@shware/security 9.0.0 → 9.1.0

package/README.md

@@ -213,7 +213,11 @@ cookie's `HttpOnly` keeps it from, and a cross-origin client needs the header in
 `Access-Control-Expose-Headers`. `Authorization` is never read: an API token is a different
 credential from a session and is not handled here.
 `logout` clears the cookie with the same attributes it was set with (`domain`, `path`, …), so a
-cookie set with `Domain=.example.com` is actually removed.
+cookie set with `Domain=.example.com` is actually removed. `logout(request, { scope })` widens what
+it ends, named as Supabase's `signOut` names them: `local` (default) the request's own session,
+`global` every session of its principal ("sign out everywhere": deleting the account, a password
+change), `others` every session but this one, which keeps the caller signed in ("sign out other
+devices"). `kick(principal)` is the same eviction for a principal other than the caller.
 
 Besides the route handlers, `Auth` exposes session helpers: `getPrincipal(request)`,
 `isAuthenticated(request)`, `getSession(request, create)`, `listSessions(principal)`,

package/dist/auth/index.cjs

@@ -212,10 +212,20 @@ var Auth = class {
 		});
 		return response;
 	};
-	logout = async (request) => {
+	logout = async (request, options) => {
+		const scope = options?.scope ?? "local";
 		const sessionId = this.getSessionId(request);
-		if (sessionId) await this.repository.deleteById(sessionId);
+		if (scope !== "local" && sessionId) {
+			const session = await this.repository.findById(sessionId);
+			const principal = session && this.principalOf(session);
+			if (principal) {
+				const sessions = await this.repository.findByPrincipalName(principal.name);
+				for (const id of sessions.keys()) if (id !== sessionId) await this.repository.deleteById(id);
+			}
+		}
 		const response = Response.json({});
+		if (scope === "others") return response;
+		if (sessionId) await this.repository.deleteById(sessionId);
 		require_utils_http.deleteCookie(response, this.cookieName, this.cookieOptions);
 		return response;
 	};

