@synqauth/nextjs 0.0.0 → 0.3.0

package/dist/sites-JUnMBDbp.js

@@ -0,0 +1,2094 @@
+import { SynqError, createSynqClient, isSynqError, memoryStorage, readMethodList, signInMethods } from "@synqauth/js";
+//#region src/crypto.ts
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const VERSION = "v1";
+const keys = /* @__PURE__ */ new Map();
+/**
+* The sealing key for a session secret, derived once per secret; with
+* `site`, the key for that site alone (`siteBinding`), which the site's core
+* keeps rather than this module.
+*/
+function sealingKey(secret, site = "") {
+	if (encoder.encode(secret).length < 32) throw new TypeError(`The session secret must be at least 32 bytes`);
+	if (site) return deriveKey(secret, `${VERSION}\nsite ${site}`);
+	let key = keys.get(secret);
+	if (!key) {
+		key = deriveKey(secret, VERSION);
+		keys.set(secret, key);
+	}
+	return key;
+}
+async function deriveKey(secret, info) {
+	const base = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: encoder.encode("@synqauth/nextjs session"),
+		info: encoder.encode(info)
+	}, base, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+async function sealingKeys(current, previous = [], site = "") {
+	const open = await Promise.all([current, ...previous].map((secret) => sealingKey(secret, site)));
+	return {
+		seal: open[0],
+		open
+	};
+}
+/** `plaintext` sealed for the cookie `name`: `v1.<iv>.<ciphertext>`, base64url. */
+async function seal(key, plaintext, name) {
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const sealed = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: encoder.encode(name)
+	}, key, encoder.encode(plaintext));
+	return `${VERSION}.${base64url(iv)}.${base64url(new Uint8Array(sealed))}`;
+}
+/** What `seal` sealed for `name` with any of `keys`, or undefined for anything else: another cookie's, tampered, or another secret's. */
+async function unseal(keys, sealed, name) {
+	if (!sealed) return void 0;
+	const [version, iv, data, ...rest] = sealed.split(".");
+	if (version !== VERSION || !iv || !data || rest.length > 0) return void 0;
+	const candidates = Array.isArray(keys) ? keys : [keys];
+	for (const key of candidates) try {
+		const opened = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: fromBase64url(iv),
+			additionalData: encoder.encode(name)
+		}, key, fromBase64url(data));
+		return decoder.decode(opened);
+	} catch {}
+}
+/** A random id: 128 bits, base64url. */
+function randomId() {
+	return base64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16)));
+}
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64url(text) {
+	const binary = atob(text.replaceAll("-", "+").replaceAll("_", "/"));
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+//#endregion
+//#region src/config.ts
+/** Milliseconds a request to Synq may take before it's given up: shorter than any lock a store holds for a refresh. */
+const REQUEST_TIMEOUT_MS = 1e4;
+/** Variables that say the app may run on more than one server process: serverless functions, replicas. */
+const MULTI_PROCESS = [
+	"VERCEL",
+	"AWS_LAMBDA_FUNCTION_NAME",
+	"NETLIFY",
+	"K_SERVICE",
+	"KUBERNETES_SERVICE_HOST"
+];
+/** The configuration from `options` and the environment; throws `invalid_options` for anything missing or unsafe. */
+function resolveConfig(options = {}, env = processEnv()) {
+	if (options.resolve) throw new SynqError("invalid_options", "This configuration has resolve, so each request picks its own: synqAuth() and synqProxy() read it per request");
+	if (options.hosts !== void 0) throw new SynqError("invalid_options", "hosts goes with resolve: the hosts it answers for");
+	return build(options, {
+		issuer: options.issuer ?? env.SYNQ_ISSUER,
+		clientId: options.clientId ?? env.SYNQ_CLIENT_ID,
+		clientSecret: options.clientSecret ?? env.SYNQ_CLIENT_SECRET,
+		appUrl: options.appUrl ?? env.SYNQ_APP_URL,
+		account: options.account,
+		postLogoutRedirectUri: options.postLogoutRedirectUri,
+		storePrefix: void 0
+	}, {
+		issuer: "SYNQ_ISSUER",
+		clientId: "SYNQ_CLIENT_ID",
+		clientSecret: "SYNQ_CLIENT_SECRET",
+		appUrl: "SYNQ_APP_URL"
+	}, env, false);
+}
+/** The options `resolve` answers for each site, which the top level never gives alongside it. */
+const SITE_OPTIONS = [
+	"issuer",
+	"clientId",
+	"clientSecret",
+	"appUrl",
+	"postLogoutRedirectUri"
+];
+/** A site's prefix in the store: letters, digits and `.:_~-`, as a key-value store's key takes them. */
+const STORE_PREFIX = /^[A-Za-z0-9._:~-]{1,128}$/;
+/**
+* One site's configuration (AERO-2655): what `resolve` answered for
+* `request`, over `options`' shared settings. Throws `invalid_options` for
+* anything missing or unsafe, naming the field, never its value.
+*/
+function siteConfig(options, site, request, env = processEnv()) {
+	const given = SITE_OPTIONS.filter((name) => options[name] !== void 0);
+	if (given.length > 0) throw new SynqError("invalid_options", `With resolve, each site's ${given.join(", ")} come from resolve: take ${given.length === 1 ? "it" : "them"} out of the options`);
+	if (site === null || typeof site !== "object") throw new SynqError("invalid_options", "resolve answers a site, or null for a host the app doesn’t serve");
+	const config = build(options, {
+		issuer: text(site.issuer, "resolve()'s issuer"),
+		clientId: text(site.clientId, "resolve()'s clientId"),
+		clientSecret: text(site.clientSecret, "resolve()'s clientSecret"),
+		appUrl: site.appUrl === void 0 ? request.origin : text(site.appUrl, "resolve()'s appUrl"),
+		account: site.account ?? options.account,
+		postLogoutRedirectUri: site.postLogoutRedirectUri === void 0 ? void 0 : text(site.postLogoutRedirectUri, "resolve()'s postLogoutRedirectUri"),
+		storePrefix: site.storePrefix
+	}, {
+		issuer: "resolve()'s issuer",
+		clientId: "resolve()'s clientId",
+		clientSecret: "resolve()'s clientSecret",
+		appUrl: "resolve()'s appUrl"
+	}, env, true);
+	if (config.appUrl.origin !== request.origin) throw new SynqError("invalid_options", "resolve()'s appUrl must be the origin the request came to (its https://<host>): leave it out to use that");
+	return config;
+}
+/** A site's field: a string, or the error that names it. */
+function text(value, name) {
+	if (value === void 0 || value === null || value === "") return void 0;
+	if (typeof value !== "string") throw new SynqError("invalid_options", `${name} must be a string`);
+	return value;
+}
+function build(options, fields, names, env, perSite) {
+	const issuer = required(fields.issuer, names.issuer).replace(/\/+$/, "");
+	checkUrl(issuer, names.issuer);
+	const clientId = required(fields.clientId, names.clientId);
+	const clientSecret = required(fields.clientSecret, names.clientSecret);
+	const appUrl = checkUrl(required(fields.appUrl, names.appUrl), names.appUrl);
+	const sessionSecret = required(options.sessionSecret ?? env.SYNQ_SESSION_SECRET, "SYNQ_SESSION_SECRET");
+	const previousSessionSecrets = options.previousSessionSecrets ?? (env.SYNQ_SESSION_SECRET_PREVIOUS ?? "").split(",").map((secret) => secret.trim()).filter(Boolean);
+	for (const secret of [sessionSecret, ...previousSessionSecrets]) if (new TextEncoder().encode(secret).length < 32) throw new SynqError("invalid_options", `Each session secret must be at least 32 bytes: make one with \`openssl rand -base64 32\``);
+	const hint = MULTI_PROCESS.find((name) => env[name]);
+	if (!options.store && !options.allowSingleProcessCookieMode && hint) throw new SynqError("invalid_options", `${hint} is set, so this app may run on more than one server process, where sessions in cookies can't refresh one at a time and Synq would sign people out: give synqAuth() a store every process shares (keyValueSessionStore over Redis or Valkey), or allowSingleProcessCookieMode if it truly runs one`);
+	if (fields.storePrefix !== void 0) {
+		if (typeof fields.storePrefix !== "string" || !STORE_PREFIX.test(fields.storePrefix)) throw new SynqError("invalid_options", "resolve()'s storePrefix is 1 to 128 of A-Z a-z 0-9 . : _ ~ -");
+		if (!options.store) throw new SynqError("invalid_options", "resolve()'s storePrefix places a site's sessions in synqAuth()'s store: give it a store");
+	}
+	const basePath = normalizePath(options.basePath ?? "/api/auth");
+	const accountApi = fields.account === false ? void 0 : `${issuer}/me`;
+	const primary = options.resource ?? accountApi;
+	const scopes = /* @__PURE__ */ new Set([
+		"openid",
+		"profile",
+		"email",
+		"offline_access"
+	]);
+	if (accountApi) for (const scope of ["me:read", "me:write"]) scopes.add(scope);
+	for (const scope of (options.scope ?? "").split(/\s+/)) if (scope) scopes.add(scope);
+	const origin = appUrl.origin;
+	return {
+		issuer,
+		clientId,
+		clientSecret,
+		appUrl,
+		sessionSecret,
+		previousSessionSecrets,
+		basePath,
+		primary,
+		accountApi,
+		scope: [...scopes].join(" "),
+		redirectUri: `${origin}${basePath}/callback`,
+		postLogoutRedirectUri: fields.postLogoutRedirectUri ?? `${origin}/`,
+		store: options.store && fields.storePrefix ? prefixedStore(options.store, fields.storePrefix) : options.store,
+		sessionMaxAge: options.sessionMaxAge ?? 2592e3,
+		refreshLeewaySeconds: options.refreshLeewaySeconds ?? 30,
+		plugins: options.plugins ?? [],
+		fetch: options.fetch,
+		clientAddress: options.clientAddress ?? ((request) => request.headers.get("x-real-ip")?.trim() || void 0),
+		secure: appUrl.protocol === "https:",
+		site: perSite ? JSON.stringify([
+			issuer,
+			clientId,
+			origin
+		]) : ""
+	};
+}
+/** `store` with every session id under `prefix`: one site's sessions, apart from the others'. */
+function prefixedStore(store, prefix) {
+	return {
+		get: (id) => store.get(`${prefix}${id}`),
+		set: (id, values, maxAgeSeconds) => store.set(`${prefix}${id}`, values, maxAgeSeconds),
+		delete: (id) => store.delete(`${prefix}${id}`),
+		lock: (id, fn) => store.lock(`${prefix}${id}`, fn)
+	};
+}
+function processEnv() {
+	return globalThis.process?.env ?? {};
+}
+function required(value, name) {
+	if (!value) throw new SynqError("invalid_options", `${name} is missing`);
+	return value;
+}
+/** An https URL, or http on this machine only. */
+function checkUrl(value, name) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new SynqError("invalid_options", `${name} isn't a URL`);
+	}
+	const loopback = url.hostname === "localhost" || url.hostname.endsWith(".localhost") || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) throw new SynqError("invalid_options", `${name} must be https (http only on this machine)`);
+	return url;
+}
