exchanged or signed in. A present state that does\n    // not match still wins, since that is the more accurate (and more alarming) diagnosis.\n    if (parsed.data.error) {\n      if (parsed.data.state && parsed.data.state !== cached.state) {\n        return this.redirect('invalid_request', 'redirect state mismatch');\n      }\n      return this.redirect(\n        safeErrorType(parsed.data.error, 'server_error'),\n        parsed.data.error_description\n      );\n    }\n    const { code, state, user } = parsed.data;\n    if (!code || !state) return this.redirect('invalid_request', 'invalid redirect query');\n    if (state !== cached.state) return this.redirect('invalid_request', 'redirect state mismatch');\n    if (provider !== cached.provider) {\n      return this.redirect('invalid_request', 'redirect provider mismatch');\n    }\n    mark('validate_session');\n\n    // 3. exchange the code, load the user, sign in. Everything here can fail (an expired or reused\n    // code, a network error, the host's handler or session store). The callback runs in a popup\n    // the user is looking at, so every failure must land on errorUri, never as a JSON error.\n    let signedIn: Session;\n    try {\n      const { clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n        provider,\n        code,\n        pkce: cached.additionalParameters,\n      });\n      // Apple posts the user's name alongside the code, once: hand it to the provider with the token.\n      const userInfo = await this.oauth2Client.getUserInfo({\n        provider,\n        clientId,\n        token,\n        response: user ? { user } : undefined,\n      });\n      mark('exchange_code');\n\n      const principal = await handler(request, {\n        provider,\n        clientId,\n        userInfo,\n        token,\n        attributes: cached.attributes ?? {},\n      });\n      mark('save_principal');\n\n      signedIn = await this.signIn(principal, session);\n      await this.repository.deleteById(session.getId());\n      mark('update_session');\n    } catch (error) {\n      // The details stay in the logs: an OAuth2Error message can carry a client id or a\n      // provider's response, which has no place in a URL the browser keeps in its history.\n      if (error instanceof OAuth2Error) {\n        console.warn('OAuth2 callback failed', error);\n        const type = CALLBACK_ERROR_TYPES.has(error.error) ? error.error : 'server_error';\n        return this.redirect(type);\n      }\n      // A refusal is something the user can act on, so its reason and metadata reach the page,\n      // as they reach a JSON client through the ErrorInfo.\n      if (error instanceof AuthenticationError) {\n        console.warn('OAuth2 sign-in refused', error.reason, error.metadata);\n        return this.redirect('access_denied', undefined, error);\n      }\n      console.error('OAuth2 callback failed', error);\n      return this.redirect('server_error');\n    }\n\n    const uri = new URL(this.oauth2Client.successUri);\n    uri.searchParams.set('status', 'success');\n    uri.searchParams.set('provider', provider);\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    setTiming(response);\n    return this.withSession(response, signedIn);\n  };\n\n  /** The shared tail of the JSON login routes: the host's handler, then a signed-in session. */\n  private async authorize(\n    request: Request,\n    handler: AuthorizedHandler,\n    authorization: Authorization,\n    setTiming: (response: Response) => void\n  ): Promise<Response> {\n    const principal = await handler(request, authorization);\n    const session = await this.signIn(principal);\n    const response = Response.json(principal);\n    setTiming(response);\n    return this.withSession(response, session);\n  }\n\n  loginOAuth2Native = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.LOGIN_OAUTH2_NATIVE);\n      const body = await readJson(request);\n      // Whatever the app sends besides its credentials for `onAuthorized` (a referral code, ...).\n      const attributes = bodyAttributes(body);\n      // Only the credentials go on to the provider client.\n      const { attributes: _, ...credentials } = body as NativeCredential & { attributes?: unknown };\n      const { code_verifier } = credentials as { code_verifier?: unknown };\n      if (\n        code_verifier !== undefined &&\n        (typeof code_verifier !== 'string' || !CODE_VERIFIER_FORMAT.test(code_verifier))\n      ) {\n        throw invalidArgument(\n          'INVALID_CODE_VERIFIER',\n          'code_verifier must be 43-128 characters from [A-Za-z0-9-._~]'\n        );\n      }\n      const { clientId, userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n        provider,\n        credentials,\n      });\n      mark('login_oauth2_native');\n\n      const { nonce } = userInfo.data as { nonce?: unknown };\n      if (typeof nonce === 'string' && nonce) {\n        await this.consumeNonce(nonce, provider);\n        mark('check_nonce');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  loginOAuth2Onetap = (\n    request: Request,\n    handler: AuthorizedHandler,\n    provider = 'google'\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n\n      // Google's own form post, or an app's JSON.\n      const contentType = request.headers.get('content-type') ?? '';\n      const body = contentType.includes('application/json')\n        ? await readJson(request)\n        : await readForm(request);\n      const { attributes = {}, ...parsed } = parse(oneTapBodySchema, body);\n\n      // Both the credential and the code are issued to the provider's web client.\n      let clientId: string;\n      let token: Authorization['token'];\n      let userInfo: Authorization['userInfo'];\n      if (parsed.credential) {\n        ({ clientId, token, userInfo } = await this.oauth2Client.getTokenInfo({\n          provider,\n          credential: parsed.credential,\n        }));\n        mark('verify_credential');\n\n        // A credential is replayable until it expires, so it must carry a single-use nonce from\n        // `oauth2Nonce`, which the front end passed to `prompt`. This replaces Google's\n        // `g_csrf_token` double-submit cookie, which FedCM mode no longer sets.\n        const { nonce } = userInfo.data as { nonce?: unknown };\n        if (typeof nonce === 'string' && nonce) {\n          await this.consumeNonce(nonce, provider);\n          mark('check_nonce');\n        } else if (this.onetapRequireNonce) {\n          throw new AuthenticationError('NONCE_MISSING');\n        }\n      } else if (parsed.code) {\n        ({ clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n          provider,\n          code: parsed.code,\n        }));\n        userInfo = await this.oauth2Client.getUserInfo({ provider, clientId, token });\n      } else {\n        throw invalidArgument('INVALID_ARGUMENT', 'credential or code is required');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  // ---- email -----------------------------------------------------------------------------------\n\n  sendEmailVerificationCode = (request: Request, sender: EmailSender): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.turnstileSecretKey, 'turnstileSecretKey is not configured');\n      const { email, turnstileToken } = parse(\n        sendEmailVerificationCodeSchema,\n        await readJson(request)\n      );\n      await verifyTurnstileToken(this.turnstileSecretKey, turnstileToken);\n      await this.emailCodes.send(email, sender);\n      return Response.json({});\n    });\n\n  verifyEmailCode = (email: string, verificationCode: string): Promise<void> =>\n    this.emailCodes.verify(email, verificationCode);\n\n  loginEmail = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      const { setTiming } = timing({ enabled: this.timing });\n      const {\n        email,\n        verificationCode,\n        attributes = {},\n      } = parse(loginEmailSchema, await readJson(request));\n      await this.emailCodes.verify(email, verificationCode);\n      const claims: StandardClaims = { sub: email, email, email_verified: true };\n      return this.authorize(\n        request,\n        handler,\n        { provider: 'EMAIL', userInfo: { claims, data: {} }, attributes },\n        setTiming\n      );\n    });\n\n  // ---- desktop ---------------------------------------------------------------------------------\n\n  /**\n   * Step 1 of the desktop / native app sign-in handshake. The caller already completed normal\n   * sign-in on the web (so a cookie session exists); this issues a 5-minute single-use code that\n   * the web page hands off to the desktop client via a loopback redirect.\n   *\n   * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier` before opening the\n   * browser, derives `code_challenge = base64url(sha256(verifier))`, and threads the challenge\n   * through the URL → web page → here. The challenge is pinned to the code; `desktopExchange`\n   * enforces that the caller knows the matching verifier. This blocks an attacker who only\n   * intercepts the auth code (browser history, malicious extension, packet capture on loopback)\n   * from exchanging it.\n   *\n   * Requires an authenticated cookie session: anonymous callers get 401. Throttling / abuse\n   * protection on this endpoint is the API layer's job (rate-limit per principal); the SDK does\n   * not gate it because the upstream sign-in flow already passed CAPTCHA / OAuth / verification.\n   */\n  desktopAuthorize = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const principal = await this.getPrincipal(request);\n      if (!principal) throw unauthenticated('Sign in first');\n      const { code_challenge } = parse(desktopAuthorizeSchema, await readJson(request));\n      const code = await this.desktopCodes.issue(principal, code_challenge);\n      return Response.json({ code });\n    });\n\n  /**\n   * Step 2 of the desktop / native app sign-in handshake. The desktop client hands back the auth\n   * code it received via the loopback callback, and we mint a fresh session for it, independent\n   * of the web cookie session that originally authorized the code, so logging out on either side\n   * does not cascade to the other.\n   *\n   * Cookie attributes: `SameSite=None; Secure` so the cookie survives cross-site fetches from the\n   * desktop renderer's `file://` / `app://` origin. The configured `cookieOptions` provide\n   * everything else (`domain`, `path`, `httpOnly`); the override is targeted at the\n   * SameSite/Secure pair only. In a non-HTTPS dev backend this combination is rejected by\n   * Chromium, see the desktop sign-in PRD for workarounds.\n   *\n   * No CSRF check needed: the request carries no cookie, the auth code itself is the credential,\n   * and the code's single-use removal blocks replay.\n   */\n  desktopExchange = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const { code, code_verifier } = parse(desktopExchangeSchema, await readJson(request));\n      const principal = await this.desktopCodes.redeem(code, code_verifier);\n      const session = await this.signIn(principal);\n      session.setAttribute('client_type', 'desktop');\n      await this.repository.save(session);\n      return this.withSession(Response.json({ ok: true }), session, {\n        sameSite: 'none',\n        secure: true,\n      });\n    });\n\n  // ---- session management ----------------------------------------------------------------------\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  /**\n   * Sliding expiration: an authenticated request renews the session, as `logged` does, so a user\n   * who keeps using the app is never signed out after `maxInactiveInterval` of not calling one\n   * particular endpoint. No extra read: the session was just loaded to authenticate, and its\n   * `lastAccessedTime` is compared in memory; writes are spaced by `session.touchInterval` (see\n   * `AuthConfig`), so a session accessed again within the interval is not rewritten.\n   */\n  private async touch(session: Session) {\n    const now = Date.now();\n    if (now - session.getLastAccessedTime() < this.touchInterval) return;\n    session.setLastAccessedTime(now);\n    await this.repository.save(session);\n  }\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const session = await this.loadSession(request);\n    const principal = session && this.principalOf(session);\n    if (!principal) return null;\n    await this.touch(session);\n    return principal;\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    return (await this.getPrincipal(request)) !== null;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    type Result = T extends true ? Session : Session | null;\n    const session = await this.loadSession(request);\n    if (session || !create) return session as Result;\n    const created = this.repository.createSession();\n    await this.repository.save(created);\n    return created;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiDA,MAAM,cAAc;AAIpB,MAAM,uBAAuB;;AAG7B,MAAM,iBAAiB;;AAGvB,MAAM,uBAAuB;AAI7B,MAAM,+BAA+B;;AAGrC,SAAS,cAAc,OAAe,UAA4C;CAChF,OAAOA,qBAAAA,uBAAuB,KAAK,IAAI,QAAQ;AACjD;;;;;;;AAQA,MAAM,uCAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;AAED,SAAS,wBACP,YACoC;CACpC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAE1C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAE9C,MAAM,OAAOC,wBAAAA,eAAe,OAAO;CACnC,CAAA,GAAA,cAAA,UAAA,CACE,QAAQC,wBAAAA,sBACR,uCAAuC,KAAK,kBAAkBA,wBAAAA,qBAAqB,SACrF;CACA,OAAO;AACT;;AAGA,SAAS,WAAW,SAAkB;CACpC,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY;CACrE,OACE,QAAQ,WAAW,UAAU,CAAC,CAAC,aAAa,WAAW,mCAAmC;AAE9F;;AAGA,MAAM,oBAAA,GAAmBC,SAAAA,OAAAA,CAAOC,sBAAAA,oBAAoB,EAAE,YAAYC,wBAAAA,iBAAiB,CAAC;AAEpF,MAAM,0BAAA,GAAyBC,SAAAA,OAAAA,CAAO;CACpC,iBAAA,GAAgBC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,MAAAA,CAAM,WAAW,CAAC;CACjD,wBAAA,GAAuBC,SAAAA,QAAAA,CAAQ,MAAM;AACvC,CAAC;AAED,MAAM,yBAAA,GAAwBH,SAAAA,OAAAA,CAAO;CACnC,OAAA,GAAMC,SAAAA,OAAAA,CAAO;CACb,gBAAA,GAAeA,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,MAAAA,CAAM,WAAW,CAAC;AAClD,CAAC;AAED,MAAa,OAAO;CAClB,MAAM;CACN,QAAQ;CACR,QAAQ;CAER,cAAc;CACd,cAAc;CACd,sBAAsB;CACtB,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CAErB,aAAa;CACb,8BAA8B;CAS9B,mBAAmB;CACnB,kBAAkB;CAElB,0BAA0B;AAC5B;;;;;;;;AASA,IAAa,OAAb,MAAyC;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,oCAAqD;CAErD,YAAY,EACV,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACa;EACb,KAAK,SAAS,UAAU;EACxB,KAAK,KAAK;EACV,KAAK,aAAa;EAClB,KAAK,qBAAqB;EAC1B,MAAM,cAAc,kBAAkB,eAAe;EACrD,MAAM,iBAAiB,kBAAkB,kBAAkB;EAC3D,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,GAAG,iDAAiD;EAC7E,CAAA,GAAA,cAAA,UAAA,CAAU,kBAAkB,GAAG,2DAA2D;EAC1F,KAAK,aAAa,IAAIE,yBAAAA,uBAAuB,cAAc;GAAE;GAAa;EAAe,CAAC;EAC1F,KAAK,eAAe,IAAIC,2BAAAA,aAAa,YAAY;EACjD,MAAM,EAAE,MAAM,GAAG,kBAAkB,UAAU,CAAC;EAC9C,KAAK,aAAa,QAAQ;EAC1B,KAAK,gBAAgB;GACnB,MAAM;GACN,UAAU;GACV,QAAQ;GACR,UAAU;GACV,GAAG;EACL;EACA,KAAK,eAAe,QAAQ,SAAS,IAAIC,sBAAAA,aAAa,OAAO,MAAM,IAAI;EACvE,KAAK,qBAAqB,QAAQ,QAAQ,gBAAgB;EAC1D,KAAK,iBAAiB,SAAS,iBAAiB,QAAQ;EACxD,KAAK,gBAAgB,SAAS,UAAU;EACxC,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,iBAAiB,GAAG,4CAA4C;CACjF;CAIA,aAAqB,SAAsC;EACzD,MAAM,aAAaC,mBAAAA,UAAU,SAAS,KAAK,UAAU;EACrD,IAAI,YAAY,OAAO;EACvB,OAAQ,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,cAAc,KAAM,KAAA;CACxE;;CAGA,MAAc,YAAY,SAA2C;EACnE,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,OAAO,YAAY,KAAK,WAAW,SAAS,SAAS,IAAI;CAC3D;;CAGA,YAAoB,SAAoC;EACtD,MAAM,OAAO,QAAQ,aAAaC,uBAAAA,yBAAyB;EAC3D,OAAO,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI;CACzC;;;;;;;;CASA,MAAc,OAAO,WAAsB,WAAuC;EAChF,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,KAAK,MAAM,aAAa,WAAW,kBAAkB,KAAK,CAAC,GAAG;GAC5D,IAAI,cAAc,KAAK,mCAAmC;GAC1D,IAAI,cAAA,iBAAyC;GAC7C,MAAM,QAAQ,WAAW,aAAa,SAAS;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,QAAQ,aAAa,WAAW,KAAK;EAClF;EACA,QAAQ,aAAaA,uBAAAA,2BAA2B,UAAU,IAAI;EAC9D,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;;;;;CAMA,YAAoB,UAAoB,SAAkB,QAAkC;EAC1F,MAAM,SAAS,QAAQ,uBAAuB;EAC9C,mBAAA,UAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG;GACpD,GAAG,KAAK;GACR,GAAG;GACH;EACF,CAAC;EACD,IAAI,KAAK,eAAe,SAAS,QAAQ,IAAI,gBAAgB,QAAQ,MAAM,CAAC;EAC5E,OAAO;CACT;;CAGA,MAAc,MAAM,KAAiD;EACnE,IAAI;GACF,OAAO,MAAM,IAAI;EACnB,SAAS,OAAO;GACd,MAAM,WAAWC,qBAAAA,cAAc,KAAK;GACpC,IAAI,UAAU,OAAO;GACrB,MAAM;EACR;CACF;;CAGA,SACE,OACA,aACA,SACU;EACV,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;EAE9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,GAC/D,IAAI,CAAC,IAAI,aAAa,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAEjE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,aACF,IAAI,aAAa,IAAI,qBAAqB,YAAY,MAAM,GAAG,4BAA4B,CAAC;EAE9F,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EAC1D,OAAO,SAAS,SAAS,IAAI,MAAM,GAAG;CACxC;CAIA,OAAO,OAAO,aAAyC;EACrD,MAAM,SAAA,GAAQC,YAAAA,WAAAA,CAAW;EACzB,MAAM,WAAW,SAAS,KAAK;GAC7B;GACA,eAAe;GACf,YAAY;EACd,CAAC;EAGD,mBAAA,UAAU,UAAU,cAAc,OAAO;GACvC,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,KAAK,cAAc;EAC7B,CAAC;EACD,OAAO;CACT;CAEA,SAAS,OAAO,YAAwC;EACtD,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,IAAI,WAAW,MAAM,KAAK,WAAW,WAAW,SAAS;EACzD,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC;EAGjC,mBAAA,aAAa,UAAU,KAAK,YAAY,KAAK,aAAa;EAC1D,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,aAAgD;EAChF,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;EAElD,QAAQ,oBAAoB,KAAK,IAAI,CAAC;EACtC,MAAM,KAAK,WAAW,KAAK,OAAO;EAElC,MAAM,YAAY,KAAK,YAAY,OAAO;EAC1C,IAAI,WAAW,MAAM,WAAW,SAAS;EACzC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,OAAO;CAC9E;CAIA,uBAA+C;EAC7C,MAAM,iBAAA,GAAgBA,YAAAA,WAAAA,CAAW;EAMjC,OAAO;GAAE;GAAe,iBAAA,GALDC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,CAAC,CACR,SAAS,WAEyB;GAAG,uBAAuB;EAAO;CACxE;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;;;;;;CAOA,MAAc,aAAa,OAAe,UAAiC;EACzE,MAAM,MAAM,KAAK,kBAAkB,KAAK;EACxC,IAAK,MAAM,KAAK,GAAG,QAAQ,GAAG,MAAO,UAAU,MAAM,IAAIC,mBAAAA,oBAAoB,gBAAgB;EAC7F,MAAM,KAAK,GAAG,WAAW,GAAG;CAC9B;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAaC,mBAAAA,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,SAAA,GAAQH,YAAAA,WAAAA,CAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAaG,mBAAAA,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,SAAA,GAAQH,YAAAA,WAAAA,CAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,uBACE,SACA,YAEA,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,aAAa,wBAAwB,SAAS,UAAU;EAC9D,MAAM,EAAE,MAAM,cAAcI,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,oBAAoB;EAC7D,MAAM,SAAA,GAAQH,YAAAA,WAAAA,CAAW;EACzB,MAAM,OAAO,KAAK,qBAAqB;EACvC,MAAM,MAAM,MAAM,KAAK,aAAa,uBAAuB;GAAE;GAAU;GAAO;EAAK,CAAC;EACpF,MAAM,UAAW,MAAM,KAAK,YAAY,OAAO,KAAM,KAAK,WAAW,cAAc;EACnF,KAAK,eAAe;EAEpB,MAAM,uBAAmD;GACvD;GACA;GACA,yBAAyB,IAAI;GAC7B,sBAAsB;GACtB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC;EACA,QAAQ,aACN,KAAK,mCACL,KAAK,UAAU,oBAAoB,CACrC;EACA,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,KAAK,cAAc;EAEnB,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C,CAAC;CAEH,kBAAkB,OAAO,SAAkB,YAAkD;EAC3F,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcI,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAG3D,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,mBAAmB,mBAAmB;EACzE,KAAK,cAAc;EACnB,MAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;EACxE,IAAI,CAAC,MAAM,OAAO,KAAK,SAAS,mBAAmB,iCAAiC;EACpF,MAAM,SAAqC,KAAK,MAAM,IAAI;EAG1D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,iBAAiB;EAC1D,MAAM,OAAO,WAAW,OAAO,IAC3B,OAAO,YAAY,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC,CAAC,IAC5DE,mBAAAA,MAAM,OAAO;EACjB,MAAM,SAASC,sBAAAA,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EAOrF,IAAI,OAAO,KAAK,OAAO;GACrB,IAAI,OAAO,KAAK,SAAS,OAAO,KAAK,UAAU,OAAO,OACpD,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;GAEnE,OAAO,KAAK,SACV,cAAc,OAAO,KAAK,OAAO,cAAc,GAC/C,OAAO,KAAK,iBACd;EACF;EACA,MAAM,EAAE,MAAM,OAAO,SAAS,OAAO;EACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EACrF,IAAI,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;EAC7F,IAAI,aAAa,OAAO,UACtB,OAAO,KAAK,SAAS,mBAAmB,4BAA4B;EAEtE,KAAK,kBAAkB;EAKvB,IAAI;EACJ,IAAI;GACF,MAAM,EAAE,UAAU,UAAU,MAAM,KAAK,aAAa,0BAA0B;IAC5E;IACA;IACA,MAAM,OAAO;GACf,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,aAAa,YAAY;IACnD;IACA;IACA;IACA,UAAU,OAAO,EAAE,KAAK,IAAI,KAAA;GAC9B,CAAC;GACD,KAAK,eAAe;GAEpB,MAAM,YAAY,MAAM,QAAQ,SAAS;IACvC;IACA;IACA;IACA;IACA,YAAY,OAAO,cAAc,CAAC;GACpC,CAAC;GACD,KAAK,gBAAgB;GAErB,WAAW,MAAM,KAAK,OAAO,WAAW,OAAO;GAC/C,MAAM,KAAK,WAAW,WAAW,QAAQ,MAAM,CAAC;GAChD,KAAK,gBAAgB;EACvB,SAAS,OAAO;GAGd,IAAI,iBAAiBC,qBAAAA,aAAa;IAChC,QAAQ,KAAK,0BAA0B,KAAK;IAC5C,MAAM,OAAO,qBAAqB,IAAI,MAAM,KAAK,IAAI,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,IAAI;GAC3B;GAGA,IAAI,iBAAiBL,mBAAAA,qBAAqB;IACxC,QAAQ,KAAK,0BAA0B,MAAM,QAAQ,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,iBAAiB,KAAA,GAAW,KAAK;GACxD;GACA,QAAQ,MAAM,0BAA0B,KAAK;GAC7C,OAAO,KAAK,SAAS,cAAc;EACrC;EAEA,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,UAAU;EAChD,IAAI,aAAa,IAAI,UAAU,SAAS;EACxC,IAAI,aAAa,IAAI,YAAY,QAAQ;EACzC,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,QAAQ;CAC5C;;CAGA,MAAc,UACZ,SACA,SACA,eACA,WACmB;EACnB,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa;EACtD,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,MAAM,WAAW,SAAS,KAAK,SAAS;EACxC,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;CAEA,qBAAqB,SAAkB,YACrC,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcE,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,mBAAmB;EAC5D,MAAM,OAAO,MAAMK,oBAAAA,SAAS,OAAO;EAEnC,MAAM,aAAaC,wBAAAA,eAAe,IAAI;EAEtC,MAAM,EAAE,YAAY,GAAG,GAAG,gBAAgB;EAC1C,MAAM,EAAE,kBAAkB;EAC1B,IACE,kBAAkB,KAAA,MACjB,OAAO,kBAAkB,YAAY,CAAC,qBAAqB,KAAK,aAAa,IAE9E,MAAMC,qBAAAA,gBACJ,yBACA,8DACF;EAEF,MAAM,EAAE,UAAU,UAAU,UAAU,MAAM,KAAK,aAAa,kBAAkB;GAC9E;GACA;EACF,CAAC;EACD,KAAK,qBAAqB;EAE1B,MAAM,EAAE,UAAU,SAAS;EAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;GACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;GACvC,KAAK,aAAa;EACpB;EAEA,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAEH,qBACE,SACA,SACA,WAAW,aAEX,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcN,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAI3D,MAAM,QADc,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAClC,SAAS,kBAAkB,IAChD,MAAMI,oBAAAA,SAAS,OAAO,IACtB,MAAMG,oBAAAA,SAAS,OAAO;EAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,GAAG,WAAWC,oBAAAA,MAAM,kBAAkB,IAAI;EAGnE,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,YAAY;GACrB,CAAC,CAAE,UAAU,OAAO,YAAa,MAAM,KAAK,aAAa,aAAa;IACpE;IACA,YAAY,OAAO;GACrB,CAAC;GACD,KAAK,mBAAmB;GAKxB,MAAM,EAAE,UAAU,SAAS;GAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;IACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;IACvC,KAAK,aAAa;GACpB,OAAO,IAAI,KAAK,oBACd,MAAM,IAAIV,mBAAAA,oBAAoB,eAAe;EAEjD,OAAO,IAAI,OAAO,MAAM;GACtB,CAAC,CAAE,UAAU,SAAU,MAAM,KAAK,aAAa,0BAA0B;IACvE;IACA,MAAM,OAAO;GACf,CAAC;GACD,WAAW,MAAM,KAAK,aAAa,YAAY;IAAE;IAAU;IAAU;GAAM,CAAC;EAC9E,OACE,MAAMQ,qBAAAA,gBAAgB,oBAAoB,gCAAgC;EAG5E,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAIH,6BAA6B,SAAkB,WAC7C,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,oBAAoB,sCAAsC;EACzE,MAAM,EAAE,OAAO,mBAAmBE,oBAAAA,MAChCC,qBAAAA,iCACA,MAAML,oBAAAA,SAAS,OAAO,CACxB;EACA,MAAMM,oBAAAA,qBAAqB,KAAK,oBAAoB,cAAc;EAClE,MAAM,KAAK,WAAW,KAAK,OAAO,MAAM;EACxC,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB,CAAC;CAEH,mBAAmB,OAAe,qBAChC,KAAK,WAAW,OAAO,OAAO,gBAAgB;CAEhD,cAAc,SAAkB,YAC9B,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,cAAcV,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EACrD,MAAM,EACJ,OACA,kBACA,aAAa,CAAC,MACZQ,oBAAAA,MAAMG,qBAAAA,kBAAkB,MAAMP,oBAAAA,SAAS,OAAO,CAAC;EACnD,MAAM,KAAK,WAAW,OAAO,OAAO,gBAAgB;EACpD,MAAM,SAAyB;GAAE,KAAK;GAAO;GAAO,gBAAgB;EAAK;EACzE,OAAO,KAAK,UACV,SACA,SACA;GAAE,UAAU;GAAS,UAAU;IAAE;IAAQ,MAAM,CAAC;GAAE;GAAG;EAAW,GAChE,SACF;CACF,CAAC;;;;;;;;;;;;;;;;;CAoBH,oBAAoB,YAClB,KAAK,MAAM,YAAY;EACrB,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO;EACjD,IAAI,CAAC,WAAW,MAAMQ,qBAAAA,gBAAgB,eAAe;EACrD,MAAM,EAAE,mBAAmBJ,oBAAAA,MAAM,wBAAwB,MAAMJ,oBAAAA,SAAS,OAAO,CAAC;EAChF,MAAM,OAAO,MAAM,KAAK,aAAa,MAAM,WAAW,cAAc;EACpE,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;CAC/B,CAAC;;;;;;;;;;;;;;;;CAiBH,mBAAmB,YACjB,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,MAAM,kBAAkBI,oBAAAA,MAAM,uBAAuB,MAAMJ,oBAAAA,SAAS,OAAO,CAAC;EACpF,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO,MAAM,aAAa;EACpE,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,QAAQ,aAAa,eAAe,SAAS;EAC7C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,SAAS;GAC5D,UAAU;GACV,QAAQ;EACV,CAAC;CACH,CAAC;CAIH,OAAO,OAAO,cAAwC;EACpD,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,KAAK,MAAM,aAAa,SAAS,KAAK,GACpC,MAAM,KAAK,WAAW,WAAW,SAAS;CAE9C;;;;;;;;CASA,MAAc,MAAM,SAAkB;EACpC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,QAAQ,oBAAoB,IAAI,KAAK,eAAe;EAC9D,QAAQ,oBAAoB,GAAG;EAC/B,MAAM,KAAK,WAAW,KAAK,OAAO;CACpC;CAEA,eAAe,OAAO,YAAgD;EACpE,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;EACrD,IAAI,CAAC,WAAW,OAAO;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,OAAO;CACT;CAEA,kBAAkB,OAAO,YAAuC;EAC9D,OAAQ,MAAM,KAAK,aAAa,OAAO,MAAO;CAChD;CAEA,aAAa,OACX,SACA,WACuD;EAEvD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,WAAW,CAAC,QAAQ,OAAO;EAC/B,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;CAEA,gBAAgB,OAAO,cAAqC;EAC1D,MAAM,KAAK,WAAW,WAAW,SAAS;CAC5C;CAEA,eAAe,OAAO,cAA6C;EACjE,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;CACrC;CAEA,yBAAyB,OAAO,iBAA6C;EAC3E,MAAM,KAAK,WAAW,uBAAuB,YAAY;EACzD,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB;AACF"}
+{"version":3,"file":"index.cjs","names":["isKnownOAuth2ErrorType","attributesSize","MAX_ATTRIBUTES_BYTES","extend","googleOneTapSchema","attributesSchema","object","string","regex","literal","EmailVerificationCodes","DesktopCodes","OAuth2Client","getCookie","PRINCIPAL_NAME_INDEX_NAME","errorResponse","randomUUID","randomBytes","createHash","AuthenticationError","param","timing","query","oauth2RedirectQuerySchema","OAuth2Error","readJson","bodyAttributes","invalidArgument","readForm","parse","sendEmailVerificationCodeSchema","verifyTurnstileToken","loginEmailSchema","unauthenticated"],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomUUID } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { extend, literal, object, regex, string } from 'zod/mini';\nimport type { Principal } from '../core/index';\nimport { loginEmailSchema, sendEmailVerificationCodeSchema } from '../email/schema';\nimport { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2Error, type OAuth2ErrorType, isKnownOAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredential,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n  StandardClaims,\n} from '../oauth2/types';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport {\n  type CookieOptions,\n  deleteCookie,\n  getCookie,\n  param,\n  query,\n  setCookie,\n} from '../utils/http';\nimport { timing } from '../utils/timing';\nimport { parse, readForm, readJson, verifyTurnstileToken } from '../utils/valid';\nimport {\n  MAX_ATTRIBUTES_BYTES,\n  attributesSchema,\n  attributesSize,\n  bodyAttributes,\n} from './attributes';\nimport { DesktopCodes } from './desktop-codes';\nimport { type EmailSender, EmailVerificationCodes } from './email-codes';\nimport { AuthenticationError } from './error';\nimport { errorResponse, invalidArgument, unauthenticated } from './respond';\nimport type {\n  AuthConfig,\n  AuthService,\n  Authorization,\n  AuthorizedHandler,\n  LoggedHandler,\n  OAuth2AuthorizationOptions,\n} from './types';\n\n// PKCE per RFC 7636: code_verifier / code_challenge are 43-128 chars from\n// the unreserved set. We restrict to base64url (drops \".\" and \"~\") since\n// that's what S256 produces and what callers should be sending; rejecting\n// the rest shrinks the accepted input shape without losing legit clients.\n// A 32-byte random verifier base64url-encodes to exactly 43 chars.\nconst PKCE_FORMAT = /^[A-Za-z0-9_-]{43,128}$/;\n\n// A native app's `code_verifier` goes on to the provider, which checks it against the challenge\n// the app sent: accept the whole RFC 7636 unreserved set here, as the provider does.\nconst CODE_VERIFIER_FORMAT = /^[A-Za-z0-9._~-]{43,128}$/;\n\n/** The header a session id travels in besides the cookie, with `session.header` on. */\nconst SESSION_HEADER = 'X-Auth-Token';\n\n/** Seconds an OAuth2 state or nonce may be used within. */\nconst OAUTH2_PARAMETER_TTL = 10 * 60;\n\n// error_description forwarded to errorUri comes from the provider or an error message: cap it so\n// the redirect URL stays short and an attacker-crafted callback cannot stuff the page with text.\nconst MAX_ERROR_DESCRIPTION_LENGTH = 256;\n\n/** An error code safe to put on errorUri: a registered one as is, anything else as `fallback`. */\nfunction safeErrorType(error: string, fallback: OAuth2ErrorType): OAuth2ErrorType {\n  return isKnownOAuth2ErrorType(error) ? error : fallback;\n}\n\n/**\n * The codes a failure past validation keeps on errorUri, each one the user can act on: the code\n * expired or was used (start again), they declined, or the provider is briefly down. Every other\n * failure there (a rejected client, a user info request that failed) is the app's or the\n * provider's problem, which the user sees as `server_error`.\n */\nconst CALLBACK_ERROR_TYPES: ReadonlySet<OAuth2ErrorType> = new Set([\n  'invalid_grant',\n  'access_denied',\n  'temporarily_unavailable',\n]);\n\nfunction authorizationAttributes(\n  attributes: OAuth2AuthorizationOptions['attributes']\n): Record<string, string> | undefined {\n  if (!attributes) return undefined;\n  const defined: Record<string, string> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    if (value !== undefined) defined[key] = value;\n  }\n  if (Object.keys(defined).length === 0) return undefined;\n  // The host's own values, written with the session: oversized is a bug in the host, not a 400.\n  const size = attributesSize(defined);\n  invariant(\n    size <= MAX_ATTRIBUTES_BYTES,\n    `oauth2 authorization attributes are ${size} bytes, at most ${MAX_ATTRIBUTES_BYTES} allowed`\n  );\n  return defined;\n}\n\n/** Sign in with Apple answers with `response_mode=form_post`; a charset parameter may follow. */\nfunction isFormPost(request: Request) {\n  const contentType = request.headers.get('content-type')?.toLowerCase();\n  return (\n    request.method === 'POST' && !!contentType?.startsWith('application/x-www-form-urlencoded')\n  );\n}\n\n/** Google's own form post carries no attributes; an app posting JSON may add them. */\nconst oneTapBodySchema = extend(googleOneTapSchema, { attributes: attributesSchema });\n\nconst desktopAuthorizeSchema = object({\n  code_challenge: string().check(regex(PKCE_FORMAT)),\n  code_challenge_method: literal('S256'),\n});\n\nconst desktopExchangeSchema = object({\n  code: string(),\n  code_verifier: string().check(regex(PKCE_FORMAT)),\n});\n\nexport const PATH = {\n  CSRF: '/csrf',\n  LOGOUT: '/logout',\n  LOGGED: '/logged',\n\n  OAUTH2_STATE: '/oauth2/state/:provider',\n  OAUTH2_NONCE: '/oauth2/nonce/:provider',\n  OAUTH2_AUTHORIZATION: '/oauth2/authorization/:provider',\n  LOGIN_OAUTH2_CODE: '/login/oauth2/code/:provider',\n  LOGIN_OAUTH2_NATIVE: '/login/oauth2/native/:provider',\n  LOGIN_OAUTH2_ONETAP: '/login/oauth2/onetap/google',\n\n  LOGIN_EMAIL: '/login/email',\n  SEND_EMAIL_VERIFICATION_CODE: '/auth/sendEmailVerificationCode',\n\n  // Desktop / native app sign-in via web loopback (RFC 8252 + OAuth 2.1 Auth Code Flow):\n  //   1. user already authenticated with cookie session → POST DESKTOP_AUTHORIZE → { code }\n  //   2. web redirects to desktop's loopback callback with the code\n  //   3. desktop renderer POSTs DESKTOP_EXCHANGE with the code → server returns\n  //      Set-Cookie carrying a fresh session, single-use code is invalidated\n  // The two-step flow keeps the actual session id off the redirect URL — only a\n  // 5-minute single-use code transits via the loopback.\n  DESKTOP_AUTHORIZE: '/auth/desktop/authorize',\n  DESKTOP_EXCHANGE: '/auth/desktop/exchange',\n\n  CLEANUP_EXPIRED_SESSIONS: '/sessions/expired/cleanup',\n} as const;\n\n/**\n * The login routes and session helpers. Every route is one straight line: read and validate the\n * request, check the credential, call the host's `onAuthorized`, sign in. Failures are thrown and\n * answered in one place per kind of route: a JSON route runs under `guard`, which maps a\n * `RequestError`, an `AuthenticationError` or an `OAuth2Error` to its google.rpc body (see\n * `respond.ts`); the redirect callback maps the same errors to `errorUri` parameters (`redirect`).\n */\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n  private readonly turnstileSecretKey?: string;\n  private readonly emailCodes: EmailVerificationCodes;\n  private readonly desktopCodes: DesktopCodes;\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly onetapRequireNonce: boolean;\n  private readonly touchInterval: number;\n  private readonly sessionHeader: boolean;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({\n    sessionRepository,\n    kvRepository,\n    turnstileSecretKey,\n    verificationCode,\n    oauth2,\n    cookie,\n    session,\n    timing,\n  }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    this.turnstileSecretKey = turnstileSecretKey;\n    const maxAttempts = verificationCode?.maxAttempts ?? 5;\n    const resendCooldown = verificationCode?.resendCooldown ?? 60;\n    invariant(maxAttempts >= 1, 'verificationCode.maxAttempts must be at least 1');\n    invariant(resendCooldown >= 1, 'verificationCode.resendCooldown must be at least 1 second');\n    this.emailCodes = new EmailVerificationCodes(kvRepository, { maxAttempts, resendCooldown });\n    this.desktopCodes = new DesktopCodes(kvRepository);\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n    this.onetapRequireNonce = oauth2?.onetap?.requireNonce ?? true;\n    this.touchInterval = (session?.touchInterval ?? 3600) * 1000;\n    this.sessionHeader = session?.header ?? false;\n    invariant(this.touchInterval >= 0, 'session.touchInterval must not be negative');\n  }\n\n  // ---- sessions and responses ------------------------------------------------------------------\n\n  private getSessionId(request: Request): string | undefined {\n    const fromCookie = getCookie(request, this.cookieName);\n    if (fromCookie) return fromCookie;\n    return (this.sessionHeader && request.headers.get(SESSION_HEADER)) || undefined;\n  }\n\n  /** The session the request carries, if it exists. */\n  private async loadSession(request: Request): Promise<Session | null> {\n    const sessionId = this.getSessionId(request);\n    return sessionId ? this.repository.findById(sessionId) : null;\n  }\n\n  /** The signed-in principal of a session, if any. */\n  private principalOf(session: Session): Principal | null {\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    return name ? { name: String(name) } : null;\n  }\n\n  /**\n   * A new session signed in as `principal`. With `carryOver`, what the host kept in the pre-login\n   * session moves to the new one; the authorization request (state, PKCE verifier, flow\n   * attributes) is single-use and was consumed, and a principal left there from an earlier\n   * sign-in is replaced. The new id is never the one the browser brought, which may have been\n   * planted by an attacker who started the flow (session fixation).\n   */\n  private async signIn(principal: Principal, carryOver?: Session): Promise<Session> {\n    const session = this.repository.createSession();\n    for (const attribute of carryOver?.getAttributeNames() ?? []) {\n      if (attribute === this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) continue;\n      if (attribute === PRINCIPAL_NAME_INDEX_NAME) continue;\n      const value = carryOver?.getAttribute(attribute);\n      if (value !== null && value !== undefined) session.setAttribute(attribute, value);\n    }\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    return session;\n  }\n\n  /**\n   * `response` carrying `session`: its cookie, renewed for the whole inactive interval, and with\n   * `session.header` on, the `X-Auth-Token` header a client without a cookie jar reads.\n   */\n  private withSession(response: Response, session: Session, cookie?: CookieOptions): Response {\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), {\n      ...this.cookieOptions,\n      ...cookie,\n      maxAge,\n    });\n    if (this.sessionHeader) response.headers.set(SESSION_HEADER, session.getId());\n    return response;\n  }\n\n  /** Runs a JSON route: a failure it knows is its response, anything else is the host's. */\n  private async guard(run: () => Promise<Response>): Promise<Response> {\n    try {\n      return await run();\n    } catch (error) {\n      const response = errorResponse(error);\n      if (response) return response;\n      throw error;\n    }\n  }\n\n  /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */\n  private redirect(\n    error: OAuth2ErrorType,\n    description?: string,\n    refusal?: AuthenticationError\n  ): Response {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    // Metadata never replaces a parameter: not one errorUri carries itself, nor one set below.\n    for (const [key, value] of Object.entries(refusal?.metadata ?? {})) {\n      if (!uri.searchParams.has(key)) uri.searchParams.set(key, value);\n    }\n    uri.searchParams.set('error', error);\n    if (description) {\n      uri.searchParams.set('error_description', description.slice(0, MAX_ERROR_DESCRIPTION_LENGTH));\n    }\n    if (refusal) uri.searchParams.set('reason', refusal.reason);\n    return Response.redirect(uri.href, 302);\n  }\n\n  // ---- basic -----------------------------------------------------------------------------------\n\n  csrf = async (_request: Request): Promise<Response> => {\n    const token = randomUUID();\n    const response = Response.json({\n      token,\n      parameterName: '_csrf',\n      headerName: 'X-XSRF-TOKEN',\n    });\n\n    // Double Submit Cookie Protection\n    setCookie(response, 'XSRF-TOKEN', token, {\n      path: '/',\n      secure: true,\n      httpOnly: false,\n      sameSite: 'none',\n      domain: this.cookieOptions.domain,\n    });\n    return response;\n  };\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = this.getSessionId(request);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    // A Set-Cookie only replaces the stored cookie when Domain and Path match (RFC 6265),\n    // so clear it with the same attributes it was set with.\n    deleteCookie(response, this.cookieName, this.cookieOptions);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    const session = await this.loadSession(request);\n    if (!session) return Response.json({ data: false });\n\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    const principal = this.principalOf(session);\n    if (principal) await onLogged?.(principal);\n    return this.withSession(Response.json({ data: principal !== null }), session);\n  };\n\n  // ---- oauth2 ----------------------------------------------------------------------------------\n\n  private createPkceParameters(): PkceParameters {\n    // 32 random bytes: a 43-char base64url verifier, the RFC 7636 minimum (a UUID is 36).\n    const code_verifier = randomBytes(32).toString('base64url');\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  /**\n   * Spends a nonce `oauth2Nonce` issued for `provider`: `NONCE_MISMATCH` for one that was not,\n   * or was used already. An id token is replayable until it expires; the nonce it carries makes\n   * it sign in once.\n   */\n  private async consumeNonce(nonce: string, provider: string): Promise<void> {\n    const key = this.getOauth2NonceKey(nonce);\n    if ((await this.kv.getItem(key)) !== provider) throw new AuthenticationError('NONCE_MISMATCH');\n    await this.kv.removeItem(key);\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = (\n    request: Request,\n    options?: OAuth2AuthorizationOptions\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const attributes = authorizationAttributes(options?.attributes);\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.OAUTH2_AUTHORIZATION);\n      const state = randomUUID();\n      const pkce = this.createPkceParameters();\n      const uri = await this.oauth2Client.createAuthorizationUri({ provider, state, pkce });\n      let session = await this.loadSession(request);\n      if (!session) {\n        // A session made for the flow only has to outlive the state: an abandoned flow must not\n        // keep a row for the default interval. Sign-in moves to a new session, with the default.\n        session = this.repository.createSession();\n        session.setMaxInactiveInterval(OAUTH2_PARAMETER_TTL);\n      }\n      mark('fetch_session');\n\n      const authorizationRequest: OAuth2AuthorizationRequest = {\n        state,\n        provider,\n        authorizationRequestUri: uri.href,\n        additionalParameters: pkce,\n        ...(attributes ? { attributes } : {}),\n      };\n      session.setAttribute(\n        this.ATTR_OAUTH2_AUTHORIZATION_REQUEST,\n        JSON.stringify(authorizationRequest)\n      );\n      await this.repository.save(session);\n      mark('save_session');\n\n      const response = new Response(null, { status: 302, headers: { location: uri.href } });\n      setTiming(response);\n      return this.withSession(response, session);\n    });\n\n  loginOAuth2Code = async (request: Request, handler: AuthorizedHandler): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. the session the flow started on, and the authorization request it stored\n    const session = await this.loadSession(request);\n    if (!session) return this.redirect('invalid_request', 'session not found');\n    mark('load_session');\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) return this.redirect('invalid_request', 'authorization request not found');\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 2. the provider's answer: query, or a form for Apple's response_mode=form_post\n    const { provider } = param(request, PATH.LOGIN_OAUTH2_CODE);\n    const data = isFormPost(request)\n      ? Object.fromEntries(new URLSearchParams(await request.text()))\n      : query(request);\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) return this.redirect('invalid_request', 'invalid redirect query');\n    // The provider answered with an error instead of a code (the user pressed Cancel →\n    // access_denied, invalid_scope, server_error, ...). Forward it rather than reporting a\n    // malformed query. This runs before the state check on purpose: providers echo state on\n    // error responses, but not all reliably do, and a forged error callback can only make the\n    // victim's popup show an error — nothing is exchanged or signed in. A present state that does\n    // not match still wins, since that is the more accurate (and more alarming) diagnosis.\n    if (parsed.data.error) {\n      if (parsed.data.state && parsed.data.state !== cached.state) {\n        return this.redirect('invalid_request', 'redirect state mismatch');\n      }\n      return this.redirect(\n        safeErrorType(parsed.data.error, 'server_error'),\n        parsed.data.error_description\n      );\n    }\n    const { code, state, user } = parsed.data;\n    if (!code || !state) return this.redirect('invalid_request', 'invalid redirect query');\n    if (state !== cached.state) return this.redirect('invalid_request', 'redirect state mismatch');\n    if (provider !== cached.provider) {\n      return this.redirect('invalid_request', 'redirect provider mismatch');\n    }\n    mark('validate_session');\n\n    // 3. exchange the code, load the user, sign in. Everything here can fail (an expired or reused\n    // code, a network error, the host's handler or session store). The callback runs in a popup\n    // the user is looking at, so every failure must land on errorUri, never as a JSON error.\n    let signedIn: Session;\n    try {\n      const { clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n        provider,\n        code,\n        pkce: cached.additionalParameters,\n      });\n      // Apple posts the user's name alongside the code, once: hand it to the provider with the token.\n      const userInfo = await this.oauth2Client.getUserInfo({\n        provider,\n        clientId,\n        token,\n        response: user ? { user } : undefined,\n      });\n      mark('exchange_code');\n\n      const principal = await handler(request, {\n        provider,\n        clientId,\n        userInfo,\n        token,\n        attributes: cached.attributes ?? {},\n      });\n      mark('save_principal');\n\n      signedIn = await this.signIn(principal, session);\n      await this.repository.deleteById(session.getId());\n      mark('update_session');\n    } catch (error) {\n      // The details stay in the logs: an OAuth2Error message can carry a client id or a\n      // provider's response, which has no place in a URL the browser keeps in its history.\n      if (error instanceof OAuth2Error) {\n        console.warn('OAuth2 callback failed', error);\n        const type = CALLBACK_ERROR_TYPES.has(error.error) ? error.error : 'server_error';\n        return this.redirect(type);\n      }\n      // A refusal is something the user can act on, so its reason and metadata reach the page,\n      // as they reach a JSON client through the ErrorInfo.\n      if (error instanceof AuthenticationError) {\n        console.warn('OAuth2 sign-in refused', error.reason, error.metadata);\n        return this.redirect('access_denied', undefined, error);\n      }\n      console.error('OAuth2 callback failed', error);\n      return this.redirect('server_error');\n    }\n\n    const uri = new URL(this.oauth2Client.successUri);\n    uri.searchParams.set('status', 'success');\n    uri.searchParams.set('provider', provider);\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    setTiming(response);\n    return this.withSession(response, signedIn);\n  };\n\n  /** The shared tail of the JSON login routes: the host's handler, then a signed-in session. */\n  private async authorize(\n    request: Request,\n    handler: AuthorizedHandler,\n    authorization: Authorization,\n    setTiming: (response: Response) => void\n  ): Promise<Response> {\n    const principal = await handler(request, authorization);\n    const session = await this.signIn(principal);\n    const response = Response.json(principal);\n    setTiming(response);\n    return this.withSession(response, session);\n  }\n\n  loginOAuth2Native = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.LOGIN_OAUTH2_NATIVE);\n      const body = await readJson(request);\n      // Whatever the app sends besides its credentials for `onAuthorized` (a referral code, ...).\n      const attributes = bodyAttributes(body);\n      // Only the credentials go on to the provider client.\n      const { attributes: _, ...credentials } = body as NativeCredential & { attributes?: unknown };\n      const { code_verifier } = credentials as { code_verifier?: unknown };\n      if (\n        code_verifier !== undefined &&\n        (typeof code_verifier !== 'string' || !CODE_VERIFIER_FORMAT.test(code_verifier))\n      ) {\n        throw invalidArgument(\n          'INVALID_CODE_VERIFIER',\n          'code_verifier must be 43-128 characters from [A-Za-z0-9-._~]'\n        );\n      }\n      const { clientId, userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n        provider,\n        credentials,\n      });\n      mark('login_oauth2_native');\n\n      const { nonce } = userInfo.data as { nonce?: unknown };\n      if (typeof nonce === 'string' && nonce) {\n        await this.consumeNonce(nonce, provider);\n        mark('check_nonce');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  loginOAuth2Onetap = (\n    request: Request,\n    handler: AuthorizedHandler,\n    provider = 'google'\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n\n      // Google's own form post, or an app's JSON.\n      const contentType = request.headers.get('content-type') ?? '';\n      const body = contentType.includes('application/json')\n        ? await readJson(request)\n        : await readForm(request);\n      const { attributes = {}, ...parsed } = parse(oneTapBodySchema, body);\n\n      // Both the credential and the code are issued to the provider's web client.\n      let clientId: string;\n      let token: Authorization['token'];\n      let userInfo: Authorization['userInfo'];\n      if (parsed.credential) {\n        ({ clientId, token, userInfo } = await this.oauth2Client.getTokenInfo({\n          provider,\n          credential: parsed.credential,\n        }));\n        mark('verify_credential');\n\n        // A credential is replayable until it expires, so it must carry a single-use nonce from\n        // `oauth2Nonce`, which the front end passed to `prompt`. This replaces Google's\n        // `g_csrf_token` double-submit cookie, which FedCM mode no longer sets.\n        const { nonce } = userInfo.data as { nonce?: unknown };\n        if (typeof nonce === 'string' && nonce) {\n          await this.consumeNonce(nonce, provider);\n          mark('check_nonce');\n        } else if (this.onetapRequireNonce) {\n          throw new AuthenticationError('NONCE_MISSING');\n        }\n      } else if (parsed.code) {\n        ({ clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n          provider,\n          code: parsed.code,\n        }));\n        userInfo = await this.oauth2Client.getUserInfo({ provider, clientId, token });\n      } else {\n        throw invalidArgument('INVALID_ARGUMENT', 'credential or code is required');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  // ---- email -----------------------------------------------------------------------------------\n\n  sendEmailVerificationCode = (request: Request, sender: EmailSender): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.turnstileSecretKey, 'turnstileSecretKey is not configured');\n      const { email, turnstileToken } = parse(\n        sendEmailVerificationCodeSchema,\n        await readJson(request)\n      );\n      await verifyTurnstileToken(this.turnstileSecretKey, turnstileToken);\n      await this.emailCodes.send(email, sender);\n      return Response.json({});\n    });\n\n  verifyEmailCode = (email: string, verificationCode: string): Promise<void> =>\n    this.emailCodes.verify(email, verificationCode);\n\n  loginEmail = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      const { setTiming } = timing({ enabled: this.timing });\n      const {\n        email,\n        verificationCode,\n        attributes = {},\n      } = parse(loginEmailSchema, await readJson(request));\n      await this.emailCodes.verify(email, verificationCode);\n      const claims: StandardClaims = { sub: email, email, email_verified: true };\n      return this.authorize(\n        request,\n        handler,\n        { provider: 'EMAIL', userInfo: { claims, data: {} }, attributes },\n        setTiming\n      );\n    });\n\n  // ---- desktop ---------------------------------------------------------------------------------\n\n  /**\n   * Step 1 of the desktop / native app sign-in handshake. The caller already completed normal\n   * sign-in on the web (so a cookie session exists); this issues a 5-minute single-use code that\n   * the web page hands off to the desktop client via a loopback redirect.\n   *\n   * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier` before opening the\n   * browser, derives `code_challenge = base64url(sha256(verifier))`, and threads the challenge\n   * through the URL → web page → here. The challenge is pinned to the code; `desktopExchange`\n   * enforces that the caller knows the matching verifier. This blocks an attacker who only\n   * intercepts the auth code (browser history, malicious extension, packet capture on loopback)\n   * from exchanging it.\n   *\n   * Requires an authenticated cookie session: anonymous callers get 401. Throttling / abuse\n   * protection on this endpoint is the API layer's job (rate-limit per principal); the SDK does\n   * not gate it because the upstream sign-in flow already passed CAPTCHA / OAuth / verification.\n   */\n  desktopAuthorize = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const principal = await this.getPrincipal(request);\n      if (!principal) throw unauthenticated('Sign in first');\n      const { code_challenge } = parse(desktopAuthorizeSchema, await readJson(request));\n      const code = await this.desktopCodes.issue(principal, code_challenge);\n      return Response.json({ code });\n    });\n\n  /**\n   * Step 2 of the desktop / native app sign-in handshake. The desktop client hands back the auth\n   * code it received via the loopback callback, and we mint a fresh session for it, independent\n   * of the web cookie session that originally authorized the code, so logging out on either side\n   * does not cascade to the other.\n   *\n   * Cookie attributes: `SameSite=None; Secure` so the cookie survives cross-site fetches from the\n   * desktop renderer's `file://` / `app://` origin. The configured `cookieOptions` provide\n   * everything else (`domain`, `path`, `httpOnly`); the override is targeted at the\n   * SameSite/Secure pair only. In a non-HTTPS dev backend this combination is rejected by\n   * Chromium, see the desktop sign-in PRD for workarounds.\n   *\n   * No CSRF check needed: the request carries no cookie, the auth code itself is the credential,\n   * and the code's single-use removal blocks replay.\n   */\n  desktopExchange = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const { code, code_verifier } = parse(desktopExchangeSchema, await readJson(request));\n      const principal = await this.desktopCodes.redeem(code, code_verifier);\n      const session = await this.signIn(principal);\n      session.setAttribute('client_type', 'desktop');\n      await this.repository.save(session);\n      return this.withSession(Response.json({ ok: true }), session, {\n        sameSite: 'none',\n        secure: true,\n      });\n    });\n\n  // ---- session management ----------------------------------------------------------------------\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  /**\n   * Sliding expiration: an authenticated request renews the session, as `logged` does, so a user\n   * who keeps using the app is never signed out after `maxInactiveInterval` of not calling one\n   * particular endpoint. No extra read: the session was just loaded to authenticate, and its\n   * `lastAccessedTime` is compared in memory; writes are spaced by `session.touchInterval` (see\n   * `AuthConfig`), so a session accessed again within the interval is not rewritten.\n   */\n  private async touch(session: Session) {\n    const now = Date.now();\n    if (now - session.getLastAccessedTime() < this.touchInterval) return;\n    session.setLastAccessedTime(now);\n    await this.repository.save(session);\n  }\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const session = await this.loadSession(request);\n    const principal = session && this.principalOf(session);\n    if (!principal) return null;\n    await this.touch(session);\n    return principal;\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    return (await this.getPrincipal(request)) !== null;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    type Result = T extends true ? Session : Session | null;\n    const session = await this.loadSession(request);\n    if (session || !create) return session as Result;\n    const created = this.repository.createSession();\n    await this.repository.save(created);\n    return created;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiDA,MAAM,cAAc;AAIpB,MAAM,uBAAuB;;AAG7B,MAAM,iBAAiB;;AAGvB,MAAM,uBAAuB;AAI7B,MAAM,+BAA+B;;AAGrC,SAAS,cAAc,OAAe,UAA4C;CAChF,OAAOA,qBAAAA,uBAAuB,KAAK,IAAI,QAAQ;AACjD;;;;;;;AAQA,MAAM,uCAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;AAED,SAAS,wBACP,YACoC;CACpC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAE1C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAE9C,MAAM,OAAOC,wBAAAA,eAAe,OAAO;CACnC,CAAA,GAAA,cAAA,UAAA,CACE,QAAQC,wBAAAA,sBACR,uCAAuC,KAAK,kBAAkBA,wBAAAA,qBAAqB,SACrF;CACA,OAAO;AACT;;AAGA,SAAS,WAAW,SAAkB;CACpC,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY;CACrE,OACE,QAAQ,WAAW,UAAU,CAAC,CAAC,aAAa,WAAW,mCAAmC;AAE9F;;AAGA,MAAM,oBAAA,GAAmBC,SAAAA,OAAAA,CAAOC,sBAAAA,oBAAoB,EAAE,YAAYC,wBAAAA,iBAAiB,CAAC;AAEpF,MAAM,0BAAA,GAAyBC,SAAAA,OAAAA,CAAO;CACpC,iBAAA,GAAgBC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,MAAAA,CAAM,WAAW,CAAC;CACjD,wBAAA,GAAuBC,SAAAA,QAAAA,CAAQ,MAAM;AACvC,CAAC;AAED,MAAM,yBAAA,GAAwBH,SAAAA,OAAAA,CAAO;CACnC,OAAA,GAAMC,SAAAA,OAAAA,CAAO;CACb,gBAAA,GAAeA,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,MAAAA,CAAM,WAAW,CAAC;AAClD,CAAC;AAED,MAAa,OAAO;CAClB,MAAM;CACN,QAAQ;CACR,QAAQ;CAER,cAAc;CACd,cAAc;CACd,sBAAsB;CACtB,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CAErB,aAAa;CACb,8BAA8B;CAS9B,mBAAmB;CACnB,kBAAkB;CAElB,0BAA0B;AAC5B;;;;;;;;AASA,IAAa,OAAb,MAAyC;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,oCAAqD;CAErD,YAAY,EACV,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACa;EACb,KAAK,SAAS,UAAU;EACxB,KAAK,KAAK;EACV,KAAK,aAAa;EAClB,KAAK,qBAAqB;EAC1B,MAAM,cAAc,kBAAkB,eAAe;EACrD,MAAM,iBAAiB,kBAAkB,kBAAkB;EAC3D,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,GAAG,iDAAiD;EAC7E,CAAA,GAAA,cAAA,UAAA,CAAU,kBAAkB,GAAG,2DAA2D;EAC1F,KAAK,aAAa,IAAIE,yBAAAA,uBAAuB,cAAc;GAAE;GAAa;EAAe,CAAC;EAC1F,KAAK,eAAe,IAAIC,2BAAAA,aAAa,YAAY;EACjD,MAAM,EAAE,MAAM,GAAG,kBAAkB,UAAU,CAAC;EAC9C,KAAK,aAAa,QAAQ;EAC1B,KAAK,gBAAgB;GACnB,MAAM;GACN,UAAU;GACV,QAAQ;GACR,UAAU;GACV,GAAG;EACL;EACA,KAAK,eAAe,QAAQ,SAAS,IAAIC,sBAAAA,aAAa,OAAO,MAAM,IAAI;EACvE,KAAK,qBAAqB,QAAQ,QAAQ,gBAAgB;EAC1D,KAAK,iBAAiB,SAAS,iBAAiB,QAAQ;EACxD,KAAK,gBAAgB,SAAS,UAAU;EACxC,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,iBAAiB,GAAG,4CAA4C;CACjF;CAIA,aAAqB,SAAsC;EACzD,MAAM,aAAaC,mBAAAA,UAAU,SAAS,KAAK,UAAU;EACrD,IAAI,YAAY,OAAO;EACvB,OAAQ,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,cAAc,KAAM,KAAA;CACxE;;CAGA,MAAc,YAAY,SAA2C;EACnE,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,OAAO,YAAY,KAAK,WAAW,SAAS,SAAS,IAAI;CAC3D;;CAGA,YAAoB,SAAoC;EACtD,MAAM,OAAO,QAAQ,aAAaC,uBAAAA,yBAAyB;EAC3D,OAAO,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI;CACzC;;;;;;;;CASA,MAAc,OAAO,WAAsB,WAAuC;EAChF,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,KAAK,MAAM,aAAa,WAAW,kBAAkB,KAAK,CAAC,GAAG;GAC5D,IAAI,cAAc,KAAK,mCAAmC;GAC1D,IAAI,cAAA,iBAAyC;GAC7C,MAAM,QAAQ,WAAW,aAAa,SAAS;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,QAAQ,aAAa,WAAW,KAAK;EAClF;EACA,QAAQ,aAAaA,uBAAAA,2BAA2B,UAAU,IAAI;EAC9D,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;;;;;CAMA,YAAoB,UAAoB,SAAkB,QAAkC;EAC1F,MAAM,SAAS,QAAQ,uBAAuB;EAC9C,mBAAA,UAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG;GACpD,GAAG,KAAK;GACR,GAAG;GACH;EACF,CAAC;EACD,IAAI,KAAK,eAAe,SAAS,QAAQ,IAAI,gBAAgB,QAAQ,MAAM,CAAC;EAC5E,OAAO;CACT;;CAGA,MAAc,MAAM,KAAiD;EACnE,IAAI;GACF,OAAO,MAAM,IAAI;EACnB,SAAS,OAAO;GACd,MAAM,WAAWC,qBAAAA,cAAc,KAAK;GACpC,IAAI,UAAU,OAAO;GACrB,MAAM;EACR;CACF;;CAGA,SACE,OACA,aACA,SACU;EACV,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;EAE9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,GAC/D,IAAI,CAAC,IAAI,aAAa,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAEjE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,aACF,IAAI,aAAa,IAAI,qBAAqB,YAAY,MAAM,GAAG,4BAA4B,CAAC;EAE9F,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EAC1D,OAAO,SAAS,SAAS,IAAI,MAAM,GAAG;CACxC;CAIA,OAAO,OAAO,aAAyC;EACrD,MAAM,SAAA,GAAQC,YAAAA,WAAAA,CAAW;EACzB,MAAM,WAAW,SAAS,KAAK;GAC7B;GACA,eAAe;GACf,YAAY;EACd,CAAC;EAGD,mBAAA,UAAU,UAAU,cAAc,OAAO;GACvC,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,KAAK,cAAc;EAC7B,CAAC;EACD,OAAO;CACT;CAEA,SAAS,OAAO,YAAwC;EACtD,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,IAAI,WAAW,MAAM,KAAK,WAAW,WAAW,SAAS;EACzD,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC;EAGjC,mBAAA,aAAa,UAAU,KAAK,YAAY,KAAK,aAAa;EAC1D,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,aAAgD;EAChF,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;EAElD,QAAQ,oBAAoB,KAAK,IAAI,CAAC;EACtC,MAAM,KAAK,WAAW,KAAK,OAAO;EAElC,MAAM,YAAY,KAAK,YAAY,OAAO;EAC1C,IAAI,WAAW,MAAM,WAAW,SAAS;EACzC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,OAAO;CAC9E;CAIA,uBAA+C;EAE7C,MAAM,iBAAA,GAAgBC,YAAAA,YAAAA,CAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EAM1D,OAAO;GAAE;GAAe,iBAAA,GALDC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,CAAC,CACR,SAAS,WAEyB;GAAG,uBAAuB;EAAO;CACxE;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;;;;;;CAOA,MAAc,aAAa,OAAe,UAAiC;EACzE,MAAM,MAAM,KAAK,kBAAkB,KAAK;EACxC,IAAK,MAAM,KAAK,GAAG,QAAQ,GAAG,MAAO,UAAU,MAAM,IAAIC,mBAAAA,oBAAoB,gBAAgB;EAC7F,MAAM,KAAK,GAAG,WAAW,GAAG;CAC9B;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAaC,mBAAAA,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAaI,mBAAAA,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,uBACE,SACA,YAEA,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,aAAa,wBAAwB,SAAS,UAAU;EAC9D,MAAM,EAAE,MAAM,cAAcK,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,oBAAoB;EAC7D,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,OAAO,KAAK,qBAAqB;EACvC,MAAM,MAAM,MAAM,KAAK,aAAa,uBAAuB;GAAE;GAAU;GAAO;EAAK,CAAC;EACpF,IAAI,UAAU,MAAM,KAAK,YAAY,OAAO;EAC5C,IAAI,CAAC,SAAS;GAGZ,UAAU,KAAK,WAAW,cAAc;GACxC,QAAQ,uBAAuB,oBAAoB;EACrD;EACA,KAAK,eAAe;EAEpB,MAAM,uBAAmD;GACvD;GACA;GACA,yBAAyB,IAAI;GAC7B,sBAAsB;GACtB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC;EACA,QAAQ,aACN,KAAK,mCACL,KAAK,UAAU,oBAAoB,CACrC;EACA,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,KAAK,cAAc;EAEnB,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C,CAAC;CAEH,kBAAkB,OAAO,SAAkB,YAAkD;EAC3F,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcK,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAG3D,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,mBAAmB,mBAAmB;EACzE,KAAK,cAAc;EACnB,MAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;EACxE,IAAI,CAAC,MAAM,OAAO,KAAK,SAAS,mBAAmB,iCAAiC;EACpF,MAAM,SAAqC,KAAK,MAAM,IAAI;EAG1D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,iBAAiB;EAC1D,MAAM,OAAO,WAAW,OAAO,IAC3B,OAAO,YAAY,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC,CAAC,IAC5DE,mBAAAA,MAAM,OAAO;EACjB,MAAM,SAASC,sBAAAA,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EAOrF,IAAI,OAAO,KAAK,OAAO;GACrB,IAAI,OAAO,KAAK,SAAS,OAAO,KAAK,UAAU,OAAO,OACpD,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;GAEnE,OAAO,KAAK,SACV,cAAc,OAAO,KAAK,OAAO,cAAc,GAC/C,OAAO,KAAK,iBACd;EACF;EACA,MAAM,EAAE,MAAM,OAAO,SAAS,OAAO;EACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EACrF,IAAI,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;EAC7F,IAAI,aAAa,OAAO,UACtB,OAAO,KAAK,SAAS,mBAAmB,4BAA4B;EAEtE,KAAK,kBAAkB;EAKvB,IAAI;EACJ,IAAI;GACF,MAAM,EAAE,UAAU,UAAU,MAAM,KAAK,aAAa,0BAA0B;IAC5E;IACA;IACA,MAAM,OAAO;GACf,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,aAAa,YAAY;IACnD;IACA;IACA;IACA,UAAU,OAAO,EAAE,KAAK,IAAI,KAAA;GAC9B,CAAC;GACD,KAAK,eAAe;GAEpB,MAAM,YAAY,MAAM,QAAQ,SAAS;IACvC;IACA;IACA;IACA;IACA,YAAY,OAAO,cAAc,CAAC;GACpC,CAAC;GACD,KAAK,gBAAgB;GAErB,WAAW,MAAM,KAAK,OAAO,WAAW,OAAO;GAC/C,MAAM,KAAK,WAAW,WAAW,QAAQ,MAAM,CAAC;GAChD,KAAK,gBAAgB;EACvB,SAAS,OAAO;GAGd,IAAI,iBAAiBC,qBAAAA,aAAa;IAChC,QAAQ,KAAK,0BAA0B,KAAK;IAC5C,MAAM,OAAO,qBAAqB,IAAI,MAAM,KAAK,IAAI,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,IAAI;GAC3B;GAGA,IAAI,iBAAiBL,mBAAAA,qBAAqB;IACxC,QAAQ,KAAK,0BAA0B,MAAM,QAAQ,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,iBAAiB,KAAA,GAAW,KAAK;GACxD;GACA,QAAQ,MAAM,0BAA0B,KAAK;GAC7C,OAAO,KAAK,SAAS,cAAc;EACrC;EAEA,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,UAAU;EAChD,IAAI,aAAa,IAAI,UAAU,SAAS;EACxC,IAAI,aAAa,IAAI,YAAY,QAAQ;EACzC,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,QAAQ;CAC5C;;CAGA,MAAc,UACZ,SACA,SACA,eACA,WACmB;EACnB,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa;EACtD,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,MAAM,WAAW,SAAS,KAAK,SAAS;EACxC,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;CAEA,qBAAqB,SAAkB,YACrC,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcE,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,mBAAmB;EAC5D,MAAM,OAAO,MAAMK,oBAAAA,SAAS,OAAO;EAEnC,MAAM,aAAaC,wBAAAA,eAAe,IAAI;EAEtC,MAAM,EAAE,YAAY,GAAG,GAAG,gBAAgB;EAC1C,MAAM,EAAE,kBAAkB;EAC1B,IACE,kBAAkB,KAAA,MACjB,OAAO,kBAAkB,YAAY,CAAC,qBAAqB,KAAK,aAAa,IAE9E,MAAMC,qBAAAA,gBACJ,yBACA,8DACF;EAEF,MAAM,EAAE,UAAU,UAAU,UAAU,MAAM,KAAK,aAAa,kBAAkB;GAC9E;GACA;EACF,CAAC;EACD,KAAK,qBAAqB;EAE1B,MAAM,EAAE,UAAU,SAAS;EAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;GACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;GACvC,KAAK,aAAa;EACpB;EAEA,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAEH,qBACE,SACA,SACA,WAAW,aAEX,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcN,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAI3D,MAAM,QADc,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAClC,SAAS,kBAAkB,IAChD,MAAMI,oBAAAA,SAAS,OAAO,IACtB,MAAMG,oBAAAA,SAAS,OAAO;EAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,GAAG,WAAWC,oBAAAA,MAAM,kBAAkB,IAAI;EAGnE,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,YAAY;GACrB,CAAC,CAAE,UAAU,OAAO,YAAa,MAAM,KAAK,aAAa,aAAa;IACpE;IACA,YAAY,OAAO;GACrB,CAAC;GACD,KAAK,mBAAmB;GAKxB,MAAM,EAAE,UAAU,SAAS;GAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;IACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;IACvC,KAAK,aAAa;GACpB,OAAO,IAAI,KAAK,oBACd,MAAM,IAAIV,mBAAAA,oBAAoB,eAAe;EAEjD,OAAO,IAAI,OAAO,MAAM;GACtB,CAAC,CAAE,UAAU,SAAU,MAAM,KAAK,aAAa,0BAA0B;IACvE;IACA,MAAM,OAAO;GACf,CAAC;GACD,WAAW,MAAM,KAAK,aAAa,YAAY;IAAE;IAAU;IAAU;GAAM,CAAC;EAC9E,OACE,MAAMQ,qBAAAA,gBAAgB,oBAAoB,gCAAgC;EAG5E,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAIH,6BAA6B,SAAkB,WAC7C,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,oBAAoB,sCAAsC;EACzE,MAAM,EAAE,OAAO,mBAAmBE,oBAAAA,MAChCC,qBAAAA,iCACA,MAAML,oBAAAA,SAAS,OAAO,CACxB;EACA,MAAMM,oBAAAA,qBAAqB,KAAK,oBAAoB,cAAc;EAClE,MAAM,KAAK,WAAW,KAAK,OAAO,MAAM;EACxC,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB,CAAC;CAEH,mBAAmB,OAAe,qBAChC,KAAK,WAAW,OAAO,OAAO,gBAAgB;CAEhD,cAAc,SAAkB,YAC9B,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,cAAcV,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EACrD,MAAM,EACJ,OACA,kBACA,aAAa,CAAC,MACZQ,oBAAAA,MAAMG,qBAAAA,kBAAkB,MAAMP,oBAAAA,SAAS,OAAO,CAAC;EACnD,MAAM,KAAK,WAAW,OAAO,OAAO,gBAAgB;EACpD,MAAM,SAAyB;GAAE,KAAK;GAAO;GAAO,gBAAgB;EAAK;EACzE,OAAO,KAAK,UACV,SACA,SACA;GAAE,UAAU;GAAS,UAAU;IAAE;IAAQ,MAAM,CAAC;GAAE;GAAG;EAAW,GAChE,SACF;CACF,CAAC;;;;;;;;;;;;;;;;;CAoBH,oBAAoB,YAClB,KAAK,MAAM,YAAY;EACrB,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO;EACjD,IAAI,CAAC,WAAW,MAAMQ,qBAAAA,gBAAgB,eAAe;EACrD,MAAM,EAAE,mBAAmBJ,oBAAAA,MAAM,wBAAwB,MAAMJ,oBAAAA,SAAS,OAAO,CAAC;EAChF,MAAM,OAAO,MAAM,KAAK,aAAa,MAAM,WAAW,cAAc;EACpE,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;CAC/B,CAAC;;;;;;;;;;;;;;;;CAiBH,mBAAmB,YACjB,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,MAAM,kBAAkBI,oBAAAA,MAAM,uBAAuB,MAAMJ,oBAAAA,SAAS,OAAO,CAAC;EACpF,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO,MAAM,aAAa;EACpE,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,QAAQ,aAAa,eAAe,SAAS;EAC7C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,SAAS;GAC5D,UAAU;GACV,QAAQ;EACV,CAAC;CACH,CAAC;CAIH,OAAO,OAAO,cAAwC;EACpD,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,KAAK,MAAM,aAAa,SAAS,KAAK,GACpC,MAAM,KAAK,WAAW,WAAW,SAAS;CAE9C;;;;;;;;CASA,MAAc,MAAM,SAAkB;EACpC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,QAAQ,oBAAoB,IAAI,KAAK,eAAe;EAC9D,QAAQ,oBAAoB,GAAG;EAC/B,MAAM,KAAK,WAAW,KAAK,OAAO;CACpC;CAEA,eAAe,OAAO,YAAgD;EACpE,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;EACrD,IAAI,CAAC,WAAW,OAAO;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,OAAO;CACT;CAEA,kBAAkB,OAAO,YAAuC;EAC9D,OAAQ,MAAM,KAAK,aAAa,OAAO,MAAO;CAChD;CAEA,aAAa,OACX,SACA,WACuD;EAEvD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,WAAW,CAAC,QAAQ,OAAO;EAC/B,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;CAEA,gBAAgB,OAAO,cAAqC;EAC1D,MAAM,KAAK,WAAW,WAAW,SAAS;CAC5C;CAEA,eAAe,OAAO,cAA6C;EACjE,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;CACrC;CAEA,yBAAyB,OAAO,iBAA6C;EAC3E,MAAM,KAAK,WAAW,uBAAuB,YAAY;EACzD,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB;AACF"}

