@synqauth/nextjs 0.2.0 → 0.4.0

package/dist/{sign-in-error-kd56GHt_.js → sites-BQ8NPcXw.js}

@@ -1,32 +1,38 @@
-import { SynqError, createSynqClient, isSynqError, memoryStorage } from "@synqauth/js";
+import { SynqError, createSynqClient, isSynqError, memoryStorage, readMethodList, signInEndingOf, signInMethods } from "@synqauth/js";
 //#region src/crypto.ts
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
 const VERSION = "v1";
 const keys = /* @__PURE__ */ new Map();
-/** The sealing key for a session secret, derived once per secret. */
-function sealingKey(secret) {
+/**
+* The sealing key for a session secret, derived once per secret; with
+* `site`, the key for that site alone (`siteBinding`), which the site's core
+* keeps rather than this module.
+*/
+function sealingKey(secret, site = "") {
 	if (encoder.encode(secret).length < 32) throw new TypeError(`The session secret must be at least 32 bytes`);
+	if (site) return deriveKey(secret, `${VERSION}\nsite ${site}`);
 	let key = keys.get(secret);
 	if (!key) {
-		key = (async () => {
-			const base = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
-			return crypto.subtle.deriveKey({
-				name: "HKDF",
-				hash: "SHA-256",
-				salt: encoder.encode("@synqauth/nextjs session"),
-				info: encoder.encode(VERSION)
-			}, base, {
-				name: "AES-GCM",
-				length: 256
-			}, false, ["encrypt", "decrypt"]);
-		})();
+		key = deriveKey(secret, VERSION);
 		keys.set(secret, key);
 	}
 	return key;
 }
-async function sealingKeys(current, previous = []) {
-	const open = await Promise.all([current, ...previous].map((secret) => sealingKey(secret)));
+async function deriveKey(secret, info) {
+	const base = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: encoder.encode("@synqauth/nextjs session"),
+		info: encoder.encode(info)
+	}, base, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+async function sealingKeys(current, previous = [], site = "") {
+	const open = await Promise.all([current, ...previous].map((secret) => sealingKey(secret, site)));
 	return {
 		seal: open[0],
 		open
@@ -86,18 +92,82 @@ const MULTI_PROCESS = [
 ];
 /** The configuration from `options` and the environment; throws `invalid_options` for anything missing or unsafe. */
 function resolveConfig(options = {}, env = processEnv()) {
-	const issuer = required(options.issuer ?? env.SYNQ_ISSUER, "SYNQ_ISSUER").replace(/\/+$/, "");
-	checkUrl(issuer, "SYNQ_ISSUER");
-	const clientId = required(options.clientId ?? env.SYNQ_CLIENT_ID, "SYNQ_CLIENT_ID");
-	const clientSecret = required(options.clientSecret ?? env.SYNQ_CLIENT_SECRET, "SYNQ_CLIENT_SECRET");
-	const appUrl = checkUrl(required(options.appUrl ?? env.SYNQ_APP_URL, "SYNQ_APP_URL"), "SYNQ_APP_URL");
+	if (options.resolve) throw new SynqError("invalid_options", "This configuration has resolve, so each request picks its own: synqAuth() and synqProxy() read it per request");
+	if (options.hosts !== void 0) throw new SynqError("invalid_options", "hosts goes with resolve: the hosts it answers for");
+	return build(options, {
+		issuer: options.issuer ?? env.SYNQ_ISSUER,
+		clientId: options.clientId ?? env.SYNQ_CLIENT_ID,
+		clientSecret: options.clientSecret ?? env.SYNQ_CLIENT_SECRET,
+		appUrl: options.appUrl ?? env.SYNQ_APP_URL,
+		account: options.account,
+		postLogoutRedirectUri: options.postLogoutRedirectUri,
+		storePrefix: void 0
+	}, {
+		issuer: "SYNQ_ISSUER",
+		clientId: "SYNQ_CLIENT_ID",
+		clientSecret: "SYNQ_CLIENT_SECRET",
+		appUrl: "SYNQ_APP_URL"
+	}, env, false);
+}
+/** The options `resolve` answers for each site, which the top level never gives alongside it. */
+const SITE_OPTIONS = [
+	"issuer",
+	"clientId",
+	"clientSecret",
+	"appUrl",
+	"postLogoutRedirectUri"
+];
+/** A site's prefix in the store: letters, digits and `.:_~-`, as a key-value store's key takes them. */
+const STORE_PREFIX = /^[A-Za-z0-9._:~-]{1,128}$/;
+/**
+* One site's configuration (AERO-2655): what `resolve` answered for
+* `request`, over `options`' shared settings. Throws `invalid_options` for
+* anything missing or unsafe, naming the field, never its value.
+*/
+function siteConfig(options, site, request, env = processEnv()) {
+	const given = SITE_OPTIONS.filter((name) => options[name] !== void 0);
+	if (given.length > 0) throw new SynqError("invalid_options", `With resolve, each site's ${given.join(", ")} come from resolve: take ${given.length === 1 ? "it" : "them"} out of the options`);
+	if (site === null || typeof site !== "object") throw new SynqError("invalid_options", "resolve answers a site, or null for a host the app doesn’t serve");
+	const config = build(options, {
+		issuer: text(site.issuer, "resolve()'s issuer"),
+		clientId: text(site.clientId, "resolve()'s clientId"),
+		clientSecret: text(site.clientSecret, "resolve()'s clientSecret"),
+		appUrl: site.appUrl === void 0 ? request.origin : text(site.appUrl, "resolve()'s appUrl"),
+		account: site.account ?? options.account,
+		postLogoutRedirectUri: site.postLogoutRedirectUri === void 0 ? void 0 : text(site.postLogoutRedirectUri, "resolve()'s postLogoutRedirectUri"),
+		storePrefix: site.storePrefix
+	}, {
+		issuer: "resolve()'s issuer",
+		clientId: "resolve()'s clientId",
+		clientSecret: "resolve()'s clientSecret",
+		appUrl: "resolve()'s appUrl"
+	}, env, true);
+	if (config.appUrl.origin !== request.origin) throw new SynqError("invalid_options", "resolve()'s appUrl must be the origin the request came to (its https://<host>): leave it out to use that");
+	return config;
+}
+/** A site's field: a string, or the error that names it. */
+function text(value, name) {
+	if (value === void 0 || value === null || value === "") return void 0;
+	if (typeof value !== "string") throw new SynqError("invalid_options", `${name} must be a string`);
+	return value;
+}
+function build(options, fields, names, env, perSite) {
+	const issuer = required(fields.issuer, names.issuer).replace(/\/+$/, "");
+	checkUrl(issuer, names.issuer);
+	const clientId = required(fields.clientId, names.clientId);
+	const clientSecret = required(fields.clientSecret, names.clientSecret);
+	const appUrl = checkUrl(required(fields.appUrl, names.appUrl), names.appUrl);
 	const sessionSecret = required(options.sessionSecret ?? env.SYNQ_SESSION_SECRET, "SYNQ_SESSION_SECRET");
 	const previousSessionSecrets = options.previousSessionSecrets ?? (env.SYNQ_SESSION_SECRET_PREVIOUS ?? "").split(",").map((secret) => secret.trim()).filter(Boolean);
