@synqauth/js 0.2.0 → 0.3.0

package/dist/api-BGeXhXo6.js

@@ -0,0 +1,913 @@
+import * as oauth from "oauth4webapi";
+import { AuthorizationResponseError, OperationProcessingError, ResponseBodyError, WWWAuthenticateChallengeError } from "oauth4webapi";
+//#region src/errors.ts
+/**
+* Every error the SDK throws. Branch on `code`, which is stable: the API's
+* problem `code`, OAuth's `error`, or one of the SDK's own; never on the
+* message.
+*/
+var SynqError = class extends Error {
+	name = "SynqError";
+	code;
+	/** The HTTP status Synq answered with, when it answered. */
+	status;
+	/** What Synq said about it: OAuth's `error_description` or a problem's `detail`. */
+	description;
+	/**
+	* Known seconds to wait from Retry-After, or a validated 429 problem's
+	* retry_after when the header is unavailable. Undefined when no wait is known.
+	*/
+	retryAfter;
+	/** The API-origin execution ID to quote to support, when the server supplied one. */
+	requestId;
+	constructor(code, message, options = {}) {
+		super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+		this.code = code;
+		this.status = options.status;
+		this.description = options.description;
+		this.retryAfter = options.retryAfter;
+		this.requestId = options.requestId;
+	}
+};
+/** Whether `error` is a `SynqError`, with `code` when given. */
+function isSynqError(error, code) {
+	return error instanceof SynqError && (code === void 0 || error.code === code);
+}
+/** A `SynqError` for a problem document a Synq API answered with. */
+function problemError(status, problem, retryAfter, requestId) {
+	const code = typeof problem.code === "string" ? problem.code : `http_${status}`;
+	const description = typeof problem.detail === "string" ? problem.detail : void 0;
+	return new SynqError(code, description ?? problem.title ?? `Synq answered ${status}`, {
+		status,
+		description,
+		retryAfter: retryAfter ?? (status === 429 && typeof problem.retry_after === "number" && Number.isSafeInteger(problem.retry_after) && problem.retry_after >= 0 ? problem.retry_after : void 0),
+		requestId: validRequestId(requestId) ?? validRequestId(problem.request_id),
+		cause: problem
+	});
+}
+function validRequestId(value) {
+	return typeof value === "string" && /^req_[0-9a-f]{32}$/.test(value) ? value : void 0;
+}
+/**
+* The seconds a `Retry-After` header asks for: a number of seconds, or an
+* HTTP date, counted from `now`. Undefined when there is none, or it can't
+* be read.
+*/
+function retryAfterSeconds(header, now = Date.now()) {
+	const value = header?.trim();
+	if (!value) return void 0;
+	if (/^[0-9]+$/.test(value)) {
+		const seconds = Number(value);
+		return Number.isSafeInteger(seconds) ? seconds : void 0;
+	}
+	if (!/[A-Za-z]/.test(value)) return void 0;
+	const at = Date.parse(value);
+	return Number.isNaN(at) ? void 0 : Math.max(0, Math.ceil((at - now) / 1e3));
+}
+/**
+* A `SynqError` for whatever went wrong talking to Synq's issuer: OAuth's
+* error responses keep their `error`, a failed check of Synq's answer is
+* `invalid_response`, and a request that never got an answer is
+* `network_error`.
+*/
+function toSynqError(error) {
+	if (error instanceof SynqError) return error;
+	if (error instanceof ResponseBodyError) return new SynqError(error.error, error.error_description ?? error.error, {
+		status: error.status,
+		description: error.error_description,
+		cause: error
+	});
+	if (error instanceof AuthorizationResponseError) return new SynqError(error.error, error.error_description ?? error.error, {
+		description: error.error_description,
+		cause: error
+	});
+	if (error instanceof WWWAuthenticateChallengeError) {
+		const challenge = error.cause[0];
+		const code = challenge?.parameters.error ?? "invalid_token";
+		const description = challenge?.parameters.error_description;
+		return new SynqError(code, description ?? code, {
+			status: error.status,
+			description,
+			cause: error
+		});
+	}
+	if (error instanceof OperationProcessingError) return new SynqError("invalid_response", error.message, { cause: error });
+	if (error instanceof TypeError) return new SynqError("network_error", `Synq couldn't be reached: ${error.message}`, { cause: error });
+	return new SynqError("invalid_response", error instanceof Error ? error.message : "Synq answered with something unexpected", { cause: error });
+}
+//#endregion
+//#region src/email-work.js
+/** @typedef {{ticket:string, algorithm:'sha256-leading-zero-bits-v1', bits:number, expiresAt:number}} EmailWorkChallenge */
+const K = new Int32Array([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+const IV = [
+	1779033703,
+	3144134277,
+	1013904242,
+	2773480762,
+	1359893119,
+	2600822924,
+	528734635,
+	1541459225
+];
+/**
+* One SHA-256 compression of the 64 bytes of `block` at `at` into `state`.
