@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/internal/SigningKey.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The keys that sign Tempo ID's tokens: the JWT plugin's key options, and the rotation that
+ * `tempo-id admin rotate-key` runs on the `jwks` table. A rotation writes the row that the plugin
+ * writes when it creates a key, with Better Auth's key generation and encryption.
+ * @module
+ */
+import type { GenericEndpointContext } from '@better-auth/core';
+import { type Jwk } from 'better-auth/plugins/jwt';
+import type * as Realm from './Realm.js';
+/**
+ * As many keys as the JWT plugin reads are live or in their grace period, so the plugin would not
+ * read a new key.
+ */
+export declare class FullError extends Error {
+    readonly name = "SigningKey.FullError";
+    constructor();
+}
+/** The table holds no signing key yet, so a rotation has no key to retire. */
+export declare class MissingError extends Error {
+    readonly name = "SigningKey.MissingError";
+    constructor();
+}
+/** The secret does not decrypt the current signing key, so the Worker could not use a new one. */
+export declare class SecretError extends Error {
+    readonly name = "SigningKey.SecretError";
+    constructor();
+}
+/**
+ * Seconds that `GET /oauth2/jwks` serves a key after it stops signing, so verifiers accept the tokens
+ * that it signed before. This is Better Auth's default, 30 days.
+ */
+export declare const gracePeriod: number;
+/**
+ * Seconds between a rotation and the first token that the new key signs. `GET /oauth2/jwks` serves
+ * the new key at once, so a verifier that caches the key set, with a refetch cooldown such as jose's
+ * 30 seconds, holds the key before any token names it.
+ */
+export declare const publication: number;
+/**
+ * The most keys that the JWT plugin reads: Better Auth's default limit on a read. A rotation keeps
+ * the live keys and the keys in their grace period within it.
+ */
+export declare const capacity = 100;
+/** The JWT plugin's `jwks` options. RS256, since Privy and the existing verifiers accept it. */
+export declare const jwks: {
+    gracePeriod: number;
+    jwksPath: string;
+    keyPairConfig: {
+        alg: 'RS256';
+        modulusLength: number;
+    };
+};
+/**
+ * The JWT plugin's read of the `jwks` table: every live key, and every key in its grace period.
+ * Better Auth's own read returns any 100 rows, and a rotation backdates each new key's `createdAt`,
+ * so neither row order nor creation time can pick the keys once retired rows build up.
+ */
+export declare const adapter: {
+    getJwks: (ctx: GenericEndpointContext) => Promise<Jwk[]>;
+};
+/**
+ * Returns the public key that an ID token hint names in its `kid` header, as a key set, retired keys
+ * included, past the grace period too. Logout verifies the hint against it, since a session can
+ * outlast the grace period of the key that signed its ID token. A hint without a `kid`, or with an
+ * unknown one, returns an empty set. Tokens that grant access verify only against the keys that
+ * `GET /oauth2/jwks` serves.
+ */
+export declare function hintKeys(db: Realm.Database, options: hintKeys.Options): Promise<hintKeys.ReturnType>;
+export declare namespace hintKeys {
+    type Options = {
+        /** The ID token hint, whose `kid` header names its signing key. */
+        hint: string;
+    };
+    type ReturnType = {
+        /** Each public key, with its ID as `kid`. */
+        keys: (JsonWebKey & {
+            /** The key's ID, which each token that it signed names as `kid`. */
+            kid: string;
+        })[];
+    };
+}
+/**
+ * Adds a new signing key, which signs every token after the {@link publication} delay, and retires
+ * every earlier key that is still live at the end of that delay. `GET /oauth2/jwks` serves the new key
+ * at once, and serves each retired key until its grace period ends.
+ *
+ * Throws `MissingError` when no key exists, `SecretError` when `secret` does not decrypt the current
+ * key, and `FullError` when `capacity` keys are live or in their grace period.