 	for (const secret of [sessionSecret, ...previousSessionSecrets]) if (new TextEncoder().encode(secret).length < 32) throw new SynqError("invalid_options", `Each session secret must be at least 32 bytes: make one with \`openssl rand -base64 32\``);
 	const hint = MULTI_PROCESS.find((name) => env[name]);
 	if (!options.store && !options.allowSingleProcessCookieMode && hint) throw new SynqError("invalid_options", `${hint} is set, so this app may run on more than one server process, where sessions in cookies can't refresh one at a time and Synq would sign people out: give synqAuth() a store every process shares (keyValueSessionStore over Redis or Valkey), or allowSingleProcessCookieMode if it truly runs one`);
+	if (fields.storePrefix !== void 0) {
+		if (typeof fields.storePrefix !== "string" || !STORE_PREFIX.test(fields.storePrefix)) throw new SynqError("invalid_options", "resolve()'s storePrefix is 1 to 128 of A-Z a-z 0-9 . : _ ~ -");
+		if (!options.store) throw new SynqError("invalid_options", "resolve()'s storePrefix places a site's sessions in synqAuth()'s store: give it a store");
+	}
 	const basePath = normalizePath(options.basePath ?? "/api/auth");
-	const accountApi = options.account === false ? void 0 : `${issuer}/me`;
+	const accountApi = fields.account === false ? void 0 : `${issuer}/me`;
 	const primary = options.resource ?? accountApi;
 	const scopes = /* @__PURE__ */ new Set([
 		"openid",
@@ -120,14 +190,28 @@ function resolveConfig(options = {}, env = processEnv()) {
 		accountApi,
 		scope: [...scopes].join(" "),
 		redirectUri: `${origin}${basePath}/callback`,
-		postLogoutRedirectUri: options.postLogoutRedirectUri ?? `${origin}/`,
-		store: options.store,
+		postLogoutRedirectUri: fields.postLogoutRedirectUri ?? `${origin}/`,
+		store: options.store && fields.storePrefix ? prefixedStore(options.store, fields.storePrefix) : options.store,
 		sessionMaxAge: options.sessionMaxAge ?? 2592e3,
 		refreshLeewaySeconds: options.refreshLeewaySeconds ?? 30,
 		plugins: options.plugins ?? [],
 		fetch: options.fetch,
 		clientAddress: options.clientAddress ?? ((request) => request.headers.get("x-real-ip")?.trim() || void 0),
-		secure: appUrl.protocol === "https:"
+		secure: appUrl.protocol === "https:",
+		site: perSite ? JSON.stringify([
+			issuer,
+			clientId,
+			origin
+		]) : ""
+	};
+}
+/** `store` with every session id under `prefix`: one site's sessions, apart from the others'. */
+function prefixedStore(store, prefix) {
+	return {
+		get: (id) => store.get(`${prefix}${id}`),
+		set: (id, values, maxAgeSeconds) => store.set(`${prefix}${id}`, values, maxAgeSeconds),
+		delete: (id) => store.delete(`${prefix}${id}`),
+		lock: (id, fn) => store.lock(`${prefix}${id}`, fn)
 	};
 }
 function processEnv() {
@@ -156,6 +240,16 @@ function normalizePath(path) {
 	return trimmed;
 }
 //#endregion
+//#region src/intent.ts
+/** The hosted flow an app asks for after identifying the account. */
+const SIGN_IN_INTENTS = /* @__PURE__ */ new Set(["add-passkey", "verify-email"]);
+/** Verification keeps the issuer session; adding a credential still needs a fresh sign-in. */
+function intentPrompt(intent, prompt) {
+	if (prompt != null) return prompt;
+	if (intent === "verify-email") return "select_account";
+	return prompt ?? (intent ? "login" : void 0);
+}
+//#endregion
 //#region src/cookies.ts
 /** Characters per chunk, under the 4096 bytes a browser keeps for one cookie with its attributes. */
 const CHUNK_SIZE = 3800;
@@ -267,6 +361,52 @@ const RESERVED = /* @__PURE__ */ new Set([
 	"link"
 ]);
 //#endregion
+//#region src/popup.ts
+/** The page's id for one popup sign-in, which its message carries back: what `attempt` takes. */
+const POPUP_ATTEMPT = /^[A-Za-z0-9_-]{8,64}$/;
+const POPUP_MESSAGE = "synq:popup";
+/**
+* The page's one script, constant so the Content-Security-Policy names it by
+* hash (`POPUP_SCRIPT_HASH`): it reads the result from the JSON block beside
+* it, posts it, and closes the window.
+*/
+const POPUP_SCRIPT = "(function(){var d=document.getElementById('synq-result');var r=d?JSON.parse(d.textContent||'null'):null;if(r){try{var c=new BroadcastChannel('synq');c.postMessage(r);c.close()}catch(e){}}window.close()})()";
+/** `POPUP_SCRIPT`'s SHA-256, as CSP's `script-src` takes it; its test holds the two together. */
+const POPUP_SCRIPT_HASH = "sha256-OpmVimyyrlgsewsXQaWdNVXCa4ywJlk1XZL1thsfWk0=";
+/** The popup's last page: it reports `result` and closes, or says the person may close it. */
+function popupPage(result) {
+	const message = {
+		type: POPUP_MESSAGE,
+		...result
+	};
+	const data = JSON.stringify(message).replaceAll("<", "\\u003c");
+	const words = result.ok ? "You’re signed in. You can close this window." : "Sign-in didn’t finish. Close this window and try again from the app.";
+	const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${result.ok ? "Signed in" : "Not signed in"}</title>
+</head>
+<body>
+<p>${words}</p>
+<script type="application/json" id="synq-result">${data}<\/script>
+<script>${POPUP_SCRIPT}<\/script>
+</body>
+</html>
+`;
+	return new Response(html, {
+		status: 200,
+		headers: {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store",
+			"content-security-policy": `default-src 'none'; script-src '${POPUP_SCRIPT_HASH}'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+			"referrer-policy": "no-referrer"
+		}
+	});
+}
+//#endregion
 //#region src/session-name.ts
 const SESSION_COOKIE = "synq.session";
 //#endregion
@@ -585,19 +725,174 @@ function now$1() {
 	return Math.floor(Date.now() / 1e3);
 }
 //#endregion
+//#region src/sign-in-context.ts
+/** The cookie that remembers the way in: the browser keeps it as long as Chrome allows, 400 days. */
+const LAST_USED = "synq.last-used";
+const LAST_USED_MAX_AGE = 3456e4;
+/** The cookie that holds a sign-in until the page hears of it: five minutes at most. */
+const EVENT = "synq.event";
+const EVENT_MAX_AGE = 300;
+/** A method's id, as the issuer names them. */
+const METHOD$1 = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+/** How long a list of methods is kept: what the issuer allows. */
+const METHODS_TTL_MS = 6e4;
+/**
+* How long the callback waits for the issuer's list to learn whether the
+* brand shows "Last used": past it, the sign-in goes on and "Last used"
+* waits for the next one.
+*/
+const METHODS_WAIT_MS = 2e3;
+/**
+* A wallet app's name as the issuer keeps it: letters, digits, spaces and a
+* little punctuation, at most 32 characters. Anything else isn't kept.