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isKnownOAuth2ErrorType","attributesSize","MAX_ATTRIBUTES_BYTES","extend","googleOneTapSchema","attributesSchema","object","string","regex","literal","EmailVerificationCodes","DesktopCodes","OAuth2Client","getCookie","PRINCIPAL_NAME_INDEX_NAME","errorResponse","randomUUID","randomBytes","createHash","AuthenticationError","param","timing","query","oauth2RedirectQuerySchema","OAuth2Error","readJson","bodyAttributes","invalidArgument","readForm","parse","sendEmailVerificationCodeSchema","verifyTurnstileToken","loginEmailSchema","unauthenticated"],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomUUID } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { extend, literal, object, regex, string } from 'zod/mini';\nimport type { Principal } from '../core/index';\nimport { loginEmailSchema, sendEmailVerificationCodeSchema } from '../email/schema';\nimport { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2Error, type OAuth2ErrorType, isKnownOAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredential,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n  StandardClaims,\n} from '../oauth2/types';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport {\n  type CookieOptions,\n  deleteCookie,\n  getCookie,\n  param,\n  query,\n  setCookie,\n} from '../utils/http';\nimport { timing } from '../utils/timing';\nimport { parse, readForm, readJson, verifyTurnstileToken } from '../utils/valid';\nimport {\n  MAX_ATTRIBUTES_BYTES,\n  attributesSchema,\n  attributesSize,\n  bodyAttributes,\n} from './attributes';\nimport { DesktopCodes } from './desktop-codes';\nimport { type EmailSender, EmailVerificationCodes } from './email-codes';\nimport { AuthenticationError } from './error';\nimport { errorResponse, invalidArgument, unauthenticated } from './respond';\nimport type {\n  AuthConfig,\n  AuthService,\n  Authorization,\n  AuthorizedHandler,\n  LoggedHandler,\n  OAuth2AuthorizationOptions,\n} from './types';\n\n// PKCE per RFC 7636: code_verifier / code_challenge are 43-128 chars from\n// the unreserved set. We restrict to base64url (drops \".\" and \"~\") since\n// that's what S256 produces and what callers should be sending; rejecting\n// the rest shrinks the accepted input shape without losing legit clients.\n// A 32-byte random verifier base64url-encodes to exactly 43 chars.\nconst PKCE_FORMAT = /^[A-Za-z0-9_-]{43,128}$/;\n\n// A native app's `code_verifier` goes on to the provider, which checks it against the challenge\n// the app sent: accept the whole RFC 7636 unreserved set here, as the provider does.\nconst CODE_VERIFIER_FORMAT = /^[A-Za-z0-9._~-]{43,128}$/;\n\n/** The header a session id travels in besides the cookie, with `session.header` on. */\nconst SESSION_HEADER = 'X-Auth-Token';\n\n/** Seconds an OAuth2 state or nonce may be used within. */\nconst OAUTH2_PARAMETER_TTL = 10 * 60;\n\n// error_description forwarded to errorUri comes from the provider or an error message: cap it so\n// the redirect URL stays short and an attacker-crafted callback cannot stuff the page with text.\nconst MAX_ERROR_DESCRIPTION_LENGTH = 256;\n\n/** An error code safe to put on errorUri: a registered one as is, anything else as `fallback`. */\nfunction safeErrorType(error: string, fallback: OAuth2ErrorType): OAuth2ErrorType {\n  return isKnownOAuth2ErrorType(error) ? error : fallback;\n}\n\n/**\n * The codes a failure past validation keeps on errorUri, each one the user can act on: the code\n * expired or was used (start again), they declined, or the provider is briefly down. Every other\n * failure there (a rejected client, a user info request that failed) is the app's or the\n * provider's problem, which the user sees as `server_error`.\n */\nconst CALLBACK_ERROR_TYPES: ReadonlySet<OAuth2ErrorType> = new Set([\n  'invalid_grant',\n  'access_denied',\n  'temporarily_unavailable',\n]);\n\nfunction authorizationAttributes(\n  attributes: OAuth2AuthorizationOptions['attributes']\n): Record<string, string> | undefined {\n  if (!attributes) return undefined;\n  const defined: Record<string, string> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    if (value !== undefined) defined[key] = value;\n  }\n  if (Object.keys(defined).length === 0) return undefined;\n  // The host's own values, written with the session: oversized is a bug in the host, not a 400.\n  const size = attributesSize(defined);\n  invariant(\n    size <= MAX_ATTRIBUTES_BYTES,\n    `oauth2 authorization attributes are ${size} bytes, at most ${MAX_ATTRIBUTES_BYTES} allowed`\n  );\n  return defined;\n}\n\n/** Sign in with Apple answers with `response_mode=form_post`; a charset parameter may follow. */\nfunction isFormPost(request: Request) {\n  const contentType = request.headers.get('content-type')?.toLowerCase();\n  return (\n    request.method === 'POST' && !!contentType?.startsWith('application/x-www-form-urlencoded')\n  );\n}\n\n/** Google's own form post carries no attributes; an app posting JSON may add them. */\nconst oneTapBodySchema = extend(googleOneTapSchema, { attributes: attributesSchema });\n\nconst desktopAuthorizeSchema = object({\n  code_challenge: string().check(regex(PKCE_FORMAT)),\n  code_challenge_method: literal('S256'),\n});\n\nconst desktopExchangeSchema = object({\n  code: string(),\n  code_verifier: string().check(regex(PKCE_FORMAT)),\n});\n\nexport const PATH = {\n  CSRF: '/csrf',\n  LOGOUT: '/logout',\n  LOGGED: '/logged',\n\n  OAUTH2_STATE: '/oauth2/state/:provider',\n  OAUTH2_NONCE: '/oauth2/nonce/:provider',\n  OAUTH2_AUTHORIZATION: '/oauth2/authorization/:provider',\n  LOGIN_OAUTH2_CODE: '/login/oauth2/code/:provider',\n  LOGIN_OAUTH2_NATIVE: '/login/oauth2/native/:provider',\n  LOGIN_OAUTH2_ONETAP: '/login/oauth2/onetap/google',\n\n  LOGIN_EMAIL: '/login/email',\n  SEND_EMAIL_VERIFICATION_CODE: '/auth/sendEmailVerificationCode',\n\n  // Desktop / native app sign-in via web loopback (RFC 8252 + OAuth 2.1 Auth Code Flow):\n  //   1. user already authenticated with cookie session → POST DESKTOP_AUTHORIZE → { code }\n  //   2. web redirects to desktop's loopback callback with the code\n  //   3. desktop renderer POSTs DESKTOP_EXCHANGE with the code → server returns\n  //      Set-Cookie carrying a fresh session, single-use code is invalidated\n  // The two-step flow keeps the actual session id off the redirect URL — only a\n  // 5-minute single-use code transits via the loopback.\n  DESKTOP_AUTHORIZE: '/auth/desktop/authorize',\n  DESKTOP_EXCHANGE: '/auth/desktop/exchange',\n\n  CLEANUP_EXPIRED_SESSIONS: '/sessions/expired/cleanup',\n} as const;\n\n/**\n * The login routes and session helpers. Every route is one straight line: read and validate the\n * request, check the credential, call the host's `onAuthorized`, sign in. Failures are thrown and\n * answered in one place per kind of route: a JSON route runs under `guard`, which maps a\n * `RequestError`, an `AuthenticationError` or an `OAuth2Error` to its google.rpc body (see\n * `respond.ts`); the redirect callback maps the same errors to `errorUri` parameters (`redirect`).\n */\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n  private readonly turnstileSecretKey?: string;\n  private readonly emailCodes: EmailVerificationCodes;\n  private readonly desktopCodes: DesktopCodes;\n  private readonly oauth2Client: OAuth2Client | null;\n  /** Provider keys whose logins may come without a nonce (`oauth2.nonce.optional`). */\n  private readonly nonceOptional: ReadonlySet<string>;\n  private readonly touchInterval: number;\n  private readonly sessionHeader: boolean;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({\n    sessionRepository,\n    kvRepository,\n    turnstileSecretKey,\n    verificationCode,\n    oauth2,\n    cookie,\n    session,\n    timing,\n  }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    this.turnstileSecretKey = turnstileSecretKey;\n    const maxAttempts = verificationCode?.maxAttempts ?? 5;\n    const resendCooldown = verificationCode?.resendCooldown ?? 60;\n    invariant(maxAttempts >= 1, 'verificationCode.maxAttempts must be at least 1');\n    invariant(resendCooldown >= 1, 'verificationCode.resendCooldown must be at least 1 second');\n    this.emailCodes = new EmailVerificationCodes(kvRepository, { maxAttempts, resendCooldown });\n    this.desktopCodes = new DesktopCodes(kvRepository);\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n    this.nonceOptional = new Set(oauth2?.nonce?.optional);\n    this.touchInterval = (session?.touchInterval ?? 3600) * 1000;\n    this.sessionHeader = session?.header ?? false;\n    invariant(this.touchInterval >= 0, 'session.touchInterval must not be negative');\n  }\n\n  // ---- sessions and responses ------------------------------------------------------------------\n\n  private getSessionId(request: Request): string | undefined {\n    const fromCookie = getCookie(request, this.cookieName);\n    if (fromCookie) return fromCookie;\n    return (this.sessionHeader && request.headers.get(SESSION_HEADER)) || undefined;\n  }\n\n  /** The session the request carries, if it exists. */\n  private async loadSession(request: Request): Promise<Session | null> {\n    const sessionId = this.getSessionId(request);\n    return sessionId ? this.repository.findById(sessionId) : null;\n  }\n\n  /** The signed-in principal of a session, if any. */\n  private principalOf(session: Session): Principal | null {\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    return name ? { name: String(name) } : null;\n  }\n\n  /**\n   * A new session signed in as `principal`. With `carryOver`, what the host kept in the pre-login\n   * session moves to the new one; the authorization request (state, PKCE verifier, flow\n   * attributes) is single-use and was consumed, and a principal left there from an earlier\n   * sign-in is replaced. The new id is never the one the browser brought, which may have been\n   * planted by an attacker who started the flow (session fixation).\n   */\n  private async signIn(principal: Principal, carryOver?: Session): Promise<Session> {\n    const session = this.repository.createSession();\n    for (const attribute of carryOver?.getAttributeNames() ?? []) {\n      if (attribute === this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) continue;\n      if (attribute === PRINCIPAL_NAME_INDEX_NAME) continue;\n      const value = carryOver?.getAttribute(attribute);\n      if (value !== null && value !== undefined) session.setAttribute(attribute, value);\n    }\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    return session;\n  }\n\n  /**\n   * `response` carrying `session`: its cookie, renewed for the whole inactive interval, and with\n   * `session.header` on, the `X-Auth-Token` header a client without a cookie jar reads.\n   */\n  private withSession(response: Response, session: Session, cookie?: CookieOptions): Response {\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), {\n      ...this.cookieOptions,\n      ...cookie,\n      maxAge,\n    });\n    if (this.sessionHeader) response.headers.set(SESSION_HEADER, session.getId());\n    return response;\n  }\n\n  /** Runs a JSON route: a failure it knows is its response, anything else is the host's. */\n  private async guard(run: () => Promise<Response>): Promise<Response> {\n    try {\n      return await run();\n    } catch (error) {\n      const response = errorResponse(error);\n      if (response) return response;\n      throw error;\n    }\n  }\n\n  /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */\n  private redirect(\n    error: OAuth2ErrorType,\n    description?: string,\n    refusal?: AuthenticationError\n  ): Response {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    // Metadata never replaces a parameter: not one errorUri carries itself, nor one set below.\n    for (const [key, value] of Object.entries(refusal?.metadata ?? {})) {\n      if (!uri.searchParams.has(key)) uri.searchParams.set(key, value);\n    }\n    uri.searchParams.set('error', error);\n    if (description) {\n      uri.searchParams.set('error_description', description.slice(0, MAX_ERROR_DESCRIPTION_LENGTH));\n    }\n    if (refusal) uri.searchParams.set('reason', refusal.reason);\n    return Response.redirect(uri.href, 302);\n  }\n\n  // ---- basic -----------------------------------------------------------------------------------\n\n  csrf = async (_request: Request): Promise<Response> => {\n    const token = randomUUID();\n    const response = Response.json({\n      token,\n      parameterName: '_csrf',\n      headerName: 'X-XSRF-TOKEN',\n    });\n\n    // Double Submit Cookie Protection\n    setCookie(response, 'XSRF-TOKEN', token, {\n      path: '/',\n      secure: true,\n      httpOnly: false,\n      sameSite: 'none',\n      domain: this.cookieOptions.domain,\n    });\n    return response;\n  };\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = this.getSessionId(request);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    // A Set-Cookie only replaces the stored cookie when Domain and Path match (RFC 6265),\n    // so clear it with the same attributes it was set with.\n    deleteCookie(response, this.cookieName, this.cookieOptions);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    const session = await this.loadSession(request);\n    if (!session) return Response.json({ data: false });\n\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    const principal = this.principalOf(session);\n    if (principal) await onLogged?.(principal);\n    return this.withSession(Response.json({ data: principal !== null }), session);\n  };\n\n  // ---- oauth2 ----------------------------------------------------------------------------------\n\n  private createPkceParameters(): PkceParameters {\n    // 32 random bytes: a 43-char base64url verifier, the RFC 7636 minimum (a UUID is 36).\n    const code_verifier = randomBytes(32).toString('base64url');\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  /**\n   * Spends a nonce `oauth2Nonce` issued for `provider`: `NONCE_MISMATCH` for one that was not,\n   * or was used already. An id token is replayable until it expires; the nonce it carries makes\n   * it sign in once.\n   */\n  private async consumeNonce(nonce: string, provider: string): Promise<void> {\n    const key = this.getOauth2NonceKey(nonce);\n    if ((await this.kv.getItem(key)) !== provider) throw new AuthenticationError('NONCE_MISMATCH');\n    await this.kv.removeItem(key);\n  }\n\n  /**\n   * The nonce check of the JSON logins (One Tap, native), where the client obtained the id token\n   * and the nonce came from `oauth2Nonce`: spends the one the token carries, and refuses a token\n   * without one when the provider's flow echoes nonces (`required`) and the host has not listed the\n   * provider as optional. An id token is replayable until it expires; the nonce makes it sign in\n   * once.\n   */\n  private async checkIssuedNonce(\n    userInfo: Authorization['userInfo'],\n    provider: string,\n    required: boolean\n  ): Promise<boolean> {\n    const { nonce } = userInfo.data as { nonce?: unknown };\n    if (typeof nonce === 'string' && nonce) {\n      await this.consumeNonce(nonce, provider);\n      return true;\n    }\n    if (required && !this.nonceOptional.has(provider)) {\n      throw new AuthenticationError('NONCE_MISSING');\n    }\n    return false;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = (\n    request: Request,\n    options?: OAuth2AuthorizationOptions\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const attributes = authorizationAttributes(options?.attributes);\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.OAUTH2_AUTHORIZATION);\n      const state = randomUUID();\n      const pkce = this.createPkceParameters();\n      // Sent only to a provider whose id token echoes it: the callback then requires it back, so\n      // a code that was swapped in for another sign-in's yields a token the session refuses.\n      const nonce = (await this.oauth2Client.nonceSupport(provider)).web ? randomUUID() : undefined;\n      const uri = await this.oauth2Client.createAuthorizationUri({ provider, state, pkce, nonce });\n      let session = await this.loadSession(request);\n      if (!session) {\n        // A session made for the flow only has to outlive the state: an abandoned flow must not\n        // keep a row for the default interval. Sign-in moves to a new session, with the default.\n        session = this.repository.createSession();\n        session.setMaxInactiveInterval(OAUTH2_PARAMETER_TTL);\n      }\n      mark('fetch_session');\n\n      const authorizationRequest: OAuth2AuthorizationRequest = {\n        state,\n        provider,\n        authorizationRequestUri: uri.href,\n        additionalParameters: pkce,\n        ...(nonce ? { nonce } : {}),\n        ...(attributes ? { attributes } : {}),\n      };\n      session.setAttribute(\n        this.ATTR_OAUTH2_AUTHORIZATION_REQUEST,\n        JSON.stringify(authorizationRequest)\n      );\n      await this.repository.save(session);\n      mark('save_session');\n\n      const response = new Response(null, { status: 302, headers: { location: uri.href } });\n      setTiming(response);\n      return this.withSession(response, session);\n    });\n\n  loginOAuth2Code = async (request: Request, handler: AuthorizedHandler): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. the session the flow started on, and the authorization request it stored\n    const session = await this.loadSession(request);\n    if (!session) return this.redirect('invalid_request', 'session not found');\n    mark('load_session');\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) return this.redirect('invalid_request', 'authorization request not found');\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 2. the provider's answer: query, or a form for Apple's response_mode=form_post\n    const { provider } = param(request, PATH.LOGIN_OAUTH2_CODE);\n    const data = isFormPost(request)\n      ? Object.fromEntries(new URLSearchParams(await request.text()))\n      : query(request);\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) return this.redirect('invalid_request', 'invalid redirect query');\n    // The provider answered with an error instead of a code (the user pressed Cancel →\n    // access_denied, invalid_scope, server_error, ...). Forward it rather than reporting a\n    // malformed query. This runs before the state check on purpose: providers echo state on\n    // error responses, but not all reliably do, and a forged error callback can only make the\n    // victim's popup show an error — nothing is exchanged or signed in. A present state that does\n    // not match still wins, since that is the more accurate (and more alarming) diagnosis.\n    if (parsed.data.error) {\n      if (parsed.data.state && parsed.data.state !== cached.state) {\n        return this.redirect('invalid_request', 'redirect state mismatch');\n      }\n      return this.redirect(\n        safeErrorType(parsed.data.error, 'server_error'),\n        parsed.data.error_description\n      );\n    }\n    const { code, state, user } = parsed.data;\n    if (!code || !state) return this.redirect('invalid_request', 'invalid redirect query');\n    if (state !== cached.state) return this.redirect('invalid_request', 'redirect state mismatch');\n    if (provider !== cached.provider) {\n      return this.redirect('invalid_request', 'redirect provider mismatch');\n    }\n    mark('validate_session');\n\n    // 3. exchange the code, load the user, sign in. Everything here can fail (an expired or reused\n    // code, a network error, the host's handler or session store). The callback runs in a popup\n    // the user is looking at, so every failure must land on errorUri, never as a JSON error.\n    let signedIn: Session;\n    try {\n      const { clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n        provider,\n        code,\n        pkce: cached.additionalParameters,\n      });\n      // Apple posts the user's name alongside the code, once: hand it to the provider with the token.\n      const userInfo = await this.oauth2Client.getUserInfo({\n        provider,\n        clientId,\n        token,\n        response: user ? { user } : undefined,\n      });\n      mark('exchange_code');\n      // The id token must carry the nonce this flow sent (stored with the state, not in KV: it\n      // is bound to this session's request). A provider that gave no id token has nothing to\n      // carry it, as has a request stored before nonces were sent.\n      if (cached.nonce && token.id_token) {\n        const { nonce } = userInfo.data as { nonce?: unknown };\n        if (typeof nonce !== 'string' || !nonce) throw new AuthenticationError('NONCE_MISSING');\n        if (nonce !== cached.nonce) throw new AuthenticationError('NONCE_MISMATCH');\n        mark('check_nonce');\n      }\n\n      const principal = await handler(request, {\n        provider,\n        clientId,\n        userInfo,\n        token,\n        attributes: cached.attributes ?? {},\n      });\n      mark('save_principal');\n\n      signedIn = await this.signIn(principal, session);\n      await this.repository.deleteById(session.getId());\n      mark('update_session');\n    } catch (error) {\n      // The details stay in the logs: an OAuth2Error message can carry a client id or a\n      // provider's response, which has no place in a URL the browser keeps in its history.\n      if (error instanceof OAuth2Error) {\n        console.warn('OAuth2 callback failed', error);\n        const type = CALLBACK_ERROR_TYPES.has(error.error) ? error.error : 'server_error';\n        return this.redirect(type);\n      }\n      // A refusal is something the user can act on, so its reason and metadata reach the page,\n      // as they reach a JSON client through the ErrorInfo.\n      if (error instanceof AuthenticationError) {\n        console.warn('OAuth2 sign-in refused', error.reason, error.metadata);\n        return this.redirect('access_denied', undefined, error);\n      }\n      console.error('OAuth2 callback failed', error);\n      return this.redirect('server_error');\n    }\n\n    const uri = new URL(this.oauth2Client.successUri);\n    uri.searchParams.set('status', 'success');\n    uri.searchParams.set('provider', provider);\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    setTiming(response);\n    return this.withSession(response, signedIn);\n  };\n\n  /** The shared tail of the JSON login routes: the host's handler, then a signed-in session. */\n  private async authorize(\n    request: Request,\n    handler: AuthorizedHandler,\n    authorization: Authorization,\n    setTiming: (response: Response) => void\n  ): Promise<Response> {\n    const principal = await handler(request, authorization);\n    const session = await this.signIn(principal);\n    const response = Response.json(principal);\n    setTiming(response);\n    return this.withSession(response, session);\n  }\n\n  loginOAuth2Native = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.LOGIN_OAUTH2_NATIVE);\n      const body = await readJson(request);\n      // Whatever the app sends besides its credentials for `onAuthorized` (a referral code, ...).\n      const attributes = bodyAttributes(body);\n      // Only the credentials go on to the provider client.\n      const { attributes: _, ...credentials } = body as NativeCredential & { attributes?: unknown };\n      const { code_verifier } = credentials as { code_verifier?: unknown };\n      if (\n        code_verifier !== undefined &&\n        (typeof code_verifier !== 'string' || !CODE_VERIFIER_FORMAT.test(code_verifier))\n      ) {\n        throw invalidArgument(\n          'INVALID_CODE_VERIFIER',\n          'code_verifier must be 43-128 characters from [A-Za-z0-9-._~]'\n        );\n      }\n      const { clientId, userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n        provider,\n        credentials,\n      });\n      mark('login_oauth2_native');\n\n      // Required when the provider's native id token echoes a nonce and the login produced one\n      // (Facebook's access_token login has none to carry it).\n      const required = (await this.oauth2Client.nonceSupport(provider)).native && !!token.id_token;\n      if (await this.checkIssuedNonce(userInfo, provider, required)) mark('check_nonce');\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  loginOAuth2Onetap = (\n    request: Request,\n    handler: AuthorizedHandler,\n    provider = 'google'\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n\n      // Google's own form post, or an app's JSON.\n      const contentType = request.headers.get('content-type') ?? '';\n      const body = contentType.includes('application/json')\n        ? await readJson(request)\n        : await readForm(request);\n      const { attributes = {}, ...parsed } = parse(oneTapBodySchema, body);\n\n      // Both the credential and the code are issued to the provider's web client.\n      let clientId: string;\n      let token: Authorization['token'];\n      let userInfo: Authorization['userInfo'];\n      if (parsed.credential) {\n        ({ clientId, token, userInfo } = await this.oauth2Client.getTokenInfo({\n          provider,\n          credential: parsed.credential,\n        }));\n        mark('verify_credential');\n\n        // The credential must carry a single-use nonce from `oauth2Nonce`, which the front end\n        // passed to `prompt`. This replaces Google's `g_csrf_token` double-submit cookie, which\n        // FedCM mode no longer sets.\n        const required = (await this.oauth2Client.nonceSupport(provider)).web;\n        if (await this.checkIssuedNonce(userInfo, provider, required)) mark('check_nonce');\n      } else if (parsed.code) {\n        ({ clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n          provider,\n          code: parsed.code,\n        }));\n        userInfo = await this.oauth2Client.getUserInfo({ provider, clientId, token });\n      } else {\n        throw invalidArgument('INVALID_ARGUMENT', 'credential or code is required');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  // ---- email -----------------------------------------------------------------------------------\n\n  sendEmailVerificationCode = (request: Request, sender: EmailSender): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.turnstileSecretKey, 'turnstileSecretKey is not configured');\n      const { email, turnstileToken } = parse(\n        sendEmailVerificationCodeSchema,\n        await readJson(request)\n      );\n      await verifyTurnstileToken(this.turnstileSecretKey, turnstileToken);\n      await this.emailCodes.send(email, sender);\n      return Response.json({});\n    });\n\n  verifyEmailCode = (email: string, verificationCode: string): Promise<void> =>\n    this.emailCodes.verify(email, verificationCode);\n\n  loginEmail = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      const { setTiming } = timing({ enabled: this.timing });\n      const {\n        email,\n        verificationCode,\n        attributes = {},\n      } = parse(loginEmailSchema, await readJson(request));\n      await this.emailCodes.verify(email, verificationCode);\n      const claims: StandardClaims = { sub: email, email, email_verified: true };\n      return this.authorize(\n        request,\n        handler,\n        { provider: 'EMAIL', userInfo: { claims, data: {} }, attributes },\n        setTiming\n      );\n    });\n\n  // ---- desktop ---------------------------------------------------------------------------------\n\n  /**\n   * Step 1 of the desktop / native app sign-in handshake. The caller already completed normal\n   * sign-in on the web (so a cookie session exists); this issues a 5-minute single-use code that\n   * the web page hands off to the desktop client via a loopback redirect.\n   *\n   * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier` before opening the\n   * browser, derives `code_challenge = base64url(sha256(verifier))`, and threads the challenge\n   * through the URL → web page → here. The challenge is pinned to the code; `desktopExchange`\n   * enforces that the caller knows the matching verifier. This blocks an attacker who only\n   * intercepts the auth code (browser history, malicious extension, packet capture on loopback)\n   * from exchanging it.\n   *\n   * Requires an authenticated cookie session: anonymous callers get 401. Throttling / abuse\n   * protection on this endpoint is the API layer's job (rate-limit per principal); the SDK does\n   * not gate it because the upstream sign-in flow already passed CAPTCHA / OAuth / verification.\n   */\n  desktopAuthorize = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const principal = await this.getPrincipal(request);\n      if (!principal) throw unauthenticated('Sign in first');\n      const { code_challenge } = parse(desktopAuthorizeSchema, await readJson(request));\n      const code = await this.desktopCodes.issue(principal, code_challenge);\n      return Response.json({ code });\n    });\n\n  /**\n   * Step 2 of the desktop / native app sign-in handshake. The desktop client hands back the auth\n   * code it received via the loopback callback, and we mint a fresh session for it, independent\n   * of the web cookie session that originally authorized the code, so logging out on either side\n   * does not cascade to the other.\n   *\n   * Cookie attributes: `SameSite=None; Secure` so the cookie survives cross-site fetches from the\n   * desktop renderer's `file://` / `app://` origin. The configured `cookieOptions` provide\n   * everything else (`domain`, `path`, `httpOnly`); the override is targeted at the\n   * SameSite/Secure pair only. In a non-HTTPS dev backend this combination is rejected by\n   * Chromium, see the desktop sign-in PRD for workarounds.\n   *\n   * No CSRF check needed: the request carries no cookie, the auth code itself is the credential,\n   * and the code's single-use removal blocks replay.\n   */\n  desktopExchange = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const { code, code_verifier } = parse(desktopExchangeSchema, await readJson(request));\n      const principal = await this.desktopCodes.redeem(code, code_verifier);\n      const session = await this.signIn(principal);\n      session.setAttribute('client_type', 'desktop');\n      await this.repository.save(session);\n      return this.withSession(Response.json({ ok: true }), session, {\n        sameSite: 'none',\n        secure: true,\n      });\n    });\n\n  // ---- session management ----------------------------------------------------------------------\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  /**\n   * Sliding expiration: an authenticated request renews the session, as `logged` does, so a user\n   * who keeps using the app is never signed out after `maxInactiveInterval` of not calling one\n   * particular endpoint. No extra read: the session was just loaded to authenticate, and its\n   * `lastAccessedTime` is compared in memory; writes are spaced by `session.touchInterval` (see\n   * `AuthConfig`), so a session accessed again within the interval is not rewritten.\n   */\n  private async touch(session: Session) {\n    const now = Date.now();\n    if (now - session.getLastAccessedTime() < this.touchInterval) return;\n    session.setLastAccessedTime(now);\n    await this.repository.save(session);\n  }\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const session = await this.loadSession(request);\n    const principal = session && this.principalOf(session);\n    if (!principal) return null;\n    await this.touch(session);\n    return principal;\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    return (await this.getPrincipal(request)) !== null;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    type Result = T extends true ? Session : Session | null;\n    const session = await this.loadSession(request);\n    if (session || !create) return session as Result;\n    const created = this.repository.createSession();\n    await this.repository.save(created);\n    return created;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiDA,MAAM,cAAc;AAIpB,MAAM,uBAAuB;;AAG7B,MAAM,iBAAiB;;AAGvB,MAAM,uBAAuB;AAI7B,MAAM,+BAA+B;;AAGrC,SAAS,cAAc,OAAe,UAA4C;CAChF,OAAOA,qBAAAA,uBAAuB,KAAK,IAAI,QAAQ;AACjD;;;;;;;AAQA,MAAM,uCAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;AAED,SAAS,wBACP,YACoC;CACpC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAE1C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAE9C,MAAM,OAAOC,wBAAAA,eAAe,OAAO;CACnC,CAAA,GAAA,cAAA,UAAA,CACE,QAAQC,wBAAAA,sBACR,uCAAuC,KAAK,kBAAkBA,wBAAAA,qBAAqB,SACrF;CACA,OAAO;AACT;;AAGA,SAAS,WAAW,SAAkB;CACpC,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY;CACrE,OACE,QAAQ,WAAW,UAAU,CAAC,CAAC,aAAa,WAAW,mCAAmC;AAE9F;;AAGA,MAAM,oBAAA,GAAmBC,SAAAA,OAAAA,CAAOC,sBAAAA,oBAAoB,EAAE,YAAYC,wBAAAA,iBAAiB,CAAC;AAEpF,MAAM,0BAAA,GAAyBC,SAAAA,OAAAA,CAAO;CACpC,iBAAA,GAAgBC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,MAAAA,CAAM,WAAW,CAAC;CACjD,wBAAA,GAAuBC,SAAAA,QAAAA,CAAQ,MAAM;AACvC,CAAC;AAED,MAAM,yBAAA,GAAwBH,SAAAA,OAAAA,CAAO;CACnC,OAAA,GAAMC,SAAAA,OAAAA,CAAO;CACb,gBAAA,GAAeA,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,MAAAA,CAAM,WAAW,CAAC;AAClD,CAAC;AAED,MAAa,OAAO;CAClB,MAAM;CACN,QAAQ;CACR,QAAQ;CAER,cAAc;CACd,cAAc;CACd,sBAAsB;CACtB,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CAErB,aAAa;CACb,8BAA8B;CAS9B,mBAAmB;CACnB,kBAAkB;CAElB,0BAA0B;AAC5B;;;;;;;;AASA,IAAa,OAAb,MAAyC;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;CAEA;CACA;CACA;CACA,oCAAqD;CAErD,YAAY,EACV,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACa;EACb,KAAK,SAAS,UAAU;EACxB,KAAK,KAAK;EACV,KAAK,aAAa;EAClB,KAAK,qBAAqB;EAC1B,MAAM,cAAc,kBAAkB,eAAe;EACrD,MAAM,iBAAiB,kBAAkB,kBAAkB;EAC3D,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,GAAG,iDAAiD;EAC7E,CAAA,GAAA,cAAA,UAAA,CAAU,kBAAkB,GAAG,2DAA2D;EAC1F,KAAK,aAAa,IAAIE,yBAAAA,uBAAuB,cAAc;GAAE;GAAa;EAAe,CAAC;EAC1F,KAAK,eAAe,IAAIC,2BAAAA,aAAa,YAAY;EACjD,MAAM,EAAE,MAAM,GAAG,kBAAkB,UAAU,CAAC;EAC9C,KAAK,aAAa,QAAQ;EAC1B,KAAK,gBAAgB;GACnB,MAAM;GACN,UAAU;GACV,QAAQ;GACR,UAAU;GACV,GAAG;EACL;EACA,KAAK,eAAe,QAAQ,SAAS,IAAIC,sBAAAA,aAAa,OAAO,MAAM,IAAI;EACvE,KAAK,gBAAgB,IAAI,IAAI,QAAQ,OAAO,QAAQ;EACpD,KAAK,iBAAiB,SAAS,iBAAiB,QAAQ;EACxD,KAAK,gBAAgB,SAAS,UAAU;EACxC,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,iBAAiB,GAAG,4CAA4C;CACjF;CAIA,aAAqB,SAAsC;EACzD,MAAM,aAAaC,mBAAAA,UAAU,SAAS,KAAK,UAAU;EACrD,IAAI,YAAY,OAAO;EACvB,OAAQ,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,cAAc,KAAM,KAAA;CACxE;;CAGA,MAAc,YAAY,SAA2C;EACnE,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,OAAO,YAAY,KAAK,WAAW,SAAS,SAAS,IAAI;CAC3D;;CAGA,YAAoB,SAAoC;EACtD,MAAM,OAAO,QAAQ,aAAaC,uBAAAA,yBAAyB;EAC3D,OAAO,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI;CACzC;;;;;;;;CASA,MAAc,OAAO,WAAsB,WAAuC;EAChF,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,KAAK,MAAM,aAAa,WAAW,kBAAkB,KAAK,CAAC,GAAG;GAC5D,IAAI,cAAc,KAAK,mCAAmC;GAC1D,IAAI,cAAA,iBAAyC;GAC7C,MAAM,QAAQ,WAAW,aAAa,SAAS;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,QAAQ,aAAa,WAAW,KAAK;EAClF;EACA,QAAQ,aAAaA,uBAAAA,2BAA2B,UAAU,IAAI;EAC9D,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;;;;;CAMA,YAAoB,UAAoB,SAAkB,QAAkC;EAC1F,MAAM,SAAS,QAAQ,uBAAuB;EAC9C,mBAAA,UAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG;GACpD,GAAG,KAAK;GACR,GAAG;GACH;EACF,CAAC;EACD,IAAI,KAAK,eAAe,SAAS,QAAQ,IAAI,gBAAgB,QAAQ,MAAM,CAAC;EAC5E,OAAO;CACT;;CAGA,MAAc,MAAM,KAAiD;EACnE,IAAI;GACF,OAAO,MAAM,IAAI;EACnB,SAAS,OAAO;GACd,MAAM,WAAWC,qBAAAA,cAAc,KAAK;GACpC,IAAI,UAAU,OAAO;GACrB,MAAM;EACR;CACF;;CAGA,SACE,OACA,aACA,SACU;EACV,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;EAE9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,GAC/D,IAAI,CAAC,IAAI,aAAa,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAEjE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,aACF,IAAI,aAAa,IAAI,qBAAqB,YAAY,MAAM,GAAG,4BAA4B,CAAC;EAE9F,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EAC1D,OAAO,SAAS,SAAS,IAAI,MAAM,GAAG;CACxC;CAIA,OAAO,OAAO,aAAyC;EACrD,MAAM,SAAA,GAAQC,YAAAA,WAAAA,CAAW;EACzB,MAAM,WAAW,SAAS,KAAK;GAC7B;GACA,eAAe;GACf,YAAY;EACd,CAAC;EAGD,mBAAA,UAAU,UAAU,cAAc,OAAO;GACvC,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,KAAK,cAAc;EAC7B,CAAC;EACD,OAAO;CACT;CAEA,SAAS,OAAO,YAAwC;EACtD,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,IAAI,WAAW,MAAM,KAAK,WAAW,WAAW,SAAS;EACzD,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC;EAGjC,mBAAA,aAAa,UAAU,KAAK,YAAY,KAAK,aAAa;EAC1D,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,aAAgD;EAChF,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;EAElD,QAAQ,oBAAoB,KAAK,IAAI,CAAC;EACtC,MAAM,KAAK,WAAW,KAAK,OAAO;EAElC,MAAM,YAAY,KAAK,YAAY,OAAO;EAC1C,IAAI,WAAW,MAAM,WAAW,SAAS;EACzC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,OAAO;CAC9E;CAIA,uBAA+C;EAE7C,MAAM,iBAAA,GAAgBC,YAAAA,YAAAA,CAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EAM1D,OAAO;GAAE;GAAe,iBAAA,GALDC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,CAAC,CACR,SAAS,WAEyB;GAAG,uBAAuB;EAAO;CACxE;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;;;;;;CAOA,MAAc,aAAa,OAAe,UAAiC;EACzE,MAAM,MAAM,KAAK,kBAAkB,KAAK;EACxC,IAAK,MAAM,KAAK,GAAG,QAAQ,GAAG,MAAO,UAAU,MAAM,IAAIC,mBAAAA,oBAAoB,gBAAgB;EAC7F,MAAM,KAAK,GAAG,WAAW,GAAG;CAC9B;;;;;;;;CASA,MAAc,iBACZ,UACA,UACA,UACkB;EAClB,MAAM,EAAE,UAAU,SAAS;EAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;GACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;GACvC,OAAO;EACT;EACA,IAAI,YAAY,CAAC,KAAK,cAAc,IAAI,QAAQ,GAC9C,MAAM,IAAIA,mBAAAA,oBAAoB,eAAe;EAE/C,OAAO;CACT;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAaC,mBAAAA,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAaI,mBAAAA,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,uBACE,SACA,YAEA,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,aAAa,wBAAwB,SAAS,UAAU;EAC9D,MAAM,EAAE,MAAM,cAAcK,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,oBAAoB;EAC7D,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,OAAO,KAAK,qBAAqB;EAGvC,MAAM,SAAS,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG,OAAA,GAAMA,YAAAA,WAAAA,CAAW,IAAI,KAAA;EACpF,MAAM,MAAM,MAAM,KAAK,aAAa,uBAAuB;GAAE;GAAU;GAAO;GAAM;EAAM,CAAC;EAC3F,IAAI,UAAU,MAAM,KAAK,YAAY,OAAO;EAC5C,IAAI,CAAC,SAAS;GAGZ,UAAU,KAAK,WAAW,cAAc;GACxC,QAAQ,uBAAuB,oBAAoB;EACrD;EACA,KAAK,eAAe;EAEpB,MAAM,uBAAmD;GACvD;GACA;GACA,yBAAyB,IAAI;GAC7B,sBAAsB;GACtB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;GACzB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC;EACA,QAAQ,aACN,KAAK,mCACL,KAAK,UAAU,oBAAoB,CACrC;EACA,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,KAAK,cAAc;EAEnB,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C,CAAC;CAEH,kBAAkB,OAAO,SAAkB,YAAkD;EAC3F,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcK,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAG3D,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,mBAAmB,mBAAmB;EACzE,KAAK,cAAc;EACnB,MAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;EACxE,IAAI,CAAC,MAAM,OAAO,KAAK,SAAS,mBAAmB,iCAAiC;EACpF,MAAM,SAAqC,KAAK,MAAM,IAAI;EAG1D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,iBAAiB;EAC1D,MAAM,OAAO,WAAW,OAAO,IAC3B,OAAO,YAAY,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC,CAAC,IAC5DE,mBAAAA,MAAM,OAAO;EACjB,MAAM,SAASC,sBAAAA,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EAOrF,IAAI,OAAO,KAAK,OAAO;GACrB,IAAI,OAAO,KAAK,SAAS,OAAO,KAAK,UAAU,OAAO,OACpD,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;GAEnE,OAAO,KAAK,SACV,cAAc,OAAO,KAAK,OAAO,cAAc,GAC/C,OAAO,KAAK,iBACd;EACF;EACA,MAAM,EAAE,MAAM,OAAO,SAAS,OAAO;EACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EACrF,IAAI,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;EAC7F,IAAI,aAAa,OAAO,UACtB,OAAO,KAAK,SAAS,mBAAmB,4BAA4B;EAEtE,KAAK,kBAAkB;EAKvB,IAAI;EACJ,IAAI;GACF,MAAM,EAAE,UAAU,UAAU,MAAM,KAAK,aAAa,0BAA0B;IAC5E;IACA;IACA,MAAM,OAAO;GACf,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,aAAa,YAAY;IACnD;IACA;IACA;IACA,UAAU,OAAO,EAAE,KAAK,IAAI,KAAA;GAC9B,CAAC;GACD,KAAK,eAAe;GAIpB,IAAI,OAAO,SAAS,MAAM,UAAU;IAClC,MAAM,EAAE,UAAU,SAAS;IAC3B,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,MAAM,IAAIJ,mBAAAA,oBAAoB,eAAe;IACtF,IAAI,UAAU,OAAO,OAAO,MAAM,IAAIA,mBAAAA,oBAAoB,gBAAgB;IAC1E,KAAK,aAAa;GACpB;GAEA,MAAM,YAAY,MAAM,QAAQ,SAAS;IACvC;IACA;IACA;IACA;IACA,YAAY,OAAO,cAAc,CAAC;GACpC,CAAC;GACD,KAAK,gBAAgB;GAErB,WAAW,MAAM,KAAK,OAAO,WAAW,OAAO;GAC/C,MAAM,KAAK,WAAW,WAAW,QAAQ,MAAM,CAAC;GAChD,KAAK,gBAAgB;EACvB,SAAS,OAAO;GAGd,IAAI,iBAAiBK,qBAAAA,aAAa;IAChC,QAAQ,KAAK,0BAA0B,KAAK;IAC5C,MAAM,OAAO,qBAAqB,IAAI,MAAM,KAAK,IAAI,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,IAAI;GAC3B;GAGA,IAAI,iBAAiBL,mBAAAA,qBAAqB;IACxC,QAAQ,KAAK,0BAA0B,MAAM,QAAQ,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,iBAAiB,KAAA,GAAW,KAAK;GACxD;GACA,QAAQ,MAAM,0BAA0B,KAAK;GAC7C,OAAO,KAAK,SAAS,cAAc;EACrC;EAEA,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,UAAU;EAChD,IAAI,aAAa,IAAI,UAAU,SAAS;EACxC,IAAI,aAAa,IAAI,YAAY,QAAQ;EACzC,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,QAAQ;CAC5C;;CAGA,MAAc,UACZ,SACA,SACA,eACA,WACmB;EACnB,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa;EACtD,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,MAAM,WAAW,SAAS,KAAK,SAAS;EACxC,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;CAEA,qBAAqB,SAAkB,YACrC,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcE,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,mBAAmB;EAC5D,MAAM,OAAO,MAAMK,oBAAAA,SAAS,OAAO;EAEnC,MAAM,aAAaC,wBAAAA,eAAe,IAAI;EAEtC,MAAM,EAAE,YAAY,GAAG,GAAG,gBAAgB;EAC1C,MAAM,EAAE,kBAAkB;EAC1B,IACE,kBAAkB,KAAA,MACjB,OAAO,kBAAkB,YAAY,CAAC,qBAAqB,KAAK,aAAa,IAE9E,MAAMC,qBAAAA,gBACJ,yBACA,8DACF;EAEF,MAAM,EAAE,UAAU,UAAU,UAAU,MAAM,KAAK,aAAa,kBAAkB;GAC9E;GACA;EACF,CAAC;EACD,KAAK,qBAAqB;EAI1B,MAAM,YAAY,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG,UAAU,CAAC,CAAC,MAAM;EACpF,IAAI,MAAM,KAAK,iBAAiB,UAAU,UAAU,QAAQ,GAAG,KAAK,aAAa;EAEjF,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAEH,qBACE,SACA,SACA,WAAW,aAEX,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcN,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAI3D,MAAM,QADc,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAClC,SAAS,kBAAkB,IAChD,MAAMI,oBAAAA,SAAS,OAAO,IACtB,MAAMG,oBAAAA,SAAS,OAAO;EAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,GAAG,WAAWC,oBAAAA,MAAM,kBAAkB,IAAI;EAGnE,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,YAAY;GACrB,CAAC,CAAE,UAAU,OAAO,YAAa,MAAM,KAAK,aAAa,aAAa;IACpE;IACA,YAAY,OAAO;GACrB,CAAC;GACD,KAAK,mBAAmB;GAKxB,MAAM,YAAY,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG;GAClE,IAAI,MAAM,KAAK,iBAAiB,UAAU,UAAU,QAAQ,GAAG,KAAK,aAAa;EACnF,OAAO,IAAI,OAAO,MAAM;GACtB,CAAC,CAAE,UAAU,SAAU,MAAM,KAAK,aAAa,0BAA0B;IACvE;IACA,MAAM,OAAO;GACf,CAAC;GACD,WAAW,MAAM,KAAK,aAAa,YAAY;IAAE;IAAU;IAAU;GAAM,CAAC;EAC9E,OACE,MAAMF,qBAAAA,gBAAgB,oBAAoB,gCAAgC;EAG5E,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAIH,6BAA6B,SAAkB,WAC7C,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,oBAAoB,sCAAsC;EACzE,MAAM,EAAE,OAAO,mBAAmBE,oBAAAA,MAChCC,qBAAAA,iCACA,MAAML,oBAAAA,SAAS,OAAO,CACxB;EACA,MAAMM,oBAAAA,qBAAqB,KAAK,oBAAoB,cAAc;EAClE,MAAM,KAAK,WAAW,KAAK,OAAO,MAAM;EACxC,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB,CAAC;CAEH,mBAAmB,OAAe,qBAChC,KAAK,WAAW,OAAO,OAAO,gBAAgB;CAEhD,cAAc,SAAkB,YAC9B,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,cAAcV,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EACrD,MAAM,EACJ,OACA,kBACA,aAAa,CAAC,MACZQ,oBAAAA,MAAMG,qBAAAA,kBAAkB,MAAMP,oBAAAA,SAAS,OAAO,CAAC;EACnD,MAAM,KAAK,WAAW,OAAO,OAAO,gBAAgB;EACpD,MAAM,SAAyB;GAAE,KAAK;GAAO;GAAO,gBAAgB;EAAK;EACzE,OAAO,KAAK,UACV,SACA,SACA;GAAE,UAAU;GAAS,UAAU;IAAE;IAAQ,MAAM,CAAC;GAAE;GAAG;EAAW,GAChE,SACF;CACF,CAAC;;;;;;;;;;;;;;;;;CAoBH,oBAAoB,YAClB,KAAK,MAAM,YAAY;EACrB,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO;EACjD,IAAI,CAAC,WAAW,MAAMQ,qBAAAA,gBAAgB,eAAe;EACrD,MAAM,EAAE,mBAAmBJ,oBAAAA,MAAM,wBAAwB,MAAMJ,oBAAAA,SAAS,OAAO,CAAC;EAChF,MAAM,OAAO,MAAM,KAAK,aAAa,MAAM,WAAW,cAAc;EACpE,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;CAC/B,CAAC;;;;;;;;;;;;;;;;CAiBH,mBAAmB,YACjB,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,MAAM,kBAAkBI,oBAAAA,MAAM,uBAAuB,MAAMJ,oBAAAA,SAAS,OAAO,CAAC;EACpF,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO,MAAM,aAAa;EACpE,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,QAAQ,aAAa,eAAe,SAAS;EAC7C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,SAAS;GAC5D,UAAU;GACV,QAAQ;EACV,CAAC;CACH,CAAC;CAIH,OAAO,OAAO,cAAwC;EACpD,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,KAAK,MAAM,aAAa,SAAS,KAAK,GACpC,MAAM,KAAK,WAAW,WAAW,SAAS;CAE9C;;;;;;;;CASA,MAAc,MAAM,SAAkB;EACpC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,QAAQ,oBAAoB,IAAI,KAAK,eAAe;EAC9D,QAAQ,oBAAoB,GAAG;EAC/B,MAAM,KAAK,WAAW,KAAK,OAAO;CACpC;CAEA,eAAe,OAAO,YAAgD;EACpE,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;EACrD,IAAI,CAAC,WAAW,OAAO;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,OAAO;CACT;CAEA,kBAAkB,OAAO,YAAuC;EAC9D,OAAQ,MAAM,KAAK,aAAa,OAAO,MAAO;CAChD;CAEA,aAAa,OACX,SACA,WACuD;EAEvD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,WAAW,CAAC,QAAQ,OAAO;EAC/B,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;CAEA,gBAAgB,OAAO,cAAqC;EAC1D,MAAM,KAAK,WAAW,WAAW,SAAS;CAC5C;CAEA,eAAe,OAAO,cAA6C;EACjE,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;CACrC;CAEA,yBAAyB,OAAO,iBAA6C;EAC3E,MAAM,KAAK,WAAW,uBAAuB,YAAY;EACzD,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB;AACF"}