package/dist/auth/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/auth/index.ts"],"mappings":";;;;qBAyHa;WACX;WACA;WACA;WAEA;WACA;WACA;WACA;WACA;WACA;WAEA;WACA;WASA;WACA;WAEA;;;;;;;;;qBAUW,gBAAgB;mBACV;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,cACE,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACC;UA6BK;;UAOM;;UAMN;;;;;;;;UAYM;;;;;UAiBN;;UAYM;;UAWN;EAqBR,OAAI,UAAoB,YAAU,QAAQ;EAmB1C,SAAM,SAAmB,YAAU,QAAQ;EAU3C,SAAM,SAAmB,SAAO,WAAa,kBAAgB,QAAQ;UAc7D;UAUA;UAIA;;;;;;UASM;EAMd,cAAW,SAAmB,YAAU,QAAQ;EAOhD,cAAW,SAAmB,YAAU,QAAQ;EAOhD,sBAAmB,SACR,SAAO,UACN,+BACT,QAAQ;EA+BX,kBAAe,SAAmB,SAAO,SAAW,sBAAoB,QAAQ;;UAoGlE;EAad,oBAAiB,SAAa,SAAO,SAAW,sBAAoB,QAAQ;EAwC5E,oBAAiB,SACN,SAAO,SACP,mBAAiB,sBAEzB,QAAQ;EAqDX,4BAAyB,SAAa,SAAO,QAAU,gBAAc,QAAQ;EAY7E,kBAAe,eAAiB,6BAA6B;EAG7D,aAAU,SAAa,SAAO,SAAW,sBAAoB,QAAQ;;;;;;;;;;;;;;;;;EAoCrE,mBAAgB,SAAa,YAAU,QAAQ;;;;;;;;;;;;;;;;EAwB/C,kBAAe,SAAa,YAAU,QAAQ;EAe9C,OAAI,WAAqB,cAAY;;;;;;;;UAcvB;EAOd,eAAY,SAAmB,YAAU,QAAQ;EAQjD,kBAAe,SAAmB,YAAU;EAI5C,aAAoB,mBAAiB,SAC1B,SAAO,QACR,MACP,QAAQ,iBAAiB,UAAU;EAStC,gBAAa,sBAA8B;EAI3C,eAAY,WAAqB,cAAY,QAAQ;EAKrD,yBAAsB,0BAAkC,QAAQ"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/auth/index.ts"],"mappings":";;;;qBAyHa;WACX;WACA;WACA;WAEA;WACA;WACA;WACA;WACA;WACA;WAEA;WACA;WASA;WACA;WAEA;;;;;;;;;qBAUW,gBAAgB;mBACV;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,cACE,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACC;UA6BK;;UAOM;;UAMN;;;;;;;;UAYM;;;;;UAiBN;;UAYM;;UAWN;EAqBR,OAAI,UAAoB,YAAU,QAAQ;EAmB1C,SAAM,SAAmB,YAAU,QAAQ;EAU3C,SAAM,SAAmB,SAAO,WAAa,kBAAgB,QAAQ;UAc7D;UAWA;UAIA;;;;;;UASM;EAMd,cAAW,SAAmB,YAAU,QAAQ;EAOhD,cAAW,SAAmB,YAAU,QAAQ;EAOhD,sBAAmB,SACR,SAAO,UACN,+BACT,QAAQ;EAqCX,kBAAe,SAAmB,SAAO,SAAW,sBAAoB,QAAQ;;UAoGlE;EAad,oBAAiB,SAAa,SAAO,SAAW,sBAAoB,QAAQ;EAwC5E,oBAAiB,SACN,SAAO,SACP,mBAAiB,sBAEzB,QAAQ;EAqDX,4BAAyB,SAAa,SAAO,QAAU,gBAAc,QAAQ;EAY7E,kBAAe,eAAiB,6BAA6B;EAG7D,aAAU,SAAa,SAAO,SAAW,sBAAoB,QAAQ;;;;;;;;;;;;;;;;;EAoCrE,mBAAgB,SAAa,YAAU,QAAQ;;;;;;;;;;;;;;;;EAwB/C,kBAAe,SAAa,YAAU,QAAQ;EAe9C,OAAI,WAAqB,cAAY;;;;;;;;UAcvB;EAOd,eAAY,SAAmB,YAAU,QAAQ;EAQjD,kBAAe,SAAmB,YAAU;EAI5C,aAAoB,mBAAiB,SAC1B,SAAO,QACR,MACP,QAAQ,iBAAiB,UAAU;EAStC,gBAAa,sBAA8B;EAI3C,eAAY,WAAqB,cAAY,QAAQ;EAKrD,yBAAsB,0BAAkC,QAAQ"}

