@simple-login/sdk 1.6.2 → 1.7.0

package/README.md

@@ -21,10 +21,16 @@ npm install @simple-login/sdk
 Set these environment variables and the SDK will auto-detect them:
 
 ```bash
-SIMPLELOGIN_CLIENT_ID=your-client-id
+# Private server-side
 SIMPLELOGIN_CLIENT_SECRET=your-client-secret
-SIMPLELOGIN_REDIRECT_URI=https://your-app.com/auth/callback
-SIMPLELOGIN_ORIGIN=https://your-app.com
+
+# Public
+VITE_SIMPLELOGIN_CLIENT_ID=your-client-id
+VITE_SIMPLELOGIN_SLUG=your-slug
+VITE_SIMPLELOGIN_REDIRECT_URI=https://your-app.com/auth/callback
+VITE_SIMPLELOGIN_ORIGIN=https://your-app.com
+
+# NB: Works with VITE_, NEXT_PUBLIC_, NUXT_PUBLIC_, PUBLIC_, REACT_APP_ and EXPO_PUBLIC_
 ```
 
 ```typescript

package/dist/index.cjs

@@ -22,6 +22,7 @@ var index_exports = {};
 __export(index_exports, {
   AuthorizationError: () => AuthorizationError,
   SimpleLogin: () => SimpleLogin,
+  SimpleLoginBrowser: () => SimpleLoginBrowser,
   SimpleLoginError: () => SimpleLoginError,
   TokenError: () => TokenError
 });
@@ -53,7 +54,7 @@ var TokenError = class extends SimpleLoginError {
 };
 
 // src/client.ts
-var BASE_URL = getEnv("SIMPLELOGIN_IDP_URL") ?? "https://app.simple-login.com";
+var BASE_URL = getEnvPublic("SIMPLELOGIN_IDP_URL") ?? "https://app.simple-login.com";
 function generateState() {
   const array = new Uint8Array(32);
   crypto.getRandomValues(array);
@@ -70,22 +71,47 @@ async function generateCodeChallenge(verifier) {
   const hash = await crypto.subtle.digest("SHA-256", data);
   return btoa(String.fromCharCode(...new Uint8Array(hash))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
+var PUBLIC_ENV_PREFIXES = [
+  "VITE_",
+  // Vite
+  "NEXT_PUBLIC_",
+  // Next.js
+  "NUXT_PUBLIC_",
+  // Nuxt 3
+  "PUBLIC_",
+  // SvelteKit
+  "REACT_APP_",
+  // Create React App
+  "EXPO_PUBLIC_"
+  // Expo
+];
 function getEnv(key) {
   if (typeof process !== "undefined" && process.env) {
     return process.env[key];
   }
   return void 0;
 }
+function getEnvPublic(key) {
+  if (typeof process === "undefined" || !process.env) {
+    return void 0;
+  }
+  for (const prefix of PUBLIC_ENV_PREFIXES) {
+    const value = process.env[`${prefix}${key}`];
+    if (value) return value;
+  }
+  return process.env[key];
+}
 function parseCookie(cookieHeader, name) {
   const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
   return match ? decodeURIComponent(match[1]) : void 0;
 }
 var publicKeyCache = /* @__PURE__ */ new Map();
 var PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1e3;
+var THIRTY_DAYS_IN_SECONDS = 30 * 24 * 60 * 60;
 function createTokenCookies(tokens) {
   return [
-    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,
-    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/`
+    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${tokens.expires_in}`,
+    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${THIRTY_DAYS_IN_SECONDS}`
   ];
 }
 function clearTokenCookies() {
@@ -388,10 +414,66 @@ var SimpleLogin = class {
     return new Response(null, { status: 302, headers });
   }
 };
+
+// src/browser.ts
+var import_meta = {};
+var PUBLIC_ENV_PREFIXES2 = [
+  "VITE_",
+  // Vite
+  "NEXT_PUBLIC_",
+  // Next.js
+  "NUXT_PUBLIC_",
+  // Nuxt 3
+  "PUBLIC_",
+  // SvelteKit
+  "REACT_APP_",
+  // Create React App
+  "EXPO_PUBLIC_"
+  // Expo
+];
+function getMetaEnvPublic(key) {
+  try {
+    const meta = import_meta;
+    if (!meta.env) return void 0;
+    for (const prefix of PUBLIC_ENV_PREFIXES2) {
+      const value = meta.env[`${prefix}${key}`];
+      if (value) return value;
+    }
+    return meta.env[key];
+  } catch {
+  }
+  return void 0;
+}
+var SimpleLoginBrowser = class {
+  clientId;
+  baseUrl;
+  slug;
+  constructor(config = {}) {
+    this.clientId = config.clientId ?? getMetaEnvPublic("SIMPLELOGIN_CLIENT_ID") ?? "";
+    this.slug = config.slug ?? getMetaEnvPublic("SIMPLELOGIN_SLUG") ?? "";
+    this.baseUrl = config.baseUrl ?? getMetaEnvPublic("SIMPLELOGIN_IDP_URL") ?? "https://app.simple-login.com";
+    if (!this.clientId) {
+      throw new Error(
+        "clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var (with appropriate framework prefix like VITE_, NEXT_PUBLIC_, etc.)."
+      );
+    }
+  }
+  /**
+   * Get the URL to the user's profile page
+   * @param options.redirectUrl - URL to redirect back to after profile changes
+   */
+  getProfileUrl(options) {
+    const params = new URLSearchParams({
+      redirect_url: options.redirectUrl
+    });
+    return `${this.baseUrl}/app/${this.slug}/profile?${params}`;
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthorizationError,
   SimpleLogin,
+  SimpleLoginBrowser,
   SimpleLoginError,
   TokenError
 });

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/errors.ts"],"sourcesContent":["export { SimpleLogin } from './client'\nexport { AuthorizationError, SimpleLoginError, TokenError } from './errors'\nexport type {\n  AccessTokenClaims,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  AuthResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n","import { decodeJwt, importSPKI, jwtVerify } from 'jose'\nimport { AuthorizationError, TokenError } from './errors'\nimport type {\n  AccessTokenClaims,\n  AuthResult,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n\ndeclare const __SIMPLELOGIN_BASE_URL__: string\n\nconst BASE_URL = getEnv('SIMPLELOGIN_IDP_URL') ?? __SIMPLELOGIN_BASE_URL__\n\nfunction generateState(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction generateCodeVerifier(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  // Base64url encode (RFC 7636)\n  return btoa(String.fromCharCode(...array))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const hash = await crypto.subtle.digest('SHA-256', data)\n  // Base64url encode the hash\n  return btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nfunction getEnv(key: string): string | undefined {\n  if (typeof process !== 'undefined' && process.env) {\n    return process.env[key]\n  }\n  return undefined\n}\n\nfunction parseCookie(cookieHeader: string, name: string): string | undefined {\n  const match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\n// Public key cache: clientId -> { key, fetchedAt }\nconst publicKeyCache = new Map<string, { key: CryptoKey; fetchedAt: number }>()\nconst PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1000 // 1 hour\n\nfunction createTokenCookies(tokens: TokenResponse): string[] {\n  return [\n    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,\n    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,\n  ]\n}\n\nfunction clearTokenCookies(): string[] {\n  return [\n    'SIMPLELOGIN_ACCESS_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    'SIMPLELOGIN_REFRESH_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n  ]\n}\n\nexport class SimpleLogin {\n  private clientId: string\n  private clientSecret: string\n  private redirectUri: string\n  private origin: string\n  private baseUrl: string\n\n  constructor(config: SimpleLoginConfig = {}) {\n    this.clientId = config.clientId ?? getEnv('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.clientSecret = config.clientSecret ?? getEnv('SIMPLELOGIN_CLIENT_SECRET') ?? ''\n    this.redirectUri = config.redirectUri ?? getEnv('SIMPLELOGIN_REDIRECT_URI') ?? ''\n    this.origin = config.origin ?? getEnv('SIMPLELOGIN_ORIGIN') ?? ''\n    this.baseUrl = BASE_URL\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var.',\n      )\n    }\n    if (!this.clientSecret) {\n      throw new Error(\n        'clientSecret is required. Pass it in config or set SIMPLELOGIN_CLIENT_SECRET env var.',\n      )\n    }\n    if (!this.redirectUri) {\n      throw new Error(\n        'redirectUri is required. Pass it in config or set SIMPLELOGIN_REDIRECT_URI env var.',\n      )\n    }\n    if (!this.origin) {\n      throw new Error('origin is required. Pass it in config or set SIMPLELOGIN_ORIGIN env var.')\n    }\n  }\n\n  /**\n   * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.\n   * @param options - Optional scopes or custom state\n   * @returns A 302 redirect Response ready to be returned from your route handler\n   */\n  async redirectToAuth(options: AuthorizationUrlOptions = {}): Promise<Response> {\n    const { url, cookies } = await this.getAuthorizationUrl(options)\n    const headers = new Headers()\n    headers.set('Location', url)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    return new Response(null, { status: 302, headers })\n  }\n\n  /**\n   * Generate the authorization URL to redirect users for sign-in\n   * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values\n   */\n  async getAuthorizationUrl(\n    options: AuthorizationUrlOptions = {},\n  ): Promise<AuthorizationUrlResult> {\n    const state = options.state ?? generateState()\n    const codeVerifier = generateCodeVerifier()\n    const codeChallenge = await generateCodeChallenge(codeVerifier)\n\n    const params = new URLSearchParams({\n      client_id: this.clientId,\n      redirect_uri: this.redirectUri,\n      response_type: 'code',\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    })\n\n    if (options.scopes?.length) {\n      params.set('scope', options.scopes.join(' '))\n    }\n\n    const cookies = [\n      `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n      `SIMPLELOGIN_CODE_VERIFIER=${codeVerifier}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n    ]\n\n    return {\n      url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,\n      state,\n      codeVerifier,\n      cookies,\n    }\n  }\n\n  /**\n   * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.\n   * @param request - The incoming Request object from the callback\n   * @param redirectTo - URL to redirect to after successful authentication (default: '/')\n   * @returns CallbackResult with redirect Response (cookies set) and user info to store\n   * @throws AuthorizationError if state is missing or doesn't match\n   */\n  async handleCallback(request: Request, redirectTo: string = '/'): Promise<CallbackResult> {\n    const url = new URL(request.url)\n    const code = url.searchParams.get('code')\n    const state = url.searchParams.get('state')\n\n    if (!code) {\n      throw new AuthorizationError('Missing authorization code in callback')\n    }\n\n    if (!state) {\n      throw new AuthorizationError('Missing state parameter in callback')\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const expectedState = parseCookie(cookieHeader, 'SIMPLELOGIN_STATE')\n    const codeVerifier = parseCookie(cookieHeader, 'SIMPLELOGIN_CODE_VERIFIER')\n\n    if (!expectedState) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_STATE cookie')\n    }\n\n    if (state !