+{"version":3,"file":"index.cjs","names":["isKnownOAuth2ErrorType","attributesSize","MAX_ATTRIBUTES_BYTES","extend","googleOneTapSchema","attributesSchema","object","string","regex","literal","EmailVerificationCodes","DesktopCodes","OAuth2Client","getCookie","PRINCIPAL_NAME_INDEX_NAME","errorResponse","randomUUID","randomBytes","createHash","AuthenticationError","param","timing","query","oauth2RedirectQuerySchema","OAuth2Error","readJson","bodyAttributes","invalidArgument","readForm","parse","sendEmailVerificationCodeSchema","verifyTurnstileToken","loginEmailSchema","unauthenticated"],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomUUID } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { extend, literal, object, regex, string } from 'zod/mini';\nimport type { Principal } from '../core/index';\nimport { loginEmailSchema, sendEmailVerificationCodeSchema } from '../email/schema';\nimport { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2Error, type OAuth2ErrorType, isKnownOAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredential,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n  StandardClaims,\n} from '../oauth2/types';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport {\n  type CookieOptions,\n  deleteCookie,\n  getCookie,\n  param,\n  query,\n  setCookie,\n} from '../utils/http';\nimport { timing } from '../utils/timing';\nimport { parse, readForm, readJson, verifyTurnstileToken } from '../utils/valid';\nimport {\n  MAX_ATTRIBUTES_BYTES,\n  attributesSchema,\n  attributesSize,\n  bodyAttributes,\n} from './attributes';\nimport { DesktopCodes } from './desktop-codes';\nimport { type EmailSender, EmailVerificationCodes } from './email-codes';\nimport { AuthenticationError } from './error';\nimport { errorResponse, invalidArgument, unauthenticated } from './respond';\nimport type {\n  AuthConfig,\n  AuthService,\n  Authorization,\n  AuthorizedHandler,\n  LoggedHandler,\n  LogoutOptions,\n  OAuth2AuthorizationOptions,\n} from './types';\n\n// PKCE per RFC 7636: code_verifier / code_challenge are 43-128 chars from\n// the unreserved set. We restrict to base64url (drops \".\" and \"~\") since\n// that's what S256 produces and what callers should be sending; rejecting\n// the rest shrinks the accepted input shape without losing legit clients.\n// A 32-byte random verifier base64url-encodes to exactly 43 chars.\nconst PKCE_FORMAT = /^[A-Za-z0-9_-]{43,128}$/;\n\n// A native app's `code_verifier` goes on to the provider, which checks it against the challenge\n// the app sent: accept the whole RFC 7636 unreserved set here, as the provider does.\nconst CODE_VERIFIER_FORMAT = /^[A-Za-z0-9._~-]{43,128}$/;\n\n/** The header a session id travels in besides the cookie, with `session.header` on. */\nconst SESSION_HEADER = 'X-Auth-Token';\n\n/** Seconds an OAuth2 state or nonce may be used within. */\nconst OAUTH2_PARAMETER_TTL = 10 * 60;\n\n// error_description forwarded to errorUri comes from the provider or an error message: cap it so\n// the redirect URL stays short and an attacker-crafted callback cannot stuff the page with text.\nconst MAX_ERROR_DESCRIPTION_LENGTH = 256;\n\n/** An error code safe to put on errorUri: a registered one as is, anything else as `fallback`. */\nfunction safeErrorType(error: string, fallback: OAuth2ErrorType): OAuth2ErrorType {\n  return isKnownOAuth2ErrorType(error) ? error : fallback;\n}\n\n/**\n * The codes a failure past validation keeps on errorUri, each one the user can act on: the code\n * expired or was used (start again), they declined, or the provider is briefly down. Every other\n * failure there (a rejected client, a user info request that failed) is the app's or the\n * provider's problem, which the user sees as `server_error`.\n */\nconst CALLBACK_ERROR_TYPES: ReadonlySet<OAuth2ErrorType> = new Set([\n  'invalid_grant',\n  'access_denied',\n  'temporarily_unavailable',\n]);\n\nfunction authorizationAttributes(\n  attributes: OAuth2AuthorizationOptions['attributes']\n): Record<string, string> | undefined {\n  if (!attributes) return undefined;\n  const defined: Record<string, string> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    if (value !== undefined) defined[key] = value;\n  }\n  if (Object.keys(defined).length === 0) return undefined;\n  // The host's own values, written with the session: oversized is a bug in the host, not a 400.\n  const size = attributesSize(defined);\n  invariant(\n    size <= MAX_ATTRIBUTES_BYTES,\n    `oauth2 authorization attributes are ${size} bytes, at most ${MAX_ATTRIBUTES_BYTES} allowed`\n  );\n  return defined;\n}\n\n/** Sign in with Apple answers with `response_mode=form_post`; a charset parameter may follow. */\nfunction isFormPost(request: Request) {\n  const contentType = request.headers.get('content-type')?.toLowerCase();\n  return (\n    request.method === 'POST' && !!contentType?.startsWith('application/x-www-form-urlencoded')\n  );\n}\n\n/** Google's own form post carries no attributes; an app posting JSON may add them. */\nconst oneTapBodySchema = extend(googleOneTapSchema, { attributes: attributesSchema });\n\nconst desktopAuthorizeSchema = object({\n  code_challenge: string().check(regex(PKCE_FORMAT)),\n  code_challenge_method: literal('S256'),\n});\n\nconst desktopExchangeSchema = object({\n  code: string(),\n  code_verifier: string().check(regex(PKCE_FORMAT)),\n});\n\nexport const PATH = {\n  CSRF: '/csrf',\n  LOGOUT: '/logout',\n  LOGGED: '/logged',\n\n  OAUTH2_STATE: '/oauth2/state/:provider',\n  OAUTH2_NONCE: '/oauth2/nonce/:provider',\n  OAUTH2_AUTHORIZATION: '/oauth2/authorization/:provider',\n  LOGIN_OAUTH2_CODE: '/login/oauth2/code/:provider',\n  LOGIN_OAUTH2_NATIVE: '/login/oauth2/native/:provider',\n  LOGIN_OAUTH2_ONETAP: '/login/oauth2/onetap/google',\n\n  LOGIN_EMAIL: '/login/email',\n  SEND_EMAIL_VERIFICATION_CODE: '/auth/sendEmailVerificationCode',\n\n  // Desktop / native app sign-in via web loopback (RFC 8252 + OAuth 2.1 Auth Code Flow):\n  //   1. user already authenticated with cookie session → POST DESKTOP_AUTHORIZE → { code }\n  //   2. web redirects to desktop's loopback callback with the code\n  //   3. desktop renderer POSTs DESKTOP_EXCHANGE with the code → server returns\n  //      Set-Cookie carrying a fresh session, single-use code is invalidated\n  // The two-step flow keeps the actual session id off the redirect URL — only a\n  // 5-minute single-use code transits via the loopback.\n  DESKTOP_AUTHORIZE: '/auth/desktop/authorize',\n  DESKTOP_EXCHANGE: '/auth/desktop/exchange',\n\n  CLEANUP_EXPIRED_SESSIONS: '/sessions/expired/cleanup',\n} as const;\n\n/**\n * The login routes and session helpers. Every route is one straight line: read and validate the\n * request, check the credential, call the host's `onAuthorized`, sign in. Failures are thrown and\n * answered in one place per kind of route: a JSON route runs under `guard`, which maps a\n * `RequestError`, an `AuthenticationError` or an `OAuth2Error` to its google.rpc body (see\n * `respond.ts`); the redirect callback maps the same errors to `errorUri` parameters (`redirect`).\n */\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n  private readonly turnstileSecretKey?: string;\n  private readonly emailCodes: EmailVerificationCodes;\n  private readonly desktopCodes: DesktopCodes;\n  private readonly oauth2Client: OAuth2Client | null;\n  /** Provider keys whose logins may come without a nonce (`oauth2.nonce.optional`). */\n  private readonly nonceOptional: ReadonlySet<string>;\n  private readonly touchInterval: number;\n  private readonly sessionHeader: boolean;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({\n    sessionRepository,\n    kvRepository,\n    turnstileSecretKey,\n    verificationCode,\n    oauth2,\n    cookie,\n    session,\n    timing,\n  }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    this.turnstileSecretKey = turnstileSecretKey;\n    const maxAttempts = verificationCode?.maxAttempts ?? 5;\n    const resendCooldown = verificationCode?.resendCooldown ?? 60;\n    invariant(maxAttempts >= 1, 'verificationCode.maxAttempts must be at least 1');\n    invariant(resendCooldown >= 1, 'verificationCode.resendCooldown must be at least 1 second');\n    this.emailCodes = new EmailVerificationCodes(kvRepository, { maxAttempts, resendCooldown });\n    this.desktopCodes = new DesktopCodes(kvRepository);\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n    this.nonceOptional = new Set(oauth2?.nonce?.optional);\n    this.touchInterval = (session?.touchInterval ?? 3600) * 1000;\n    this.sessionHeader = session?.header ?? false;\n    invariant(this.touchInterval >= 0, 'session.touchInterval must not be negative');\n  }\n\n  // ---- sessions and responses ------------------------------------------------------------------\n\n  private getSessionId(request: Request): string | undefined {\n    const fromCookie = getCookie(request, this.cookieName);\n    if (fromCookie) return fromCookie;\n    return (this.sessionHeader && request.headers.get(SESSION_HEADER)) || undefined;\n  }\n\n  /** The session the request carries, if it exists. */\n  private async loadSession(request: Request): Promise<Session | null> {\n    const sessionId = this.getSessionId(request);\n    return sessionId ? this.repository.findById(sessionId) : null;\n  }\n\n  /** The signed-in principal of a session, if any. */\n  private principalOf(session: Session): Principal | null {\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    return name ? { name: String(name) } : null;\n  }\n\n  /**\n   * A new session signed in as `principal`. With `carryOver`, what the host kept in the pre-login\n   * session moves to the new one; the authorization request (state, PKCE verifier, flow\n   * attributes) is single-use and was consumed, and a principal left there from an earlier\n   * sign-in is replaced. The new id is never the one the browser brought, which may have been\n   * planted by an attacker who started the flow (session fixation).\n   */\n  private async signIn(principal: Principal, carryOver?: Session): Promise<Session> {\n    const session = this.repository.createSession();\n    for (const attribute of carryOver?.getAttributeNames() ?? []) {\n      if (attribute === this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) continue;\n      if (attribute === PRINCIPAL_NAME_INDEX_NAME) continue;\n      const value = carryOver?.getAttribute(attribute);\n      if (value !== null && value !== undefined) session.setAttribute(attribute, value);\n    }\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    return session;\n  }\n\n  /**\n   * `response` carrying `session`: its cookie, renewed for the whole inactive interval, and with\n   * `session.header` on, the `X-Auth-Token` header a client without a cookie jar reads.\n   */\n  private withSession(response: Response, session: Session, cookie?: CookieOptions): Response {\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), {\n      ...this.cookieOptions,\n      ...cookie,\n      maxAge,\n    });\n    if (this.sessionHeader) response.headers.set(SESSION_HEADER, session.getId());\n    return response;\n  }\n\n  /** Runs a JSON route: a failure it knows is its response, anything else is the host's. */\n  private async guard(run: () => Promise<Response>): Promise<Response> {\n    try {\n      return await run();\n    } catch (error) {\n      const response = errorResponse(error);\n      if (response) return response;\n      throw error;\n    }\n  }\n\n  /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */\n  private redirect(\n    error: OAuth2ErrorType,\n    description?: string,\n    refusal?: AuthenticationError\n  ): Response {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    // Metadata never replaces a parameter: not one errorUri carries itself, nor one set below.\n    for (const [key, value] of Object.entries(refusal?.metadata ?? {})) {\n      if (!uri.searchParams.has(key)) uri.searchParams.set(key, value);\n    }\n    uri.searchParams.set('error', error);\n    if (description) {\n      uri.searchParams.set('error_description', description.slice(0, MAX_ERROR_DESCRIPTION_LENGTH));\n    }\n    if (refusal) uri.searchParams.set('reason', refusal.reason);\n    return Response.redirect(uri.href, 302);\n  }\n\n  // ---- basic -----------------------------------------------------------------------------------\n\n  csrf = async (_request: Request): Promise<Response> => {\n    const token = randomUUID();\n    const response = Response.json({\n      token,\n      parameterName: '_csrf',\n      headerName: 'X-XSRF-TOKEN',\n    });\n\n    // Double Submit Cookie Protection\n    setCookie(response, 'XSRF-TOKEN', token, {\n      path: '/',\n      secure: true,\n      httpOnly: false,\n      sameSite: 'none',\n      domain: this.cookieOptions.domain,\n    });\n    return response;\n  };\n\n  logout = async (request: Request, options?: LogoutOptions): Promise<Response> => {\n    const scope = options?.scope ?? 'local';\n    const sessionId = this.getSessionId(request);\n    // `global` and `others` reach the principal's other sessions through the one the request\n    // carries; a request without a signed-in session has no principal to widen to, and ends as\n    // `local` would.\n    if (scope !== 'local' && sessionId) {\n      const session = await this.repository.findById(sessionId);\n      const principal = session && this.principalOf(session);\n      if (principal) {\n        const sessions = await this.repository.findByPrincipalName(principal.name);\n        for (const id of sessions.keys()) {\n          if (id !== sessionId) await this.repository.deleteById(id);\n        }\n      }\n    }\n    const response = Response.json({});\n    if (scope === 'others') return response;\n    if (sessionId) await this.repository.deleteById(sessionId);\n    // A Set-Cookie only replaces the stored cookie when Domain and Path match (RFC 6265),\n    // so clear it with the same attributes it was set with.\n    deleteCookie(response, this.cookieName, this.cookieOptions);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    const session = await this.loadSession(request);\n    if (!session) return Response.json({ data: false });\n\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    const principal = this.principalOf(session);\n    if (principal) await onLogged?.(principal);\n    return this.withSession(Response.json({ data: principal !== null }), session);\n  };\n\n  // ---- oauth2 ----------------------------------------------------------------------------------\n\n  private createPkceParameters(): PkceParameters {\n    // 32 random bytes: a 43-char base64url verifier, the RFC 7636 minimum (a UUID is 36).\n    const code_verifier = randomBytes(32).toString('base64url');\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  /**\n   * Spends a nonce `oauth2Nonce` issued for `provider`: `NONCE_MISMATCH` for one that was not,\n   * or was used already. An id token is replayable until it expires; the nonce it carries makes\n   * it sign in once.\n   */\n  private async consumeNonce(nonce: string, provider: string): Promise<void> {\n    const key = this.getOauth2NonceKey(nonce);\n    if ((await this.kv.getItem(key)) !== provider) throw new AuthenticationError('NONCE_MISMATCH');\n    await this.kv.removeItem(key);\n  }\n\n  /**\n   * The nonce check of the JSON logins (One Tap, native), where the client obtained the id token\n   * and the nonce came from `oauth2Nonce`: spends the one the token carries, and refuses a token\n   * without one when the provider's flow echoes nonces (`required`) and the host has not listed the\n   * provider as optional. An id token is replayable until it expires; the nonce makes it sign in\n   * once.\n   */\n  private async checkIssuedNonce(\n    userInfo: Authorization['userInfo'],\n    provider: string,\n    required: boolean\n  ): Promise<boolean> {\n    const { nonce } = userInfo.data as { nonce?: unknown };\n    if (typeof nonce === 'string' && nonce) {\n      await this.consumeNonce(nonce, provider);\n      return true;\n    }\n    if (required && !this.nonceOptional.has(provider)) {\n      throw new AuthenticationError('NONCE_MISSING');\n    }\n    return false;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = (\n    request: Request,\n    options?: OAuth2AuthorizationOptions\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const attributes = authorizationAttributes(options?.attributes);\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.OAUTH2_AUTHORIZATION);\n      const state = randomUUID();\n      const pkce = this.createPkceParameters();\n      // Sent only to a provider whose id token echoes it: the callback then requires it back, so\n      // a code that was swapped in for another sign-in's yields a token the session refuses.\n      const nonce = (await this.oauth2Client.nonceSupport(provider)).web ? randomUUID() : undefined;\n      const uri = await this.oauth2Client.createAuthorizationUri({ provider, state, pkce, nonce });\n      let session = await this.loadSession(request);\n      if (!session) {\n        // A session made for the flow only has to outlive the state: an abandoned flow must not\n        // keep a row for the default interval. Sign-in moves to a new session, with the default.\n        session = this.repository.createSession();\n        session.setMaxInactiveInterval(OAUTH2_PARAMETER_TTL);\n      }\n      mark('fetch_session');\n\n      const authorizationRequest: OAuth2AuthorizationRequest = {\n        state,\n        provider,\n        authorizationRequestUri: uri.href,\n        additionalParameters: pkce,\n        ...(nonce ? { nonce } : {}),\n        ...(attributes ? { attributes } : {}),\n      };\n      session.setAttribute(\n        this.ATTR_OAUTH2_AUTHORIZATION_REQUEST,\n        JSON.stringify(authorizationRequest)\n      );\n      await this.repository.save(session);\n      mark('save_session');\n\n      const response = new Response(null, { status: 302, headers: { location: uri.href } });\n      setTiming(response);\n      return this.withSession(response, session);\n    });\n\n  loginOAuth2Code = async (request: Request, handler: AuthorizedHandler): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. the session the flow started on, and the authorization request it stored\n    const session = await this.loadSession(request);\n    if (!session) return this.redirect('invalid_request', 'session not found');\n    mark('load_session');\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) return this.redirect('invalid_request', 'authorization request not found');\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 2. the provider's answer: query, or a form for Apple's response_mode=form_post\n    const { provider } = param(request, PATH.LOGIN_OAUTH2_CODE);\n    const data = isFormPost(request)\n      ? Object.fromEntries(new URLSearchParams(await request.text()))\n      : query(request);\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) return this.redirect('invalid_request', 'invalid redirect query');\n    // The provider answered with an error instead of a code (the user pressed Cancel →\n    // access_denied, invalid_scope, server_error, ...). Forward it rather than reporting a\n    // malformed query. This runs before the state check on purpose: providers echo state on\n    // error responses, but not all reliably do, and a forged error callback can only make the\n    // victim's popup show an error — nothing is exchanged or signed in. A present state that does\n    // not match still wins, since that is the more accurate (and more alarming) diagnosis.\n    if (parsed.data.error) {\n      if (parsed.data.state && parsed.data.state !== cached.state) {\n        return this.redirect('invalid_request', 'redirect state mismatch');\n      }\n      return this.redirect(\n        safeErrorType(parsed.data.error, 'server_error'),\n        parsed.data.error_description\n      );\n    }\n    const { code, state, user } = parsed.data;\n    if (!code || !state) return this.redirect('invalid_request', 'invalid redirect query');\n    if (state !== cached.state) return this.redirect('invalid_request', 'redirect state mismatch');\n    if (provider !== cached.provider) {\n      return this.redirect('invalid_request', 'redirect provider mismatch');\n    }\n    mark('validate_session');\n\n    // 3. exchange the code, load the user, sign in. Everything here can fail (an expired or reused\n    // code, a network error, the host's handler or session store). The callback runs in a popup\n    // the user is looking at, so every failure must land on errorUri, never as a JSON error.\n    let signedIn: Session;\n    try {\n      const { clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n        provider,\n        code,\n        pkce: cached.additionalParameters,\n      });\n      // Apple posts the user's name alongside the code, once: hand it to the provider with the token.\n      const userInfo = await this.oauth2Client.getUserInfo({\n        provider,\n        clientId,\n        token,\n        response: user ? { user } : undefined,\n      });\n      mark('exchange_code');\n      // The id token must carry the nonce this flow sent (stored with the state, not in KV: it\n      // is bound to this session's request). A provider that gave no id token has nothing to\n      // carry it, as has a request stored before nonces were sent.\n      if (cached.nonce && token.id_token) {\n        const { nonce } = userInfo.data as { nonce?: unknown };\n        if (typeof nonce !== 'string' || !nonce) throw new AuthenticationError('NONCE_MISSING');\n        if (nonce !== cached.nonce) throw new AuthenticationError('NONCE_MISMATCH');\n        mark('check_nonce');\n      }\n\n      const principal = await handler(request, {\n        provider,\n        clientId,\n        userInfo,\n        token,\n        attributes: cached.attributes ?? {},\n      });\n      mark('save_principal');\n\n      signedIn = await this.signIn(principal, session);\n      await this.repository.deleteById(session.getId());\n      mark('update_session');\n    } catch (error) {\n      // The details stay in the logs: an OAuth2Error message can carry a client id or a\n      // provider's response, which has no place in a URL the browser keeps in its history.\n      if (error instanceof OAuth2Error) {\n        console.warn('OAuth2 callback failed', error);\n        const type = CALLBACK_ERROR_TYPES.has(error.error) ? error.error : 'server_error';\n        return this.redirect(type);\n      }\n      // A refusal is something the user can act on, so its reason and metadata reach the page,\n      // as they reach a JSON client through the ErrorInfo.\n      if (error instanceof AuthenticationError) {\n        console.warn('OAuth2 sign-in refused', error.reason, error.metadata);\n        return this.redirect('access_denied', undefined, error);\n      }\n      console.error('OAuth2 callback failed', error);\n      return this.redirect('server_error');\n    }\n\n    const uri = new URL(this.oauth2Client.successUri);\n    uri.searchParams.set('status', 'success');\n    uri.searchParams.set('provider', provider);\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    setTiming(response);\n    return this.withSession(response, signedIn);\n  };\n\n  /** The shared tail of the JSON login routes: the host's handler, then a signed-in session. */\n  private async authorize(\n    request: Request,\n    handler: AuthorizedHandler,\n    authorization: Authorization,\n    setTiming: (response: Response) => void\n  ): Promise<Response> {\n    const principal = await handler(request, authorization);\n    const session = await this.signIn(principal);\n    const response = Response.json(principal);\n    setTiming(response);\n    return this.withSession(response, session);\n  }\n\n  loginOAuth2Native = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.LOGIN_OAUTH2_NATIVE);\n      const body = await readJson(request);\n      // Whatever the app sends besides its credentials for `onAuthorized` (a referral code, ...).\n      const attributes = bodyAttributes(body);\n      // Only the credentials go on to the provider client.\n      const { attributes: _, ...credentials } = body as NativeCredential & { attributes?: unknown };\n      const { code_verifier } = credentials as { code_verifier?: unknown };\n      if (\n        code_verifier !== undefined &&\n        (typeof code_verifier !== 'string' || !CODE_VERIFIER_FORMAT.test(code_verifier))\n      ) {\n        throw invalidArgument(\n          'INVALID_CODE_VERIFIER',\n          'code_verifier must be 43-128 characters from [A-Za-z0-9-._~]'\n        );\n      }\n      const { clientId, userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n        provider,\n        credentials,\n      });\n      mark('login_oauth2_native');\n\n      // Required when the provider's native id token echoes a nonce and the login produced one\n      // (Facebook's access_token login has none to carry it).\n      const required = (await this.oauth2Client.nonceSupport(provider)).native && !!token.id_token;\n      if (await this.checkIssuedNonce(userInfo, provider, required)) mark('check_nonce');\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  loginOAuth2Onetap = (\n    request: Request,\n    handler: AuthorizedHandler,\n    provider = 'google'\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n\n      // Google's own form post, or an app's JSON.\n      const contentType = request.headers.get('content-type') ?? '';\n      const body = contentType.includes('application/json')\n        ? await readJson(request)\n        : await readForm(request);\n      const { attributes = {}, ...parsed } = parse(oneTapBodySchema, body);\n\n      // Both the credential and the code are issued to the provider's web client.\n      let clientId: string;\n      let token: Authorization['token'];\n      let userInfo: Authorization['userInfo'];\n      if (parsed.credential) {\n        ({ clientId, token, userInfo } = await this.oauth2Client.getTokenInfo({\n          provider,\n          credential: parsed.credential,\n        }));\n        mark('verify_credential');\n\n        // The credential must carry a single-use nonce from `oauth2Nonce`, which the front end\n        // passed to `prompt`. This replaces Google's `g_csrf_token` double-submit cookie, which\n        // FedCM mode no longer sets.\n        const required = (await this.oauth2Client.nonceSupport(provider)).web;\n        if (await this.checkIssuedNonce(userInfo, provider, required)) mark('check_nonce');\n      } else if (parsed.code) {\n        ({ clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n          provider,\n          code: parsed.code,\n        }));\n        userInfo = await this.oauth2Client.getUserInfo({ provider, clientId, token });\n      } else {\n        throw invalidArgument('INVALID_ARGUMENT', 'credential or code is required');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  // ---- email -----------------------------------------------------------------------------------\n\n  sendEmailVerificationCode = (request: Request, sender: EmailSender): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.turnstileSecretKey, 'turnstileSecretKey is not configured');\n      const { email, turnstileToken } = parse(\n        sendEmailVerificationCodeSchema,\n        await readJson(request)\n      );\n      await verifyTurnstileToken(this.turnstileSecretKey, turnstileToken);\n      await this.emailCodes.send(email, sender);\n      return Response.json({});\n    });\n\n  verifyEmailCode = (email: string, verificationCode: string): Promise<void> =>\n    this.emailCodes.verify(email, verificationCode);\n\n  loginEmail = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      const { setTiming } = timing({ enabled: this.timing });\n      const {\n        email,\n        verificationCode,\n        attributes = {},\n      } = parse(loginEmailSchema, await readJson(request));\n      await this.emailCodes.verify(email, verificationCode);\n      const claims: StandardClaims = { sub: email, email, email_verified: true };\n      return this.authorize(\n        request,\n        handler,\n        { provider: 'EMAIL', userInfo: { claims, data: {} }, attributes },\n        setTiming\n      );\n    });\n\n  // ---- desktop ---------------------------------------------------------------------------------\n\n  /**\n   * Step 1 of the desktop / native app sign-in handshake. The caller already completed normal\n   * sign-in on the web (so a cookie session exists); this issues a 5-minute single-use code that\n   * the web page hands off to the desktop client via a loopback redirect.\n   *\n   * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier` before opening the\n   * browser, derives `code_challenge = base64url(sha256(verifier))`, and threads the challenge\n   * through the URL → web page → here. The challenge is pinned to the code; `desktopExchange`\n   * enforces that the caller knows the matching verifier. This blocks an attacker who only\n   * intercepts the auth code (browser history, malicious extension, packet capture on loopback)\n   * from exchanging it.\n   *\n   * Requires an authenticated cookie session: anonymous callers get 401. Throttling / abuse\n   * protection on this endpoint is the API layer's job (rate-limit per principal); the SDK does\n   * not gate it because the upstream sign-in flow already passed CAPTCHA / OAuth / verification.\n   */\n  desktopAuthorize = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const principal = await this.getPrincipal(request);\n      if (!principal) throw unauthenticated('Sign in first');\n      const { code_challenge } = parse(desktopAuthorizeSchema, await readJson(request));\n      const code = await this.desktopCodes.issue(principal, code_challenge);\n      return Response.json({ code });\n    });\n\n  /**\n   * Step 2 of the desktop / native app sign-in handshake. The desktop client hands back the auth\n   * code it received via the loopback callback, and we mint a fresh session for it, independent\n   * of the web cookie session that originally authorized the code, so logging out on either side\n   * does not cascade to the other.\n   *\n   * Cookie attributes: `SameSite=None; Secure` so the cookie survives cross-site fetches from the\n   * desktop renderer's `file://` / `app://` origin. The configured `cookieOptions` provide\n   * everything else (`domain`, `path`, `httpOnly`); the override is targeted at the\n   * SameSite/Secure pair only. In a non-HTTPS dev backend this combination is rejected by\n   * Chromium, see the desktop sign-in PRD for workarounds.\n   *\n   * No CSRF check needed: the request carries no cookie, the auth code itself is the credential,\n   * and the code's single-use removal blocks replay.\n   */\n  desktopExchange = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const { code, code_verifier } = parse(desktopExchangeSchema, await readJson(request));\n      const principal = await this.desktopCodes.redeem(code, code_verifier);\n      const session = await this.signIn(principal);\n      session.setAttribute('client_type', 'desktop');\n      await this.repository.save(session);\n      return this.withSession(Response.json({ ok: true }), session, {\n        sameSite: 'none',\n        secure: true,\n      });\n    });\n\n  // ---- session management ----------------------------------------------------------------------\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  /**\n   * Sliding expiration: an authenticated request renews the session, as `logged` does, so a user\n   * who keeps using the app is never signed out after `maxInactiveInterval` of not calling one\n   * particular endpoint. No extra read: the session was just loaded to authenticate, and its\n   * `lastAccessedTime` is compared in memory; writes are spaced by `session.touchInterval` (see\n   * `AuthConfig`), so a session accessed again within the interval is not rewritten.\n   */\n  private async touch(session: Session) {\n    const now = Date.now();\n    if (now - session.getLastAccessedTime() < this.touchInterval) return;\n    session.setLastAccessedTime(now);\n    await this.repository.save(session);\n  }\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const session = await this.loadSession(request);\n    const principal = session && this.principalOf(session);\n    if (!principal) return null;\n    await this.touch(session);\n    return principal;\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    return (await this.getPrincipal(request)) !== null;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    type Result = T extends true ? Session : Session | null;\n    const session = await this.loadSession(request);\n    if (session || !create) return session as Result;\n    const created = this.repository.createSession();\n    await this.repository.save(created);\n    return created;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAkDA,MAAM,cAAc;AAIpB,MAAM,uBAAuB;;AAG7B,MAAM,iBAAiB;;AAGvB,MAAM,uBAAuB;AAI7B,MAAM,+BAA+B;;AAGrC,SAAS,cAAc,OAAe,UAA4C;CAChF,OAAOA,qBAAAA,uBAAuB,KAAK,IAAI,QAAQ;AACjD;;;;;;;AAQA,MAAM,uCAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;AAED,SAAS,wBACP,YACoC;CACpC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAE1C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAE9C,MAAM,OAAOC,wBAAAA,eAAe,OAAO;CACnC,CAAA,GAAA,cAAA,UAAA,CACE,QAAQC,wBAAAA,sBACR,uCAAuC,KAAK,kBAAkBA,wBAAAA,qBAAqB,SACrF;CACA,OAAO;AACT;;AAGA,SAAS,WAAW,SAAkB;CACpC,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY;CACrE,OACE,QAAQ,WAAW,UAAU,CAAC,CAAC,aAAa,WAAW,mCAAmC;AAE9F;;AAGA,MAAM,oBAAA,GAAmBC,SAAAA,OAAAA,CAAOC,sBAAAA,oBAAoB,EAAE,YAAYC,wBAAAA,iBAAiB,CAAC;AAEpF,MAAM,0BAAA,GAAyBC,SAAAA,OAAAA,CAAO;CACpC,iBAAA,GAAgBC,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,MAAAA,CAAM,WAAW,CAAC;CACjD,wBAAA,GAAuBC,SAAAA,QAAAA,CAAQ,MAAM;AACvC,CAAC;AAED,MAAM,yBAAA,GAAwBH,SAAAA,OAAAA,CAAO;CACnC,OAAA,GAAMC,SAAAA,OAAAA,CAAO;CACb,gBAAA,GAAeA,SAAAA,OAAAA,CAAO,CAAC,CAAC,OAAA,GAAMC,SAAAA,MAAAA,CAAM,WAAW,CAAC;AAClD,CAAC;AAED,MAAa,OAAO;CAClB,MAAM;CACN,QAAQ;CACR,QAAQ;CAER,cAAc;CACd,cAAc;CACd,sBAAsB;CACtB,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CAErB,aAAa;CACb,8BAA8B;CAS9B,mBAAmB;CACnB,kBAAkB;CAElB,0BAA0B;AAC5B;;;;;;;;AASA,IAAa,OAAb,MAAyC;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;CAEA;CACA;CACA;CACA,oCAAqD;CAErD,YAAY,EACV,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACa;EACb,KAAK,SAAS,UAAU;EACxB,KAAK,KAAK;EACV,KAAK,aAAa;EAClB,KAAK,qBAAqB;EAC1B,MAAM,cAAc,kBAAkB,eAAe;EACrD,MAAM,iBAAiB,kBAAkB,kBAAkB;EAC3D,CAAA,GAAA,cAAA,UAAA,CAAU,eAAe,GAAG,iDAAiD;EAC7E,CAAA,GAAA,cAAA,UAAA,CAAU,kBAAkB,GAAG,2DAA2D;EAC1F,KAAK,aAAa,IAAIE,yBAAAA,uBAAuB,cAAc;GAAE;GAAa;EAAe,CAAC;EAC1F,KAAK,eAAe,IAAIC,2BAAAA,aAAa,YAAY;EACjD,MAAM,EAAE,MAAM,GAAG,kBAAkB,UAAU,CAAC;EAC9C,KAAK,aAAa,QAAQ;EAC1B,KAAK,gBAAgB;GACnB,MAAM;GACN,UAAU;GACV,QAAQ;GACR,UAAU;GACV,GAAG;EACL;EACA,KAAK,eAAe,QAAQ,SAAS,IAAIC,sBAAAA,aAAa,OAAO,MAAM,IAAI;EACvE,KAAK,gBAAgB,IAAI,IAAI,QAAQ,OAAO,QAAQ;EACpD,KAAK,iBAAiB,SAAS,iBAAiB,QAAQ;EACxD,KAAK,gBAAgB,SAAS,UAAU;EACxC,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,iBAAiB,GAAG,4CAA4C;CACjF;CAIA,aAAqB,SAAsC;EACzD,MAAM,aAAaC,mBAAAA,UAAU,SAAS,KAAK,UAAU;EACrD,IAAI,YAAY,OAAO;EACvB,OAAQ,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,cAAc,KAAM,KAAA;CACxE;;CAGA,MAAc,YAAY,SAA2C;EACnE,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,OAAO,YAAY,KAAK,WAAW,SAAS,SAAS,IAAI;CAC3D;;CAGA,YAAoB,SAAoC;EACtD,MAAM,OAAO,QAAQ,aAAaC,uBAAAA,yBAAyB;EAC3D,OAAO,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI;CACzC;;;;;;;;CASA,MAAc,OAAO,WAAsB,WAAuC;EAChF,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,KAAK,MAAM,aAAa,WAAW,kBAAkB,KAAK,CAAC,GAAG;GAC5D,IAAI,cAAc,KAAK,mCAAmC;GAC1D,IAAI,cAAA,iBAAyC;GAC7C,MAAM,QAAQ,WAAW,aAAa,SAAS;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,QAAQ,aAAa,WAAW,KAAK;EAClF;EACA,QAAQ,aAAaA,uBAAAA,2BAA2B,UAAU,IAAI;EAC9D,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;;;;;CAMA,YAAoB,UAAoB,SAAkB,QAAkC;EAC1F,MAAM,SAAS,QAAQ,uBAAuB;EAC9C,mBAAA,UAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG;GACpD,GAAG,KAAK;GACR,GAAG;GACH;EACF,CAAC;EACD,IAAI,KAAK,eAAe,SAAS,QAAQ,IAAI,gBAAgB,QAAQ,MAAM,CAAC;EAC5E,OAAO;CACT;;CAGA,MAAc,MAAM,KAAiD;EACnE,IAAI;GACF,OAAO,MAAM,IAAI;EACnB,SAAS,OAAO;GACd,MAAM,WAAWC,qBAAAA,cAAc,KAAK;GACpC,IAAI,UAAU,OAAO;GACrB,MAAM;EACR;CACF;;CAGA,SACE,OACA,aACA,SACU;EACV,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;EAE9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,GAC/D,IAAI,CAAC,IAAI,aAAa,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAEjE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,aACF,IAAI,aAAa,IAAI,qBAAqB,YAAY,MAAM,GAAG,4BAA4B,CAAC;EAE9F,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EAC1D,OAAO,SAAS,SAAS,IAAI,MAAM,GAAG;CACxC;CAIA,OAAO,OAAO,aAAyC;EACrD,MAAM,SAAA,GAAQC,YAAAA,WAAAA,CAAW;EACzB,MAAM,WAAW,SAAS,KAAK;GAC7B;GACA,eAAe;GACf,YAAY;EACd,CAAC;EAGD,mBAAA,UAAU,UAAU,cAAc,OAAO;GACvC,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,KAAK,cAAc;EAC7B,CAAC;EACD,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,YAA+C;EAC/E,MAAM,QAAQ,SAAS,SAAS;EAChC,MAAM,YAAY,KAAK,aAAa,OAAO;EAI3C,IAAI,UAAU,WAAW,WAAW;GAClC,MAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;GACxD,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;GACrD,IAAI,WAAW;IACb,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;IACzE,KAAK,MAAM,MAAM,SAAS,KAAK,GAC7B,IAAI,OAAO,WAAW,MAAM,KAAK,WAAW,WAAW,EAAE;GAE7D;EACF;EACA,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC;EACjC,IAAI,UAAU,UAAU,OAAO;EAC/B,IAAI,WAAW,MAAM,KAAK,WAAW,WAAW,SAAS;EAGzD,mBAAA,aAAa,UAAU,KAAK,YAAY,KAAK,aAAa;EAC1D,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,aAAgD;EAChF,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;EAElD,QAAQ,oBAAoB,KAAK,IAAI,CAAC;EACtC,MAAM,KAAK,WAAW,KAAK,OAAO;EAElC,MAAM,YAAY,KAAK,YAAY,OAAO;EAC1C,IAAI,WAAW,MAAM,WAAW,SAAS;EACzC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,OAAO;CAC9E;CAIA,uBAA+C;EAE7C,MAAM,iBAAA,GAAgBC,YAAAA,YAAAA,CAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EAM1D,OAAO;GAAE;GAAe,iBAAA,GALDC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,CAAC,CACR,SAAS,WAEyB;GAAG,uBAAuB;EAAO;CACxE;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;;;;;;CAOA,MAAc,aAAa,OAAe,UAAiC;EACzE,MAAM,MAAM,KAAK,kBAAkB,KAAK;EACxC,IAAK,MAAM,KAAK,GAAG,QAAQ,GAAG,MAAO,UAAU,MAAM,IAAIC,mBAAAA,oBAAoB,gBAAgB;EAC7F,MAAM,KAAK,GAAG,WAAW,GAAG;CAC9B;;;;;;;;CASA,MAAc,iBACZ,UACA,UACA,UACkB;EAClB,MAAM,EAAE,UAAU,SAAS;EAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;GACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;GACvC,OAAO;EACT;EACA,IAAI,YAAY,CAAC,KAAK,cAAc,IAAI,QAAQ,GAC9C,MAAM,IAAIA,mBAAAA,oBAAoB,eAAe;EAE/C,OAAO;CACT;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAaC,mBAAAA,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAaI,mBAAAA,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,uBACE,SACA,YAEA,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,aAAa,wBAAwB,SAAS,UAAU;EAC9D,MAAM,EAAE,MAAM,cAAcK,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,oBAAoB;EAC7D,MAAM,SAAA,GAAQJ,YAAAA,WAAAA,CAAW;EACzB,MAAM,OAAO,KAAK,qBAAqB;EAGvC,MAAM,SAAS,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG,OAAA,GAAMA,YAAAA,WAAAA,CAAW,IAAI,KAAA;EACpF,MAAM,MAAM,MAAM,KAAK,aAAa,uBAAuB;GAAE;GAAU;GAAO;GAAM;EAAM,CAAC;EAC3F,IAAI,UAAU,MAAM,KAAK,YAAY,OAAO;EAC5C,IAAI,CAAC,SAAS;GAGZ,UAAU,KAAK,WAAW,cAAc;GACxC,QAAQ,uBAAuB,oBAAoB;EACrD;EACA,KAAK,eAAe;EAEpB,MAAM,uBAAmD;GACvD;GACA;GACA,yBAAyB,IAAI;GAC7B,sBAAsB;GACtB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;GACzB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC;EACA,QAAQ,aACN,KAAK,mCACL,KAAK,UAAU,oBAAoB,CACrC;EACA,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,KAAK,cAAc;EAEnB,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C,CAAC;CAEH,kBAAkB,OAAO,SAAkB,YAAkD;EAC3F,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcK,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAG3D,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,mBAAmB,mBAAmB;EACzE,KAAK,cAAc;EACnB,MAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;EACxE,IAAI,CAAC,MAAM,OAAO,KAAK,SAAS,mBAAmB,iCAAiC;EACpF,MAAM,SAAqC,KAAK,MAAM,IAAI;EAG1D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,iBAAiB;EAC1D,MAAM,OAAO,WAAW,OAAO,IAC3B,OAAO,YAAY,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC,CAAC,IAC5DE,mBAAAA,MAAM,OAAO;EACjB,MAAM,SAASC,sBAAAA,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EAOrF,IAAI,OAAO,KAAK,OAAO;GACrB,IAAI,OAAO,KAAK,SAAS,OAAO,KAAK,UAAU,OAAO,OACpD,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;GAEnE,OAAO,KAAK,SACV,cAAc,OAAO,KAAK,OAAO,cAAc,GAC/C,OAAO,KAAK,iBACd;EACF;EACA,MAAM,EAAE,MAAM,OAAO,SAAS,OAAO;EACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EACrF,IAAI,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;EAC7F,IAAI,aAAa,OAAO,UACtB,OAAO,KAAK,SAAS,mBAAmB,4BAA4B;EAEtE,KAAK,kBAAkB;EAKvB,IAAI;EACJ,IAAI;GACF,MAAM,EAAE,UAAU,UAAU,MAAM,KAAK,aAAa,0BAA0B;IAC5E;IACA;IACA,MAAM,OAAO;GACf,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,aAAa,YAAY;IACnD;IACA;IACA;IACA,UAAU,OAAO,EAAE,KAAK,IAAI,KAAA;GAC9B,CAAC;GACD,KAAK,eAAe;GAIpB,IAAI,OAAO,SAAS,MAAM,UAAU;IAClC,MAAM,EAAE,UAAU,SAAS;IAC3B,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,MAAM,IAAIJ,mBAAAA,oBAAoB,eAAe;IACtF,IAAI,UAAU,OAAO,OAAO,MAAM,IAAIA,mBAAAA,oBAAoB,gBAAgB;IAC1E,KAAK,aAAa;GACpB;GAEA,MAAM,YAAY,MAAM,QAAQ,SAAS;IACvC;IACA;IACA;IACA;IACA,YAAY,OAAO,cAAc,CAAC;GACpC,CAAC;GACD,KAAK,gBAAgB;GAErB,WAAW,MAAM,KAAK,OAAO,WAAW,OAAO;GAC/C,MAAM,KAAK,WAAW,WAAW,QAAQ,MAAM,CAAC;GAChD,KAAK,gBAAgB;EACvB,SAAS,OAAO;GAGd,IAAI,iBAAiBK,qBAAAA,aAAa;IAChC,QAAQ,KAAK,0BAA0B,KAAK;IAC5C,MAAM,OAAO,qBAAqB,IAAI,MAAM,KAAK,IAAI,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,IAAI;GAC3B;GAGA,IAAI,iBAAiBL,mBAAAA,qBAAqB;IACxC,QAAQ,KAAK,0BAA0B,MAAM,QAAQ,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,iBAAiB,KAAA,GAAW,KAAK;GACxD;GACA,QAAQ,MAAM,0BAA0B,KAAK;GAC7C,OAAO,KAAK,SAAS,cAAc;EACrC;EAEA,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,UAAU;EAChD,IAAI,aAAa,IAAI,UAAU,SAAS;EACxC,IAAI,aAAa,IAAI,YAAY,QAAQ;EACzC,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,QAAQ;CAC5C;;CAGA,MAAc,UACZ,SACA,SACA,eACA,WACmB;EACnB,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa;EACtD,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,MAAM,WAAW,SAAS,KAAK,SAAS;EACxC,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;CAEA,qBAAqB,SAAkB,YACrC,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcE,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAaD,mBAAAA,MAAM,SAAS,KAAK,mBAAmB;EAC5D,MAAM,OAAO,MAAMK,oBAAAA,SAAS,OAAO;EAEnC,MAAM,aAAaC,wBAAAA,eAAe,IAAI;EAEtC,MAAM,EAAE,YAAY,GAAG,GAAG,gBAAgB;EAC1C,MAAM,EAAE,kBAAkB;EAC1B,IACE,kBAAkB,KAAA,MACjB,OAAO,kBAAkB,YAAY,CAAC,qBAAqB,KAAK,aAAa,IAE9E,MAAMC,qBAAAA,gBACJ,yBACA,8DACF;EAEF,MAAM,EAAE,UAAU,UAAU,UAAU,MAAM,KAAK,aAAa,kBAAkB;GAC9E;GACA;EACF,CAAC;EACD,KAAK,qBAAqB;EAI1B,MAAM,YAAY,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG,UAAU,CAAC,CAAC,MAAM;EACpF,IAAI,MAAM,KAAK,iBAAiB,UAAU,UAAU,QAAQ,GAAG,KAAK,aAAa;EAEjF,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAEH,qBACE,SACA,SACA,WAAW,aAEX,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAcN,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAI3D,MAAM,QADc,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAClC,SAAS,kBAAkB,IAChD,MAAMI,oBAAAA,SAAS,OAAO,IACtB,MAAMG,oBAAAA,SAAS,OAAO;EAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,GAAG,WAAWC,oBAAAA,MAAM,kBAAkB,IAAI;EAGnE,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,YAAY;GACrB,CAAC,CAAE,UAAU,OAAO,YAAa,MAAM,KAAK,aAAa,aAAa;IACpE;IACA,YAAY,OAAO;GACrB,CAAC;GACD,KAAK,mBAAmB;GAKxB,MAAM,YAAY,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG;GAClE,IAAI,MAAM,KAAK,iBAAiB,UAAU,UAAU,QAAQ,GAAG,KAAK,aAAa;EACnF,OAAO,IAAI,OAAO,MAAM;GACtB,CAAC,CAAE,UAAU,SAAU,MAAM,KAAK,aAAa,0BAA0B;IACvE;IACA,MAAM,OAAO;GACf,CAAC;GACD,WAAW,MAAM,KAAK,aAAa,YAAY;IAAE;IAAU;IAAU;GAAM,CAAC;EAC9E,OACE,MAAMF,qBAAAA,gBAAgB,oBAAoB,gCAAgC;EAG5E,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAIH,6BAA6B,SAAkB,WAC7C,KAAK,MAAM,YAAY;EACrB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,oBAAoB,sCAAsC;EACzE,MAAM,EAAE,OAAO,mBAAmBE,oBAAAA,MAChCC,qBAAAA,iCACA,MAAML,oBAAAA,SAAS,OAAO,CACxB;EACA,MAAMM,oBAAAA,qBAAqB,KAAK,oBAAoB,cAAc;EAClE,MAAM,KAAK,WAAW,KAAK,OAAO,MAAM;EACxC,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB,CAAC;CAEH,mBAAmB,OAAe,qBAChC,KAAK,WAAW,OAAO,OAAO,gBAAgB;CAEhD,cAAc,SAAkB,YAC9B,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,cAAcV,qBAAAA,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EACrD,MAAM,EACJ,OACA,kBACA,aAAa,CAAC,MACZQ,oBAAAA,MAAMG,qBAAAA,kBAAkB,MAAMP,oBAAAA,SAAS,OAAO,CAAC;EACnD,MAAM,KAAK,WAAW,OAAO,OAAO,gBAAgB;EACpD,MAAM,SAAyB;GAAE,KAAK;GAAO;GAAO,gBAAgB;EAAK;EACzE,OAAO,KAAK,UACV,SACA,SACA;GAAE,UAAU;GAAS,UAAU;IAAE;IAAQ,MAAM,CAAC;GAAE;GAAG;EAAW,GAChE,SACF;CACF,CAAC;;;;;;;;;;;;;;;;;CAoBH,oBAAoB,YAClB,KAAK,MAAM,YAAY;EACrB,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO;EACjD,IAAI,CAAC,WAAW,MAAMQ,qBAAAA,gBAAgB,eAAe;EACrD,MAAM,EAAE,mBAAmBJ,oBAAAA,MAAM,wBAAwB,MAAMJ,oBAAAA,SAAS,OAAO,CAAC;EAChF,MAAM,OAAO,MAAM,KAAK,aAAa,MAAM,WAAW,cAAc;EACpE,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;CAC/B,CAAC;;;;;;;;;;;;;;;;CAiBH,mBAAmB,YACjB,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,MAAM,kBAAkBI,oBAAAA,MAAM,uBAAuB,MAAMJ,oBAAAA,SAAS,OAAO,CAAC;EACpF,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO,MAAM,aAAa;EACpE,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,QAAQ,aAAa,eAAe,SAAS;EAC7C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,SAAS;GAC5D,UAAU;GACV,QAAQ;EACV,CAAC;CACH,CAAC;CAIH,OAAO,OAAO,cAAwC;EACpD,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,KAAK,MAAM,aAAa,SAAS,KAAK,GACpC,MAAM,KAAK,WAAW,WAAW,SAAS;CAE9C;;;;;;;;CASA,MAAc,MAAM,SAAkB;EACpC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,QAAQ,oBAAoB,IAAI,KAAK,eAAe;EAC9D,QAAQ,oBAAoB,GAAG;EAC/B,MAAM,KAAK,WAAW,KAAK,OAAO;CACpC;CAEA,eAAe,OAAO,YAAgD;EACpE,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;EACrD,IAAI,CAAC,WAAW,OAAO;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,OAAO;CACT;CAEA,kBAAkB,OAAO,YAAuC;EAC9D,OAAQ,MAAM,KAAK,aAAa,OAAO,MAAO;CAChD;CAEA,aAAa,OACX,SACA,WACuD;EAEvD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,WAAW,CAAC,QAAQ,OAAO;EAC/B,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;CAEA,gBAAgB,OAAO,cAAqC;EAC1D,MAAM,KAAK,WAAW,WAAW,SAAS;CAC5C;CAEA,eAAe,OAAO,cAA6C;EACjE,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;CACrC;CAEA,yBAAyB,OAAO,iBAA6C;EAC3E,MAAM,KAAK,WAAW,uBAAuB,YAAY;EACzD,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB;AACF"}