package/dist/auth/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/auth/index.ts"],"mappings":";;;;qBAyHa;WACX;WACA;WACA;WAEA;WACA;WACA;WACA;WACA;WACA;WAEA;WACA;WASA;WACA;WAEA;;;;;;;;;qBAUW,gBAAgB;mBACV;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,cACE,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACC;UA6BK;;UAOM;;UAMN;;;;;;;;UAYM;;;;;UAiBN;;UAYM;;UAWN;EAqBR,OAAI,UAAoB,YAAU,QAAQ;EAmB1C,SAAM,SAAmB,YAAU,QAAQ;EAU3C,SAAM,SAAmB,SAAO,WAAa,kBAAgB,QAAQ;UAc7D;UAUA;UAIA;;;;;;UASM;EAMd,cAAW,SAAmB,YAAU,QAAQ;EAOhD,cAAW,SAAmB,YAAU,QAAQ;EAOhD,sBAAmB,SACR,SAAO,UACN,+BACT,QAAQ;EA+BX,kBAAe,SAAmB,SAAO,SAAW,sBAAoB,QAAQ;;UAoGlE;EAad,oBAAiB,SAAa,SAAO,SAAW,sBAAoB,QAAQ;EAwC5E,oBAAiB,SACN,SAAO,SACP,mBAAiB,sBAEzB,QAAQ;EAqDX,4BAAyB,SAAa,SAAO,QAAU,gBAAc,QAAQ;EAY7E,kBAAe,eAAiB,6BAA6B;EAG7D,aAAU,SAAa,SAAO,SAAW,sBAAoB,QAAQ;;;;;;;;;;;;;;;;;EAoCrE,mBAAgB,SAAa,YAAU,QAAQ;;;;;;;;;;;;;;;;EAwB/C,kBAAe,SAAa,YAAU,QAAQ;EAe9C,OAAI,WAAqB,cAAY;;;;;;;;UAcvB;EAOd,eAAY,SAAmB,YAAU,QAAQ;EAQjD,kBAAe,SAAmB,YAAU;EAI5C,aAAoB,mBAAiB,SAC1B,SAAO,QACR,MACP,QAAQ,iBAAiB,UAAU;EAStC,gBAAa,sBAA8B;EAI3C,eAAY,WAAqB,cAAY,QAAQ;EAKrD,yBAAsB,0BAAkC,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/auth/index.ts"],"mappings":";;;;qBAyHa;WACX;WACA;WACA;WAEA;WACA;WACA;WACA;WACA;WACA;WAEA;WACA;WASA;WACA;WAEA;;;;;;;;;qBAUW,gBAAgB;mBACV;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,cACE,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACC;UA6BK;;UAOM;;UAMN;;;;;;;;UAYM;;;;;UAiBN;;UAYM;;UAWN;EAqBR,OAAI,UAAoB,YAAU,QAAQ;EAmB1C,SAAM,SAAmB,YAAU,QAAQ;EAU3C,SAAM,SAAmB,SAAO,WAAa,kBAAgB,QAAQ;UAc7D;UAWA;UAIA;;;;;;UASM;EAMd,cAAW,SAAmB,YAAU,QAAQ;EAOhD,cAAW,SAAmB,YAAU,QAAQ;EAOhD,sBAAmB,SACR,SAAO,UACN,+BACT,QAAQ;EAqCX,kBAAe,SAAmB,SAAO,SAAW,sBAAoB,QAAQ;;UAoGlE;EAad,oBAAiB,SAAa,SAAO,SAAW,sBAAoB,QAAQ;EAwC5E,oBAAiB,SACN,SAAO,SACP,mBAAiB,sBAEzB,QAAQ;EAqDX,4BAAyB,SAAa,SAAO,QAAU,gBAAc,QAAQ;EAY7E,kBAAe,eAAiB,6BAA6B;EAG7D,aAAU,SAAa,SAAO,SAAW,sBAAoB,QAAQ;;;;;;;;;;;;;;;;;EAoCrE,mBAAgB,SAAa,YAAU,QAAQ;;;;;;;;;;;;;;;;EAwB/C,kBAAe,SAAa,YAAU,QAAQ;EAe9C,OAAI,WAAqB,cAAY;;;;;;;;UAcvB;EAOd,eAAY,SAAmB,YAAU,QAAQ;EAQjD,kBAAe,SAAmB,YAAU;EAI5C,aAAoB,mBAAiB,SAC1B,SAAO,QACR,MACP,QAAQ,iBAAiB,UAAU;EAStC,gBAAa,sBAA8B;EAI3C,eAAY,WAAqB,cAAY,QAAQ;EAKrD,yBAAsB,0BAAkC,QAAQ"}