== expectedState) {\n      throw new AuthorizationError('Invalid state parameter')\n    }\n\n    if (!codeVerifier) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_CODE_VERIFIER cookie')\n    }\n\n    // Exchange code for tokens (with PKCE code_verifier)\n    const tokens = await this.exchangeCode(code, codeVerifier)\n\n    // Fetch user info (only time we do this)\n    const user = await this.getUserInfo(tokens.access_token)\n\n    // Build redirect response with token cookies\n    const cookies = createTokenCookies(tokens)\n    const headers = new Headers()\n    headers.set('Location', redirectTo)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    // Clear the state and code verifier cookies\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_STATE=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_CODE_VERIFIER=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n\n    const response = new Response(null, { status: 302, headers })\n\n    return { response, user }\n  }\n\n  /**\n   * Exchange an authorization code for access and refresh tokens\n   * @param code - The authorization code from the callback\n   * @param codeVerifier - The PKCE code verifier\n   */\n  async exchangeCode(code: string, codeVerifier: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        redirect_uri: this.redirectUri,\n        code,\n        code_verifier: codeVerifier,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to exchange authorization code')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshToken(refreshToken: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        refresh_token: refreshToken,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to refresh token')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Get user information using an access token\n   */\n  async getUserInfo(accessToken: string): Promise<UserInfo> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/userinfo`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch user info')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Fetch and cache the public key for JWT verification\n   */\n  private async getPublicKey(): Promise<CryptoKey> {\n    const cached = publicKeyCache.get(this.clientId)\n    if (cached && Date.now() - cached.fetchedAt < PUBLIC_KEY_CACHE_TTL) {\n      return cached.key\n    }\n\n    const response = await fetch(`${this.baseUrl}/api/applications/${this.clientId}/public-key`)\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch public key')\n    }\n\n    const data = await response.json()\n    const pem = data['public_key']\n    const key = await importSPKI(pem, 'RS256')\n\n    publicKeyCache.set(this.clientId, { key, fetchedAt: Date.now() })\n    return key\n  }\n\n  /**\n   * Authenticate a request by verifying the access token from cookies.\n   * No network calls except when refreshing expired tokens.\n   * CSRF protection is automatic using the origin from config.\n   * @param request - The incoming Request object\n   * @returns AuthResult if authenticated, null if not authenticated\n   */\n  async authenticate(request: Request): Promise<AuthResult | null> {\n    // CSRF protection for state-changing requests\n    const method = request.method.toUpperCase()\n    if (method !== 'GET' && method !== 'HEAD') {\n      const requestOrigin = request.headers.get('origin') || request.headers.get('referer')\n      if (!requestOrigin?.startsWith(this.origin)) {\n        return null\n      }\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const accessToken = parseCookie(cookieHeader, 'SIMPLELOGIN_ACCESS_TOKEN')\n    const refreshTokenValue = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // No tokens at all\n    if (!accessToken && !refreshTokenValue) {\n      return null\n    }\n\n    // No access token but have refresh token - try to get new tokens\n    if (!accessToken && refreshTokenValue) {\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n\n        const headers = new Headers()\n        for (const cookie of createTokenCookies(tokens)) {\n          headers.append('Set-Cookie', cookie)\n        }\n\n        return { claims, accessToken: tokens.access_token, headers }\n      } catch {\n        return null\n      }\n    }\n\n    // At this point, accessToken is guaranteed to be defined\n    const token = accessToken!\n\n    const publicKey = await this.getPublicKey()\n\n    try {\n      // Verify the token (local, no network call)\n      await jwtVerify(token, publicKey)\n\n      // Decode claims from JWT (no network call)\n      const claims = decodeJwt(token) as AccessTokenClaims\n\n      return { claims, accessToken: token, headers: new Headers() }\n    } catch (error) {\n      // Check if token is expired\n      const isExpired =\n        error instanceof Error &&\n        'code' in error &&\n        (error as { code: string }).code === 'ERR_JWT_EXPIRED'\n\n      if (!isExpired || !refreshTokenValue) {\n        return null\n      }\n\n      // Token expired, try to refresh\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n\n        // Build headers with new cookies\n        const headers = new Headers()\n        for (const cookie of createTokenCookies(tokens)) {\n          headers.append('Set-Cookie', cookie)\n        }\n\n        return { claims, accessToken: tokens.access_token, headers }\n      } catch {\n        return null\n      }\n    }\n  }\n\n  /**\n   * Revoke a refresh token on the IdP\n   */\n  private async revokeToken(refreshToken: string): Promise<void> {\n    await fetch(`${this.baseUrl}/v1/auth/revoke`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        token: refreshToken,\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n      }),\n    })\n  }\n\n  /**\n   * Logout: revoke refresh token on IdP, clear cookies, and redirect to auth.\n   * @param request - The incoming Request object (to read refresh token from cookies)\n   */\n  async logout(request: Request): Promise<Response> {\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const refreshToken = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // Revoke token on IdP (fire and forget - don't block logout on failure)\n    if (refreshToken) {\n      this.revokeToken(refreshToken).catch(() => {})\n    }\n\n    // Get auth redirect response\n    const authResponse = await this.redirectToAuth()\n\n    // Merge clear cookies with auth cookies\n    const headers = new Headers(authResponse.headers)\n    for (const cookie of clearTokenCookies()) {\n      headers.append('Set-Cookie', cookie)\n    }\n\n    return new Response(null, { status: 302, headers })\n  }\n}\n","export class SimpleLoginError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number,\n  ) {\n    super(message)\n    this.name = 'SimpleLoginError'\n  }\n}\n\nexport class AuthorizationError extends SimpleLoginError {\n  constructor(message: string) {\n    super(message, 'AUTHORIZATION_ERROR', 401)\n    this.name = 'AuthorizationError'\n  }\n}\n\nexport class TokenError extends SimpleLoginError {\n  constructor(message: string) {\n    super(message, 'TOKEN_ERROR', 400)\n    this.name = 'TokenError'\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAAiD;;;ACA1C,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACO,MACA,YACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,iBAAiB;AAAA,EACvD,YAAY,SAAiB;AAC3B,UAAM,SAAS,uBAAuB,GAAG;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,aAAN,cAAyB,iBAAiB;AAAA,EAC/C,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe,GAAG;AACjC,SAAK,OAAO;AAAA,EACd;AACF;;;ADRA,IAAM,WAAW,OAAO,qBAAqB,KAAK;AAElD,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAE5B,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EACtC,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,eAAe,sBAAsB,UAAmC;AACtE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAEvD,SAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,EACrD,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,SAAS,OAAO,KAAiC;AAC/C,MAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,YAAY,cAAsB,MAAkC;AAC3E,QAAM,QAAQ,aAAa,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACzE,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGA,IAAM,iBAAiB,oBAAI,IAAmD;AAC9E,IAAM,uBAAuB,KAAK,KAAK;AAEvC,SAAS,mBAAmB,QAAiC;AAC3D,SAAO;AAAA,IACL,4BAA4B,OAAO,YAAY;AAAA,IAC/C,6BAA6B,OAAO,aAAa;AAAA,EACnD;AACF;AAEA,SAAS,oBAA8B;AACrC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA4B,CAAC,GAAG;AAC1C,SAAK,WAAW,OAAO,YAAY,OAAO,uBAAuB,KAAK;AACtE,SAAK,eAAe,OAAO,gBAAgB,OAAO,2BAA2B,KAAK;AAClF,SAAK,cAAc,OAAO,eAAe,OAAO,0BAA0B,KAAK;AAC/E,SAAK,SAAS,OAAO,UAAU,OAAO,oBAAoB,KAAK;AAC/D,SAAK,UAAU;AAEf,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAI,MAAM,0EAA0E;AAAA,IAC5F;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,UAAmC,CAAC,GAAsB;AAC7E,UAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,KAAK,oBAAoB,OAAO;AAC/D,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,GAAG;AAC3B,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBACJ,UAAmC,CAAC,GACH;AACjC,UAAM,QAAQ,QAAQ,SAAS,cAAc;AAC7C,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAE9D,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,eAAe;AAAA,MACf;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,QAAI,QAAQ,QAAQ,QAAQ;AAC1B,aAAO,IAAI,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9C;AAEA,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK;AAAA,MAC1B,6BAA6B,YAAY;AAAA,IAC3C;AAEA,WAAO;AAAA,MACL,KAAK,GAAG,KAAK,OAAO,sBAAsB,OAAO,SAAS,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAAkB,aAAqB,KAA8B;AACxF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB,wCAAwC;AAAA,IACvE;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,gBAAgB,YAAY,cAAc,mBAAmB;AACnE,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAE1E,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,mBAAmB,kCAAkC;AAAA,IACjE;AAEA,QAAI,UAAU,eAAe;AAC3B,YAAM,IAAI,mBAAmB,yBAAyB;AAAA,IACxD;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,mBAAmB,0CAA0C;AAAA,IACzE;AAGA,UAAM,SAAS,MAAM,KAAK,aAAa,MAAM,YAAY;AAGzD,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,YAAY;AAGvD,UAAM,UAAU,mBAAmB,MAAM;AACzC,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,UAAU;AAClC,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAE5D,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,MAAc,cAA8C;AAC7E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,cAAc,KAAK;AAAA,QACnB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,uCAAuC;AAAA,IACzF;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,cAA8C;AAC/D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,yBAAyB;AAAA,IAC3E;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAAwC;AACxD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB;AAAA,MAC/D,SAAS;AAAA,QACP,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,eAAmC;AAC/C,UAAM,SAAS,eAAe,IAAI,KAAK,QAAQ;AAC/C,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,YAAY,sBAAsB;AAClE,aAAO,OAAO;AAAA,IAChB;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB,KAAK,QAAQ,aAAa;AAC3F,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,4BAA4B;AAAA,IAC3D;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,MAAM,KAAK,YAAY;AAC7B,UAAM,MAAM,UAAM,wBAAW,KAAK,OAAO;AAEzC,mBAAe,IAAI,KAAK,UAAU,EAAE,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,SAA8C;AAE/D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,YAAM,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,IAAI,SAAS;AACpF,UAAI,CAAC,eAAe,WAAW,KAAK,MAAM,GAAG;AAC3C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,cAAc,YAAY,cAAc,0BAA0B;AACxE,UAAM,oBAAoB,YAAY,cAAc,2BAA2B;AAG/E,QAAI,CAAC,eAAe,CAAC,mBAAmB;AACtC,aAAO;AAAA,IACT;AAGA,QAAI,CAAC,eAAe,mBAAmB;AACrC,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,aAAS,uBAAU,OAAO,YAAY;AAE5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,mBAAW,UAAU,mBAAmB,MAAM,GAAG;AAC/C,kBAAQ,OAAO,cAAc,MAAM;AAAA,QACrC;AAEA,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,QAAQ;AAEd,UAAM,YAAY,MAAM,KAAK,aAAa;AAE1C,QAAI;AAEF,gBAAM,uBAAU,OAAO,SAAS;AAGhC,YAAM,aAAS,uBAAU,KAAK;AAE9B,aAAO,EAAE,QAAQ,aAAa,OAAO,SAAS,IAAI,QAAQ,EAAE;AAAA,IAC9D,SAAS,OAAO;AAEd,YAAM,YACJ,iBAAiB,SACjB,UAAU,SACT,MAA2B,SAAS;AAEvC,UAAI,CAAC,aAAa,CAAC,mBAAmB;AACpC,eAAO;AAAA,MACT;AAGA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,aAAS,uBAAU,OAAO,YAAY;AAG5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,mBAAW,UAAU,mBAAmB,MAAM,GAAG;AAC/C,kBAAQ,OAAO,cAAc,MAAM;AAAA,QACrC;AAEA,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,cAAqC;AAC7D,UAAM,MAAM,GAAG,KAAK,OAAO,mBAAmB;AAAA,MAC5C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,SAAqC;AAChD,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAG1E,QAAI,cAAc;AAChB,WAAK,YAAY,YAAY,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC/C;AAGA,UAAM,eAAe,MAAM,KAAK,eAAe;AAG/C,UAAM,UAAU,IAAI,QAAQ,aAAa,OAAO;AAChD,eAAW,UAAU,kBAAkB,GAAG;AACxC,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/errors.ts","../src/browser.ts"],"sourcesContent":["export { SimpleLogin } from './client'\nexport { SimpleLoginBrowser } from './browser'\nexport { AuthorizationError, SimpleLoginError, TokenError } from './errors'\nexport type {\n  ProfileUrlOptions,\n  SimpleLoginBrowserConfig,\n} from './browser'\nexport type {\n  AccessTokenClaims,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  AuthResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n","import { decodeJwt, importSPKI, jwtVerify } from 'jose'\nimport { AuthorizationError, TokenError } from './errors'\nimport type {\n  AccessTokenClaims,\n  AuthResult,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n\ndeclare const __SIMPLELOGIN_BASE_URL__: string\n\nconst BASE_URL = getEnvPublic('SIMPLELOGIN_IDP_URL') ?? __SIMPLELOGIN_BASE_URL__\n\nfunction generateState(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction generateCodeVerifier(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  // Base64url encode (RFC 7636)\n  return btoa(String.fromCharCode(...array))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const hash = await crypto.subtle.digest('SHA-256', data)\n  // Base64url encode the hash\n  return btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\n// Common framework prefixes for public env vars\nconst PUBLIC_ENV_PREFIXES = [\n  'VITE_',        // Vite\n  'NEXT_PUBLIC_', // Next.js\n  'NUXT_PUBLIC_', // Nuxt 3\n  'PUBLIC_',      // SvelteKit\n  'REACT_APP_',   // Create React App\n  'EXPO_PUBLIC_', // Expo\n]\n\nfunction getEnv(key: string): string | undefined {\n  if (typeof process !