@synqauth/nextjs 0.0.0-stage → 0.2.0

package/dist/sign-in-error-kd56GHt_.js

@@ -0,0 +1,1349 @@
+import { SynqError, createSynqClient, isSynqError, memoryStorage } from "@synqauth/js";
+//#region src/crypto.ts
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const VERSION = "v1";
+const keys = /* @__PURE__ */ new Map();
+/** The sealing key for a session secret, derived once per secret. */
+function sealingKey(secret) {
+	if (encoder.encode(secret).length < 32) throw new TypeError(`The session secret must be at least 32 bytes`);
+	let key = keys.get(secret);
+	if (!key) {
+		key = (async () => {
+			const base = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+			return crypto.subtle.deriveKey({
+				name: "HKDF",
+				hash: "SHA-256",
+				salt: encoder.encode("@synqauth/nextjs session"),
+				info: encoder.encode(VERSION)
+			}, base, {
+				name: "AES-GCM",
+				length: 256
+			}, false, ["encrypt", "decrypt"]);
+		})();
+		keys.set(secret, key);
+	}
+	return key;
+}
+async function sealingKeys(current, previous = []) {
+	const open = await Promise.all([current, ...previous].map((secret) => sealingKey(secret)));
+	return {
+		seal: open[0],
+		open
+	};
+}
+/** `plaintext` sealed for the cookie `name`: `v1.<iv>.<ciphertext>`, base64url. */
+async function seal(key, plaintext, name) {
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const sealed = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: encoder.encode(name)
+	}, key, encoder.encode(plaintext));
+	return `${VERSION}.${base64url(iv)}.${base64url(new Uint8Array(sealed))}`;
+}
+/** What `seal` sealed for `name` with any of `keys`, or undefined for anything else: another cookie's, tampered, or another secret's. */
+async function unseal(keys, sealed, name) {
+	if (!sealed) return void 0;
+	const [version, iv, data, ...rest] = sealed.split(".");
+	if (version !== VERSION || !iv || !data || rest.length > 0) return void 0;
+	const candidates = Array.isArray(keys) ? keys : [keys];
+	for (const key of candidates) try {
+		const opened = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64url(iv),
+			additionalData: encoder.encode(name)
+		}, key, fromBase64url(data));
+		return decoder.decode(opened);
+	} catch {}
+}
+/** A random id: 128 bits, base64url. */
+function randomId() {
+	return base64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16)));
+}
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64url(text) {
+	const binary = atob(text.replaceAll("-", "+").replaceAll("_", "/"));
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+//#endregion
+//#region src/config.ts
+/** Milliseconds a request to Synq may take before it's given up: shorter than any lock a store holds for a refresh. */
+const REQUEST_TIMEOUT_MS = 1e4;
+/** Variables that say the app may run on more than one server process: serverless functions, replicas. */
+const MULTI_PROCESS = [
+	"VERCEL",
+	"AWS_LAMBDA_FUNCTION_NAME",
+	"NETLIFY",
+	"K_SERVICE",
+	"KUBERNETES_SERVICE_HOST"
+];
+/** The configuration from `options` and the environment; throws `invalid_options` for anything missing or unsafe. */
+function resolveConfig(options = {}, env = processEnv()) {
+	const issuer = required(options.issuer ?? env.SYNQ_ISSUER, "SYNQ_ISSUER").replace(/\/+$/, "");
+	checkUrl(issuer, "SYNQ_ISSUER");
+	const clientId = required(options.clientId ?? env.SYNQ_CLIENT_ID, "SYNQ_CLIENT_ID");
+	const clientSecret = required(options.clientSecret ?? env.SYNQ_CLIENT_SECRET, "SYNQ_CLIENT_SECRET");
+	const appUrl = checkUrl(required(options.appUrl ?? env.SYNQ_APP_URL, "SYNQ_APP_URL"), "SYNQ_APP_URL");
+	const sessionSecret = required(options.sessionSecret ?? env.SYNQ_SESSION_SECRET, "SYNQ_SESSION_SECRET");
+	const previousSessionSecrets = options.previousSessionSecrets ?? (env.SYNQ_SESSION_SECRET_PREVIOUS ?? "").split(",").map((secret) => secret.trim()).filter(Boolean);
+	for (const secret of [sessionSecret, ...previousSessionSecrets]) if (new TextEncoder().encode(secret).length < 32) throw new SynqError("invalid_options", `Each session secret must be at least 32 bytes: make one with \`openssl rand -base64 32\``);
+	const hint = MULTI_PROCESS.find((name) => env[name]);
+	if (!options.store && !options.allowSingleProcessCookieMode && hint) throw new SynqError("invalid_options", `${hint} is set, so this app may run on more than one server process, where sessions in cookies can't refresh one at a time and Synq would sign people out: give synqAuth() a store every process shares (keyValueSessionStore over Redis or Valkey), or allowSingleProcessCookieMode if it truly runs one`);
+	const basePath = normalizePath(options.basePath ?? "/api/auth");
+	const accountApi = options.account === false ? void 0 : `${issuer}/me`;
+	const primary = options.resource ?? accountApi;
+	const scopes = /* @__PURE__ */ new Set([
+		"openid",
+		"profile",
+		"email",
+		"offline_access"
+	]);
+	if (accountApi) for (const scope of ["me:read", "me:write"]) scopes.add(scope);
+	for (const scope of (options.scope ?? "").split(/\s+/)) if (scope) scopes.add(scope);
+	const origin = appUrl.origin;
+	return {
+		issuer,
+		clientId,
+		clientSecret,
+		appUrl,
+		sessionSecret,
+		previousSessionSecrets,
+		basePath,
+		primary,
+		accountApi,
+		scope: [...scopes].join(" "),
+		redirectUri: `${origin}${basePath}/callback`,
+		postLogoutRedirectUri: options.postLogoutRedirectUri ?? `${origin}/`,
+		store: options.store,
+		sessionMaxAge: options.sessionMaxAge ?? 2592e3,
+		refreshLeewaySeconds: options.refreshLeewaySeconds ?? 30,
+		plugins: options.plugins ?? [],
+		fetch: options.fetch,
+		clientAddress: options.clientAddress ?? ((request) => request.headers.get("x-real-ip")?.trim() || void 0),
+		secure: appUrl.protocol === "https:"
+	};
+}
+function processEnv() {
+	return globalThis.process?.env ?? {};
+}
+function required(value, name) {
+	if (!value) throw new SynqError("invalid_options", `${name} is missing`);
+	return value;
+}
+/** An https URL, or http on this machine only. */
+function checkUrl(value, name) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new SynqError("invalid_options", `${name} isn't a URL`);