+*/
+function walletAppName(value) {
+	if (typeof value !== "string") return void 0;
+	const name = value.normalize("NFC").trim().replace(/\s+/g, " ");
+	return name.length > 0 && name.length <= 32 && /^[\p{L}\p{N} .'_-]+$/u.test(name) ? name : void 0;
+}
+/** What the session's ID token says of its sign-in, when the app turned the claims on. */
+function signInOf(claims) {
+	const method = claims?.sign_in_method;
+	const at = claims?.auth_time;
+	if (typeof method !== "string" || !METHOD$1.test(method) || typeof at !== "number") return void 0;
+	const wallet = claims?.sign_in_wallet;
+	return {
+		id: crypto.randomUUID(),
+		isNewUser: claims?.new_user === true,
+		method,
+		wallet: wallet && typeof wallet.address === "string" ? {
+			address: wallet.address,
+			app: walletAppName(wallet.app) ?? null
+		} : null,
+		at
+	};
+}
+/** Remembers on this browser the way it signed in: the method, and a wallet app's name. */
+function rememberLastUsed(jar, event, secure) {
+	const app = event.wallet?.app ?? void 0;
+	const value = app ? `${event.method}.${encodeURIComponent(app)}` : event.method;
+	jar.set(cookieName(LAST_USED, secure), value, {
+		secure,
+		maxAge: LAST_USED_MAX_AGE
+	});
+}
+/** The way this browser last signed in to the app, as its cookie holds it, or null. */
+function lastUsedOf(jar, secure) {
+	const value = jar.get(cookieName(LAST_USED, secure));
+	if (!value || value.length > 160) return null;
+	const dot = value.indexOf(".");
+	const method = dot < 0 ? value : value.slice(0, dot);
+	if (!METHOD$1.test(method)) return null;
+	if (dot < 0) return { method };
+	let app;
+	try {
+		app = walletAppName(decodeURIComponent(value.slice(dot + 1)));
+	} catch {
+		app = void 0;
+	}
+	return app ? {
+		method,
+		walletApp: app
+	} : { method };
+}
+/** Forgets the way in: where the brand turned "Last used" off. */
+function forgetLastUsed(jar, secure) {
+	if (jar.get(cookieName(LAST_USED, secure)) !== void 0) jar.delete(cookieName(LAST_USED, secure), { secure });
+}
+/** Keeps `event` for the page, sealed, bound to the person it is for (`sub`). */
+async function keepEvent(jar, key, sub, event, secure) {
+	const name = cookieName(EVENT, secure);
+	const until = Math.floor(Date.now() / 1e3) + EVENT_MAX_AGE;
+	jar.set(name, await seal(key, JSON.stringify({
+		sub,
+		event,
+		until
+	}), name), {
+		secure,
+		maxAge: EVENT_MAX_AGE
+	});
+}
+/** The sign-in kept for the page, when it is `sub`'s and still fresh, or null. */
+async function eventOf(jar, keys, sub, secure, now) {
+	if (!sub) return null;
+	const name = cookieName(EVENT, secure);
+	const opened = await unseal(keys, jar.get(name), name);
+	if (!opened) return null;
+	try {
+		const kept = JSON.parse(opened);
+		if (kept.sub !== sub || typeof kept.event?.id !== "string" || typeof kept.until !== "number" || kept.until < now) return null;
+		return kept.event;
+	} catch {
+		return null;
+	}
+}
+/** Forgets the kept sign-in: the page heard of it, or the person signed out. */
+function forgetEvent(jar, secure) {
+	if (jar.get(cookieName(EVENT, secure)) !== void 0) jar.delete(cookieName(EVENT, secure), { secure });
+}
+/**
+* `promise`'s value, or undefined when `ms` milliseconds pass first: the
+* caller goes on, and the promise settles on its own.
+*/
+async function within(promise, ms) {
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((resolve) => {
+			timer = setTimeout(resolve, ms);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* The app's sign-in methods from its issuer (`GET /sign-in/methods`), kept a
+* minute in this process, as the issuer allows; one read at a time.
+*/
+function methodsReader(options) {
+	let kept;
+	let reading;
+	return () => {
+		if (kept && kept.until > Date.now()) return Promise.resolve(kept.list);
+		reading ??= signInMethods(options).then((list) => {
+			kept = {
+				list: readMethodList(list),
+				until: Date.now() + METHODS_TTL_MS
+			};
+			return kept.list;
+		}).finally(() => {
+			reading = void 0;
+		});
+		return reading;
+	};
+}
+//#endregion
 //#region src/core.ts
 const PROMPTS = /* @__PURE__ */ new Set([
 	"login",
 	"none",
 	"consent",
-	"select_account"
+	"select_account",
+	"create"
 ]);
-const INTENTS = /* @__PURE__ */ new Set(["add-passkey"]);
+/** A plan's code, as Synq's catalog has it: what `plan` may hold (AERO-2160). */
+const PLAN_CODE = /^[a-z][a-z0-9-]{1,30}$/;
+/** An onboarding visit's id: 22 base62 characters (AERO-2160). */
+const ONBOARDING_VISIT = /^[0-9A-Za-z]{22}$/;
 /** A sign-in method's name, as `synq_method` and the account API's link requests take it. */
 const METHOD = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 const TRANSACTION_SECONDS = 3600;
 const TRANSACTION_PREFIX = "synq.tx.";
 const ACCOUNT_BODY_LIMIT = 65536;
+/** A picture the person uploads: the account API's own limit (AERO-2700). */
+const PICTURE_BODY_LIMIT = 5242880;
+/** The pictures Synq takes, by the request's `Content-Type`; Synq knows them again by their bytes. */
+const PICTURE_TYPES = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif"
+]);
 const LINK_BODY_LIMIT = 4096;
 /** A step of an own-UI sign-in: a passkey's assertion is the most it carries. */
 const FLOW_BODY_LIMIT = 16384;
@@ -627,7 +922,9 @@ const PROTOCOL_CLAIMS = /* @__PURE__ */ new Set([
 function createSynqCore(config) {
 	/** Whether the missing end-user address was logged already: once is enough. */
 	let warnedAboutAddress = false;
-	const keysFor = () => sealingKeys(config.sessionSecret, config.previousSessionSecrets);
+	/** The keys this app's (or site's, `config.site`) cookies are sealed with, derived once. */
+	let keys;
+	const keysFor = () => keys ??= sealingKeys(config.sessionSecret, config.previousSessionSecrets, config.site);
 	/** Every request to Synq: never cached, and given up after REQUEST_TIMEOUT_MS. */
 	const upstream = (input, init = {}) => {
 		const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
@@ -669,6 +966,43 @@ function createSynqCore(config) {
 			sid: typeof claims.sid === "string" ? claims.sid : void 0
 		};
 	}
+	/**
+	* Why a sign-in again (`reauthenticate`), for `sub`, can't be kept, or
+	* `undefined` when it can: `not_signed_in` when `sub` isn't the one signed
+	* in here any more (signed out in another tab, say, or someone else signed
+	* in since), `other_account` when someone else signed in at the brand.
+	*/
+	async function reauthenticationRefused(jar, handle, sub) {
+		const previous = await load(jar);
+		const [before, after] = await Promise.all([previous ? issuerSessionOf(previous) : void 0, issuerSessionOf(handle)]);
+		if (before?.sub !== sub) return "not_signed_in";
+		if (after?.sub !== sub) return "other_account";
+	}
+	/**
+	* Ends a sign-in the callback won't keep: the browser's session at the
+	* brand that it made, from this server, then its grant. Signed in with
+	* `prompt=login`, it replaced the brand's session in this browser, and
+	* left alive it would sign whoever it was in to any later sign-in that
+	* asks for no fresh one, at this app or another of the brand's.