== 'undefined' && process.env) {\n    return process.env[key]\n  }\n  return undefined\n}\n\nfunction getEnvPublic(key: string): string | undefined {\n  if (typeof process === 'undefined' || !process.env) {\n    return undefined\n  }\n  for (const prefix of PUBLIC_ENV_PREFIXES) {\n    const value = process.env[`${prefix}${key}`]\n    if (value) return value\n  }\n  return process.env[key]\n}\n\nfunction parseCookie(cookieHeader: string, name: string): string | undefined {\n  const match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\n// Public key cache: clientId -> { key, fetchedAt }\nconst publicKeyCache = new Map<string, { key: CryptoKey; fetchedAt: number }>()\nconst PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1000 // 1 hour\nconst THIRTY_DAYS_IN_SECONDS = 30 * 24 * 60 * 60\n\nfunction createTokenCookies(tokens: TokenResponse): string[] {\n  return [\n    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${tokens.expires_in}`,\n    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${THIRTY_DAYS_IN_SECONDS}`,\n  ]\n}\n\nfunction clearTokenCookies(): string[] {\n  return [\n    'SIMPLELOGIN_ACCESS_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    'SIMPLELOGIN_REFRESH_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n  ]\n}\n\nexport class SimpleLogin {\n  private clientId: string\n  private clientSecret: string\n  private redirectUri: string\n  private origin: string\n  private baseUrl: string\n\n  constructor(config: SimpleLoginConfig = {}) {\n    this.clientId = config.clientId ?? getEnv('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.clientSecret = config.clientSecret ?? getEnv('SIMPLELOGIN_CLIENT_SECRET') ?? ''\n    this.redirectUri = config.redirectUri ?? getEnv('SIMPLELOGIN_REDIRECT_URI') ?? ''\n    this.origin = config.origin ?? getEnv('SIMPLELOGIN_ORIGIN') ?? ''\n    this.baseUrl = BASE_URL\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var.',\n      )\n    }\n    if (!this.clientSecret) {\n      throw new Error(\n        'clientSecret is required. Pass it in config or set SIMPLELOGIN_CLIENT_SECRET env var.',\n      )\n    }\n    if (!this.redirectUri) {\n      throw new Error(\n        'redirectUri is required. Pass it in config or set SIMPLELOGIN_REDIRECT_URI env var.',\n      )\n    }\n    if (!this.origin) {\n      throw new Error('origin is required. Pass it in config or set SIMPLELOGIN_ORIGIN env var.')\n    }\n  }\n\n  /**\n   * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.\n   * @param options - Optional scopes or custom state\n   * @returns A 302 redirect Response ready to be returned from your route handler\n   */\n  async redirectToAuth(options: AuthorizationUrlOptions = {}): Promise<Response> {\n    const { url, cookies } = await this.getAuthorizationUrl(options)\n    const headers = new Headers()\n    headers.set('Location', url)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    return new Response(null, { status: 302, headers })\n  }\n\n  /**\n   * Generate the authorization URL to redirect users for sign-in\n   * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values\n   */\n  async getAuthorizationUrl(\n    options: AuthorizationUrlOptions = {},\n  ): Promise<AuthorizationUrlResult> {\n    const state = options.state ?? generateState()\n    const codeVerifier = generateCodeVerifier()\n    const codeChallenge = await generateCodeChallenge(codeVerifier)\n\n    const params = new URLSearchParams({\n      client_id: this.clientId,\n      redirect_uri: this.redirectUri,\n      response_type: 'code',\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    })\n\n    if (options.scopes?.length) {\n      params.set('scope', options.scopes.join(' '))\n    }\n\n    const cookies = [\n      `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n      `SIMPLELOGIN_CODE_VERIFIER=${codeVerifier}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n    ]\n\n    return {\n      url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,\n      state,\n      codeVerifier,\n      cookies,\n    }\n  }\n\n  /**\n   * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.\n   * @param request - The incoming Request object from the callback\n   * @param redirectTo - URL to redirect to after successful authentication (default: '/')\n   * @returns CallbackResult with redirect Response (cookies set) and user info to store\n   * @throws AuthorizationError if state is missing or doesn't match\n   */\n  async handleCallback(request: Request, redirectTo: string = '/'): Promise<CallbackResult> {\n    const url = new URL(request.url)\n    const code = url.searchParams.get('code')\n    const state = url.searchParams.get('state')\n\n    if (!code) {\n      throw new AuthorizationError('Missing authorization code in callback')\n    }\n\n    if (!state) {\n      throw new AuthorizationError('Missing state parameter in callback')\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const expectedState = parseCookie(cookieHeader, 'SIMPLELOGIN_STATE')\n    const codeVerifier = parseCookie(cookieHeader, 'SIMPLELOGIN_CODE_VERIFIER')\n\n    if (!expectedState) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_STATE cookie')\n    }\n\n    if (state !== expectedState) {\n      throw new AuthorizationError('Invalid state parameter')\n    }\n\n    if (!codeVerifier) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_CODE_VERIFIER cookie')\n    }\n\n    // Exchange code for tokens (with PKCE code_verifier)\n    const tokens = await this.exchangeCode(code, codeVerifier)\n\n    // Fetch user info (only time we do this)\n    const user = await this.getUserInfo(tokens.access_token)\n\n    // Build redirect response with token cookies\n    const cookies = createTokenCookies(tokens)\n    const headers = new Headers()\n    headers.set('Location', redirectTo)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    // Clear the state and code verifier cookies\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_STATE=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_CODE_VERIFIER=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n\n    const response = new Response(null, { status: 302, headers })\n\n    return { response, user }\n  }\n\n  /**\n   * Exchange an authorization code for access and refresh tokens\n   * @param code - The authorization code from the callback\n   * @param codeVerifier - The PKCE code verifier\n   */\n  async exchangeCode(code: string, codeVerifier: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        redirect_uri: this.redirectUri,\n        code,\n        code_verifier: codeVerifier,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to exchange authorization code')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshToken(refreshToken: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        refresh_token: refreshToken,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to refresh token')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Get user information using an access token\n   */\n  async getUserInfo(accessToken: string): Promise<UserInfo> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/userinfo`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch user info')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Fetch and cache the public key for JWT verification\n   */\n  private async getPublicKey(): Promise<CryptoKey> {\n    const cached = publicKeyCache.get(this.clientId)\n    if (cached && Date.now() - cached.fetchedAt < PUBLIC_KEY_CACHE_TTL) {\n      return cached.key\n    }\n\n    const response = await fetch(`${this.baseUrl}/api/applications/${this.clientId}/public-key`)\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch public key')\n    }\n\n    const data = await response.json()\n    const pem = data['public_key']\n    const key = await importSPKI(pem, 'RS256')\n\n    publicKeyCache.set(this.clientId, { key, fetchedAt: Date.now() })\n    return key\n  }\n\n  /**\n   * Authenticate a request by verifying the access token from cookies.\n   * No network calls except when refreshing expired tokens.\n   * CSRF protection is automatic using the origin from config.\n   * @param request - The incoming Request object\n   * @returns AuthResult if authenticated, null if not authenticated\n   */\n  async authenticate(request: Request): Promise<AuthResult | null> {\n    // CSRF protection for state-changing requests\n    const method = request.method.toUpperCase()\n    if (method !== 'GET' && method !== 'HEAD') {\n      const requestOrigin = request.headers.get('origin') || request.headers.get('referer')\n      if (!requestOrigin?.startsWith(this.origin)) {\n        return null\n      }\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const accessToken = parseCookie(cookieHeader, 'SIMPLELOGIN_ACCESS_TOKEN')\n    const refreshTokenValue = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // No tokens at all\n    if (!accessToken && !refreshTokenValue) {\n      return null\n    }\n\n    // No access token but have refresh token - try to get new tokens\n    if (!accessToken && refreshTokenValue) {\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n\n        const headers = new Headers()\n        for (const cookie of createTokenCookies(tokens)) {\n          headers.append('Set-Cookie', cookie)\n        }\n\n        return { claims, accessToken: tokens.access_token, headers }\n      } catch {\n        return null\n      }\n    }\n\n    // At this point, accessToken is guaranteed to be defined\n    const token = accessToken!\n\n    const publicKey = await this.getPublicKey()\n\n    try {\n      // Verify the token (local, no network call)\n      await jwtVerify(token, publicKey)\n\n      // Decode claims from JWT (no network call)\n      const claims = decodeJwt(token) as AccessTokenClaims\n\n      return { claims, accessToken: token, headers: new Headers() }\n    } catch (error) {\n      // Check if token is expired\n      const isExpired =\n        error instanceof Error &&\n        'code' in error &&\n        (error as { code: string }).code === 'ERR_JWT_EXPIRED'\n\n      if (!isExpired || !refreshTokenValue) {\n        return null\n      }\n\n      // Token expired, try to refresh\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n\n        // Build headers with new cookies\n        const headers = new Headers()\n        for (const cookie of createTokenCookies(tokens)) {\n          headers.append('Set-Cookie', cookie)\n        }\n\n        return { claims, accessToken: tokens.access_token, headers }\n      } catch {\n        return null\n      }\n    }\n  }\n\n  /**\n   * Revoke a refresh token on the IdP\n   */\n  private async revokeToken(refreshToken: string): Promise<void> {\n    await fetch(`${this.baseUrl}/v1/auth/revoke`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        token: refreshToken,\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n      }),\n    })\n  }\n\n  /**\n   * Logout: revoke refresh token on IdP, clear cookies, and redirect to auth.