+* @param {Int32Array} state eight words, updated in place
+* @param {Uint8Array} block
+* @param {number} at
+* @param {Int32Array} w a 64-word schedule to reuse
+*/
+function compress(state, block, at, w) {
+	for (let i = 0; i < 16; i++, at += 4) w[i] = (block[at] ?? 0) << 24 | (block[at + 1] ?? 0) << 16 | (block[at + 2] ?? 0) << 8 | (block[at + 3] ?? 0);
+	for (let i = 16; i < 64; i++) {
+		const x = w[i - 15] ?? 0, y = w[i - 2] ?? 0;
+		const s0 = (x >>> 7 | x << 25) ^ (x >>> 18 | x << 14) ^ x >>> 3;
+		const s1 = (y >>> 17 | y << 15) ^ (y >>> 19 | y << 13) ^ y >>> 10;
+		w[i] = (w[i - 16] ?? 0) + s0 + (w[i - 7] ?? 0) + s1 | 0;
+	}
+	let a = state[0] ?? 0, b = state[1] ?? 0, c = state[2] ?? 0, d = state[3] ?? 0, e = state[4] ?? 0, f = state[5] ?? 0, g = state[6] ?? 0, h = state[7] ?? 0;
+	for (let i = 0; i < 64; i++) {
+		const t1 = h + ((e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7)) + (e & f ^ ~e & g) + (K[i] ?? 0) + (w[i] ?? 0) | 0;
+		const t2 = ((a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10)) + (a & b ^ a & c ^ b & c) | 0;
+		h = g;
+		g = f;
+		f = e;
+		e = d + t1 | 0;
+		d = c;
+		c = b;
+		b = a;
+		a = t1 + t2 | 0;
+	}
+	state[0] = (state[0] ?? 0) + a | 0;
+	state[1] = (state[1] ?? 0) + b | 0;
+	state[2] = (state[2] ?? 0) + c | 0;
+	state[3] = (state[3] ?? 0) + d | 0;
+	state[4] = (state[4] ?? 0) + e | 0;
+	state[5] = (state[5] ?? 0) + f | 0;
+	state[6] = (state[6] ?? 0) + g | 0;
+	state[7] = (state[7] ?? 0) + h | 0;
+}
+/**
+* The first 32 bits of SHA-256(`synq/signup-email-work/v1\0<ticket>\0<nonce>`),
+* for one ticket and any nonce from 0 to 9,999,999. Only the nonce changes
+* between attempts, so every whole 64-byte block before it is hashed once,
+* and each attempt hashes only the last one or two blocks: a ticket of up to
+* 2 KiB costs an attempt no more than a short one does. Exported for the
+* tests, which hold it to node:crypto; not part of the SDK's API.
+* @param {string} ticket
+* @returns {(nonce: number) => number} the digest's first word, unsigned
+*/
+function emailWorkHasher(ticket) {
+	const prefix = `synq/signup-email-work/v1\0${ticket}\0`;
+	for (let i = 0; i < prefix.length; i++) if (prefix.charCodeAt(i) > 127) throw new TypeError("An email work ticket is ASCII");
+	const whole = prefix.length - prefix.length % 64;
+	const bytes = new Uint8Array(whole);
+	for (let i = 0; i < whole; i++) bytes[i] = prefix.charCodeAt(i);
+	const w = /* @__PURE__ */ new Int32Array(64), midstate = Int32Array.from(IV), state = /* @__PURE__ */ new Int32Array(8);
+	for (let at = 0; at < whole; at += 64) compress(midstate, bytes, at, w);
+	const tail = /* @__PURE__ */ new Uint8Array(128), rest = prefix.length - whole;
+	for (let i = 0; i < rest; i++) tail[i] = prefix.charCodeAt(whole + i);
+	return (nonce) => {
+		const digits = String(nonce);
+		let at = rest;
+		for (let i = 0; i < digits.length; i++) tail[at++] = digits.charCodeAt(i);
+		tail[at++] = 128;
+		const end = at + 8 <= 64 ? 64 : 128;
+		tail.fill(0, at, end - 4);
+		const bits = (prefix.length + digits.length) * 8;
+		tail[end - 4] = bits >>> 24;
+		tail[end - 3] = bits >>> 16;
+		tail[end - 2] = bits >>> 8;
+		tail[end - 1] = bits;
+		state.set(midstate);
+		compress(state, tail, 0, w);
+		if (end === 128) compress(state, tail, 64, w);
+		return (state[0] ?? 0) >>> 0;
+	};
+}
+/**
+* How the solver gives the event loop a turn between slices of work, so
+* input, rendering and an abort run while it works, with no timer's clamped
+* delay where the runtime has something better: `scheduler.yield()`; in a
+* browser without it, a MessageChannel, whose every message is a task of its
+* own; in Node, setImmediate (Node drains a port's messages without turning
+* its loop); elsewhere (React Native, whose chained setImmediate never hands
+* native a turn), a timer.