+	*/
+	async function discard(handle) {
+		const theirs = client(handle.storage(config.primary, config.primary), config.primary);
+		try {
+			await theirs.signOut({ stay: true });
+		} catch {
+			try {
+				await theirs.signOut();
+			} catch {}
+		}
+	}
+	/** The ID token the session's main token came with: who is signed in, as the issuer said. */
+	async function idTokenOf(handle) {
+		if (!handle) return void 0;
+		const raw = (await handle.read())[tokenKey(config.primary)];
+		if (!raw) return void 0;
+		const { idToken } = JSON.parse(raw);
+		return typeof idToken === "string" ? idToken : void 0;
+	}
 	/** The person the session's main token was issued with, while the session can still give a token. */
 	async function userOf(handle) {
 		if (!handle) return {
@@ -698,6 +1032,48 @@ function createSynqCore(config) {
 			expiresAt
 		};
 	}
+	/** Who is signed in, the way in this browser last used, and the sign-in the page hasn't heard of. */
+	async function sessionInfo(jar) {
+		const { user, expiresAt } = await userOf(await load(jar));
+		return {
+			user,
+			expiresAt,
+			lastUsed: lastUsedOf(jar, config.secure),
+			event: await eventOf(jar, (await keysFor()).open, user?.sub, config.secure, now())
+		};
+	}
+	/** The app's sign-in methods (AERO-2690), from the issuer, kept a minute. */
+	const methods = methodsReader({
+		issuer: config.issuer,
+		clientId: config.clientId,
+		fetch: upstream
+	});
+	/**
+	* What the new session's ID token says of its sign-in, kept on this
+	* browser (AERO-2691): the way in, for "Last used" where the brand shows
+	* it, and the sign-in itself, for the page to hear of once (`event`).
+	* Nothing without the app's sign-in claims. Best effort: the sign-in
+	* stands whatever happens here, and waits at most METHODS_WAIT_MS for the
+	* issuer's list.
+	*
+	* A link, or the person signed in now confirming it's them, is no sign-in
+	* for the page to hear of (`event: false`): the person signed in is the
+	* same, and a panel open on its onboarding or its profile carries on there
+	* rather than greeting them again.
+	*/
+	async function keepSignIn(jar, handle, { event: keep = true } = {}) {
+		const raw = (await handle.read())[tokenKey(config.primary)];
+		const claims = raw ? JSON.parse(raw).claims : void 0;
+		const event = signInOf(claims);
+		if (!event || typeof claims?.sub !== "string") return;
+		if (keep) await keepEvent(jar, (await keysFor()).seal, claims.sub, event, config.secure);
+		try {
+			const list = await within(methods(), METHODS_WAIT_MS);
+			if (!list) return;
+			if (list.show_last_used) rememberLastUsed(jar, event, config.secure);
+			else forgetLastUsed(jar, config.secure);
+		} catch {}
+	}
 	async function getAccessToken(jar, options = {}) {
 		const resource = options.resource ?? config.primary;
 		if (resource !== config.primary && resource !== config.accountApi) throw new SynqError("invalid_options", `The session has no token for ${resource ?? "userinfo"}: name it in synqAuth()'s resource`);
@@ -718,8 +1094,14 @@ function createSynqCore(config) {
 			throw error;
 		}
 	}
-	/** A store for one sign-in's transaction: a sealed cookie named after its state, with where to go afterwards. */
-	async function transactions(jar, returnTo) {
+	/**
+	* A store for one sign-in's transaction: a sealed cookie named after its
+	* state, with where to go afterwards, or the popup it runs in (`popup`, the
+	* page's attempt id: popup.ts), for a sign-in again, who must sign in
+	* (`reauthenticate`, their `sub`), and whether it adds a way in to the
+	* person signed in (`link`) rather than signing someone in.
+	*/
+	async function transactions(jar, returnTo, popup, reauthenticate, link) {
 		const keys = await keysFor();
 		const options = {
 			secure: config.secure,
@@ -732,8 +1114,11 @@ function createSynqCore(config) {
 					const cookie = cookieName(name, config.secure);
 					const opened = await unseal(keys.open, jar.get(cookie), cookie);
 					if (!opened) return void 0;
-					const { v, r } = JSON.parse(opened);
+					const { v, r, p, s, l } = JSON.parse(opened);
 					found.returnTo = r;
+					if (typeof p === "string" && POPUP_ATTEMPT.test(p)) found.popup = p;
+					if (typeof s === "string") found.reauthenticate = s;
+					if (l === true) found.link = true;
 					return v;
 				},
 				async set(name, value) {
@@ -742,7 +1127,10 @@ function createSynqCore(config) {
 					const sealed = JSON.stringify({
 						v: value,
 						r: returnTo,
-						t: Date.now()
+						t: Date.now(),
+						p: popup,
+						s: reauthenticate,
+						...link ? { l: true } : {}
 					});
 					jar.set(cookie, await seal(keys.seal, sealed, cookie), options);
 				},
@@ -782,41 +1170,122 @@ function createSynqCore(config) {
 		const prompt = params.get("prompt") ?? void 0;
 		const maxAge = params.get("max_age");
 		const intent = params.get("intent") ?? void 0;
-		if (prompt && !PROMPTS.has(prompt)) return problem(400, "invalid_request", "prompt is login, none, consent or select_account");
+		if (prompt && !PROMPTS.has(prompt)) return problem(400, "invalid_request", "prompt is login, none, consent, select_account or create");
 		if (maxAge !== null && !/^\d{1,9}$/.test(maxAge)) return problem(400, "invalid_request", "max_age is a number of seconds");
-		if (intent && !INTENTS.has(intent)) return problem(400, "invalid_request", "intent is add-passkey (POST link adds a way to sign in)");
-		const tx = await transactions(jar, returnTo);
+		if (intent && !SIGN_IN_INTENTS.has(intent)) return problem(400, "invalid_request", "intent is add-passkey or verify-email (POST link adds a way to sign in)");
+		const plan = params.get("plan") ?? void 0;
+		const interval = params.get("interval") ?? void 0;
+		if (plan !== void 0 && !PLAN_CODE.test(plan)) return problem(400, "invalid_request", "plan is a plan code, such as pro");
+		if (interval !== void 0 && (plan === void 0 || interval !== "month" && interval !== "year")) return problem(400, "invalid_request", "interval is month or year, with a plan");
+		const onboarding = params.get("onboarding") ?? void 0;
+		if (onboarding !== void 0 && !ONBOARDING_VISIT.test(onboarding)) return problem(400, "invalid_request", "onboarding is an onboarding visit id");
+		const display = displayOf(params.get("display"), params.get("attempt"));
+		if (display instanceof Response) return display;
+		const again = params.get("reauthenticate");
+		let reauthenticate;
+		if (again !== null) {
+			if (again !== "true") return problem(400, "invalid_request", "reauthenticate is true, or left out");
+			if (prompt && prompt !== "login" || intent) return problem(400, "invalid_request", "reauthenticate is a fresh sign-in: it takes no other prompt, and no intent");
+			const signedIn = await load(jar);
+			reauthenticate = signedIn ? (await issuerSessionOf(signedIn))?.sub : void 0;
+			if (!reauthenticate) {
+				if (display) return popupPage({
+					attempt: display,
+					ok: false,
+					error: "not_signed_in"
+				});
+				return redirect(withError(returnTo, "not_signed_in"), 302);
+			}
+		}
+		const tx = await transactions(jar, returnTo, display, reauthenticate);
 		return redirect((await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
 			method: params.get("method") ?? void 0,
 			loginHint: params.get("login_hint") ?? void 0,
-			prompt: prompt ?? (intent ? "login" : void 0),
+			prompt: reauthenticate ? "login" : intentPrompt(intent, prompt),