+/** The route mount's path, `/api/auth` style; throws `invalid_options` for anything else. */
+function normalizePath(path) {
+	const trimmed = `/${path.replace(/^\/+|\/+$/g, "")}`;
+	if (!/^\/[A-Za-z0-9._~\-/]*$/.test(trimmed) || trimmed.includes("//")) throw new SynqError("invalid_options", "basePath must be a plain path, such as /api/auth");
+	return trimmed;
+}
+//#endregion
+//#region src/intent.ts
+/** The hosted flow an app asks for after identifying the account. */
+const SIGN_IN_INTENTS = /* @__PURE__ */ new Set(["add-passkey", "verify-email"]);
+/** Verification keeps the issuer session; adding a credential still needs a fresh sign-in. */
+function intentPrompt(intent, prompt) {
+	if (prompt != null) return prompt;
+	if (intent === "verify-email") return "select_account";
+	return prompt ?? (intent ? "login" : void 0);
+}
+//#endregion
+//#region src/cookies.ts
+/** Characters per chunk, under the 4096 bytes a browser keeps for one cookie with its attributes. */
+const CHUNK_SIZE = 3800;
+/** A cookie's full name: `__Host-<base>` over https, `<base>` on a plain-http stack on this machine. */
+function cookieName(base, secure) {
+	return secure ? `__Host-${base}` : base;
+}
+/** A value kept under `name`, joined from its chunks; undefined when there is none. */
+function readChunked(jar, name) {
+	const whole = jar.get(name);
+	if (whole !== void 0) return whole;
+	let value = "";
+	for (let i = 0;; i++) {
+		const chunk = jar.get(`${name}.${i}`);
+		if (chunk === void 0) return i === 0 ? void 0 : value;
+		value += chunk;
+	}
+}
+/** Keeps `value` under `name`, in chunks when it needs them, and deletes chunks a longer value left behind. */
+function writeChunked(jar, name, value, options) {
+	const existing = chunkNames(jar, name);
+	if (value.length <= 3800) {
+		jar.set(name, value, options);
+		for (const old of existing) if (old !== name) jar.delete(old, options);
+		return;
+	}
+	const written = /* @__PURE__ */ new Set();
+	for (let i = 0; i * CHUNK_SIZE < value.length; i++) {
+		const chunk = `${name}.${i}`;
+		jar.set(chunk, value.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE), options);
+		written.add(chunk);
+	}
+	for (const old of existing) if (!written.has(old)) jar.delete(old, options);
+}
+/** Deletes `name` and every chunk of it. */
+function deleteChunked(jar, name, options) {
+	for (const old of chunkNames(jar, name)) jar.delete(old, options);
+}
+function chunkNames(jar, name) {
+	const pattern = new RegExp(`^${escapeRegExp(name)}(\\.\\d+)?$`);
+	return [...jar.names()].filter((candidate) => pattern.test(candidate));
+}
+/** The Set-Cookie header for a cookie: `HttpOnly`, `SameSite=Lax`, `Path=/`, and `Secure` over https. */
+function setCookieHeader(name, value, options) {
+	const parts = [
+		`${name}=${value}`,
+		"Path=/",
+		"HttpOnly",
+		"SameSite=Lax"
+	];
+	if (options.maxAge !== void 0) parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAge))}`);
+	if (options.secure) parts.push("Secure");
+	return parts.join("; ");
+}
+/** The cookies a `Cookie` header carries. */
+function parseCookieHeader(header) {
+	const cookies = /* @__PURE__ */ new Map();
+	for (const pair of (header ?? "").split(";")) {
+		const at = pair.indexOf("=");
+		if (at <= 0) continue;
+		const name = pair.slice(0, at).trim();
+		if (!cookies.has(name)) cookies.set(name, pair.slice(at + 1).trim());
+	}
+	return cookies;
+}
+/** A jar over a request's cookies that collects the Set-Cookie headers its response sends. */
+function requestJar(request) {
+	const cookies = parseCookieHeader(request.headers.get("cookie"));
+	const out = /* @__PURE__ */ new Map();
+	return {
+		get: (name) => cookies.get(name),
+		names: () => cookies.keys(),
+		set(name, value, options) {
+			cookies.set(name, value);
+			out.set(name, setCookieHeader(name, value, options));
+		},
+		delete(name, options) {
+			cookies.delete(name);
+			out.set(name, setCookieHeader(name, "", {
+				...options,
+				maxAge: 0
+			}));
+		},
+		headers: () => [...out.values()],
+		/** The `Cookie` header the request carries now, changes made: for what runs after Next's proxy. */
+		cookieHeader: () => [...cookies].map(([name, value]) => `${name}=${value}`).join("; ")
+	};
+}
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//#endregion
+//#region src/plugins.ts
+const PLUGIN_ID = /^[a-z][a-z0-9-]{0,39}$/;
+const ROUTE_KEY = /^(GET|POST|PATCH|DELETE) \/[A-Za-z0-9._~\-/]*$/;
+/** Declares a server plugin, checking its id and routes once, when the module loads. */
+function defineSynqPlugin(plugin) {
+	if (!PLUGIN_ID.test(plugin.id) || RESERVED.has(plugin.id)) throw new TypeError(`A Synq plugin's id must be lowercase letters, digits and dashes, and not one of the mount's own routes: ${plugin.id}`);
+	for (const key of Object.keys(plugin.routes ?? {})) if (!ROUTE_KEY.test(key)) throw new TypeError(`A Synq plugin's route is "<METHOD> /<path>": ${key}`);
+	return plugin;
+}
+/** The route mount's own paths, which no plugin can take. */
+const RESERVED = /* @__PURE__ */ new Set([
+	"sign-in",
+	"callback",
+	"sign-out",
+	"session",
+	"account",
+	"link"
+]);
+//#endregion
+//#region src/popup.ts
+/** The page's id for one popup sign-in, which its message carries back: what `attempt` takes. */
+const POPUP_ATTEMPT = /^[A-Za-z0-9_-]{8,64}$/;
+const POPUP_MESSAGE = "synq:popup";
+/**
+* The page's one script, constant so the Content-Security-Policy names it by
+* hash (`POPUP_SCRIPT_HASH`): it reads the result from the JSON block beside
+* it, posts it, and closes the window.
+*/
+const POPUP_SCRIPT = "(function(){var d=document.getElementById('synq-result');var r=d?JSON.parse(d.textContent||'null'):null;if(r){try{var c=new BroadcastChannel('synq');c.postMessage(r);c.close()}catch(e){}}window.close()})()";
+/** `POPUP_SCRIPT`'s SHA-256, as CSP's `script-src` takes it; its test holds the two together. */
+const POPUP_SCRIPT_HASH = "sha256-OpmVimyyrlgsewsXQaWdNVXCa4ywJlk1XZL1thsfWk0=";
+/** The popup's last page: it reports `result` and closes, or says the person may close it. */
+function popupPage(result) {
+	const message = {
+		type: POPUP_MESSAGE,
+		...result
+	};
+	const data = JSON.stringify(message).replaceAll("<", "\\u003c");
+	const words = result.ok ? "You’re signed in. You can close this window." : "That didn’t finish. You can close this window and try again.";
+	const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${result.ok ? "Signed in" : "Not signed in"}</title>
+</head>
+<body>
+<p>${words}</p>
+<script type="application/json" id="synq-result">${data}<\/script>
+<script>${POPUP_SCRIPT}<\/script>
+</body>
+</html>
+`;
+	return new Response(html, {
+		status: 200,
+		headers: {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store",
+			"content-security-policy": `default-src 'none'; script-src '${POPUP_SCRIPT_HASH}'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+			"referrer-policy": "no-referrer"
+		}
+	});
+}
+//#endregion
+//#region src/session-name.ts
+const SESSION_COOKIE = "synq.session";
+//#endregion
+//#region src/store.ts
+/**
+* A store in this process's memory: for tests and a single server process,
+* where the default cookie does as well.
+*/
+function memorySessionStore() {
+	const sessions = /* @__PURE__ */ new Map();
+	const locks = /* @__PURE__ */ new Map();
+	return {
+		get(id) {
+			const entry = sessions.get(id);
+			if (!entry || entry.expires <= Date.now()) {
+				sessions.delete(id);
+				return Promise.resolve(null);
+			}
+			return Promise.resolve({ ...entry.values });
+		},
+		set(id, values, maxAgeSeconds) {
+			sessions.set(id, {
+				values: { ...values },
+				expires: Date.now() + maxAgeSeconds * 1e3
+			});
+			return Promise.resolve();
+		},
+		delete(id) {
+			sessions.delete(id);
+			return Promise.resolve();
+		},
+		lock: (id, fn) => chain(locks, id, fn)
+	};
+}
+/**
+* Sessions in a key-value store every server process shares, such as Redis
+* or Valkey: the store an app on several processes (replicas, serverless
+* functions) needs. Its lock is `SET … NX PX` with a token, polled until
+* free, and released only by its holder; it expires on its own, so a dead
+* process never holds a session for ever.
+*
+* ```ts
+* keyValueSessionStore({
+*   get: (key) => redis.get(key),
+*   set: async (key, value, { ttlMs, onlyIfAbsent }) =>
+*     (await redis.set(key, value, { PX: ttlMs, NX: onlyIfAbsent })) === 'OK',
+*   delete: async (key) => void (await redis.del(key)),
+* })
+* ```
+*/
+function keyValueSessionStore(kv, options = {}) {
+	const prefix = options.prefix ?? "synq:";
+	const lockTtlMs = options.lockTtlMs ?? 3e4;
+	const lockWaitMs = options.lockWaitMs ?? 35e3;
+	if (lockTtlMs <= 2e4) throw new TypeError(`lockTtlMs must be over ${REQUEST_TIMEOUT_MS * 2}: a refresh can make two requests to Synq (discovery, then the token) of up to ${REQUEST_TIMEOUT_MS} ms each`);
+	const sessionKey = (id) => `${prefix}session:${id}`;
+	const lockKey = (id) => `${prefix}lock:${id}`;
+	return {
+		async get(id) {
+			const raw = await kv.get(sessionKey(id));
+			if (!raw) return null;
+			try {
+				return JSON.parse(raw);
+			} catch {
+				return null;
+			}
+		},
+		async set(id, values, maxAgeSeconds) {
+			await kv.set(sessionKey(id), JSON.stringify(values), { ttlMs: maxAgeSeconds * 1e3 });
+		},
+		async delete(id) {
+			await kv.delete(sessionKey(id));
+		},
+		async lock(id, fn) {
+			const key = lockKey(id);
+			const token = crypto.randomUUID();
+			const deadline = Date.now() + lockWaitMs;
+			let wait = 25;
+			while (!await kv.set(key, token, {
+				ttlMs: lockTtlMs,
+				onlyIfAbsent: true
+			})) {
+				if (Date.now() >= deadline) throw new SynqError("lock_timeout", "Another request held this session's lock too long");
+				await new Promise((resolve) => setTimeout(resolve, wait));
+				wait = Math.min(wait * 2, 250);
+			}
+			try {
+				return await fn();
+			} finally {
+				if (kv.deleteIfEquals) await kv.deleteIfEquals(key, token);
+				else if (await kv.get(key) === token) await kv.delete(key);
+			}
+		}
+	};
+}
+/** Runs `fn` after every earlier holder of `name` in `locks`, failed or not. */
+function chain(locks, name, fn) {
+	const run = (locks.get(name) ?? Promise.resolve()).then(fn, fn);
+	const settled = run.then(() => void 0, () => void 0);
+	locks.set(name, settled);
+	settled.then(() => {
+		if (locks.get(name) === settled) locks.delete(name);
+	});
+	return run;
+}
+//#endregion
+//#region src/session.ts
+/**
+* @synqauth/js's keys in its store (client.ts), which the adapter maps onto
+* a session's values: the session per API, and the refresh token.