+* @returns {{pause: () => Promise<unknown>, close: () => void}}
+*/
+function turns() {
+	const scope = globalThis;
+	const scheduler = scope.scheduler, yieldTurn = scheduler?.yield, immediate = scope.setImmediate;
+	if (typeof yieldTurn === "function") return {
+		pause: () => yieldTurn.call(scheduler),
+		close: () => {}
+	};
+	if (typeof scope.document === "object" && typeof MessageChannel === "function") {
+		const channel = new MessageChannel();
+		/** @type {(value?: unknown) => void} */
+		let wake = () => {};
+		channel.port1.onmessage = () => wake();
+		return {
+			pause: () => new Promise((resolve) => {
+				wake = resolve;
+				channel.port2.postMessage(0);
+			}),
+			close: () => channel.port1.close()
+		};
+	}
+	if (typeof scope.process?.versions?.node === "string" && typeof immediate === "function") return {
+		pause: () => new Promise((resolve) => immediate(() => resolve(void 0))),
+		close: () => {}
+	};
+	return {
+		pause: () => new Promise((resolve) => setTimeout(resolve, 0)),
+		close: () => {}
+	};
+}
+/** How long one slice of attempts may hold the thread before the solver yields. */
+const SLICE_MS = 8;
+/**
+* Public, bounded proof solver in plain JavaScript (the hash above): no key,
+* account lookup, platform crypto or third-party code, so it runs the same in
+* every browser, Node and React Native.
+* @param {EmailWorkChallenge} work
+* @param {{signal?:AbortSignal, maxIterations?:number, timeoutMs?:number}} [options]
+* @returns {Promise<string>} Canonical decimal nonce; send with the unchanged ticket.
+*/
+async function solveEmailWork$1(work, options = {}) {
+	const cap = Math.min(options.maxIterations ?? 1048576, 1048576);
+	const timeout = Math.min(options.timeoutMs ?? 2e3, 2e3);
+	if (!work || typeof work.ticket !== "string" || work.ticket.length > 2048 || !/^synq_work_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{43}$/.test(work.ticket) || work.algorithm !== "sha256-leading-zero-bits-v1" || ![12, 14].includes(work.bits) || !Number.isSafeInteger(work.expiresAt) || work.expiresAt <= Date.now() || !Number.isSafeInteger(cap) || cap < 1 || !Number.isFinite(timeout) || timeout < 1) throw new Error("Invalid email work challenge: request another");
+	const started = performance.now(), hash = emailWorkHasher(work.ticket), shift = 32 - work.bits, turn = turns();
+	try {
+		for (let nonce = 0; nonce < cap;) {
+			options.signal?.throwIfAborted();
+			if (Date.now() >= work.expiresAt) throw new Error("Email work expired: request another");
+			const now = performance.now();
+			if (now - started >= timeout) throw new Error("Email work took too long: retry or use another sign-in method");
+			const until = now + SLICE_MS;
+			do
+				for (const stop = Math.min(cap, nonce + 256); nonce < stop; nonce++) if (hash(nonce) >>> shift === 0) {
+					if (Date.now() >= work.expiresAt) throw new Error("Email work expired: request another");
+					return String(nonce);
+				}
+			while (nonce < cap && performance.now() < until);
+			if (nonce < cap) await turn.pause();
+		}
+	} finally {
+		turn.close();
+	}
+	throw new Error("Email work limit reached: request another challenge");
+}
+//#endregion
+//#region src/email-work-api.ts
+/** Solve with bounded work in plain JavaScript and return the decimal nonce for the unchanged ticket. */
+function solveEmailWork(work, options = {}) {
+	return solveEmailWork$1(work, options);
+}
+//#endregion
+//#region src/linked-accounts.ts
+/** A test account as `/authorize-challenge` takes it: `synq_test_*` fields. */
+function testAccountFields(account) {
+	const fields = {
+		provider: account.provider,
+		account: account.account,
+		username: account.username,
+		email: account.email,
+		name: account.name,
+		account_type: account.accountType,