package/dist/auth/index.d.cts

@@ -1,7 +1,7 @@
 import { Principal } from "../core/index.cjs";
 import { Session } from "../session/types.cjs";
 import { EmailSender } from "./email-codes.cjs";
-import { AuthConfig, AuthService, AuthorizedHandler, LoggedHandler, OAuth2AuthorizationOptions } from "./types.cjs";
+import { AuthConfig, AuthService, AuthorizedHandler, LoggedHandler, LogoutOptions, OAuth2AuthorizationOptions } from "./types.cjs";
 export declare const PATH: {
   readonly CSRF: '/csrf';
   readonly LOGOUT: '/logout';
@@ -64,7 +64,7 @@ export declare class Auth implements AuthService {
   /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */
   private redirect;
   csrf: (_request: Request) => Promise<Response>;
-  logout: (request: Request) => Promise<Response>;
+  logout: (request: Request, options?: LogoutOptions) => Promise<Response>;
   logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
   private createPkceParameters;
   private getOauth2StateKey;

package/dist/auth/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/auth/index.ts"],"mappings":";;;;qBAyHa;WACX;WACA;WACA;WAEA;WACA;WACA;WACA;WACA;WACA;WAEA;WACA;WASA;WACA;WAEA;;;;;;;;;qBAUW,gBAAgB;mBACV;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;;mBAEA;mBACA;mBACA;mBACA;EAEjB,cACE,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACC;UA6BK;;UAOM;;UAMN;;;;;;;;UAYM;;;;;UAiBN;;UAYM;;UAWN;EAqBR,OAAI,UAAoB,YAAU,QAAQ;EAmB1C,SAAM,SAAmB,YAAU,QAAQ;EAU3C,SAAM,SAAmB,SAAO,WAAa,kBAAgB,QAAQ;UAc7D;UAWA;UAIA;;;;;;UASM;;;;;;;;UAaA;EAgBd,cAAW,SAAmB,YAAU,QAAQ;EAOhD,cAAW,SAAmB,YAAU,QAAQ;EAOhD,sBAAmB,SACR,SAAO,UACN,+BACT,QAAQ;EAyCX,kBAAe,SAAmB,SAAO,SAAW,sBAAoB,QAAQ;;UA6GlE;EAad,oBAAiB,SAAa,SAAO,SAAW,sBAAoB,QAAQ;EAuC5E,oBAAiB,SACN,SAAO,SACP,mBAAiB,sBAEzB,QAAQ;EAgDX,4BAAyB,SAAa,SAAO,QAAU,gBAAc,QAAQ;EAY7E,kBAAe,eAAiB,6BAA6B;EAG7D,aAAU,SAAa,SAAO,SAAW,sBAAoB,QAAQ;;;;;;;;;;;;;;;;;EAoCrE,mBAAgB,SAAa,YAAU,QAAQ;;;;;;;;;;;;;;;;EAwB/C,kBAAe,SAAa,YAAU,QAAQ;EAe9C,OAAI,WAAqB,cAAY;;;;;;;;UAcvB;EAOd,eAAY,SAAmB,YAAU,QAAQ;EAQjD,kBAAe,SAAmB,YAAU;EAI5C,aAAoB,mBAAiB,SAC1B,SAAO,QACR,MACP,QAAQ,iBAAiB,UAAU;EAStC,gBAAa,sBAA8B;EAI3C,eAAY,WAAqB,cAAY,QAAQ;EAKrD,yBAAsB,0BAAkC,QAAQ"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/auth/index.ts"],"mappings":";;;;qBA0Ha;WACX;WACA;WACA;WAEA;WACA;WACA;WACA;WACA;WACA;WAEA;WACA;WASA;WACA;WAEA;;;;;;;;;qBAUW,gBAAgB;mBACV;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;;mBAEA;mBACA;mBACA;mBACA;EAEjB,cACE,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACC;UA6BK;;UAOM;;UAMN;;;;;;;;UAYM;;;;;UAiBN;;UAYM;;UAWN;EAqBR,OAAI,UAAoB,YAAU,QAAQ;EAmB1C,SAAM,SAAmB,SAAO,UAAY,kBAAgB,QAAQ;EAyBpE,SAAM,SAAmB,SAAO,WAAa,kBAAgB,QAAQ;UAc7D;UAWA;UAIA;;;;;;UASM;;;;;;;;UAaA;EAgBd,cAAW,SAAmB,YAAU,QAAQ;EAOhD,cAAW,SAAmB,YAAU,QAAQ;EAOhD,sBAAmB,SACR,SAAO,UACN,+BACT,QAAQ;EAyCX,kBAAe,SAAmB,SAAO,SAAW,sBAAoB,QAAQ;;UA6GlE;EAad,oBAAiB,SAAa,SAAO,SAAW,sBAAoB,QAAQ;EAuC5E,oBAAiB,SACN,SAAO,SACP,mBAAiB,sBAEzB,QAAQ;EAgDX,4BAAyB,SAAa,SAAO,QAAU,gBAAc,QAAQ;EAY7E,kBAAe,eAAiB,6BAA6B;EAG7D,aAAU,SAAa,SAAO,SAAW,sBAAoB,QAAQ;;;;;;;;;;;;;;;;;EAoCrE,mBAAgB,SAAa,YAAU,QAAQ;;;;;;;;;;;;;;;;EAwB/C,kBAAe,SAAa,YAAU,QAAQ;EAe9C,OAAI,WAAqB,cAAY;;;;;;;;UAcvB;EAOd,eAAY,SAAmB,YAAU,QAAQ;EAQjD,kBAAe,SAAmB,YAAU;EAI5C,aAAoB,mBAAiB,SAC1B,SAAO,QACR,MACP,QAAQ,iBAAiB,UAAU;EAStC,gBAAa,sBAA8B;EAI3C,eAAY,WAAqB,cAAY,QAAQ;EAKrD,yBAAsB,0BAAkC,QAAQ"}

package/dist/auth/index.d.mts

@@ -1,7 +1,7 @@
 import { Principal } from "../core/index.mjs";
 import { Session } from "../session/types.mjs";
 import { EmailSender } from "./email-codes.mjs";
-import { AuthConfig, AuthService, AuthorizedHandler, LoggedHandler, OAuth2AuthorizationOptions } from "./types.mjs";
+import { AuthConfig, AuthService, AuthorizedHandler, LoggedHandler, LogoutOptions, OAuth2AuthorizationOptions } from "./types.mjs";
 export declare const PATH: {
   readonly CSRF: '/csrf';
   readonly LOGOUT: '/logout';
@@ -64,7 +64,7 @@ export declare class Auth implements AuthService {
   /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */
   private redirect;
   csrf: (_request: Request) => Promise<Response>;
-  logout: (request: Request) => Promise<Response>;
+  logout: (request: Request, options?: LogoutOptions) => Promise<Response>;
   logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
   private createPkceParameters;
   private getOauth2StateKey;

package/dist/auth/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/auth/index.ts"],"mappings":";;;;qBAyHa;WACX;WACA;WACA;WAEA;WACA;WACA;WACA;WACA;WACA;WAEA;WACA;WASA;WACA;WAEA;;;;;;;;;qBAUW,gBAAgB;mBACV;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;;mBAEA;mBACA;mBACA;mBACA;EAEjB,cACE,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACC;UA6BK;;UAOM;;UAMN;;;;;;;;UAYM;;;;;UAiBN;;UAYM;;UAWN;EAqBR,OAAI,UAAoB,YAAU,QAAQ;EAmB1C,SAAM,SAAmB,YAAU,QAAQ;EAU3C,SAAM,SAAmB,SAAO,WAAa,kBAAgB,QAAQ;UAc7D;UAWA;UAIA;;;;;;UASM;;;;;;;;UAaA;EAgBd,cAAW,SAAmB,YAAU,QAAQ;EAOhD,cAAW,SAAmB,YAAU,QAAQ;EAOhD,sBAAmB,SACR,SAAO,UACN,+BACT,QAAQ;EAyCX,kBAAe,SAAmB,SAAO,SAAW,sBAAoB,QAAQ;;UA6GlE;EAad,oBAAiB,SAAa,SAAO,SAAW,sBAAoB,QAAQ;EAuC5E,oBAAiB,SACN,SAAO,SACP,mBAAiB,sBAEzB,QAAQ;EAgDX,4BAAyB,SAAa,SAAO,QAAU,gBAAc,QAAQ;EAY7E,kBAAe,eAAiB,6BAA6B;EAG7D,aAAU,SAAa,SAAO,SAAW,sBAAoB,QAAQ;;;;;;;;;;;;;;;;;EAoCrE,mBAAgB,SAAa,YAAU,QAAQ;;;;;;;;;;;;;;;;EAwB/C,kBAAe,SAAa,YAAU,QAAQ;EAe9C,OAAI,WAAqB,cAAY;;;;;;;;UAcvB;EAOd,eAAY,SAAmB,YAAU,QAAQ;EAQjD,kBAAe,SAAmB,YAAU;EAI5C,aAAoB,mBAAiB,SAC1B,SAAO,QACR,MACP,QAAQ,iBAAiB,UAAU;EAStC,gBAAa,sBAA8B;EAI3C,eAAY,WAAqB,cAAY,QAAQ;EAKrD,yBAAsB,0BAAkC,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/auth/index.ts"],"mappings":";;;;qBA0Ha;WACX;WACA;WACA;WAEA;WACA;WACA;WACA;WACA;WACA;WAEA;WACA;WASA;WACA;WAEA;;;;;;;;;qBAUW,gBAAgB;mBACV;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;;mBAEA;mBACA;mBACA;mBACA;EAEjB,cACE,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACC;UA6BK;;UAOM;;UAMN;;;;;;;;UAYM;;;;;UAiBN;;UAYM;;UAWN;EAqBR,OAAI,UAAoB,YAAU,QAAQ;EAmB1C,SAAM,SAAmB,SAAO,UAAY,kBAAgB,QAAQ;EAyBpE,SAAM,SAAmB,SAAO,WAAa,kBAAgB,QAAQ;UAc7D;UAWA;UAIA;;;;;;UASM;;;;;;;;UAaA;EAgBd,cAAW,SAAmB,YAAU,QAAQ;EAOhD,cAAW,SAAmB,YAAU,QAAQ;EAOhD,sBAAmB,SACR,SAAO,UACN,+BACT,QAAQ;EAyCX,kBAAe,SAAmB,SAAO,SAAW,sBAAoB,QAAQ;;UA6GlE;EAad,oBAAiB,SAAa,SAAO,SAAW,sBAAoB,QAAQ;EAuC5E,oBAAiB,SACN,SAAO,SACP,mBAAiB,sBAEzB,QAAQ;EAgDX,4BAAyB,SAAa,SAAO,QAAU,gBAAc,QAAQ;EAY7E,kBAAe,eAAiB,6BAA6B;EAG7D,aAAU,SAAa,SAAO,SAAW,sBAAoB,QAAQ;;;;;;;;;;;;;;;;;EAoCrE,mBAAgB,SAAa,YAAU,QAAQ;;;;;;;;;;;;;;;;EAwB/C,kBAAe,SAAa,YAAU,QAAQ;EAe9C,OAAI,WAAqB,cAAY;;;;;;;;UAcvB;EAOd,eAAY,SAAmB,YAAU,QAAQ;EAQjD,kBAAe,SAAmB,YAAU;EAI5C,aAAoB,mBAAiB,SAC1B,SAAO,QACR,MACP,QAAQ,iBAAiB,UAAU;EAStC,gBAAa,sBAA8B;EAI3C,eAAY,WAAqB,cAAY,QAAQ;EAKrD,yBAAsB,0BAAkC,QAAQ"}

package/dist/auth/index.mjs

@@ -211,10 +211,20 @@ var Auth = class {
 		});
 		return response;
 	};
-	logout = async (request) => {
+	logout = async (request, options) => {
+		const scope = options?.scope ?? "local";
 		const sessionId = this.getSessionId(request);
-		if (sessionId) await this.repository.deleteById(sessionId);
+		if (scope !== "local" && sessionId) {
+			const session = await this.repository.findById(sessionId);
+			const principal = session && this.principalOf(session);
+			if (principal) {
+				const sessions = await this.repository.findByPrincipalName(principal.name);
+				for (const id of sessions.keys()) if (id !== sessionId) await this.repository.deleteById(id);
+			}
+		}
 		const response = Response.json({});
+		if (scope === "others") return response;
+		if (sessionId) await this.repository.deleteById(sessionId);
 		deleteCookie(response, this.cookieName, this.cookieOptions);
 		return response;
 	};