 			maxAge: maxAge === null ? void 0 : Number(maxAge),
 			additionalResources: config.accountApi && config.accountApi !== config.primary ? [config.accountApi] : [],
-			params: intent ? { synq_intent: intent } : void 0
+			params: {
+				...intent ? { synq_intent: intent } : {},
+				...plan ? { synq_plan: plan } : {},
+				...interval ? { synq_interval: interval } : {},
+				...onboarding ? { synq_onboarding: onboarding } : {}
+			}
 		})).href, 302);
 	}
 	async function callback(request, jar) {
 		const tx = await transactions(jar);
 		const handle = newSession(config.sessionMaxAge, config.store);
+		const back = () => safeReturnTo(tx.found.returnTo ?? null, config.appUrl);
+		const failed = (code) => tx.found.popup ? popupPage({
+			attempt: tx.found.popup,
+			ok: false,
+			error: code
+		}) : redirect(withError(back(), code), 303);
 		try {
 			await client(handle.storage(config.primary, config.primary), config.primary, tx.storage).handleCallback(request.url);
 		} catch (error) {
-			const code = isSynqError(error) ? error.code : "server_error";
-			return redirect(withError(safeReturnTo(tx.found.returnTo ?? null, config.appUrl), code), 303);
+			const code = isSynqError(error) ? signInEndingOf(error.description) ?? error.code : "server_error";
+			if (!QUIET_SIGN_IN_ERRORS.has(code)) console.error("@synqauth/nextjs: sign-in callback failed", {
+				code,
+				status: isSynqError(error) ? error.status : void 0,
+				requestId: isSynqError(error) ? error.requestId : void 0
+			});
+			return failed(code);
+		}
+		if (tx.found.reauthenticate !== void 0) {
+			const refused = await reauthenticationRefused(jar, handle, tx.found.reauthenticate);
+			if (refused) {
+				await discard(handle);
+				return failed(refused);
+			}
 		}
 		await startSession(jar, handle);
-		return redirect(safeReturnTo(tx.found.returnTo ?? null, config.appUrl), 303);
+		await keepSignIn(jar, handle, { event: tx.found.reauthenticate === void 0 && tx.found.link !== true });
+		if (tx.found.popup) return popupPage({
+			attempt: tx.found.popup,
+			ok: true
+		});
+		return redirect(back(), 303);
 	}
 	async function signOut(request, jar) {
+		const stay = await staysOnPage(request);
+		if (stay instanceof Response) return stay;
 		const handle = await load(jar);
 		let url = null;
-		if (handle) url = await client(handle.storage(config.primary, config.primary), config.primary).signOut();
+		if (handle) url = await client(handle.storage(config.primary, config.primary), config.primary).signOut(stay ? { stay: true } : {});
 		await endSession(jar, handle, config.secure, config.store);
+		forgetEvent(jar, config.secure);
+		if (stay) return json({ redirect: null });
 		const target = url?.href ?? config.postLogoutRedirectUri;
 		if ((request.headers.get("accept") ?? "").includes("application/json")) return json({ redirect: target });
 		return redirect(target, 303);
 	}
 	/**
+	* Whether a sign-out asks to stay on the page (AERO-2684): `{ stay: true }`
+	* as JSON. A form's post, or no body, goes to the brand's sign-out page.
+	*/
+	async function staysOnPage(request) {
+		if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return false;
+		const length = Number(request.headers.get("content-length") ?? 0);
+		if (request.headers.has("transfer-encoding")) return problem(411, "length_required", "Send the body with a Content-Length");
+		if (!Number.isFinite(length) || length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		try {
+			const body = await request.text();
+			if (body === "") return false;
+			const input = JSON.parse(body);
+			if (input === null || typeof input !== "object" || Array.isArray(input)) throw new TypeError();
+			if (input.stay !== void 0 && typeof input.stay !== "boolean") throw new TypeError();
+			return input.stay === true;
+		} catch {
+			return problem(400, "invalid_request", "Send { stay: true } as JSON, or no body");
+		}
+	}
+	/** The ways the app's sign-in offers, for its own panel (AERO-2690): the issuer's list, kept a minute. */
+	async function signInMethodsRoute() {
+		const list = await methods();
+		return Response.json(list, { headers: { "cache-control": "private, max-age=60" } });
+	}
+	/**
 	* Adding a way to sign in (AERO-1397): the account API makes a link request
 	* for the person with the session's token, and its ticket goes to Synq in
 	* a sign-in like any other, which asks them to sign in again first. A POST
@@ -837,6 +1306,8 @@ function createSynqCore(config) {
 			return problem(400, "invalid_request", "Send { method, returnTo } as JSON");
 		}
 		if (typeof input?.method !== "string" || !METHOD.test(input.method)) return problem(400, "invalid_request", "method names the way to sign in to add");
+		const display = displayOf(textOrNull(input.display), textOrNull(input.attempt));
+		if (display instanceof Response) return display;
 		const returnTo = safeReturnTo(typeof input.returnTo === "string" ? input.returnTo : null, config.appUrl);
 		let token;
 		try {
@@ -849,6 +1320,23 @@ function createSynqCore(config) {
 			].includes(error.code)) return problem(401, "not_signed_in", "Nobody is signed in");
 			throw error;
 		}
+		if (input.method === "passkey") {
+			const methods = await upstream(`${config.accountApi}/v1/link-methods?limit=200`, { headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json"
+			} });
+			if (!methods.ok) return new Response(methods.body, {
+				status: methods.status,
+				headers: { "content-type": methods.headers.get("content-type") ?? "application/problem+json" }
+			});
+			if (!(await methods.json()).data?.some((one) => one.method === "passkey")) return problem(409, "sign_in_method_unavailable", "This brand doesn’t offer passkeys");
+			const tx = await transactions(jar, returnTo, display, void 0, true);
+			return json({ redirect: (await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
+				prompt: "login",
+				additionalResources: config.accountApi !== config.primary ? [config.accountApi] : [],
+				params: { synq_intent: "add-passkey" }
+			})).href });
+		}
 		const answer = await upstream(`${config.accountApi}/v1/link-requests`, {
 			method: "POST",
 			headers: {
@@ -864,7 +1352,7 @@ function createSynqCore(config) {
 		});
 		const ticket = (await answer.json()).authorization_params?.synq_link;
 		if (typeof ticket !== "string") return problem(502, "invalid_response", "Synq answered without a link ticket");
-		const tx = await transactions(jar, returnTo);
+		const tx = await transactions(jar, returnTo, display, void 0, true);
 		return json({ redirect: (await client(memoryStorage(), config.primary, tx.storage).authorizationUrl({
 			prompt: "login",
 			additionalResources: config.accountApi !== config.primary ? [config.accountApi] : [],
@@ -941,9 +1429,16 @@ function createSynqCore(config) {
 			warnedAboutAddress = true;
 			console.warn("@synqauth/nextjs: own-UI sign-in can't tell where people sign in from (no x-real-ip): give synqAuth() a clientAddress, or per-address protection is off for this app");
 		}
+		const reauthenticate = input.reauthenticate === true;
+		if (reauthenticate && step !== "wallet") return problem(400, "invalid_request", "reauthenticate goes with step wallet");
+		const signedIn = reauthenticate ? await idTokenOf(await load(jar)) : void 0;
+		if (reauthenticate && !signedIn) return json({
+			status: "other-account",
+			message: "Nobody is signed in to confirm."