+	}
+	const loopback = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) throw new SynqError("invalid_options", `${name} must be https (http only on this machine)`);
+	return url;
+}
+/** The route mount's path, `/api/auth` style; throws `invalid_options` for anything else. */
+function normalizePath(path) {
+	const trimmed = `/${path.replace(/^\/+|\/+$/g, "")}`;
+	if (!/^\/[A-Za-z0-9._~\-/]*$/.test(trimmed) || trimmed.includes("//")) throw new SynqError("invalid_options", "basePath must be a plain path, such as /api/auth");
+	return trimmed;
+}
+//#endregion
+//#region src/cookies.ts
+/** Characters per chunk, under the 4096 bytes a browser keeps for one cookie with its attributes. */
+const CHUNK_SIZE = 3800;
+/** A cookie's full name: `__Host-<base>` over https, `<base>` on a plain-http stack on this machine. */
+function cookieName(base, secure) {
+	return secure ? `__Host-${base}` : base;
+}
+/** A value kept under `name`, joined from its chunks; undefined when there is none. */
+function readChunked(jar, name) {
+	const whole = jar.get(name);
+	if (whole !== void 0) return whole;
+	let value = "";
+	for (let i = 0;; i++) {
+		const chunk = jar.get(`${name}.${i}`);
+		if (chunk === void 0) return i === 0 ? void 0 : value;
+		value += chunk;
+	}
+}
+/** Keeps `value` under `name`, in chunks when it needs them, and deletes chunks a longer value left behind. */
+function writeChunked(jar, name, value, options) {
+	const existing = chunkNames(jar, name);
+	if (value.length <= 3800) {
+		jar.set(name, value, options);
+		for (const old of existing) if (old !== name) jar.delete(old, options);
+		return;
+	}
+	const written = /* @__PURE__ */ new Set();
+	for (let i = 0; i * CHUNK_SIZE < value.length; i++) {
+		const chunk = `${name}.${i}`;
+		jar.set(chunk, value.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE), options);
+		written.add(chunk);
+	}
+	for (const old of existing) if (!written.has(old)) jar.delete(old, options);
+}
+/** Deletes `name` and every chunk of it. */
+function deleteChunked(jar, name, options) {
+	for (const old of chunkNames(jar, name)) jar.delete(old, options);
+}
+function chunkNames(jar, name) {
+	const pattern = new RegExp(`^${escapeRegExp(name)}(\\.\\d+)?$`);
+	return [...jar.names()].filter((candidate) => pattern.test(candidate));
+}
+/** The Set-Cookie header for a cookie: `HttpOnly`, `SameSite=Lax`, `Path=/`, and `Secure` over https. */
+function setCookieHeader(name, value, options) {
+	const parts = [
+		`${name}=${value}`,
+		"Path=/",
+		"HttpOnly",
+		"SameSite=Lax"
+	];
+	if (options.maxAge !== void 0) parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAge))}`);
+	if (options.secure) parts.push("Secure");
+	return parts.join("; ");
+}
+/** The cookies a `Cookie` header carries. */
+function parseCookieHeader(header) {
+	const cookies = /* @__PURE__ */ new Map();
+	for (const pair of (header ?? "").split(";")) {
+		const at = pair.indexOf("=");
+		if (at <= 0) continue;
+		const name = pair.slice(0, at).trim();
+		if (!cookies.has(name)) cookies.set(name, pair.slice(at + 1).trim());
+	}
+	return cookies;
+}
+/** A jar over a request's cookies that collects the Set-Cookie headers its response sends. */
+function requestJar(request) {
+	const cookies = parseCookieHeader(request.headers.get("cookie"));
+	const out = /* @__PURE__ */ new Map();
+	return {
+		get: (name) => cookies.get(name),
+		names: () => cookies.keys(),
+		set(name, value, options) {
+			cookies.set(name, value);
+			out.set(name, setCookieHeader(name, value, options));
+		},
+		delete(name, options) {
+			cookies.delete(name);
+			out.set(name, setCookieHeader(name, "", {
+				...options,
+				maxAge: 0
+			}));
+		},
+		headers: () => [...out.values()],
+		/** The `Cookie` header the request carries now, changes made: for what runs after Next's proxy. */
+		cookieHeader: () => [...cookies].map(([name, value]) => `${name}=${value}`).join("; ")
+	};
+}
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//#endregion
+//#region src/plugins.ts
+const PLUGIN_ID = /^[a-z][a-z0-9-]{0,39}$/;
+const ROUTE_KEY = /^(GET|POST|PATCH|DELETE) \/[A-Za-z0-9._~\-/]*$/;
+/** Declares a server plugin, checking its id and routes once, when the module loads. */
+function defineSynqPlugin(plugin) {
+	if (!PLUGIN_ID.test(plugin.id) || RESERVED.has(plugin.id)) throw new TypeError(`A Synq plugin's id must be lowercase letters, digits and dashes, and not one of the mount's own routes: ${plugin.id}`);
+	for (const key of Object.keys(plugin.routes ?? {})) if (!ROUTE_KEY.test(key)) throw new TypeError(`A Synq plugin's route is "<METHOD> /<path>": ${key}`);
+	return plugin;
+}
+/** The route mount's own paths, which no plugin can take. */
+const RESERVED = /* @__PURE__ */ new Set([
+	"sign-in",
+	"callback",
+	"sign-out",
+	"session",
+	"account",
+	"link"
+]);
+//#endregion
+//#region src/session-name.ts
+const SESSION_COOKIE = "synq.session";
+//#endregion
+//#region src/store.ts
+/**
+* A store in this process's memory: for tests and a single server process,
+* where the default cookie does as well.
+*/
+function memorySessionStore() {
+	const sessions = /* @__PURE__ */ new Map();
+	const locks = /* @__PURE__ */ new Map();
+	return {
+		get(id) {
+			const entry = sessions.get(id);
+			if (!entry || entry.expires <= Date.now()) {
+				sessions.delete(id);
+				return Promise.resolve(null);
+			}
+			return Promise.resolve({ ...entry.values });
+		},
+		set(id, values, maxAgeSeconds) {
+			sessions.set(id, {
+				values: { ...values },
+				expires: Date.now() + maxAgeSeconds * 1e3
+			});
+			return Promise.resolve();
+		},
+		delete(id) {
+			sessions.delete(id);
+			return Promise.resolve();
+		},
+		lock: (id, fn) => chain(locks, id, fn)
+	};
+}
+/**
+* Sessions in a key-value store every server process shares, such as Redis
+* or Valkey: the store an app on several processes (replicas, serverless
+* functions) needs. Its lock is `SET … NX PX` with a token, polled until
+* free, and released only by its holder; it expires on its own, so a dead
+* process never holds a session for ever.