package/dist/auth/index.mjs

@@ -10,7 +10,7 @@ import { timing } from "../utils/timing.mjs";
 import { parse, readForm, readJson, verifyTurnstileToken } from "../utils/valid.mjs";
 import { DesktopCodes } from "./desktop-codes.mjs";
 import { EmailVerificationCodes } from "./email-codes.mjs";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { invariant } from "@shware/utils";
 import { extend, literal, object, regex, string } from "zod/mini";
 // src/auth/index.ts
@@ -227,7 +227,7 @@ var Auth = class {
 		return this.withSession(Response.json({ data: principal !== null }), session);
 	};
 	createPkceParameters() {
-		const code_verifier = randomUUID();
+		const code_verifier = randomBytes(32).toString("base64url");
 		return {
 			code_verifier,
 			code_challenge: createHash("sha256").update(code_verifier).digest().toString("base64url"),
@@ -274,7 +274,11 @@ var Auth = class {
 			state,
 			pkce
 		});
-		const session = await this.loadSession(request) ?? this.repository.createSession();
+		let session = await this.loadSession(request);
+		if (!session) {
+			session = this.repository.createSession();
+			session.setMaxInactiveInterval(OAUTH2_PARAMETER_TTL);
+		}
 		mark("fetch_session");
 		const authorizationRequest = {
 			state,