\n   * @param request - The incoming Request object (to read refresh token from cookies)\n   */\n  async logout(request: Request): Promise<Response> {\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const refreshToken = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // Revoke token on IdP (fire and forget - don't block logout on failure)\n    if (refreshToken) {\n      this.revokeToken(refreshToken).catch(() => {})\n    }\n\n    // Get auth redirect response\n    const authResponse = await this.redirectToAuth()\n\n    // Merge clear cookies with auth cookies\n    const headers = new Headers(authResponse.headers)\n    for (const cookie of clearTokenCookies()) {\n      headers.append('Set-Cookie', cookie)\n    }\n\n    return new Response(null, { status: 302, headers })\n  }\n}\n","export class SimpleLoginError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number,\n  ) {\n    super(message)\n    this.name = 'SimpleLoginError'\n  }\n}\n\nexport class AuthorizationError extends SimpleLoginError {\n  constructor(message: string) {\n    super(message, 'AUTHORIZATION_ERROR', 401)\n    this.name = 'AuthorizationError'\n  }\n}\n\nexport class TokenError extends SimpleLoginError {\n  constructor(message: string) {\n    super(message, 'TOKEN_ERROR', 400)\n    this.name = 'TokenError'\n  }\n}\n","declare const __SIMPLELOGIN_BASE_URL__: string\n\nexport interface SimpleLoginBrowserConfig {\n  clientId?: string\n  baseUrl?: string\n  slug?: string\n}\n\nexport interface ProfileUrlOptions {\n  redirectUrl: string\n}\n\n// Common framework prefixes for public env vars\nconst PUBLIC_ENV_PREFIXES = [\n  'VITE_', // Vite\n  'NEXT_PUBLIC_', // Next.js\n  'NUXT_PUBLIC_', // Nuxt 3\n  'PUBLIC_', // SvelteKit\n  'REACT_APP_', // Create React App\n  'EXPO_PUBLIC_', // Expo\n]\n\nfunction getMetaEnv(key: string): string | undefined {\n  try {\n    const meta = import.meta as unknown as { env?: Record<string, string> }\n    if (meta.env) {\n      return meta.env[key]\n    }\n  } catch {\n    // import.meta not available\n  }\n  return undefined\n}\n\nfunction getMetaEnvPublic(key: string): string | undefined {\n  try {\n    const meta = import.meta as unknown as { env?: Record<string, string> }\n    if (!meta.env) return undefined\n    for (const prefix of PUBLIC_ENV_PREFIXES) {\n      const value = meta.env[`${prefix}${key}`]\n      if (value) return value\n    }\n    return meta.env[key]\n  } catch {\n    // import.meta not available\n  }\n  return undefined\n}\n\nexport class SimpleLoginBrowser {\n  private clientId: string\n  private baseUrl: string\n  private slug: string\n\n  constructor(config: SimpleLoginBrowserConfig = {}) {\n    this.clientId = config.clientId ?? getMetaEnvPublic('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.slug = config.slug ?? getMetaEnvPublic('SIMPLELOGIN_SLUG') ?? ''\n    this.baseUrl =\n      config.baseUrl ?? getMetaEnvPublic('SIMPLELOGIN_IDP_URL') ?? __SIMPLELOGIN_BASE_URL__\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var (with appropriate framework prefix like VITE_, NEXT_PUBLIC_, etc.).',\n      )\n    }\n  }\n\n  /**\n   * Get the URL to the user's profile page\n   * @param options.redirectUrl - URL to redirect back to after profile changes\n   */\n  getProfileUrl(options: ProfileUrlOptions): string {\n    const params = new URLSearchParams({\n      redirect_url: options.redirectUrl,\n    })\n\n    return `${this.baseUrl}/app/${this.slug}/profile?${params}`\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAAiD;;;ACA1C,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACO,MACA,YACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,iBAAiB;AAAA,EACvD,YAAY,SAAiB;AAC3B,UAAM,SAAS,uBAAuB,GAAG;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,aAAN,cAAyB,iBAAiB;AAAA,EAC/C,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe,GAAG;AACjC,SAAK,OAAO;AAAA,EACd;AACF;;;ADRA,IAAM,WAAW,aAAa,qBAAqB,KAAK;AAExD,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAE5B,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EACtC,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,eAAe,sBAAsB,UAAmC;AACtE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAEvD,SAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,EACrD,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAGA,IAAM,sBAAsB;AAAA,EAC1B;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAEA,SAAS,OAAO,KAAiC;AAC/C,MAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,MAAI,OAAO,YAAY,eAAe,CAAC,QAAQ,KAAK;AAClD,WAAO;AAAA,EACT;AACA,aAAW,UAAU,qBAAqB;AACxC,UAAM,QAAQ,QAAQ,IAAI,GAAG,MAAM,GAAG,GAAG,EAAE;AAC3C,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO,QAAQ,IAAI,GAAG;AACxB;AAEA,SAAS,YAAY,cAAsB,MAAkC;AAC3E,QAAM,QAAQ,aAAa,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACzE,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGA,IAAM,iBAAiB,oBAAI,IAAmD;AAC9E,IAAM,uBAAuB,KAAK,KAAK;AACvC,IAAM,yBAAyB,KAAK,KAAK,KAAK;AAE9C,SAAS,mBAAmB,QAAiC;AAC3D,SAAO;AAAA,IACL,4BAA4B,OAAO,YAAY,qDAAqD,OAAO,UAAU;AAAA,IACrH,6BAA6B,OAAO,aAAa,qDAAqD,sBAAsB;AAAA,EAC9H;AACF;AAEA,SAAS,oBAA8B;AACrC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA4B,CAAC,GAAG;AAC1C,SAAK,WAAW,OAAO,YAAY,OAAO,uBAAuB,KAAK;AACtE,SAAK,eAAe,OAAO,gBAAgB,OAAO,2BAA2B,KAAK;AAClF,SAAK,cAAc,OAAO,eAAe,OAAO,0BAA0B,KAAK;AAC/E,SAAK,SAAS,OAAO,UAAU,OAAO,oBAAoB,KAAK;AAC/D,SAAK,UAAU;AAEf,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAI,MAAM,0EAA0E;AAAA,IAC5F;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,UAAmC,CAAC,GAAsB;AAC7E,UAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,KAAK,oBAAoB,OAAO;AAC/D,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,GAAG;AAC3B,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBACJ,UAAmC,CAAC,GACH;AACjC,UAAM,QAAQ,QAAQ,SAAS,cAAc;AAC7C,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAE9D,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,eAAe;AAAA,MACf;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,QAAI,QAAQ,QAAQ,QAAQ;AAC1B,aAAO,IAAI,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9C;AAEA,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK;AAAA,MAC1B,6BAA6B,YAAY;AAAA,IAC3C;AAEA,WAAO;AAAA,MACL,KAAK,GAAG,KAAK,OAAO,sBAAsB,OAAO,SAAS,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAAkB,aAAqB,KAA8B;AACxF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB,wCAAwC;AAAA,IACvE;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,gBAAgB,YAAY,cAAc,mBAAmB;AACnE,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAE1E,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,mBAAmB,kCAAkC;AAAA,IACjE;AAEA,QAAI,UAAU,eAAe;AAC3B,YAAM,IAAI,mBAAmB,yBAAyB;AAAA,IACxD;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,mBAAmB,0CAA0C;AAAA,IACzE;AAGA,UAAM,SAAS,MAAM,KAAK,aAAa,MAAM,YAAY;AAGzD,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,YAAY;AAGvD,UAAM,UAAU,mBAAmB,MAAM;AACzC,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,UAAU;AAClC,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAE5D,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,MAAc,cAA8C;AAC7E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,cAAc,KAAK;AAAA,QACnB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,uCAAuC;AAAA,IACzF;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,cAA8C;AAC/D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,yBAAyB;AAAA,IAC3E;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAAwC;AACxD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB;AAAA,MAC/D,SAAS;AAAA,QACP,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,eAAmC;AAC/C,UAAM,SAAS,eAAe,IAAI,KAAK,QAAQ;AAC/C,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,YAAY,sBAAsB;AAClE,aAAO,OAAO;AAAA,IAChB;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB,KAAK,QAAQ,aAAa;AAC3F,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,4BAA4B;AAAA,IAC3D;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,MAAM,KAAK,YAAY;AAC7B,UAAM,MAAM,UAAM,wBAAW,KAAK,OAAO;AAEzC,mBAAe,IAAI,KAAK,UAAU,EAAE,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,SAA8C;AAE/D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,YAAM,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,IAAI,SAAS;AACpF,UAAI,CAAC,eAAe,WAAW,KAAK,MAAM,GAAG;AAC3C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,cAAc,YAAY,cAAc,0BAA0B;AACxE,UAAM,oBAAoB,YAAY,cAAc,2BAA2B;AAG/E,QAAI,CAAC,eAAe,CAAC,mBAAmB;AACtC,aAAO;AAAA,IACT;AAGA,QAAI,CAAC,eAAe,mBAAmB;AACrC,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,aAAS,uBAAU,OAAO,YAAY;AAE5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,mBAAW,UAAU,mBAAmB,MAAM,GAAG;AAC/C,kBAAQ,OAAO,cAAc,MAAM;AAAA,QACrC;AAEA,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,QAAQ;AAEd,UAAM,YAAY,MAAM,KAAK,aAAa;AAE1C,QAAI;AAEF,gBAAM,uBAAU,OAAO,SAAS;AAGhC,YAAM,aAAS,uBAAU,KAAK;AAE9B,aAAO,EAAE,QAAQ,aAAa,OAAO,SAAS,IAAI,QAAQ,EAAE;AAAA,IAC9D,SAAS,OAAO;AAEd,YAAM,YACJ,iBAAiB,SACjB,UAAU,SACT,MAA2B,SAAS;AAEvC,UAAI,CAAC,aAAa,CAAC,mBAAmB;AACpC,eAAO;AAAA,MACT;AAGA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,aAAS,uBAAU,OAAO,YAAY;AAG5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,mBAAW,UAAU,mBAAmB,MAAM,GAAG;AAC/C,kBAAQ,OAAO,cAAc,MAAM;AAAA,QACrC;AAEA,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,cAAqC;AAC7D,UAAM,MAAM,GAAG,KAAK,OAAO,mBAAmB;AAAA,MAC5C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,SAAqC;AAChD,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAG1E,QAAI,cAAc;AAChB,WAAK,YAAY,YAAY,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC/C;AAGA,UAAM,eAAe,MAAM,KAAK,eAAe;AAG/C,UAAM,UAAU,IAAI,QAAQ,aAAa,OAAO;AAChD,eAAW,UAAU,kBAAkB,GAAG;AACxC,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AACF;;;AE/cA;AAaA,IAAMA,uBAAsB;AAAA,EAC1B;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAcA,SAAS,iBAAiB,KAAiC;AACzD,MAAI;AACF,UAAM,OAAO;AACb,QAAI,CAAC,KAAK,IAAK,QAAO;AACtB,eAAW,UAAUC,sBAAqB;AACxC,YAAM,QAAQ,KAAK,IAAI,GAAG,MAAM,GAAG,GAAG,EAAE;AACxC,UAAI,MAAO,QAAO;AAAA,IACpB;AACA,WAAO,KAAK,IAAI,GAAG;AAAA,EACrB,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAAmC,CAAC,GAAG;AACjD,SAAK,WAAW,OAAO,YAAY,iBAAiB,uBAAuB,KAAK;AAChF,SAAK,OAAO,OAAO,QAAQ,iBAAiB,kBAAkB,KAAK;AACnE,SAAK,UACH,OAAO,WAAW,iBAAiB,qBAAqB,KAAK;AAE/D,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,SAAoC;AAChD,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,cAAc,QAAQ;AAAA,IACxB,CAAC;AAED,WAAO,GAAG,KAAK,OAAO,QAAQ,KAAK,IAAI,YAAY,MAAM;AAAA,EAC3D;AACF;","names":["PUBLIC_ENV_PREFIXES","PUBLIC_ENV_PREFIXES"]}

package/dist/index.d.cts

@@ -130,6 +130,26 @@ declare class SimpleLogin {
     logout(request: Request): Promise<Response>;
 }
 
+interface SimpleLoginBrowserConfig {
+    clientId?: string;
+    baseUrl?: string;
+    slug?: string;
+}
+interface ProfileUrlOptions {
+    redirectUrl: string;
+}
+declare class SimpleLoginBrowser {
+    private clientId;
+    private baseUrl;
+    private slug;
+    constructor(config?: SimpleLoginBrowserConfig);
+    /**
+     * Get the URL to the user's profile page
+     * @param options.redirectUrl - URL to redirect back to after profile changes
+     */
+    getProfileUrl(options: ProfileUrlOptions): string;
+}
+
 declare class SimpleLoginError extends Error {
     code: string;