+		account_age_days: account.accountAgeDays,
+		created_at: account.createdAt,
+		public_repos: account.publicRepos,
+		followers: account.followers,
+		email_verified: account.emailVerified,
+		workspace_domain: account.workspaceDomain
+	};
+	return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== void 0).map(([name, value]) => [`synq_test_${name}`, String(value)]));
+}
+/** The `linked_accounts` claim, read safely: the entries that are objects, else undefined. */
+function linkedAccountsOf(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter((entry) => typeof entry === "object" && entry !== null && typeof entry.provider === "string" && typeof entry.subject === "string");
+}
+//#endregion
+//#region src/sign-in-flow.ts
+/** A new flow's state: a PKCE verifier and nonce of its own. */
+function newSignIn(scope, options) {
+	return {
+		v: 1,
+		verifier: oauth.generateRandomCodeVerifier(),
+		nonce: oauth.generateRandomNonce(),
+		scope,
+		...options.resource ? { resource: options.resource } : {},
+		...options.additionalResources?.length ? { additionalResources: [...options.additionalResources] } : {},
+		...options.acr ? { acr: options.acr } : {},
+		step: "start"
+	};
+}
+/** A saved flow, checked: one this SDK wrote. */
+function readSavedSignIn(saved) {
+	const value = typeof saved === "string" ? JSON.parse(saved) : saved;
+	if (value?.v !== 1 || typeof value.verifier !== "string" || typeof value.nonce !== "string" || typeof value.scope !== "string" || typeof value.step !== "string") throw new SynqError("invalid_options", "That is not a sign-in this SDK saved");
+	return value;
+}
+/** One sign-in on an app's own screens. */
+var SignInFlow = class {
+	#port;
+	#state;
+	#workEpoch = 0;
+	#workJob;
+	constructor(port, state) {
+		this.#port = port;
+		this.#state = state;
+	}
+	/** What the app's screen asks for now. */
+	get step() {
+		return this.#state.step;
+	}
+	/** The address the sign-in is for, once one was typed. */
+	get address() {
+		return this.#state.email;
+	}
+	/** Email and password. */
+	password = {
+		signIn: (input) => this.#ask(this.#method("password", {
+			username: input.email,
+			password: input.password
+		}), { email: input.email }),
+		/** Makes an account where the brand lets people sign up; its address is verified next. */
+		signUp: (input) => this.#ask(this.#method("password", {
+			username: input.email,
+			password: input.password,
+			synq_screen: "sign-up"
+		}), { email: input.email })
+	};
+	/** A code by email. */
+	email = {
+		send: (email) => this.#ask(this.#method("email", { username: email }), { email }),
+		verify: (code) => this.#ask({ otp: code }),
+		resend: () => this.#ask({ synq_action: "resend" })
+	};
+	/**
+	* A test sign-in (AERO-2343): a made-up GitHub or Google account, signed
+	* in at once, for an app with `test_sign_ins` on, on Synq's stages other
+	* than production. For end-to-end tests that want tokens without a real
+	* account or a browser.
+	*/
+	test = { signIn: (account) => this.#ask(this.#method("test", testAccountFields(account))) };
+	/** A passkey: `options()`, then the browser's assertion to `signIn`. */
+	passkey = {
+		options: () => this.#ask(this.#method("passkey", {})),
+		signIn: (credential, options = {}) => this.#ask({
+			synq_passkey: JSON.stringify(credential),
+			...options.related ? { synq_passkey_rp: "related" } : {}
+		})
+	};
+	/**
+	* A Solana wallet (AERO-2681): `siws` is the wallet's signature over a
+	* sign-in request this app's page asked the issuer for, as
+	* `@synqauth/solana`'s `requestSignIn`, `signWithWallet` and `encodeSiws`
+	* make it. One request, with no page: signed in, or `retry` with
+	* `wallet_failed` (not the wallet's signature) or `wallet_expired` (ask
+	* for another request), the flow going on for the next try.