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomUUID } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { extend, literal, object, regex, string } from 'zod/mini';\nimport type { Principal } from '../core/index';\nimport { loginEmailSchema, sendEmailVerificationCodeSchema } from '../email/schema';\nimport { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2Error, type OAuth2ErrorType, isKnownOAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredential,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n  StandardClaims,\n} from '../oauth2/types';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport {\n  type CookieOptions,\n  deleteCookie,\n  getCookie,\n  param,\n  query,\n  setCookie,\n} from '../utils/http';\nimport { timing } from '../utils/timing';\nimport { parse, readForm, readJson, verifyTurnstileToken } from '../utils/valid';\nimport {\n  MAX_ATTRIBUTES_BYTES,\n  attributesSchema,\n  attributesSize,\n  bodyAttributes,\n} from './attributes';\nimport { DesktopCodes } from './desktop-codes';\nimport { type EmailSender, EmailVerificationCodes } from './email-codes';\nimport { AuthenticationError } from './error';\nimport { errorResponse, invalidArgument, unauthenticated } from './respond';\nimport type {\n  AuthConfig,\n  AuthService,\n  Authorization,\n  AuthorizedHandler,\n  LoggedHandler,\n  OAuth2AuthorizationOptions,\n} from './types';\n\n// PKCE per RFC 7636: code_verifier / code_challenge are 43-128 chars from\n// the unreserved set. We restrict to base64url (drops \".\" and \"~\") since\n// that's what S256 produces and what callers should be sending; rejecting\n// the rest shrinks the accepted input shape without losing legit clients.\n// A 32-byte random verifier base64url-encodes to exactly 43 chars.\nconst PKCE_FORMAT = /^[A-Za-z0-9_-]{43,128}$/;\n\n// A native app's `code_verifier` goes on to the provider, which checks it against the challenge\n// the app sent: accept the whole RFC 7636 unreserved set here, as the provider does.\nconst CODE_VERIFIER_FORMAT = /^[A-Za-z0-9._~-]{43,128}$/;\n\n/** The header a session id travels in besides the cookie, with `session.header` on. */\nconst SESSION_HEADER = 'X-Auth-Token';\n\n/** Seconds an OAuth2 state or nonce may be used within. */\nconst OAUTH2_PARAMETER_TTL = 10 * 60;\n\n// error_description forwarded to errorUri comes from the provider or an error message: cap it so\n// the redirect URL stays short and an attacker-crafted callback cannot stuff the page with text.\nconst MAX_ERROR_DESCRIPTION_LENGTH = 256;\n\n/** An error code safe to put on errorUri: a registered one as is, anything else as `fallback`. */\nfunction safeErrorType(error: string, fallback: OAuth2ErrorType): OAuth2ErrorType {\n  return isKnownOAuth2ErrorType(error) ? error : fallback;\n}\n\n/**\n * The codes a failure past validation keeps on errorUri, each one the user can act on: the code\n * expired or was used (start again), they declined, or the provider is briefly down. Every other\n * failure there (a rejected client, a user info request that failed) is the app's or the\n * provider's problem, which the user sees as `server_error`.\n */\nconst CALLBACK_ERROR_TYPES: ReadonlySet<OAuth2ErrorType> = new Set([\n  'invalid_grant',\n  'access_denied',\n  'temporarily_unavailable',\n]);\n\nfunction authorizationAttributes(\n  attributes: OAuth2AuthorizationOptions['attributes']\n): Record<string, string> | undefined {\n  if (!attributes) return undefined;\n  const defined: Record<string, string> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    if (value !== undefined) defined[key] = value;\n  }\n  if (Object.keys(defined).length === 0) return undefined;\n  // The host's own values, written with the session: oversized is a bug in the host, not a 400.\n  const size = attributesSize(defined);\n  invariant(\n    size <= MAX_ATTRIBUTES_BYTES,\n    `oauth2 authorization attributes are ${size} bytes, at most ${MAX_ATTRIBUTES_BYTES} allowed`\n  );\n  return defined;\n}\n\n/** Sign in with Apple answers with `response_mode=form_post`; a charset parameter may follow. */\nfunction isFormPost(request: Request) {\n  const contentType = request.headers.get('content-type')?.toLowerCase();\n  return (\n    request.method === 'POST' && !!contentType?.startsWith('application/x-www-form-urlencoded')\n  );\n}\n\n/** Google's own form post carries no attributes; an app posting JSON may add them. */\nconst oneTapBodySchema = extend(googleOneTapSchema, { attributes: attributesSchema });\n\nconst desktopAuthorizeSchema = object({\n  code_challenge: string().check(regex(PKCE_FORMAT)),\n  code_challenge_method: literal('S256'),\n});\n\nconst desktopExchangeSchema = object({\n  code: string(),\n  code_verifier: string().check(regex(PKCE_FORMAT)),\n});\n\nexport const PATH = {\n  CSRF: '/csrf',\n  LOGOUT: '/logout',\n  LOGGED: '/logged',\n\n  OAUTH2_STATE: '/oauth2/state/:provider',\n  OAUTH2_NONCE: '/oauth2/nonce/:provider',\n  OAUTH2_AUTHORIZATION: '/oauth2/authorization/:provider',\n  LOGIN_OAUTH2_CODE: '/login/oauth2/code/:provider',\n  LOGIN_OAUTH2_NATIVE: '/login/oauth2/native/:provider',\n  LOGIN_OAUTH2_ONETAP: '/login/oauth2/onetap/google',\n\n  LOGIN_EMAIL: '/login/email',\n  SEND_EMAIL_VERIFICATION_CODE: '/auth/sendEmailVerificationCode',\n\n  // Desktop / native app sign-in via web loopback (RFC 8252 + OAuth 2.1 Auth Code Flow):\n  //   1. user already authenticated with cookie session → POST DESKTOP_AUTHORIZE → { code }\n  //   2. web redirects to desktop's loopback callback with the code\n  //   3. desktop renderer POSTs DESKTOP_EXCHANGE with the code → server returns\n  //      Set-Cookie carrying a fresh session, single-use code is invalidated\n  // The two-step flow keeps the actual session id off the redirect URL — only a\n  // 5-minute single-use code transits via the loopback.\n  DESKTOP_AUTHORIZE: '/auth/desktop/authorize',\n  DESKTOP_EXCHANGE: '/auth/desktop/exchange',\n\n  CLEANUP_EXPIRED_SESSIONS: '/sessions/expired/cleanup',\n} as const;\n\n/**\n * The login routes and session helpers. Every route is one straight line: read and validate the\n * request, check the credential, call the host's `onAuthorized`, sign in. Failures are thrown and\n * answered in one place per kind of route: a JSON route runs under `guard`, which maps a\n * `RequestError`, an `AuthenticationError` or an `OAuth2Error` to its google.rpc body (see\n * `respond.ts`); the redirect callback maps the same errors to `errorUri` parameters (`redirect`).\n */\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n  private readonly turnstileSecretKey?: string;\n  private readonly emailCodes: EmailVerificationCodes;\n  private readonly desktopCodes: DesktopCodes;\n  private readonly oauth2Client: OAuth2Client | null;\n  /** Provider keys whose logins may come without a nonce (`oauth2.nonce.optional`). */\n  private readonly nonceOptional: ReadonlySet<string>;\n  private readonly touchInterval: number;\n  private readonly sessionHeader: boolean;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({\n    sessionRepository,\n    kvRepository,\n    turnstileSecretKey,\n    verificationCode,\n    oauth2,\n    cookie,\n    session,\n    timing,\n  }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    this.turnstileSecretKey = turnstileSecretKey;\n    const maxAttempts = verificationCode?.maxAttempts ?? 5;\n    const resendCooldown = verificationCode?.resendCooldown ?? 60;\n    invariant(maxAttempts >= 1, 'verificationCode.maxAttempts must be at least 1');\n    invariant(resendCooldown >= 1, 'verificationCode.resendCooldown must be at least 1 second');\n    this.emailCodes = new EmailVerificationCodes(kvRepository, { maxAttempts, resendCooldown });\n    this.desktopCodes = new DesktopCodes(kvRepository);\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n    this.nonceOptional = new Set(oauth2?.nonce?.optional);\n    this.touchInterval = (session?.touchInterval ?? 3600) * 1000;\n    this.sessionHeader = session?.header ?? false;\n    invariant(this.touchInterval >= 0, 'session.touchInterval must not be negative');\n  }\n\n  // ---- sessions and responses ------------------------------------------------------------------\n\n  private getSessionId(request: Request): string | undefined {\n    const fromCookie = getCookie(request, this.cookieName);\n    if (fromCookie) return fromCookie;\n    return (this.sessionHeader && request.headers.get(SESSION_HEADER)) || undefined;\n  }\n\n  /** The session the request carries, if it exists. */\n  private async loadSession(request: Request): Promise<Session | null> {\n    const sessionId = this.getSessionId(request);\n    return sessionId ? this.repository.findById(sessionId) : null;\n  }\n\n  /** The signed-in principal of a session, if any. */\n  private principalOf(session: Session): Principal | null {\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    return name ? { name: String(name) } : null;\n  }\n\n  /**\n   * A new session signed in as `principal`. With `carryOver`, what the host kept in the pre-login\n   * session moves to the new one; the authorization request (state, PKCE verifier, flow\n   * attributes) is single-use and was consumed, and a principal left there from an earlier\n   * sign-in is replaced. The new id is never the one the browser brought, which may have been\n   * planted by an attacker who started the flow (session fixation).\n   */\n  private async signIn(principal: Principal, carryOver?: Session): Promise<Session> {\n    const session = this.repository.createSession();\n    for (const attribute of carryOver?.getAttributeNames() ?? []) {\n      if (attribute === this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) continue;\n      if (attribute === PRINCIPAL_NAME_INDEX_NAME) continue;\n      const value = carryOver?.getAttribute(attribute);\n      if (value !== null && value !== undefined) session.setAttribute(attribute, value);\n    }\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    return session;\n  }\n\n  /**\n   * `response` carrying `session`: its cookie, renewed for the whole inactive interval, and with\n   * `session.header` on, the `X-Auth-Token` header a client without a cookie jar reads.\n   */\n  private withSession(response: Response, session: Session, cookie?: CookieOptions): Response {\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), {\n      ...this.cookieOptions,\n      ...cookie,\n      maxAge,\n    });\n    if (this.sessionHeader) response.headers.set(SESSION_HEADER, session.getId());\n    return response;\n  }\n\n  /** Runs a JSON route: a failure it knows is its response, anything else is the host's. */\n  private async guard(run: () => Promise<Response>): Promise<Response> {\n    try {\n      return await run();\n    } catch (error) {\n      const response = errorResponse(error);\n      if (response) return response;\n      throw error;\n    }\n  }\n\n  /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */\n  private redirect(\n    error: OAuth2ErrorType,\n    description?: string,\n    refusal?: AuthenticationError\n  ): Response {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    // Metadata never replaces a parameter: not one errorUri carries itself, nor one set below.\n    for (const [key, value] of Object.entries(refusal?.metadata ?? {})) {\n      if (!uri.searchParams.has(key)) uri.searchParams.set(key, value);\n    }\n    uri.searchParams.set('error', error);\n    if (description) {\n      uri.searchParams.set('error_description', description.slice(0, MAX_ERROR_DESCRIPTION_LENGTH));\n    }\n    if (refusal) uri.searchParams.set('reason', refusal.reason);\n    return Response.redirect(uri.href, 302);\n  }\n\n  // ---- basic -----------------------------------------------------------------------------------\n\n  csrf = async (_request: Request): Promise<Response> => {\n    const token = randomUUID();\n    const response = Response.json({\n      token,\n      parameterName: '_csrf',\n      headerName: 'X-XSRF-TOKEN',\n    });\n\n    // Double Submit Cookie Protection\n    setCookie(response, 'XSRF-TOKEN', token, {\n      path: '/',\n      secure: true,\n      httpOnly: false,\n      sameSite: 'none',\n      domain: this.cookieOptions.domain,\n    });\n    return response;\n  };\n\n  logout = async (request: Request): Promise<Response> => {\n    const sessionId = this.getSessionId(request);\n    if (sessionId) await this.repository.deleteById(sessionId);\n    const response = Response.json({});\n    // A Set-Cookie only replaces the stored cookie when Domain and Path match (RFC 6265),\n    // so clear it with the same attributes it was set with.\n    deleteCookie(response, this.cookieName, this.cookieOptions);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    const session = await this.loadSession(request);\n    if (!session) return Response.json({ data: false });\n\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    const principal = this.principalOf(session);\n    if (principal) await onLogged?.(principal);\n    return this.withSession(Response.json({ data: principal !== null }), session);\n  };\n\n  // ---- oauth2 ----------------------------------------------------------------------------------\n\n  private createPkceParameters(): PkceParameters {\n    // 32 random bytes: a 43-char base64url verifier, the RFC 7636 minimum (a UUID is 36).\n    const code_verifier = randomBytes(32).toString('base64url');\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  /**\n   * Spends a nonce `oauth2Nonce` issued for `provider`: `NONCE_MISMATCH` for one that was not,\n   * or was used already. An id token is replayable until it expires; the nonce it carries makes\n   * it sign in once.\n   */\n  private async consumeNonce(nonce: string, provider: string): Promise<void> {\n    const key = this.getOauth2NonceKey(nonce);\n    if ((await this.kv.getItem(key)) !== provider) throw new AuthenticationError('NONCE_MISMATCH');\n    await this.kv.removeItem(key);\n  }\n\n  /**\n   * The nonce check of the JSON logins (One Tap, native), where the client obtained the id token\n   * and the nonce came from `oauth2Nonce`: spends the one the token carries, and refuses a token\n   * without one when the provider's flow echoes nonces (`required`) and the host has not listed the\n   * provider as optional. An id token is replayable until it expires; the nonce makes it sign in\n   * once.\n   */\n  private async checkIssuedNonce(\n    userInfo: Authorization['userInfo'],\n    provider: string,\n    required: boolean\n  ): Promise<boolean> {\n    const { nonce } = userInfo.data as { nonce?: unknown };\n    if (typeof nonce === 'string' && nonce) {\n      await this.consumeNonce(nonce, provider);\n      return true;\n    }\n    if (required && !this.nonceOptional.has(provider)) {\n      throw new AuthenticationError('NONCE_MISSING');\n    }\n    return false;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = (\n    request: Request,\n    options?: OAuth2AuthorizationOptions\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const attributes = authorizationAttributes(options?.attributes);\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.OAUTH2_AUTHORIZATION);\n      const state = randomUUID();\n      const pkce = this.createPkceParameters();\n      // Sent only to a provider whose id token echoes it: the callback then requires it back, so\n      // a code that was swapped in for another sign-in's yields a token the session refuses.\n      const nonce = (await this.oauth2Client.nonceSupport(provider)).web ? randomUUID() : undefined;\n      const uri = await this.oauth2Client.createAuthorizationUri({ provider, state, pkce, nonce });\n      let session = await this.loadSession(request);\n      if (!session) {\n        // A session made for the flow only has to outlive the state: an abandoned flow must not\n        // keep a row for the default interval. Sign-in moves to a new session, with the default.\n        session = this.repository.createSession();\n        session.setMaxInactiveInterval(OAUTH2_PARAMETER_TTL);\n      }\n      mark('fetch_session');\n\n      const authorizationRequest: OAuth2AuthorizationRequest = {\n        state,\n        provider,\n        authorizationRequestUri: uri.href,\n        additionalParameters: pkce,\n        ...(nonce ? { nonce } : {}),\n        ...(attributes ? { attributes } : {}),\n      };\n      session.setAttribute(\n        this.ATTR_OAUTH2_AUTHORIZATION_REQUEST,\n        JSON.stringify(authorizationRequest)\n      );\n      await this.repository.save(session);\n      mark('save_session');\n\n      const response = new Response(null, { status: 302, headers: { location: uri.href } });\n      setTiming(response);\n      return this.withSession(response, session);\n    });\n\n  loginOAuth2Code = async (request: Request, handler: AuthorizedHandler): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. the session the flow started on, and the authorization request it stored\n    const session = await this.loadSession(request);\n    if (!session) return this.redirect('invalid_request', 'session not found');\n    mark('load_session');\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) return this.redirect('invalid_request', 'authorization request not found');\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 2. the provider's answer: query, or a form for Apple's response_mode=form_post\n    const { provider } = param(request, PATH.LOGIN_OAUTH2_CODE);\n    const data = isFormPost(request)\n      ? Object.fromEntries(new URLSearchParams(await request.text()))\n      : query(request);\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) return this.redirect('invalid_request', 'invalid redirect query');\n    // The provider answered with an error instead of a code (the user pressed Cancel →\n    // access_denied, invalid_scope, server_error, ...). Forward it rather than reporting a\n    // malformed query. This runs before the state check on purpose: providers echo state on\n    // error responses, but not all reliably do, and a forged error callback can only make the\n    // victim's popup show an error — nothing is exchanged or signed in. A present state that does\n    // not match still wins, since that is the more accurate (and more alarming) diagnosis.\n    if (parsed.data.error) {\n      if (parsed.data.state && parsed.data.state !== cached.state) {\n        return this.redirect('invalid_request', 'redirect state mismatch');\n      }\n      return this.redirect(\n        safeErrorType(parsed.data.error, 'server_error'),\n        parsed.data.error_description\n      );\n    }\n    const { code, state, user } = parsed.data;\n    if (!code || !state) return this.redirect('invalid_request', 'invalid redirect query');\n    if (state !== cached.state) return this.redirect('invalid_request', 'redirect state mismatch');\n    if (provider !== cached.provider) {\n      return this.redirect('invalid_request', 'redirect provider mismatch');\n    }\n    mark('validate_session');\n\n    // 3. exchange the code, load the user, sign in. Everything here can fail (an expired or reused\n    // code, a network error, the host's handler or session store). The callback runs in a popup\n    // the user is looking at, so every failure must land on errorUri, never as a JSON error.\n    let signedIn: Session;\n    try {\n      const { clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n        provider,\n        code,\n        pkce: cached.additionalParameters,\n      });\n      // Apple posts the user's name alongside the code, once: hand it to the provider with the token.\n      const userInfo = await this.oauth2Client.getUserInfo({\n        provider,\n        clientId,\n        token,\n        response: user ? { user } : undefined,\n      });\n      mark('exchange_code');\n      // The id token must carry the nonce this flow sent (stored with the state, not in KV: it\n      // is bound to this session's request). A provider that gave no id token has nothing to\n      // carry it, as has a request stored before nonces were sent.\n      if (cached.nonce && token.id_token) {\n        const { nonce } = userInfo.data as { nonce?: unknown };\n        if (typeof nonce !== 'string' || !nonce) throw new AuthenticationError('NONCE_MISSING');\n        if (nonce !== cached.nonce) throw new AuthenticationError('NONCE_MISMATCH');\n        mark('check_nonce');\n      }\n\n      const principal = await handler(request, {\n        provider,\n        clientId,\n        userInfo,\n        token,\n        attributes: cached.attributes ?? {},\n      });\n      mark('save_principal');\n\n      signedIn = await this.signIn(principal, session);\n      await this.repository.deleteById(session.getId());\n      mark('update_session');\n    } catch (error) {\n      // The details stay in the logs: an OAuth2Error message can carry a client id or a\n      // provider's response, which has no place in a URL the browser keeps in its history.\n      if (error instanceof OAuth2Error) {\n        console.warn('OAuth2 callback failed', error);\n        const type = CALLBACK_ERROR_TYPES.has(error.error) ? error.error : 'server_error';\n        return this.redirect(type);\n      }\n      // A refusal is something the user can act on, so its reason and metadata reach the page,\n      // as they reach a JSON client through the ErrorInfo.\n      if (error instanceof AuthenticationError) {\n        console.warn('OAuth2 sign-in refused', error.reason, error.metadata);\n        return this.redirect('access_denied', undefined, error);\n      }\n      console.error('OAuth2 callback failed', error);\n      return this.redirect('server_error');\n    }\n\n    const uri = new URL(this.oauth2Client.successUri);\n    uri.searchParams.set('status', 'success');\n    uri.searchParams.set('provider', provider);\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    setTiming(response);\n    return this.withSession(response, signedIn);\n  };\n\n  /** The shared tail of the JSON login routes: the host's handler, then a signed-in session. */\n  private async authorize(\n    request: Request,\n    handler: AuthorizedHandler,\n    authorization: Authorization,\n    setTiming: (response: Response) => void\n  ): Promise<Response> {\n    const principal = await handler(request, authorization);\n    const session = await this.signIn(principal);\n    const response = Response.json(principal);\n    setTiming(response);\n    return this.withSession(response, session);\n  }\n\n  loginOAuth2Native = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.LOGIN_OAUTH2_NATIVE);\n      const body = await readJson(request);\n      // Whatever the app sends besides its credentials for `onAuthorized` (a referral code, ...).\n      const attributes = bodyAttributes(body);\n      // Only the credentials go on to the provider client.\n      const { attributes: _, ...credentials } = body as NativeCredential & { attributes?: unknown };\n      const { code_verifier } = credentials as { code_verifier?: unknown };\n      if (\n        code_verifier !== undefined &&\n        (typeof code_verifier !== 'string' || !CODE_VERIFIER_FORMAT.test(code_verifier))\n      ) {\n        throw invalidArgument(\n          'INVALID_CODE_VERIFIER',\n          'code_verifier must be 43-128 characters from [A-Za-z0-9-._~]'\n        );\n      }\n      const { clientId, userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n        provider,\n        credentials,\n      });\n      mark('login_oauth2_native');\n\n      // Required when the provider's native id token echoes a nonce and the login produced one\n      // (Facebook's access_token login has none to carry it).\n      const required = (await this.oauth2Client.nonceSupport(provider)).native && !!token.id_token;\n      if (await this.checkIssuedNonce(userInfo, provider, required)) mark('check_nonce');\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  loginOAuth2Onetap = (\n    request: Request,\n    handler: AuthorizedHandler,\n    provider = 'google'\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n\n      // Google's own form post, or an app's JSON.\n      const contentType = request.headers.get('content-type') ?? '';\n      const body = contentType.includes('application/json')\n        ? await readJson(request)\n        : await readForm(request);\n      const { attributes = {}, ...parsed } = parse(oneTapBodySchema, body);\n\n      // Both the credential and the code are issued to the provider's web client.\n      let clientId: string;\n      let token: Authorization['token'];\n      let userInfo: Authorization['userInfo'];\n      if (parsed.credential) {\n        ({ clientId, token, userInfo } = await this.oauth2Client.getTokenInfo({\n          provider,\n          credential: parsed.credential,\n        }));\n        mark('verify_credential');\n\n        // The credential must carry a single-use nonce from `oauth2Nonce`, which the front end\n        // passed to `prompt`. This replaces Google's `g_csrf_token` double-submit cookie, which\n        // FedCM mode no longer sets.\n        const required = (await this.oauth2Client.nonceSupport(provider)).web;\n        if (await this.checkIssuedNonce(userInfo, provider, required)) mark('check_nonce');\n      } else if (parsed.code) {\n        ({ clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n          provider,\n          code: parsed.code,\n        }));\n        userInfo = await this.oauth2Client.getUserInfo({ provider, clientId, token });\n      } else {\n        throw invalidArgument('INVALID_ARGUMENT', 'credential or code is required');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  // ---- email -----------------------------------------------------------------------------------\n\n  sendEmailVerificationCode = (request: Request, sender: EmailSender): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.turnstileSecretKey, 'turnstileSecretKey is not configured');\n      const { email, turnstileToken } = parse(\n        sendEmailVerificationCodeSchema,\n        await readJson(request)\n      );\n      await verifyTurnstileToken(this.turnstileSecretKey, turnstileToken);\n      await this.emailCodes.send(email, sender);\n      return Response.json({});\n    });\n\n  verifyEmailCode = (email: string, verificationCode: string): Promise<void> =>\n    this.emailCodes.verify(email, verificationCode);\n\n  loginEmail = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      const { setTiming } = timing({ enabled: this.timing });\n      const {\n        email,\n        verificationCode,\n        attributes = {},\n      } = parse(loginEmailSchema, await readJson(request));\n      await this.emailCodes.verify(email, verificationCode);\n      const claims: StandardClaims = { sub: email, email, email_verified: true };\n      return this.authorize(\n        request,\n        handler,\n        { provider: 'EMAIL', userInfo: { claims, data: {} }, attributes },\n        setTiming\n      );\n    });\n\n  // ---- desktop ---------------------------------------------------------------------------------\n\n  /**\n   * Step 1 of the desktop / native app sign-in handshake. The caller already completed normal\n   * sign-in on the web (so a cookie session exists); this issues a 5-minute single-use code that\n   * the web page hands off to the desktop client via a loopback redirect.\n   *\n   * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier` before opening the\n   * browser, derives `code_challenge = base64url(sha256(verifier))`, and threads the challenge\n   * through the URL → web page → here. The challenge is pinned to the code; `desktopExchange`\n   * enforces that the caller knows the matching verifier. This blocks an attacker who only\n   * intercepts the auth code (browser history, malicious extension, packet capture on loopback)\n   * from exchanging it.\n   *\n   * Requires an authenticated cookie session: anonymous callers get 401. Throttling / abuse\n   * protection on this endpoint is the API layer's job (rate-limit per principal); the SDK does\n   * not gate it because the upstream sign-in flow already passed CAPTCHA / OAuth / verification.\n   */\n  desktopAuthorize = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const principal = await this.getPrincipal(request);\n      if (!principal) throw unauthenticated('Sign in first');\n      const { code_challenge } = parse(desktopAuthorizeSchema, await readJson(request));\n      const code = await this.desktopCodes.issue(principal, code_challenge);\n      return Response.json({ code });\n    });\n\n  /**\n   * Step 2 of the desktop / native app sign-in handshake. The desktop client hands back the auth\n   * code it received via the loopback callback, and we mint a fresh session for it, independent\n   * of the web cookie session that originally authorized the code, so logging out on either side\n   * does not cascade to the other.\n   *\n   * Cookie attributes: `SameSite=None; Secure` so the cookie survives cross-site fetches from the\n   * desktop renderer's `file://` / `app://` origin. The configured `cookieOptions` provide\n   * everything else (`domain`, `path`, `httpOnly`); the override is targeted at the\n   * SameSite/Secure pair only. In a non-HTTPS dev backend this combination is rejected by\n   * Chromium, see the desktop sign-in PRD for workarounds.\n   *\n   * No CSRF check needed: the request carries no cookie, the auth code itself is the credential,\n   * and the code's single-use removal blocks replay.\n   */\n  desktopExchange = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const { code, code_verifier } = parse(desktopExchangeSchema, await readJson(request));\n      const principal = await this.desktopCodes.redeem(code, code_verifier);\n      const session = await this.signIn(principal);\n      session.setAttribute('client_type', 'desktop');\n      await this.repository.save(session);\n      return this.withSession(Response.json({ ok: true }), session, {\n        sameSite: 'none',\n        secure: true,\n      });\n    });\n\n  // ---- session management ----------------------------------------------------------------------\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  /**\n   * Sliding expiration: an authenticated request renews the session, as `logged` does, so a user\n   * who keeps using the app is never signed out after `maxInactiveInterval` of not calling one\n   * particular endpoint. No extra read: the session was just loaded to authenticate, and its\n   * `lastAccessedTime` is compared in memory; writes are spaced by `session.touchInterval` (see\n   * `AuthConfig`), so a session accessed again within the interval is not rewritten.