     statusCode?: number | undefined;
@@ -142,4 +162,4 @@ declare class TokenError extends SimpleLoginError {
     constructor(message: string);
 }
 
-export { type AccessTokenClaims, type AuthResult, AuthorizationError, type AuthorizationUrlOptions, type AuthorizationUrlResult, type CallbackResult, SimpleLogin, type SimpleLoginConfig, SimpleLoginError, TokenError, type TokenResponse, type UserInfo };
+export { type AccessTokenClaims, type AuthResult, AuthorizationError, type AuthorizationUrlOptions, type AuthorizationUrlResult, type CallbackResult, type ProfileUrlOptions, SimpleLogin, SimpleLoginBrowser, type SimpleLoginBrowserConfig, type SimpleLoginConfig, SimpleLoginError, TokenError, type TokenResponse, type UserInfo };

package/dist/index.d.ts

@@ -130,6 +130,26 @@ declare class SimpleLogin {
     logout(request: Request): Promise<Response>;
 }
 
+interface SimpleLoginBrowserConfig {
+    clientId?: string;
+    baseUrl?: string;
+    slug?: string;
+}
+interface ProfileUrlOptions {
+    redirectUrl: string;
+}
+declare class SimpleLoginBrowser {
+    private clientId;
+    private baseUrl;
+    private slug;
+    constructor(config?: SimpleLoginBrowserConfig);
+    /**
+     * Get the URL to the user's profile page
+     * @param options.redirectUrl - URL to redirect back to after profile changes
+     */
+    getProfileUrl(options: ProfileUrlOptions): string;
+}
+
 declare class SimpleLoginError extends Error {
     code: string;
     statusCode?: number | undefined;
@@ -142,4 +162,4 @@ declare class TokenError extends SimpleLoginError {
     constructor(message: string);
 }
 
-export { type AccessTokenClaims, type AuthResult, AuthorizationError, type AuthorizationUrlOptions, type AuthorizationUrlResult, type CallbackResult, SimpleLogin, type SimpleLoginConfig, SimpleLoginError, TokenError, type TokenResponse, type UserInfo };
+export { type AccessTokenClaims, type AuthResult, AuthorizationError, type AuthorizationUrlOptions, type AuthorizationUrlResult, type CallbackResult, type ProfileUrlOptions, SimpleLogin, SimpleLoginBrowser, type SimpleLoginBrowserConfig, type SimpleLoginConfig, SimpleLoginError, TokenError, type TokenResponse, type UserInfo };

package/dist/index.js

@@ -24,7 +24,7 @@ var TokenError = class extends SimpleLoginError {
 };
 
 // src/client.ts
-var BASE_URL = getEnv("SIMPLELOGIN_IDP_URL") ?? "https://app.simple-login.com";
+var BASE_URL = getEnvPublic("SIMPLELOGIN_IDP_URL") ?? "https://app.simple-login.com";
 function generateState() {
   const array = new Uint8Array(32);
   crypto.getRandomValues(array);
@@ -41,22 +41,47 @@ async function generateCodeChallenge(verifier) {
   const hash = await crypto.subtle.digest("SHA-256", data);
   return btoa(String.fromCharCode(...new Uint8Array(hash))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
+var PUBLIC_ENV_PREFIXES = [
+  "VITE_",
+  // Vite
+  "NEXT_PUBLIC_",
+  // Next.js
+  "NUXT_PUBLIC_",
+  // Nuxt 3
+  "PUBLIC_",
+  // SvelteKit
+  "REACT_APP_",
+  // Create React App
+  "EXPO_PUBLIC_"
+  // Expo
+];
 function getEnv(key) {
   if (typeof process !== "undefined" && process.env) {
     return process.env[key];
   }
   return void 0;
 }
+function getEnvPublic(key) {
+  if (typeof process === "undefined" || !process.env) {
+    return void 0;
+  }
+  for (const prefix of PUBLIC_ENV_PREFIXES) {
+    const value = process.env[`${prefix}${key}`];
+    if (value) return value;
+  }
+  return process.env[key];
+}
 function parseCookie(cookieHeader, name) {
   const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
   return match ? decodeURIComponent(match[1]) : void 0;
 }
 var publicKeyCache = /* @__PURE__ */ new Map();
 var PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1e3;
+var THIRTY_DAYS_IN_SECONDS = 30 * 24 * 60 * 60;
 function createTokenCookies(tokens) {
   return [
-    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,
-    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/`
+    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${tokens.expires_in}`,
+    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${THIRTY_DAYS_IN_SECONDS}`
   ];
 }
 function clearTokenCookies() {
@@ -359,9 +384,64 @@ var SimpleLogin = class {
     return new Response(null, { status: 302, headers });
   }
 };
+
+// src/browser.ts
+var PUBLIC_ENV_PREFIXES2 = [
+  "VITE_",
+  // Vite
+  "NEXT_PUBLIC_",
+  // Next.js
+  "NUXT_PUBLIC_",
+  // Nuxt 3
+  "PUBLIC_",
+  // SvelteKit
+  "REACT_APP_",
+  // Create React App
+  "EXPO_PUBLIC_"
+  // Expo
+];
+function getMetaEnvPublic(key) {
+  try {
+    const meta = import.meta;
+    if (!meta.env) return void 0;
+    for (const prefix of PUBLIC_ENV_PREFIXES2) {
+      const value = meta.env[`${prefix}${key}`];
+      if (value) return value;
+    }
+    return meta.env[key];
+  } catch {
+  }
+  return void 0;
+}
+var SimpleLoginBrowser = class {
+  clientId;
+  baseUrl;
+  slug;
+  constructor(config = {}) {
+    this.clientId = config.clientId ?? getMetaEnvPublic("SIMPLELOGIN_CLIENT_ID") ?? "";
+    this.slug = config.slug ?? getMetaEnvPublic("SIMPLELOGIN_SLUG") ?? "";
+    this.baseUrl = config.baseUrl ?? getMetaEnvPublic("SIMPLELOGIN_IDP_URL") ?? "https://app.simple-login.com";
+    if (!this.clientId) {
+      throw new Error(
+        "clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var (with appropriate framework prefix like VITE_, NEXT_PUBLIC_, etc.)."
+      );
+    }
+  }
+  /**
+   * Get the URL to the user's profile page
+   * @param options.redirectUrl - URL to redirect back to after profile changes
+   */
+  getProfileUrl(options) {
+    const params = new URLSearchParams({
+      redirect_url: options.redirectUrl
+    });
+    return `${this.baseUrl}/app/${this.slug}/profile?${params}`;
+  }
+};
 export {
   AuthorizationError,
   SimpleLogin,
+  SimpleLoginBrowser,
   SimpleLoginError,
   TokenError
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/errors.ts"],"sourcesContent":["import { decodeJwt, importSPKI, jwtVerify } from 'jose'\nimport { AuthorizationError, TokenError } from './errors'\nimport type {\n  AccessTokenClaims,\n  AuthResult,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n\ndeclare const __SIMPLELOGIN_BASE_URL__: string\n\nconst BASE_URL = getEnv('SIMPLELOGIN_IDP_URL') ?? __SIMPLELOGIN_BASE_URL__\n\nfunction generateState(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction generateCodeVerifier(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  // Base64url encode (RFC 7636)\n  return btoa(String.fromCharCode(...array))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const hash = await crypto.subtle.digest('SHA-256', data)\n  // Base64url encode the hash\n  return btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nfunction getEnv(key: string): string | undefined {\n  if (typeof process !== 'undefined' && process.env) {\n    return process.env[key]\n  }\n  return undefined\n}\n\nfunction parseCookie(cookieHeader: string, name: string): string | undefined {\n  const match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\n// Public key cache: clientId -> { key, fetchedAt }\nconst publicKeyCache = new Map<string, { key: CryptoKey; fetchedAt: number }>()\nconst PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1000 // 1 hour\n\nfunction createTokenCookies(tokens: TokenResponse): string[] {\n  return [\n    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,\n    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,\n  ]\n}\n\nfunction clearTokenCookies(): string[] {\n  return [\n    'SIMPLELOGIN_ACCESS_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    'SIMPLELOGIN_REFRESH_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n  ]\n}\n\nexport class SimpleLogin {\n  private clientId: string\n  private clientSecret: string\n  private redirectUri: string\n  private origin: string\n  private baseUrl: string\n\n  constructor(config: SimpleLoginConfig = {}) {\n    this.clientId = config.clientId ?? getEnv('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.clientSecret = config.clientSecret ?? getEnv('SIMPLELOGIN_CLIENT_SECRET') ?? ''\n    this.redirectUri = config.redirectUri ?? getEnv('SIMPLELOGIN_REDIRECT_URI') ?? ''\n    this.origin = config.origin ?? getEnv('SIMPLELOGIN_ORIGIN') ?? ''\n    this.baseUrl = BASE_URL\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var.',\n      )\n    }\n    if (!this.clientSecret) {\n      throw new Error(\n        'clientSecret is required. Pass it in config or set SIMPLELOGIN_CLIENT_SECRET env var.',\n      )\n    }\n    if (!this.redirectUri) {\n      throw new Error(\n        'redirectUri is required. Pass it in config or set SIMPLELOGIN_REDIRECT_URI env var.',\n      )\n    }\n    if (!this.origin) {\n      throw new Error('origin is required. Pass it in config or set SIMPLELOGIN_ORIGIN env var.')\n    }\n  }\n\n  /**\n   * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.\n   * @param options - Optional scopes or custom state\n   * @returns A 302 redirect Response ready to be returned from your route handler\n   */\n  async redirectToAuth(options: AuthorizationUrlOptions = {}): Promise<Response> {\n    const { url, cookies } = await this.getAuthorizationUrl(options)\n    const headers = new Headers()\n    headers.set('Location', url)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    return new Response(null, { status: 302, headers })\n  }\n\n  /**\n   * Generate the authorization URL to redirect users for sign-in\n   * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values\n   */\n  async getAuthorizationUrl(\n    options: AuthorizationUrlOptions = {},\n  ): Promise<AuthorizationUrlResult> {\n    const state = options.state ?? generateState()\n    const codeVerifier = generateCodeVerifier()\n    const codeChallenge = await generateCodeChallenge(codeVerifier)\n\n    const params = new URLSearchParams({\n      client_id: this.clientId,\n      redirect_uri: this.redirectUri,\n      response_type: 'code',\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    })\n\n    if (options.scopes?.length) {\n      params.set('scope', options.scopes.join(' '))\n    }\n\n    const cookies = [\n      `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n      `SIMPLELOGIN_CODE_VERIFIER=${codeVerifier}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n    ]\n\n    return {\n      url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,\n      state,\n      codeVerifier,\n      cookies,\n    }\n  }\n\n  /**\n   * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.\n   * @param request - The incoming Request object from the callback\n   * @param redirectTo - URL to redirect to after successful authentication (default: '/')\n   * @returns CallbackResult with redirect Response (cookies set) and user info to store\n   * @throws AuthorizationError if state is missing or doesn't match\n   */\n  async handleCallback(request: Request, redirectTo: string = '/'): Promise<CallbackResult> {\n    const url = new URL(request.url)\n    const code = url.searchParams.get('code')\n    const state = url.searchParams.get('state')\n\n    if (!code) {\n      throw new AuthorizationError('Missing authorization code in callback')\n    }\n\n    if (!state) {\n      throw new AuthorizationError('Missing state parameter in callback')\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const expectedState = parseCookie(cookieHeader, 'SIMPLELOGIN_STATE')\n    const codeVerifier = parseCookie(cookieHeader, 'SIMPLELOGIN_CODE_VERIFIER')\n\n    if (!expectedState) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_STATE cookie')\n    }\n\n    if (state !