+ */
+export declare function rotate(db: Realm.Database, options: rotate.Options): Promise<rotate.ReturnType>;
+export declare namespace rotate {
+    type Options = {
+        /** The deployment's `SECRET` variable, which encrypts each private key. */
+        secret: string;
+    };
+    type ReturnType = {
+        /** The new signing key. */
+        key: {
+            /** The key's ID, which each token names as `kid`. */
+            id: string;
+            /** When the key signs its first token, after the publication delay. */
+            signsFrom: Date;
+        };
+        /** The keys that the rotation retires, newest first. */
+        retired: readonly {
+            /** The key's ID. */
+            id: string;
+            /** When `GET /oauth2/jwks` stops serving the key. */
+            servedUntil: Date;
+            /** When the key signs its last token. */
+            signsUntil: Date;
+        }[];
+    };
+}
+//# sourceMappingURL=SigningKey.d.ts.map

package/dist/internal/SigningKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SigningKey.d.ts","sourceRoot":"","sources":["../../src/internal/SigningKey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAG/D,OAAO,EAA2B,KAAK,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAI3E,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAExC;;;GAGG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,0BAAyB;IAE/C,cAIC;CACF;AAED,8EAA8E;AAC9E,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,6BAA4B;IAElD,cAIC;CACF;AAED,kGAAkG;AAClG,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAkB,IAAI,4BAA2B;IAEjD,cAIC;CACF;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAoB,CAAA;AAE5C;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAS,CAAA;AAEjC;;;GAGG;AACH,eAAO,MAAM,QAAQ,MAAM,CAAA;AAE3B,gGAAgG;AAChG,eAAO,MAAM,IAAI;;;;QAGE,GAAG,EAAE,OAAO;QAAW,aAAa;;CACtD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO;IAClB,OAAO,QAAc,sBAAsB;CAiB5C,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAuB9B;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,mEAAmE;QACnE,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IAED,KAAK,UAAU,GAAG;QAChB,6CAA6C;QAC7C,IAAI,EAAE,CAAC,UAAU,GAAG;YAClB,oEAAoE;YACpE,GAAG,EAAE,MAAM,CAAA;SACZ,CAAC,EAAE,CAAA;KACL,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,EAAE,EAAE,KAAK,CAAC,QAAQ,EAClB,OAAO,EAAE,MAAM,CAAC,OAAO,GACtB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAgG5B;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,2EAA2E;QAC3E,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;IAED,KAAK,UAAU,GAAG;QAChB,2BAA2B;QAC3B,GAAG,EAAE;YACH,qDAAqD;YACrD,EAAE,EAAE,MAAM,CAAA;YACV,uEAAuE;YACvE,SAAS,EAAE,IAAI,CAAA;SAChB,CAAA;QACD,wDAAwD;QACxD,OAAO,EAAE,SAAS;YAChB,oBAAoB;YACpB,EAAE,EAAE,MAAM,CAAA;YACV,qDAAqD;YACrD,WAAW,EAAE,IAAI,CAAA;YACjB,yCAAyC;YACzC,UAAU,EAAE,IAAI,CAAA;SACjB,EAAE,CAAA;KACJ,CAAA;CACF"}

package/dist/internal/SigningKey.js

@@ -0,0 +1,197 @@
+import { getCurrentAdapter } from '@better-auth/core/context';
+import { symmetricDecrypt, symmetricEncrypt } from 'better-auth/crypto';
+import { generateExportedKeyPair } from 'better-auth/plugins/jwt';
+import { count, desc, eq, gt, isNull, or, sql } from 'drizzle-orm';
+import { decodeProtectedHeader } from 'jose';
+import * as Schema from '../app/db/schema.js';
+/**
+ * As many keys as the JWT plugin reads are live or in their grace period, so the plugin would not
+ * read a new key.
+ */
+export class FullError extends Error {
+    name = 'SigningKey.FullError';
+    constructor() {
+        super(`Too many signing keys: ${capacity} keys are live or in their 30-day grace period. Rotate again once the oldest grace period ends.`);
+    }
+}
+/** The table holds no signing key yet, so a rotation has no key to retire. */
+export class MissingError extends Error {
+    name = 'SigningKey.MissingError';
+    constructor() {
+        super('No signing key exists. Tempo ID creates the first key when it signs its first token.');
+    }
+}
+/** The secret does not decrypt the current signing key, so the Worker could not use a new one. */
+export class SecretError extends Error {
+    name = 'SigningKey.SecretError';
+    constructor() {
+        super("Invalid SECRET: it does not decrypt the current signing key. Set SECRET to the deployment's SECRET variable.");
+    }
+}
+/**
+ * Seconds that `GET /oauth2/jwks` serves a key after it stops signing, so verifiers accept the tokens
+ * that it signed before. This is Better Auth's default, 30 days.
+ */
+export const gracePeriod = 60 * 60 * 24 * 30;
+/**
+ * Seconds between a rotation and the first token that the new key signs. `GET /oauth2/jwks` serves
+ * the new key at once, so a verifier that caches the key set, with a refetch cooldown such as jose's
+ * 30 seconds, holds the key before any token names it.