+*
+* ```ts
+* keyValueSessionStore({
+*   get: (key) => redis.get(key),
+*   set: async (key, value, { ttlMs, onlyIfAbsent }) =>
+*     (await redis.set(key, value, { PX: ttlMs, NX: onlyIfAbsent })) === 'OK',
+*   delete: async (key) => void (await redis.del(key)),
+* })
+* ```
+*/
+function keyValueSessionStore(kv, options = {}) {
+	const prefix = options.prefix ?? "synq:";
+	const lockTtlMs = options.lockTtlMs ?? 3e4;
+	const lockWaitMs = options.lockWaitMs ?? 35e3;
+	if (lockTtlMs <= 2e4) throw new TypeError(`lockTtlMs must be over ${REQUEST_TIMEOUT_MS * 2}: a refresh can make two requests to Synq (discovery, then the token) of up to ${REQUEST_TIMEOUT_MS} ms each`);
+	const sessionKey = (id) => `${prefix}session:${id}`;
+	const lockKey = (id) => `${prefix}lock:${id}`;
+	return {
+		async get(id) {
+			const raw = await kv.get(sessionKey(id));
+			if (!raw) return null;
+			try {
+				return JSON.parse(raw);
+			} catch {
+				return null;
+			}
+		},
+		async set(id, values, maxAgeSeconds) {
+			await kv.set(sessionKey(id), JSON.stringify(values), { ttlMs: maxAgeSeconds * 1e3 });
+		},
+		async delete(id) {
+			await kv.delete(sessionKey(id));
+		},
+		async lock(id, fn) {
+			const key = lockKey(id);
+			const token = crypto.randomUUID();
+			const deadline = Date.now() + lockWaitMs;
+			let wait = 25;
+			while (!await kv.set(key, token, {
+				ttlMs: lockTtlMs,
+				onlyIfAbsent: true
+			})) {
+				if (Date.now() >= deadline) throw new SynqError("lock_timeout", "Another request held this session's lock too long");
+				await new Promise((resolve) => setTimeout(resolve, wait));
+				wait = Math.min(wait * 2, 250);
+			}
+			try {
+				return await fn();
+			} finally {
+				if (kv.deleteIfEquals) await kv.deleteIfEquals(key, token);
+				else if (await kv.get(key) === token) await kv.delete(key);
+			}
+		}
+	};
+}
+/** Runs `fn` after every earlier holder of `name` in `locks`, failed or not. */
+function chain(locks, name, fn) {
+	const run = (locks.get(name) ?? Promise.resolve()).then(fn, fn);
+	const settled = run.then(() => void 0, () => void 0);
+	locks.set(name, settled);
+	settled.then(() => {
+		if (locks.get(name) === settled) locks.delete(name);
+	});
+	return run;
+}
+//#endregion
+//#region src/session.ts
+/**
+* @synqauth/js's keys in its store (client.ts), which the adapter maps onto
+* a session's values: the session per API, and the refresh token.
+*/
+const JS_SESSION_KEY = "synq.session";
+const JS_REFRESH_KEY = "synq.refresh";
+const REFRESH = "refresh";
+const SHARED = Symbol.for("@synqauth/nextjs sessions");
+const { newest, locks } = globalThis[SHARED] ??= {
+	newest: /* @__PURE__ */ new Map(),
+	locks: /* @__PURE__ */ new Map()
+};
+const OVERLAY_MAX = 1e4;
+const OVERLAY_TTL_MS = 18e5;
+var SessionHandle = class {
+	id;
+	created;
+	#backend;
+	/** Whether the cookie must be written: a new session, or values newer than the cookie's. */
+	#cookieRev;
+	#fresh;
+	constructor(id, created, backend, cookieRev, fresh) {
+		this.id = id;
+		this.created = created;
+		this.#backend = backend;
+		this.#cookieRev = cookieRev;
+		this.#fresh = fresh;
+	}
+	read() {
+		return this.#backend.read();
+	}
+	/** `@synqauth/js`'s store for this session's token for `resource`; `primary` is the API whose session holds the ID token. */
+	storage(resource, primary) {
+		const own = tokenKey(resource);
+		const main = tokenKey(primary);
+		const backend = this.#backend;
+		return {
+			holdsRefreshTokens: true,
+			async get(key) {
+				const values = await backend.read();
+				if (key === JS_REFRESH_KEY) return values[REFRESH];
+				if (key !== JS_SESSION_KEY) return void 0;
+				const mine = values[own];
+				const first = values[main];
+				if (own === main) return mine;
+				if (!first) return mine;
+				const { idToken, claims } = JSON.parse(first);
+				if (mine) return JSON.stringify({
+					...JSON.parse(mine),
+					idToken,
+					claims
+				});
+				return JSON.stringify({
+					accessToken: "",
+					tokenType: "Bearer",
+					expiresAt: 0,
+					idToken,
+					claims
+				});
+			},
+			async set(key, value) {
+				if (key === JS_REFRESH_KEY) return backend.write((values) => void (values[REFRESH] = value));
+				if (key !== JS_SESSION_KEY) return;
+				let kept = value;
+				if (own !== main) {
+					const rest = JSON.parse(value);
+					delete rest.idToken;
+					delete rest.claims;
+					kept = JSON.stringify(rest);
+				}
+				await backend.write((values) => void (values[own] = kept));
+			},
+			async remove(key) {
+				if (key === JS_REFRESH_KEY) return backend.write((values) => void delete values[REFRESH]);
+				if (key !== JS_SESSION_KEY) return;
+				await backend.write((values) => {
+					if (own === main) for (const name of Object.keys(values)) delete values[name];
+					else delete values[own];
+				});
+			},
+			lock: (_name, fn) => backend.lock(fn)
+		};
+	}
+	/** Writes the session's cookie when it's new or this process holds newer values than it. */
+	async commit(jar, keys, secure, maxAge, store) {
+		const name = cookieName(SESSION_COOKIE, secure);