\n   */\n  private async touch(session: Session) {\n    const now = Date.now();\n    if (now - session.getLastAccessedTime() < this.touchInterval) return;\n    session.setLastAccessedTime(now);\n    await this.repository.save(session);\n  }\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const session = await this.loadSession(request);\n    const principal = session && this.principalOf(session);\n    if (!principal) return null;\n    await this.touch(session);\n    return principal;\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    return (await this.getPrincipal(request)) !== null;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    type Result = T extends true ? Session : Session | null;\n    const session = await this.loadSession(request);\n    if (session || !create) return session as Result;\n    const created = this.repository.createSession();\n    await this.repository.save(created);\n    return created;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiDA,MAAM,cAAc;AAIpB,MAAM,uBAAuB;;AAG7B,MAAM,iBAAiB;;AAGvB,MAAM,uBAAuB;AAI7B,MAAM,+BAA+B;;AAGrC,SAAS,cAAc,OAAe,UAA4C;CAChF,OAAO,uBAAuB,KAAK,IAAI,QAAQ;AACjD;;;;;;;AAQA,MAAM,uCAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;AAED,SAAS,wBACP,YACoC;CACpC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAE1C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAE9C,MAAM,OAAO,eAAe,OAAO;CACnC,UACE,QAAQ,sBACR,uCAAuC,KAAK,kBAAkB,qBAAqB,SACrF;CACA,OAAO;AACT;;AAGA,SAAS,WAAW,SAAkB;CACpC,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY;CACrE,OACE,QAAQ,WAAW,UAAU,CAAC,CAAC,aAAa,WAAW,mCAAmC;AAE9F;;AAGA,MAAM,mBAAmB,OAAO,oBAAoB,EAAE,YAAY,iBAAiB,CAAC;AAEpF,MAAM,yBAAyB,OAAO;CACpC,gBAAgB,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC;CACjD,uBAAuB,QAAQ,MAAM;AACvC,CAAC;AAED,MAAM,wBAAwB,OAAO;CACnC,MAAM,OAAO;CACb,eAAe,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC;AAClD,CAAC;AAED,MAAa,OAAO;CAClB,MAAM;CACN,QAAQ;CACR,QAAQ;CAER,cAAc;CACd,cAAc;CACd,sBAAsB;CACtB,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CAErB,aAAa;CACb,8BAA8B;CAS9B,mBAAmB;CACnB,kBAAkB;CAElB,0BAA0B;AAC5B;;;;;;;;AASA,IAAa,OAAb,MAAyC;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;CAEA;CACA;CACA;CACA,oCAAqD;CAErD,YAAY,EACV,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACa;EACb,KAAK,SAAS,UAAU;EACxB,KAAK,KAAK;EACV,KAAK,aAAa;EAClB,KAAK,qBAAqB;EAC1B,MAAM,cAAc,kBAAkB,eAAe;EACrD,MAAM,iBAAiB,kBAAkB,kBAAkB;EAC3D,UAAU,eAAe,GAAG,iDAAiD;EAC7E,UAAU,kBAAkB,GAAG,2DAA2D;EAC1F,KAAK,aAAa,IAAI,uBAAuB,cAAc;GAAE;GAAa;EAAe,CAAC;EAC1F,KAAK,eAAe,IAAI,aAAa,YAAY;EACjD,MAAM,EAAE,MAAM,GAAG,kBAAkB,UAAU,CAAC;EAC9C,KAAK,aAAa,QAAQ;EAC1B,KAAK,gBAAgB;GACnB,MAAM;GACN,UAAU;GACV,QAAQ;GACR,UAAU;GACV,GAAG;EACL;EACA,KAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;EACvE,KAAK,gBAAgB,IAAI,IAAI,QAAQ,OAAO,QAAQ;EACpD,KAAK,iBAAiB,SAAS,iBAAiB,QAAQ;EACxD,KAAK,gBAAgB,SAAS,UAAU;EACxC,UAAU,KAAK,iBAAiB,GAAG,4CAA4C;CACjF;CAIA,aAAqB,SAAsC;EACzD,MAAM,aAAa,UAAU,SAAS,KAAK,UAAU;EACrD,IAAI,YAAY,OAAO;EACvB,OAAQ,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,cAAc,KAAM,KAAA;CACxE;;CAGA,MAAc,YAAY,SAA2C;EACnE,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,OAAO,YAAY,KAAK,WAAW,SAAS,SAAS,IAAI;CAC3D;;CAGA,YAAoB,SAAoC;EACtD,MAAM,OAAO,QAAQ,aAAa,yBAAyB;EAC3D,OAAO,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI;CACzC;;;;;;;;CASA,MAAc,OAAO,WAAsB,WAAuC;EAChF,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,KAAK,MAAM,aAAa,WAAW,kBAAkB,KAAK,CAAC,GAAG;GAC5D,IAAI,cAAc,KAAK,mCAAmC;GAC1D,IAAI,cAAA,iBAAyC;GAC7C,MAAM,QAAQ,WAAW,aAAa,SAAS;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,QAAQ,aAAa,WAAW,KAAK;EAClF;EACA,QAAQ,aAAa,2BAA2B,UAAU,IAAI;EAC9D,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;;;;;CAMA,YAAoB,UAAoB,SAAkB,QAAkC;EAC1F,MAAM,SAAS,QAAQ,uBAAuB;EAC9C,UAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG;GACpD,GAAG,KAAK;GACR,GAAG;GACH;EACF,CAAC;EACD,IAAI,KAAK,eAAe,SAAS,QAAQ,IAAI,gBAAgB,QAAQ,MAAM,CAAC;EAC5E,OAAO;CACT;;CAGA,MAAc,MAAM,KAAiD;EACnE,IAAI;GACF,OAAO,MAAM,IAAI;EACnB,SAAS,OAAO;GACd,MAAM,WAAW,cAAc,KAAK;GACpC,IAAI,UAAU,OAAO;GACrB,MAAM;EACR;CACF;;CAGA,SACE,OACA,aACA,SACU;EACV,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;EAE9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,GAC/D,IAAI,CAAC,IAAI,aAAa,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAEjE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,aACF,IAAI,aAAa,IAAI,qBAAqB,YAAY,MAAM,GAAG,4BAA4B,CAAC;EAE9F,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EAC1D,OAAO,SAAS,SAAS,IAAI,MAAM,GAAG;CACxC;CAIA,OAAO,OAAO,aAAyC;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,WAAW,SAAS,KAAK;GAC7B;GACA,eAAe;GACf,YAAY;EACd,CAAC;EAGD,UAAU,UAAU,cAAc,OAAO;GACvC,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,KAAK,cAAc;EAC7B,CAAC;EACD,OAAO;CACT;CAEA,SAAS,OAAO,YAAwC;EACtD,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,IAAI,WAAW,MAAM,KAAK,WAAW,WAAW,SAAS;EACzD,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC;EAGjC,aAAa,UAAU,KAAK,YAAY,KAAK,aAAa;EAC1D,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,aAAgD;EAChF,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;EAElD,QAAQ,oBAAoB,KAAK,IAAI,CAAC;EACtC,MAAM,KAAK,WAAW,KAAK,OAAO;EAElC,MAAM,YAAY,KAAK,YAAY,OAAO;EAC1C,IAAI,WAAW,MAAM,WAAW,SAAS;EACzC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,OAAO;CAC9E;CAIA,uBAA+C;EAE7C,MAAM,gBAAgB,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EAM1D,OAAO;GAAE;GAAe,gBALD,WAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,CAAC,CACR,SAAS,WAEyB;GAAG,uBAAuB;EAAO;CACxE;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;;;;;;CAOA,MAAc,aAAa,OAAe,UAAiC;EACzE,MAAM,MAAM,KAAK,kBAAkB,KAAK;EACxC,IAAK,MAAM,KAAK,GAAG,QAAQ,GAAG,MAAO,UAAU,MAAM,IAAI,oBAAoB,gBAAgB;EAC7F,MAAM,KAAK,GAAG,WAAW,GAAG;CAC9B;;;;;;;;CASA,MAAc,iBACZ,UACA,UACA,UACkB;EAClB,MAAM,EAAE,UAAU,SAAS;EAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;GACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;GACvC,OAAO;EACT;EACA,IAAI,YAAY,CAAC,KAAK,cAAc,IAAI,QAAQ,GAC9C,MAAM,IAAI,oBAAoB,eAAe;EAE/C,OAAO;CACT;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,uBACE,SACA,YAEA,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,aAAa,wBAAwB,SAAS,UAAU;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,oBAAoB;EAC7D,MAAM,QAAQ,WAAW;EACzB,MAAM,OAAO,KAAK,qBAAqB;EAGvC,MAAM,SAAS,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG,MAAM,WAAW,IAAI,KAAA;EACpF,MAAM,MAAM,MAAM,KAAK,aAAa,uBAAuB;GAAE;GAAU;GAAO;GAAM;EAAM,CAAC;EAC3F,IAAI,UAAU,MAAM,KAAK,YAAY,OAAO;EAC5C,IAAI,CAAC,SAAS;GAGZ,UAAU,KAAK,WAAW,cAAc;GACxC,QAAQ,uBAAuB,oBAAoB;EACrD;EACA,KAAK,eAAe;EAEpB,MAAM,uBAAmD;GACvD;GACA;GACA,yBAAyB,IAAI;GAC7B,sBAAsB;GACtB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;GACzB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC;EACA,QAAQ,aACN,KAAK,mCACL,KAAK,UAAU,oBAAoB,CACrC;EACA,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,KAAK,cAAc;EAEnB,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C,CAAC;CAEH,kBAAkB,OAAO,SAAkB,YAAkD;EAC3F,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAG3D,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,mBAAmB,mBAAmB;EACzE,KAAK,cAAc;EACnB,MAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;EACxE,IAAI,CAAC,MAAM,OAAO,KAAK,SAAS,mBAAmB,iCAAiC;EACpF,MAAM,SAAqC,KAAK,MAAM,IAAI;EAG1D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,iBAAiB;EAC1D,MAAM,OAAO,WAAW,OAAO,IAC3B,OAAO,YAAY,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC,CAAC,IAC5D,MAAM,OAAO;EACjB,MAAM,SAAS,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EAOrF,IAAI,OAAO,KAAK,OAAO;GACrB,IAAI,OAAO,KAAK,SAAS,OAAO,KAAK,UAAU,OAAO,OACpD,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;GAEnE,OAAO,KAAK,SACV,cAAc,OAAO,KAAK,OAAO,cAAc,GAC/C,OAAO,KAAK,iBACd;EACF;EACA,MAAM,EAAE,MAAM,OAAO,SAAS,OAAO;EACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EACrF,IAAI,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;EAC7F,IAAI,aAAa,OAAO,UACtB,OAAO,KAAK,SAAS,mBAAmB,4BAA4B;EAEtE,KAAK,kBAAkB;EAKvB,IAAI;EACJ,IAAI;GACF,MAAM,EAAE,UAAU,UAAU,MAAM,KAAK,aAAa,0BAA0B;IAC5E;IACA;IACA,MAAM,OAAO;GACf,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,aAAa,YAAY;IACnD;IACA;IACA;IACA,UAAU,OAAO,EAAE,KAAK,IAAI,KAAA;GAC9B,CAAC;GACD,KAAK,eAAe;GAIpB,IAAI,OAAO,SAAS,MAAM,UAAU;IAClC,MAAM,EAAE,UAAU,SAAS;IAC3B,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,MAAM,IAAI,oBAAoB,eAAe;IACtF,IAAI,UAAU,OAAO,OAAO,MAAM,IAAI,oBAAoB,gBAAgB;IAC1E,KAAK,aAAa;GACpB;GAEA,MAAM,YAAY,MAAM,QAAQ,SAAS;IACvC;IACA;IACA;IACA;IACA,YAAY,OAAO,cAAc,CAAC;GACpC,CAAC;GACD,KAAK,gBAAgB;GAErB,WAAW,MAAM,KAAK,OAAO,WAAW,OAAO;GAC/C,MAAM,KAAK,WAAW,WAAW,QAAQ,MAAM,CAAC;GAChD,KAAK,gBAAgB;EACvB,SAAS,OAAO;GAGd,IAAI,iBAAiB,aAAa;IAChC,QAAQ,KAAK,0BAA0B,KAAK;IAC5C,MAAM,OAAO,qBAAqB,IAAI,MAAM,KAAK,IAAI,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,IAAI;GAC3B;GAGA,IAAI,iBAAiB,qBAAqB;IACxC,QAAQ,KAAK,0BAA0B,MAAM,QAAQ,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,iBAAiB,KAAA,GAAW,KAAK;GACxD;GACA,QAAQ,MAAM,0BAA0B,KAAK;GAC7C,OAAO,KAAK,SAAS,cAAc;EACrC;EAEA,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,UAAU;EAChD,IAAI,aAAa,IAAI,UAAU,SAAS;EACxC,IAAI,aAAa,IAAI,YAAY,QAAQ;EACzC,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,QAAQ;CAC5C;;CAGA,MAAc,UACZ,SACA,SACA,eACA,WACmB;EACnB,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa;EACtD,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,MAAM,WAAW,SAAS,KAAK,SAAS;EACxC,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;CAEA,qBAAqB,SAAkB,YACrC,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,mBAAmB;EAC5D,MAAM,OAAO,MAAM,SAAS,OAAO;EAEnC,MAAM,aAAa,eAAe,IAAI;EAEtC,MAAM,EAAE,YAAY,GAAG,GAAG,gBAAgB;EAC1C,MAAM,EAAE,kBAAkB;EAC1B,IACE,kBAAkB,KAAA,MACjB,OAAO,kBAAkB,YAAY,CAAC,qBAAqB,KAAK,aAAa,IAE9E,MAAM,gBACJ,yBACA,8DACF;EAEF,MAAM,EAAE,UAAU,UAAU,UAAU,MAAM,KAAK,aAAa,kBAAkB;GAC9E;GACA;EACF,CAAC;EACD,KAAK,qBAAqB;EAI1B,MAAM,YAAY,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG,UAAU,CAAC,CAAC,MAAM;EACpF,IAAI,MAAM,KAAK,iBAAiB,UAAU,UAAU,QAAQ,GAAG,KAAK,aAAa;EAEjF,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAEH,qBACE,SACA,SACA,WAAW,aAEX,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAI3D,MAAM,QADc,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAClC,SAAS,kBAAkB,IAChD,MAAM,SAAS,OAAO,IACtB,MAAM,SAAS,OAAO;EAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,GAAG,WAAW,MAAM,kBAAkB,IAAI;EAGnE,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,YAAY;GACrB,CAAC,CAAE,UAAU,OAAO,YAAa,MAAM,KAAK,aAAa,aAAa;IACpE;IACA,YAAY,OAAO;GACrB,CAAC;GACD,KAAK,mBAAmB;GAKxB,MAAM,YAAY,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG;GAClE,IAAI,MAAM,KAAK,iBAAiB,UAAU,UAAU,QAAQ,GAAG,KAAK,aAAa;EACnF,OAAO,IAAI,OAAO,MAAM;GACtB,CAAC,CAAE,UAAU,SAAU,MAAM,KAAK,aAAa,0BAA0B;IACvE;IACA,MAAM,OAAO;GACf,CAAC;GACD,WAAW,MAAM,KAAK,aAAa,YAAY;IAAE;IAAU;IAAU;GAAM,CAAC;EAC9E,OACE,MAAM,gBAAgB,oBAAoB,gCAAgC;EAG5E,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAIH,6BAA6B,SAAkB,WAC7C,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,oBAAoB,sCAAsC;EACzE,MAAM,EAAE,OAAO,mBAAmB,MAChC,iCACA,MAAM,SAAS,OAAO,CACxB;EACA,MAAM,qBAAqB,KAAK,oBAAoB,cAAc;EAClE,MAAM,KAAK,WAAW,KAAK,OAAO,MAAM;EACxC,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB,CAAC;CAEH,mBAAmB,OAAe,qBAChC,KAAK,WAAW,OAAO,OAAO,gBAAgB;CAEhD,cAAc,SAAkB,YAC9B,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EACrD,MAAM,EACJ,OACA,kBACA,aAAa,CAAC,MACZ,MAAM,kBAAkB,MAAM,SAAS,OAAO,CAAC;EACnD,MAAM,KAAK,WAAW,OAAO,OAAO,gBAAgB;EACpD,MAAM,SAAyB;GAAE,KAAK;GAAO;GAAO,gBAAgB;EAAK;EACzE,OAAO,KAAK,UACV,SACA,SACA;GAAE,UAAU;GAAS,UAAU;IAAE;IAAQ,MAAM,CAAC;GAAE;GAAG;EAAW,GAChE,SACF;CACF,CAAC;;;;;;;;;;;;;;;;;CAoBH,oBAAoB,YAClB,KAAK,MAAM,YAAY;EACrB,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO;EACjD,IAAI,CAAC,WAAW,MAAM,gBAAgB,eAAe;EACrD,MAAM,EAAE,mBAAmB,MAAM,wBAAwB,MAAM,SAAS,OAAO,CAAC;EAChF,MAAM,OAAO,MAAM,KAAK,aAAa,MAAM,WAAW,cAAc;EACpE,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;CAC/B,CAAC;;;;;;;;;;;;;;;;CAiBH,mBAAmB,YACjB,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,MAAM,kBAAkB,MAAM,uBAAuB,MAAM,SAAS,OAAO,CAAC;EACpF,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO,MAAM,aAAa;EACpE,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,QAAQ,aAAa,eAAe,SAAS;EAC7C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,SAAS;GAC5D,UAAU;GACV,QAAQ;EACV,CAAC;CACH,CAAC;CAIH,OAAO,OAAO,cAAwC;EACpD,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,KAAK,MAAM,aAAa,SAAS,KAAK,GACpC,MAAM,KAAK,WAAW,WAAW,SAAS;CAE9C;;;;;;;;CASA,MAAc,MAAM,SAAkB;EACpC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,QAAQ,oBAAoB,IAAI,KAAK,eAAe;EAC9D,QAAQ,oBAAoB,GAAG;EAC/B,MAAM,KAAK,WAAW,KAAK,OAAO;CACpC;CAEA,eAAe,OAAO,YAAgD;EACpE,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;EACrD,IAAI,CAAC,WAAW,OAAO;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,OAAO;CACT;CAEA,kBAAkB,OAAO,YAAuC;EAC9D,OAAQ,MAAM,KAAK,aAAa,OAAO,MAAO;CAChD;CAEA,aAAa,OACX,SACA,WACuD;EAEvD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,WAAW,CAAC,QAAQ,OAAO;EAC/B,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;CAEA,gBAAgB,OAAO,cAAqC;EAC1D,MAAM,KAAK,WAAW,WAAW,SAAS;CAC5C;CAEA,eAAe,OAAO,cAA6C;EACjE,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;CACrC;CAEA,yBAAyB,OAAO,iBAA6C;EAC3E,MAAM,KAAK,WAAW,uBAAuB,YAAY;EACzD,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { createHash, randomBytes, randomUUID } from 'node:crypto';\nimport { invariant } from '@shware/utils';\nimport { extend, literal, object, regex, string } from 'zod/mini';\nimport type { Principal } from '../core/index';\nimport { loginEmailSchema, sendEmailVerificationCodeSchema } from '../email/schema';\nimport { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema } from '../oauth2/client';\nimport { OAuth2Error, type OAuth2ErrorType, isKnownOAuth2ErrorType } from '../oauth2/error';\nimport type {\n  NativeCredential,\n  OAuth2AuthorizationRequest,\n  PkceParameters,\n  StandardClaims,\n} from '../oauth2/types';\nimport { PRINCIPAL_NAME_INDEX_NAME } from '../session/common';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport {\n  type CookieOptions,\n  deleteCookie,\n  getCookie,\n  param,\n  query,\n  setCookie,\n} from '../utils/http';\nimport { timing } from '../utils/timing';\nimport { parse, readForm, readJson, verifyTurnstileToken } from '../utils/valid';\nimport {\n  MAX_ATTRIBUTES_BYTES,\n  attributesSchema,\n  attributesSize,\n  bodyAttributes,\n} from './attributes';\nimport { DesktopCodes } from './desktop-codes';\nimport { type EmailSender, EmailVerificationCodes } from './email-codes';\nimport { AuthenticationError } from './error';\nimport { errorResponse, invalidArgument, unauthenticated } from './respond';\nimport type {\n  AuthConfig,\n  AuthService,\n  Authorization,\n  AuthorizedHandler,\n  LoggedHandler,\n  LogoutOptions,\n  OAuth2AuthorizationOptions,\n} from './types';\n\n// PKCE per RFC 7636: code_verifier / code_challenge are 43-128 chars from\n// the unreserved set. We restrict to base64url (drops \".\" and \"~\") since\n// that's what S256 produces and what callers should be sending; rejecting\n// the rest shrinks the accepted input shape without losing legit clients.\n// A 32-byte random verifier base64url-encodes to exactly 43 chars.\nconst PKCE_FORMAT = /^[A-Za-z0-9_-]{43,128}$/;\n\n// A native app's `code_verifier` goes on to the provider, which checks it against the challenge\n// the app sent: accept the whole RFC 7636 unreserved set here, as the provider does.\nconst CODE_VERIFIER_FORMAT = /^[A-Za-z0-9._~-]{43,128}$/;\n\n/** The header a session id travels in besides the cookie, with `session.header` on. */\nconst SESSION_HEADER = 'X-Auth-Token';\n\n/** Seconds an OAuth2 state or nonce may be used within. */\nconst OAUTH2_PARAMETER_TTL = 10 * 60;\n\n// error_description forwarded to errorUri comes from the provider or an error message: cap it so\n// the redirect URL stays short and an attacker-crafted callback cannot stuff the page with text.\nconst MAX_ERROR_DESCRIPTION_LENGTH = 256;\n\n/** An error code safe to put on errorUri: a registered one as is, anything else as `fallback`. */\nfunction safeErrorType(error: string, fallback: OAuth2ErrorType): OAuth2ErrorType {\n  return isKnownOAuth2ErrorType(error) ? error : fallback;\n}\n\n/**\n * The codes a failure past validation keeps on errorUri, each one the user can act on: the code\n * expired or was used (start again), they declined, or the provider is briefly down. Every other\n * failure there (a rejected client, a user info request that failed) is the app's or the\n * provider's problem, which the user sees as `server_error`.\n */\nconst CALLBACK_ERROR_TYPES: ReadonlySet<OAuth2ErrorType> = new Set([\n  'invalid_grant',\n  'access_denied',\n  'temporarily_unavailable',\n]);\n\nfunction authorizationAttributes(\n  attributes: OAuth2AuthorizationOptions['attributes']\n): Record<string, string> | undefined {\n  if (!attributes) return undefined;\n  const defined: Record<string, string> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    if (value !== undefined) defined[key] = value;\n  }\n  if (Object.keys(defined).length === 0) return undefined;\n  // The host's own values, written with the session: oversized is a bug in the host, not a 400.\n  const size = attributesSize(defined);\n  invariant(\n    size <= MAX_ATTRIBUTES_BYTES,\n    `oauth2 authorization attributes are ${size} bytes, at most ${MAX_ATTRIBUTES_BYTES} allowed`\n  );\n  return defined;\n}\n\n/** Sign in with Apple answers with `response_mode=form_post`; a charset parameter may follow. */\nfunction isFormPost(request: Request) {\n  const contentType = request.headers.get('content-type')?.toLowerCase();\n  return (\n    request.method === 'POST' && !!contentType?.startsWith('application/x-www-form-urlencoded')\n  );\n}\n\n/** Google's own form post carries no attributes; an app posting JSON may add them. */\nconst oneTapBodySchema = extend(googleOneTapSchema, { attributes: attributesSchema });\n\nconst desktopAuthorizeSchema = object({\n  code_challenge: string().check(regex(PKCE_FORMAT)),\n  code_challenge_method: literal('S256'),\n});\n\nconst desktopExchangeSchema = object({\n  code: string(),\n  code_verifier: string().check(regex(PKCE_FORMAT)),\n});\n\nexport const PATH = {\n  CSRF: '/csrf',\n  LOGOUT: '/logout',\n  LOGGED: '/logged',\n\n  OAUTH2_STATE: '/oauth2/state/:provider',\n  OAUTH2_NONCE: '/oauth2/nonce/:provider',\n  OAUTH2_AUTHORIZATION: '/oauth2/authorization/:provider',\n  LOGIN_OAUTH2_CODE: '/login/oauth2/code/:provider',\n  LOGIN_OAUTH2_NATIVE: '/login/oauth2/native/:provider',\n  LOGIN_OAUTH2_ONETAP: '/login/oauth2/onetap/google',\n\n  LOGIN_EMAIL: '/login/email',\n  SEND_EMAIL_VERIFICATION_CODE: '/auth/sendEmailVerificationCode',\n\n  // Desktop / native app sign-in via web loopback (RFC 8252 + OAuth 2.1 Auth Code Flow):\n  //   1. user already authenticated with cookie session → POST DESKTOP_AUTHORIZE → { code }\n  //   2. web redirects to desktop's loopback callback with the code\n  //   3. desktop renderer POSTs DESKTOP_EXCHANGE with the code → server returns\n  //      Set-Cookie carrying a fresh session, single-use code is invalidated\n  // The two-step flow keeps the actual session id off the redirect URL — only a\n  // 5-minute single-use code transits via the loopback.\n  DESKTOP_AUTHORIZE: '/auth/desktop/authorize',\n  DESKTOP_EXCHANGE: '/auth/desktop/exchange',\n\n  CLEANUP_EXPIRED_SESSIONS: '/sessions/expired/cleanup',\n} as const;\n\n/**\n * The login routes and session helpers. Every route is one straight line: read and validate the\n * request, check the credential, call the host's `onAuthorized`, sign in. Failures are thrown and\n * answered in one place per kind of route: a JSON route runs under `guard`, which maps a\n * `RequestError`, an `AuthenticationError` or an `OAuth2Error` to its google.rpc body (see\n * `respond.ts`); the redirect callback maps the same errors to `errorUri` parameters (`redirect`).\n */\nexport class Auth implements AuthService {\n  private readonly timing: boolean;\n  private readonly cookieName;\n  private readonly cookieOptions: CookieOptions;\n  private readonly kv: KVRepository;\n  private readonly repository: SessionRepository;\n  private readonly turnstileSecretKey?: string;\n  private readonly emailCodes: EmailVerificationCodes;\n  private readonly desktopCodes: DesktopCodes;\n  private readonly oauth2Client: OAuth2Client | null;\n  /** Provider keys whose logins may come without a nonce (`oauth2.nonce.optional`). */\n  private readonly nonceOptional: ReadonlySet<string>;\n  private readonly touchInterval: number;\n  private readonly sessionHeader: boolean;\n  private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST = 'oauth2AuthorizationRequest';\n\n  constructor({\n    sessionRepository,\n    kvRepository,\n    turnstileSecretKey,\n    verificationCode,\n    oauth2,\n    cookie,\n    session,\n    timing,\n  }: AuthConfig) {\n    this.timing = timing ?? false;\n    this.kv = kvRepository;\n    this.repository = sessionRepository;\n    this.turnstileSecretKey = turnstileSecretKey;\n    const maxAttempts = verificationCode?.maxAttempts ?? 5;\n    const resendCooldown = verificationCode?.resendCooldown ?? 60;\n    invariant(maxAttempts >= 1, 'verificationCode.maxAttempts must be at least 1');\n    invariant(resendCooldown >= 1, 'verificationCode.resendCooldown must be at least 1 second');\n    this.emailCodes = new EmailVerificationCodes(kvRepository, { maxAttempts, resendCooldown });\n    this.desktopCodes = new DesktopCodes(kvRepository);\n    const { name, ...cookieOptions } = cookie ?? {};\n    this.cookieName = name ?? 'SESSION';\n    this.cookieOptions = {\n      path: '/',\n      sameSite: 'none',\n      secure: true,\n      httpOnly: true,\n      ...cookieOptions,\n    };\n    this.oauth2Client = oauth2?.client ? new OAuth2Client(oauth2.client) : null;\n    this.nonceOptional = new Set(oauth2?.nonce?.optional);\n    this.touchInterval = (session?.touchInterval ?? 3600) * 1000;\n    this.sessionHeader = session?.header ?? false;\n    invariant(this.touchInterval >= 0, 'session.touchInterval must not be negative');\n  }\n\n  // ---- sessions and responses ------------------------------------------------------------------\n\n  private getSessionId(request: Request): string | undefined {\n    const fromCookie = getCookie(request, this.cookieName);\n    if (fromCookie) return fromCookie;\n    return (this.sessionHeader && request.headers.get(SESSION_HEADER)) || undefined;\n  }\n\n  /** The session the request carries, if it exists. */\n  private async loadSession(request: Request): Promise<Session | null> {\n    const sessionId = this.getSessionId(request);\n    return sessionId ? this.repository.findById(sessionId) : null;\n  }\n\n  /** The signed-in principal of a session, if any. */\n  private principalOf(session: Session): Principal | null {\n    const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n    return name ? { name: String(name) } : null;\n  }\n\n  /**\n   * A new session signed in as `principal`. With `carryOver`, what the host kept in the pre-login\n   * session moves to the new one; the authorization request (state, PKCE verifier, flow\n   * attributes) is single-use and was consumed, and a principal left there from an earlier\n   * sign-in is replaced. The new id is never the one the browser brought, which may have been\n   * planted by an attacker who started the flow (session fixation).\n   */\n  private async signIn(principal: Principal, carryOver?: Session): Promise<Session> {\n    const session = this.repository.createSession();\n    for (const attribute of carryOver?.getAttributeNames() ?? []) {\n      if (attribute === this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) continue;\n      if (attribute === PRINCIPAL_NAME_INDEX_NAME) continue;\n      const value = carryOver?.getAttribute(attribute);\n      if (value !== null && value !== undefined) session.setAttribute(attribute, value);\n    }\n    session.setAttribute(PRINCIPAL_NAME_INDEX_NAME, principal.name);\n    await this.repository.save(session);\n    return session;\n  }\n\n  /**\n   * `response` carrying `session`: its cookie, renewed for the whole inactive interval, and with\n   * `session.header` on, the `X-Auth-Token` header a client without a cookie jar reads.\n   */\n  private withSession(response: Response, session: Session, cookie?: CookieOptions): Response {\n    const maxAge = session.getMaxInactiveInterval();\n    setCookie(response, this.cookieName, session.getId(), {\n      ...this.cookieOptions,\n      ...cookie,\n      maxAge,\n    });\n    if (this.sessionHeader) response.headers.set(SESSION_HEADER, session.getId());\n    return response;\n  }\n\n  /** Runs a JSON route: a failure it knows is its response, anything else is the host's. */\n  private async guard(run: () => Promise<Response>): Promise<Response> {\n    try {\n      return await run();\n    } catch (error) {\n      const response = errorResponse(error);\n      if (response) return response;\n      throw error;\n    }\n  }\n\n  /** The error redirect of the callback flow; `refusal`'s reason and metadata ride along. */\n  private redirect(\n    error: OAuth2ErrorType,\n    description?: string,\n    refusal?: AuthenticationError\n  ): Response {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const uri = new URL(this.oauth2Client.errorUri);\n    // Metadata never replaces a parameter: not one errorUri carries itself, nor one set below.\n    for (const [key, value] of Object.entries(refusal?.metadata ?? {})) {\n      if (!uri.searchParams.has(key)) uri.searchParams.set(key, value);\n    }\n    uri.searchParams.set('error', error);\n    if (description) {\n      uri.searchParams.set('error_description', description.slice(0, MAX_ERROR_DESCRIPTION_LENGTH));\n    }\n    if (refusal) uri.searchParams.set('reason', refusal.reason);\n    return Response.redirect(uri.href, 302);\n  }\n\n  // ---- basic -----------------------------------------------------------------------------------\n\n  csrf = async (_request: Request): Promise<Response> => {\n    const token = randomUUID();\n    const response = Response.json({\n      token,\n      parameterName: '_csrf',\n      headerName: 'X-XSRF-TOKEN',\n    });\n\n    // Double Submit Cookie Protection\n    setCookie(response, 'XSRF-TOKEN', token, {\n      path: '/',\n      secure: true,\n      httpOnly: false,\n      sameSite: 'none',\n      domain: this.cookieOptions.domain,\n    });\n    return response;\n  };\n\n  logout = async (request: Request, options?: LogoutOptions): Promise<Response> => {\n    const scope = options?.scope ?? 'local';\n    const sessionId = this.getSessionId(request);\n    // `global` and `others` reach the principal's other sessions through the one the request\n    // carries; a request without a signed-in session has no principal to widen to, and ends as\n    // `local` would.\n    if (scope !== 'local' && sessionId) {\n      const session = await this.repository.findById(sessionId);\n      const principal = session && this.principalOf(session);\n      if (principal) {\n        const sessions = await this.repository.findByPrincipalName(principal.name);\n        for (const id of sessions.keys()) {\n          if (id !== sessionId) await this.repository.deleteById(id);\n        }\n      }\n    }\n    const response = Response.json({});\n    if (scope === 'others') return response;\n    if (sessionId) await this.repository.deleteById(sessionId);\n    // A Set-Cookie only replaces the stored cookie when Domain and Path match (RFC 6265),\n    // so clear it with the same attributes it was set with.\n    deleteCookie(response, this.cookieName, this.cookieOptions);\n    return response;\n  };\n\n  logged = async (request: Request, onLogged?: LoggedHandler): Promise<Response> => {\n    const session = await this.loadSession(request);\n    if (!session) return Response.json({ data: false });\n\n    session.setLastAccessedTime(Date.now());\n    await this.repository.save(session);\n\n    const principal = this.principalOf(session);\n    if (principal) await onLogged?.(principal);\n    return this.withSession(Response.json({ data: principal !== null }), session);\n  };\n\n  // ---- oauth2 ----------------------------------------------------------------------------------\n\n  private createPkceParameters(): PkceParameters {\n    // 32 random bytes: a 43-char base64url verifier, the RFC 7636 minimum (a UUID is 36).\n    const code_verifier = randomBytes(32).toString('base64url');\n    const code_challenge = createHash('sha256')\n      .update(code_verifier)\n      .digest()\n      .toString('base64url');\n\n    return { code_verifier, code_challenge, code_challenge_method: 'S256' };\n  }\n\n  private getOauth2StateKey(state: string) {\n    return `oauth2:state:${state}`;\n  }\n\n  private getOauth2NonceKey(nonce: string) {\n    return `oauth2:nonce:${nonce}`;\n  }\n\n  /**\n   * Spends a nonce `oauth2Nonce` issued for `provider`: `NONCE_MISMATCH` for one that was not,\n   * or was used already. An id token is replayable until it expires; the nonce it carries makes\n   * it sign in once.\n   */\n  private async consumeNonce(nonce: string, provider: string): Promise<void> {\n    const key = this.getOauth2NonceKey(nonce);\n    if ((await this.kv.getItem(key)) !== provider) throw new AuthenticationError('NONCE_MISMATCH');\n    await this.kv.removeItem(key);\n  }\n\n  /**\n   * The nonce check of the JSON logins (One Tap, native), where the client obtained the id token\n   * and the nonce came from `oauth2Nonce`: spends the one the token carries, and refuses a token\n   * without one when the provider's flow echoes nonces (`required`) and the host has not listed the\n   * provider as optional. An id token is replayable until it expires; the nonce makes it sign in\n   * once.\n   */\n  private async checkIssuedNonce(\n    userInfo: Authorization['userInfo'],\n    provider: string,\n    required: boolean\n  ): Promise<boolean> {\n    const { nonce } = userInfo.data as { nonce?: unknown };\n    if (typeof nonce === 'string' && nonce) {\n      await this.consumeNonce(nonce, provider);\n      return true;\n    }\n    if (required && !this.nonceOptional.has(provider)) {\n      throw new AuthenticationError('NONCE_MISSING');\n    }\n    return false;\n  }\n\n  oauth2State = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_STATE);\n    const state = randomUUID();\n    await this.kv.setItem(this.getOauth2StateKey(state), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ state });\n  };\n\n  oauth2Nonce = async (request: Request): Promise<Response> => {\n    const { provider } = param(request, PATH.OAUTH2_NONCE);\n    const nonce = randomUUID();\n    await this.kv.setItem(this.getOauth2NonceKey(nonce), provider, OAUTH2_PARAMETER_TTL);\n    return Response.json({ nonce });\n  };\n\n  oauth2Authorization = (\n    request: Request,\n    options?: OAuth2AuthorizationOptions\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const attributes = authorizationAttributes(options?.attributes);\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.OAUTH2_AUTHORIZATION);\n      const state = randomUUID();\n      const pkce = this.createPkceParameters();\n      // Sent only to a provider whose id token echoes it: the callback then requires it back, so\n      // a code that was swapped in for another sign-in's yields a token the session refuses.