== expectedState) {\n      throw new AuthorizationError('Invalid state parameter')\n    }\n\n    if (!codeVerifier) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_CODE_VERIFIER cookie')\n    }\n\n    // Exchange code for tokens (with PKCE code_verifier)\n    const tokens = await this.exchangeCode(code, codeVerifier)\n\n    // Fetch user info (only time we do this)\n    const user = await this.getUserInfo(tokens.access_token)\n\n    // Build redirect response with token cookies\n    const cookies = createTokenCookies(tokens)\n    const headers = new Headers()\n    headers.set('Location', redirectTo)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    // Clear the state and code verifier cookies\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_STATE=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_CODE_VERIFIER=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n\n    const response = new Response(null, { status: 302, headers })\n\n    return { response, user }\n  }\n\n  /**\n   * Exchange an authorization code for access and refresh tokens\n   * @param code - The authorization code from the callback\n   * @param codeVerifier - The PKCE code verifier\n   */\n  async exchangeCode(code: string, codeVerifier: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        redirect_uri: this.redirectUri,\n        code,\n        code_verifier: codeVerifier,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to exchange authorization code')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshToken(refreshToken: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        refresh_token: refreshToken,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to refresh token')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Get user information using an access token\n   */\n  async getUserInfo(accessToken: string): Promise<UserInfo> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/userinfo`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch user info')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Fetch and cache the public key for JWT verification\n   */\n  private async getPublicKey(): Promise<CryptoKey> {\n    const cached = publicKeyCache.get(this.clientId)\n    if (cached && Date.now() - cached.fetchedAt < PUBLIC_KEY_CACHE_TTL) {\n      return cached.key\n    }\n\n    const response = await fetch(`${this.baseUrl}/api/applications/${this.clientId}/public-key`)\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch public key')\n    }\n\n    const data = await response.json()\n    const pem = data['public_key']\n    const key = await importSPKI(pem, 'RS256')\n\n    publicKeyCache.set(this.clientId, { key, fetchedAt: Date.now() })\n    return key\n  }\n\n  /**\n   * Authenticate a request by verifying the access token from cookies.\n   * No network calls except when refreshing expired tokens.\n   * CSRF protection is automatic using the origin from config.\n   * @param request - The incoming Request object\n   * @returns AuthResult if authenticated, null if not authenticated\n   */\n  async authenticate(request: Request): Promise<AuthResult | null> {\n    // CSRF protection for state-changing requests\n    const method = request.method.toUpperCase()\n    if (method !== 'GET' && method !== 'HEAD') {\n      const requestOrigin = request.headers.get('origin') || request.headers.get('referer')\n      if (!requestOrigin?.startsWith(this.origin)) {\n        return null\n      }\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const accessToken = parseCookie(cookieHeader, 'SIMPLELOGIN_ACCESS_TOKEN')\n    const refreshTokenValue = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // No tokens at all\n    if (!accessToken && !refreshTokenValue) {\n      return null\n    }\n\n    // No access token but have refresh token - try to get new tokens\n    if (!accessToken && refreshTokenValue) {\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n\n        const headers = new Headers()\n        for (const cookie of createTokenCookies(tokens)) {\n          headers.append('Set-Cookie', cookie)\n        }\n\n        return { claims, accessToken: tokens.access_token, headers }\n      } catch {\n        return null\n      }\n    }\n\n    // At this point, accessToken is guaranteed to be defined\n    const token = accessToken!\n\n    const publicKey = await this.getPublicKey()\n\n    try {\n      // Verify the token (local, no network call)\n      await jwtVerify(token, publicKey)\n\n      // Decode claims from JWT (no network call)\n      const claims = decodeJwt(token) as AccessTokenClaims\n\n      return { claims, accessToken: token, headers: new Headers() }\n    } catch (error) {\n      // Check if token is expired\n      const isExpired =\n        error instanceof Error &&\n        'code' in error &&\n        (error as { code: string }).code === 'ERR_JWT_EXPIRED'\n\n      if (!isExpired || !refreshTokenValue) {\n        return null\n      }\n\n      // Token expired, try to refresh\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n\n        // Build headers with new cookies\n        const headers = new Headers()\n        for (const cookie of createTokenCookies(tokens)) {\n          headers.append('Set-Cookie', cookie)\n        }\n\n        return { claims, accessToken: tokens.access_token, headers }\n      } catch {\n        return null\n      }\n    }\n  }\n\n  /**\n   * Revoke a refresh token on the IdP\n   */\n  private async revokeToken(refreshToken: string): Promise<void> {\n    await fetch(`${this.baseUrl}/v1/auth/revoke`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        token: refreshToken,\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n      }),\n    })\n  }\n\n  /**\n   * Logout: revoke refresh token on IdP, clear cookies, and redirect to auth.\n   * @param request - The incoming Request object (to read refresh token from cookies)\n   */\n  async logout(request: Request): Promise<Response> {\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const refreshToken = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // Revoke token on IdP (fire and forget - don't block logout on failure)\n    if (refreshToken) {\n      this.revokeToken(refreshToken).catch(() => {})\n    }\n\n    // Get auth redirect response\n    const authResponse = await this.redirectToAuth()\n\n    // Merge clear cookies with auth cookies\n    const headers = new Headers(authResponse.headers)\n    for (const cookie of clearTokenCookies()) {\n      headers.append('Set-Cookie', cookie)\n    }\n\n    return new Response(null, { status: 302, headers })\n  }\n}\n","export class SimpleLoginError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number,\n  ) {\n    super(message)\n    this.name = 'SimpleLoginError'\n  }\n}\n\nexport class AuthorizationError extends SimpleLoginError {\n  constructor(message: string) {\n    super(message, 'AUTHORIZATION_ERROR', 401)\n    this.name = 'AuthorizationError'\n  }\n}\n\nexport class TokenError extends SimpleLoginError {\n  constructor(message: string) {\n    super(message, 'TOKEN_ERROR', 400)\n    this.name = 'TokenError'\n  }\n}\n"],"mappings":";AAAA,SAAS,WAAW,YAAY,iBAAiB;;;ACA1C,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACO,MACA,YACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,iBAAiB;AAAA,EACvD,YAAY,SAAiB;AAC3B,UAAM,SAAS,uBAAuB,GAAG;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,aAAN,cAAyB,iBAAiB;AAAA,EAC/C,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe,GAAG;AACjC,SAAK,OAAO;AAAA,EACd;AACF;;;ADRA,IAAM,WAAW,OAAO,qBAAqB,KAAK;AAElD,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAE5B,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EACtC,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,eAAe,sBAAsB,UAAmC;AACtE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAEvD,SAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,EACrD,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,SAAS,OAAO,KAAiC;AAC/C,MAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,YAAY,cAAsB,MAAkC;AAC3E,QAAM,QAAQ,aAAa,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACzE,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGA,IAAM,iBAAiB,oBAAI,IAAmD;AAC9E,IAAM,uBAAuB,KAAK,KAAK;AAEvC,SAAS,mBAAmB,QAAiC;AAC3D,SAAO;AAAA,IACL,4BAA4B,OAAO,YAAY;AAAA,IAC/C,6BAA6B,OAAO,aAAa;AAAA,EACnD;AACF;AAEA,SAAS,oBAA8B;AACrC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA4B,CAAC,GAAG;AAC1C,SAAK,WAAW,OAAO,YAAY,OAAO,uBAAuB,KAAK;AACtE,SAAK,eAAe,OAAO,gBAAgB,OAAO,2BAA2B,KAAK;AAClF,SAAK,cAAc,OAAO,eAAe,OAAO,0BAA0B,KAAK;AAC/E,SAAK,SAAS,OAAO,UAAU,OAAO,oBAAoB,KAAK;AAC/D,SAAK,UAAU;AAEf,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAI,MAAM,0EAA0E;AAAA,IAC5F;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,UAAmC,CAAC,GAAsB;AAC7E,UAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,KAAK,oBAAoB,OAAO;AAC/D,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,GAAG;AAC3B,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBACJ,UAAmC,CAAC,GACH;AACjC,UAAM,QAAQ,QAAQ,SAAS,cAAc;AAC7C,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAE9D,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,eAAe;AAAA,MACf;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,QAAI,QAAQ,QAAQ,QAAQ;AAC1B,aAAO,IAAI,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9C;AAEA,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK;AAAA,MAC1B,6BAA6B,YAAY;AAAA,IAC3C;AAEA,WAAO;AAAA,MACL,KAAK,GAAG,KAAK,OAAO,sBAAsB,OAAO,SAAS,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAAkB,aAAqB,KAA8B;AACxF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB,wCAAwC;AAAA,IACvE;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,gBAAgB,YAAY,cAAc,mBAAmB;AACnE,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAE1E,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,mBAAmB,kCAAkC;AAAA,IACjE;AAEA,QAAI,UAAU,eAAe;AAC3B,YAAM,IAAI,mBAAmB,yBAAyB;AAAA,IACxD;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,mBAAmB,0CAA0C;AAAA,IACzE;AAGA,UAAM,SAAS,MAAM,KAAK,aAAa,MAAM,YAAY;AAGzD,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,YAAY;AAGvD,UAAM,UAAU,mBAAmB,MAAM;AACzC,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,UAAU;AAClC,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAE5D,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,MAAc,cAA8C;AAC7E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,cAAc,KAAK;AAAA,QACnB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,uCAAuC;AAAA,IACzF;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,cAA8C;AAC/D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,yBAAyB;AAAA,IAC3E;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAAwC;AACxD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB;AAAA,MAC/D,SAAS;AAAA,QACP,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,eAAmC;AAC/C,UAAM,SAAS,eAAe,IAAI,KAAK,QAAQ;AAC/C,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,YAAY,sBAAsB;AAClE,aAAO,OAAO;AAAA,IAChB;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB,KAAK,QAAQ,aAAa;AAC3F,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,4BAA4B;AAAA,IAC3D;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,MAAM,KAAK,YAAY;AAC7B,UAAM,MAAM,MAAM,WAAW,KAAK,OAAO;AAEzC,mBAAe,IAAI,KAAK,UAAU,EAAE,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,SAA8C;AAE/D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,YAAM,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,IAAI,SAAS;AACpF,UAAI,CAAC,eAAe,WAAW,KAAK,MAAM,GAAG;AAC3C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,cAAc,YAAY,cAAc,0BAA0B;AACxE,UAAM,oBAAoB,YAAY,cAAc,2BAA2B;AAG/E,QAAI,CAAC,eAAe,CAAC,mBAAmB;AACtC,aAAO;AAAA,IACT;AAGA,QAAI,CAAC,eAAe,mBAAmB;AACrC,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,SAAS,UAAU,OAAO,YAAY;AAE5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,mBAAW,UAAU,mBAAmB,MAAM,GAAG;AAC/C,kBAAQ,OAAO,cAAc,MAAM;AAAA,QACrC;AAEA,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,QAAQ;AAEd,UAAM,YAAY,MAAM,KAAK,aAAa;AAE1C,QAAI;AAEF,YAAM,UAAU,OAAO,SAAS;AAGhC,YAAM,SAAS,UAAU,KAAK;AAE9B,aAAO,EAAE,QAAQ,aAAa,OAAO,SAAS,IAAI,QAAQ,EAAE;AAAA,IAC9D,SAAS,OAAO;AAEd,YAAM,YACJ,iBAAiB,SACjB,UAAU,SACT,MAA2B,SAAS;AAEvC,UAAI,CAAC,aAAa,CAAC,mBAAmB;AACpC,eAAO;AAAA,MACT;AAGA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,SAAS,UAAU,OAAO,YAAY;AAG5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,mBAAW,UAAU,mBAAmB,MAAM,GAAG;AAC/C,kBAAQ,OAAO,cAAc,MAAM;AAAA,QACrC;AAEA,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,cAAqC;AAC7D,UAAM,MAAM,GAAG,KAAK,OAAO,mBAAmB;AAAA,MAC5C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,SAAqC;AAChD,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAG1E,QAAI,cAAc;AAChB,WAAK,YAAY,YAAY,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC/C;AAGA,UAAM,eAAe,MAAM,KAAK,eAAe;AAG/C,UAAM,UAAU,IAAI,QAAQ,aAAa,OAAO;AAChD,eAAW,UAAU,kBAAkB,GAAG;AACxC,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AACF;","names":[]}