+		const remaining = Math.max(0, this.created + maxAge - now$1());
+		if (store) {
+			if (!this.#fresh) return;
+			const sealed = {
+				v: 1,
+				id: this.id,
+				created: this.created
+			};
+			writeChunked(jar, name, await seal(keys.seal, JSON.stringify(sealed), name), {
+				secure,
+				maxAge: remaining
+			});
+			this.#fresh = false;
+			return;
+		}
+		const current = newest.get(this.id);
+		const rev = current?.rev ?? 0;
+		if (!this.#fresh && rev <= this.#cookieRev) return;
+		const sealed = {
+			v: 1,
+			id: this.id,
+			created: this.created,
+			rev,
+			values: current?.values ?? {}
+		};
+		writeChunked(jar, name, await seal(keys.seal, JSON.stringify(sealed), name), {
+			secure,
+			maxAge: remaining
+		});
+		this.#cookieRev = rev;
+		this.#fresh = false;
+	}
+};
+/** The session the request's cookie names, or null: none, unreadable, past its age, or gone from the store. */
+async function loadSession(jar, keys, secure, maxAge, store) {
+	const name = cookieName(SESSION_COOKIE, secure);
+	const opened = await unseal(keys.open, readChunked(jar, name), name);
+	if (!opened) return null;
+	let sealed;
+	try {
+		sealed = JSON.parse(opened);
+	} catch {
+		return null;
+	}
+	if (sealed.v !== 1 || typeof sealed.id !== "string" || sealed.created + maxAge <= now$1()) return null;
+	if (store) {
+		if (!await store.get(sealed.id)) return null;
+		return new SessionHandle(sealed.id, sealed.created, storeBackend(store, sealed.id, sealed.created, maxAge), 0, false);
+	}
+	const rev = sealed.rev ?? 0;
+	remember(sealed.id, rev, sealed.values ?? {});
+	return new SessionHandle(sealed.id, sealed.created, cookieBackend(sealed.id), rev, false);
+}
+/** A new, empty session: what a sign-in fills. */
+function newSession(maxAge, store) {
+	const id = randomId();
+	const created = now$1();
+	if (store) return new SessionHandle(id, created, storeBackend(store, id, created, maxAge), 0, true);
+	remember(id, 0, {});
+	return new SessionHandle(id, created, cookieBackend(id), -1, true);
+}
+/** Ends a session: its cookie, its stored values, and what this process remembers of it. */
+async function endSession(jar, handle, secure, store) {
+	if (handle) {
+		newest.delete(handle.id);
+		if (store) await store.delete(handle.id);
+	}
+	deleteChunked(jar, cookieName(SESSION_COOKIE, secure), { secure });
+}
+/** The key a session keeps `resource`'s token under. */
+function tokenKey(resource) {
+	return `token:${resource ?? ""}`;
+}
+function cookieBackend(id) {
+	return {
+		read() {
+			const entry = newest.get(id);
+			return Promise.resolve({ ...entry?.values ?? {} });
+		},
+		write(mutate) {
+			const entry = newest.get(id);
+			const values = { ...entry?.values ?? {} };
+			mutate(values);
+			remember(id, (entry?.rev ?? 0) + 1, values);
+			return Promise.resolve();
+		},
+		lock: (fn) => chain(locks, id, fn)
+	};
+}
+function storeBackend(store, id, created, maxAge) {
+	return {
+		async read() {
+			return await store.get(id) ?? {};
+		},
+		async write(mutate) {
+			const values = await store.get(id) ?? {};
+			mutate(values);
+			await store.set(id, values, Math.max(1, created + maxAge - now$1()));
+		},
+		lock: (fn) => store.lock(id, fn)
+	};
+}
+/** Keeps the newer of what's remembered and `rev`'s values. */
+function remember(id, rev, values) {
+	const entry = newest.get(id);
+	const time = Date.now();
+	if (entry && entry.rev >= rev) {
+		entry.seen = time;
+		return;
+	}
+	newest.delete(id);
+	newest.set(id, {
+		rev,
+		values,
+		seen: time
+	});
+	if (newest.size > OVERLAY_MAX) for (const [old, kept] of newest) {
+		if (newest.size <= OVERLAY_MAX && time - kept.seen < OVERLAY_TTL_MS) break;
+		newest.delete(old);
+	}
+}
+function now$1() {
+	return Math.floor(Date.now() / 1e3);
+}
+//#endregion
+//#region src/core.ts
+const PROMPTS = /* @__PURE__ */ new Set([
+	"login",
+	"none",
+	"consent",
+	"select_account"
+]);
+const INTENTS = /* @__PURE__ */ new Set(["add-passkey"]);
+/** A sign-in method's name, as `synq_method` and the account API's link requests take it. */
+const METHOD = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const TRANSACTION_SECONDS = 3600;
+const TRANSACTION_PREFIX = "synq.tx.";
+const ACCOUNT_BODY_LIMIT = 65536;
+const LINK_BODY_LIMIT = 4096;
+/** A step of an own-UI sign-in: a passkey's assertion is the most it carries. */
+const FLOW_BODY_LIMIT = 16384;
+/** Where an own-UI sign-in's flow is kept, sealed: one a browser at a time. */
+const FLOW_KEY = `${TRANSACTION_PREFIX}flow`;
+/** `synq_siws` as @synqauth/solana's `encodeSiws` writes it: base64url, well under the body's limit. */
+const SIWS = /^[A-Za-z0-9_-]{1,3072}$/;
+/** Claims of the ID token that say nothing about the person. */
+const PROTOCOL_CLAIMS = /* @__PURE__ */ new Set([
+	"iss",
+	"aud",
+	"azp",
+	"exp",
+	"iat",
+	"nbf",
+	"nonce",
+	"at_hash",
+	"c_hash",
+	"sid",
+	"jti"
+]);
+/**
+* The framework-neutral core `synqAuth()` runs on, over any cookie jar: for
+* a server that answers the same routes without Next. Most apps use
+* `synqAuth()` instead.