+	*
+	* `reauthenticate` signs the person signed in now in again, for a change
+	* that wants a recent sign-in: it is the ID token this app holds for
+	* them, and only they can sign in. Another account's wallet, or one
+	* nobody signs in with, is `refused` with `other_account`, and nothing
+	* changes at Synq.
+	*/
+	wallet = { signIn: (siws, options = {}) => this.#ask(this.#method("wallet", {
+		synq_siws: siws,
+		...options.reauthenticate ? { synq_reauthenticate: options.reauthenticate } : {}
+	})) };
+	/** Verifying an address after a sign-in that didn't prove it. */
+	verifyEmail = {
+		verify: (code) => this.#ask({ otp: code }),
+		resend: () => this.#ask({ synq_action: "resend" }),
+		skip: () => this.#ask({ synq_action: "skip" })
+	};
+	/** The flow, to keep between requests (a server's sealed cookie, a phone's secure storage). */
+	toJSON() {
+		return this.#state;
+	}
+	/** Cancel only local email-work computation; the server sign-in may be retried. */
+	cancelEmailWork() {
+		this.#workEpoch++;
+		this.#workJob?.abort();
+		this.#workJob = void 0;
+	}
+	/** Fields that name `method`, which a session already under way switches to. */
+	#method(method, fields) {
+		return {
+			synq_method: method,
+			...fields
+		};
+	}
+	async #ask(fields, changes = {}) {
+		if (this.#state.step === "done") throw new SynqError("invalid_session", "This sign-in has finished: start another");
+		this.cancelEmailWork();
+		const epoch = this.#workEpoch;
+		if (changes.email !== void 0) this.#state = {
+			...this.#state,
+			email: changes.email
+		};
+		const recipient = this.#state.email ?? "";
+		const superseded = () => ({
+			status: "retry",
+			problem: "work_required",
+			message: "This computation was cancelled or replaced. Continue with your latest sign-in request."
+		});
+		const initial = { ...this.#state };
+		let answer = await this.#send(fields, initial);
+		if (epoch !== this.#workEpoch) return superseded();
+		const work = answer.body.synq_work;
+		if ((fields.synq_method === "email" || fields.synq_action === "resend" && this.#state.step === "code") && answer.body.synq_problem === "work_required" && work && typeof work === "object" && typeof answer.body.auth_session === "string") {
+			if (epoch !== this.#workEpoch) return superseded();
+			const captured = {
+				...this.#state,
+				email: recipient,
+				authSession: answer.body.auth_session
+			};
+			this.#state = captured;
+			const job = new AbortController();
+			this.#workJob = job;
+			const current = () => epoch === this.#workEpoch && this.#workJob === job && !job.signal.aborted;
+			try {
+				let solution;
+				try {
+					solution = await solveEmailWork(work, { signal: job.signal });
+				} catch {
+					return current() ? this.#read(answer) : superseded();
+				}
+				if (!current()) return superseded();
+				try {
+					answer = await this.#send({
+						...fields,
+						username: recipient,
+						synq_work: work.ticket,
+						synq_work_nonce: solution
+					}, captured, job.signal);
+				} catch (error) {
+					if (!current()) return superseded();
+					throw error;
+				}
+				if (!current()) return superseded();
+				return this.#read(answer);
+			} finally {
+				if (this.#workJob === job) this.#workJob = void 0;
+			}
+		}
+		return this.#read(answer);
+	}
+	async #send(fields, captured, signal) {
+		const port = this.#port;
+		const server = await port.server();
+		signal?.throwIfAborted();
+		const endpoint = server.authorization_challenge_endpoint;
+		if (typeof endpoint !== "string") throw new SynqError("discovery_failed", "The issuer doesn't sign people in on apps' own screens");
+		const body = new URLSearchParams(fields);
+		const state = captured ?? this.#state;
+		if (state.authSession) body.set("auth_session", state.authSession);
+		else {
+			body.set("response_type", "code");
+			body.set("scope", state.scope);
+			body.set("nonce", state.nonce);
+			body.set("code_challenge", await oauth.calculatePKCECodeChallenge(state.verifier));
+			body.set("code_challenge_method", "S256");