+{"version":3,"sources":["../src/client.ts","../src/errors.ts","../src/browser.ts"],"sourcesContent":["import { decodeJwt, importSPKI, jwtVerify } from 'jose'\nimport { AuthorizationError, TokenError } from './errors'\nimport type {\n  AccessTokenClaims,\n  AuthResult,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n\ndeclare const __SIMPLELOGIN_BASE_URL__: string\n\nconst BASE_URL = getEnvPublic('SIMPLELOGIN_IDP_URL') ?? __SIMPLELOGIN_BASE_URL__\n\nfunction generateState(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction generateCodeVerifier(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  // Base64url encode (RFC 7636)\n  return btoa(String.fromCharCode(...array))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const hash = await crypto.subtle.digest('SHA-256', data)\n  // Base64url encode the hash\n  return btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\n// Common framework prefixes for public env vars\nconst PUBLIC_ENV_PREFIXES = [\n  'VITE_',        // Vite\n  'NEXT_PUBLIC_', // Next.js\n  'NUXT_PUBLIC_', // Nuxt 3\n  'PUBLIC_',      // SvelteKit\n  'REACT_APP_',   // Create React App\n  'EXPO_PUBLIC_', // Expo\n]\n\nfunction getEnv(key: string): string | undefined {\n  if (typeof process !== 'undefined' && process.env) {\n    return process.env[key]\n  }\n  return undefined\n}\n\nfunction getEnvPublic(key: string): string | undefined {\n  if (typeof process === 'undefined' || !process.env) {\n    return undefined\n  }\n  for (const prefix of PUBLIC_ENV_PREFIXES) {\n    const value = process.env[`${prefix}${key}`]\n    if (value) return value\n  }\n  return process.env[key]\n}\n\nfunction parseCookie(cookieHeader: string, name: string): string | undefined {\n  const match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\n// Public key cache: clientId -> { key, fetchedAt }\nconst publicKeyCache = new Map<string, { key: CryptoKey; fetchedAt: number }>()\nconst PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1000 // 1 hour\nconst THIRTY_DAYS_IN_SECONDS = 30 * 24 * 60 * 60\n\nfunction createTokenCookies(tokens: TokenResponse): string[] {\n  return [\n    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${tokens.expires_in}`,\n    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${THIRTY_DAYS_IN_SECONDS}`,\n  ]\n}\n\nfunction clearTokenCookies(): string[] {\n  return [\n    'SIMPLELOGIN_ACCESS_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    'SIMPLELOGIN_REFRESH_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n  ]\n}\n\nexport class SimpleLogin {\n  private clientId: string\n  private clientSecret: string\n  private redirectUri: string\n  private origin: string\n  private baseUrl: string\n\n  constructor(config: SimpleLoginConfig = {}) {\n    this.clientId = config.clientId ?? getEnv('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.clientSecret = config.clientSecret ?? getEnv('SIMPLELOGIN_CLIENT_SECRET') ?? ''\n    this.redirectUri = config.redirectUri ?? getEnv('SIMPLELOGIN_REDIRECT_URI') ?? ''\n    this.origin = config.origin ?? getEnv('SIMPLELOGIN_ORIGIN') ?? ''\n    this.baseUrl = BASE_URL\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var.',\n      )\n    }\n    if (!this.clientSecret) {\n      throw new Error(\n        'clientSecret is required. Pass it in config or set SIMPLELOGIN_CLIENT_SECRET env var.',\n      )\n    }\n    if (!this.redirectUri) {\n      throw new Error(\n        'redirectUri is required. Pass it in config or set SIMPLELOGIN_REDIRECT_URI env var.',\n      )\n    }\n    if (!this.origin) {\n      throw new Error('origin is required. Pass it in config or set SIMPLELOGIN_ORIGIN env var.')\n    }\n  }\n\n  /**\n   * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.\n   * @param options - Optional scopes or custom state\n   * @returns A 302 redirect Response ready to be returned from your route handler\n   */\n  async redirectToAuth(options: AuthorizationUrlOptions = {}): Promise<Response> {\n    const { url, cookies } = await this.getAuthorizationUrl(options)\n    const headers = new Headers()\n    headers.set('Location', url)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    return new Response(null, { status: 302, headers })\n  }\n\n  /**\n   * Generate the authorization URL to redirect users for sign-in\n   * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values\n   */\n  async getAuthorizationUrl(\n    options: AuthorizationUrlOptions = {},\n  ): Promise<AuthorizationUrlResult> {\n    const state = options.state ?? generateState()\n    const codeVerifier = generateCodeVerifier()\n    const codeChallenge = await generateCodeChallenge(codeVerifier)\n\n    const params = new URLSearchParams({\n      client_id: this.clientId,\n      redirect_uri: this.redirectUri,\n      response_type: 'code',\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    })\n\n    if (options.scopes?.length) {\n      params.set('scope', options.scopes.join(' '))\n    }\n\n    const cookies = [\n      `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n      `SIMPLELOGIN_CODE_VERIFIER=${codeVerifier}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n    ]\n\n    return {\n      url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,\n      state,\n      codeVerifier,\n      cookies,\n    }\n  }\n\n  /**\n   * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.\n   * @param request - The incoming Request object from the callback\n   * @param redirectTo - URL to redirect to after successful authentication (default: '/')\n   * @returns CallbackResult with redirect Response (cookies set) and user info to store\n   * @throws AuthorizationError if state is missing or doesn't match\n   */\n  async handleCallback(request: Request, redirectTo: string = '/'): Promise<CallbackResult> {\n    const url = new URL(request.url)\n    const code = url.searchParams.get('code')\n    const state = url.searchParams.get('state')\n\n    if (!code) {\n      throw new AuthorizationError('Missing authorization code in callback')\n    }\n\n    if (!state) {\n      throw new AuthorizationError('Missing state parameter in callback')\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const expectedState = parseCookie(cookieHeader, 'SIMPLELOGIN_STATE')\n    const codeVerifier = parseCookie(cookieHeader, 'SIMPLELOGIN_CODE_VERIFIER')\n\n    if (!expectedState) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_STATE cookie')\n    }\n\n    if (state !== expectedState) {\n      throw new AuthorizationError('Invalid state parameter')\n    }\n\n    if (!codeVerifier) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_CODE_VERIFIER cookie')\n    }\n\n    // Exchange code for tokens (with PKCE code_verifier)\n    const tokens = await this.exchangeCode(code, codeVerifier)\n\n    // Fetch user info (only time we do this)\n    const user = await this.getUserInfo(tokens.access_token)\n\n    // Build redirect response with token cookies\n    const cookies = createTokenCookies(tokens)\n    const headers = new Headers()\n    headers.set('Location', redirectTo)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    // Clear the state and code verifier cookies\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_STATE=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_CODE_VERIFIER=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n\n    const response = new Response(null, { status: 302, headers })\n\n    return { response, user }\n  }\n\n  /**\n   * Exchange an authorization code for access and refresh tokens\n   * @param code - The authorization code from the callback\n   * @param codeVerifier - The PKCE code verifier\n   */\n  async exchangeCode(code: string, codeVerifier: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        redirect_uri: this.redirectUri,\n        code,\n        code_verifier: codeVerifier,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to exchange authorization code')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshToken(refreshToken: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        refresh_token: refreshToken,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to refresh token')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Get user information using an access token\n   */\n  async getUserInfo(accessToken: string): Promise<UserInfo> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/userinfo`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch user info')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Fetch and cache the public key for JWT verification\n   */\n  private async getPublicKey(): Promise<CryptoKey> {\n    const cached = publicKeyCache.get(this.clientId)\n    if (cached && Date.now() - cached.fetchedAt < PUBLIC_KEY_CACHE_TTL) {\n      return cached.key\n    }\n\n    const response = await fetch(`${this.baseUrl}/api/applications/${this.clientId}/public-key`)\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch public key')\n    }\n\n    const data = await response.json()\n    const pem = data['public_key']\n    const key = await importSPKI(pem, 'RS256')\n\n    publicKeyCache.set(this.clientId, { key, fetchedAt: Date.now() })\n    return key\n  }\n\n  /**\n   * Authenticate a request by verifying the access token from cookies.\n   * No network calls except when refreshing expired tokens.\n   * CSRF protection is automatic using the origin from config.\n   * @param request - The incoming Request object\n   * @returns AuthResult if authenticated, null if not authenticated\n   */\n  async authenticate(request: Request): Promise<AuthResult | null> {\n    // CSRF protection for state-changing requests\n    const method = request.method.toUpperCase()\n    if (method !== 'GET' && method !== 'HEAD') {\n      const requestOrigin = request.headers.get('origin') || request.headers.get('referer')\n      if (!requestOrigin?.startsWith(this.origin)) {\n        return null\n      }\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const accessToken = parseCookie(cookieHeader, 'SIMPLELOGIN_ACCESS_TOKEN')\n    const refreshTokenValue = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // No tokens at all\n    if (!accessToken && !refreshTokenValue) {\n      return null\n    }\n\n    // No access token but have refresh token - try to get new tokens\n    if (!accessToken && refreshTokenValue) {\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n\n        const headers = new Headers()\n        for (const cookie of createTokenCookies(tokens)) {\n          headers.append('Set-Cookie', cookie)\n        }\n\n        return { claims, accessToken: tokens.access_token, headers }\n      } catch {\n        return null\n      }\n    }\n\n    // At this point, accessToken is guaranteed to be defined\n    const token = accessToken!