+*/
+function createSynqCore(config) {
+	/** Whether the missing end-user address was logged already: once is enough. */
+	let warnedAboutAddress = false;
+	const keysFor = () => sealingKeys(config.sessionSecret, config.previousSessionSecrets);
+	/** Every request to Synq: never cached, and given up after REQUEST_TIMEOUT_MS. */
+	const upstream = (input, init = {}) => {
+		const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+		return (config.fetch ?? fetch)(input, {
+			...init,
+			cache: "no-store",
+			signal: init.signal ? AbortSignal.any([init.signal, timeout]) : timeout
+		});
+	};
+	function client(storage, resource, transactions) {
+		return createSynqClient({
+			issuer: config.issuer,
+			clientId: config.clientId,
+			clientSecret: config.clientSecret,
+			redirectUri: config.redirectUri,
+			postLogoutRedirectUri: config.postLogoutRedirectUri,
+			scope: config.scope,
+			resource,
+			storage,
+			transactionStorage: transactions ?? memoryStorage(),
+			fetch: upstream,
+			refreshLeewaySeconds: config.refreshLeewaySeconds
+		});
+	}
+	async function load(jar) {
+		return loadSession(jar, await keysFor(), config.secure, config.sessionMaxAge, config.store);
+	}
+	async function commit(jar, handle) {
+		await handle.commit(jar, await keysFor(), config.secure, config.sessionMaxAge, config.store);
+	}
+	/** Who signed in (the ID token's `sub`), and in which session at the issuer (its `sid`, when Synq sent one). */
+	async function issuerSessionOf(handle) {
+		const raw = (await handle.read())[tokenKey(config.primary)];
+		if (!raw) return void 0;
+		const { claims } = JSON.parse(raw);
+		if (typeof claims?.sub !== "string") return void 0;
+		return {
+			sub: claims.sub,
+			sid: typeof claims.sid === "string" ? claims.sid : void 0
+		};
+	}
+	/** The person the session's main token was issued with, while the session can still give a token. */
+	async function userOf(handle) {
+		if (!handle) return {
+			user: null,
+			expiresAt: null
+		};
+		const values = await handle.read();
+		const raw = values[tokenKey(config.primary)];
+		if (!raw) return {
+			user: null,
+			expiresAt: null
+		};
+		const stored = JSON.parse(raw);
+		const expiresAt = stored.expiresAt ?? null;
+		if (!values.refresh && expiresAt !== null && expiresAt <= now()) return {
+			user: null,
+			expiresAt: null
+		};
+		if (!stored.claims || typeof stored.claims.sub !== "string") return {
+			user: null,
+			expiresAt
+		};
+		const user = {};
+		for (const [name, value] of Object.entries(stored.claims)) if (!PROTOCOL_CLAIMS.has(name)) user[name] = value;
+		return {
+			user,
+			expiresAt
+		};
+	}
+	async function getAccessToken(jar, options = {}) {
+		const resource = options.resource ?? config.primary;
+		if (resource !== config.primary && resource !== config.accountApi) throw new SynqError("invalid_options", `The session has no token for ${resource ?? "userinfo"}: name it in synqAuth()'s resource`);
+		const handle = await load(jar);
+		if (!handle) throw new SynqError("not_signed_in", "Nobody is signed in");
+		if (!config.store && jar.writable?.() === false) {
+			const raw = (await handle.read())[tokenKey(resource)];
+			const stored = raw ? JSON.parse(raw) : {};
+			if (stored.accessToken && (stored.expiresAt === void 0 || stored.expiresAt > now())) return stored.accessToken;
+			throw new SynqError("refresh_required", "The session's token ran out where its cookie can't be written (a server component): let synqProxy() refresh it before the page renders");
+		}
+		try {
+			const token = await client(handle.storage(resource, config.primary), resource).getAccessToken({ minValiditySeconds: options.minValiditySeconds });
+			await commit(jar, handle);
+			return token;
+		} catch (error) {
+			if (isSynqError(error, "invalid_grant") || isSynqError(error, "no_refresh_token")) await endSession(jar, handle, config.secure, config.store);
+			throw error;
+		}
+	}
+	/** A store for one sign-in's transaction: a sealed cookie named after its state, with where to go afterwards. */
+	async function transactions(jar, returnTo) {
+		const keys = await keysFor();
+		const options = {
+			secure: config.secure,
+			maxAge: TRANSACTION_SECONDS
+		};
+		const found = {};
+		return {
+			storage: {
+				async get(name) {
+					const cookie = cookieName(name, config.secure);
+					const opened = await unseal(keys.open, jar.get(cookie), cookie);
+					if (!opened) return void 0;
+					const { v, r } = JSON.parse(opened);
+					found.returnTo = r;
+					return v;
+				},
+				async set(name, value) {
+					await dropOldTransactions(jar, keys.open);
+					const cookie = cookieName(name, config.secure);
+					const sealed = JSON.stringify({
+						v: value,
+						r: returnTo,
+						t: Date.now()
+					});
+					jar.set(cookie, await seal(keys.seal, sealed, cookie), options);
+				},
+				remove(name) {
+					jar.delete(cookieName(name, config.secure), options);
+				}
+			},
+			found
+		};
+	}
+	/** Keeps a browser's sign-ins under way to MAX_TRANSACTIONS, the newest, before it starts another. */
+	async function dropOldTransactions(jar, keys) {
+		const prefix = cookieName(TRANSACTION_PREFIX, config.secure);
+		const started = [];
+		for (const name of [...jar.names()]) {
+			if (!name.startsWith(prefix)) continue;
+			const opened = await unseal(keys, jar.get(name), name);
+			let at;
+			try {
+				at = opened ? JSON.parse(opened).t ?? 0 : 0;
+			} catch {
+				at = 0;
+			}
+			started.push({
+				name,
+				at,
+				order: started.length
+			});
+		}
+		started.sort((a, b) => b.at - a.at || b.order - a.order);
+		for (const { name } of started.slice(4)) jar.delete(name, { secure: config.secure });
+	}
+	async function signIn(request, jar) {
+		if (isPrefetch(request)) return new Response(null, { status: 204 });
+		const params = new URL(request.url).searchParams;
+		const returnTo = safeReturnTo(params.get("returnTo"), config.appUrl);
+		const prompt = params.get("prompt") ?? void 0;
+		const maxAge = params.get("max_age");
+		const intent = params.get("intent") ?? void 0;
+		if (prompt && !PROMPTS.has(prompt)) return problem(400, "invalid_request", "prompt is login, none, consent or select_account");
+		if (maxAge !== null && !/^\d{1,9}$/.test(maxAge)) return problem(400, "invalid_request", "max_age is a number of seconds");
+		if (intent && !INTENTS.has(intent)) return problem(400, "invalid_request", "intent is add-passkey (POST link adds a way to sign in)");
+		const tx = await transactions(jar, returnTo);
+		return redirect((await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
+			method: params.get("method") ?? void 0,
+			loginHint: params.get("login_hint") ?? void 0,
+			prompt: prompt ?? (intent ? "login" : void 0),
+			maxAge: maxAge === null ? void 0 : Number(maxAge),
+			additionalResources: config.accountApi && config.accountApi !== config.primary ? [config.accountApi] : [],
+			params: intent ? { synq_intent: intent } : void 0
+		})).href, 302);
+	}
+	async function callback(request, jar) {
+		const tx = await transactions(jar);
+		const handle = newSession(config.sessionMaxAge, config.store);
+		try {
+			await client(handle.storage(config.primary, config.primary), config.primary, tx.storage).handleCallback(request.url);
+		} catch (error) {
+			const code = isSynqError(error) ? error.code : "server_error";
+			return redirect(withError(safeReturnTo(tx.found.returnTo ?? null, config.appUrl), code), 303);
+		}
+		await startSession(jar, handle);
+		return redirect(safeReturnTo(tx.found.returnTo ?? null, config.appUrl), 303);
+	}
+	async function signOut(request, jar) {
+		const handle = await load(jar);
+		let url = null;
+		if (handle) url = await client(handle.storage(config.primary, config.primary), config.primary).signOut();
+		await endSession(jar, handle, config.secure, config.store);
+		const target = url?.href ?? config.postLogoutRedirectUri;
+		if ((request.headers.get("accept") ?? "").includes("application/json")) return json({ redirect: target });
+		return redirect(target, 303);
+	}
+	/**
+	* Adding a way to sign in (AERO-1397): the account API makes a link request
+	* for the person with the session's token, and its ticket goes to Synq in
+	* a sign-in like any other, which asks them to sign in again first. A POST
+	* from the app's own pages, answered `{ redirect }` for the browser to
+	* follow, so another site can't start one.