+			if (state.resource) body.set("resource", state.resource);
+			for (const extra of state.additionalResources ?? []) if (extra !== state.resource) body.append("resource", extra);
+			if (state.acr) {
+				if (state.acr.essential) body.set("claims", JSON.stringify({ id_token: { acr: {
+					essential: true,
+					values: [...state.acr.values]
+				} } }));
+				else body.set("acr_values", state.acr.values.join(" "));
+			}
+		}
+		const headers = new Headers({
+			accept: "application/json",
+			"content-type": "application/x-www-form-urlencoded",
+			...port.headers
+		});
+		await port.auth(server, port.client, body, headers);
+		signal?.throwIfAborted();
+		let response;
+		try {
+			response = await port.fetch(endpoint, {
+				method: "POST",
+				headers,
+				body: body.toString(),
+				redirect: "manual",
+				...signal ? { signal } : {}
+			});
+		} catch (error) {
+			throw toSynqError(error);
+		}
+		let parsed;
+		try {
+			parsed = await response.json();
+		} catch {
+			parsed = void 0;
+		}
+		if (!parsed || typeof parsed !== "object") throw new SynqError("invalid_response", `Synq answered ${response.status} with no JSON`, { status: response.status });
+		return {
+			status: response.status,
+			body: parsed,
+			retryAfter: retryAfterSeconds(response.headers.get("retry-after"))
+		};
+	}
+	async #read(answer) {
+		const { body } = answer;
+		const text = (name) => typeof body[name] === "string" ? body[name] : void 0;
+		const message = text("error_description") ?? "";
+		const problem = text("synq_problem");
+		const session = text("auth_session");
+		if (session) this.#state = {
+			...this.#state,
+			authSession: session
+		};
+		if (answer.status === 200 && typeof body.authorization_code === "string") {
+			this.#state = {
+				...this.#state,
+				step: "done"
+			};
+			return {
+				status: "signed-in",
+				session: await this.#redeem(body.authorization_code)
+			};
+		}
+		const error = text("error");
+		switch (error) {
+			case "insufficient_authorization": return this.#next(body, problem, message);
+			case "redirect_to_web": {
+				this.#state = {
+					...this.#state,
+					step: "done"
+				};
+				const method = text("synq_method");
+				const loginHint = text("login_hint") ?? this.#state.email;
+				return {
+					status: "hosted",
+					reason: text("synq_reason"),
+					...method ? { method } : {},
+					...loginHint ? { loginHint } : {},
+					continue: () => this.#port.hosted({
+						...method ? { method } : {},
+						...loginHint ? { loginHint } : {}
+					})
+				};
+			}
+			case "access_denied":
+				this.#state = {
+					...this.#state,
+					step: "done"
+				};
+				return {
+					status: "refused",
+					reason: text("synq_reason"),
+					message
+				};
+			case "too_many_requests":
+				if (session && problem) return {
+					status: "retry",
+					problem,
+					message,
+					...answer.retryAfter === void 0 ? {} : { retryAfter: answer.retryAfter }
+				};
+				throw new SynqError("too_many_requests", message || "Too many requests", {
+					status: answer.status,
+					description: message,
+					...answer.retryAfter === void 0 ? {} : { retryAfter: answer.retryAfter }
+				});
+			default:
+				if (error === "invalid_session") this.#state = {
+					...this.#state,
+					step: "done"
+				};
+				throw new SynqError(error ?? `http_${answer.status}`, message || `Synq answered ${answer.status}`, {
+					status: answer.status,
+					description: message || void 0
+				});
+		}
+	}
+	/** What Synq asks for next, or the same step again with what went wrong. */
+	#next(body, problem, message) {
+		const next = body.synq_next;
+		const step = next === "otp" ? "code" : next === "verify_email" ? "verify-email" : next === "method" ? "start" : next;
+		this.#state = {
+			...this.#state,
+			step
+		};
+		if (next === "passkey") {
+			const related = body.synq_passkey_related_options;
+			return {
+				status: "passkey",
+				options: body.synq_passkey_options,
+				...related ? { related: {
+					rpId: related.rp_id,