+ */
+export const publication = 5 * 60;
+/**
+ * The most keys that the JWT plugin reads: Better Auth's default limit on a read. A rotation keeps
+ * the live keys and the keys in their grace period within it.
+ */
+export const capacity = 100;
+/** The JWT plugin's `jwks` options. RS256, since Privy and the existing verifiers accept it. */
+export const jwks = {
+    gracePeriod,
+    jwksPath: '/oauth2/jwks',
+    keyPairConfig: { alg: 'RS256', modulusLength: 2048 },
+};
+/**
+ * The JWT plugin's read of the `jwks` table: every live key, and every key in its grace period.
+ * Better Auth's own read returns any 100 rows, and a rotation backdates each new key's `createdAt`,
+ * so neither row order nor creation time can pick the keys once retired rows build up.
+ */
+export const adapter = {
+    getJwks: async (ctx) => await (await getCurrentAdapter(ctx.context.adapter)).findMany({
+        limit: capacity,
+        model: 'jwks',
+        sortBy: { direction: 'desc', field: 'createdAt' },
+        where: [
+            { connector: 'OR', field: 'expiresAt', value: null },
+            {
+                connector: 'OR',
+                field: 'expiresAt',
+                operator: 'gt',
+                value: new Date(Date.now() - gracePeriod * 1000),
+            },
+        ],
+    }),
+};
+/**
+ * Returns the public key that an ID token hint names in its `kid` header, as a key set, retired keys
+ * included, past the grace period too. Logout verifies the hint against it, since a session can
+ * outlast the grace period of the key that signed its ID token. A hint without a `kid`, or with an
+ * unknown one, returns an empty set. Tokens that grant access verify only against the keys that
+ * `GET /oauth2/jwks` serves.
+ */
+export async function hintKeys(db, options) {
+    // The header is read before the signature is checked, so a forged hint costs one indexed read.
+    const kid = (() => {
+        try {
+            return decodeProtectedHeader(options.hint).kid;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (!kid)
+        return { keys: [] };
+    const rows = await db
+        .select()
+        .from(Schema.jwks)
+        .where(eq(Schema.jwks.id, kid))
+        .limit(1);
+    return {
+        keys: rows.map((row) => ({
+            ...JSON.parse(row.publicKey),
+            alg: row.alg ?? jwks.keyPairConfig.alg,
+            kid: row.id,
+        })),
+    };
+}
+/**
+ * Adds a new signing key, which signs every token after the {@link publication} delay, and retires
+ * every earlier key that is still live at the end of that delay. `GET /oauth2/jwks` serves the new key
+ * at once, and serves each retired key until its grace period ends.
+ *
+ * Throws `MissingError` when no key exists, `SecretError` when `secret` does not decrypt the current
+ * key, and `FullError` when `capacity` keys are live or in their grace period.
+ */
+export async function rotate(db, options) {
+    const { secret } = options;
+    return await db.transaction(async (tx) => {
+        // Serializes rotations, and keeps the Worker from creating a key between the read and the writes.
+        // Reads proceed, so the Worker signs with the current key until the commit.
+        await tx.execute(sql `lock table ${Schema.jwks} in share row exclusive mode`);
+        // The database's clock, which every deployment shares, so a skewed clock on the machine that
+        // runs the command cannot end the publication delay early. `clock_timestamp()` reads it after the
+        // lock, where `now()` would return the transaction's start and count the wait for the lock.
+        const [clock] = await tx
+            .select({
+            now: sql `(extract(epoch from clock_timestamp()) * 1000)::float8`,
+        })
+            .from(Schema.jwks)
+            .limit(1);
+        if (!clock)
+            throw new MissingError();
+        const now = new Date(Number(clock.now));
+        const signsFrom = new Date(now.getTime() + publication * 1000);
+        const live = await tx
+            .select()
+            .from(Schema.jwks)
+            .where(or(isNull(Schema.jwks.expiresAt), gt(Schema.jwks.expiresAt, now)))
+            .orderBy(desc(Schema.jwks.createdAt));
+        const [current] = live;
+        const oldest = live.at(-1);
+        if (!current || !oldest)
+            throw new MissingError();
+        // A key encrypted with another secret would fail every signature, so the rotation checks first.
+        const decrypted = await symmetricDecrypt({
+            data: JSON.parse(current.privateKey),
+            key: secret,
+        }).catch(() => undefined);
+        if (decrypted === undefined)
+            throw new SecretError();
+        // The read returns at most `capacity` rows, and a rotated key sorts last, so one more would hide it.