+	*/
+	async function link(request, jar) {
+		if (!config.accountApi) return problem(404, "not_found", "The session holds no account API token: synqAuth()'s account is off");
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		let input;
+		try {
+			const body = await request.text();
+			if (new TextEncoder().encode(body).length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+			input = JSON.parse(body);
+		} catch {
+			return problem(400, "invalid_request", "Send { method, returnTo } as JSON");
+		}
+		if (typeof input?.method !== "string" || !METHOD.test(input.method)) return problem(400, "invalid_request", "method names the way to sign in to add");
+		const returnTo = safeReturnTo(typeof input.returnTo === "string" ? input.returnTo : null, config.appUrl);
+		let token;
+		try {
+			token = await getAccessToken(jar, { resource: config.accountApi });
+		} catch (error) {
+			if (isSynqError(error) && [
+				"not_signed_in",
+				"invalid_grant",
+				"no_refresh_token"
+			].includes(error.code)) return problem(401, "not_signed_in", "Nobody is signed in");
+			throw error;
+		}
+		const answer = await upstream(`${config.accountApi}/v1/link-requests`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json",
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({ method: input.method })
+		});
+		if (!answer.ok) return new Response(answer.body, {
+			status: answer.status,
+			headers: { "content-type": answer.headers.get("content-type") ?? "application/problem+json" }
+		});
+		const ticket = (await answer.json()).authorization_params?.synq_link;
+		if (typeof ticket !== "string") return problem(502, "invalid_response", "Synq answered without a link ticket");
+		const tx = await transactions(jar, returnTo);
+		return json({ redirect: (await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
+			prompt: "login",
+			additionalResources: config.accountApi !== config.primary ? [config.accountApi] : [],
+			params: {
+				synq_intent: "link",
+				synq_link: ticket
+			}
+		})).href });
+	}
+	/**
+	* Signing in with a wallet from the app's own page (AERO-1423, over the
+	* issuer's headless wallet sign-in, AERO-1410): `{ siws, returnTo }`, the
+	* `synq_siws` @synqauth/solana's `encodeSiws` makes of what the wallet
+	* signed. It goes to Synq in a pushed authorization request with
+	* `prompt=login`, sent from this server with the app's credentials, so the
+	* signature never lands in a URL; answered `{ redirect }` for the browser
+	* to follow. A POST from the app's own pages.
+	*/
+	async function walletSignIn(request, jar) {
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		let input;
+		try {
+			const body = await request.text();
+			if (new TextEncoder().encode(body).length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+			input = JSON.parse(body);
+		} catch {
+			return problem(400, "invalid_request", "Send { siws, returnTo } as JSON");
+		}
+		if (typeof input?.siws !== "string" || !SIWS.test(input.siws)) return problem(400, "invalid_request", "siws is what the wallet signed, as encodeSiws makes it");
+		const tx = await transactions(jar, safeReturnTo(typeof input.returnTo === "string" ? input.returnTo : null, config.appUrl));
+		return json({ redirect: (await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
+			prompt: "login",
+			pushed: true,
+			additionalResources: config.accountApi && config.accountApi !== config.primary ? [config.accountApi] : [],
+			params: { synq_siws: input.siws }
+		})).href });
+	}
+	/**
+	* One step of a sign-in on the app's own screens (AERO-1411): the page
+	* posts what the person typed, `{ step, … }`, and this server takes it to
+	* Synq's Authorization Challenge Endpoint as the app, with where the
+	* person is (`clientAddress`). The flow (its PKCE verifier and Synq's auth
+	* session) stays sealed in a cookie; the page hears only what to show
+	* next, never a token, a code or the auth session. A sign-in that ends
+	* starts the session as the callback does.
+	*/
+	async function signInFlow(request, jar) {
+		if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return problem(415, "unsupported_media_type", "Send the step as JSON");
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > FLOW_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		let input;
+		try {
+			const body = await request.text();
+			if (new TextEncoder().encode(body).length > FLOW_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+			input = JSON.parse(body);
+			if (!input || typeof input !== "object") throw new TypeError("not an object");
+		} catch {
+			return problem(400, "invalid_request", "Send { step, … } as JSON");
+		}
+		const text = (name, max = 512) => typeof input[name] === "string" ? input[name].slice(0, max) : "";
+		const step = text("step", 32);
+		const returnTo = safeReturnTo(text("returnTo", 2048) || null, config.appUrl);
+		const tx = await transactions(jar, returnTo);
+		const saved = await tx.storage.get(FLOW_KEY);
+		if (step === "restart") {
+			await tx.storage.remove(FLOW_KEY);
+			return json({ status: "restarted" });
+		}
+		const endUserIp = config.clientAddress(request);
+		if (!endUserIp && !warnedAboutAddress) {
+			warnedAboutAddress = true;
+			console.warn("@synqauth/nextjs: own-UI sign-in can't tell where people sign in from (no x-real-ip): give synqAuth() a clientAddress, or per-address protection is off for this app");
+		}
+		const handle = newSession(config.sessionMaxAge, config.store);
+		const synq = client(handle.storage(config.primary, config.primary), config.primary);
+		const flow = saved ? synq.resumeSignIn(saved, { endUserIp }) : synq.startSignIn({
+			endUserIp,
+			additionalResources: config.accountApi && config.accountApi !== config.primary ? [config.accountApi] : []
+		});
+		const email = text("email", 254);
+		let result;
+		try {
+			switch (step) {
+				case "password":
+					result = text("screen") === "sign-up" ? await flow.password.signUp({
+						email,
+						password: text("password", 1024)
+					}) : await flow.password.signIn({
+						email,
+						password: text("password", 1024)
+					});
+					break;
+				case "email":
+					result = await flow.email.send(email);
+					break;
+				case "code":
+					result = flow.step === "verify-email" ? await flow.verifyEmail.verify(text("code", 32)) : await flow.email.verify(text("code", 32));
+					break;
+				case "resend":
+					result = flow.step === "verify-email" ? await flow.verifyEmail.resend() : await flow.email.resend();
+					break;
+				case "skip":
+					result = await flow.verifyEmail.skip();
+					break;
+				case "passkey-options":
+					result = await flow.passkey.options();
+					break;
+				case "passkey": {
+					const credential = input.credential;
+					if (!credential || typeof credential !== "object") return problem(400, "invalid_request", "credential is the passkey’s assertion");
+					result = await flow.passkey.signIn(credential, { related: input.related === true });
+					break;
+				}
+				default: return problem(400, "invalid_request", "step is password, email, code, resend, skip, passkey-options, passkey or restart");
+			}
+		} catch (error) {
+			if (isSynqError(error, "invalid_session")) {
+				await tx.storage.remove(FLOW_KEY);
+				return json({
+					status: "expired",
+					message: error.message
+				});
+			}
+			if (isSynqError(error, "too_many_requests")) return json({
+				status: "retry",
+				step: flow.step,
+				problem: "limited",
+				message: error.message,
+				...error.retryAfter === void 0 ? {} : { retryAfter: error.retryAfter }
+			});
+			throw error;
+		}
+		if (result.status === "signed-in") {
+			await tx.storage.remove(FLOW_KEY);
+			await startSession(jar, handle);
+			return json({
+				status: "signed-in",
+				returnTo: tx.found.returnTo ?? returnTo
+			});
+		}