+		});
 		const handle = newSession(config.sessionMaxAge, config.store);
 		const synq = client(handle.storage(config.primary, config.primary), config.primary);
-		const flow = saved ? synq.resumeSignIn(saved, { endUserIp }) : synq.startSignIn({
+		const flow = saved && !reauthenticate ? synq.resumeSignIn(saved, { endUserIp }) : synq.startSignIn({
 			endUserIp,
 			additionalResources: config.accountApi && config.accountApi !== config.primary ? [config.accountApi] : []
 		});
@@ -981,7 +1476,13 @@ function createSynqCore(config) {
 					result = await flow.passkey.signIn(credential, { related: input.related === true });
 					break;
 				}
-				default: return problem(400, "invalid_request", "step is password, email, code, resend, skip, passkey-options, passkey or restart");
+				case "wallet": {
+					const siws = input.siws;
+					if (typeof siws !== "string" || !SIWS.test(siws)) return problem(400, "invalid_request", "siws is what the wallet signed, as encodeSiws makes it");
+					result = await flow.wallet.signIn(siws, signedIn ? { reauthenticate: signedIn } : {});
+					break;
+				}
+				default: return problem(400, "invalid_request", "step is password, email, code, resend, skip, passkey-options, passkey, wallet or restart");
 			}
 		} catch (error) {
 			if (isSynqError(error, "invalid_session")) {
@@ -1002,7 +1503,21 @@ function createSynqCore(config) {
 		}
 		if (result.status === "signed-in") {
 			await tx.storage.remove(FLOW_KEY);
+			if (reauthenticate) {
+				const previous = await load(jar);
+				const [before, after] = await Promise.all([previous ? issuerSessionOf(previous) : void 0, issuerSessionOf(handle)]);
+				if (!before || before.sub !== after?.sub) {
+					try {
+						await client(handle.storage(config.primary, config.primary), config.primary).signOut();
+					} catch {}
+					return json({
+						status: "other-account",
+						message: before ? "That wallet signs in to another account. Use a wallet of the account signed in here." : "Nobody is signed in to confirm."
+					});
+				}
+			}
 			await startSession(jar, handle);
+			await keepSignIn(jar, handle, { event: !reauthenticate });
 			return json({
 				status: "signed-in",
 				returnTo: tx.found.returnTo ?? returnTo
@@ -1050,11 +1565,16 @@ function createSynqCore(config) {
 					...result.loginHint ? { loginHint: result.loginHint } : {}
 				}
 			});
-			case "refused": return json({
-				status: result.status,
-				reason: result.reason,
-				message: result.message
-			});
+			case "refused":
+				if (reauthenticate && result.reason === "other_account") return json({
+					status: "other-account",
+					message: "That wallet signs in to another account, or to none. Use a wallet of the account signed in here."
+				});
+				return json({
+					status: result.status,
+					reason: result.reason,
+					message: result.message
+				});
 		}
 	}
 	/**
@@ -1126,6 +1646,85 @@ function createSynqCore(config) {
 			headers: out
 		});
 	}
+	/**
+	* The person's picture (AERO-2700): the browser posts the picture's own
+	* bytes here, and this server runs the account API's upload for them,
+	* asking for an upload, PUTting the bytes to Synq's storage, and choosing
+	* it, so the storage needs no CORS for the app, and no bytes pass through
+	* Synq's API. Or it posts `{ "identity": … }`, a linked account whose
+	* picture to use: a POST, which every app's route file already serves. A
+	* body that says it is too large, or not a picture, or won't say how long
+	* it is, is refused before it is read.
+	*/
+	async function picture(request, jar) {
+		if (!config.accountApi) return problem(404, "not_found", "The session holds no account API token: synqAuth()'s account is off");
+		const declared = request.headers.get("content-length");
+		if (request.headers.has("transfer-encoding") || declared === null) return problem(411, "length_required", "Send the picture with a Content-Length");
+		const length = Number(declared);
+		if (!Number.isSafeInteger(length) || length < 1) return problem(411, "length_required", "Send the picture with a Content-Length");
+		if (length > PICTURE_BODY_LIMIT) return problem(413, "payload_too_large", "A picture is at most 5 MB.");
+		const type = request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() ?? "";
+		const linked = type === "application/json";
+		if (linked && length > LINK_BODY_LIMIT) return problem(413, "payload_too_large", "The body is too large");
+		if (!linked && !PICTURE_TYPES.has(type)) return problem(415, "unsupported_media_type", "Send a PNG, JPEG, WebP or GIF picture");
+		let token;
+		try {
+			token = await getAccessToken(jar, { resource: config.accountApi });
+		} catch (error) {
+			if (isSynqError(error) && [
+				"not_signed_in",
+				"invalid_grant",
+				"no_refresh_token"
+			].includes(error.code)) return problem(401, "not_signed_in", "Nobody is signed in");
+			throw error;
+		}
+		const bytes = new Uint8Array(await request.arrayBuffer());
+		if (bytes.byteLength !== length) return problem(400, "validation_failed", "The picture isn’t the length it said");
+		const key = request.headers.get("idempotency-key");
+		const call = (method, path, body, step) => upstream(`${config.accountApi}/${path}`, {
+			method,
+			headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json",
+				"content-type": "application/json",
+				...key ? { "idempotency-key": `${key}:${step}` } : {}
+			},
+			body: JSON.stringify(body),
+			redirect: "manual"
+		});
+		const relay = async (answer) => new Response(answer.status === 204 ? null : await answer.text(), {
+			status: answer.status,
+			headers: {
+				"cache-control": "no-store",
+				"content-type": answer.headers.get("content-type") ?? "application/json"
+			}
+		});
+		if (linked) {
+			let identity;
+			try {
+				identity = JSON.parse(new TextDecoder().decode(bytes)).identity;
+			} catch {
+				identity = void 0;
+			}
+			if (typeof identity !== "string" || !/^idn_[0-9a-z]{1,64}$/.test(identity)) return problem(400, "validation_failed", "Name the linked account: { \"identity\": \"idn_…\" }");
+			return relay(await call("PUT", "v1/profile/picture", { identity }, "choose"));
+		}
+		const started = await call("POST", "v1/profile/picture/uploads", {
+			content_type: type,
+			content_length: length
+		}, "upload");
+		if (started.status !== 201) return relay(started);
+		const upload = await started.json();
+		const stored = await upstream(upload.url, {
+			method: "PUT",
+			headers: upload.headers,
+			body: bytes,
+			redirect: "manual"
+		});
+		await stored.body?.cancel();
+		if (!stored.ok) return problem(502, "upload_failed", `Synq's storage refused the picture (${stored.status})`);
+		return relay(await call("PUT", "v1/profile/picture", { file_id: upload.file_id }, "choose"));
+	}
 	async function plugin(request, jar, id, rest) {
 		const route = config.plugins.find((candidate) => candidate.id === id)?.routes?.[`${request.method} /${rest}`];
 		if (!route) return void 0;
@@ -1144,20 +1743,38 @@ function createSynqCore(config) {
 		const rest = url.pathname.slice(prefix.length);
 		const [first = "", ...tail] = rest.split("/");
 		const jar = requestJar(request);