+*/
+const JS_SESSION_KEY = "synq.session";
+const JS_REFRESH_KEY = "synq.refresh";
+const REFRESH = "refresh";
+const SHARED = Symbol.for("@synqauth/nextjs sessions");
+const { newest, locks } = globalThis[SHARED] ??= {
+	newest: /* @__PURE__ */ new Map(),
+	locks: /* @__PURE__ */ new Map()
+};
+const OVERLAY_MAX = 1e4;
+const OVERLAY_TTL_MS = 18e5;
+var SessionHandle = class {
+	id;
+	created;
+	#backend;
+	/** Whether the cookie must be written: a new session, or values newer than the cookie's. */
+	#cookieRev;
+	#fresh;
+	constructor(id, created, backend, cookieRev, fresh) {
+		this.id = id;
+		this.created = created;
+		this.#backend = backend;
+		this.#cookieRev = cookieRev;
+		this.#fresh = fresh;
+	}
+	read() {
+		return this.#backend.read();
+	}
+	/** `@synqauth/js`'s store for this session's token for `resource`; `primary` is the API whose session holds the ID token. */
+	storage(resource, primary) {
+		const own = tokenKey(resource);
+		const main = tokenKey(primary);
+		const backend = this.#backend;
+		return {
+			holdsRefreshTokens: true,
+			async get(key) {
+				const values = await backend.read();
+				if (key === JS_REFRESH_KEY) return values[REFRESH];
+				if (key !== JS_SESSION_KEY) return void 0;
+				const mine = values[own];
+				const first = values[main];
+				if (own === main) return mine;
+				if (!first) return mine;
+				const { idToken, claims } = JSON.parse(first);
+				if (mine) return JSON.stringify({
+					...JSON.parse(mine),
+					idToken,
+					claims
+				});
+				return JSON.stringify({
+					accessToken: "",
+					tokenType: "Bearer",
+					expiresAt: 0,
+					idToken,
+					claims
+				});
+			},
+			async set(key, value) {
+				if (key === JS_REFRESH_KEY) return backend.write((values) => void (values[REFRESH] = value));
+				if (key !== JS_SESSION_KEY) return;
+				let kept = value;
+				if (own !== main) {
+					const rest = JSON.parse(value);
+					delete rest.idToken;
+					delete rest.claims;
+					kept = JSON.stringify(rest);
+				}
+				await backend.write((values) => void (values[own] = kept));
+			},
+			async remove(key) {
+				if (key === JS_REFRESH_KEY) return backend.write((values) => void delete values[REFRESH]);
+				if (key !== JS_SESSION_KEY) return;
+				await backend.write((values) => {
+					if (own === main) for (const name of Object.keys(values)) delete values[name];
+					else delete values[own];
+				});
+			},
+			lock: (_name, fn) => backend.lock(fn)
+		};
+	}
+	/** Writes the session's cookie when it's new or this process holds newer values than it. */
+	async commit(jar, keys, secure, maxAge, store) {
+		const name = cookieName(SESSION_COOKIE, secure);
+		const remaining = Math.max(0, this.created + maxAge - now$1());
+		if (store) {
+			if (!this.#fresh) return;
+			const sealed = {
+				v: 1,
+				id: this.id,
+				created: this.created
+			};
+			writeChunked(jar, name, await seal(keys.seal, JSON.stringify(sealed), name), {
+				secure,
+				maxAge: remaining
+			});
+			this.#fresh = false;
+			return;
+		}
+		const current = newest.get(this.id);
+		const rev = current?.rev ?? 0;
+		if (!this.#fresh && rev <= this.#cookieRev) return;
+		const sealed = {
+			v: 1,
+			id: this.id,
+			created: this.created,
+			rev,
+			values: current?.values ?? {}
+		};
+		writeChunked(jar, name, await seal(keys.seal, JSON.stringify(sealed), name), {
+			secure,
+			maxAge: remaining
+		});
+		this.#cookieRev = rev;
+		this.#fresh = false;
+	}
+};
+/** The session the request's cookie names, or null: none, unreadable, past its age, or gone from the store. */
+async function loadSession(jar, keys, secure, maxAge, store) {
+	const name = cookieName(SESSION_COOKIE, secure);
+	const opened = await unseal(keys.open, readChunked(jar, name), name);
+	if (!opened) return null;
+	let sealed;
+	try {
+		sealed = JSON.parse(opened);
+	} catch {
+		return null;
+	}
+	if (sealed.v !== 1 || typeof sealed.id !== "string" || sealed.created + maxAge <= now$1()) return null;
+	if (store) {
+		if (!await store.get(sealed.id)) return null;
+		return new SessionHandle(sealed.id, sealed.created, storeBackend(store, sealed.id, sealed.created, maxAge), 0, false);
+	}
+	const rev = sealed.rev ?? 0;
+	remember(sealed.id, rev, sealed.values ?? {});
+	return new SessionHandle(sealed.id, sealed.created, cookieBackend(sealed.id), rev, false);
+}
+/** A new, empty session: what a sign-in fills. */
+function newSession(maxAge, store) {
+	const id = randomId();
+	const created = now$1();
+	if (store) return new SessionHandle(id, created, storeBackend(store, id, created, maxAge), 0, true);
+	remember(id, 0, {});
+	return new SessionHandle(id, created, cookieBackend(id), -1, true);
+}
+/** Ends a session: its cookie, its stored values, and what this process remembers of it. */
+async function endSession(jar, handle, secure, store) {
+	if (handle) {
+		newest.delete(handle.id);
+		if (store) await store.delete(handle.id);
+	}
+	deleteChunked(jar, cookieName(SESSION_COOKIE, secure), { secure });
+}
+/** The key a session keeps `resource`'s token under. */
+function tokenKey(resource) {
+	return `token:${resource ?? ""}`;
+}
+function cookieBackend(id) {
+	return {
+		read() {
+			const entry = newest.get(id);
+			return Promise.resolve({ ...entry?.values ?? {} });
+		},
+		write(mutate) {
+			const entry = newest.get(id);
+			const values = { ...entry?.values ?? {} };
+			mutate(values);
+			remember(id, (entry?.rev ?? 0) + 1, values);
+			return Promise.resolve();
+		},
+		lock: (fn) => chain(locks, id, fn)
+	};
+}
+function storeBackend(store, id, created, maxAge) {
+	return {
+		async read() {
+			return await store.get(id) ?? {};
+		},
+		async write(mutate) {
+			const values = await store.get(id) ?? {};
+			mutate(values);
+			await store.set(id, values, Math.max(1, created + maxAge - now$1()));
+		},
+		lock: (fn) => store.lock(id, fn)
+	};
+}
+/** Keeps the newer of what's remembered and `rev`'s values. */
+function remember(id, rev, values) {
+	const entry = newest.get(id);
+	const time = Date.now();
+	if (entry && entry.rev >= rev) {
+		entry.seen = time;
+		return;
+	}
+	newest.delete(id);
+	newest.set(id, {
+		rev,
+		values,
+		seen: time
+	});
+	if (newest.size > OVERLAY_MAX) for (const [old, kept] of newest) {
+		if (newest.size <= OVERLAY_MAX && time - kept.seen < OVERLAY_TTL_MS) break;
+		newest.delete(old);
+	}
+}
+function now$1() {
+	return Math.floor(Date.now() / 1e3);
+}
+//#endregion
+//#region src/sign-in-context.ts
+/** The cookie that remembers the way in: the browser keeps it as long as Chrome allows, 400 days. */
+const LAST_USED = "synq.last-used";
+const LAST_USED_MAX_AGE = 3456e4;
+/** The cookie that holds a sign-in until the page hears of it: five minutes at most. */
+const EVENT = "synq.event";
+const EVENT_MAX_AGE = 300;
+/** A method's id, as the issuer names them. */
+const METHOD$1 = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+/** How long a list of methods is kept: what the issuer allows. */
+const METHODS_TTL_MS = 6e4;
+/**
+* How long the callback waits for the issuer's list to learn whether the
+* brand shows "Last used": past it, the sign-in goes on and "Last used"
+* waits for the next one.
+*/
+const METHODS_WAIT_MS = 2e3;
+/**
+* A wallet app's name as the issuer keeps it: letters, digits, spaces and a
+* little punctuation, at most 32 characters. Anything else isn't kept.