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomUUID } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { extend, literal, object, regex, string } from 'zod/mini';\nimport type { Principal } from '../core/index';\nimport { loginEmailSchema, sendEmailVerificationCodeSchema } from '../email/schema';\nimport { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2Error, type OAuth2ErrorType, isKnownOAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredential,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n  StandardClaims,\n} from '../oauth2/types';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport {\n  type CookieOptions,\n  deleteCookie,\n  getCookie,\n  param,\n  query,\n  setCookie,\n} from '../utils/http';\nimport { timing } from '../utils/timing';\nimport { parse, readForm, readJson, verifyTurnstileToken } from '../utils/valid';\nimport {\n  MAX_ATTRIBUTES_BYTES,\n  attributesSchema,\n  attributesSize,\n  bodyAttributes,\n} from './attributes';\nimport { DesktopCodes } from './desktop-codes';\nimport { type EmailSender, EmailVerificationCodes } from './email-codes';\nimport { AuthenticationError } from './error';\nimport { errorResponse, invalidArgument, unauthenticated } from './respond';\nimport type {\n  AuthConfig,\n  AuthService,\n  Authorization,\n  AuthorizedHandler,\n  LoggedHandler,\n  OAuth2AuthorizationOptions,\n} from './types';\n\n// PKCE per RFC 7636: code_verifier / code_challenge are 43-128 chars from\n// the unreserved set. We restrict to base64url (drops \".\" and \"~\") since\n// that's what S256 produces and what callers should be sending; rejecting\n// the rest shrinks the accepted input shape without losing legit clients.\n// A 32-byte random verifier base64url-encodes to exactly 43 chars.\nconst PKCE_FORMAT = /^[A-Za-z0-9_-]{43,128}$/;\n\n// A native app's `code_verifier` goes on to the provider, which checks it against the challenge\n// the app sent: accept the whole RFC 7636 unreserved set here, as the provider does.\nconst CODE_VERIFIER_FORMAT = /^[A-Za-z0-9._~-]{43,128}$/;\n\n/** The header a session id travels in besides the cookie, with `session.header` on. */\nconst SESSION_HEADER = 'X-Auth-Token';\n\n/** Seconds an OAuth2 state or nonce may be used within. */\nconst OAUTH2_PARAMETER_TTL = 10 * 60;\n\n// error_description forwarded to errorUri comes from the provider or an error message: cap it so\n// the redirect URL stays short and an attacker-crafted callback cannot stuff the page with text.\nconst MAX_ERROR_DESCRIPTION_LENGTH = 256;\n\n/** An error code safe to put on errorUri: a registered one as is, anything else as `fallback`. */\nfunction safeErrorType(error: string, fallback: OAuth2ErrorType): OAuth2ErrorType {\n  return isKnownOAuth2ErrorType(error) ? error : fallback;\n}\n\n/**\n * The codes a failure past validation keeps on errorUri, each one the user can act on: the code\n * expired or was used (start again), they declined, or the provider is briefly down. Every other\n * failure there (a rejected client, a user info request that failed) is the app's or the\n * provider's problem, which the user sees as `server_error`.\n */\nconst CALLBACK_ERROR_TYPES: ReadonlySet<OAuth2ErrorType> = new Set([\n  'invalid_grant',\n  'access_denied',\n  'temporarily_unavailable',\n]);\n\nfunction authorizationAttributes(\n  attributes: OAuth2AuthorizationOptions['attributes']\n): Record<string, string> | undefined {\n  if (!attributes) return undefined;\n  const defined: Record<string, string> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    if (value !== undefined) defined[key] = value;\n  }\n  if (Object.keys(defined).length === 0) return undefined;\n  // The host's own values, written with the session: oversized is a bug in the host, not a 400.\n  const size = attributesSize(defined);\n  invariant(\n    size <= MAX_ATTRIBUTES_BYTES,\n    `oauth2 authorization attributes are ${size} bytes, at most ${MAX_ATTRIBUTES_BYTES} allowed`\n  );\n  return defined;\n}\n\n/** Sign in with Apple answers with `response_mode=form_post`; a charset parameter may follow. */\nfunction isFormPost(request: Request) {\n  const contentType = request.headers.get('content-type')?.toLowerCase();\n  return (\n    request.method === 'POST' && !!contentType?.startsWith('application/x-www-form-urlencoded')\n  );\n}\n\n/** Google's own form post carries no attributes; an app posting JSON may add them. */\nconst oneTapBodySchema = extend(googleOneTapSchema, { attributes: attributesSchema });\n\nconst desktopAuthorizeSchema = object({\n  code_challenge: string().check(regex(PKCE_FORMAT)),\n  code_challenge_method: literal('S256'),\n});\n\nconst desktopExchangeSchema = object({\n  code: string(),\n  code_verifier: string().check(regex(PKCE_FORMAT)),\n});\n\nexport const PATH = {\n  CSRF: '/csrf',\n  LOGOUT: '/logout',\n  LOGGED: '/logged',\n\n  OAUTH2_STATE: '/oauth2/state/:provider',\n  OAUTH2_NONCE: '/oauth2/nonce/:provider',\n  OAUTH2_AUTHORIZATION: '/oauth2/authorization/:provider',\n  LOGIN_OAUTH2_CODE: '/login/oauth2/code/:provider',\n  LOGIN_OAUTH2_NATIVE: '/login/oauth2/native/:provider',\n  LOGIN_OAUTH2_ONETAP: '/login/oauth2/onetap/google',\n\n  LOGIN_EMAIL: '/login/email',\n  SEND_EMAIL_VERIFICATION_CODE: '/auth/sendEmailVerificationCode',\n\n  // Desktop / native app sign-in via web loopback (RFC 8252 + OAuth 2.1 Auth Code Flow):\n  //   1. user already authenticated with cookie session → POST DESKTOP_AUTHORIZE → { code }\n  //   2. web redirects to desktop's loopback callback with the code\n  //   3. desktop renderer POSTs DESKTOP_EXCHANGE with the code → server returns\n  //      Set-Cookie carrying a fresh session, single-use code is invalidated\n  // The two-step flow keeps the actual session id off the redirect URL — only a\n  // 5-minute single-use code transits via the loopback.\n  DESKTOP_AUTHORIZE: '/auth/desktop/authorize',\n  DESKTOP_EXCHANGE: '/auth/desktop/exchange',\n\n  CLEANUP_EXPIRED_SESSIONS: '/sessions/expired/cleanup',\n} as const;\n\n/**\n * The login routes and session helpers. Every route is one straight line: read and validate the\n * request, check the credential, call the host's `onAuthorized`, sign in. Failures are thrown and\n * answered in one place per kind of route: a JSON route runs under `guard`, which maps a\n * `RequestError`, an `AuthenticationError` or an `OAuth2Error` to its google.rpc body (see\n * `respond.ts`); the redirect callback maps the same errors to `errorUri` parameters (`redirect`).\n */\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n  private readonly turnstileSecretKey?: string;\n  private readonly emailCodes: EmailVerificationCodes;\n  private readonly desktopCodes: DesktopCodes;\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly onetapRequireNonce: boolean;\n  private readonly touchInterval: number;\n  private readonly sessionHeader: boolean;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({\n    sessionRepository,\n    kvRepository,\n    turnstileSecretKey,\n    verificationCode,\n    oauth2,\n    cookie,\n    session,\n    timing,\n  }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    this.turnstileSecretKey = turnstileSecretKey;\n    const maxAttempts = verificationCode?.maxAttempts ?? 5;\n    const resendCooldown = verificationCode?.resendCooldown ?? 60;\n    invariant(maxAttempts >= 1, 'verificationCode.maxAttempts must be at least 1');\n    invariant(resendCooldown >= 1, 'verificationCode.resendCooldown must be at least 1 second');\n    this.emailCodes = new EmailVerificationCodes(kvRepository, { maxAttempts, resendCooldown });\n    this.desktopCodes = new DesktopCodes(kvRepository);\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n    this.onetapRequireNonce = oauth2?.onetap?.requireNonce ?? true;\n    this.touchInterval = (session?.touchInterval ?? 3600) * 1000;\n    this.sessionHeader = session?.header ?? false;\n    invariant(this.touchInterval >= 0, 'session.touchInterval must not be negative');\n  }\n\n  // ---- sessions and responses ------------------------------------------------------------------\n\n  private getSessionId(request: Request): string | undefined {\n    const fromCookie = getCookie(request, this.cookieName);\n    if (fromCookie) return fromCookie;\n    return (this.sessionHeader && request.headers.get(SESSION_HEADER)) || undefined;\n  }\n\n  /** The session the request carries, if it exists. */\n  private async loadSession(request: Request): Promise<Session | null> {\n    const sessionId = this.getSessionId(request);\n    return sessionId ? this.repository.findById(sessionId) : null;\n  }\n\n  /** The signed-in principal of a session, if any. */\n  private principalOf(session: Session): Principal | null {\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    return name ? { name: String(name) } : null;\n  }\n\n  /**\n   * A new session signed in as `principal`. With `carryOver`, what the host kept in the pre-login\n   * session moves to the new one; the authorization request (state, PKCE verifier, flow\n   * attributes) is single-use and was consumed, and a principal left there from an earlier\n   * sign-in is replaced. The new id is never the one the browser brought, which may have been\n   * planted by an attacker who started the flow (session fixation).\n   */\n  private async signIn(principal: Principal, carryOver?: Session): Promise<Session> {\n    const session = this.repository.createSession();\n    for (const attribute of carryOver?.getAttributeNames() ?? []) {\n      if (attribute === this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) continue;\n      if (attribute === PRINCIPAL_NAME_INDEX_NAME) continue;\n      const value = carryOver?.getAttribute(attribute);\n      if (value !== null && value !== undefined) session.setAttribute(attribute, value);\n    }\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    return session;\n  }\n\n  /**\n   * `response` carrying `session`: its cookie, renewed for the whole inactive interval, and with\n   * `session.header` on, the `X-Auth-Token` header a client without a cookie jar reads.\n   */\n  private withSession(response: Response, session: Session, cookie?: CookieOptions): Response {\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), {\n      ...this.cookieOptions,\n      ...cookie,\n      maxAge,\n    });\n    if (this.sessionHeader) response.headers.set(SESSION_HEADER, session.getId());\n    return response;\n  }\n\n  /** Runs a JSON route: a failure it knows is its response, anything else is the host's. */\n  private async guard(run: () => Promise<Response>): Promise<Response> {\n    try {\n      return await run();\n    } catch (error) {\n      const response = errorResponse(error);\n      if (response) return response;\n      throw error;\n    }\n  }\n\n  /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */\n  private redirect(\n    error: OAuth2ErrorType,\n    description?: string,\n    refusal?: AuthenticationError\n  ): Response {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    // Metadata never replaces a parameter: not one errorUri carries itself, nor one set below.\n    for (const [key, value] of Object.entries(refusal?.metadata ?? {})) {\n      if (!uri.searchParams.has(key)) uri.searchParams.set(key, value);\n    }\n    uri.searchParams.set('error', error);\n    if (description) {\n      uri.searchParams.set('error_description', description.slice(0, MAX_ERROR_DESCRIPTION_LENGTH));\n    }\n    if (refusal) uri.searchParams.set('reason', refusal.reason);\n    return Response.redirect(uri.href, 302);\n  }\n\n  // ---- basic -----------------------------------------------------------------------------------\n\n  csrf = async (_request: Request): Promise<Response> => {\n    const token = randomUUID();\n    const response = Response.json({\n      token,\n      parameterName: '_csrf',\n      headerName: 'X-XSRF-TOKEN',\n    });\n\n    // Double Submit Cookie Protection\n    setCookie(response, 'XSRF-TOKEN', token, {\n      path: '/',\n      secure: true,\n      httpOnly: false,\n      sameSite: 'none',\n      domain: this.cookieOptions.domain,\n    });\n    return response;\n  };\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = this.getSessionId(request);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    // A Set-Cookie only replaces the stored cookie when Domain and Path match (RFC 6265),\n    // so clear it with the same attributes it was set with.\n    deleteCookie(response, this.cookieName, this.cookieOptions);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    const session = await this.loadSession(request);\n    if (!session) return Response.json({ data: false });\n\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    const principal = this.principalOf(session);\n    if (principal) await onLogged?.(principal);\n    return this.withSession(Response.json({ data: principal !== null }), session);\n  };\n\n  // ---- oauth2 ----------------------------------------------------------------------------------\n\n  private createPkceParameters(): PkceParameters {\n    const code_verifier = randomUUID();\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  /**\n   * Spends a nonce `oauth2Nonce` issued for `provider`: `NONCE_MISMATCH` for one that was not,\n   * or was used already. An id token is replayable until it expires; the nonce it carries makes\n   * it sign in once.\n   */\n  private async consumeNonce(nonce: string, provider: string): Promise<void> {\n    const key = this.getOauth2NonceKey(nonce);\n    if ((await this.kv.getItem(key)) !== provider) throw new AuthenticationError('NONCE_MISMATCH');\n    await this.kv.removeItem(key);\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = (\n    request: Request,\n    options?: OAuth2AuthorizationOptions\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const attributes = authorizationAttributes(options?.attributes);\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.OAUTH2_AUTHORIZATION);\n      const state = randomUUID();\n      const pkce = this.createPkceParameters();\n      const uri = await this.oauth2Client.createAuthorizationUri({ provider, state, pkce });\n      const session = (await this.loadSession(request)) ?? this.repository.createSession();\n      mark('fetch_session');\n\n      const authorizationRequest: OAuth2AuthorizationRequest = {\n        state,\n        provider,\n        authorizationRequestUri: uri.href,\n        additionalParameters: pkce,\n        ...(attributes ? { attributes } : {}),\n      };\n      session.setAttribute(\n        this.ATTR_OAUTH2_AUTHORIZATION_REQUEST,\n        JSON.stringify(authorizationRequest)\n      );\n      await this.repository.save(session);\n      mark('save_session');\n\n      const response = new Response(null, { status: 302, headers: { location: uri.href } });\n      setTiming(response);\n      return this.withSession(response, session);\n    });\n\n  loginOAuth2Code = async (request: Request, handler: AuthorizedHandler): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. the session the flow started on, and the authorization request it stored\n    const session = await this.loadSession(request);\n    if (!session) return this.redirect('invalid_request', 'session not found');\n    mark('load_session');\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) return this.redirect('invalid_request', 'authorization request not found');\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 2. the provider's answer: query, or a form for Apple's response_mode=form_post\n    const { provider } = param(request, PATH.LOGIN_OAUTH2_CODE);\n    const data = isFormPost(request)\n      ? Object.fromEntries(new URLSearchParams(await request.text()))\n      : query(request);\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) return this.redirect('invalid_request', 'invalid redirect query');\n    // The provider answered with an error instead of a code (the user pressed Cancel →\n    // access_denied, invalid_scope, server_error, ...). Forward it rather than reporting a\n    // malformed query. This runs before the state check on purpose: providers echo state on\n    // error responses, but not all reliably do, and a forged error callback can only make the\n    // victim's popup show an error — nothing is exchanged or signed in. A present state that does\n    // not match still wins, since that is the more accurate (and more alarming) diagnosis.\n    if (parsed.data.error) {\n      if (parsed.data.state && parsed.data.state !== cached.state) {\n        return this.redirect('invalid_request', 'redirect state mismatch');\n      }\n      return this.redirect(\n        safeErrorType(parsed.data.error, 'server_error'),\n        parsed.data.error_description\n      );\n    }\n    const { code, state, user } = parsed.data;\n    if (!code || !state) return this.redirect('invalid_request', 'invalid redirect query');\n    if (state !== cached.state) return this.redirect('invalid_request', 'redirect state mismatch');\n    if (provider !== cached.provider) {\n      return this.redirect('invalid_request', 'redirect provider mismatch');\n    }\n    mark('validate_session');\n\n    // 3. exchange the code, load the user, sign in. Everything here can fail (an expired or reused\n    // code, a network error, the host's handler or session store). The callback runs in a popup\n    // the user is looking at, so every failure must land on errorUri, never as a JSON error.\n    let signedIn: Session;\n    try {\n      const { clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n        provider,\n        code,\n        pkce: cached.additionalParameters,\n      });\n      // Apple posts the user's name alongside the code, once: hand it to the provider with the token.\n      const userInfo = await this.oauth2Client.getUserInfo({\n        provider,\n        clientId,\n        token,\n        response: user ? { user } : undefined,\n      });\n      mark('exchange_code');\n\n      const principal = await handler(request, {\n        provider,\n        clientId,\n        userInfo,\n        token,\n        attributes: cached.attributes ?? {},\n      });\n      mark('save_principal');\n\n      signedIn = await this.signIn(principal, session);\n      await this.repository.deleteById(session.getId());\n      mark('update_session');\n    } catch (error) {\n      // The details stay in the logs: an OAuth2Error message can carry a client id or a\n      // provider's response, which has no place in a URL the browser keeps in its history.\n      if (error instanceof OAuth2Error) {\n        console.warn('OAuth2 callback failed', error);\n        const type = CALLBACK_ERROR_TYPES.has(error.error) ? error.error : 'server_error';\n        return this.redirect(type);\n      }\n      // A refusal is something the user can act on, so its reason and metadata reach the page,\n      // as they reach a JSON client through the ErrorInfo.\n      if (error instanceof AuthenticationError) {\n        console.warn('OAuth2 sign-in refused', error.reason, error.metadata);\n        return this.redirect('access_denied', undefined, error);\n      }\n      console.error('OAuth2 callback failed', error);\n      return this.redirect('server_error');\n    }\n\n    const uri = new URL(this.oauth2Client.successUri);\n    uri.searchParams.set('status', 'success');\n    uri.searchParams.set('provider', provider);\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    setTiming(response);\n    return this.withSession(response, signedIn);\n  };\n\n  /** The shared tail of the JSON login routes: the host's handler, then a signed-in session. */\n  private async authorize(\n    request: Request,\n    handler: AuthorizedHandler,\n    authorization: Authorization,\n    setTiming: (response: Response) => void\n  ): Promise<Response> {\n    const principal = await handler(request, authorization);\n    const session = await this.signIn(principal);\n    const response = Response.json(principal);\n    setTiming(response);\n    return this.withSession(response, session);\n  }\n\n  loginOAuth2Native = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.LOGIN_OAUTH2_NATIVE);\n      const body = await readJson(request);\n      // Whatever the app sends besides its credentials for `onAuthorized` (a referral code, ...).\n      const attributes = bodyAttributes(body);\n      // Only the credentials go on to the provider client.\n      const { attributes: _, ...credentials } = body as NativeCredential & { attributes?: unknown };\n      const { code_verifier } = credentials as { code_verifier?: unknown };\n      if (\n        code_verifier !== undefined &&\n        (typeof code_verifier !== 'string' || !CODE_VERIFIER_FORMAT.test(code_verifier))\n      ) {\n        throw invalidArgument(\n          'INVALID_CODE_VERIFIER',\n          'code_verifier must be 43-128 characters from [A-Za-z0-9-._~]'\n        );\n      }\n      const { clientId, userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n        provider,\n        credentials,\n      });\n      mark('login_oauth2_native');\n\n      const { nonce } = userInfo.data as { nonce?: unknown };\n      if (typeof nonce === 'string' && nonce) {\n        await this.consumeNonce(nonce, provider);\n        mark('check_nonce');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  loginOAuth2Onetap = (\n    request: Request,\n    handler: AuthorizedHandler,\n    provider = 'google'\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n\n      // Google's own form post, or an app's JSON.\n      const contentType = request.headers.get('content-type') ?? '';\n      const body = contentType.includes('application/json')\n        ? await readJson(request)\n        : await readForm(request);\n      const { attributes = {}, ...parsed } = parse(oneTapBodySchema, body);\n\n      // Both the credential and the code are issued to the provider's web client.\n      let clientId: string;\n      let token: Authorization['token'];\n      let userInfo: Authorization['userInfo'];\n      if (parsed.credential) {\n        ({ clientId, token, userInfo } = await this.oauth2Client.getTokenInfo({\n          provider,\n          credential: parsed.credential,\n        }));\n        mark('verify_credential');\n\n        // A credential is replayable until it expires, so it must carry a single-use nonce from\n        // `oauth2Nonce`, which the front end passed to `prompt`. This replaces Google's\n        // `g_csrf_token` double-submit cookie, which FedCM mode no longer sets.\n        const { nonce } = userInfo.data as { nonce?: unknown };\n        if (typeof nonce === 'string' && nonce) {\n          await this.consumeNonce(nonce, provider);\n          mark('check_nonce');\n        } else if (this.onetapRequireNonce) {\n          throw new AuthenticationError('NONCE_MISSING');\n        }\n      } else if (parsed.code) {\n        ({ clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n          provider,\n          code: parsed.code,\n        }));\n        userInfo = await this.oauth2Client.getUserInfo({ provider, clientId, token });\n      } else {\n        throw invalidArgument('INVALID_ARGUMENT', 'credential or code is required');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  // ---- email -----------------------------------------------------------------------------------\n\n  sendEmailVerificationCode = (request: Request, sender: EmailSender): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.turnstileSecretKey, 'turnstileSecretKey is not configured');\n      const { email, turnstileToken } = parse(\n        sendEmailVerificationCodeSchema,\n        await readJson(request)\n      );\n      await verifyTurnstileToken(this.turnstileSecretKey, turnstileToken);\n      await this.emailCodes.send(email, sender);\n      return Response.json({});\n    });\n\n  verifyEmailCode = (email: string, verificationCode: string): Promise<void> =>\n    this.emailCodes.verify(email, verificationCode);\n\n  loginEmail = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      const { setTiming } = timing({ enabled: this.timing });\n      const {\n        email,\n        verificationCode,\n        attributes = {},\n      } = parse(loginEmailSchema, await readJson(request));\n      await this.emailCodes.verify(email, verificationCode);\n      const claims: StandardClaims = { sub: email, email, email_verified: true };\n      return this.authorize(\n        request,\n        handler,\n        { provider: 'EMAIL', userInfo: { claims, data: {} }, attributes },\n        setTiming\n      );\n    });\n\n  // ---- desktop ---------------------------------------------------------------------------------\n\n  /**\n   * Step 1 of the desktop / native app sign-in handshake. The caller already completed normal\n   * sign-in on the web (so a cookie session exists); this issues a 5-minute single-use code that\n   * the web page hands off to the desktop client via a loopback redirect.\n   *\n   * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier` before opening the\n   * browser, derives `code_challenge = base64url(sha256(verifier))`, and threads the challenge\n   * through the URL → web page → here. The challenge is pinned to the code; `desktopExchange`\n   * enforces that the caller knows the matching verifier. This blocks an attacker who only\n   * intercepts the auth code (browser history, malicious extension, packet capture on loopback)\n   * from exchanging it.\n   *\n   * Requires an authenticated cookie session: anonymous callers get 401. Throttling / abuse\n   * protection on this endpoint is the API layer's job (rate-limit per principal); the SDK does\n   * not gate it because the upstream sign-in flow already passed CAPTCHA / OAuth / verification.\n   */\n  desktopAuthorize = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const principal = await this.getPrincipal(request);\n      if (!principal) throw unauthenticated('Sign in first');\n      const { code_challenge } = parse(desktopAuthorizeSchema, await readJson(request));\n      const code = await this.desktopCodes.issue(principal, code_challenge);\n      return Response.json({ code });\n    });\n\n  /**\n   * Step 2 of the desktop / native app sign-in handshake. The desktop client hands back the auth\n   * code it received via the loopback callback, and we mint a fresh session for it, independent\n   * of the web cookie session that originally authorized the code, so logging out on either side\n   * does not cascade to the other.\n   *\n   * Cookie attributes: `SameSite=None; Secure` so the cookie survives cross-site fetches from the\n   * desktop renderer's `file://` / `app://` origin. The configured `cookieOptions` provide\n   * everything else (`domain`, `path`, `httpOnly`); the override is targeted at the\n   * SameSite/Secure pair only. In a non-HTTPS dev backend this combination is rejected by\n   * Chromium, see the desktop sign-in PRD for workarounds.\n   *\n   * No CSRF check needed: the request carries no cookie, the auth code itself is the credential,\n   * and the code's single-use removal blocks replay.\n   */\n  desktopExchange = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const { code, code_verifier } = parse(desktopExchangeSchema, await readJson(request));\n      const principal = await this.desktopCodes.redeem(code, code_verifier);\n      const session = await this.signIn(principal);\n      session.setAttribute('client_type', 'desktop');\n      await this.repository.save(session);\n      return this.withSession(Response.json({ ok: true }), session, {\n        sameSite: 'none',\n        secure: true,\n      });\n    });\n\n  // ---- session management ----------------------------------------------------------------------\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  /**\n   * Sliding expiration: an authenticated request renews the session, as `logged` does, so a user\n   * who keeps using the app is never signed out after `maxInactiveInterval` of not calling one\n   * particular endpoint. No extra read: the session was just loaded to authenticate, and its\n   * `lastAccessedTime` is compared in memory; writes are spaced by `session.touchInterval` (see\n   * `AuthConfig`), so a session accessed again within the interval is not rewritten.\n   */\n  private async touch(session: Session) {\n    const now = Date.now();\n    if (now - session.getLastAccessedTime() < this.touchInterval) return;\n    session.setLastAccessedTime(now);\n    await this.repository.save(session);\n  }\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const session = await this.loadSession(request);\n    const principal = session && this.principalOf(session);\n    if (!principal) return null;\n    await this.touch(session);\n    return principal;\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    return (await this.getPrincipal(request)) !== null;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    type Result = T extends true ? Session : Session | null;\n    const session = await this.loadSession(request);\n    if (session || !create) return session as Result;\n    const created = this.repository.createSession();\n    await this.repository.save(created);\n    return created;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiDA,MAAM,cAAc;AAIpB,MAAM,uBAAuB;;AAG7B,MAAM,iBAAiB;;AAGvB,MAAM,uBAAuB;AAI7B,MAAM,+BAA+B;;AAGrC,SAAS,cAAc,OAAe,UAA4C;CAChF,OAAO,uBAAuB,KAAK,IAAI,QAAQ;AACjD;;;;;;;AAQA,MAAM,uCAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;AAED,SAAS,wBACP,YACoC;CACpC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAE1C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAE9C,MAAM,OAAO,eAAe,OAAO;CACnC,UACE,QAAQ,sBACR,uCAAuC,KAAK,kBAAkB,qBAAqB,SACrF;CACA,OAAO;AACT;;AAGA,SAAS,WAAW,SAAkB;CACpC,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY;CACrE,OACE,QAAQ,WAAW,UAAU,CAAC,CAAC,aAAa,WAAW,mCAAmC;AAE9F;;AAGA,MAAM,mBAAmB,OAAO,oBAAoB,EAAE,YAAY,iBAAiB,CAAC;AAEpF,MAAM,yBAAyB,OAAO;CACpC,gBAAgB,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC;CACjD,uBAAuB,QAAQ,MAAM;AACvC,CAAC;AAED,MAAM,wBAAwB,OAAO;CACnC,MAAM,OAAO;CACb,eAAe,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC;AAClD,CAAC;AAED,MAAa,OAAO;CAClB,MAAM;CACN,QAAQ;CACR,QAAQ;CAER,cAAc;CACd,cAAc;CACd,sBAAsB;CACtB,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CAErB,aAAa;CACb,8BAA8B;CAS9B,mBAAmB;CACnB,kBAAkB;CAElB,0BAA0B;AAC5B;;;;;;;;AASA,IAAa,OAAb,MAAyC;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,oCAAqD;CAErD,YAAY,EACV,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACa;EACb,KAAK,SAAS,UAAU;EACxB,KAAK,KAAK;EACV,KAAK,aAAa;EAClB,KAAK,qBAAqB;EAC1B,MAAM,cAAc,kBAAkB,eAAe;EACrD,MAAM,iBAAiB,kBAAkB,kBAAkB;EAC3D,UAAU,eAAe,GAAG,iDAAiD;EAC7E,UAAU,kBAAkB,GAAG,2DAA2D;EAC1F,KAAK,aAAa,IAAI,uBAAuB,cAAc;GAAE;GAAa;EAAe,CAAC;EAC1F,KAAK,eAAe,IAAI,aAAa,YAAY;EACjD,MAAM,EAAE,MAAM,GAAG,kBAAkB,UAAU,CAAC;EAC9C,KAAK,aAAa,QAAQ;EAC1B,KAAK,gBAAgB;GACnB,MAAM;GACN,UAAU;GACV,QAAQ;GACR,UAAU;GACV,GAAG;EACL;EACA,KAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;EACvE,KAAK,qBAAqB,QAAQ,QAAQ,gBAAgB;EAC1D,KAAK,iBAAiB,SAAS,iBAAiB,QAAQ;EACxD,KAAK,gBAAgB,SAAS,UAAU;EACxC,UAAU,KAAK,iBAAiB,GAAG,4CAA4C;CACjF;CAIA,aAAqB,SAAsC;EACzD,MAAM,aAAa,UAAU,SAAS,KAAK,UAAU;EACrD,IAAI,YAAY,OAAO;EACvB,OAAQ,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,cAAc,KAAM,KAAA;CACxE;;CAGA,MAAc,YAAY,SAA2C;EACnE,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,OAAO,YAAY,KAAK,WAAW,SAAS,SAAS,IAAI;CAC3D;;CAGA,YAAoB,SAAoC;EACtD,MAAM,OAAO,QAAQ,aAAa,yBAAyB;EAC3D,OAAO,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI;CACzC;;;;;;;;CASA,MAAc,OAAO,WAAsB,WAAuC;EAChF,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,KAAK,MAAM,aAAa,WAAW,kBAAkB,KAAK,CAAC,GAAG;GAC5D,IAAI,cAAc,KAAK,mCAAmC;GAC1D,IAAI,cAAA,iBAAyC;GAC7C,MAAM,QAAQ,WAAW,aAAa,SAAS;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,QAAQ,aAAa,WAAW,KAAK;EAClF;EACA,QAAQ,aAAa,2BAA2B,UAAU,IAAI;EAC9D,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;;;;;CAMA,YAAoB,UAAoB,SAAkB,QAAkC;EAC1F,MAAM,SAAS,QAAQ,uBAAuB;EAC9C,UAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG;GACpD,GAAG,KAAK;GACR,GAAG;GACH;EACF,CAAC;EACD,IAAI,KAAK,eAAe,SAAS,QAAQ,IAAI,gBAAgB,QAAQ,MAAM,CAAC;EAC5E,OAAO;CACT;;CAGA,MAAc,MAAM,KAAiD;EACnE,IAAI;GACF,OAAO,MAAM,IAAI;EACnB,SAAS,OAAO;GACd,MAAM,WAAW,cAAc,KAAK;GACpC,IAAI,UAAU,OAAO;GACrB,MAAM;EACR;CACF;;CAGA,SACE,OACA,aACA,SACU;EACV,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;EAE9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,GAC/D,IAAI,CAAC,IAAI,aAAa,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAEjE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,aACF,IAAI,aAAa,IAAI,qBAAqB,YAAY,MAAM,GAAG,4BAA4B,CAAC;EAE9F,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EAC1D,OAAO,SAAS,SAAS,IAAI,MAAM,GAAG;CACxC;CAIA,OAAO,OAAO,aAAyC;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,WAAW,SAAS,KAAK;GAC7B;GACA,eAAe;GACf,YAAY;EACd,CAAC;EAGD,UAAU,UAAU,cAAc,OAAO;GACvC,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,KAAK,cAAc;EAC7B,CAAC;EACD,OAAO;CACT;CAEA,SAAS,OAAO,YAAwC;EACtD,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,IAAI,WAAW,MAAM,KAAK,WAAW,WAAW,SAAS;EACzD,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC;EAGjC,aAAa,UAAU,KAAK,YAAY,KAAK,aAAa;EAC1D,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,aAAgD;EAChF,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;EAElD,QAAQ,oBAAoB,KAAK,IAAI,CAAC;EACtC,MAAM,KAAK,WAAW,KAAK,OAAO;EAElC,MAAM,YAAY,KAAK,YAAY,OAAO;EAC1C,IAAI,WAAW,MAAM,WAAW,SAAS;EACzC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,OAAO;CAC9E;CAIA,uBAA+C;EAC7C,MAAM,gBAAgB,WAAW;EAMjC,OAAO;GAAE;GAAe,gBALD,WAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,CAAC,CACR,SAAS,WAEyB;GAAG,uBAAuB;EAAO;CACxE;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;;;;;;CAOA,MAAc,aAAa,OAAe,UAAiC;EACzE,MAAM,MAAM,KAAK,kBAAkB,KAAK;EACxC,IAAK,MAAM,KAAK,GAAG,QAAQ,GAAG,MAAO,UAAU,MAAM,IAAI,oBAAoB,gBAAgB;EAC7F,MAAM,KAAK,GAAG,WAAW,GAAG;CAC9B;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,uBACE,SACA,YAEA,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,aAAa,wBAAwB,SAAS,UAAU;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,oBAAoB;EAC7D,MAAM,QAAQ,WAAW;EACzB,MAAM,OAAO,KAAK,qBAAqB;EACvC,MAAM,MAAM,MAAM,KAAK,aAAa,uBAAuB;GAAE;GAAU;GAAO;EAAK,CAAC;EACpF,MAAM,UAAW,MAAM,KAAK,YAAY,OAAO,KAAM,KAAK,WAAW,cAAc;EACnF,KAAK,eAAe;EAEpB,MAAM,uBAAmD;GACvD;GACA;GACA,yBAAyB,IAAI;GAC7B,sBAAsB;GACtB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC;EACA,QAAQ,aACN,KAAK,mCACL,KAAK,UAAU,oBAAoB,CACrC;EACA,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,KAAK,cAAc;EAEnB,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C,CAAC;CAEH,kBAAkB,OAAO,SAAkB,YAAkD;EAC3F,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAG3D,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,mBAAmB,mBAAmB;EACzE,KAAK,cAAc;EACnB,MAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;EACxE,IAAI,CAAC,MAAM,OAAO,KAAK,SAAS,mBAAmB,iCAAiC;EACpF,MAAM,SAAqC,KAAK,MAAM,IAAI;EAG1D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,iBAAiB;EAC1D,MAAM,OAAO,WAAW,OAAO,IAC3B,OAAO,YAAY,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC,CAAC,IAC5D,MAAM,OAAO;EACjB,MAAM,SAAS,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EAOrF,IAAI,OAAO,KAAK,OAAO;GACrB,IAAI,OAAO,KAAK,SAAS,OAAO,KAAK,UAAU,OAAO,OACpD,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;GAEnE,OAAO,KAAK,SACV,cAAc,OAAO,KAAK,OAAO,cAAc,GAC/C,OAAO,KAAK,iBACd;EACF;EACA,MAAM,EAAE,MAAM,OAAO,SAAS,OAAO;EACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EACrF,IAAI,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;EAC7F,IAAI,aAAa,OAAO,UACtB,OAAO,KAAK,SAAS,mBAAmB,4BAA4B;EAEtE,KAAK,kBAAkB;EAKvB,IAAI;EACJ,IAAI;GACF,MAAM,EAAE,UAAU,UAAU,MAAM,KAAK,aAAa,0BAA0B;IAC5E;IACA;IACA,MAAM,OAAO;GACf,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,aAAa,YAAY;IACnD;IACA;IACA;IACA,UAAU,OAAO,EAAE,KAAK,IAAI,KAAA;GAC9B,CAAC;GACD,KAAK,eAAe;GAEpB,MAAM,YAAY,MAAM,QAAQ,SAAS;IACvC;IACA;IACA;IACA;IACA,YAAY,OAAO,cAAc,CAAC;GACpC,CAAC;GACD,KAAK,gBAAgB;GAErB,WAAW,MAAM,KAAK,OAAO,WAAW,OAAO;GAC/C,MAAM,KAAK,WAAW,WAAW,QAAQ,MAAM,CAAC;GAChD,KAAK,gBAAgB;EACvB,SAAS,OAAO;GAGd,IAAI,iBAAiB,aAAa;IAChC,QAAQ,KAAK,0BAA0B,KAAK;IAC5C,MAAM,OAAO,qBAAqB,IAAI,MAAM,KAAK,IAAI,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,IAAI;GAC3B;GAGA,IAAI,iBAAiB,qBAAqB;IACxC,QAAQ,KAAK,0BAA0B,MAAM,QAAQ,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,iBAAiB,KAAA,GAAW,KAAK;GACxD;GACA,QAAQ,MAAM,0BAA0B,KAAK;GAC7C,OAAO,KAAK,SAAS,cAAc;EACrC;EAEA,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,UAAU;EAChD,IAAI,aAAa,IAAI,UAAU,SAAS;EACxC,IAAI,aAAa,IAAI,YAAY,QAAQ;EACzC,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,QAAQ;CAC5C;;CAGA,MAAc,UACZ,SACA,SACA,eACA,WACmB;EACnB,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa;EACtD,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,MAAM,WAAW,SAAS,KAAK,SAAS;EACxC,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;CAEA,qBAAqB,SAAkB,YACrC,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,mBAAmB;EAC5D,MAAM,OAAO,MAAM,SAAS,OAAO;EAEnC,MAAM,aAAa,eAAe,IAAI;EAEtC,MAAM,EAAE,YAAY,GAAG,GAAG,gBAAgB;EAC1C,MAAM,EAAE,kBAAkB;EAC1B,IACE,kBAAkB,KAAA,MACjB,OAAO,kBAAkB,YAAY,CAAC,qBAAqB,KAAK,aAAa,IAE9E,MAAM,gBACJ,yBACA,8DACF;EAEF,MAAM,EAAE,UAAU,UAAU,UAAU,MAAM,KAAK,aAAa,kBAAkB;GAC9E;GACA;EACF,CAAC;EACD,KAAK,qBAAqB;EAE1B,MAAM,EAAE,UAAU,SAAS;EAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;GACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;GACvC,KAAK,aAAa;EACpB;EAEA,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAEH,qBACE,SACA,SACA,WAAW,aAEX,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAI3D,MAAM,QADc,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAClC,SAAS,kBAAkB,IAChD,MAAM,SAAS,OAAO,IACtB,MAAM,SAAS,OAAO;EAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,GAAG,WAAW,MAAM,kBAAkB,IAAI;EAGnE,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,YAAY;GACrB,CAAC,CAAE,UAAU,OAAO,YAAa,MAAM,KAAK,aAAa,aAAa;IACpE;IACA,YAAY,OAAO;GACrB,CAAC;GACD,KAAK,mBAAmB;GAKxB,MAAM,EAAE,UAAU,SAAS;GAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;IACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;IACvC,KAAK,aAAa;GACpB,OAAO,IAAI,KAAK,oBACd,MAAM,IAAI,oBAAoB,eAAe;EAEjD,OAAO,IAAI,OAAO,MAAM;GACtB,CAAC,CAAE,UAAU,SAAU,MAAM,KAAK,aAAa,0BAA0B;IACvE;IACA,MAAM,OAAO;GACf,CAAC;GACD,WAAW,MAAM,KAAK,aAAa,YAAY;IAAE;IAAU;IAAU;GAAM,CAAC;EAC9E,OACE,MAAM,gBAAgB,oBAAoB,gCAAgC;EAG5E,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAIH,6BAA6B,SAAkB,WAC7C,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,oBAAoB,sCAAsC;EACzE,MAAM,EAAE,OAAO,mBAAmB,MAChC,iCACA,MAAM,SAAS,OAAO,CACxB;EACA,MAAM,qBAAqB,KAAK,oBAAoB,cAAc;EAClE,MAAM,KAAK,WAAW,KAAK,OAAO,MAAM;EACxC,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB,CAAC;CAEH,mBAAmB,OAAe,qBAChC,KAAK,WAAW,OAAO,OAAO,gBAAgB;CAEhD,cAAc,SAAkB,YAC9B,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EACrD,MAAM,EACJ,OACA,kBACA,aAAa,CAAC,MACZ,MAAM,kBAAkB,MAAM,SAAS,OAAO,CAAC;EACnD,MAAM,KAAK,WAAW,OAAO,OAAO,gBAAgB;EACpD,MAAM,SAAyB;GAAE,KAAK;GAAO;GAAO,gBAAgB;EAAK;EACzE,OAAO,KAAK,UACV,SACA,SACA;GAAE,UAAU;GAAS,UAAU;IAAE;IAAQ,MAAM,CAAC;GAAE;GAAG;EAAW,GAChE,SACF;CACF,CAAC;;;;;;;;;;;;;;;;;CAoBH,oBAAoB,YAClB,KAAK,MAAM,YAAY;EACrB,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO;EACjD,IAAI,CAAC,WAAW,MAAM,gBAAgB,eAAe;EACrD,MAAM,EAAE,mBAAmB,MAAM,wBAAwB,MAAM,SAAS,OAAO,CAAC;EAChF,MAAM,OAAO,MAAM,KAAK,aAAa,MAAM,WAAW,cAAc;EACpE,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;CAC/B,CAAC;;;;;;;;;;;;;;;;CAiBH,mBAAmB,YACjB,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,MAAM,kBAAkB,MAAM,uBAAuB,MAAM,SAAS,OAAO,CAAC;EACpF,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO,MAAM,aAAa;EACpE,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,QAAQ,aAAa,eAAe,SAAS;EAC7C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,SAAS;GAC5D,UAAU;GACV,QAAQ;EACV,CAAC;CACH,CAAC;CAIH,OAAO,OAAO,cAAwC;EACpD,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,KAAK,MAAM,aAAa,SAAS,KAAK,GACpC,MAAM,KAAK,WAAW,WAAW,SAAS;CAE9C;;;;;;;;CASA,MAAc,MAAM,SAAkB;EACpC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,QAAQ,oBAAoB,IAAI,KAAK,eAAe;EAC9D,QAAQ,oBAAoB,GAAG;EAC/B,MAAM,KAAK,WAAW,KAAK,OAAO;CACpC;CAEA,eAAe,OAAO,YAAgD;EACpE,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;EACrD,IAAI,CAAC,WAAW,OAAO;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,OAAO;CACT;CAEA,kBAAkB,OAAO,YAAuC;EAC9D,OAAQ,MAAM,KAAK,aAAa,OAAO,MAAO;CAChD;CAEA,aAAa,OACX,SACA,WACuD;EAEvD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,WAAW,CAAC,QAAQ,OAAO;EAC/B,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;CAEA,gBAAgB,OAAO,cAAqC;EAC1D,MAAM,KAAK,WAAW,WAAW,SAAS;CAC5C;CAEA,eAAe,OAAO,cAA6C;EACjE,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;CACrC;CAEA,yBAAyB,OAAO,iBAA6C;EAC3E,MAAM,KAAK,WAAW,uBAAuB,YAAY;EACzD,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomUUID } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { extend, literal, object, regex, string } from 'zod/mini';\nimport type { Principal } from '../core/index';\nimport { loginEmailSchema, sendEmailVerificationCodeSchema } from '../email/schema';\nimport { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2Error, type OAuth2ErrorType, isKnownOAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredential,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n  StandardClaims,\n} from '../oauth2/types';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport {\n  type CookieOptions,\n  deleteCookie,\n  getCookie,\n  param,\n  query,\n  setCookie,\n} from '../utils/http';\nimport { timing } from '../utils/timing';\nimport { parse, readForm, readJson, verifyTurnstileToken } from '../utils/valid';\nimport {\n  MAX_ATTRIBUTES_BYTES,\n  attributesSchema,\n  attributesSize,\n  bodyAttributes,\n} from './attributes';\nimport { DesktopCodes } from './desktop-codes';\nimport { type EmailSender, EmailVerificationCodes } from './email-codes';\nimport { AuthenticationError } from './error';\nimport { errorResponse, invalidArgument, unauthenticated } from './respond';\nimport type {\n  AuthConfig,\n  AuthService,\n  Authorization,\n  AuthorizedHandler,\n  LoggedHandler,\n  OAuth2AuthorizationOptions,\n} from './types';\n\n// PKCE per RFC 7636: code_verifier / code_challenge are 43-128 chars from\n// the unreserved set. We restrict to base64url (drops \".