+		if (flow.step === "done") await tx.storage.remove(FLOW_KEY);
+		else await tx.storage.set(FLOW_KEY, JSON.stringify(flow));
+		switch (result.status) {
+			case "code-sent": return json({
+				status: result.status,
+				step: flow.step,
+				email: result.email,
+				expiresAt: result.expiresAt.toISOString()
+			});
+			case "verify-email": return json({
+				status: result.status,
+				step: flow.step,
+				email: result.email,
+				canSkip: result.canSkip
+			});
+			case "passkey": return json({
+				status: result.status,
+				step: flow.step,
+				passkey: {
+					options: result.options,
+					related: result.related
+				},
+				...result.problem ? {
+					problem: result.problem,
+					message: result.message
+				} : {}
+			});
+			case "retry": return json({
+				status: result.status,
+				step: flow.step,
+				problem: result.problem,
+				message: result.message,
+				...result.retryAfter === void 0 ? {} : { retryAfter: result.retryAfter }
+			});
+			case "hosted": return json({
+				status: result.status,
+				hosted: {
+					reason: result.reason,
+					...result.method ? { method: result.method } : {},
+					...result.loginHint ? { loginHint: result.loginHint } : {}
+				}
+			});
+			case "refused": return json({
+				status: result.status,
+				reason: result.reason,
+				message: result.message
+			});
+		}
+	}
+	/**
+	* Starts the session `handle` holds the new sign-in's tokens of. A
+	* sign-in replaces whatever session the browser had, and its refresh
+	* token is revoked: an offline grant outlives the brand's session. But
+	* the same person signing in again within their session at the issuer,
+	* as adding a passkey or a way in asks, gets the grant the replaced
+	* session had, and Synq ends a grant with any refresh token of it
+	* revoked: that one is dropped instead. Same person: the ID tokens'
+	* `sub`. Same issuer session: their `sid`, which Synq includes for every
+	* app (AERO-1624) but one whose tenant turned it off; without it, the
+	* same `sub` is taken for the same session (a sign-in after it lapsed
+	* leaves the old grant to expire).
+	*/
+	async function startSession(jar, handle) {
+		const previous = await load(jar);
+		if (previous) {
+			const [before, after] = await Promise.all([issuerSessionOf(previous), issuerSessionOf(handle)]);
+			if (!(before !== void 0 && after !== void 0 && before.sub === after.sub && (before.sid === void 0 || after.sid === void 0 || before.sid === after.sid))) try {
+				await client(previous.storage(config.primary, config.primary), config.primary).signOut();
+			} catch {}
+			await endSession(jar, previous, config.secure, config.store);
+		}
+		await commit(jar, handle);
+	}
+	async function account(request, jar, path) {
+		if (!config.accountApi) return problem(404, "not_found", "The session holds no account API token: synqAuth()'s account is off");
+		if (!/^v1(\/[A-Za-z0-9._~-]+)+$/.test(path) || path.split("/").some((part) => part === "." || part === "..")) return problem(404, "not_found", "No such account API route");
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > ACCOUNT_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		let token;
+		try {
+			token = await getAccessToken(jar, { resource: config.accountApi });
+		} catch (error) {
+			if (isSynqError(error) && [
+				"not_signed_in",
+				"invalid_grant",
+				"no_refresh_token"
+			].includes(error.code)) return problem(401, "not_signed_in", "Nobody is signed in");
+			throw error;
+		}
+		const headers = new Headers({
+			authorization: `Bearer ${token}`,
+			accept: "application/json"
+		});
+		for (const name of ["content-type", "idempotency-key"]) {
+			const value = request.headers.get(name);
+			if (value) headers.set(name, value);
+		}
+		let body;
+		if (request.method !== "GET" && request.method !== "HEAD") {
+			body = await request.text();
+			if (new TextEncoder().encode(body).length > ACCOUNT_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		}
+		const search = new URL(request.url).search;
+		const answer = await upstream(`${config.accountApi}/${path}${search}`, {
+			method: request.method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+		const out = new Headers({ "cache-control": "no-store" });
+		const type = answer.headers.get("content-type");
+		if (type) out.set("content-type", type);
+		return new Response(answer.status === 204 ? null : await answer.text(), {
+			status: answer.status,
+			headers: out
+		});
+	}
+	async function plugin(request, jar, id, rest) {
+		const route = config.plugins.find((candidate) => candidate.id === id)?.routes?.[`${request.method} /${rest}`];
+		if (!route) return void 0;
+		return route({
+			user: async () => (await userOf(await load(jar))).user,
+			getAccessToken: (options) => getAccessToken(jar, options),
+			issuer: config.issuer,
+			clientId: config.clientId,
+			basePath: config.basePath
+		}, request);
+	}
+	async function handle(request) {
+		const url = new URL(request.url);
+		const prefix = `${config.basePath}/`;
+		if (!url.pathname.startsWith(prefix)) return problem(404, "not_found", "Not under the route mount");
+		const rest = url.pathname.slice(prefix.length);
+		const [first = "", ...tail] = rest.split("/");
+		const jar = requestJar(request);
+		if (!["GET", "HEAD"].includes(request.method) && !sameOrigin(request, config.appUrl)) return problem(403, "forbidden", "A change must come from the app's own pages");
+		let response;
+		try {
+			if (rest === "sign-in" && request.method === "GET") response = await signIn(request, jar);
+			else if (rest === "sign-in" && request.method === "POST") response = await walletSignIn(request, jar);
+			else if (rest === "sign-in/flow" && request.method === "POST") response = await signInFlow(request, jar);
+			else if (rest === "callback" && request.method === "GET") response = await callback(request, jar);
+			else if (rest === "sign-out" && request.method === "POST") response = await signOut(request, jar);
+			else if (rest === "link" && request.method === "POST") response = await link(request, jar);
+			else if (rest === "session" && request.method === "GET") response = json(await userOf(await load(jar)));
+			else if (first === "account") response = await account(request, jar, tail.join("/"));
+			else if (!RESERVED.has(first)) response = await plugin(request, jar, first, tail.join("/"));
+		} catch (error) {
+			if (!isSynqError(error)) throw error;
+			response = problem(error.status && error.status >= 400 ? 502 : 500, error.code, error.message);
+		}
+		response ??= problem(404, "not_found", "No such route under the mount");
+		const headers = new Headers(response.headers);
+		for (const cookie of jar.headers()) headers.append("set-cookie", cookie);
+		if (!headers.has("cache-control")) headers.set("cache-control", "no-store");
+		headers.set("x-content-type-options", "nosniff");
+		return new Response(response.body, {
+			status: response.status,
+			headers
+		});
+	}
+	async function refreshIfDue(jar) {
+		const handle = await load(jar);
+		const { user, expiresAt } = await userOf(handle);
+		if (!handle || !user) return false;
+		if (config.store || expiresAt === null || expiresAt - config.refreshLeewaySeconds > now()) return true;
+		try {
+			await getAccessToken(jar);
+			return true;
+		} catch (error) {
+			if (isSynqError(error, "invalid_grant") || isSynqError(error, "no_refresh_token")) return false;
+			return expiresAt > now();
+		}
+	}
+	return {
+		handle,
+		user: async (jar) => (await userOf(await load(jar))).user,
+		session: async (jar) => userOf(await load(jar)),
+		getAccessToken,
+		refreshIfDue,
+		config
+	};
+}
+/**
+* Whether a request is a prefetch, not a person going there: Next.js's
+* router (`Next-Router-Prefetch`) and browsers' speculative loads (`Purpose`,
+* `Sec-Purpose`: prefetch or prerender).