+*/
+function walletAppName(value) {
+	if (typeof value !== "string") return void 0;
+	const name = value.normalize("NFC").trim().replace(/\s+/g, " ");
+	return name.length > 0 && name.length <= 32 && /^[\p{L}\p{N} .'_-]+$/u.test(name) ? name : void 0;
+}
+/** What the session's ID token says of its sign-in, when the app turned the claims on. */
+function signInOf(claims) {
+	const method = claims?.sign_in_method;
+	const at = claims?.auth_time;
+	if (typeof method !== "string" || !METHOD$1.test(method) || typeof at !== "number") return void 0;
+	const wallet = claims?.sign_in_wallet;
+	return {
+		id: crypto.randomUUID(),
+		isNewUser: claims?.new_user === true,
+		method,
+		wallet: wallet && typeof wallet.address === "string" ? {
+			address: wallet.address,
+			app: walletAppName(wallet.app) ?? null
+		} : null,
+		at
+	};
+}
+/** Remembers on this browser the way it signed in: the method, and a wallet app's name. */
+function rememberLastUsed(jar, event, secure) {
+	const app = event.wallet?.app ?? void 0;
+	const value = app ? `${event.method}.${encodeURIComponent(app)}` : event.method;
+	jar.set(cookieName(LAST_USED, secure), value, {
+		secure,
+		maxAge: LAST_USED_MAX_AGE
+	});
+}
+/** The way this browser last signed in to the app, as its cookie holds it, or null. */
+function lastUsedOf(jar, secure) {
+	const value = jar.get(cookieName(LAST_USED, secure));
+	if (!value || value.length > 160) return null;
+	const dot = value.indexOf(".");
+	const method = dot < 0 ? value : value.slice(0, dot);
+	if (!METHOD$1.test(method)) return null;
+	if (dot < 0) return { method };
+	let app;
+	try {
+		app = walletAppName(decodeURIComponent(value.slice(dot + 1)));
+	} catch {
+		app = void 0;
+	}
+	return app ? {
+		method,
+		walletApp: app
+	} : { method };
+}
+/** Forgets the way in: where the brand turned "Last used" off. */
+function forgetLastUsed(jar, secure) {
+	if (jar.get(cookieName(LAST_USED, secure)) !== void 0) jar.delete(cookieName(LAST_USED, secure), { secure });
+}
+/** Keeps `event` for the page, sealed, bound to the person it is for (`sub`). */
+async function keepEvent(jar, key, sub, event, secure) {
+	const name = cookieName(EVENT, secure);
+	const until = Math.floor(Date.now() / 1e3) + EVENT_MAX_AGE;
+	jar.set(name, await seal(key, JSON.stringify({
+		sub,
+		event,
+		until
+	}), name), {
+		secure,
+		maxAge: EVENT_MAX_AGE
+	});
+}
+/** The sign-in kept for the page, when it is `sub`'s and still fresh, or null. */
+async function eventOf(jar, keys, sub, secure, now) {
+	if (!sub) return null;
+	const name = cookieName(EVENT, secure);
+	const opened = await unseal(keys, jar.get(name), name);
+	if (!opened) return null;
+	try {
+		const kept = JSON.parse(opened);
+		if (kept.sub !== sub || typeof kept.event?.id !== "string" || typeof kept.until !== "number" || kept.until < now) return null;
+		return kept.event;
+	} catch {
+		return null;
+	}
+}
+/** Forgets the kept sign-in: the page heard of it, or the person signed out. */
+function forgetEvent(jar, secure) {
+	if (jar.get(cookieName(EVENT, secure)) !== void 0) jar.delete(cookieName(EVENT, secure), { secure });
+}
+/**
+* `promise`'s value, or undefined when `ms` milliseconds pass first: the
+* caller goes on, and the promise settles on its own.
+*/
+async function within(promise, ms) {
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((resolve) => {
+			timer = setTimeout(resolve, ms);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* The app's sign-in methods from its issuer (`GET /sign-in/methods`), kept a
+* minute in this process, as the issuer allows; one read at a time.
+*/
+function methodsReader(options) {
+	let kept;
+	let reading;
+	return () => {
+		if (kept && kept.until > Date.now()) return Promise.resolve(kept.list);
+		reading ??= signInMethods(options).then((list) => {
+			kept = {
+				list: readMethodList(list),
+				until: Date.now() + METHODS_TTL_MS
+			};
+			return kept.list;
+		}).finally(() => {
+			reading = void 0;
+		});
+		return reading;
+	};
+}
+//#endregion
+//#region src/core.ts
+const PROMPTS = /* @__PURE__ */ new Set([
+	"login",
+	"none",
+	"consent",
+	"select_account",
+	"create"
+]);
+/** A plan's code, as Synq's catalog has it: what `plan` may hold (AERO-2160). */
+const PLAN_CODE = /^[a-z][a-z0-9-]{1,30}$/;
+/** An onboarding visit's id: 22 base62 characters (AERO-2160). */
+const ONBOARDING_VISIT = /^[0-9A-Za-z]{22}$/;
+/** A sign-in method's name, as `synq_method` and the account API's link requests take it. */
+const METHOD = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const TRANSACTION_SECONDS = 3600;
+const TRANSACTION_PREFIX = "synq.tx.";
+const ACCOUNT_BODY_LIMIT = 65536;
+/** A picture the person uploads: the account API's own limit (AERO-2700). */
+const PICTURE_BODY_LIMIT = 5242880;
+/** The pictures Synq takes, by the request's `Content-Type`; Synq knows them again by their bytes. */
+const PICTURE_TYPES = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif"
+]);
+const LINK_BODY_LIMIT = 4096;
+/** A step of an own-UI sign-in: a passkey's assertion is the most it carries. */
+const FLOW_BODY_LIMIT = 16384;
+/** Where an own-UI sign-in's flow is kept, sealed: one a browser at a time. */
+const FLOW_KEY = `${TRANSACTION_PREFIX}flow`;
+/** `synq_siws` as @synqauth/solana's `encodeSiws` writes it: base64url, well under the body's limit. */
+const SIWS = /^[A-Za-z0-9_-]{1,3072}$/;
+/** Claims of the ID token that say nothing about the person. */
+const PROTOCOL_CLAIMS = /* @__PURE__ */ new Set([
+	"iss",
+	"aud",
+	"azp",
+	"exp",
+	"iat",
+	"nbf",
+	"nonce",
+	"at_hash",
+	"c_hash",
+	"sid",
+	"jti"
+]);
+/**
+* The framework-neutral core `synqAuth()` runs on, over any cookie jar: for
+* a server that answers the same routes without Next. Most apps use
+* `synqAuth()` instead.
+*/
+function createSynqCore(config) {
+	/** Whether the missing end-user address was logged already: once is enough. */
+	let warnedAboutAddress = false;
+	/** The keys this app's (or site's, `config.site`) cookies are sealed with, derived once. */
+	let keys;
+	const keysFor = () => keys ??= sealingKeys(config.sessionSecret, config.previousSessionSecrets, config.site);
+	/** Every request to Synq: never cached, and given up after REQUEST_TIMEOUT_MS. */
+	const upstream = (input, init = {}) => {
+		const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+		return (config.fetch ?? fetch)(input, {
+			...init,
+			cache: "no-store",
+			signal: init.signal ? AbortSignal.any([init.signal, timeout]) : timeout
+		});
+	};
+	function client(storage, resource, transactions) {
+		return createSynqClient({
+			issuer: config.issuer,
+			clientId: config.clientId,
+			clientSecret: config.clientSecret,
+			redirectUri: config.redirectUri,
+			postLogoutRedirectUri: config.postLogoutRedirectUri,
+			scope: config.scope,
+			resource,
+			storage,
+			transactionStorage: transactions ?? memoryStorage(),
+			fetch: upstream,
+			refreshLeewaySeconds: config.refreshLeewaySeconds
+		});
+	}
+	async function load(jar) {
+		return loadSession(jar, await keysFor(), config.secure, config.sessionMaxAge, config.store);
+	}
+	async function commit(jar, handle) {
+		await handle.commit(jar, await keysFor(), config.secure, config.sessionMaxAge, config.store);
+	}
+	/** Who signed in (the ID token's `sub`), and in which session at the issuer (its `sid`, when Synq sent one). */
+	async function issuerSessionOf(handle) {
+		const raw = (await handle.read())[tokenKey(config.primary)];
+		if (!raw) return void 0;
+		const { claims } = JSON.parse(raw);
+		if (typeof claims?.sub !== "string") return void 0;
+		return {
+			sub: claims.sub,
+			sid: typeof claims.sid === "string" ? claims.sid : void 0
+		};
+	}
+	/**
+	* Why a sign-in again (`reauthenticate`), for `sub`, can't be kept, or
+	* `undefined` when it can: `not_signed_in` when `sub` isn't the one signed
+	* in here any more (signed out in another tab, say, or someone else signed
+	* in since), `other_account` when someone else signed in at the brand.
+	*/
+	async function reauthenticationRefused(jar, handle, sub) {
+		const previous = await load(jar);
+		const [before, after] = await Promise.all([previous ? issuerSessionOf(previous) : void 0, issuerSessionOf(handle)]);
+		if (before?.sub !== sub) return "not_signed_in";
+		if (after?.sub !== sub) return "other_account";
+	}
+	/**
+	* Ends a sign-in the callback won't keep: the browser's session at the
+	* brand that it made, from this server, then its grant. Signed in with
+	* `prompt=login`, it replaced the brand's session in this browser, and
+	* left alive it would sign whoever it was in to any later sign-in that
+	* asks for no fresh one, at this app or another of the brand's.
+	*/
+	async function discard(handle) {
+		const theirs = client(handle.storage(config.primary, config.primary), config.primary);
+		try {
+			await theirs.signOut({ stay: true });
+		} catch {
+			try {
+				await theirs.signOut();
+			} catch {}
+		}
+	}
+	/** The ID token the session's main token came with: who is signed in, as the issuer said. */
+	async function idTokenOf(handle) {
+		if (!handle) return void 0;
+		const raw = (await handle.read())[tokenKey(config.primary)];
+		if (!raw) return void 0;
+		const { idToken } = JSON.parse(raw);
+		return typeof idToken === "string" ? idToken : void 0;
+	}
+	/** The person the session's main token was issued with, while the session can still give a token. */
+	async function userOf(handle) {
+		if (!handle) return {
+			user: null,
+			expiresAt: null
+		};
+		const values = await handle.read();
+		const raw = values[tokenKey(config.primary)];
+		if (!raw) return {
+			user: null,
+			expiresAt: null
+		};
+		const stored = JSON.parse(raw);
+		const expiresAt = stored.expiresAt ?? null;
+		if (!values.refresh && expiresAt !== null && expiresAt <= now()) return {
+			user: null,
+			expiresAt: null
+		};
+		if (!stored.claims || typeof stored.claims.sub !== "string") return {
+			user: null,
+			expiresAt
+		};
+		const user = {};
+		for (const [name, value] of Object.entries(stored.claims)) if (!PROTOCOL_CLAIMS.has(name)) user[name] = value;
+		return {
+			user,
+			expiresAt
+		};
+	}
+	/** Who is signed in, the way in this browser last used, and the sign-in the page hasn't heard of. */
+	async function sessionInfo(jar) {
+		const { user, expiresAt } = await userOf(await load(jar));
+		return {
+			user,
+			expiresAt,
+			lastUsed: lastUsedOf(jar, config.secure),
+			event: await eventOf(jar, (await keysFor()).open, user?.sub, config.secure, now())
+		};
+	}
+	/** The app's sign-in methods (AERO-2690), from the issuer, kept a minute. */
+	const methods = methodsReader({
+		issuer: config.issuer,
+		clientId: config.clientId,
+		fetch: upstream
+	});
+	/**
+	* What the new session's ID token says of its sign-in, kept on this
+	* browser (AERO-2691): the way in, for "Last used" where the brand shows
+	* it, and the sign-in itself, for the page to hear of once (`event`).
+	* Nothing without the app's sign-in claims. Best effort: the sign-in
+	* stands whatever happens here, and waits at most METHODS_WAIT_MS for the
+	* issuer's list.
+	*
+	* A link, or the person signed in now confirming it's them, is no sign-in
+	* for the page to hear of (`event: false`): the person signed in is the
+	* same, and a panel open on its onboarding or its profile carries on there
+	* rather than greeting them again.