+					options: related.options
+				} } : {},
+				...problem ? {
+					problem,
+					message
+				} : {}
+			};
+		}
+		if (problem) return {
+			status: "retry",
+			problem,
+			message
+		};
+		const email = this.#state.email ?? "";
+		if (next === "otp") {
+			const seconds = typeof body.synq_code_expires_in === "number" ? body.synq_code_expires_in : 0;
+			return {
+				status: "code-sent",
+				email,
+				expiresAt: new Date(Date.now() + seconds * 1e3)
+			};
+		}
+		if (next === "verify_email") return {
+			status: "verify-email",
+			email,
+			canSkip: body.synq_can_skip === true
+		};
+		return {
+			status: "retry",
+			problem: "missing",
+			message
+		};
+	}
+	/** Redeems the code at the token endpoint, with the verifier and no redirect URI. */
+	async #redeem(code) {
+		const port = this.#port;
+		const server = await port.server();
+		if (!server.token_endpoint) throw new SynqError("discovery_failed", "The issuer has no token endpoint");
+		const body = new URLSearchParams({
+			grant_type: "authorization_code",
+			code,
+			code_verifier: this.#state.verifier
+		});
+		if (this.#state.resource) body.set("resource", this.#state.resource);
+		const headers = new Headers({
+			accept: "application/json",
+			"content-type": "application/x-www-form-urlencoded"
+		});
+		await port.auth(server, port.client, body, headers);
+		try {
+			const response = await port.fetch(server.token_endpoint, {
+				method: "POST",
+				headers,
+				body: body.toString(),
+				redirect: "manual"
+			});
+			const result = await oauth.processAuthorizationCodeResponse(server, port.client, response, {
+				expectedNonce: this.#state.nonce,
+				maxAge: oauth.skipAuthTimeCheck,
+				requireIdToken: true
+			});
+			const claims = oauth.getValidatedIdTokenClaims(result);
+			const acr = this.#state.acr;
+			if (acr?.essential && !(typeof claims?.acr === "string" && acr.values.includes(claims.acr))) throw new SynqError("unmet_authentication_requirements", "The sign-in did not reach the level this app requires");
+			return await port.finish(result, claims);
+		} catch (error) {
+			throw toSynqError(error);
+		}
+	}
+};
+//#endregion
+//#region src/urls.ts
+/** Whether a host is this machine: a Synq stack under `localhost`, or a loopback address. */
+function isLoopback(hostname) {
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+/**
+* `value` as a URL, which must be https: Synq's hosts always are. Plain http
+* only on this machine, for a local Synq stack. `what` names it in the error.
+*/
+function secureUrl(value, what) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new SynqError("invalid_options", `${what} isn't a URL: ${String(value)}`);
+	}
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback(url.hostname))) throw new SynqError("invalid_options", `${what} must be https: (http: only for a Synq stack on this machine, under 'localhost')`);
+	return url;
+}
+/** The longest wait between tries when Synq names none. */
+const RETRY_MAX_DELAY_MS = 8e3;
+/**
+* Whether a call that failed this way may be tried again, and nothing
+* happens twice when it is:
+*
+* - 429 and 503 are refusals: Synq did nothing, so any method retries. A
+*   503 problem `service_unavailable` without `Retry-After` is a part not
+*   set up on this server, which waiting doesn't change, so it doesn't.
+* - 409 `idempotency_key_in_flight`: the first try with this key is still
+*   running; the retry gets its answer once it finishes.
+* - 502, 504 and a dropped connection may come after Synq acted. A GET,
+*   PUT or PATCH sets the same thing again, and a POST carries its
+*   `Idempotency-Key`, whose answer Synq keeps once it succeeds, so the
+*   retry is answered with it. A DELETE isn't retried: a second try could
+*   answer 404 for a delete that worked.
+* - 500 is Synq's own error, which isn't kept with the key: a POST could
+*   run twice, so only a GET, PUT or PATCH retries.
+*
+* Anything else, a 4xx above all, fails the same way however often it is
+* sent.