\n      const nonce = (await this.oauth2Client.nonceSupport(provider)).web ? randomUUID() : undefined;\n      const uri = await this.oauth2Client.createAuthorizationUri({ provider, state, pkce, nonce });\n      let session = await this.loadSession(request);\n      if (!session) {\n        // A session made for the flow only has to outlive the state: an abandoned flow must not\n        // keep a row for the default interval. Sign-in moves to a new session, with the default.\n        session = this.repository.createSession();\n        session.setMaxInactiveInterval(OAUTH2_PARAMETER_TTL);\n      }\n      mark('fetch_session');\n\n      const authorizationRequest: OAuth2AuthorizationRequest = {\n        state,\n        provider,\n        authorizationRequestUri: uri.href,\n        additionalParameters: pkce,\n        ...(nonce ? { nonce } : {}),\n        ...(attributes ? { attributes } : {}),\n      };\n      session.setAttribute(\n        this.ATTR_OAUTH2_AUTHORIZATION_REQUEST,\n        JSON.stringify(authorizationRequest)\n      );\n      await this.repository.save(session);\n      mark('save_session');\n\n      const response = new Response(null, { status: 302, headers: { location: uri.href } });\n      setTiming(response);\n      return this.withSession(response, session);\n    });\n\n  loginOAuth2Code = async (request: Request, handler: AuthorizedHandler): Promise<Response> => {\n    invariant(this.oauth2Client, 'oauth2Client is not initialized');\n    const { mark, setTiming } = timing({ enabled: this.timing });\n\n    // 1. the session the flow started on, and the authorization request it stored\n    const session = await this.loadSession(request);\n    if (!session) return this.redirect('invalid_request', 'session not found');\n    mark('load_session');\n    const json = session.getAttribute(this.ATTR_OAUTH2_AUTHORIZATION_REQUEST) as string | null;\n    if (!json) return this.redirect('invalid_request', 'authorization request not found');\n    const cached: OAuth2AuthorizationRequest = JSON.parse(json);\n\n    // 2. the provider's answer: query, or a form for Apple's response_mode=form_post\n    const { provider } = param(request, PATH.LOGIN_OAUTH2_CODE);\n    const data = isFormPost(request)\n      ? Object.fromEntries(new URLSearchParams(await request.text()))\n      : query(request);\n    const parsed = oauth2RedirectQuerySchema.safeParse(data);\n    if (!parsed.success) return this.redirect('invalid_request', 'invalid redirect query');\n    // The provider answered with an error instead of a code (the user pressed Cancel →\n    // access_denied, invalid_scope, server_error, ...). Forward it rather than reporting a\n    // malformed query. This runs before the state check on purpose: providers echo state on\n    // error responses, but not all reliably do, and a forged error callback can only make the\n    // victim's popup show an error — nothing is exchanged or signed in. A present state that does\n    // not match still wins, since that is the more accurate (and more alarming) diagnosis.\n    if (parsed.data.error) {\n      if (parsed.data.state && parsed.data.state !== cached.state) {\n        return this.redirect('invalid_request', 'redirect state mismatch');\n      }\n      return this.redirect(\n        safeErrorType(parsed.data.error, 'server_error'),\n        parsed.data.error_description\n      );\n    }\n    const { code, state, user } = parsed.data;\n    if (!code || !state) return this.redirect('invalid_request', 'invalid redirect query');\n    if (state !== cached.state) return this.redirect('invalid_request', 'redirect state mismatch');\n    if (provider !== cached.provider) {\n      return this.redirect('invalid_request', 'redirect provider mismatch');\n    }\n    mark('validate_session');\n\n    // 3. exchange the code, load the user, sign in. Everything here can fail (an expired or reused\n    // code, a network error, the host's handler or session store). The callback runs in a popup\n    // the user is looking at, so every failure must land on errorUri, never as a JSON error.\n    let signedIn: Session;\n    try {\n      const { clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n        provider,\n        code,\n        pkce: cached.additionalParameters,\n      });\n      // Apple posts the user's name alongside the code, once: hand it to the provider with the token.\n      const userInfo = await this.oauth2Client.getUserInfo({\n        provider,\n        clientId,\n        token,\n        response: user ? { user } : undefined,\n      });\n      mark('exchange_code');\n      // The id token must carry the nonce this flow sent (stored with the state, not in KV: it\n      // is bound to this session's request). A provider that gave no id token has nothing to\n      // carry it, as has a request stored before nonces were sent.\n      if (cached.nonce && token.id_token) {\n        const { nonce } = userInfo.data as { nonce?: unknown };\n        if (typeof nonce !== 'string' || !nonce) throw new AuthenticationError('NONCE_MISSING');\n        if (nonce !== cached.nonce) throw new AuthenticationError('NONCE_MISMATCH');\n        mark('check_nonce');\n      }\n\n      const principal = await handler(request, {\n        provider,\n        clientId,\n        userInfo,\n        token,\n        attributes: cached.attributes ?? {},\n      });\n      mark('save_principal');\n\n      signedIn = await this.signIn(principal, session);\n      await this.repository.deleteById(session.getId());\n      mark('update_session');\n    } catch (error) {\n      // The details stay in the logs: an OAuth2Error message can carry a client id or a\n      // provider's response, which has no place in a URL the browser keeps in its history.\n      if (error instanceof OAuth2Error) {\n        console.warn('OAuth2 callback failed', error);\n        const type = CALLBACK_ERROR_TYPES.has(error.error) ? error.error : 'server_error';\n        return this.redirect(type);\n      }\n      // A refusal is something the user can act on, so its reason and metadata reach the page,\n      // as they reach a JSON client through the ErrorInfo.\n      if (error instanceof AuthenticationError) {\n        console.warn('OAuth2 sign-in refused', error.reason, error.metadata);\n        return this.redirect('access_denied', undefined, error);\n      }\n      console.error('OAuth2 callback failed', error);\n      return this.redirect('server_error');\n    }\n\n    const uri = new URL(this.oauth2Client.successUri);\n    uri.searchParams.set('status', 'success');\n    uri.searchParams.set('provider', provider);\n    const response = new Response(null, { status: 302, headers: { location: uri.href } });\n    setTiming(response);\n    return this.withSession(response, signedIn);\n  };\n\n  /** The shared tail of the JSON login routes: the host's handler, then a signed-in session. */\n  private async authorize(\n    request: Request,\n    handler: AuthorizedHandler,\n    authorization: Authorization,\n    setTiming: (response: Response) => void\n  ): Promise<Response> {\n    const principal = await handler(request, authorization);\n    const session = await this.signIn(principal);\n    const response = Response.json(principal);\n    setTiming(response);\n    return this.withSession(response, session);\n  }\n\n  loginOAuth2Native = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n      const { provider } = param(request, PATH.LOGIN_OAUTH2_NATIVE);\n      const body = await readJson(request);\n      // Whatever the app sends besides its credentials for `onAuthorized` (a referral code, ...).\n      const attributes = bodyAttributes(body);\n      // Only the credentials go on to the provider client.\n      const { attributes: _, ...credentials } = body as NativeCredential & { attributes?: unknown };\n      const { code_verifier } = credentials as { code_verifier?: unknown };\n      if (\n        code_verifier !== undefined &&\n        (typeof code_verifier !== 'string' || !CODE_VERIFIER_FORMAT.test(code_verifier))\n      ) {\n        throw invalidArgument(\n          'INVALID_CODE_VERIFIER',\n          'code_verifier must be 43-128 characters from [A-Za-z0-9-._~]'\n        );\n      }\n      const { clientId, userInfo, token } = await this.oauth2Client.loginOAuth2Native({\n        provider,\n        credentials,\n      });\n      mark('login_oauth2_native');\n\n      // Required when the provider's native id token echoes a nonce and the login produced one\n      // (Facebook's access_token login has none to carry it).\n      const required = (await this.oauth2Client.nonceSupport(provider)).native && !!token.id_token;\n      if (await this.checkIssuedNonce(userInfo, provider, required)) mark('check_nonce');\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  loginOAuth2Onetap = (\n    request: Request,\n    handler: AuthorizedHandler,\n    provider = 'google'\n  ): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.oauth2Client, 'oauth2Client is not initialized');\n      const { mark, setTiming } = timing({ enabled: this.timing });\n\n      // Google's own form post, or an app's JSON.\n      const contentType = request.headers.get('content-type') ?? '';\n      const body = contentType.includes('application/json')\n        ? await readJson(request)\n        : await readForm(request);\n      const { attributes = {}, ...parsed } = parse(oneTapBodySchema, body);\n\n      // Both the credential and the code are issued to the provider's web client.\n      let clientId: string;\n      let token: Authorization['token'];\n      let userInfo: Authorization['userInfo'];\n      if (parsed.credential) {\n        ({ clientId, token, userInfo } = await this.oauth2Client.getTokenInfo({\n          provider,\n          credential: parsed.credential,\n        }));\n        mark('verify_credential');\n\n        // The credential must carry a single-use nonce from `oauth2Nonce`, which the front end\n        // passed to `prompt`. This replaces Google's `g_csrf_token` double-submit cookie, which\n        // FedCM mode no longer sets.\n        const required = (await this.oauth2Client.nonceSupport(provider)).web;\n        if (await this.checkIssuedNonce(userInfo, provider, required)) mark('check_nonce');\n      } else if (parsed.code) {\n        ({ clientId, token } = await this.oauth2Client.exchangeAuthorizationCode({\n          provider,\n          code: parsed.code,\n        }));\n        userInfo = await this.oauth2Client.getUserInfo({ provider, clientId, token });\n      } else {\n        throw invalidArgument('INVALID_ARGUMENT', 'credential or code is required');\n      }\n\n      return this.authorize(\n        request,\n        handler,\n        { provider, clientId, userInfo, token, attributes },\n        setTiming\n      );\n    });\n\n  // ---- email -----------------------------------------------------------------------------------\n\n  sendEmailVerificationCode = (request: Request, sender: EmailSender): Promise<Response> =>\n    this.guard(async () => {\n      invariant(this.turnstileSecretKey, 'turnstileSecretKey is not configured');\n      const { email, turnstileToken } = parse(\n        sendEmailVerificationCodeSchema,\n        await readJson(request)\n      );\n      await verifyTurnstileToken(this.turnstileSecretKey, turnstileToken);\n      await this.emailCodes.send(email, sender);\n      return Response.json({});\n    });\n\n  verifyEmailCode = (email: string, verificationCode: string): Promise<void> =>\n    this.emailCodes.verify(email, verificationCode);\n\n  loginEmail = (request: Request, handler: AuthorizedHandler): Promise<Response> =>\n    this.guard(async () => {\n      const { setTiming } = timing({ enabled: this.timing });\n      const {\n        email,\n        verificationCode,\n        attributes = {},\n      } = parse(loginEmailSchema, await readJson(request));\n      await this.emailCodes.verify(email, verificationCode);\n      const claims: StandardClaims = { sub: email, email, email_verified: true };\n      return this.authorize(\n        request,\n        handler,\n        { provider: 'EMAIL', userInfo: { claims, data: {} }, attributes },\n        setTiming\n      );\n    });\n\n  // ---- desktop ---------------------------------------------------------------------------------\n\n  /**\n   * Step 1 of the desktop / native app sign-in handshake. The caller already completed normal\n   * sign-in on the web (so a cookie session exists); this issues a 5-minute single-use code that\n   * the web page hands off to the desktop client via a loopback redirect.\n   *\n   * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier` before opening the\n   * browser, derives `code_challenge = base64url(sha256(verifier))`, and threads the challenge\n   * through the URL → web page → here. The challenge is pinned to the code; `desktopExchange`\n   * enforces that the caller knows the matching verifier. This blocks an attacker who only\n   * intercepts the auth code (browser history, malicious extension, packet capture on loopback)\n   * from exchanging it.\n   *\n   * Requires an authenticated cookie session: anonymous callers get 401. Throttling / abuse\n   * protection on this endpoint is the API layer's job (rate-limit per principal); the SDK does\n   * not gate it because the upstream sign-in flow already passed CAPTCHA / OAuth / verification.\n   */\n  desktopAuthorize = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const principal = await this.getPrincipal(request);\n      if (!principal) throw unauthenticated('Sign in first');\n      const { code_challenge } = parse(desktopAuthorizeSchema, await readJson(request));\n      const code = await this.desktopCodes.issue(principal, code_challenge);\n      return Response.json({ code });\n    });\n\n  /**\n   * Step 2 of the desktop / native app sign-in handshake. The desktop client hands back the auth\n   * code it received via the loopback callback, and we mint a fresh session for it, independent\n   * of the web cookie session that originally authorized the code, so logging out on either side\n   * does not cascade to the other.\n   *\n   * Cookie attributes: `SameSite=None; Secure` so the cookie survives cross-site fetches from the\n   * desktop renderer's `file://` / `app://` origin. The configured `cookieOptions` provide\n   * everything else (`domain`, `path`, `httpOnly`); the override is targeted at the\n   * SameSite/Secure pair only. In a non-HTTPS dev backend this combination is rejected by\n   * Chromium, see the desktop sign-in PRD for workarounds.\n   *\n   * No CSRF check needed: the request carries no cookie, the auth code itself is the credential,\n   * and the code's single-use removal blocks replay.\n   */\n  desktopExchange = (request: Request): Promise<Response> =>\n    this.guard(async () => {\n      const { code, code_verifier } = parse(desktopExchangeSchema, await readJson(request));\n      const principal = await this.desktopCodes.redeem(code, code_verifier);\n      const session = await this.signIn(principal);\n      session.setAttribute('client_type', 'desktop');\n      await this.repository.save(session);\n      return this.withSession(Response.json({ ok: true }), session, {\n        sameSite: 'none',\n        secure: true,\n      });\n    });\n\n  // ---- session management ----------------------------------------------------------------------\n\n  kick = async (principal: Principal): Promise<void> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    for (const sessionId of sessions.keys()) {\n      await this.repository.deleteById(sessionId);\n    }\n  };\n\n  /**\n   * Sliding expiration: an authenticated request renews the session, as `logged` does, so a user\n   * who keeps using the app is never signed out after `maxInactiveInterval` of not calling one\n   * particular endpoint. No extra read: the session was just loaded to authenticate, and its\n   * `lastAccessedTime` is compared in memory; writes are spaced by `session.touchInterval` (see\n   * `AuthConfig`), so a session accessed again within the interval is not rewritten.\n   */\n  private async touch(session: Session) {\n    const now = Date.now();\n    if (now - session.getLastAccessedTime() < this.touchInterval) return;\n    session.setLastAccessedTime(now);\n    await this.repository.save(session);\n  }\n\n  getPrincipal = async (request: Request): Promise<Principal | null> => {\n    const session = await this.loadSession(request);\n    const principal = session && this.principalOf(session);\n    if (!principal) return null;\n    await this.touch(session);\n    return principal;\n  };\n\n  isAuthenticated = async (request: Request): Promise<boolean> => {\n    return (await this.getPrincipal(request)) !== null;\n  };\n\n  getSession = async <T extends boolean>(\n    request: Request,\n    create: T\n  ): Promise<T extends true ? Session : Session | null> => {\n    type Result = T extends true ? Session : Session | null;\n    const session = await this.loadSession(request);\n    if (session || !create) return session as Result;\n    const created = this.repository.createSession();\n    await this.repository.save(created);\n    return created;\n  };\n\n  deleteSession = async (sessionId: string): Promise<void> => {\n    await this.repository.deleteById(sessionId);\n  };\n\n  listSessions = async (principal: Principal): Promise<Session[]> => {\n    const sessions = await this.repository.findByPrincipalName(principal.name);\n    return Array.from(sessions.values());\n  };\n\n  cleanupExpiredSessions = async (cleanupCount?: number): Promise<Response> => {\n    await this.repository.cleanupExpiredSessions(cleanupCount);\n    return Response.json({});\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkDA,MAAM,cAAc;AAIpB,MAAM,uBAAuB;;AAG7B,MAAM,iBAAiB;;AAGvB,MAAM,uBAAuB;AAI7B,MAAM,+BAA+B;;AAGrC,SAAS,cAAc,OAAe,UAA4C;CAChF,OAAO,uBAAuB,KAAK,IAAI,QAAQ;AACjD;;;;;;;AAQA,MAAM,uCAAqD,IAAI,IAAI;CACjE;CACA;CACA;AACF,CAAC;AAED,SAAS,wBACP,YACoC;CACpC,IAAI,CAAC,YAAY,OAAO,KAAA;CACxB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAClD,IAAI,UAAU,KAAA,GAAW,QAAQ,OAAO;CAE1C,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,GAAG,OAAO,KAAA;CAE9C,MAAM,OAAO,eAAe,OAAO;CACnC,UACE,QAAQ,sBACR,uCAAuC,KAAK,kBAAkB,qBAAqB,SACrF;CACA,OAAO;AACT;;AAGA,SAAS,WAAW,SAAkB;CACpC,MAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY;CACrE,OACE,QAAQ,WAAW,UAAU,CAAC,CAAC,aAAa,WAAW,mCAAmC;AAE9F;;AAGA,MAAM,mBAAmB,OAAO,oBAAoB,EAAE,YAAY,iBAAiB,CAAC;AAEpF,MAAM,yBAAyB,OAAO;CACpC,gBAAgB,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC;CACjD,uBAAuB,QAAQ,MAAM;AACvC,CAAC;AAED,MAAM,wBAAwB,OAAO;CACnC,MAAM,OAAO;CACb,eAAe,OAAO,CAAC,CAAC,MAAM,MAAM,WAAW,CAAC;AAClD,CAAC;AAED,MAAa,OAAO;CAClB,MAAM;CACN,QAAQ;CACR,QAAQ;CAER,cAAc;CACd,cAAc;CACd,sBAAsB;CACtB,mBAAmB;CACnB,qBAAqB;CACrB,qBAAqB;CAErB,aAAa;CACb,8BAA8B;CAS9B,mBAAmB;CACnB,kBAAkB;CAElB,0BAA0B;AAC5B;;;;;;;;AASA,IAAa,OAAb,MAAyC;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;CAEA;CACA;CACA;CACA,oCAAqD;CAErD,YAAY,EACV,mBACA,cACA,oBACA,kBACA,QACA,QACA,SACA,UACa;EACb,KAAK,SAAS,UAAU;EACxB,KAAK,KAAK;EACV,KAAK,aAAa;EAClB,KAAK,qBAAqB;EAC1B,MAAM,cAAc,kBAAkB,eAAe;EACrD,MAAM,iBAAiB,kBAAkB,kBAAkB;EAC3D,UAAU,eAAe,GAAG,iDAAiD;EAC7E,UAAU,kBAAkB,GAAG,2DAA2D;EAC1F,KAAK,aAAa,IAAI,uBAAuB,cAAc;GAAE;GAAa;EAAe,CAAC;EAC1F,KAAK,eAAe,IAAI,aAAa,YAAY;EACjD,MAAM,EAAE,MAAM,GAAG,kBAAkB,UAAU,CAAC;EAC9C,KAAK,aAAa,QAAQ;EAC1B,KAAK,gBAAgB;GACnB,MAAM;GACN,UAAU;GACV,QAAQ;GACR,UAAU;GACV,GAAG;EACL;EACA,KAAK,eAAe,QAAQ,SAAS,IAAI,aAAa,OAAO,MAAM,IAAI;EACvE,KAAK,gBAAgB,IAAI,IAAI,QAAQ,OAAO,QAAQ;EACpD,KAAK,iBAAiB,SAAS,iBAAiB,QAAQ;EACxD,KAAK,gBAAgB,SAAS,UAAU;EACxC,UAAU,KAAK,iBAAiB,GAAG,4CAA4C;CACjF;CAIA,aAAqB,SAAsC;EACzD,MAAM,aAAa,UAAU,SAAS,KAAK,UAAU;EACrD,IAAI,YAAY,OAAO;EACvB,OAAQ,KAAK,iBAAiB,QAAQ,QAAQ,IAAI,cAAc,KAAM,KAAA;CACxE;;CAGA,MAAc,YAAY,SAA2C;EACnE,MAAM,YAAY,KAAK,aAAa,OAAO;EAC3C,OAAO,YAAY,KAAK,WAAW,SAAS,SAAS,IAAI;CAC3D;;CAGA,YAAoB,SAAoC;EACtD,MAAM,OAAO,QAAQ,aAAa,yBAAyB;EAC3D,OAAO,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI;CACzC;;;;;;;;CASA,MAAc,OAAO,WAAsB,WAAuC;EAChF,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,KAAK,MAAM,aAAa,WAAW,kBAAkB,KAAK,CAAC,GAAG;GAC5D,IAAI,cAAc,KAAK,mCAAmC;GAC1D,IAAI,cAAA,iBAAyC;GAC7C,MAAM,QAAQ,WAAW,aAAa,SAAS;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,QAAQ,aAAa,WAAW,KAAK;EAClF;EACA,QAAQ,aAAa,2BAA2B,UAAU,IAAI;EAC9D,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;;;;;CAMA,YAAoB,UAAoB,SAAkB,QAAkC;EAC1F,MAAM,SAAS,QAAQ,uBAAuB;EAC9C,UAAU,UAAU,KAAK,YAAY,QAAQ,MAAM,GAAG;GACpD,GAAG,KAAK;GACR,GAAG;GACH;EACF,CAAC;EACD,IAAI,KAAK,eAAe,SAAS,QAAQ,IAAI,gBAAgB,QAAQ,MAAM,CAAC;EAC5E,OAAO;CACT;;CAGA,MAAc,MAAM,KAAiD;EACnE,IAAI;GACF,OAAO,MAAM,IAAI;EACnB,SAAS,OAAO;GACd,MAAM,WAAW,cAAc,KAAK;GACpC,IAAI,UAAU,OAAO;GACrB,MAAM;EACR;CACF;;CAGA,SACE,OACA,aACA,SACU;EACV,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,QAAQ;EAE9C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,GAC/D,IAAI,CAAC,IAAI,aAAa,IAAI,GAAG,GAAG,IAAI,aAAa,IAAI,KAAK,KAAK;EAEjE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,aACF,IAAI,aAAa,IAAI,qBAAqB,YAAY,MAAM,GAAG,4BAA4B,CAAC;EAE9F,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EAC1D,OAAO,SAAS,SAAS,IAAI,MAAM,GAAG;CACxC;CAIA,OAAO,OAAO,aAAyC;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,WAAW,SAAS,KAAK;GAC7B;GACA,eAAe;GACf,YAAY;EACd,CAAC;EAGD,UAAU,UAAU,cAAc,OAAO;GACvC,MAAM;GACN,QAAQ;GACR,UAAU;GACV,UAAU;GACV,QAAQ,KAAK,cAAc;EAC7B,CAAC;EACD,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,YAA+C;EAC/E,MAAM,QAAQ,SAAS,SAAS;EAChC,MAAM,YAAY,KAAK,aAAa,OAAO;EAI3C,IAAI,UAAU,WAAW,WAAW;GAClC,MAAM,UAAU,MAAM,KAAK,WAAW,SAAS,SAAS;GACxD,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;GACrD,IAAI,WAAW;IACb,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;IACzE,KAAK,MAAM,MAAM,SAAS,KAAK,GAC7B,IAAI,OAAO,WAAW,MAAM,KAAK,WAAW,WAAW,EAAE;GAE7D;EACF;EACA,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC;EACjC,IAAI,UAAU,UAAU,OAAO;EAC/B,IAAI,WAAW,MAAM,KAAK,WAAW,WAAW,SAAS;EAGzD,aAAa,UAAU,KAAK,YAAY,KAAK,aAAa;EAC1D,OAAO;CACT;CAEA,SAAS,OAAO,SAAkB,aAAgD;EAChF,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,SAAS,KAAK,EAAE,MAAM,MAAM,CAAC;EAElD,QAAQ,oBAAoB,KAAK,IAAI,CAAC;EACtC,MAAM,KAAK,WAAW,KAAK,OAAO;EAElC,MAAM,YAAY,KAAK,YAAY,OAAO;EAC1C,IAAI,WAAW,MAAM,WAAW,SAAS;EACzC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,OAAO;CAC9E;CAIA,uBAA+C;EAE7C,MAAM,gBAAgB,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EAM1D,OAAO;GAAE;GAAe,gBALD,WAAW,QAAQ,CAAC,CACxC,OAAO,aAAa,CAAC,CACrB,OAAO,CAAC,CACR,SAAS,WAEyB;GAAG,uBAAuB;EAAO;CACxE;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;CAEA,kBAA0B,OAAe;EACvC,OAAO,gBAAgB;CACzB;;;;;;CAOA,MAAc,aAAa,OAAe,UAAiC;EACzE,MAAM,MAAM,KAAK,kBAAkB,KAAK;EACxC,IAAK,MAAM,KAAK,GAAG,QAAQ,GAAG,MAAO,UAAU,MAAM,IAAI,oBAAoB,gBAAgB;EAC7F,MAAM,KAAK,GAAG,WAAW,GAAG;CAC9B;;;;;;;;CASA,MAAc,iBACZ,UACA,UACA,UACkB;EAClB,MAAM,EAAE,UAAU,SAAS;EAC3B,IAAI,OAAO,UAAU,YAAY,OAAO;GACtC,MAAM,KAAK,aAAa,OAAO,QAAQ;GACvC,OAAO;EACT;EACA,IAAI,YAAY,CAAC,KAAK,cAAc,IAAI,QAAQ,GAC9C,MAAM,IAAI,oBAAoB,eAAe;EAE/C,OAAO;CACT;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,cAAc,OAAO,YAAwC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,YAAY;EACrD,MAAM,QAAQ,WAAW;EACzB,MAAM,KAAK,GAAG,QAAQ,KAAK,kBAAkB,KAAK,GAAG,UAAU,oBAAoB;EACnF,OAAO,SAAS,KAAK,EAAE,MAAM,CAAC;CAChC;CAEA,uBACE,SACA,YAEA,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,aAAa,wBAAwB,SAAS,UAAU;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,oBAAoB;EAC7D,MAAM,QAAQ,WAAW;EACzB,MAAM,OAAO,KAAK,qBAAqB;EAGvC,MAAM,SAAS,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG,MAAM,WAAW,IAAI,KAAA;EACpF,MAAM,MAAM,MAAM,KAAK,aAAa,uBAAuB;GAAE;GAAU;GAAO;GAAM;EAAM,CAAC;EAC3F,IAAI,UAAU,MAAM,KAAK,YAAY,OAAO;EAC5C,IAAI,CAAC,SAAS;GAGZ,UAAU,KAAK,WAAW,cAAc;GACxC,QAAQ,uBAAuB,oBAAoB;EACrD;EACA,KAAK,eAAe;EAEpB,MAAM,uBAAmD;GACvD;GACA;GACA,yBAAyB,IAAI;GAC7B,sBAAsB;GACtB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;GACzB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACrC;EACA,QAAQ,aACN,KAAK,mCACL,KAAK,UAAU,oBAAoB,CACrC;EACA,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,KAAK,cAAc;EAEnB,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C,CAAC;CAEH,kBAAkB,OAAO,SAAkB,YAAkD;EAC3F,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAG3D,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,CAAC,SAAS,OAAO,KAAK,SAAS,mBAAmB,mBAAmB;EACzE,KAAK,cAAc;EACnB,MAAM,OAAO,QAAQ,aAAa,KAAK,iCAAiC;EACxE,IAAI,CAAC,MAAM,OAAO,KAAK,SAAS,mBAAmB,iCAAiC;EACpF,MAAM,SAAqC,KAAK,MAAM,IAAI;EAG1D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,iBAAiB;EAC1D,MAAM,OAAO,WAAW,OAAO,IAC3B,OAAO,YAAY,IAAI,gBAAgB,MAAM,QAAQ,KAAK,CAAC,CAAC,IAC5D,MAAM,OAAO;EACjB,MAAM,SAAS,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EAOrF,IAAI,OAAO,KAAK,OAAO;GACrB,IAAI,OAAO,KAAK,SAAS,OAAO,KAAK,UAAU,OAAO,OACpD,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;GAEnE,OAAO,KAAK,SACV,cAAc,OAAO,KAAK,OAAO,cAAc,GAC/C,OAAO,KAAK,iBACd;EACF;EACA,MAAM,EAAE,MAAM,OAAO,SAAS,OAAO;EACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,SAAS,mBAAmB,wBAAwB;EACrF,IAAI,UAAU,OAAO,OAAO,OAAO,KAAK,SAAS,mBAAmB,yBAAyB;EAC7F,IAAI,aAAa,OAAO,UACtB,OAAO,KAAK,SAAS,mBAAmB,4BAA4B;EAEtE,KAAK,kBAAkB;EAKvB,IAAI;EACJ,IAAI;GACF,MAAM,EAAE,UAAU,UAAU,MAAM,KAAK,aAAa,0BAA0B;IAC5E;IACA;IACA,MAAM,OAAO;GACf,CAAC;GAED,MAAM,WAAW,MAAM,KAAK,aAAa,YAAY;IACnD;IACA;IACA;IACA,UAAU,OAAO,EAAE,KAAK,IAAI,KAAA;GAC9B,CAAC;GACD,KAAK,eAAe;GAIpB,IAAI,OAAO,SAAS,MAAM,UAAU;IAClC,MAAM,EAAE,UAAU,SAAS;IAC3B,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,MAAM,IAAI,oBAAoB,eAAe;IACtF,IAAI,UAAU,OAAO,OAAO,MAAM,IAAI,oBAAoB,gBAAgB;IAC1E,KAAK,aAAa;GACpB;GAEA,MAAM,YAAY,MAAM,QAAQ,SAAS;IACvC;IACA;IACA;IACA;IACA,YAAY,OAAO,cAAc,CAAC;GACpC,CAAC;GACD,KAAK,gBAAgB;GAErB,WAAW,MAAM,KAAK,OAAO,WAAW,OAAO;GAC/C,MAAM,KAAK,WAAW,WAAW,QAAQ,MAAM,CAAC;GAChD,KAAK,gBAAgB;EACvB,SAAS,OAAO;GAGd,IAAI,iBAAiB,aAAa;IAChC,QAAQ,KAAK,0BAA0B,KAAK;IAC5C,MAAM,OAAO,qBAAqB,IAAI,MAAM,KAAK,IAAI,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,IAAI;GAC3B;GAGA,IAAI,iBAAiB,qBAAqB;IACxC,QAAQ,KAAK,0BAA0B,MAAM,QAAQ,MAAM,QAAQ;IACnE,OAAO,KAAK,SAAS,iBAAiB,KAAA,GAAW,KAAK;GACxD;GACA,QAAQ,MAAM,0BAA0B,KAAK;GAC7C,OAAO,KAAK,SAAS,cAAc;EACrC;EAEA,MAAM,MAAM,IAAI,IAAI,KAAK,aAAa,UAAU;EAChD,IAAI,aAAa,IAAI,UAAU,SAAS;EACxC,IAAI,aAAa,IAAI,YAAY,QAAQ;EACzC,MAAM,WAAW,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK,SAAS,EAAE,UAAU,IAAI,KAAK;EAAE,CAAC;EACpF,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,QAAQ;CAC5C;;CAGA,MAAc,UACZ,SACA,SACA,eACA,WACmB;EACnB,MAAM,YAAY,MAAM,QAAQ,SAAS,aAAa;EACtD,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,MAAM,WAAW,SAAS,KAAK,SAAS;EACxC,UAAU,QAAQ;EAClB,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;CAEA,qBAAqB,SAAkB,YACrC,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAC3D,MAAM,EAAE,aAAa,MAAM,SAAS,KAAK,mBAAmB;EAC5D,MAAM,OAAO,MAAM,SAAS,OAAO;EAEnC,MAAM,aAAa,eAAe,IAAI;EAEtC,MAAM,EAAE,YAAY,GAAG,GAAG,gBAAgB;EAC1C,MAAM,EAAE,kBAAkB;EAC1B,IACE,kBAAkB,KAAA,MACjB,OAAO,kBAAkB,YAAY,CAAC,qBAAqB,KAAK,aAAa,IAE9E,MAAM,gBACJ,yBACA,8DACF;EAEF,MAAM,EAAE,UAAU,UAAU,UAAU,MAAM,KAAK,aAAa,kBAAkB;GAC9E;GACA;EACF,CAAC;EACD,KAAK,qBAAqB;EAI1B,MAAM,YAAY,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG,UAAU,CAAC,CAAC,MAAM;EACpF,IAAI,MAAM,KAAK,iBAAiB,UAAU,UAAU,QAAQ,GAAG,KAAK,aAAa;EAEjF,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAEH,qBACE,SACA,SACA,WAAW,aAEX,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,cAAc,iCAAiC;EAC9D,MAAM,EAAE,MAAM,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EAI3D,MAAM,QADc,QAAQ,QAAQ,IAAI,cAAc,KAAK,GAAA,CAClC,SAAS,kBAAkB,IAChD,MAAM,SAAS,OAAO,IACtB,MAAM,SAAS,OAAO;EAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,GAAG,WAAW,MAAM,kBAAkB,IAAI;EAGnE,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,YAAY;GACrB,CAAC,CAAE,UAAU,OAAO,YAAa,MAAM,KAAK,aAAa,aAAa;IACpE;IACA,YAAY,OAAO;GACrB,CAAC;GACD,KAAK,mBAAmB;GAKxB,MAAM,YAAY,MAAM,KAAK,aAAa,aAAa,QAAQ,EAAA,CAAG;GAClE,IAAI,MAAM,KAAK,iBAAiB,UAAU,UAAU,QAAQ,GAAG,KAAK,aAAa;EACnF,OAAO,IAAI,OAAO,MAAM;GACtB,CAAC,CAAE,UAAU,SAAU,MAAM,KAAK,aAAa,0BAA0B;IACvE;IACA,MAAM,OAAO;GACf,CAAC;GACD,WAAW,MAAM,KAAK,aAAa,YAAY;IAAE;IAAU;IAAU;GAAM,CAAC;EAC9E,OACE,MAAM,gBAAgB,oBAAoB,gCAAgC;EAG5E,OAAO,KAAK,UACV,SACA,SACA;GAAE;GAAU;GAAU;GAAU;GAAO;EAAW,GAClD,SACF;CACF,CAAC;CAIH,6BAA6B,SAAkB,WAC7C,KAAK,MAAM,YAAY;EACrB,UAAU,KAAK,oBAAoB,sCAAsC;EACzE,MAAM,EAAE,OAAO,mBAAmB,MAChC,iCACA,MAAM,SAAS,OAAO,CACxB;EACA,MAAM,qBAAqB,KAAK,oBAAoB,cAAc;EAClE,MAAM,KAAK,WAAW,KAAK,OAAO,MAAM;EACxC,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB,CAAC;CAEH,mBAAmB,OAAe,qBAChC,KAAK,WAAW,OAAO,OAAO,gBAAgB;CAEhD,cAAc,SAAkB,YAC9B,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,cAAc,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC;EACrD,MAAM,EACJ,OACA,kBACA,aAAa,CAAC,MACZ,MAAM,kBAAkB,MAAM,SAAS,OAAO,CAAC;EACnD,MAAM,KAAK,WAAW,OAAO,OAAO,gBAAgB;EACpD,MAAM,SAAyB;GAAE,KAAK;GAAO;GAAO,gBAAgB;EAAK;EACzE,OAAO,KAAK,UACV,SACA,SACA;GAAE,UAAU;GAAS,UAAU;IAAE;IAAQ,MAAM,CAAC;GAAE;GAAG;EAAW,GAChE,SACF;CACF,CAAC;;;;;;;;;;;;;;;;;CAoBH,oBAAoB,YAClB,KAAK,MAAM,YAAY;EACrB,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO;EACjD,IAAI,CAAC,WAAW,MAAM,gBAAgB,eAAe;EACrD,MAAM,EAAE,mBAAmB,MAAM,wBAAwB,MAAM,SAAS,OAAO,CAAC;EAChF,MAAM,OAAO,MAAM,KAAK,aAAa,MAAM,WAAW,cAAc;EACpE,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;CAC/B,CAAC;;;;;;;;;;;;;;;;CAiBH,mBAAmB,YACjB,KAAK,MAAM,YAAY;EACrB,MAAM,EAAE,MAAM,kBAAkB,MAAM,uBAAuB,MAAM,SAAS,OAAO,CAAC;EACpF,MAAM,YAAY,MAAM,KAAK,aAAa,OAAO,MAAM,aAAa;EACpE,MAAM,UAAU,MAAM,KAAK,OAAO,SAAS;EAC3C,QAAQ,aAAa,eAAe,SAAS;EAC7C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO,KAAK,YAAY,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,SAAS;GAC5D,UAAU;GACV,QAAQ;EACV,CAAC;CACH,CAAC;CAIH,OAAO,OAAO,cAAwC;EACpD,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,KAAK,MAAM,aAAa,SAAS,KAAK,GACpC,MAAM,KAAK,WAAW,WAAW,SAAS;CAE9C;;;;;;;;CASA,MAAc,MAAM,SAAkB;EACpC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,QAAQ,oBAAoB,IAAI,KAAK,eAAe;EAC9D,QAAQ,oBAAoB,GAAG;EAC/B,MAAM,KAAK,WAAW,KAAK,OAAO;CACpC;CAEA,eAAe,OAAO,YAAgD;EACpE,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,MAAM,YAAY,WAAW,KAAK,YAAY,OAAO;EACrD,IAAI,CAAC,WAAW,OAAO;EACvB,MAAM,KAAK,MAAM,OAAO;EACxB,OAAO;CACT;CAEA,kBAAkB,OAAO,YAAuC;EAC9D,OAAQ,MAAM,KAAK,aAAa,OAAO,MAAO;CAChD;CAEA,aAAa,OACX,SACA,WACuD;EAEvD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO;EAC9C,IAAI,WAAW,CAAC,QAAQ,OAAO;EAC/B,MAAM,UAAU,KAAK,WAAW,cAAc;EAC9C,MAAM,KAAK,WAAW,KAAK,OAAO;EAClC,OAAO;CACT;CAEA,gBAAgB,OAAO,cAAqC;EAC1D,MAAM,KAAK,WAAW,WAAW,SAAS;CAC5C;CAEA,eAAe,OAAO,cAA6C;EACjE,MAAM,WAAW,MAAM,KAAK,WAAW,oBAAoB,UAAU,IAAI;EACzE,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;CACrC;CAEA,yBAAyB,OAAO,iBAA6C;EAC3E,MAAM,KAAK,WAAW,uBAAuB,YAAY;EACzD,OAAO,SAAS,KAAK,CAAC,CAAC;CACzB;AACF"}