+	*/
+	async function keepSignIn(jar, handle, { event: keep = true } = {}) {
+		const raw = (await handle.read())[tokenKey(config.primary)];
+		const claims = raw ? JSON.parse(raw).claims : void 0;
+		const event = signInOf(claims);
+		if (!event || typeof claims?.sub !== "string") return;
+		if (keep) await keepEvent(jar, (await keysFor()).seal, claims.sub, event, config.secure);
+		try {
+			const list = await within(methods(), METHODS_WAIT_MS);
+			if (!list) return;
+			if (list.show_last_used) rememberLastUsed(jar, event, config.secure);
+			else forgetLastUsed(jar, config.secure);
+		} catch {}
+	}
+	async function getAccessToken(jar, options = {}) {
+		const resource = options.resource ?? config.primary;
+		if (resource !== config.primary && resource !== config.accountApi) throw new SynqError("invalid_options", `The session has no token for ${resource ?? "userinfo"}: name it in synqAuth()'s resource`);
+		const handle = await load(jar);
+		if (!handle) throw new SynqError("not_signed_in", "Nobody is signed in");
+		if (!config.store && jar.writable?.() === false) {
+			const raw = (await handle.read())[tokenKey(resource)];
+			const stored = raw ? JSON.parse(raw) : {};
+			if (stored.accessToken && (stored.expiresAt === void 0 || stored.expiresAt > now())) return stored.accessToken;
+			throw new SynqError("refresh_required", "The session's token ran out where its cookie can't be written (a server component): let synqProxy() refresh it before the page renders");
+		}
+		try {
+			const token = await client(handle.storage(resource, config.primary), resource).getAccessToken({ minValiditySeconds: options.minValiditySeconds });
+			await commit(jar, handle);
+			return token;
+		} catch (error) {
+			if (isSynqError(error, "invalid_grant") || isSynqError(error, "no_refresh_token")) await endSession(jar, handle, config.secure, config.store);
+			throw error;
+		}
+	}
+	/**
+	* A store for one sign-in's transaction: a sealed cookie named after its
+	* state, with where to go afterwards, or the popup it runs in (`popup`, the
+	* page's attempt id: popup.ts), for a sign-in again, who must sign in
+	* (`reauthenticate`, their `sub`), and whether it adds a way in to the
+	* person signed in (`link`) rather than signing someone in.
+	*/
+	async function transactions(jar, returnTo, popup, reauthenticate, link) {
+		const keys = await keysFor();
+		const options = {
+			secure: config.secure,
+			maxAge: TRANSACTION_SECONDS
+		};
+		const found = {};
+		return {
+			storage: {
+				async get(name) {
+					const cookie = cookieName(name, config.secure);
+					const opened = await unseal(keys.open, jar.get(cookie), cookie);
+					if (!opened) return void 0;
+					const { v, r, p, s, l } = JSON.parse(opened);
+					found.returnTo = r;
+					if (typeof p === "string" && POPUP_ATTEMPT.test(p)) found.popup = p;
+					if (typeof s === "string") found.reauthenticate = s;
+					if (l === true) found.link = true;
+					return v;
+				},
+				async set(name, value) {
+					await dropOldTransactions(jar, keys.open);
+					const cookie = cookieName(name, config.secure);
+					const sealed = JSON.stringify({
+						v: value,
+						r: returnTo,
+						t: Date.now(),
+						p: popup,
+						s: reauthenticate,
+						...link ? { l: true } : {}
+					});
+					jar.set(cookie, await seal(keys.seal, sealed, cookie), options);
+				},
+				remove(name) {
+					jar.delete(cookieName(name, config.secure), options);
+				}
+			},
+			found
+		};
+	}
+	/** Keeps a browser's sign-ins under way to MAX_TRANSACTIONS, the newest, before it starts another. */
+	async function dropOldTransactions(jar, keys) {
+		const prefix = cookieName(TRANSACTION_PREFIX, config.secure);
+		const started = [];
+		for (const name of [...jar.names()]) {
+			if (!name.startsWith(prefix)) continue;
+			const opened = await unseal(keys, jar.get(name), name);
+			let at;
+			try {
+				at = opened ? JSON.parse(opened).t ?? 0 : 0;
+			} catch {
+				at = 0;
+			}
+			started.push({
+				name,
+				at,
+				order: started.length
+			});
+		}
+		started.sort((a, b) => b.at - a.at || b.order - a.order);
+		for (const { name } of started.slice(4)) jar.delete(name, { secure: config.secure });
+	}
+	async function signIn(request, jar) {
+		if (isPrefetch(request)) return new Response(null, { status: 204 });
+		const params = new URL(request.url).searchParams;
+		const returnTo = safeReturnTo(params.get("returnTo"), config.appUrl);
+		const prompt = params.get("prompt") ?? void 0;
+		const maxAge = params.get("max_age");
+		const intent = params.get("intent") ?? void 0;
+		if (prompt && !PROMPTS.has(prompt)) return problem(400, "invalid_request", "prompt is login, none, consent, select_account or create");
+		if (maxAge !== null && !/^\d{1,9}$/.test(maxAge)) return problem(400, "invalid_request", "max_age is a number of seconds");
+		if (intent && !SIGN_IN_INTENTS.has(intent)) return problem(400, "invalid_request", "intent is add-passkey or verify-email (POST link adds a way to sign in)");
+		const plan = params.get("plan") ?? void 0;
+		const interval = params.get("interval") ?? void 0;
+		if (plan !== void 0 && !PLAN_CODE.test(plan)) return problem(400, "invalid_request", "plan is a plan code, such as pro");
+		if (interval !== void 0 && (plan === void 0 || interval !== "month" && interval !== "year")) return problem(400, "invalid_request", "interval is month or year, with a plan");
+		const onboarding = params.get("onboarding") ?? void 0;
+		if (onboarding !== void 0 && !ONBOARDING_VISIT.test(onboarding)) return problem(400, "invalid_request", "onboarding is an onboarding visit id");
+		const display = displayOf(params.get("display"), params.get("attempt"));
+		if (display instanceof Response) return display;
+		const again = params.get("reauthenticate");
+		let reauthenticate;
+		if (again !== null) {
+			if (again !== "true") return problem(400, "invalid_request", "reauthenticate is true, or left out");
+			if (prompt && prompt !== "login" || intent) return problem(400, "invalid_request", "reauthenticate is a fresh sign-in: it takes no other prompt, and no intent");
+			const signedIn = await load(jar);
+			reauthenticate = signedIn ? (await issuerSessionOf(signedIn))?.sub : void 0;
+			if (!reauthenticate) {
+				if (display) return popupPage({
+					attempt: display,
+					ok: false,
+					error: "not_signed_in"
+				});
+				return redirect(withError(returnTo, "not_signed_in"), 302);
+			}
+		}
+		const tx = await transactions(jar, returnTo, display, reauthenticate);
+		return redirect((await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
+			method: params.get("method") ?? void 0,
+			loginHint: params.get("login_hint") ?? void 0,
+			prompt: reauthenticate ? "login" : intentPrompt(intent, prompt),
+			maxAge: maxAge === null ? void 0 : Number(maxAge),
+			additionalResources: config.accountApi && config.accountApi !== config.primary ? [config.accountApi] : [],
+			params: {
+				...intent ? { synq_intent: intent } : {},
+				...plan ? { synq_plan: plan } : {},
+				...interval ? { synq_interval: interval } : {},
+				...onboarding ? { synq_onboarding: onboarding } : {}
+			}
+		})).href, 302);
+	}
+	async function callback(request, jar) {
+		const tx = await transactions(jar);
+		const handle = newSession(config.sessionMaxAge, config.store);
+		const back = () => safeReturnTo(tx.found.returnTo ?? null, config.appUrl);
+		const failed = (code) => tx.found.popup ? popupPage({
+			attempt: tx.found.popup,
+			ok: false,
+			error: code
+		}) : redirect(withError(back(), code), 303);
+		try {
+			await client(handle.storage(config.primary, config.primary), config.primary, tx.storage).handleCallback(request.url);
+		} catch (error) {
+			return failed(isSynqError(error) ? error.code : "server_error");
+		}
+		if (tx.found.reauthenticate !== void 0) {
+			const refused = await reauthenticationRefused(jar, handle, tx.found.reauthenticate);
+			if (refused) {
+				await discard(handle);
+				return failed(refused);
+			}
+		}
+		await startSession(jar, handle);
+		await keepSignIn(jar, handle, { event: tx.found.reauthenticate === void 0 && tx.found.link !== true });
+		if (tx.found.popup) return popupPage({
+			attempt: tx.found.popup,
+			ok: true
+		});
+		return redirect(back(), 303);
+	}
+	async function signOut(request, jar) {
+		const stay = await staysOnPage(request);
+		if (stay instanceof Response) return stay;
+		const handle = await load(jar);
+		let url = null;
+		if (handle) url = await client(handle.storage(config.primary, config.primary), config.primary).signOut(stay ? { stay: true } : {});
+		await endSession(jar, handle, config.secure, config.store);
+		forgetEvent(jar, config.secure);
+		if (stay) return json({ redirect: null });
+		const target = url?.href ?? config.postLogoutRedirectUri;
+		if ((request.headers.get("accept") ?? "").includes("application/json")) return json({ redirect: target });
+		return redirect(target, 303);
+	}
+	/**
+	* Whether a sign-out asks to stay on the page (AERO-2684): `{ stay: true }`
+	* as JSON. A form's post, or no body, goes to the brand's sign-out page.
+	*/
+	async function staysOnPage(request) {
+		if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return false;
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		try {
+			const body = await request.text();
+			if (body === "") return false;
+			const input = JSON.parse(body);
+			if (input === null || typeof input !== "object" || Array.isArray(input)) throw new TypeError();
+			if (input.stay !== void 0 && typeof input.stay !== "boolean") throw new TypeError();
+			return input.stay === true;
+		} catch {
+			return problem(400, "invalid_request", "Send { stay: true } as JSON, or no body");
+		}
+	}
+	/** The ways the app's sign-in offers, for its own panel (AERO-2690): the issuer's list, kept a minute. */
+	async function signInMethodsRoute() {
+		const list = await methods();
+		return Response.json(list, { headers: { "cache-control": "private, max-age=60" } });
+	}
+	/**
+	* Adding a way to sign in (AERO-1397): the account API makes a link request
+	* for the person with the session's token, and its ticket goes to Synq in
+	* a sign-in like any other, which asks them to sign in again first. A POST
+	* from the app's own pages, answered `{ redirect }` for the browser to
+	* follow, so another site can't start one.