-		if (!["GET", "HEAD"].includes(request.method) && !sameOrigin(request, config.appUrl)) return problem(403, "forbidden", "A change must come from the app's own pages");
+		if (!["GET", "HEAD"].includes(request.method) && !sameOrigin(request, config.appUrl)) {
+			reportOriginMismatch(request, config.appUrl);
+			return problem(403, "origin_mismatch", "This change came from another address than the app's own pages (appUrl)");
+		}
 		let response;
 		try {
 			if (rest === "sign-in" && request.method === "GET") response = await signIn(request, jar);
 			else if (rest === "sign-in" && request.method === "POST") response = await walletSignIn(request, jar);
 			else if (rest === "sign-in/flow" && request.method === "POST") response = await signInFlow(request, jar);
+			else if (rest === "sign-in/wallet" && request.method === "GET") response = json({
+				issuer: config.issuer,
+				clientId: config.clientId
+			});
 			else if (rest === "callback" && request.method === "GET") response = await callback(request, jar);
 			else if (rest === "sign-out" && request.method === "POST") response = await signOut(request, jar);
 			else if (rest === "link" && request.method === "POST") response = await link(request, jar);
-			else if (rest === "session" && request.method === "GET") response = json(await userOf(await load(jar)));
+			else if (rest === "sign-in/methods" && request.method === "GET") response = await signInMethodsRoute();
+			else if (rest === "session" && request.method === "GET") response = json(await sessionInfo(jar));
+			else if (rest === "session/event" && request.method === "DELETE") {
+				forgetEvent(jar, config.secure);
+				response = new Response(null, { status: 204 });
+			} else if (rest === "account/picture" && request.method === "POST") response = await picture(request, jar);
 			else if (first === "account") response = await account(request, jar, tail.join("/"));
 			else if (!RESERVED.has(first)) response = await plugin(request, jar, first, tail.join("/"));
 		} catch (error) {
 			if (!isSynqError(error)) throw error;
+			if (error.status === void 0 || error.status >= 500) console.error("@synqauth/nextjs: a route under the mount failed", {
+				route: rest,
+				code: error.code,
+				status: error.status,
+				requestId: error.requestId
+			});
 			response = problem(error.status && error.status >= 400 ? 502 : 500, error.code, error.message);
 		}
 		response ??= problem(404, "not_found", "No such route under the mount");
@@ -1186,12 +1803,28 @@ function createSynqCore(config) {
 	return {
 		handle,
 		user: async (jar) => (await userOf(await load(jar))).user,
-		session: async (jar) => userOf(await load(jar)),
+		session: sessionInfo,
 		getAccessToken,
 		refreshIfDue,
 		config
 	};
 }
+/** A body field as text: null when it is left out, and anything but text kept as a mark that it was there. */
+function textOrNull(value) {
+	if (value === void 0) return null;
+	return typeof value === "string" ? value : "?";
+}
+/**
+* The popup a sign-in or link runs in (AERO-2692): the page's attempt id for
+* `display=popup`, undefined for `redirect` or none, or the problem for
+* anything else.
+*/
+function displayOf(display, attempt) {
+	if (display === null || display === "redirect") return attempt === null ? void 0 : problem(400, "invalid_request", "attempt goes with display=popup");
+	if (display !== "popup") return problem(400, "invalid_request", "display is popup or redirect");
+	if (attempt === null || !POPUP_ATTEMPT.test(attempt)) return problem(400, "invalid_request", "attempt is the popup's id: 8 to 64 of A-Z a-z 0-9 _ -");
+	return attempt;
+}
 /**
 * Whether a request is a prefetch, not a person going there: Next.js's
 * router (`Next-Router-Prefetch`) and browsers' speculative loads (`Purpose`,
@@ -1225,6 +1858,30 @@ function sameOrigin(request, appUrl) {
 	if (origin) return origin === appUrl.origin;
 	return request.headers.get("sec-fetch-site") === "same-origin";
 }
+/**
+* Sign-in errors that are the person's own doing or an expected step, which
+* no server log needs to hear of (AERO-2757).
+*/
+const QUIET_SIGN_IN_ERRORS = /* @__PURE__ */ new Set([
+	"access_denied",
+	"login_required",
+	"interaction_required",
+	"consent_required",
+	"account_selection_required",
+	"cancelled",
+	"consent_denied",
+	"token_gate_refused",
+	"passkey_required",
+	"unknown_state"
+]);
+let originMismatchReported = false;
+/** Says once per process which origin the mount refused, and what appUrl says (AERO-2757). */
+function reportOriginMismatch(request, appUrl) {
+	if (originMismatchReported) return;
+	originMismatchReported = true;
+	const origin = request.headers.get("origin") ?? request.headers.get("sec-fetch-site") ?? "unknown";
+	console.error(`@synqauth/nextjs: refused a change from ${origin}: appUrl is ${appUrl.origin}. Set appUrl (or SYNQ_APP_URL) to the origin people use.`);
+}
 function withError(target, code) {
 	const url = new URL(target);
 	url.searchParams.set("synq_error", code);
@@ -1266,17 +1923,47 @@ const SIGN_IN_ERROR_PARAM = "synq_error";
 /** An OAuth or SDK error code, as the route mount puts it there. */
 const CODE = /^[a-z0-9_]{1,64}$/;
 const MESSAGES = {
-	access_denied: "The sign-in was cancelled, or this account can’t use this app.",
+	access_denied: "This account can’t use this app, or the sign-in was canceled. Sign in again, or use another account.",
+	cancelled: "You canceled signing in. Sign in when you’re ready.",
+	consent_denied: "You didn’t allow this app to use your account. Sign in again to allow it.",
+	token_gate_refused: "This account’s wallets don’t hold what this app asks for. Use another account, or add the wallet that holds it.",
+	token_gate_unavailable: "We couldn’t check your wallets. That’s a problem on Synq’s side, not yours. Try again in a minute.",
+	passkey_required: "This app needs you to sign in with a passkey.",
+	unmet_authentication_requirements: "This app needs you to sign in with a passkey.",
+	level_not_met: "This app needs you to sign in with a passkey.",
 	login_required: "You need to sign in to continue.",
 	interaction_required: "You need to sign in to continue.",
 	consent_required: "You need to allow this app to use your account to continue.",
 	account_selection_required: "Choose an account to continue.",
-	temporarily_unavailable: "Signing in isn’t available just now. Try again in a moment.",
-	unknown_state: "This sign-in expired, or it finished in another tab. Try again."
+	temporarily_unavailable: "Signing in is down for a moment on Synq’s side. Try again in a minute.",
+	server_error: "Synq had a problem finishing your sign-in. Try again in a minute.",
+	invalid_grant: "This sign-in expired or was already used. Sign in again.",
+	unknown_state: "This sign-in expired, or it finished in another tab. Sign in again.",
+	other_account: "That signed in to another account. Confirm with a way in of the account signed in here.",
+	not_signed_in: "You were signed out. Sign in again."
 };
-/** What a sign-in error code means, in plain words. */
+/**
+* The app's own setup, which only its team can fix: retrying gets the same
+* answer, and nothing the person does changes it.