\n\n    const publicKey = await this.getPublicKey()\n\n    try {\n      // Verify the token (local, no network call)\n      await jwtVerify(token, publicKey)\n\n      // Decode claims from JWT (no network call)\n      const claims = decodeJwt(token) as AccessTokenClaims\n\n      return { claims, accessToken: token, headers: new Headers() }\n    } catch (error) {\n      // Check if token is expired\n      const isExpired =\n        error instanceof Error &&\n        'code' in error &&\n        (error as { code: string }).code === 'ERR_JWT_EXPIRED'\n\n      if (!isExpired || !refreshTokenValue) {\n        return null\n      }\n\n      // Token expired, try to refresh\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n\n        // Build headers with new cookies\n        const headers = new Headers()\n        for (const cookie of createTokenCookies(tokens)) {\n          headers.append('Set-Cookie', cookie)\n        }\n\n        return { claims, accessToken: tokens.access_token, headers }\n      } catch {\n        return null\n      }\n    }\n  }\n\n  /**\n   * Revoke a refresh token on the IdP\n   */\n  private async revokeToken(refreshToken: string): Promise<void> {\n    await fetch(`${this.baseUrl}/v1/auth/revoke`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        token: refreshToken,\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n      }),\n    })\n  }\n\n  /**\n   * Logout: revoke refresh token on IdP, clear cookies, and redirect to auth.\n   * @param request - The incoming Request object (to read refresh token from cookies)\n   */\n  async logout(request: Request): Promise<Response> {\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const refreshToken = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // Revoke token on IdP (fire and forget - don't block logout on failure)\n    if (refreshToken) {\n      this.revokeToken(refreshToken).catch(() => {})\n    }\n\n    // Get auth redirect response\n    const authResponse = await this.redirectToAuth()\n\n    // Merge clear cookies with auth cookies\n    const headers = new Headers(authResponse.headers)\n    for (const cookie of clearTokenCookies()) {\n      headers.append('Set-Cookie', cookie)\n    }\n\n    return new Response(null, { status: 302, headers })\n  }\n}\n","export class SimpleLoginError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number,\n  ) {\n    super(message)\n    this.name = 'SimpleLoginError'\n  }\n}\n\nexport class AuthorizationError extends SimpleLoginError {\n  constructor(message: string) {\n    super(message, 'AUTHORIZATION_ERROR', 401)\n    this.name = 'AuthorizationError'\n  }\n}\n\nexport class TokenError extends SimpleLoginError {\n  constructor(message: string) {\n    super(message, 'TOKEN_ERROR', 400)\n    this.name = 'TokenError'\n  }\n}\n","declare const __SIMPLELOGIN_BASE_URL__: string\n\nexport interface SimpleLoginBrowserConfig {\n  clientId?: string\n  baseUrl?: string\n  slug?: string\n}\n\nexport interface ProfileUrlOptions {\n  redirectUrl: string\n}\n\n// Common framework prefixes for public env vars\nconst PUBLIC_ENV_PREFIXES = [\n  'VITE_', // Vite\n  'NEXT_PUBLIC_', // Next.js\n  'NUXT_PUBLIC_', // Nuxt 3\n  'PUBLIC_', // SvelteKit\n  'REACT_APP_', // Create React App\n  'EXPO_PUBLIC_', // Expo\n]\n\nfunction getMetaEnv(key: string): string | undefined {\n  try {\n    const meta = import.meta as unknown as { env?: Record<string, string> }\n    if (meta.env) {\n      return meta.env[key]\n    }\n  } catch {\n    // import.meta not available\n  }\n  return undefined\n}\n\nfunction getMetaEnvPublic(key: string): string | undefined {\n  try {\n    const meta = import.meta as unknown as { env?: Record<string, string> }\n    if (!meta.env) return undefined\n    for (const prefix of PUBLIC_ENV_PREFIXES) {\n      const value = meta.env[`${prefix}${key}`]\n      if (value) return value\n    }\n    return meta.env[key]\n  } catch {\n    // import.meta not available\n  }\n  return undefined\n}\n\nexport class SimpleLoginBrowser {\n  private clientId: string\n  private baseUrl: string\n  private slug: string\n\n  constructor(config: SimpleLoginBrowserConfig = {}) {\n    this.clientId = config.clientId ?? getMetaEnvPublic('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.slug = config.slug ?? getMetaEnvPublic('SIMPLELOGIN_SLUG') ?? ''\n    this.baseUrl =\n      config.baseUrl ?? getMetaEnvPublic('SIMPLELOGIN_IDP_URL') ?? __SIMPLELOGIN_BASE_URL__\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var (with appropriate framework prefix like VITE_, NEXT_PUBLIC_, etc.).',\n      )\n    }\n  }\n\n  /**\n   * Get the URL to the user's profile page\n   * @param options.redirectUrl - URL to redirect back to after profile changes\n   */\n  getProfileUrl(options: ProfileUrlOptions): string {\n    const params = new URLSearchParams({\n      redirect_url: options.redirectUrl,\n    })\n\n    return `${this.baseUrl}/app/${this.slug}/profile?${params}`\n  }\n}\n"],"mappings":";AAAA,SAAS,WAAW,YAAY,iBAAiB;;;ACA1C,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACO,MACA,YACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,iBAAiB;AAAA,EACvD,YAAY,SAAiB;AAC3B,UAAM,SAAS,uBAAuB,GAAG;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,aAAN,cAAyB,iBAAiB;AAAA,EAC/C,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe,GAAG;AACjC,SAAK,OAAO;AAAA,EACd;AACF;;;ADRA,IAAM,WAAW,aAAa,qBAAqB,KAAK;AAExD,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAE5B,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EACtC,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,eAAe,sBAAsB,UAAmC;AACtE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAEvD,SAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,EACrD,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAGA,IAAM,sBAAsB;AAAA,EAC1B;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAEA,SAAS,OAAO,KAAiC;AAC/C,MAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,aAAa,KAAiC;AACrD,MAAI,OAAO,YAAY,eAAe,CAAC,QAAQ,KAAK;AAClD,WAAO;AAAA,EACT;AACA,aAAW,UAAU,qBAAqB;AACxC,UAAM,QAAQ,QAAQ,IAAI,GAAG,MAAM,GAAG,GAAG,EAAE;AAC3C,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO,QAAQ,IAAI,GAAG;AACxB;AAEA,SAAS,YAAY,cAAsB,MAAkC;AAC3E,QAAM,QAAQ,aAAa,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACzE,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGA,IAAM,iBAAiB,oBAAI,IAAmD;AAC9E,IAAM,uBAAuB,KAAK,KAAK;AACvC,IAAM,yBAAyB,KAAK,KAAK,KAAK;AAE9C,SAAS,mBAAmB,QAAiC;AAC3D,SAAO;AAAA,IACL,4BAA4B,OAAO,YAAY,qDAAqD,OAAO,UAAU;AAAA,IACrH,6BAA6B,OAAO,aAAa,qDAAqD,sBAAsB;AAAA,EAC9H;AACF;AAEA,SAAS,oBAA8B;AACrC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA4B,CAAC,GAAG;AAC1C,SAAK,WAAW,OAAO,YAAY,OAAO,uBAAuB,KAAK;AACtE,SAAK,eAAe,OAAO,gBAAgB,OAAO,2BAA2B,KAAK;AAClF,SAAK,cAAc,OAAO,eAAe,OAAO,0BAA0B,KAAK;AAC/E,SAAK,SAAS,OAAO,UAAU,OAAO,oBAAoB,KAAK;AAC/D,SAAK,UAAU;AAEf,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAI,MAAM,0EAA0E;AAAA,IAC5F;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,UAAmC,CAAC,GAAsB;AAC7E,UAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,KAAK,oBAAoB,OAAO;AAC/D,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,GAAG;AAC3B,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBACJ,UAAmC,CAAC,GACH;AACjC,UAAM,QAAQ,QAAQ,SAAS,cAAc;AAC7C,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAE9D,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,eAAe;AAAA,MACf;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,QAAI,QAAQ,QAAQ,QAAQ;AAC1B,aAAO,IAAI,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9C;AAEA,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK;AAAA,MAC1B,6BAA6B,YAAY;AAAA,IAC3C;AAEA,WAAO;AAAA,MACL,KAAK,GAAG,KAAK,OAAO,sBAAsB,OAAO,SAAS,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAAkB,aAAqB,KAA8B;AACxF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB,wCAAwC;AAAA,IACvE;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,gBAAgB,YAAY,cAAc,mBAAmB;AACnE,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAE1E,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,mBAAmB,kCAAkC;AAAA,IACjE;AAEA,QAAI,UAAU,eAAe;AAC3B,YAAM,IAAI,mBAAmB,yBAAyB;AAAA,IACxD;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,mBAAmB,0CAA0C;AAAA,IACzE;AAGA,UAAM,SAAS,MAAM,KAAK,aAAa,MAAM,YAAY;AAGzD,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,YAAY;AAGvD,UAAM,UAAU,mBAAmB,MAAM;AACzC,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,UAAU;AAClC,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAE5D,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,MAAc,cAA8C;AAC7E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,cAAc,KAAK;AAAA,QACnB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,uCAAuC;AAAA,IACzF;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,cAA8C;AAC/D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,yBAAyB;AAAA,IAC3E;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAAwC;AACxD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB;AAAA,MAC/D,SAAS;AAAA,QACP,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,eAAmC;AAC/C,UAAM,SAAS,eAAe,IAAI,KAAK,QAAQ;AAC/C,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,YAAY,sBAAsB;AAClE,aAAO,OAAO;AAAA,IAChB;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB,KAAK,QAAQ,aAAa;AAC3F,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,4BAA4B;AAAA,IAC3D;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,MAAM,KAAK,YAAY;AAC7B,UAAM,MAAM,MAAM,WAAW,KAAK,OAAO;AAEzC,mBAAe,IAAI,KAAK,UAAU,EAAE,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aAAa,SAA8C;AAE/D,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,YAAM,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,IAAI,SAAS;AACpF,UAAI,CAAC,eAAe,WAAW,KAAK,MAAM,GAAG;AAC3C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,cAAc,YAAY,cAAc,0BAA0B;AACxE,UAAM,oBAAoB,YAAY,cAAc,2BAA2B;AAG/E,QAAI,CAAC,eAAe,CAAC,mBAAmB;AACtC,aAAO;AAAA,IACT;AAGA,QAAI,CAAC,eAAe,mBAAmB;AACrC,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,SAAS,UAAU,OAAO,YAAY;AAE5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,mBAAW,UAAU,mBAAmB,MAAM,GAAG;AAC/C,kBAAQ,OAAO,cAAc,MAAM;AAAA,QACrC;AAEA,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,QAAQ;AAEd,UAAM,YAAY,MAAM,KAAK,aAAa;AAE1C,QAAI;AAEF,YAAM,UAAU,OAAO,SAAS;AAGhC,YAAM,SAAS,UAAU,KAAK;AAE9B,aAAO,EAAE,QAAQ,aAAa,OAAO,SAAS,IAAI,QAAQ,EAAE;AAAA,IAC9D,SAAS,OAAO;AAEd,YAAM,YACJ,iBAAiB,SACjB,UAAU,SACT,MAA2B,SAAS;AAEvC,UAAI,CAAC,aAAa,CAAC,mBAAmB;AACpC,eAAO;AAAA,MACT;AAGA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,SAAS,UAAU,OAAO,YAAY;AAG5C,cAAM,UAAU,IAAI,QAAQ;AAC5B,mBAAW,UAAU,mBAAmB,MAAM,GAAG;AAC/C,kBAAQ,OAAO,cAAc,MAAM;AAAA,QACrC;AAEA,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,cAAqC;AAC7D,UAAM,MAAM,GAAG,KAAK,OAAO,mBAAmB;AAAA,MAC5C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,SAAqC;AAChD,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAG1E,QAAI,cAAc;AAChB,WAAK,YAAY,YAAY,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC/C;AAGA,UAAM,eAAe,MAAM,KAAK,eAAe;AAG/C,UAAM,UAAU,IAAI,QAAQ,aAAa,OAAO;AAChD,eAAW,UAAU,kBAAkB,GAAG;AACxC,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AACF;;;AElcA,IAAMA,uBAAsB;AAAA,EAC1B;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAcA,SAAS,iBAAiB,KAAiC;AACzD,MAAI;AACF,UAAM,OAAO;AACb,QAAI,CAAC,KAAK,IAAK,QAAO;AACtB,eAAW,UAAUC,sBAAqB;AACxC,YAAM,QAAQ,KAAK,IAAI,GAAG,MAAM,GAAG,GAAG,EAAE;AACxC,UAAI,MAAO,QAAO;AAAA,IACpB;AACA,WAAO,KAAK,IAAI,GAAG;AAAA,EACrB,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAAmC,CAAC,GAAG;AACjD,SAAK,WAAW,OAAO,YAAY,iBAAiB,uBAAuB,KAAK;AAChF,SAAK,OAAO,OAAO,QAAQ,iBAAiB,kBAAkB,KAAK;AACnE,SAAK,UACH,OAAO,WAAW,iBAAiB,qBAAqB,KAAK;AAE/D,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,SAAoC;AAChD,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,cAAc,QAAQ;AAAA,IACxB,CAAC;AAED,WAAO,GAAG,KAAK,OAAO,QAAQ,KAAK,IAAI,YAAY,MAAM;AAAA,EAC3D;AACF;","names":["PUBLIC_ENV_PREFIXES","PUBLIC_ENV_PREFIXES"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-login/sdk",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "description": "Official SDK for Simple Login",
   "type": "module",
   "main": "./dist/index.cjs",