+	*/
+	async function link(request, jar) {
+		if (!config.accountApi) return problem(404, "not_found", "The session holds no account API token: synqAuth()'s account is off");
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		let input;
+		try {
+			const body = await request.text();
+			if (new TextEncoder().encode(body).length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+			input = JSON.parse(body);
+		} catch {
+			return problem(400, "invalid_request", "Send { method, returnTo } as JSON");
+		}
+		if (typeof input?.method !== "string" || !METHOD.test(input.method)) return problem(400, "invalid_request", "method names the way to sign in to add");
+		const display = displayOf(textOrNull(input.display), textOrNull(input.attempt));
+		if (display instanceof Response) return display;
+		const returnTo = safeReturnTo(typeof input.returnTo === "string" ? input.returnTo : null, config.appUrl);
+		let token;
+		try {
+			token = await getAccessToken(jar, { resource: config.accountApi });
+		} catch (error) {
+			if (isSynqError(error) && [
+				"not_signed_in",
+				"invalid_grant",
+				"no_refresh_token"
+			].includes(error.code)) return problem(401, "not_signed_in", "Nobody is signed in");
+			throw error;
+		}
+		if (input.method === "passkey") {
+			const methods = await upstream(`${config.accountApi}/v1/link-methods?limit=200`, { headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json"
+			} });
+			if (!methods.ok) return new Response(methods.body, {
+				status: methods.status,
+				headers: { "content-type": methods.headers.get("content-type") ?? "application/problem+json" }
+			});
+			if (!(await methods.json()).data?.some((one) => one.method === "passkey")) return problem(409, "sign_in_method_unavailable", "This brand doesn’t offer passkeys");
+			const tx = await transactions(jar, returnTo, display, void 0, true);
+			return json({ redirect: (await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
+				prompt: "login",
+				additionalResources: config.accountApi !== config.primary ? [config.accountApi] : [],
+				params: { synq_intent: "add-passkey" }
+			})).href });
+		}
+		const answer = await upstream(`${config.accountApi}/v1/link-requests`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json",
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({ method: input.method })
+		});
+		if (!answer.ok) return new Response(answer.body, {
+			status: answer.status,
+			headers: { "content-type": answer.headers.get("content-type") ?? "application/problem+json" }
+		});
+		const ticket = (await answer.json()).authorization_params?.synq_link;
+		if (typeof ticket !== "string") return problem(502, "invalid_response", "Synq answered without a link ticket");
+		const tx = await transactions(jar, returnTo, display, void 0, true);
+		return json({ redirect: (await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
+			prompt: "login",
+			additionalResources: config.accountApi !== config.primary ? [config.accountApi] : [],
+			params: {
+				synq_intent: "link",
+				synq_link: ticket
+			}
+		})).href });
+	}
+	/**
+	* Signing in with a wallet from the app's own page (AERO-1423, over the
+	* issuer's headless wallet sign-in, AERO-1410): `{ siws, returnTo }`, the
+	* `synq_siws` @synqauth/solana's `encodeSiws` makes of what the wallet
+	* signed. It goes to Synq in a pushed authorization request with
+	* `prompt=login`, sent from this server with the app's credentials, so the
+	* signature never lands in a URL; answered `{ redirect }` for the browser
+	* to follow. A POST from the app's own pages.
+	*/
+	async function walletSignIn(request, jar) {
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		let input;
+		try {
+			const body = await request.text();
+			if (new TextEncoder().encode(body).length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+			input = JSON.parse(body);
+		} catch {
+			return problem(400, "invalid_request", "Send { siws, returnTo } as JSON");
+		}
+		if (typeof input?.siws !== "string" || !SIWS.test(input.siws)) return problem(400, "invalid_request", "siws is what the wallet signed, as encodeSiws makes it");
+		const tx = await transactions(jar, safeReturnTo(typeof input.returnTo === "string" ? input.returnTo : null, config.appUrl));
+		return json({ redirect: (await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
+			prompt: "login",
+			pushed: true,
+			additionalResources: config.accountApi && config.accountApi !== config.primary ? [config.accountApi] : [],
+			params: { synq_siws: input.siws }
+		})).href });
+	}
+	/**
+	* One step of a sign-in on the app's own screens (AERO-1411): the page
+	* posts what the person typed, `{ step, … }`, and this server takes it to
+	* Synq's Authorization Challenge Endpoint as the app, with where the
+	* person is (`clientAddress`). The flow (its PKCE verifier and Synq's auth
+	* session) stays sealed in a cookie; the page hears only what to show
+	* next, never a token, a code or the auth session. A sign-in that ends
+	* starts the session as the callback does.
+	*/
+	async function signInFlow(request, jar) {
+		if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return problem(415, "unsupported_media_type", "Send the step as JSON");
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > FLOW_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		let input;
+		try {
+			const body = await request.text();
+			if (new TextEncoder().encode(body).length > FLOW_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+			input = JSON.parse(body);
+			if (!input || typeof input !== "object") throw new TypeError("not an object");
+		} catch {
+			return problem(400, "invalid_request", "Send { step, … } as JSON");
+		}
+		const text = (name, max = 512) => typeof input[name] === "string" ? input[name].slice(0, max) : "";
+		const step = text("step", 32);
+		const returnTo = safeReturnTo(text("returnTo", 2048) || null, config.appUrl);
+		const tx = await transactions(jar, returnTo);
+		const saved = await tx.storage.get(FLOW_KEY);
+		if (step === "restart") {
+			await tx.storage.remove(FLOW_KEY);
+			return json({ status: "restarted" });
+		}
+		const endUserIp = config.clientAddress(request);
+		if (!endUserIp && !warnedAboutAddress) {
+			warnedAboutAddress = true;
+			console.warn("@synqauth/nextjs: own-UI sign-in can't tell where people sign in from (no x-real-ip): give synqAuth() a clientAddress, or per-address protection is off for this app");
+		}
+		const reauthenticate = input.reauthenticate === true;
+		if (reauthenticate && step !== "wallet") return problem(400, "invalid_request", "reauthenticate goes with step wallet");
+		const signedIn = reauthenticate ? await idTokenOf(await load(jar)) : void 0;
+		if (reauthenticate && !signedIn) return json({
+			status: "other-account",
+			message: "Nobody is signed in to confirm."
+		});
+		const handle = newSession(config.sessionMaxAge, config.store);
+		const synq = client(handle.storage(config.primary, config.primary), config.primary);
+		const flow = saved && !reauthenticate ? synq.resumeSignIn(saved, { endUserIp }) : synq.startSignIn({
+			endUserIp,
+			additionalResources: config.accountApi && config.accountApi !== config.primary ? [config.accountApi] : []
+		});
+		const email = text("email", 254);
+		let result;
+		try {
+			switch (step) {
+				case "password":
+					result = text("screen") === "sign-up" ? await flow.password.signUp({
+						email,
+						password: text("password", 1024)
+					}) : await flow.password.signIn({
+						email,
+						password: text("password", 1024)
+					});
+					break;
+				case "email":
+					result = await flow.email.send(email);
+					break;
+				case "code":
+					result = flow.step === "verify-email" ? await flow.verifyEmail.verify(text("code", 32)) : await flow.email.verify(text("code", 32));
+					break;
+				case "resend":
+					result = flow.step === "verify-email" ? await flow.verifyEmail.resend() : await flow.email.resend();
+					break;
+				case "skip":
+					result = await flow.verifyEmail.skip();
+					break;
+				case "passkey-options":
+					result = await flow.passkey.options();
+					break;
+				case "passkey": {
+					const credential = input.credential;
+					if (!credential || typeof credential !== "object") return problem(400, "invalid_request", "credential is the passkey’s assertion");
+					result = await flow.passkey.signIn(credential, { related: input.related === true });
+					break;
+				}
+				case "wallet": {
+					const siws = input.siws;
+					if (typeof siws !== "string" || !SIWS.test(siws)) return problem(400, "invalid_request", "siws is what the wallet signed, as encodeSiws makes it");
+					result = await flow.wallet.signIn(siws, signedIn ? { reauthenticate: signedIn } : {});
+					break;
+				}
+				default: return problem(400, "invalid_request", "step is password, email, code, resend, skip, passkey-options, passkey, wallet or restart");
+			}
+		} catch (error) {
+			if (isSynqError(error, "invalid_session")) {
+				await tx.storage.remove(FLOW_KEY);
+				return json({
+					status: "expired",
+					message: error.message
+				});
+			}
+			if (isSynqError(error, "too_many_requests")) return json({
+				status: "retry",
+				step: flow.step,
+				problem: "limited",
+				message: error.message,
+				...error.retryAfter === void 0 ? {} : { retryAfter: error.retryAfter }
+			});
+			throw error;
+		}
+		if (result.status === "signed-in") {
+			await tx.storage.remove(FLOW_KEY);
+			if (reauthenticate) {
+				const previous = await load(jar);
+				const [before, after] = await Promise.all([previous ? issuerSessionOf(previous) : void 0, issuerSessionOf(handle)]);
+				if (!before || before.sub !== after?.sub) {
+					try {
+						await client(handle.storage(config.primary, config.primary), config.primary).signOut();
+					} catch {}
+					return json({
+						status: "other-account",
+						message: before ? "That wallet signs in to another account. Use a wallet of the account signed in here." : "Nobody is signed in to confirm."
+					});
+				}
+			}
+			await startSession(jar, handle);
+			await keepSignIn(jar, handle, { event: !reauthenticate });
+			return json({
+				status: "signed-in",
+				returnTo: tx.found.returnTo ?? returnTo
+			});
+		}
+		if (flow.step === "done") await tx.storage.remove(FLOW_KEY);
+		else await tx.storage.set(FLOW_KEY, JSON.stringify(flow));
+		switch (result.status) {
+			case "code-sent": return json({
+				status: result.status,
+				step: flow.step,
+				email: result.email,
+				expiresAt: result.expiresAt.toISOString()
+			});
+			case "verify-email": return json({
+				status: result.status,
+				step: flow.step,
+				email: result.email,
+				canSkip: result.canSkip
+			});
+			case "passkey": return json({
+				status: result.status,
+				step: flow.step,
+				passkey: {
+					options: result.options,
+					related: result.related
+				},
+				...result.problem ? {
+					problem: result.problem,
+					message: result.message
+				} : {}
+			});
+			case "retry": return json({
+				status: result.status,
+				step: flow.step,
+				problem: result.problem,
+				message: result.message,
+				...result.retryAfter === void 0 ? {} : { retryAfter: result.retryAfter }
+			});
+			case "hosted": return json({
+				status: result.status,
+				hosted: {
+					reason: result.reason,
+					...result.method ? { method: result.method } : {},
+					...result.loginHint ? { loginHint: result.loginHint } : {}
+				}
+			});
+			case "refused":
+				if (reauthenticate && result.reason === "other_account") return json({
+					status: "other-account",
+					message: "That wallet signs in to another account, or to none. Use a wallet of the account signed in here."