+*/
+const APP_SETUP = /* @__PURE__ */ new Set([
+	"invalid_client",
+	"unauthorized_client",
+	"invalid_scope",
+	"invalid_request",
+	"invalid_response",
+	"invalid_redirect_uri",
+	"unsupported_response_type",
+	"discovery_failed",
+	"method_not_offered",
+	"origin_mismatch"
+]);
+/** What a sign-in error code means, in plain words: whose side it is on, and what to do. */
 function signInErrorMessage(code) {
-	return MESSAGES[code] ?? "Something went wrong signing in. Try again.";
+	const said = MESSAGES[code];
+	if (said) return said;
+	if (APP_SETUP.has(code)) return `This app’s sign-in isn’t set up right, so it can’t finish. It’s not something you did: tell the app’s team (code ${code}).`;
+	return `Your sign-in didn’t finish (code ${code}). Try again, and if it keeps happening, tell the app’s team.`;
 }
 /** A path and query on the app, without `synq_error`: where the ways on come back to. */
 function withoutSignInError(pathAndSearch) {
@@ -1346,4 +2033,129 @@ function signInErrorPage(error) {
 	});
 }
 //#endregion
-export { withoutSignInError as a, memorySessionStore as c, normalizePath as d, resolveConfig as f, signInErrorPage as i, defineSynqPlugin as l, signInErrorMessage as n, createSynqCore as o, signInErrorOf as r, keyValueSessionStore as s, SIGN_IN_ERROR_PARAM as t, requestJar as u };
+//#region src/sites.ts
+/** Sites kept at once; past it, the one used longest ago is made again when next asked for. */
+const MAX_SITES = 500;
+/** One DNS label, as a host name has them. */
+const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** A host as a browser names it in `Host`: a DNS name or an IPv6 literal, and a port. */
+const HOST = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*|\[[0-9a-f:.]+\])(?::\d{1,5})?$/;
+/** A host as it's compared: lowercase, with no dot at the end of its name. */
+function normalHost(value) {
+	return value.trim().toLowerCase().replace(/\.(:\d+)?$/, "$1");
+}
+/**
+* The host the browser asked for: `X-Forwarded-Host`'s first, which a proxy
+* in front of the app sets (and Next's own server does), else `Host`.
+* Undefined when there is none, or it isn't a host.
+*/
+function requestHost(headers) {
+	const forwarded = headers.get("x-forwarded-host")?.split(",", 1)[0]?.trim();
+	const host = normalHost(forwarded || headers.get("host") || "");
+	return HOST.test(host) ? host : void 0;
+}
+/**
+* `hosts` as a test: an entry is a host (`club.example.com`,
+* `localhost:3000`), or `*.` and a domain, for any one label under it, its
+* port named or none. Throws `invalid_options` for an entry that is neither.
+*/
+function allowList(hosts) {
+	if (!Array.isArray(hosts) || hosts.length === 0) throw new SynqError("invalid_options", "With resolve, hosts lists every host the app serves (club.example.com, *.example.com): any other is refused");
+	const exact = /* @__PURE__ */ new Set();
+	const under = [];
+	for (const entry of hosts) {
+		const host = typeof entry === "string" ? normalHost(entry) : "";
+		const wildcard = host.startsWith("*.");
+		const name = wildcard ? host.slice(2) : host;
+		if (!HOST.test(name) || name.startsWith("[") || wildcard && !name.includes(".")) throw new SynqError("invalid_options", `hosts: ${JSON.stringify(entry)} isn't a host, nor *. and a domain`);
+		if (wildcard) under.push(`.${name}`);
+		else exact.add(name);
+	}
+	return (host) => exact.has(host) || under.some((suffix) => host.endsWith(suffix) && LABEL.test(host.slice(0, -suffix.length)));
+}
+/** Whether `host` (its name, without the port) is this machine. */
+function isLoopback(host) {
+	const name = host.startsWith("[") ? host.slice(0, host.indexOf("]") + 1) : host.split(":", 1)[0];
+	return name === "localhost" || name.endsWith(".localhost") || name === "127.0.0.1" || name === "[::1]";
+}
+/**
+* The site's origin: `https://<host>`, or, for a host on this machine, the
+* scheme the request came over (`X-Forwarded-Proto`, which Next sets, else
+* the request's own URL).
+*/
+function originOf(host, headers, url) {
+	let protocol = "https:";
+	if (isLoopback(host)) {
+		const forwarded = headers.get("x-forwarded-proto")?.split(",", 1)[0]?.trim().toLowerCase();
+		if (forwarded === "http" || forwarded === "https") protocol = `${forwarded}:`;
+		else if (url) protocol = new URL(url).protocol === "https:" ? "https:" : "http:";
+		else protocol = "http:";
+	}
+	return new URL(`${protocol}//${host}`).origin;
+}
+function siteCores(options) {
+	const { resolve } = options;
+	if (!resolve) throw new TypeError("siteCores needs resolve");
+	let allowed;
+	const cores = /* @__PURE__ */ new Map();
+	return { async coreFor(headers, url) {
+		allowed ??= allowList(options.hosts);
+		const host = requestHost(headers);
+		if (!host || !allowed(host)) return null;
+		const request = {
+			host,
+			origin: originOf(host, headers, url),
+			headers
+		};
+		const site = await resolve(request);
+		if (site === null || site === void 0) return null;
+		const key = JSON.stringify([
+			request.origin,
+			site.issuer,
+			site.clientId,
+			site.appUrl ?? null,
+			site.storePrefix ?? null,
+			site.account ?? null,
+			site.postLogoutRedirectUri ?? null
+		]);
+		const kept = cores.get(key);
+		cores.delete(key);
+		if (kept && kept.secret === site.clientSecret) {
+			cores.set(key, kept);
+			return kept.core;
+		}
+		const core = createSynqCore(siteConfig(options, site, request));
+		cores.set(key, {
+			secret: site.clientSecret,
+			core
+		});
+		if (cores.size > MAX_SITES) cores.delete(cores.keys().next().value);
+		return core;
+	} };
+}
+const UNKNOWN_HOST = "This app doesn't serve the host this request was sent to: add it to synqAuth()'s hosts if it should";
+/** Why a request to a host the app doesn't serve gets nothing, as the error server code throws. */
+function unknownHostError() {
+	return new SynqError("unknown_host", UNKNOWN_HOST, { status: 421 });
+}
+/**
+* The answer to a request for a host the app doesn't serve: 421 Misdirected
+* Request, as a problem, naming no host and no configuration.
+*/
+function unknownHostResponse() {
+	return Response.json({
+		type: "about:blank",
+		status: 421,
+		code: "unknown_host",
+		detail: UNKNOWN_HOST
+	}, {
+		status: 421,
+		headers: {
+			"content-type": "application/problem+json",
+			"cache-control": "no-store",
+			"x-content-type-options": "nosniff"
+		}
+	});
+}
+//#endregion
+export { signInErrorMessage as a, withoutSignInError as c, memorySessionStore as d, defineSynqPlugin as f, resolveConfig as h, SIGN_IN_ERROR_PARAM as i, createSynqCore as l, normalizePath as m, unknownHostError as n, signInErrorOf as o, requestJar as p, unknownHostResponse as r, signInErrorPage as s, siteCores as t, keyValueSessionStore as u };