\" and \"~\") since\n// that's what S256 produces and what callers should be sending; rejecting\n// the rest shrinks the accepted input shape without losing legit clients.\n// A 32-byte random verifier base64url-encodes to exactly 43 chars.\nconst PKCE_FORMAT = /^[A-Za-z0-9_-]{43,128}$/;\n\n// A native app's `code_verifier` goes on to the provider, which checks it against the challenge\n// the app sent: accept the whole RFC 7636 unreserved set here, as the provider does.\nconst CODE_VERIFIER_FORMAT = /^[A-Za-z0-9._~-]{43,128}$/;\n\n/** The header a session id travels in besides the cookie, with `session.header` on. */\nconst SESSION_HEADER = 'X-Auth-Token';\n\n/** Seconds an OAuth2 state or nonce may be used within. */\nconst OAUTH2_PARAMETER_TTL = 10 * 60;\n\n// error_description forwarded to errorUri comes from the provider or an error message: cap it so\n// the redirect URL stays short and an attacker-crafted callback cannot stuff the page with text.\nconst MAX_ERROR_DESCRIPTION_LENGTH = 256;\n\n/** An error code safe to put on errorUri: a registered one as is, anything else as `fallback`. */\nfunction safeErrorType(error: string, fallback: OAuth2ErrorType): OAuth2ErrorType {\n  return isKnownOAuth2ErrorType(error) ? error : fallback;\n}\n\n/**\n * The codes a failure past validation keeps on errorUri, each one the user can act on: the code\n * expired or was used (start again), they declined, or the provider is briefly down. Every other\n * failure there (a rejected client, a user info request that failed) is the app's or the\n * provider's problem, which the user sees as `server_error`.\n */\nconst CALLBACK_ERROR_TYPES: ReadonlySet<OAuth2ErrorType> = new Set([\n  'invalid_grant',\n  'access_denied',\n  'temporarily_unavailable',\n]);\n\nfunction authorizationAttributes(\n  attributes: OAuth2AuthorizationOptions['attributes']\n): Record<string, string> | undefined {\n  if (!attributes) return undefined;\n  const defined: Record<string, string> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    if (value !== undefined) defined[key] = value;\n  }\n  if (Object.keys(defined).length === 0) return undefined;\n  // The host's own values, written with the session: oversized is a bug in the host, not a 400.\n  const size = attributesSize(defined);\n  invariant(\n    size <= MAX_ATTRIBUTES_BYTES,\n    `oauth2 authorization attributes are ${size} bytes, at most ${MAX_ATTRIBUTES_BYTES} allowed`\n  );\n  return defined;\n}\n\n/** Sign in with Apple answers with `response_mode=form_post`; a charset parameter may follow. */\nfunction isFormPost(request: Request) {\n  const contentType = request.headers.get('content-type')?.toLowerCase();\n  return (\n    request.method === 'POST' && !!contentType?.startsWith('application/x-www-form-urlencoded')\n  );\n}\n\n/** Google's own form post carries no attributes; an app posting JSON may add them. */\nconst oneTapBodySchema = extend(googleOneTapSchema, { attributes: attributesSchema });\n\nconst desktopAuthorizeSchema = object({\n  code_challenge: string().check(regex(PKCE_FORMAT)),\n  code_challenge_method: literal('S256'),\n});\n\nconst desktopExchangeSchema = object({\n  code: string(),\n  code_verifier: string().check(regex(PKCE_FORMAT)),\n});\n\nexport const PATH = {\n  CSRF: '/csrf',\n  LOGOUT: '/logout',\n  LOGGED: '/logged',\n\n  OAUTH2_STATE: '/oauth2/state/:provider',\n  OAUTH2_NONCE: '/oauth2/nonce/:provider',\n  OAUTH2_AUTHORIZATION: '/oauth2/authorization/:provider',\n  LOGIN_OAUTH2_CODE: '/login/oauth2/code/:provider',\n  LOGIN_OAUTH2_NATIVE: '/login/oauth2/native/:provider',\n  LOGIN_OAUTH2_ONETAP: '/login/oauth2/onetap/google',\n\n  LOGIN_EMAIL: '/login/email',\n  SEND_EMAIL_VERIFICATION_CODE: '/auth/sendEmailVerificationCode',\n\n  // Desktop / native app sign-in via web loopback (RFC 8252 + OAuth 2.1 Auth Code Flow):\n  //   1. user already authenticated with cookie session → POST DESKTOP_AUTHORIZE → { code }\n  //   2. web redirects to desktop's loopback callback with the code\n  //   3. desktop renderer POSTs DESKTOP_EXCHANGE with the code → server returns\n  //      Set-Cookie carrying a fresh session, single-use code is invalidated\n  // The two-step flow keeps the actual session id off the redirect URL — only a\n  // 5-minute single-use code transits via the loopback.\n  DESKTOP_AUTHORIZE: '/auth/desktop/authorize',\n  DESKTOP_EXCHANGE: '/auth/desktop/exchange',\n\n  CLEANUP_EXPIRED_SESSIONS: '/sessions/expired/cleanup',\n} as const;\n\n/**\n * The login routes and session helpers. Every route is one straight line: read and validate the\n * request, check the credential, call the host's `onAuthorized`, sign in. Failures are thrown and\n * answered in one place per kind of route: a JSON route runs under `guard`, which maps a\n * `RequestError`, an `AuthenticationError` or an `OAuth2Error` to its google.rpc body (see\n * `respond.ts`); the redirect callback maps the same errors to `errorUri` parameters (`redirect`).\n */\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n  private readonly turnstileSecretKey?: string;\n  private readonly emailCodes: EmailVerificationCodes;\n  private readonly desktopCodes: DesktopCodes;\n  private readonly oauth2Client: OAuth2Client | null;\n  private readonly onetapRequireNonce: boolean;\n  private readonly touchInterval: number;\n  private readonly sessionHeader: boolean;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({\n    sessionRepository,\n    kvRepository,\n    turnstileSecretKey,\n    verificationCode,\n    oauth2,\n    cookie,\n    session,\n    timing,\n  }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    this.turnstileSecretKey = turnstileSecretKey;\n    const maxAttempts = verificationCode?.maxAttempts ?? 5;\n    const resendCooldown = verificationCode?.resendCooldown ?? 60;\n    invariant(maxAttempts >= 1, 'verificationCode.maxAttempts must be at least 1');\n    invariant(resendCooldown >= 1, 'verificationCode.resendCooldown must be at least 1 second');\n    this.emailCodes = new EmailVerificationCodes(kvRepository, { maxAttempts, resendCooldown });\n    this.desktopCodes = new DesktopCodes(kvRepository);\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n    this.onetapRequireNonce = oauth2?.onetap?.requireNonce ?? true;\n    this.touchInterval = (session?.touchInterval ?? 3600) * 1000;\n    this.sessionHeader = session?.header ?? false;\n    invariant(this.touchInterval >= 0, 'session.touchInterval must not be negative');\n  }\n\n  // ---- sessions and responses ------------------------------------------------------------------\n\n  private getSessionId(request: Request): string | undefined {\n    const fromCookie = getCookie(request, this.cookieName);\n    if (fromCookie) return fromCookie;\n    return (this.sessionHeader && request.headers.get(SESSION_HEADER)) || undefined;\n  }\n\n  /** The session the request carries, if it exists. */\n  private async loadSession(request: Request): Promise<Session | null> {\n    const sessionId = this.getSessionId(request);\n    return sessionId ? this.repository.findById(sessionId) : null;\n  }\n\n  /** The signed-in principal of a session, if any. */\n  private principalOf(session: Session): Principal | null {\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    return name ? { name: String(name) } : null;\n  }\n\n  /**\n   * A new session signed in as `principal`. With `carryOver`, what the host kept in the pre-login\n   * session moves to the new one; the authorization request (state, PKCE verifier, flow\n   * attributes) is single-use and was consumed, and a principal left there from an earlier\n   * sign-in is replaced. The new id is never the one the browser brought, which may have been\n   * planted by an attacker who started the flow (session fixation).\n   */\n  private async signIn(principal: Principal, carryOver?: Session): Promise<Session> {\n    const session = this.repository.createSession();\n    for (const attribute of carryOver?.getAttributeNames() ?? []) {\n      if (attribute === this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) continue;\n      if (attribute === PRINCIPAL_NAME_INDEX_NAME) continue;\n      const value = carryOver?.getAttribute(attribute);\n      if (value !== null && value !== undefined) session.setAttribute(attribute, value);\n    }\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    return session;\n  }\n\n  /**\n   * `response` carrying `session`: its cookie, renewed for the whole inactive interval, and with\n   * `session.header` on, the `X-Auth-Token` header a client without a cookie jar reads.\n   */\n  private withSession(response: Response, session: Session, cookie?: CookieOptions): Response {\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), {\n      ...this.cookieOptions,\n      ...cookie,\n      maxAge,\n    });\n    if (this.sessionHeader) response.headers.set(SESSION_HEADER, session.getId());\n    return response;\n  }\n\n  /** Runs a JSON route: a failure it knows is its response, anything else is the host's. */\n  private async guard(run: () => Promise<Response>): Promise<Response> {\n    try {\n      return await run();\n    } catch (error) {\n      const response = errorResponse(error);\n      if (response) return response;\n      throw error;\n    }\n  }\n\n  /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */\n  private redirect(\n    error: OAuth2ErrorType,\n    description?: string,\n    refusal?: AuthenticationError\n  ): Response {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    // Metadata never replaces a parameter: not one errorUri carries itself, nor one set below.\n    for (const [key, value] of Object.entries(refusal?.metadata ?? {})) {\n      if (!uri.searchParams.has(key)) uri.searchParams.set(key, value);\n    }\n    uri.searchParams.set('error', error);\n    if (description) {\n      uri.searchParams.set('error_description', description.slice(0, MAX_ERROR_DESCRIPTION_LENGTH));\n    }\n    if (refusal) uri.searchParams.set('reason', refusal.reason);\n    return Response.redirect(uri.href, 302);\n  }\n\n  // ---- basic -----------------------------------------------------------------------------------\n\n  csrf = async (_request: Request): Promise<Response> => {\n    const token = randomUUID();\n    const response = Response.json({\n      token,\n      parameterName: '_csrf',\n      headerName: 'X-XSRF-TOKEN',\n    });\n\n    // Double Submit Cookie Protection\n    setCookie(response, 'XSRF-TOKEN', token, {\n      path: '/',\n      secure: true,\n      httpOnly: false,\n      sameSite: 'none',\n      domain: this.cookieOptions.domain,\n    });\n    return response;\n  };\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = this.getSessionId(request);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    // A Set-Cookie only replaces the stored cookie when Domain and Path match (RFC 6265),\n    // so clear it with the same attributes it was set with.\n    deleteCookie(response, this.cookieName, this.cookieOptions);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    const session = await this.loadSession(request);\n    if (!session) return Response.json({ data: false });\n\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    const principal = this.principalOf(session);\n    if (principal) await onLogged?.(principal);\n    return this.withSession(Response.json({ data: principal !== null }), session);\n  };\n\n  // ---- oauth2 ----------------------------------------------------------------------------------\n\n  private createPkceParameters(): PkceParameters {\n    // 32 random bytes: a 43-char base64url verifier, the RFC 7636 minimum (a UUID is 36).\n    const code_verifier = randomBytes(32).toString('base64url');\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  /**\n   * Spends a nonce `oauth2Nonce` issued for `provider`: `NONCE_MISMATCH` for one that was not,\n   * or was used already. An id token is replayable until it expires; the nonce it carries makes\n   * it sign in once.\n   */\n  private async consumeNonce(nonce: string, provider: string): Promise<void> {\n    const key = this.getOauth2NonceKey(nonce);\n    if ((await this.kv.getItem(key)) !== provider) throw new AuthenticationError('NONCE_MISMATCH');\n    await this.kv.removeItem(key);\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = (\n    request: Request,\n    options?: OAuth2AuthorizationOptions\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const attributes = authorizationAttributes(options?.attributes);\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.OAUTH2_AUTHORIZATION);\n      const state = randomUUID();\n      const pkce = this.createPkceParameters();\n      const uri = await this.oauth2Client.createAuthorizationUri({ provider, state, pkce });\n      let session = await this.loadSession(request);\n      if (!session) {\n        // A session made for the flow only has to outlive the state: an abandoned flow must not\n        // keep a row for the default interval. Sign-in moves to a new session, with the default.\n        session = this.repository.createSession();\n        session.setMaxInactiveInterval(OAUTH2_PARAMETER_TTL);\n      }\n      mark('fetch_session');\n\n      const authorizationRequest: OAuth2AuthorizationRequest = {\n        state,\n        provider,\n        authorizationRequestUri: uri.href,\n        additionalParameters: pkce,\n        ...(attributes ? { attributes } : {}),\n      };\n      session.setAttribute(\n        this.ATTR_OAUTH2_AUTHORIZATION_REQUEST,\n        JSON.stringify(authorizationRequest)\n      );\n      await this.repository.save(session);\n      mark('save_session');\n\n      const response = new Response(null, { status: 302, headers: { location: uri.href } });\n      setTiming(response);\n      return this.withSession(response, session);\n    });\n\n  loginOAuth2Code = async (request: Request, handler: AuthorizedHandler): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. the session the flow started on, and the authorization request it stored\n    const session = await this.loadSession(request);\n    if (!session) return this.redirect('invalid_request', 'session not found');\n    mark('load_session');\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) return this.redirect('invalid_request', 'authorization request not found');\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 2. the provider's answer: query, or a form for Apple's response_mode=form_post\n    const { provider } = param(request, PATH.LOGIN_OAUTH2_CODE);\n    const data = isFormPost(request)\n      ? Object.fromEntries(new URLSearchParams(await request.text()))\n      : query(request);\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) return this.redirect('invalid_request', 'invalid redirect query');\n    // The provider answered with an error instead of a code (the user pressed Cancel →\n    // access_denied, invalid_scope, server_error, ...). Forward it rather than reporting a\n    // malformed query. This runs before the state check on purpose: providers echo state on\n    // error responses, but not all reliably do, and a forged error callback can only make the\n    // victim's popup show an error — nothing is exchanged or signed in. A present state that does\n    // not match still wins, since that is the more accurate (and more alarming) diagnosis.\n    if (parsed.data.error) {\n      if (parsed.data.state && parsed.data.state !== cached.state) {\n        return this.redirect('invalid_request', 'redirect state mismatch');\n      }\n      return this.redirect(\n        safeErrorType(parsed.data.error, 'server_error'),\n        parsed.data.error_description\n      );\n    }\n    const { code, state, user } = parsed.data;\n    if (!code || !state) return this.redirect('invalid_request', 'invalid redirect query');\n    if (state !== cached.state) return this.redirect('invalid_request', 'redirect state mismatch');\n    if (provider !== cached.provider) {\n      return this.redirect('invalid_request', 'redirect provider mismatch');\n    }\n    mark('validate_session');\n\n    // 3. exchange the code, load the user, sign in. Everything here can fail (an expired or reused\n    // code, a network error, the host's handler or session store). The callback runs in a popup\n    // the user is looking at, so every failure must land on errorUri, never as a JSON error.\n    let signedIn: Session;\n    try {\n      const { clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n        provider,\n        code,\n        pkce: cached.additionalParameters,\n      });\n      // Apple posts the user's name alongside the code, once: hand it to the provider with the token.\n      const userInfo = await this.oauth2Client.getUserInfo({\n        provider,\n        clientId,\n        token,\n        response: user ? { user } : undefined,\n      });\n      mark('exchange_code');\n\n      const principal = await handler(request, {\n        provider,\n        clientId,\n        userInfo,\n        token,\n        attributes: cached.attributes ?? {},\n      });\n      mark('save_principal');\n\n      signedIn = await this.signIn(principal, session);\n      await this.repository.deleteById(session.getId());\n      mark('update_session');\n    } catch (error) {\n      // The details stay in the logs: an OAuth2Error message can carry a client id or a\n      // provider's response, which has no place in a URL the browser keeps in its history.\n      if (error instanceof OAuth2Error) {\n        console.warn('OAuth2 callback failed', error);\n        const type = CALLBACK_ERROR_TYPES.has(error.error) ? error.error : 'server_error';\n        return this.redirect(type);\n      }\n      // A refusal is something the user can act on, so its reason and metadata reach the page,\n      // as they reach a JSON client through the ErrorInfo.\n      if (error instanceof AuthenticationError) {\n        console.warn('OAuth2 sign-in refused', error.reason, error.metadata);\n        return this.redirect('access_denied', undefined, error);\n      }\n      console.error('OAuth2 callback failed', error);\n      return this.redirect('server_error');\n    }\n\n    const uri = new URL(this.oauth2Client.successUri);\n    uri.searchParams.set('status', 'success');\n    uri.searchParams.set('provider', provider);\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    setTiming(response);\n    return this.withSession(response, signedIn);\n  };\n\n  /** The shared tail of the JSON login routes: the host's handler, then a signed-in session. */\n  private async authorize(\n    request: Request,\n    handler: AuthorizedHandler,\n    authorization: Authorization,\n    setTiming: (response: Response) => void\n  ): Promise<Response> {\n    const principal = await handler(request, authorization);\n    const session = await this.signIn(principal);\n    const response = Response.json(principal);\n    setTiming(response);\n    return this.withSession(response, session);\n  }\n\n  loginOAuth2Native = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.LOGIN_OAUTH2_NATIVE);\n      const body = await readJson(request);\n      // Whatever the app sends besides its credentials for `onAuthorized` (a referral code, ...).\n      const attributes = bodyAttributes(body);\n      // Only the credentials go on to the provider client.\n      const { attributes: _, ...credentials } = body as NativeCredential & { attributes?: unknown };\n      const { code_verifier } = credentials as { code_verifier?: unknown };\n      if (\n        code_verifier !== undefined &&\n        (typeof code_verifier !== 'string' || !CODE_VERIFIER_FORMAT.test(code_verifier))\n      ) {\n        throw invalidArgument(\n          'INVALID_CODE_VERIFIER',\n          'code_verifier must be 43-128 characters from [A-Za-z0-9-._~]'\n        );\n      }\n      const { clientId, userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n        provider,\n        credentials,\n      });\n      mark('login_oauth2_native');\n\n      const { nonce } = userInfo.data as { nonce?: unknown };\n      if (typeof nonce === 'string' && nonce) {\n        await this.consumeNonce(nonce, provider);\n        mark('check_nonce');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  loginOAuth2Onetap = (\n    request: Request,\n    handler: AuthorizedHandler,\n    provider = 'google'\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n\n      // Google's own form post, or an app's JSON.\n      const contentType = request.headers.get('content-type') ?? '';\n      const body = contentType.includes('application/json')\n        ? await readJson(request)\n        : await readForm(request);\n      const { attributes = {}, ...parsed } = parse(oneTapBodySchema, body);\n\n      // Both the credential and the code are issued to the provider's web client.\n      let clientId: string;\n      let token: Authorization['token'];\n      let userInfo: Authorization['userInfo'];\n      if (parsed.credential) {\n        ({ clientId, token, userInfo } = await this.oauth2Client.getTokenInfo({\n          provider,\n          credential: parsed.credential,\n        }));\n        mark('verify_credential');\n\n        // A credential is replayable until it expires, so it must carry a single-use nonce from\n        // `oauth2Nonce`, which the front end passed to `prompt`. This replaces Google's\n        // `g_csrf_token` double-submit cookie, which FedCM mode no longer sets.\n        const { nonce } = userInfo.data as { nonce?: unknown };\n        if (typeof nonce === 'string' && nonce) {\n          await this.consumeNonce(nonce, provider);\n          mark('check_nonce');\n        } else if (this.onetapRequireNonce) {\n          throw new AuthenticationError('NONCE_MISSING');\n        }\n      } else if (parsed.code) {\n        ({ clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n          provider,\n          code: parsed.code,\n        }));\n        userInfo = await this.oauth2Client.getUserInfo({ provider, clientId, token });\n      } else {\n        throw invalidArgument('INVALID_ARGUMENT', 'credential or code is required');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  // ---- email -----------------------------------------------------------------------------------\n\n  sendEmailVerificationCode = (request: Request, sender: EmailSender): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.turnstileSecretKey, 'turnstileSecretKey is not configured');\n      const { email, turnstileToken } = parse(\n        sendEmailVerificationCodeSchema,\n        await readJson(request)\n      );\n      await verifyTurnstileToken(this.turnstileSecretKey, turnstileToken);\n      await this.emailCodes.send(email, sender);\n      return Response.json({});\n    });\n\n  verifyEmailCode = (email: string, verificationCode: string): Promise<void> =>\n    this.emailCodes.verify(email, verificationCode);\n\n  loginEmail = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      const { setTiming } = timing({ enabled: this.timing });\n      const {\n        email,\n        verificationCode,\n        attributes = {},\n      } = parse(loginEmailSchema, await readJson(request));\n      await this.emailCodes.verify(email, verificationCode);\n      const claims: StandardClaims = { sub: email, email, email_verified: true };\n      return this.authorize(\n        request,\n        handler,\n        { provider: 'EMAIL', userInfo: { claims, data: {} }, attributes },\n        setTiming\n      );\n    });\n\n  // ---- desktop ---------------------------------------------------------------------------------\n\n  /**\n   * Step 1 of the desktop / native app sign-in handshake. The caller already completed normal\n   * sign-in on the web (so a cookie session exists); this issues a 5-minute single-use code that\n   * the web page hands off to the desktop client via a loopback redirect.\n   *\n   * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier` before opening the\n   * browser, derives `code_challenge = base64url(sha256(verifier))`, and threads the challenge\n   * through the URL → web page → here. The challenge is pinned to the code; `desktopExchange`\n   * enforces that the caller knows the matching verifier. This blocks an attacker who only\n   * intercepts the auth code (browser history, malicious extension, packet capture on loopback)\n   * from exchanging it.\n   *\n   * Requires an authenticated cookie session: anonymous callers get 401. Throttling / abuse\n   * protection on this endpoint is the API layer's job (rate-limit per principal); the SDK does\n   * not gate it because the upstream sign-in flow already passed CAPTCHA / OAuth / verification.\n   */\n  desktopAuthorize = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const principal = await this.getPrincipal(request);\n      if (!principal) throw unauthenticated('Sign in first');\n      const { code_challenge } = parse(desktopAuthorizeSchema, await readJson(request));\n      const code = await this.desktopCodes.issue(principal, code_challenge);\n      return Response.json({ code });\n    });\n\n  /**\n   * Step 2 of the desktop / native app sign-in handshake. The desktop client hands back the auth\n   * code it received via the loopback callback, and we mint a fresh session for it, independent\n   * of the web cookie session that originally authorized the code, so logging out on either side\n   * does not cascade to the other.\n   *\n   * Cookie attributes: `SameSite=None; Secure` so the cookie survives cross-site fetches from the\n   * desktop renderer's `file://` / `app://` origin. The configured `cookieOptions` provide\n   * everything else (`domain`, `path`, `httpOnly`); the override is targeted at the\n   * SameSite/Secure pair only. In a non-HTTPS dev backend this combination is rejected by\n   * Chromium, see the desktop sign-in PRD for workarounds.\n   *\n   * No CSRF check needed: the request carries no cookie, the auth code itself is the credential,\n   * and the code's single-use removal blocks replay.\n   */\n  desktopExchange = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const { code, code_verifier } = parse(desktopExchangeSchema, await readJson(request));\n      const principal = await this.desktopCodes.redeem(code, code_verifier);\n      const session = await this.signIn(principal);\n      session.setAttribute('client_type', 'desktop');\n      await this.repository.save(session);\n      return this.withSession(Response.json({ ok: true }), session, {\n        sameSite: 'none',\n        secure: true,\n      });\n    });\n\n  // ---- session management ----------------------------------------------------------------------\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  /**\n   * Sliding expiration: an authenticated request renews the session, as `logged` does, so a user\n   * who keeps using the app is never signed out after `maxInactiveInterval` of not calling one\n   * particular endpoint. No extra read: the session was just loaded to authenticate, and its\n   * `lastAccessedTime` is compared in memory; writes are spaced by `session.touchInterval` (see\n   * `AuthConfig`), so a session accessed again within the interval is not rewritten.\n   */\n  private async touch(session: Session) {\n    const now = Date.now();\n    if (now - session.getLastAccessedTime() < this.touchInterval) return;\n    session.setLastAccessedTime(now);\n    await this.repository.save(session);\n  }\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const session = await this.loadSession(request);\n    const principal = session && this.principalOf(session);\n    if (!principal) return null;\n    await this.touch(session);\n    return principal;\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    return (await this.getPrincipal(request)) !== null;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    type Result = T extends true ? Session : Session | null;\n    const session = await this.loadSession(request);\n    if (session || !create) return session as Result;\n    const created = this.repository.createSession();\n    await this.repository.save(created);\n    return created;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiDA,MAAM,cAAc;AAIpB,MAAM,uBAAuB;;AAG7B,MAAM,iBAAiB;;AAGvB,MAAM,uBAAuB;AAI7B,MAAM,+BAA+B;;AAGrC,SAAS,cAAc,OAAe,UAA4C;CAChF,OAAO,uBAAuB,KAAK,IAAI,QAAQ;AACjD;;;;;;;AAQA,MAAM,uCAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;AAED,SAAS,wBACP,YACoC;CACpC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAE1C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAE9C,MAAM,OAAO,eAAe,OAAO;CACnC,UACE,QAAQ,sBACR,uCAAuC,KAAK,kBAAkB,qBAAqB,SACrF;CACA,OAAO;AACT;;AAGA,SAAS,WAAW,SAAkB;CACpC,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY;CACrE,OACE,QAAQ,WAAW,UAAU,CAAC,CAAC,aAAa,WAAW,mCAAmC;AAE9F;;AAGA,MAAM,mBAAmB,OAAO,oBAAoB,EAAE,YAAY,iBAAiB,CAAC;AAEpF,MAAM,yBAAyB,OAAO;CACpC,gBAAgB,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC;CACjD,uBAAuB,QAAQ,MAAM;AACvC,CAAC;AAED,MAAM,wBAAwB,OAAO;CACnC,MAAM,OAAO;CACb,eAAe,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC;AAClD,CAAC;AAED,MAAa,OAAO;CAClB,MAAM;CACN,QAAQ;CACR,QAAQ;CAER,cAAc;CACd,cAAc;CACd,sBAAsB;CACtB,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CAErB,aAAa;CACb,8BAA8B;CAS9B,mBAAmB;CACnB,kBAAkB;CAElB,0BAA0B;AAC5B;;;;;;;;AASA,IAAa,OAAb,MAAyC;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,oCAAqD;CAErD,YAAY,EACV,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACa;EACb,KAAK,SAAS,UAAU;EACxB,KAAK,KAAK;EACV,KAAK,aAAa;EAClB,KAAK,qBAAqB;EAC1B,MAAM,cAAc,kBAAkB,eAAe;EACrD,MAAM,iBAAiB,kBAAkB,kBAAkB;EAC3D,UAAU,eAAe,GAAG,iDAAiD;EAC7E,UAAU,kBAAkB,GAAG,2DAA2D;EAC1F,KAAK,aAAa,IAAI,uBAAuB,cAAc;GAAE;GAAa;EAAe,CAAC;EAC1F,KAAK,eAAe,IAAI,aAAa,YAAY;EACjD,MAAM,EAAE,MAAM,GAAG,kBAAkB,UAAU,CAAC;EAC9C,KAAK,aAAa,QAAQ;EAC1B,KAAK,gBAAgB;GACnB,MAAM;GACN,UAAU;GACV,QAAQ;GACR,UAAU;GACV,GAAG;EACL;EACA,KAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;EACvE,KAAK,qBAAqB,QAAQ,QAAQ,gBAAgB;EAC1D,KAAK,iBAAiB,SAAS,iBAAiB,QAAQ;EACxD,KAAK,gBAAgB,SAAS,UAAU;EACxC,UAAU,KAAK,iBAAiB,GAAG,4CAA4C;CACjF;CAIA,aAAqB,SAAsC;EACzD,MAAM,aAAa,UAAU,SAAS,KAAK,UAAU;EACrD,IAAI,YAAY,OAAO;EACvB,OAAQ,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,cAAc,KAAM,KAAA;CACxE;;CAGA,MAAc,YAAY,SAA2C;EACnE,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,OAAO,YAAY,KAAK,WAAW,SAAS,SAAS,IAAI;CAC3D;;CAGA,YAAoB,SAAoC;EACtD,MAAM,OAAO,QAAQ,aAAa,yBAAyB;EAC3D,OAAO,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI;CACzC;;;;;;;;CASA,MAAc,OAAO,WAAsB,WAAuC;EAChF,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,KAAK,MAAM,aAAa,WAAW,kBAAkB,KAAK,CAAC,GAAG;GAC5D,IAAI,cAAc,KAAK,mCAAmC;GAC1D,IAAI,cAAA,iBAAyC;GAC7C,MAAM,QAAQ,WAAW,aAAa,SAAS;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,QAAQ,aAAa,WAAW,KAAK;EAClF;EACA,QAAQ,aAAa,2BAA2B,UAAU,IAAI;EAC9D,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;;;;;CAMA,YAAoB,UAAoB,SAAkB,QAAkC;EAC1F,MAAM,SAAS,QAAQ,uBAAuB;EAC9C,UAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG;GACpD,GAAG,KAAK;GACR,GAAG;GACH;EACF,CAAC;EACD,IAAI,KAAK,eAAe,SAAS,QAAQ,IAAI,gBAAgB,QAAQ,MAAM,CAAC;EAC5E,OAAO;CACT;;CAGA,MAAc,MAAM,KAAiD;EACnE,IAAI;GACF,OAAO,MAAM,IAAI;EACnB,SAAS,OAAO;GACd,MAAM,WAAW,cAAc,KAAK;GACpC,IAAI,UAAU,OAAO;GACrB,MAAM;EACR;CACF;;CAGA,SACE,OACA,aACA,SACU;EACV,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;EAE9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,GAC/D,IAAI,CAAC,IAAI,aAAa,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAEjE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,aACF,IAAI,aAAa,IAAI,qBAAqB,YAAY,MAAM,GAAG,4BAA4B,CAAC;EAE9F,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EAC1D,OAAO,SAAS,SAAS,IAAI,MAAM,GAAG;CACxC;CAIA,OAAO,OAAO,aAAyC;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,WAAW,SAAS,KAAK;GAC7B;GACA,eAAe;GACf,YAAY;EACd,CAAC;EAGD,UAAU,UAAU,cAAc,OAAO;GACvC,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,KAAK,cAAc;EAC7B,CAAC;EACD,OAAO;CACT;CAEA,SAAS,OAAO,YAAwC;EACtD,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,IAAI,WAAW,MAAM,KAAK,WAAW,WAAW,SAAS;EACzD,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC;EAGjC,aAAa,UAAU,KAAK,YAAY,KAAK,aAAa;EAC1D,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,aAAgD;EAChF,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;EAElD,QAAQ,oBAAoB,KAAK,IAAI,CAAC;EACtC,MAAM,KAAK,WAAW,KAAK,OAAO;EAElC,MAAM,YAAY,KAAK,YAAY,OAAO;EAC1C,IAAI,WAAW,MAAM,WAAW,SAAS;EACzC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,OAAO;CAC9E;CAIA,uBAA+C;EAE7C,MAAM,gBAAgB,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EAM1D,OAAO;GAAE;GAAe,gBALD,WAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,CAAC,CACR,SAAS,WAEyB;GAAG,uBAAuB;EAAO;CACxE;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;;;;;;CAOA,MAAc,aAAa,OAAe,UAAiC;EACzE,MAAM,MAAM,KAAK,kBAAkB,KAAK;EACxC,IAAK,MAAM,KAAK,GAAG,QAAQ,GAAG,MAAO,UAAU,MAAM,IAAI,oBAAoB,gBAAgB;EAC7F,MAAM,KAAK,GAAG,WAAW,GAAG;CAC9B;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,uBACE,SACA,YAEA,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,aAAa,wBAAwB,SAAS,UAAU;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,oBAAoB;EAC7D,MAAM,QAAQ,WAAW;EACzB,MAAM,OAAO,KAAK,qBAAqB;EACvC,MAAM,MAAM,MAAM,KAAK,aAAa,uBAAuB;GAAE;GAAU;GAAO;EAAK,CAAC;EACpF,IAAI,UAAU,MAAM,KAAK,YAAY,OAAO;EAC5C,IAAI,CAAC,SAAS;GAGZ,UAAU,KAAK,WAAW,cAAc;GACxC,QAAQ,uBAAuB,oBAAoB;EACrD;EACA,KAAK,eAAe;EAEpB,MAAM,uBAAmD;GACvD;GACA;GACA,yBAAyB,IAAI;GAC7B,sBAAsB;GACtB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC;EACA,QAAQ,aACN,KAAK,mCACL,KAAK,UAAU,oBAAoB,CACrC;EACA,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,KAAK,cAAc;EAEnB,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C,CAAC;CAEH,kBAAkB,OAAO,SAAkB,YAAkD;EAC3F,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAG3D,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,mBAAmB,mBAAmB;EACzE,KAAK,cAAc;EACnB,MAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;EACxE,IAAI,CAAC,MAAM,OAAO,KAAK,SAAS,mBAAmB,iCAAiC;EACpF,MAAM,SAAqC,KAAK,MAAM,IAAI;EAG1D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,iBAAiB;EAC1D,MAAM,OAAO,WAAW,OAAO,IAC3B,OAAO,YAAY,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC,CAAC,IAC5D,MAAM,OAAO;EACjB,MAAM,SAAS,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EAOrF,IAAI,OAAO,KAAK,OAAO;GACrB,IAAI,OAAO,KAAK,SAAS,OAAO,KAAK,UAAU,OAAO,OACpD,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;GAEnE,OAAO,KAAK,SACV,cAAc,OAAO,KAAK,OAAO,cAAc,GAC/C,OAAO,KAAK,iBACd;EACF;EACA,MAAM,EAAE,MAAM,OAAO,SAAS,OAAO;EACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EACrF,IAAI,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;EAC7F,IAAI,aAAa,OAAO,UACtB,OAAO,KAAK,SAAS,mBAAmB,4BAA4B;EAEtE,KAAK,kBAAkB;EAKvB,IAAI;EACJ,IAAI;GACF,MAAM,EAAE,UAAU,UAAU,MAAM,KAAK,aAAa,0BAA0B;IAC5E;IACA;IACA,MAAM,OAAO;GACf,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,aAAa,YAAY;IACnD;IACA;IACA;IACA,UAAU,OAAO,EAAE,KAAK,IAAI,KAAA;GAC9B,CAAC;GACD,KAAK,eAAe;GAEpB,MAAM,YAAY,MAAM,QAAQ,SAAS;IACvC;IACA;IACA;IACA;IACA,YAAY,OAAO,cAAc,CAAC;GACpC,CAAC;GACD,KAAK,gBAAgB;GAErB,WAAW,MAAM,KAAK,OAAO,WAAW,OAAO;GAC/C,MAAM,KAAK,WAAW,WAAW,QAAQ,MAAM,CAAC;GAChD,KAAK,gBAAgB;EACvB,SAAS,OAAO;GAGd,IAAI,iBAAiB,aAAa;IAChC,QAAQ,KAAK,0BAA0B,KAAK;IAC5C,MAAM,OAAO,qBAAqB,IAAI,MAAM,KAAK,IAAI,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,IAAI;GAC3B;GAGA,IAAI,iBAAiB,qBAAqB;IACxC,QAAQ,KAAK,0BAA0B,MAAM,QAAQ,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,iBAAiB,KAAA,GAAW,KAAK;GACxD;GACA,QAAQ,MAAM,0BAA0B,KAAK;GAC7C,OAAO,KAAK,SAAS,cAAc;EACrC;EAEA,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,UAAU;EAChD,IAAI,aAAa,IAAI,UAAU,SAAS;EACxC,IAAI,aAAa,IAAI,YAAY,QAAQ;EACzC,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,QAAQ;CAC5C;;CAGA,MAAc,UACZ,SACA,SACA,eACA,WACmB;EACnB,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa;EACtD,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,MAAM,WAAW,SAAS,KAAK,SAAS;EACxC,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;CAEA,qBAAqB,SAAkB,YACrC,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,mBAAmB;EAC5D,MAAM,OAAO,MAAM,SAAS,OAAO;EAEnC,MAAM,aAAa,eAAe,IAAI;EAEtC,MAAM,EAAE,YAAY,GAAG,GAAG,gBAAgB;EAC1C,MAAM,EAAE,kBAAkB;EAC1B,IACE,kBAAkB,KAAA,MACjB,OAAO,kBAAkB,YAAY,CAAC,qBAAqB,KAAK,aAAa,IAE9E,MAAM,gBACJ,yBACA,8DACF;EAEF,MAAM,EAAE,UAAU,UAAU,UAAU,MAAM,KAAK,aAAa,kBAAkB;GAC9E;GACA;EACF,CAAC;EACD,KAAK,qBAAqB;EAE1B,MAAM,EAAE,UAAU,SAAS;EAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;GACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;GACvC,KAAK,aAAa;EACpB;EAEA,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAEH,qBACE,SACA,SACA,WAAW,aAEX,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAI3D,MAAM,QADc,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAClC,SAAS,kBAAkB,IAChD,MAAM,SAAS,OAAO,IACtB,MAAM,SAAS,OAAO;EAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,GAAG,WAAW,MAAM,kBAAkB,IAAI;EAGnE,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,YAAY;GACrB,CAAC,CAAE,UAAU,OAAO,YAAa,MAAM,KAAK,aAAa,aAAa;IACpE;IACA,YAAY,OAAO;GACrB,CAAC;GACD,KAAK,mBAAmB;GAKxB,MAAM,EAAE,UAAU,SAAS;GAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;IACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;IACvC,KAAK,aAAa;GACpB,OAAO,IAAI,KAAK,oBACd,MAAM,IAAI,oBAAoB,eAAe;EAEjD,OAAO,IAAI,OAAO,MAAM;GACtB,CAAC,CAAE,UAAU,SAAU,MAAM,KAAK,aAAa,0BAA0B;IACvE;IACA,MAAM,OAAO;GACf,CAAC;GACD,WAAW,MAAM,KAAK,aAAa,YAAY;IAAE;IAAU;IAAU;GAAM,CAAC;EAC9E,OACE,MAAM,gBAAgB,oBAAoB,gCAAgC;EAG5E,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAIH,6BAA6B,SAAkB,WAC7C,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,oBAAoB,sCAAsC;EACzE,MAAM,EAAE,OAAO,mBAAmB,MAChC,iCACA,MAAM,SAAS,OAAO,CACxB;EACA,MAAM,qBAAqB,KAAK,oBAAoB,cAAc;EAClE,MAAM,KAAK,WAAW,KAAK,OAAO,MAAM;EACxC,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB,CAAC;CAEH,mBAAmB,OAAe,qBAChC,KAAK,WAAW,OAAO,OAAO,gBAAgB;CAEhD,cAAc,SAAkB,YAC9B,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EACrD,MAAM,EACJ,OACA,kBACA,aAAa,CAAC,MACZ,MAAM,kBAAkB,MAAM,SAAS,OAAO,CAAC;EACnD,MAAM,KAAK,WAAW,OAAO,OAAO,gBAAgB;EACpD,MAAM,SAAyB;GAAE,KAAK;GAAO;GAAO,gBAAgB;EAAK;EACzE,OAAO,KAAK,UACV,SACA,SACA;GAAE,UAAU;GAAS,UAAU;IAAE;IAAQ,MAAM,CAAC;GAAE;GAAG;EAAW,GAChE,SACF;CACF,CAAC;;;;;;;;;;;;;;;;;CAoBH,oBAAoB,YAClB,KAAK,MAAM,YAAY;EACrB,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO;EACjD,IAAI,CAAC,WAAW,MAAM,gBAAgB,eAAe;EACrD,MAAM,EAAE,mBAAmB,MAAM,wBAAwB,MAAM,SAAS,OAAO,CAAC;EAChF,MAAM,OAAO,MAAM,KAAK,aAAa,MAAM,WAAW,cAAc;EACpE,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;CAC/B,CAAC;;;;;;;;;;;;;;;;CAiBH,mBAAmB,YACjB,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,MAAM,kBAAkB,MAAM,uBAAuB,MAAM,SAAS,OAAO,CAAC;EACpF,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO,MAAM,aAAa;EACpE,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,QAAQ,aAAa,eAAe,SAAS;EAC7C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,SAAS;GAC5D,UAAU;GACV,QAAQ;EACV,CAAC;CACH,CAAC;CAIH,OAAO,OAAO,cAAwC;EACpD,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,KAAK,MAAM,aAAa,SAAS,KAAK,GACpC,MAAM,KAAK,WAAW,WAAW,SAAS;CAE9C;;;;;;;;CASA,MAAc,MAAM,SAAkB;EACpC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,QAAQ,oBAAoB,IAAI,KAAK,eAAe;EAC9D,QAAQ,oBAAoB,GAAG;EAC/B,MAAM,KAAK,WAAW,KAAK,OAAO;CACpC;CAEA,eAAe,OAAO,YAAgD;EACpE,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;EACrD,IAAI,CAAC,WAAW,OAAO;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,OAAO;CACT;CAEA,kBAAkB,OAAO,YAAuC;EAC9D,OAAQ,MAAM,KAAK,aAAa,OAAO,MAAO;CAChD;CAEA,aAAa,OACX,SACA,WACuD;EAEvD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,WAAW,CAAC,QAAQ,OAAO;EAC/B,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;CAEA,gBAAgB,OAAO,cAAqC;EAC1D,MAAM,KAAK,WAAW,WAAW,SAAS;CAC5C;CAEA,eAAe,OAAO,cAA6C;EACjE,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;CACrC;CAEA,yBAAyB,OAAO,iBAA6C;EAC3E,MAAM,KAAK,WAAW,uBAAuB,YAAY;EACzD,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB;AACF"}