+				});
+				return json({
+					status: result.status,
+					reason: result.reason,
+					message: result.message
+				});
+		}
+	}
+	/**
+	* Starts the session `handle` holds the new sign-in's tokens of. A
+	* sign-in replaces whatever session the browser had, and its refresh
+	* token is revoked: an offline grant outlives the brand's session. But
+	* the same person signing in again within their session at the issuer,
+	* as adding a passkey or a way in asks, gets the grant the replaced
+	* session had, and Synq ends a grant with any refresh token of it
+	* revoked: that one is dropped instead. Same person: the ID tokens'
+	* `sub`. Same issuer session: their `sid`, which Synq includes for every
+	* app (AERO-1624) but one whose tenant turned it off; without it, the
+	* same `sub` is taken for the same session (a sign-in after it lapsed
+	* leaves the old grant to expire).
+	*/
+	async function startSession(jar, handle) {
+		const previous = await load(jar);
+		if (previous) {
+			const [before, after] = await Promise.all([issuerSessionOf(previous), issuerSessionOf(handle)]);
+			if (!(before !== void 0 && after !== void 0 && before.sub === after.sub && (before.sid === void 0 || after.sid === void 0 || before.sid === after.sid))) try {
+				await client(previous.storage(config.primary, config.primary), config.primary).signOut();
+			} catch {}
+			await endSession(jar, previous, config.secure, config.store);
+		}
+		await commit(jar, handle);
+	}
+	async function account(request, jar, path) {
+		if (!config.accountApi) return problem(404, "not_found", "The session holds no account API token: synqAuth()'s account is off");
+		if (!/^v1(\/[A-Za-z0-9._~-]+)+$/.test(path) || path.split("/").some((part) => part === "." || part === "..")) return problem(404, "not_found", "No such account API route");
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > ACCOUNT_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		let token;
+		try {
+			token = await getAccessToken(jar, { resource: config.accountApi });
+		} catch (error) {
+			if (isSynqError(error) && [
+				"not_signed_in",
+				"invalid_grant",
+				"no_refresh_token"
+			].includes(error.code)) return problem(401, "not_signed_in", "Nobody is signed in");
+			throw error;
+		}
+		const headers = new Headers({
+			authorization: `Bearer ${token}`,
+			accept: "application/json"
+		});
+		for (const name of ["content-type", "idempotency-key"]) {
+			const value = request.headers.get(name);
+			if (value) headers.set(name, value);
+		}
+		let body;
+		if (request.method !== "GET" && request.method !== "HEAD") {
+			body = await request.text();
+			if (new TextEncoder().encode(body).length > ACCOUNT_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		}
+		const search = new URL(request.url).search;
+		const answer = await upstream(`${config.accountApi}/${path}${search}`, {
+			method: request.method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+		const out = new Headers({ "cache-control": "no-store" });
+		const type = answer.headers.get("content-type");
+		if (type) out.set("content-type", type);
+		return new Response(answer.status === 204 ? null : await answer.text(), {
+			status: answer.status,
+			headers: out
+		});
+	}
+	/**
+	* The person's picture (AERO-2700): the browser posts the picture's own
+	* bytes here, and this server runs the account API's upload for them,
+	* asking for an upload, PUTting the bytes to Synq's storage, and choosing
+	* it, so the storage needs no CORS for the app, and no bytes pass through
+	* Synq's API. Or it posts `{ "identity": … }`, a linked account whose
+	* picture to use: a POST, which every app's route file already serves. A
+	* body that says it is too large, or not a picture, or won't say how long
+	* it is, is refused before it is read.
+	*/
+	async function picture(request, jar) {
+		if (!config.accountApi) return problem(404, "not_found", "The session holds no account API token: synqAuth()'s account is off");
+		const declared = request.headers.get("content-length");
+		if (request.headers.has("transfer-encoding") || declared === null) return problem(411, "length_required", "Send the picture with a Content-Length");
+		const length = Number(declared);
+		if (!Number.isSafeInteger(length) || length < 1) return problem(411, "length_required", "Send the picture with a Content-Length");
+		if (length > PICTURE_BODY_LIMIT) return problem(413, "payload_too_large", "A picture is at most 5 MB.");
+		const type = request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() ?? "";
+		const linked = type === "application/json";
+		if (linked && length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		if (!linked && !PICTURE_TYPES.has(type)) return problem(415, "unsupported_media_type", "Send a PNG, JPEG, WebP or GIF picture");
+		let token;
+		try {
+			token = await getAccessToken(jar, { resource: config.accountApi });
+		} catch (error) {
+			if (isSynqError(error) && [
+				"not_signed_in",
+				"invalid_grant",
+				"no_refresh_token"
+			].includes(error.code)) return problem(401, "not_signed_in", "Nobody is signed in");
+			throw error;
+		}
+		const bytes = new Uint8Array(await request.arrayBuffer());
+		if (bytes.byteLength !== length) return problem(400, "validation_failed", "The picture isn’t the length it said");
+		const key = request.headers.get("idempotency-key");
+		const call = (method, path, body, step) => upstream(`${config.accountApi}/${path}`, {
+			method,
+			headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json",
+				"content-type": "application/json",
+				...key ? { "idempotency-key": `${key}:${step}` } : {}
+			},
+			body: JSON.stringify(body),
+			redirect: "manual"
+		});
+		const relay = async (answer) => new Response(answer.status === 204 ? null : await answer.text(), {
+			status: answer.status,
+			headers: {
+				"cache-control": "no-store",
+				"content-type": answer.headers.get("content-type") ?? "application/json"
+			}
+		});
+		if (linked) {
+			let identity;
+			try {
+				identity = JSON.parse(new TextDecoder().decode(bytes)).identity;
+			} catch {
+				identity = void 0;
+			}
+			if (typeof identity !== "string" || !/^idn_[0-9a-z]{1,64}$/.test(identity)) return problem(400, "validation_failed", "Name the linked account: { \"identity\": \"idn_…\" }");
+			return relay(await call("PUT", "v1/profile/picture", { identity }, "choose"));
+		}
+		const started = await call("POST", "v1/profile/picture/uploads", {
+			content_type: type,
+			content_length: length
+		}, "upload");
+		if (started.status !== 201) return relay(started);
+		const upload = await started.json();
+		const stored = await upstream(upload.url, {
+			method: "PUT",
+			headers: upload.headers,
+			body: bytes,
+			redirect: "manual"
+		});
+		await stored.body?.cancel();
+		if (!stored.ok) return problem(502, "upload_failed", `Synq's storage refused the picture (${stored.status})`);
+		return relay(await call("PUT", "v1/profile/picture", { file_id: upload.file_id }, "choose"));
+	}
+	async function plugin(request, jar, id, rest) {
+		const route = config.plugins.find((candidate) => candidate.id === id)?.routes?.[`${request.method} /${rest}`];
+		if (!route) return void 0;
+		return route({
+			user: async () => (await userOf(await load(jar))).user,
+			getAccessToken: (options) => getAccessToken(jar, options),
+			issuer: config.issuer,
+			clientId: config.clientId,
+			basePath: config.basePath
+		}, request);
+	}
+	async function handle(request) {
+		const url = new URL(request.url);
+		const prefix = `${config.basePath}/`;
+		if (!url.pathname.startsWith(prefix)) return problem(404, "not_found", "Not under the route mount");
+		const rest = url.pathname.slice(prefix.length);
+		const [first = "", ...tail] = rest.split("/");
+		const jar = requestJar(request);
+		if (!["GET", "HEAD"].includes(request.method) && !sameOrigin(request, config.appUrl)) return problem(403, "forbidden", "A change must come from the app's own pages");
+		let response;
+		try {
+			if (rest === "sign-in" && request.method === "GET") response = await signIn(request, jar);
+			else if (rest === "sign-in" && request.method === "POST") response = await walletSignIn(request, jar);
+			else if (rest === "sign-in/flow" && request.method === "POST") response = await signInFlow(request, jar);
+			else if (rest === "sign-in/wallet" && request.method === "GET") response = json({
+				issuer: config.issuer,
+				clientId: config.clientId
+			});
+			else if (rest === "callback" && request.method === "GET") response = await callback(request, jar);
+			else if (rest === "sign-out" && request.method === "POST") response = await signOut(request, jar);
+			else if (rest === "link" && request.method === "POST") response = await link(request, jar);
+			else if (rest === "sign-in/methods" && request.method === "GET") response = await signInMethodsRoute();
+			else if (rest === "session" && request.method === "GET") response = json(await sessionInfo(jar));
+			else if (rest === "session/event" && request.method === "DELETE") {
+				forgetEvent(jar, config.secure);
+				response = new Response(null, { status: 204 });
+			} else if (rest === "account/picture" && request.method === "POST") response = await picture(request, jar);
+			else if (first === "account") response = await account(request, jar, tail.join("/"));
+			else if (!RESERVED.has(first)) response = await plugin(request, jar, first, tail.join("/"));
+		} catch (error) {
+			if (!isSynqError(error)) throw error;
+			response = problem(error.status && error.status >= 400 ? 502 : 500, error.code, error.message);
+		}
+		response ??= problem(404, "not_found", "No such route under the mount");
+		const headers = new Headers(response.headers);
+		for (const cookie of jar.headers()) headers.append("set-cookie", cookie);
+		if (!headers.has("cache-control")) headers.set("cache-control", "no-store");
+		headers.set("x-content-type-options", "nosniff");
+		return new Response(response.body, {
+			status: response.status,
+			headers
+		});
+	}
+	async function refreshIfDue(jar) {
+		const handle = await load(jar);
+		const { user, expiresAt } = await userOf(handle);
+		if (!handle || !user) return false;
+		if (config.store || expiresAt === null || expiresAt - config.refreshLeewaySeconds > now()) return true;
+		try {
+			await getAccessToken(jar);
+			return true;
+		} catch (error) {
+			if (isSynqError(error, "invalid_grant") || isSynqError(error, "no_refresh_token")) return false;
+			return expiresAt > now();
+		}
+	}
+	return {
+		handle,
+		user: async (jar) => (await userOf(await load(jar))).user,
+		session: sessionInfo,
+		getAccessToken,
+		refreshIfDue,
+		config
+	};
+}
+/** A body field as text: null when it is left out, and anything but text kept as a mark that it was there. */
+function textOrNull(value) {
+	if (value === void 0) return null;
+	return typeof value === "string" ? value : "?";
+}
+/**
+* The popup a sign-in or link runs in (AERO-2692): the page's attempt id for
+* `display=popup`, undefined for `redirect` or none, or the problem for
+* anything else.
+*/
+function displayOf(display, attempt) {
+	if (display === null || display === "redirect") return attempt === null ? void 0 : problem(400, "invalid_request", "attempt goes with display=popup");
+	if (display !== "popup") return problem(400, "invalid_request", "display is popup or redirect");
+	if (attempt === null || !POPUP_ATTEMPT.test(attempt)) return problem(400, "invalid_request", "attempt is the popup's id: 8 to 64 of A-Z a-z 0-9 _ -");
+	return attempt;
+}
+/**
+* Whether a request is a prefetch, not a person going there: Next.js's
+* router (`Next-Router-Prefetch`) and browsers' speculative loads (`Purpose`,
+* `Sec-Purpose`: prefetch or prerender).