+*/
+function retryable(method, failure, hasIdempotencyKey) {
+	const { status, code } = failure;
+	const sets = method === "get" || method === "put" || method === "patch";
+	const ambiguousOk = sets || method === "post" && hasIdempotencyKey;
+	if (status === void 0) return ambiguousOk;
+	if (status === 429) return true;
+	if (status === 503) return !(code === "service_unavailable" && failure.retryAfter === void 0);
+	if (status === 409) return code === "idempotency_key_in_flight";
+	if (status === 502 || status === 504) return ambiguousOk;
+	if (status === 500) return sets;
+	return false;
+}
+/** How long to wait before try `retry` (1 for the first retry): Synq's `Retry-After`, else jittered backoff. */
+function retryDelayMs(retry, retryAfter, random = Math.random) {
+	if (retryAfter !== void 0) return retryAfter * 1e3;
+	const ceiling = Math.min(RETRY_MAX_DELAY_MS, 500 * 2 ** (retry - 1));
+	return Math.round(ceiling / 2 + random() * (ceiling / 2));
+}
+function createApiClient(options) {
+	const base = secureUrl(options.baseUrl, "The API base URL").href.replace(/\/+$/, "");
+	const maxRetries = options.maxRetries ?? 0;
+	if (!Number.isSafeInteger(maxRetries) || maxRetries < 0) throw new SynqError("invalid_options", "maxRetries must be a whole number, 0 or more");
+	const call = (method) => ((path, request = {}) => send(method, path, request));
+	async function send(method, path, request) {
+		const url = new URL(base + fill(path, request.path));
+		for (const [name, value] of Object.entries(request.query ?? {})) {
+			if (value === void 0) continue;
+			for (const item of Array.isArray(value) ? value : [value]) url.searchParams.append(name, String(item));
+		}
+		const body = request.body === void 0 ? void 0 : JSON.stringify(request.body);
+		const idempotencyKey = request.idempotencyKey || (options.idempotencyKeys && maxRetries > 0 && method === "post" ? crypto.randomUUID() : void 0);
+		for (let retry = 0;; retry++) try {
+			return await attempt(method, url, body, idempotencyKey, request.signal);
+		} catch (error) {
+			if (!(error instanceof SynqError) || retry >= maxRetries || request.signal?.aborted) throw error;
+			if (!retryable(method, {
+				status: error.status,
+				code: error.code,
+				retryAfter: error.retryAfter
+			}, idempotencyKey !== void 0)) throw error;
+			if (error.retryAfter !== void 0 && error.retryAfter > 60) throw error;
+			await sleep(retryDelayMs(retry + 1, error.retryAfter), request.signal, error);
+		}
+	}
+	async function attempt(method, url, body, idempotencyKey, signal) {
+		const headers = new Headers({
+			accept: "application/json, application/problem+json",
+			authorization: `Bearer ${await options.credential()}`
+		});
+		if (body !== void 0) headers.set("content-type", "application/json");
+		if (idempotencyKey) headers.set("idempotency-key", idempotencyKey);
+		let response;
+		try {
+			response = await (options.fetch ?? fetch)(url, {
+				method: method.toUpperCase(),
+				headers,
+				body,
+				signal
+			});
+		} catch (error) {
+			throw new SynqError("network_error", `Synq couldn't be reached: ${String(error)}`, { cause: error });
+		}
+		const text = await response.text();
+		let json;
+		try {
+			json = text ? JSON.parse(text) : void 0;
+		} catch {
+			json = void 0;
+		}
+		if (!response.ok) throw problemError(response.status, json !== null && typeof json === "object" ? json : {}, retryAfterSeconds(response.headers.get("retry-after")), response.headers.get("request-id"));
+		return json;
+	}
+	async function* paginate(path, request = {}) {
+		let cursor = request.query?.cursor;
+		for (;;) {
+			const page = await send("get", path, {
+				...request,
+				query: {
+					...request.query,
+					cursor
+				}
+			});
+			if (!page || !Array.isArray(page.data)) throw new SynqError("invalid_response", `${path} didn't answer a page of data`);
+			yield* page.data;
+			const next = page.next_cursor;
+			if (next === null || next === void 0) return;
+			if (typeof next !== "string" || next === "" || next === cursor) throw new SynqError("invalid_response", `${path} answered a next_cursor that can't be followed`);
+			cursor = next;
+		}
+	}
+	return {
+		get: call("get"),
+		post: call("post"),
+		put: call("put"),
+		patch: call("patch"),
+		delete: call("delete"),
+		paginate
+	};
+}
+/** Waits `ms`, or rejects with the abort's reason (or `failure`) as soon as `signal` fires. */
+function sleep(ms, signal, failure) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(failure);
+			return;
+		}
+		const done = () => {
+			signal?.removeEventListener("abort", aborted);
+			resolve();
+		};
+		const timer = setTimeout(done, ms);
+		const aborted = () => {
+			clearTimeout(timer);
+			reject(failure);
+		};
+		signal?.addEventListener("abort", aborted, { once: true });
+	});
+}
+/** The path with each `{name}` replaced by its parameter, encoded. */
+function fill(path, params = {}) {
+	return path.replace(/\{([^}]+)\}/g, (_, name) => {
+		const value = params[name];
+		if (value === void 0 || value === "") throw new SynqError("invalid_options", `The path ${path} needs ${name}`);
+		if (/^\.+$/.test(String(value))) throw new SynqError("invalid_options", `${name} can't be ${String(value)}`);
+		return encodeURIComponent(String(value));
+	});
+}
+//#endregion
+export { readSavedSignIn as a, SynqError as c, toSynqError as d, newSignIn as i, isSynqError as l, secureUrl as n, linkedAccountsOf as o, SignInFlow as r, solveEmailWork as s, createApiClient as t, problemError as u };