package/dist/oauth2/provider/common.cjs

@@ -75,14 +75,28 @@ async function revokeToken(params) {
 	});
 	if (!response.ok) {
 		const error = await response.json();
-		console.error("Refresh token error:", error);
+		console.error("Revoke token error:", error);
 		throw new require_oauth2_error.OAuth2Error(response.status, "invalid_request", "Failed to revoke token");
 	}
 }
+/**
+* One key set per JWKS endpoint for the life of the process: jose caches the fetched keys,
+* refetches on an unknown `kid` (with a cooldown) and when they go stale, so a set created per
+* call would refetch the keys for every id token.
+*/
+const jwkSets = /* @__PURE__ */ new Map();
+function remoteJWKSet(jwkSetUri) {
+	let jwks = jwkSets.get(jwkSetUri);
+	if (!jwks) {
+		jwks = (0, jose.createRemoteJWKSet)(new URL(jwkSetUri));
+		jwkSets.set(jwkSetUri, jwks);
+	}
+	return jwks;
+}
 async function verifyIdToken(idToken, options) {
 	const { jwkSetUri, issuer, audience } = options;
 	try {
-		const jwks = (0, jose.createRemoteJWKSet)(new URL(jwkSetUri));
+		const jwks = remoteJWKSet(jwkSetUri);
 		const { payload } = await (0, jose.jwtVerify)(idToken, jwks, {
 			issuer,
 			audience

package/dist/oauth2/provider/common.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"common.cjs","names":["OAuth2Error","createRemoteJWKSet","jwtVerify"],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n    /** Extra request headers some providers require, e.g. GitHub's `User-Agent`. */\n    headers?: Record<string, string>;\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    ...params.headers,\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    // Public clients (Google's installed-app clients, PKCE-only clients) have no secret.\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport interface VerifyIdTokenOptions {\n  jwkSetUri: string;\n  /** The `iss` values the provider signs with; anything else is refused. */\n  issuer: string | string[];\n  /**\n   * The client the token must be issued to. An id token proves who the user is only to the client\n   * it names in `aud`: any other app on the same identity provider can obtain a validly signed one\n   * for the same user, so a token for a foreign client must never sign anyone in here.\n   */\n  audience: string;\n}\n\nexport async function verifyIdToken<T>(idToken: string, options: VerifyIdTokenOptions) {\n  const { jwkSetUri, issuer, audience } = options;\n  try {\n    const jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    const { payload } = await jwtVerify(idToken, jwks, { issuer, audience });\n    return payload as T;\n  } catch (error) {\n    console.error('Failed to verify id_token', error);\n    // The token is the grant here: one for another audience or issuer is an invalid grant, not a\n    // malformed request.\n    throw new OAuth2Error(400, 'invalid_grant', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;;AAIA,SAAgB,uBAAuB,SAOpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAMA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EAExC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,wBAAwB,KAAK;EAC3C,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;AAcA,eAAsB,cAAiB,SAAiB,SAA+B;CACrF,MAAM,EAAE,WAAW,QAAQ,aAAa;CACxC,IAAI;EACF,MAAM,QAAA,GAAOC,KAAAA,mBAAAA,CAAmB,IAAI,IAAI,SAAS,CAAC;EAClD,MAAM,EAAE,YAAY,OAAA,GAAMC,KAAAA,UAAAA,CAAU,SAAS,MAAM;GAAE;GAAQ;EAAS,CAAC;EACvE,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,6BAA6B,KAAK;EAGhD,MAAM,IAAIF,qBAAAA,YAAY,KAAK,iBAAiB,2BAA2B;CACzE;AACF"}
+{"version":3,"file":"common.cjs","names":["OAuth2Error","createRemoteJWKSet","jwtVerify"],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n    /** Extra request headers some providers require, e.g. GitHub's `User-Agent`. */\n    headers?: Record<string, string>;\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    ...params.headers,\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    // Public clients (Google's installed-app clients, PKCE-only clients) have no secret.\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Revoke token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport interface VerifyIdTokenOptions {\n  jwkSetUri: string;\n  /** The `iss` values the provider signs with; anything else is refused. */\n  issuer: string | string[];\n  /**\n   * The client the token must be issued to. An id token proves who the user is only to the client\n   * it names in `aud`: any other app on the same identity provider can obtain a validly signed one\n   * for the same user, so a token for a foreign client must never sign anyone in here.\n   */\n  audience: string;\n}\n\n/**\n * One key set per JWKS endpoint for the life of the process: jose caches the fetched keys,\n * refetches on an unknown `kid` (with a cooldown) and when they go stale, so a set created per\n * call would refetch the keys for every id token.\n */\nconst jwkSets = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nfunction remoteJWKSet(jwkSetUri: string) {\n  let jwks = jwkSets.get(jwkSetUri);\n  if (!jwks) {\n    jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    jwkSets.set(jwkSetUri, jwks);\n  }\n  return jwks;\n}\n\nexport async function verifyIdToken<T>(idToken: string, options: VerifyIdTokenOptions) {\n  const { jwkSetUri, issuer, audience } = options;\n  try {\n    const jwks = remoteJWKSet(jwkSetUri);\n    const { payload } = await jwtVerify(idToken, jwks, { issuer, audience });\n    return payload as T;\n  } catch (error) {\n    console.error('Failed to verify id_token', error);\n    // The token is the grant here: one for another audience or issuer is an invalid grant, not a\n    // malformed request.\n    throw new OAuth2Error(400, 'invalid_grant', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;;AAIA,SAAgB,uBAAuB,SAOpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAMA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EAExC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,uBAAuB,KAAK;EAC1C,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;;;;;;AAmBA,MAAM,0BAAU,IAAI,IAAmD;AAEvE,SAAS,aAAa,WAAmB;CACvC,IAAI,OAAO,QAAQ,IAAI,SAAS;CAChC,IAAI,CAAC,MAAM;EACT,QAAA,GAAOC,KAAAA,mBAAAA,CAAmB,IAAI,IAAI,SAAS,CAAC;EAC5C,QAAQ,IAAI,WAAW,IAAI;CAC7B;CACA,OAAO;AACT;AAEA,eAAsB,cAAiB,SAAiB,SAA+B;CACrF,MAAM,EAAE,WAAW,QAAQ,aAAa;CACxC,IAAI;EACF,MAAM,OAAO,aAAa,SAAS;EACnC,MAAM,EAAE,YAAY,OAAA,GAAMC,KAAAA,UAAAA,CAAU,SAAS,MAAM;GAAE;GAAQ;EAAS,CAAC;EACvE,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,6BAA6B,KAAK;EAGhD,MAAM,IAAIF,qBAAAA,YAAY,KAAK,iBAAiB,2BAA2B;CACzE;AACF"}