+*/
+function isPrefetch(request) {
+	const h = request.headers;
+	if (h.get("next-router-prefetch") !== null) return true;
+	const purpose = `${h.get("purpose") ?? ""} ${h.get("sec-purpose") ?? ""}`.toLowerCase();
+	return /\b(prefetch|prerender)\b/.test(purpose);
+}
+/**
+* Where to send the browser back to on the app, as an absolute URL, never
+* another site: the app's root for anything else. It checks where the value
+* resolves to, not how it's spelled, since dot segments and encodings
+* (`/.//evil.example`, `/%2e//evil.example`) collapse into another host.
+*/
+function safeReturnTo(value, appUrl) {
+	const home = new URL("/", appUrl).href;
+	if (!value || value.includes("\\")) return home;
+	try {
+		const url = new URL(value, appUrl);
+		return url.origin === appUrl.origin && !url.pathname.startsWith("//") ? url.href : home;
+	} catch {
+		return home;
+	}
+}
+/** A request from the app's own pages: its `Origin`, or else the browser's `Sec-Fetch-Site`, says so. */
+function sameOrigin(request, appUrl) {
+	const origin = request.headers.get("origin");
+	if (origin) return origin === appUrl.origin;
+	return request.headers.get("sec-fetch-site") === "same-origin";
+}
+function withError(target, code) {
+	const url = new URL(target);
+	url.searchParams.set("synq_error", code);
+	return url.href;
+}
+function redirect(location, status) {
+	return new Response(null, {
+		status,
+		headers: { location }
+	});
+}
+function json(body, status = 200) {
+	return Response.json(body, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+function problem(status, code, detail) {
+	return Response.json({
+		type: "about:blank",
+		status,
+		code,
+		detail
+	}, {
+		status,
+		headers: {
+			"content-type": "application/problem+json",
+			"cache-control": "no-store"
+		}
+	});
+}
+function now() {
+	return Math.floor(Date.now() / 1e3);
+}
+//#endregion
+//#region src/sign-in-error.ts
+/** The query parameter the route mount adds to `returnTo` when a sign-in fails. */
+const SIGN_IN_ERROR_PARAM = "synq_error";
+/** An OAuth or SDK error code, as the route mount puts it there. */
+const CODE = /^[a-z0-9_]{1,64}$/;
+const MESSAGES = {
+	access_denied: "The sign-in was cancelled, or this account can’t use this app.",
+	login_required: "You need to sign in to continue.",
+	interaction_required: "You need to sign in to continue.",
+	consent_required: "You need to allow this app to use your account to continue.",
+	account_selection_required: "Choose an account to continue.",
+	temporarily_unavailable: "Signing in isn’t available just now. Try again in a moment.",
+	unknown_state: "This sign-in expired, or it finished in another tab. Try again.",
+	other_account: "That signed in to another account. Confirm with a way in of the account signed in here.",
+	not_signed_in: "You were signed out. Sign in again."
+};
+/** What a sign-in error code means, in plain words. */
+function signInErrorMessage(code) {
+	return MESSAGES[code] ?? "Something went wrong signing in. Try again.";
+}
+/** A path and query on the app, without `synq_error`: where the ways on come back to. */
+function withoutSignInError(pathAndSearch) {
+	const url = new URL(pathAndSearch, "http://app.invalid");
+	url.searchParams.delete(SIGN_IN_ERROR_PARAM);
+	return `${url.pathname}${url.search}`;
+}
+/**
+* The sign-in error `code` names, coming back to `returnTo` (a path on the
+* app), or null when there is none or it isn't a code.
+*/
+function signInErrorOf(code, basePath, returnTo) {
+	if (!code || !CODE.test(code)) return null;
+	const back = withoutSignInError(returnTo.startsWith("/") && !returnTo.startsWith("//") ? returnTo : "/");
+	const signIn = (prompt) => {
+		const params = new URLSearchParams({ returnTo: back });
+		if (prompt) params.set("prompt", prompt);
+		return `${basePath}/sign-in?${params.toString()}`;
+	};
+	return {
+		code,
+		message: signInErrorMessage(code),
+		retryPath: signIn(),
+		anotherAccountPath: signIn("select_account")
+	};
+}
+function escape(text) {
+	return text.replace(/[&<>"']/g, (c) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[c]);
+}
+/**
+* The proxy's own page for a sign-in error, for an app that has none of its
+* own (`synqProxy`'s `signInError`): plain HTML, no script and no style, so
+* any Content-Security-Policy the app sends allows it.
+*/
+function signInErrorPage(error) {
+	const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Sign-in didn’t finish</title>
+</head>
+<body>
+<main>
+<h1>Sign-in didn’t finish</h1>
+<p>${escape(error.message)}</p>
+<p><a href="${escape(error.retryPath)}">Try again</a></p>
+<p><a href="${escape(error.anotherAccountPath)}">Use another account</a></p>
+</main>
+</body>
+</html>
+`;
+	return new Response(html, {
+		status: 200,
+		headers: {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store",
+			"x-content-type-options": "nosniff"
+		}
+	});
+}
+//#endregion
+//#region src/sites.ts
+/** Sites kept at once; past it, the one used longest ago is made again when next asked for. */
+const MAX_SITES = 500;
+/** One DNS label, as a host name has them. */
+const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** A host as a browser names it in `Host`: a DNS name or an IPv6 literal, and a port. */
+const HOST = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*|\[[0-9a-f:.]+\])(?::\d{1,5})?$/;
+/** A host as it's compared: lowercase, with no dot at the end of its name. */
+function normalHost(value) {
+	return value.trim().toLowerCase().replace(/\.(:\d+)?$/, "$1");
+}
+/**
+* The host the browser asked for: `X-Forwarded-Host`'s first, which a proxy
+* in front of the app sets (and Next's own server does), else `Host`.
+* Undefined when there is none, or it isn't a host.
+*/
+function requestHost(headers) {
+	const forwarded = headers.get("x-forwarded-host")?.split(",", 1)[0]?.trim();
+	const host = normalHost(forwarded || headers.get("host") || "");
+	return HOST.test(host) ? host : void 0;
+}
+/**
+* `hosts` as a test: an entry is a host (`club.example.com`,
+* `localhost:3000`), or `*.` and a domain, for any one label under it, its
+* port named or none. Throws `invalid_options` for an entry that is neither.
+*/
+function allowList(hosts) {
+	if (!Array.isArray(hosts) || hosts.length === 0) throw new SynqError("invalid_options", "With resolve, hosts lists every host the app serves (club.example.com, *.example.com): any other is refused");
+	const exact = /* @__PURE__ */ new Set();
+	const under = [];
+	for (const entry of hosts) {
+		const host = typeof entry === "string" ? normalHost(entry) : "";
+		const wildcard = host.startsWith("*.");
+		const name = wildcard ? host.slice(2) : host;
+		if (!HOST.test(name) || name.startsWith("[") || wildcard && !name.includes(".")) throw new SynqError("invalid_options", `hosts: ${JSON.stringify(entry)} isn't a host, nor *. and a domain`);
+		if (wildcard) under.push(`.${name}`);
+		else exact.add(name);
+	}
+	return (host) => exact.has(host) || under.some((suffix) => host.endsWith(suffix) && LABEL.test(host.slice(0, -suffix.length)));
+}
+/** Whether `host` (its name, without the port) is this machine. */
+function isLoopback(host) {
+	const name = host.startsWith("[") ? host.slice(0, host.indexOf("]") + 1) : host.split(":", 1)[0];
+	return name === "localhost" || name.endsWith(".localhost") || name === "127.0.0.1" || name === "[::1]";
+}
+/**
+* The site's origin: `https://<host>`, or, for a host on this machine, the
+* scheme the request came over (`X-Forwarded-Proto`, which Next sets, else
+* the request's own URL).
+*/
+function originOf(host, headers, url) {
+	let protocol = "https:";
+	if (isLoopback(host)) {
+		const forwarded = headers.get("x-forwarded-proto")?.split(",", 1)[0]?.trim().toLowerCase();
+		if (forwarded === "http" || forwarded === "https") protocol = `${forwarded}:`;
+		else if (url) protocol = new URL(url).protocol === "https:" ? "https:" : "http:";
+		else protocol = "http:";
+	}
+	return new URL(`${protocol}//${host}`).origin;
+}
+function siteCores(options) {
+	const { resolve } = options;
+	if (!resolve) throw new TypeError("siteCores needs resolve");
+	let allowed;
+	const cores = /* @__PURE__ */ new Map();
+	return { async coreFor(headers, url) {
+		allowed ??= allowList(options.hosts);
+		const host = requestHost(headers);
+		if (!host || !allowed(host)) return null;
+		const request = {
+			host,
+			origin: originOf(host, headers, url),
+			headers
+		};
+		const site = await resolve(request);
+		if (site === null || site === void 0) return null;
+		const key = JSON.stringify([
+			request.origin,
+			site.issuer,
+			site.clientId,
+			site.appUrl ?? null,
+			site.storePrefix ?? null,
+			site.account ?? null,
+			site.postLogoutRedirectUri ?? null
+		]);
+		const kept = cores.get(key);
+		cores.delete(key);
+		if (kept && kept.secret === site.clientSecret) {
+			cores.set(key, kept);
+			return kept.core;
+		}
+		const core = createSynqCore(siteConfig(options, site, request));
+		cores.set(key, {
+			secret: site.clientSecret,
+			core
+		});
+		if (cores.size > MAX_SITES) cores.delete(cores.keys().next().value);
+		return core;
+	} };
+}
+const UNKNOWN_HOST = "This app doesn't serve the host this request was sent to: add it to synqAuth()'s hosts if it should";
+/** Why a request to a host the app doesn't serve gets nothing, as the error server code throws. */
+function unknownHostError() {
+	return new SynqError("unknown_host", UNKNOWN_HOST, { status: 421 });
+}
+/**
+* The answer to a request for a host the app doesn't serve: 421 Misdirected
+* Request, as a problem, naming no host and no configuration.
+*/
+function unknownHostResponse() {
+	return Response.json({
+		type: "about:blank",
+		status: 421,
+		code: "unknown_host",
+		detail: UNKNOWN_HOST
+	}, {
+		status: 421,
+		headers: {
+			"content-type": "application/problem+json",
+			"cache-control": "no-store",
+			"x-content-type-options": "nosniff"
+		}
+	});
+}
+//#endregion
+export { signInErrorMessage as a, withoutSignInError as c, memorySessionStore as d, defineSynqPlugin as f, resolveConfig as h, SIGN_IN_ERROR_PARAM as i, createSynqCore as l, normalizePath as m, unknownHostError as n, signInErrorOf as o, requestJar as p, unknownHostResponse as r, signInErrorPage as s, siteCores as t, keyValueSessionStore as u };