+*/
+function isPrefetch(request) {
+	const h = request.headers;
+	if (h.get("next-router-prefetch") !== null) return true;
+	const purpose = `${h.get("purpose") ?? ""} ${h.get("sec-purpose") ?? ""}`.toLowerCase();
+	return /\b(prefetch|prerender)\b/.test(purpose);
+}
+/**
+* Where to send the browser back to on the app, as an absolute URL, never
+* another site: the app's root for anything else. It checks where the value
+* resolves to, not how it's spelled, since dot segments and encodings
+* (`/.//evil.example`, `/%2e//evil.example`) collapse into another host.
+*/
+function safeReturnTo(value, appUrl) {
+	const home = new URL("/", appUrl).href;
+	if (!value || value.includes("\\")) return home;
+	try {
+		const url = new URL(value, appUrl);
+		return url.origin === appUrl.origin && !url.pathname.startsWith("//") ? url.href : home;
+	} catch {
+		return home;
+	}
+}
+/** A request from the app's own pages: its `Origin`, or else the browser's `Sec-Fetch-Site`, says so. */
+function sameOrigin(request, appUrl) {
+	const origin = request.headers.get("origin");
+	if (origin) return origin === appUrl.origin;
+	return request.headers.get("sec-fetch-site") === "same-origin";
+}
+function withError(target, code) {
+	const url = new URL(target);
+	url.searchParams.set("synq_error", code);
+	return url.href;
+}
+function redirect(location, status) {
+	return new Response(null, {
+		status,
+		headers: { location }
+	});
+}
+function json(body, status = 200) {
+	return Response.json(body, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+function problem(status, code, detail) {
+	return Response.json({
+		type: "about:blank",
+		status,
+		code,
+		detail
+	}, {
+		status,
+		headers: {
+			"content-type": "application/problem+json",
+			"cache-control": "no-store"
+		}
+	});
+}
+function now() {
+	return Math.floor(Date.now() / 1e3);
+}
+//#endregion
+//#region src/sign-in-error.ts
+/** The query parameter the route mount adds to `returnTo` when a sign-in fails. */
+const SIGN_IN_ERROR_PARAM = "synq_error";
+/** An OAuth or SDK error code, as the route mount puts it there. */
+const CODE = /^[a-z0-9_]{1,64}$/;
+const MESSAGES = {
+	access_denied: "The sign-in was cancelled, or this account can’t use this app.",
+	login_required: "You need to sign in to continue.",
+	interaction_required: "You need to sign in to continue.",
+	consent_required: "You need to allow this app to use your account to continue.",
+	account_selection_required: "Choose an account to continue.",
+	temporarily_unavailable: "Signing in isn’t available just now. Try again in a moment.",
+	unknown_state: "This sign-in expired, or it finished in another tab. Try again."
+};
+/** What a sign-in error code means, in plain words. */
+function signInErrorMessage(code) {
+	return MESSAGES[code] ?? "Something went wrong signing in. Try again.";
+}
+/** A path and query on the app, without `synq_error`: where the ways on come back to. */
+function withoutSignInError(pathAndSearch) {
+	const url = new URL(pathAndSearch, "http://app.invalid");
+	url.searchParams.delete(SIGN_IN_ERROR_PARAM);
+	return `${url.pathname}${url.search}`;
+}
+/**
+* The sign-in error `code` names, coming back to `returnTo` (a path on the
+* app), or null when there is none or it isn't a code.
+*/
+function signInErrorOf(code, basePath, returnTo) {
+	if (!code || !CODE.test(code)) return null;
+	const back = withoutSignInError(returnTo.startsWith("/") && !returnTo.startsWith("//") ? returnTo : "/");
+	const signIn = (prompt) => {
+		const params = new URLSearchParams({ returnTo: back });
+		if (prompt) params.set("prompt", prompt);
+		return `${basePath}/sign-in?${params.toString()}`;
+	};
+	return {
+		code,
+		message: signInErrorMessage(code),
+		retryPath: signIn(),
+		anotherAccountPath: signIn("select_account")
+	};
+}
+function escape(text) {
+	return text.replace(/[&<>"']/g, (c) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[c]);
+}
+/**
+* The proxy's own page for a sign-in error, for an app that has none of its
+* own (`synqProxy`'s `signInError`): plain HTML, no script and no style, so
+* any Content-Security-Policy the app sends allows it.
+*/
+function signInErrorPage(error) {
+	const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Sign-in didn’t finish</title>
+</head>
+<body>
+<main>
+<h1>Sign-in didn’t finish</h1>
+<p>${escape(error.message)}</p>
+<p><a href="${escape(error.retryPath)}">Try again</a></p>
+<p><a href="${escape(error.anotherAccountPath)}">Use another account</a></p>
+</main>
+</body>
+</html>
+`;
+	return new Response(html, {
+		status: 200,
+		headers: {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store",
+			"x-content-type-options": "nosniff"
+		}
+	});
+}
+//#endregion
+export { withoutSignInError as a, memorySessionStore as c, normalizePath as d, resolveConfig as f, signInErrorPage as i, defineSynqPlugin as l, signInErrorMessage as n, createSynqCore as o, signInErrorOf as r, keyValueSessionStore as s, SIGN_IN_ERROR_PARAM as t, requestJar as u };