package/dist/oauth2/provider/common.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.cts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";wBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;IACb;wBAcqB,0BACpB,QAAQ;EACN;EACA;;EAEA,UAAU;IACX,QAAA;wBAyBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;wBAGoB,YAAY,QAAQ,oBAAiB;iBAwB1C;EACf;;EAEA;;;;;;EAMA;;wBAGoB,cAAc,GAAG,iBAAiB,SAAS,uBAAoB,QAAA"}
+{"version":3,"file":"common.d.cts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";wBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;IACb;wBAcqB,0BACpB,QAAQ;EACN;EACA;;EAEA,UAAU;IACX,QAAA;wBAyBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;wBAGoB,YAAY,QAAQ,oBAAiB;iBAwB1C;EACf;;EAEA;;;;;;EAMA;;wBAmBoB,cAAc,GAAG,iBAAiB,SAAS,uBAAoB,QAAA"}

package/dist/oauth2/provider/common.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.mts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";wBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;IACb;wBAcqB,0BACpB,QAAQ;EACN;EACA;;EAEA,UAAU;IACX,QAAA;wBAyBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;wBAGoB,YAAY,QAAQ,oBAAiB;iBAwB1C;EACf;;EAEA;;;;;;EAMA;;wBAGoB,cAAc,GAAG,iBAAiB,SAAS,uBAAoB,QAAA"}
+{"version":3,"file":"common.d.mts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";wBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;IACb;wBAcqB,0BACpB,QAAQ;EACN;EACA;;EAEA,UAAU;IACX,QAAA;wBAyBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;wBAGoB,YAAY,QAAQ,oBAAiB;iBAwB1C;EACf;;EAEA;;;;;;EAMA;;wBAmBoB,cAAc,GAAG,iBAAiB,SAAS,uBAAoB,QAAA"}

package/dist/oauth2/provider/common.mjs

@@ -74,14 +74,28 @@ async function revokeToken(params) {
 	});
 	if (!response.ok) {
 		const error = await response.json();
-		console.error("Refresh token error:", error);
+		console.error("Revoke token error:", error);
 		throw new OAuth2Error(response.status, "invalid_request", "Failed to revoke token");
 	}
 }
+/**
+* One key set per JWKS endpoint for the life of the process: jose caches the fetched keys,
+* refetches on an unknown `kid` (with a cooldown) and when they go stale, so a set created per
+* call would refetch the keys for every id token.
+*/
+const jwkSets = /* @__PURE__ */ new Map();
+function remoteJWKSet(jwkSetUri) {
+	let jwks = jwkSets.get(jwkSetUri);
+	if (!jwks) {
+		jwks = createRemoteJWKSet(new URL(jwkSetUri));
+		jwkSets.set(jwkSetUri, jwks);
+	}
+	return jwks;
+}
 async function verifyIdToken(idToken, options) {
 	const { jwkSetUri, issuer, audience } = options;
 	try {
-		const jwks = createRemoteJWKSet(new URL(jwkSetUri));
+		const jwks = remoteJWKSet(jwkSetUri);
 		const { payload } = await jwtVerify(idToken, jwks, {
 			issuer,
 			audience

package/dist/oauth2/provider/common.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"common.mjs","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n    /** Extra request headers some providers require, e.g. GitHub's `User-Agent`. */\n    headers?: Record<string, string>;\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    ...params.headers,\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    // Public clients (Google's installed-app clients, PKCE-only clients) have no secret.\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport interface VerifyIdTokenOptions {\n  jwkSetUri: string;\n  /** The `iss` values the provider signs with; anything else is refused. */\n  issuer: string | string[];\n  /**\n   * The client the token must be issued to. An id token proves who the user is only to the client\n   * it names in `aud`: any other app on the same identity provider can obtain a validly signed one\n   * for the same user, so a token for a foreign client must never sign anyone in here.\n   */\n  audience: string;\n}\n\nexport async function verifyIdToken<T>(idToken: string, options: VerifyIdTokenOptions) {\n  const { jwkSetUri, issuer, audience } = options;\n  try {\n    const jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    const { payload } = await jwtVerify(idToken, jwks, { issuer, audience });\n    return payload as T;\n  } catch (error) {\n    console.error('Failed to verify id_token', error);\n    // The token is the grant here: one for another audience or issuer is an invalid grant, not a\n    // malformed request.\n    throw new OAuth2Error(400, 'invalid_grant', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;AAIA,SAAgB,uBAAuB,SAOpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAMA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EAExC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,wBAAwB,KAAK;EAC3C,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;AAcA,eAAsB,cAAiB,SAAiB,SAA+B;CACrF,MAAM,EAAE,WAAW,QAAQ,aAAa;CACxC,IAAI;EACF,MAAM,OAAO,mBAAmB,IAAI,IAAI,SAAS,CAAC;EAClD,MAAM,EAAE,YAAY,MAAM,UAAU,SAAS,MAAM;GAAE;GAAQ;EAAS,CAAC;EACvE,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,6BAA6B,KAAK;EAGhD,MAAM,IAAI,YAAY,KAAK,iBAAiB,2BAA2B;CACzE;AACF"}
+{"version":3,"file":"common.mjs","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n    /** Extra request headers some providers require, e.g. GitHub's `User-Agent`. */\n    headers?: Record<string, string>;\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    ...params.headers,\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    // Public clients (Google's installed-app clients, PKCE-only clients) have no secret.\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret ?? ''}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    if (params.clientSecret) body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Revoke token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport interface VerifyIdTokenOptions {\n  jwkSetUri: string;\n  /** The `iss` values the provider signs with; anything else is refused. */\n  issuer: string | string[];\n  /**\n   * The client the token must be issued to. An id token proves who the user is only to the client\n   * it names in `aud`: any other app on the same identity provider can obtain a validly signed one\n   * for the same user, so a token for a foreign client must never sign anyone in here.\n   */\n  audience: string;\n}\n\n/**\n * One key set per JWKS endpoint for the life of the process: jose caches the fetched keys,\n * refetches on an unknown `kid` (with a cooldown) and when they go stale, so a set created per\n * call would refetch the keys for every id token.\n */\nconst jwkSets = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\nfunction remoteJWKSet(jwkSetUri: string) {\n  let jwks = jwkSets.get(jwkSetUri);\n  if (!jwks) {\n    jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    jwkSets.set(jwkSetUri, jwks);\n  }\n  return jwks;\n}\n\nexport async function verifyIdToken<T>(idToken: string, options: VerifyIdTokenOptions) {\n  const { jwkSetUri, issuer, audience } = options;\n  try {\n    const jwks = remoteJWKSet(jwkSetUri);\n    const { payload } = await jwtVerify(idToken, jwks, { issuer, audience });\n    return payload as T;\n  } catch (error) {\n    console.error('Failed to verify id_token', error);\n    // The token is the grant here: one for another audience or issuer is an invalid grant, not a\n    // malformed request.\n    throw new OAuth2Error(400, 'invalid_grant', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;AAIA,SAAgB,uBAAuB,SAOpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAMA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,GAAG,OAAO;EACV,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EAExC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS,QACjD;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,IAAI,OAAO,cAAc,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAC3E;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,uBAAuB,KAAK;EAC1C,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;;;;;;AAmBA,MAAM,0BAAU,IAAI,IAAmD;AAEvE,SAAS,aAAa,WAAmB;CACvC,IAAI,OAAO,QAAQ,IAAI,SAAS;CAChC,IAAI,CAAC,MAAM;EACT,OAAO,mBAAmB,IAAI,IAAI,SAAS,CAAC;EAC5C,QAAQ,IAAI,WAAW,IAAI;CAC7B;CACA,OAAO;AACT;AAEA,eAAsB,cAAiB,SAAiB,SAA+B;CACrF,MAAM,EAAE,WAAW,QAAQ,aAAa;CACxC,IAAI;EACF,MAAM,OAAO,aAAa,SAAS;EACnC,MAAM,EAAE,YAAY,MAAM,UAAU,SAAS,MAAM;GAAE;GAAQ;EAAS,CAAC;EACvE,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,MAAM,6BAA6B,KAAK;EAGhD,MAAM,IAAI,YAAY,KAAK,iBAAiB,2BAA2B;CACzE;AACF"}

package/dist/oauth2/provider/github.cjs

@@ -68,7 +68,7 @@ function createGithubProvider() {
 			return {
 				data,
 				claims: {
-					sub: data.id,
+					sub: String(data.id),
 					name: data.name || data.login,
 					email_verified,
 					email: data.email,

package/dist/oauth2/provider/github.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"github.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error"],"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\n/**\n * GitHub's REST API rejects any request without a `User-Agent` header with a 403. Node's fetch sends\n * a default one, but Cloudflare Workers' fetch sends none, so every GitHub request sets it explicitly.\n * reference: https://docs.github.com/en/rest/using-the-rest-api/troubleshooting-the-rest-api#user-agent-required\n */\nconst USER_AGENT = '@shware/security';\n\n/** A short slice of an error response body, enough to tell GitHub's failures apart in logs. */\nasync function describeFailure(response: Response, message: string) {\n  const body = await response.text().catch(() => '');\n  const detail = body ? `: ${body.slice(0, 200)}` : '';\n  return `${message} (HTTP ${response.status})${detail}`;\n}\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        headers: { 'User-Agent': USER_AGENT },\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      // GitHub answers a failed exchange (bad_verification_code, incorrect_client_credentials, ...)\n      // with HTTP 200 and an error body, so a 200 alone does not mean a token was issued.\n      const body = (await response.json()) as GithubToken & Partial<GithubErrorResponse>;\n      if (body.error) throw new OAuth2Error(400, body.error, body.error_description);\n      return body;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = {\n        Accept: 'application/json',\n        Authorization: `Bearer ${access_token}`,\n        'User-Agent': USER_AGENT,\n      };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const message = await describeFailure(response, 'Failed to fetch user info');\n        throw new OAuth2Error(response.status, 'invalid_request', message);\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        const message = await describeFailure(emailResponse, 'Failed to fetch user email');\n        throw new OAuth2Error(emailResponse.status, 'invalid_request', message);\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified ?? false;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: string;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,aAAa;;AAGnB,eAAe,gBAAgB,UAAoB,SAAiB;CAClE,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,MAAM,SAAS,OAAO,KAAK,KAAK,MAAM,GAAG,GAAG,MAAM;CAClD,OAAO,GAAG,QAAQ,SAAS,SAAS,OAAO,GAAG;AAChD;AAEA,SAAgB,uBAAiC;CAC/C,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,cAAc,CAAC,YAAY;EAC3B,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,SAAS,EAAE,cAAc,WAAW;GACtC,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GAGA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,IAAI,KAAK,OAAO,MAAM,IAAIA,qBAAAA,YAAY,KAAK,KAAK,OAAO,KAAK,iBAAiB;GAC7E,OAAO;EACT;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,0BAA0B;GAClD,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GACrD,MAAM,UAAU;IACd,QAAQ;IACR,eAAe,UAAU;IACzB,cAAc;GAChB;GACA,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,UAAU,MAAM,gBAAgB,UAAU,2BAA2B;IAC3E,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,OAAO;GACnE;GACA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,MAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;GACnF,IAAI,CAAC,cAAc,IAAI;IACrB,MAAM,UAAU,MAAM,gBAAgB,eAAe,4BAA4B;IACjF,MAAM,IAAIA,qBAAAA,YAAY,cAAc,QAAQ,mBAAmB,OAAO;GACxE;GACA,MAAM,SAAU,MAAM,cAAc,KAAK;GACzC,KAAK,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,CAAC,EAAE,SAAS,KAAK;GAClE,MAAM,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,CAAC,EAAE,YAAY;GACvF,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK,QAAQ,KAAK;KACxB;KACA,OAAO,KAAK;KACZ,SAAS,KAAK;KACd,SAAS,KAAK;KACd,SAAS,KAAK;KACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI,KAAA;IAC9D;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"github.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error"],"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\n/**\n * GitHub's REST API rejects any request without a `User-Agent` header with a 403. Node's fetch sends\n * a default one, but Cloudflare Workers' fetch sends none, so every GitHub request sets it explicitly.\n * reference: https://docs.github.com/en/rest/using-the-rest-api/troubleshooting-the-rest-api#user-agent-required\n */\nconst USER_AGENT = '@shware/security';\n\n/** A short slice of an error response body, enough to tell GitHub's failures apart in logs. */\nasync function describeFailure(response: Response, message: string) {\n  const body = await response.text().catch(() => '');\n  const detail = body ? `: ${body.slice(0, 200)}` : '';\n  return `${message} (HTTP ${response.status})${detail}`;\n}\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        headers: { 'User-Agent': USER_AGENT },\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      // GitHub answers a failed exchange (bad_verification_code, incorrect_client_credentials, ...)\n      // with HTTP 200 and an error body, so a 200 alone does not mean a token was issued.\n      const body = (await response.json()) as GithubToken & Partial<GithubErrorResponse>;\n      if (body.error) throw new OAuth2Error(400, body.error, body.error_description);\n      return body;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = {\n        Accept: 'application/json',\n        Authorization: `Bearer ${access_token}`,\n        'User-Agent': USER_AGENT,\n      };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const message = await describeFailure(response, 'Failed to fetch user info');\n        throw new OAuth2Error(response.status, 'invalid_request', message);\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        const message = await describeFailure(emailResponse, 'Failed to fetch user email');\n        throw new OAuth2Error(emailResponse.status, 'invalid_request', message);\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified ?? false;\n      return {\n        data,\n        claims: {\n          // GitHub answers the account id as a number; `sub` is a string claim.\n          sub: String(data.id),\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: number;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,aAAa;;AAGnB,eAAe,gBAAgB,UAAoB,SAAiB;CAClE,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,MAAM,SAAS,OAAO,KAAK,KAAK,MAAM,GAAG,GAAG,MAAM;CAClD,OAAO,GAAG,QAAQ,SAAS,SAAS,OAAO,GAAG;AAChD;AAEA,SAAgB,uBAAiC;CAC/C,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,cAAc,CAAC,YAAY;EAC3B,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,SAAS,EAAE,cAAc,WAAW;GACtC,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GAGA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,IAAI,KAAK,OAAO,MAAM,IAAIA,qBAAAA,YAAY,KAAK,KAAK,OAAO,KAAK,iBAAiB;GAC7E,OAAO;EACT;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,0BAA0B;GAClD,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GACrD,MAAM,UAAU;IACd,QAAQ;IACR,eAAe,UAAU;IACzB,cAAc;GAChB;GACA,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,UAAU,MAAM,gBAAgB,UAAU,2BAA2B;IAC3E,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,OAAO;GACnE;GACA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,MAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;GACnF,IAAI,CAAC,cAAc,IAAI;IACrB,MAAM,UAAU,MAAM,gBAAgB,eAAe,4BAA4B;IACjF,MAAM,IAAIA,qBAAAA,YAAY,cAAc,QAAQ,mBAAmB,OAAO;GACxE;GACA,MAAM,SAAU,MAAM,cAAc,KAAK;GACzC,KAAK,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,CAAC,EAAE,SAAS,KAAK;GAClE,MAAM,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,CAAC,EAAE,YAAY;GACvF,OAAO;IACL;IACA,QAAQ;KAEN,KAAK,OAAO,KAAK,EAAE;KACnB,MAAM,KAAK,QAAQ,KAAK;KACxB;KACA,OAAO,KAAK;KACZ,SAAS,KAAK;KACd,SAAS,KAAK;KACd,SAAS,KAAK;KACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI,KAAA;IAC9D;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/provider/github.d.cts

@@ -3,7 +3,7 @@ export declare function createGithubProvider(): Provider;
 export declare const github: Provider;
 export interface GithubUserInfo {
   login: string;
-  id: string;
+  id: number;
   node_id: string;
   avatar_url: string;
   gravatar_id: string;

package/dist/oauth2/provider/github.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"github.d.cts","names":[],"sources":["../../../src/oauth2/provider/github.ts"],"mappings":";wBAmBgB,wBAAwB;qBAqE3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;;;iBAWa,oBAAoB;EACnC;EACA;EACA;EACA;EACA"}
+{"version":3,"file":"github.d.cts","names":[],"sources":["../../../src/oauth2/provider/github.ts"],"mappings":";wBAmBgB,wBAAwB;qBAsE3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;;;iBAWa,oBAAoB;EACnC;EACA;EACA;EACA;EACA"}

package/dist/oauth2/provider/github.d.mts

@@ -3,7 +3,7 @@ export declare function createGithubProvider(): Provider;
 export declare const github: Provider;
 export interface GithubUserInfo {
   login: string;
-  id: string;
+  id: number;
   node_id: string;
   avatar_url: string;
   gravatar_id: string;

package/dist/oauth2/provider/github.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"github.d.mts","names":[],"sources":["../../../src/oauth2/provider/github.ts"],"mappings":";wBAmBgB,wBAAwB;qBAqE3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;;;iBAWa,oBAAoB;EACnC;EACA;EACA;EACA;EACA"}
+{"version":3,"file":"github.d.mts","names":[],"sources":["../../../src/oauth2/provider/github.ts"],"mappings":";wBAmBgB,wBAAwB;qBAsE3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;;;iBAWa,oBAAoB;EACnC;EACA;EACA;EACA;EACA"}

package/dist/oauth2/provider/github.mjs

@@ -67,7 +67,7 @@ function createGithubProvider() {
 			return {
 				data,
 				claims: {
-					sub: data.id,
+					sub: String(data.id),
 					name: data.name || data.login,
 					email_verified,
 					email: data.email,

package/dist/oauth2/provider/github.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"github.mjs","names":[],"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\n/**\n * GitHub's REST API rejects any request without a `User-Agent` header with a 403. Node's fetch sends\n * a default one, but Cloudflare Workers' fetch sends none, so every GitHub request sets it explicitly.\n * reference: https://docs.github.com/en/rest/using-the-rest-api/troubleshooting-the-rest-api#user-agent-required\n */\nconst USER_AGENT = '@shware/security';\n\n/** A short slice of an error response body, enough to tell GitHub's failures apart in logs. */\nasync function describeFailure(response: Response, message: string) {\n  const body = await response.text().catch(() => '');\n  const detail = body ? `: ${body.slice(0, 200)}` : '';\n  return `${message} (HTTP ${response.status})${detail}`;\n}\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        headers: { 'User-Agent': USER_AGENT },\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      // GitHub answers a failed exchange (bad_verification_code, incorrect_client_credentials, ...)\n      // with HTTP 200 and an error body, so a 200 alone does not mean a token was issued.\n      const body = (await response.json()) as GithubToken & Partial<GithubErrorResponse>;\n      if (body.error) throw new OAuth2Error(400, body.error, body.error_description);\n      return body;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = {\n        Accept: 'application/json',\n        Authorization: `Bearer ${access_token}`,\n        'User-Agent': USER_AGENT,\n      };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const message = await describeFailure(response, 'Failed to fetch user info');\n        throw new OAuth2Error(response.status, 'invalid_request', message);\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        const message = await describeFailure(emailResponse, 'Failed to fetch user email');\n        throw new OAuth2Error(emailResponse.status, 'invalid_request', message);\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified ?? false;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: string;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";;;;;;;;;AAUA,MAAM,aAAa;;AAGnB,eAAe,gBAAgB,UAAoB,SAAiB;CAClE,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,MAAM,SAAS,OAAO,KAAK,KAAK,MAAM,GAAG,GAAG,MAAM;CAClD,OAAO,GAAG,QAAQ,SAAS,SAAS,OAAO,GAAG;AAChD;AAEA,SAAgB,uBAAiC;CAC/C,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,cAAc,CAAC,YAAY;EAC3B,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,SAAS,EAAE,cAAc,WAAW;GACtC,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GAGA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,IAAI,KAAK,OAAO,MAAM,IAAI,YAAY,KAAK,KAAK,OAAO,KAAK,iBAAiB;GAC7E,OAAO;EACT;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GACrD,MAAM,UAAU;IACd,QAAQ;IACR,eAAe,UAAU;IACzB,cAAc;GAChB;GACA,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,UAAU,MAAM,gBAAgB,UAAU,2BAA2B;IAC3E,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,OAAO;GACnE;GACA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,MAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;GACnF,IAAI,CAAC,cAAc,IAAI;IACrB,MAAM,UAAU,MAAM,gBAAgB,eAAe,4BAA4B;IACjF,MAAM,IAAI,YAAY,cAAc,QAAQ,mBAAmB,OAAO;GACxE;GACA,MAAM,SAAU,MAAM,cAAc,KAAK;GACzC,KAAK,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,CAAC,EAAE,SAAS,KAAK;GAClE,MAAM,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,CAAC,EAAE,YAAY;GACvF,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK,QAAQ,KAAK;KACxB;KACA,OAAO,KAAK;KACZ,SAAS,KAAK;KACd,SAAS,KAAK;KACd,SAAS,KAAK;KACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI,KAAA;IAC9D;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"github.mjs","names":[],"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\n/**\n * GitHub's REST API rejects any request without a `User-Agent` header with a 403. Node's fetch sends\n * a default one, but Cloudflare Workers' fetch sends none, so every GitHub request sets it explicitly.\n * reference: https://docs.github.com/en/rest/using-the-rest-api/troubleshooting-the-rest-api#user-agent-required\n */\nconst USER_AGENT = '@shware/security';\n\n/** A short slice of an error response body, enough to tell GitHub's failures apart in logs. */\nasync function describeFailure(response: Response, message: string) {\n  const body = await response.text().catch(() => '');\n  const detail = body ? `: ${body.slice(0, 200)}` : '';\n  return `${message} (HTTP ${response.status})${detail}`;\n}\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        headers: { 'User-Agent': USER_AGENT },\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      // GitHub answers a failed exchange (bad_verification_code, incorrect_client_credentials, ...)\n      // with HTTP 200 and an error body, so a 200 alone does not mean a token was issued.\n      const body = (await response.json()) as GithubToken & Partial<GithubErrorResponse>;\n      if (body.error) throw new OAuth2Error(400, body.error, body.error_description);\n      return body;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = {\n        Accept: 'application/json',\n        Authorization: `Bearer ${access_token}`,\n        'User-Agent': USER_AGENT,\n      };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const message = await describeFailure(response, 'Failed to fetch user info');\n        throw new OAuth2Error(response.status, 'invalid_request', message);\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        const message = await describeFailure(emailResponse, 'Failed to fetch user email');\n        throw new OAuth2Error(emailResponse.status, 'invalid_request', message);\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified ?? false;\n      return {\n        data,\n        claims: {\n          // GitHub answers the account id as a number; `sub` is a string claim.\n          sub: String(data.id),\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: number;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";;;;;;;;;AAUA,MAAM,aAAa;;AAGnB,eAAe,gBAAgB,UAAoB,SAAiB;CAClE,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,MAAM,SAAS,OAAO,KAAK,KAAK,MAAM,GAAG,GAAG,MAAM;CAClD,OAAO,GAAG,QAAQ,SAAS,SAAS,OAAO,GAAG;AAChD;AAEA,SAAgB,uBAAiC;CAC/C,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,cAAc,CAAC,YAAY;EAC3B,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,SAAS,EAAE,cAAc,WAAW;GACtC,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GAGA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,IAAI,KAAK,OAAO,MAAM,IAAI,YAAY,KAAK,KAAK,OAAO,KAAK,iBAAiB;GAC7E,OAAO;EACT;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GACrD,MAAM,UAAU;IACd,QAAQ;IACR,eAAe,UAAU;IACzB,cAAc;GAChB;GACA,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,UAAU,MAAM,gBAAgB,UAAU,2BAA2B;IAC3E,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,OAAO;GACnE;GACA,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,MAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;GACnF,IAAI,CAAC,cAAc,IAAI;IACrB,MAAM,UAAU,MAAM,gBAAgB,eAAe,4BAA4B;IACjF,MAAM,IAAI,YAAY,cAAc,QAAQ,mBAAmB,OAAO;GACxE;GACA,MAAM,SAAU,MAAM,cAAc,KAAK;GACzC,KAAK,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,CAAC,EAAE,SAAS,KAAK;GAClE,MAAM,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,CAAC,EAAE,YAAY;GACvF,OAAO;IACL;IACA,QAAQ;KAEN,KAAK,OAAO,KAAK,EAAE;KACnB,MAAM,KAAK,QAAQ,KAAK;KACxB;KACA,OAAO,KAAK;KACZ,SAAS,KAAK;KACd,SAAS,KAAK;KACd,SAAS,KAAK;KACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI,KAAA;IAC9D;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/security",
-  "version": "8.0.0",
+  "version": "8.0.1",
   "private": false,
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@shware/utils": "^2.0.1",
+    "@shware/utils": "^2.0.2",
     "cookie": "^2.0.1",
     "jose": "^6.2.13",
     "path-to-regexp": "^8.4.2"