package/dist/auth/types.d.cts

@@ -103,9 +103,19 @@ export interface AuthConfig {
     };
   };
 }
+/**
+ * Which sessions `logout` ends, as Supabase's `signOut({ scope })` names them: `local`, the one
+ * the request carries (default); `global`, every session of its principal, this one included
+ * ("sign out everywhere"); `others`, every session of its principal but this one, which keeps the
+ * caller signed in and its cookie untouched ("sign out other devices").
+ */
+export type LogoutScope = 'local' | 'others' | 'global';
+export interface LogoutOptions {
+  scope?: LogoutScope;
+}
 export interface AuthService {
   csrf: (request: Request) => Promise<Response>;
-  logout: (request: Request) => Promise<Response>;
+  logout: (request: Request, options?: LogoutOptions) => Promise<Response>;
   logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
   oauth2State: (request: Request) => Promise<Response>;
   oauth2Nonce: (request: Request) => Promise<Response>;

package/dist/auth/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/auth/types.ts"],"mappings":";;;;;YAMY,iBAAiB,WAAW,cAAc;;;;;;;;;;;;;;;iBAerC;EACf;EACA;EACA,UAAU;EACV,QAAQ;EACR,YAAY;;;;;;;YAQF,qBACV,SAAS,SACT,eAAe,kBACZ,QAAQ;iBAEI;;;;;;;;;;;EAWf,aAAa;;iBAGE;EACf;EACA,cAAc;EACd,mBAAmB;EACnB,SAAS;IAAkB;;EAC3B;;;;;;;;;IASE;;;;;;;;;;;IAWA;;EAEF;;EAEA;;;;;IAKE;;;;;IAKA;;EAEF;IACE,SAAS;IACT;;;;;;;;;;MAUE;;;;iBAKW;EAEf,OAAO,SAAS,YAAY,QAAQ;EACpC,SAAS,SAAS,YAAY,QAAQ;EACtC,SAAS,SAAS,SAAS,WAAW,kBAAkB,QAAQ;EAGhE,cAAc,SAAS,YAAY,QAAQ;EAC3C,cAAc,SAAS,YAAY,QAAQ;EAC3C,sBACE,SAAS,SACT,UAAU,+BACP,QAAQ;EACb,kBAAkB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAChF,oBAAoB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAClF,oBACE,SAAS,SACT,cAAc,mBACd,sBACG,QAAQ;EAGb,4BAA4B,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;EAC9E,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;;;;;;EAM3E,kBAAkB,eAAe,6BAA6B;EAG9D,mBAAmB,SAAS,YAAY,QAAQ;EAChD,kBAAkB,SAAS,YAAY,QAAQ;EAG/C,OAAO,WAAW,cAAc;EAChC,kBAAkB,SAAS,YAAY;EACvC,aAAa,mBACX,SAAS,SACT,QAAQ,MACL,QAAQ,iBAAiB,UAAU;EACxC,gBAAgB,sBAAsB;EACtC,eAAe,SAAS,YAAY,QAAQ;EAC5C,eAAe,WAAW,cAAc,QAAQ;EAChD,yBAAyB,0BAA0B,QAAQ"}
+{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/auth/types.ts"],"mappings":";;;;;YAMY,iBAAiB,WAAW,cAAc;;;;;;;;;;;;;;;iBAerC;EACf;EACA;EACA,UAAU;EACV,QAAQ;EACR,YAAY;;;;;;;YAQF,qBACV,SAAS,SACT,eAAe,kBACZ,QAAQ;iBAEI;;;;;;;;;;;EAWf,aAAa;;iBAGE;EACf;EACA,cAAc;EACd,mBAAmB;EACnB,SAAS;IAAkB;;EAC3B;;;;;;;;;IASE;;;;;;;;;;;IAWA;;EAEF;;EAEA;;;;;IAKE;;;;;IAKA;;EAEF;IACE,SAAS;IACT;;;;;;;;;;MAUE;;;;;;;;;;YAWM;iBAEK;EACf,QAAQ;;iBAGO;EAEf,OAAO,SAAS,YAAY,QAAQ;EACpC,SAAS,SAAS,SAAS,UAAU,kBAAkB,QAAQ;EAC/D,SAAS,SAAS,SAAS,WAAW,kBAAkB,QAAQ;EAGhE,cAAc,SAAS,YAAY,QAAQ;EAC3C,cAAc,SAAS,YAAY,QAAQ;EAC3C,sBACE,SAAS,SACT,UAAU,+BACP,QAAQ;EACb,kBAAkB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAChF,oBAAoB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAClF,oBACE,SAAS,SACT,cAAc,mBACd,sBACG,QAAQ;EAGb,4BAA4B,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;EAC9E,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;;;;;;EAM3E,kBAAkB,eAAe,6BAA6B;EAG9D,mBAAmB,SAAS,YAAY,QAAQ;EAChD,kBAAkB,SAAS,YAAY,QAAQ;EAG/C,OAAO,WAAW,cAAc;EAChC,kBAAkB,SAAS,YAAY;EACvC,aAAa,mBACX,SAAS,SACT,QAAQ,MACL,QAAQ,iBAAiB,UAAU;EACxC,gBAAgB,sBAAsB;EACtC,eAAe,SAAS,YAAY,QAAQ;EAC5C,eAAe,WAAW,cAAc,QAAQ;EAChD,yBAAyB,0BAA0B,QAAQ"}

package/dist/auth/types.d.mts

@@ -103,9 +103,19 @@ export interface AuthConfig {
     };
   };
 }
+/**
+ * Which sessions `logout` ends, as Supabase's `signOut({ scope })` names them: `local`, the one
+ * the request carries (default); `global`, every session of its principal, this one included
+ * ("sign out everywhere"); `others`, every session of its principal but this one, which keeps the
+ * caller signed in and its cookie untouched ("sign out other devices").
+ */
+export type LogoutScope = 'local' | 'others' | 'global';
+export interface LogoutOptions {
+  scope?: LogoutScope;
+}
 export interface AuthService {
   csrf: (request: Request) => Promise<Response>;
-  logout: (request: Request) => Promise<Response>;
+  logout: (request: Request, options?: LogoutOptions) => Promise<Response>;
   logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
   oauth2State: (request: Request) => Promise<Response>;
   oauth2Nonce: (request: Request) => Promise<Response>;

package/dist/auth/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/auth/types.ts"],"mappings":";;;;;YAMY,iBAAiB,WAAW,cAAc;;;;;;;;;;;;;;;iBAerC;EACf;EACA;EACA,UAAU;EACV,QAAQ;EACR,YAAY;;;;;;;YAQF,qBACV,SAAS,SACT,eAAe,kBACZ,QAAQ;iBAEI;;;;;;;;;;;EAWf,aAAa;;iBAGE;EACf;EACA,cAAc;EACd,mBAAmB;EACnB,SAAS;IAAkB;;EAC3B;;;;;;;;;IASE;;;;;;;;;;;IAWA;;EAEF;;EAEA;;;;;IAKE;;;;;IAKA;;EAEF;IACE,SAAS;IACT;;;;;;;;;;MAUE;;;;iBAKW;EAEf,OAAO,SAAS,YAAY,QAAQ;EACpC,SAAS,SAAS,YAAY,QAAQ;EACtC,SAAS,SAAS,SAAS,WAAW,kBAAkB,QAAQ;EAGhE,cAAc,SAAS,YAAY,QAAQ;EAC3C,cAAc,SAAS,YAAY,QAAQ;EAC3C,sBACE,SAAS,SACT,UAAU,+BACP,QAAQ;EACb,kBAAkB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAChF,oBAAoB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAClF,oBACE,SAAS,SACT,cAAc,mBACd,sBACG,QAAQ;EAGb,4BAA4B,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;EAC9E,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;;;;;;EAM3E,kBAAkB,eAAe,6BAA6B;EAG9D,mBAAmB,SAAS,YAAY,QAAQ;EAChD,kBAAkB,SAAS,YAAY,QAAQ;EAG/C,OAAO,WAAW,cAAc;EAChC,kBAAkB,SAAS,YAAY;EACvC,aAAa,mBACX,SAAS,SACT,QAAQ,MACL,QAAQ,iBAAiB,UAAU;EACxC,gBAAgB,sBAAsB;EACtC,eAAe,SAAS,YAAY,QAAQ;EAC5C,eAAe,WAAW,cAAc,QAAQ;EAChD,yBAAyB,0BAA0B,QAAQ"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/auth/types.ts"],"mappings":";;;;;YAMY,iBAAiB,WAAW,cAAc;;;;;;;;;;;;;;;iBAerC;EACf;EACA;EACA,UAAU;EACV,QAAQ;EACR,YAAY;;;;;;;YAQF,qBACV,SAAS,SACT,eAAe,kBACZ,QAAQ;iBAEI;;;;;;;;;;;EAWf,aAAa;;iBAGE;EACf;EACA,cAAc;EACd,mBAAmB;EACnB,SAAS;IAAkB;;EAC3B;;;;;;;;;IASE;;;;;;;;;;;IAWA;;EAEF;;EAEA;;;;;IAKE;;;;;IAKA;;EAEF;IACE,SAAS;IACT;;;;;;;;;;MAUE;;;;;;;;;;YAWM;iBAEK;EACf,QAAQ;;iBAGO;EAEf,OAAO,SAAS,YAAY,QAAQ;EACpC,SAAS,SAAS,SAAS,UAAU,kBAAkB,QAAQ;EAC/D,SAAS,SAAS,SAAS,WAAW,kBAAkB,QAAQ;EAGhE,cAAc,SAAS,YAAY,QAAQ;EAC3C,cAAc,SAAS,YAAY,QAAQ;EAC3C,sBACE,SAAS,SACT,UAAU,+BACP,QAAQ;EACb,kBAAkB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAChF,oBAAoB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAClF,oBACE,SAAS,SACT,cAAc,mBACd,sBACG,QAAQ;EAGb,4BAA4B,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;EAC9E,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;;;;;;EAM3E,kBAAkB,eAAe,6BAA6B;EAG9D,mBAAmB,SAAS,YAAY,QAAQ;EAChD,kBAAkB,SAAS,YAAY,QAAQ;EAG/C,OAAO,WAAW,cAAc;EAChC,kBAAkB,SAAS,YAAY;EACvC,aAAa,mBACX,SAAS,SACT,QAAQ,MACL,QAAQ,iBAAiB,UAAU;EACxC,gBAAgB,sBAAsB;EACtC,eAAe,SAAS,YAAY,QAAQ;EAC5C,eAAe,WAAW,cAAc,QAAQ;EAChD,yBAAyB,0BAA0B,QAAQ"}

package/dist/index.d.cts

@@ -3,7 +3,7 @@ import { KVRepository, Namespace, Session, SessionRepository } from "./session/t
 import { EmailSender } from "./auth/email-codes.cjs";
 import { AUTHENTICATION_REASONS, AuthenticationError, AuthenticationReason, AuthenticationReasons } from "./auth/error.cjs";
 import { AuthorizationResponse, ClientSecret, NativeClient, NativeCredential, OAuth2ClientConfig, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, PersonNameComponents, ProviderConfig, StandardClaims, UserInfo, WebClient } from "./oauth2/types.cjs";
-import { AuthConfig, AuthService, Authorization, AuthorizedHandler, OAuth2AuthorizationOptions } from "./auth/types.cjs";
+import { AuthConfig, AuthService, Authorization, AuthorizedHandler, LogoutOptions, LogoutScope, OAuth2AuthorizationOptions } from "./auth/types.cjs";
 import { Auth, PATH } from "./auth/index.cjs";
 import { ErrorBody, errorResponse } from "./auth/respond.cjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.cjs";
@@ -12,4 +12,4 @@ import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redi
 import { DBAdapter, DBIndexedSessionRepository } from "./session/db.cjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.cjs";
 import { MAX_NAME_PART_LENGTH, composeName } from "./oauth2/name.cjs";
-export { AUTHENTICATION_REASONS, Auth, type AuthConfig, type AuthService, AuthenticationError, type AuthenticationReason, type AuthenticationReasons, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type ClientSecret, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type EmailSender, type ErrorBody, type KVRepository, MAX_NAME_PART_LENGTH, type Namespace, type NativeClient, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, type OAuth2ClientConfig, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, type ProviderConfig, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, type WebClient, composeName, errorResponse, oauth2RedirectQuerySchema };
+export { AUTHENTICATION_REASONS, Auth, type AuthConfig, type AuthService, AuthenticationError, type AuthenticationReason, type AuthenticationReasons, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type ClientSecret, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type EmailSender, type ErrorBody, type KVRepository, type LogoutOptions, type LogoutScope, MAX_NAME_PART_LENGTH, type Namespace, type NativeClient, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, type OAuth2ClientConfig, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, type ProviderConfig, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, type WebClient, composeName, errorResponse, oauth2RedirectQuerySchema };

package/dist/index.d.mts

@@ -3,7 +3,7 @@ import { KVRepository, Namespace, Session, SessionRepository } from "./session/t
 import { EmailSender } from "./auth/email-codes.mjs";
 import { AUTHENTICATION_REASONS, AuthenticationError, AuthenticationReason, AuthenticationReasons } from "./auth/error.mjs";
 import { AuthorizationResponse, ClientSecret, NativeClient, NativeCredential, OAuth2ClientConfig, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, PersonNameComponents, ProviderConfig, StandardClaims, UserInfo, WebClient } from "./oauth2/types.mjs";
-import { AuthConfig, AuthService, Authorization, AuthorizedHandler, OAuth2AuthorizationOptions } from "./auth/types.mjs";
+import { AuthConfig, AuthService, Authorization, AuthorizedHandler, LogoutOptions, LogoutScope, OAuth2AuthorizationOptions } from "./auth/types.mjs";
 import { Auth, PATH } from "./auth/index.mjs";
 import { ErrorBody, errorResponse } from "./auth/respond.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
@@ -12,4 +12,4 @@ import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redi
 import { DBAdapter, DBIndexedSessionRepository } from "./session/db.mjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.mjs";
 import { MAX_NAME_PART_LENGTH, composeName } from "./oauth2/name.mjs";
-export { AUTHENTICATION_REASONS, Auth, type AuthConfig, type AuthService, AuthenticationError, type AuthenticationReason, type AuthenticationReasons, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type ClientSecret, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type EmailSender, type ErrorBody, type KVRepository, MAX_NAME_PART_LENGTH, type Namespace, type NativeClient, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, type OAuth2ClientConfig, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, type ProviderConfig, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, type WebClient, composeName, errorResponse, oauth2RedirectQuerySchema };
+export { AUTHENTICATION_REASONS, Auth, type AuthConfig, type AuthService, AuthenticationError, type AuthenticationReason, type AuthenticationReasons, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type ClientSecret, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type EmailSender, type ErrorBody, type KVRepository, type LogoutOptions, type LogoutScope, MAX_NAME_PART_LENGTH, type Namespace, type NativeClient, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, type OAuth2ClientConfig, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, type ProviderConfig, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, type WebClient, composeName, errorResponse, oauth2RedirectQuerySchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/security",
-  "version": "9.0.0",
+  "version": "9.1.0",
   "private": false,
   "repository": {
     "type": "git",