+        // The Worker applies the grace cutoff by its own clock, so the count also includes the keys whose
+        // grace period ended up to `publication` seconds ago, in case that clock is behind the database's.
+        const [served] = await tx
+            .select({ count: count() })
+            .from(Schema.jwks)
+            .where(or(isNull(Schema.jwks.expiresAt), gt(Schema.jwks.expiresAt, new Date(now.getTime() - (gracePeriod + publication) * 1000))));
+        if (served.count >= capacity)
+            throw new FullError();
+        const pair = await generateExportedKeyPair({ jwks });
+        const [key] = await tx
+            .insert(Schema.jwks)
+            .values({
+            alg: pair.alg,
+            // Better Auth signs with the live key of the latest `createdAt`. A `createdAt` before every
+            // live key's keeps the new key from signing until the earlier keys expire at `signsFrom`.
+            createdAt: new Date(oldest.createdAt.getTime() - 1),
+            id: crypto.randomUUID(),
+            // The JWT plugin stores the encrypted key as a JSON string.
+            privateKey: JSON.stringify(await symmetricEncrypt({
+                data: JSON.stringify(pair.privateWebKey),
+                key: secret,
+            })),
+            publicKey: JSON.stringify(pair.publicWebKey),
+        })
+            .returning({ id: Schema.jwks.id });
+        // A key that an earlier rotation already retires keeps its earlier expiry.
+        const retired = live.map((entry) => ({
+            expiresAt: entry.expiresAt && entry.expiresAt < signsFrom
+                ? entry.expiresAt
+                : signsFrom,
+            id: entry.id,
+        }));
+        for (const entry of retired)
+            await tx
+                .update(Schema.jwks)
+                .set({ expiresAt: entry.expiresAt })
+                .where(eq(Schema.jwks.id, entry.id));
+        return {
+            key: { id: key.id, signsFrom },
+            retired: retired.map((entry) => ({
+                id: entry.id,
+                servedUntil: new Date(entry.expiresAt.getTime() + gracePeriod * 1000),
+                signsUntil: entry.expiresAt,
+            })),
+        };
+    });
+}
+//# sourceMappingURL=SigningKey.js.map

package/dist/internal/SigningKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SigningKey.js","sourceRoot":"","sources":["../../src/internal/SigningKey.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAAE,uBAAuB,EAAY,MAAM,yBAAyB,CAAA;AAC3E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAG7C;;;GAGG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,IAAI,GAAG,sBAAsB,CAAA;IAE/C;QACE,KAAK,CACH,0BAA0B,QAAQ,iGAAiG,CACpI,CAAA;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,yBAAyB,CAAA;IAElD;QACE,KAAK,CACH,sFAAsF,CACvF,CAAA;IACH,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClB,IAAI,GAAG,wBAAwB,CAAA;IAEjD;QACE,KAAK,CACH,8GAA8G,CAC/G,CAAA;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,CAAA;AAEjC;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAA;AAE3B,gGAAgG;AAChG,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,WAAW;IACX,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,EAAE,GAAG,EAAE,OAAgB,EAAE,aAAa,EAAE,IAAI,EAAE;CAC9D,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE,KAAK,EAAE,GAA2B,EAAE,EAAE,CAC7C,MAAM,CACJ,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAC7C,CAAC,QAAQ,CAAM;QACd,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE;QACjD,KAAK,EAAE;YACL,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE;YACpD;gBACE,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC;aACjD;SACF;KACF,CAAC;CACL,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,EAAkB,EAClB,OAAyB;IAEzB,+FAA+F;IAC/F,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE;QAChB,IAAI,CAAC;YACH,OAAO,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;IAE7B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;SACjB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;SAC9B,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAgB;YAC5C,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG;YACtC,GAAG,EAAE,GAAG,CAAC,EAAE;SACZ,CAAC,CAAC;KACJ,CAAA;AACH,CAAC;AAiBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,EAAkB,EAClB,OAAuB;IAEvB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,kGAAkG;QAClG,4EAA4E;QAC5E,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,cAAc,MAAM,CAAC,IAAI,8BAA8B,CAAC,CAAA;QAE5E,6FAA6F;QAC7F,kGAAkG;QAClG,4FAA4F;QAC5F,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACN,GAAG,EAAE,GAAG,CAAQ,wDAAwD;SACzE,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;aACjB,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,YAAY,EAAE,CAAA;QACpC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;aACxE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QACvC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,YAAY,EAAE,CAAA;QAEjD,gGAAgG;QAChG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAW;YAC9C,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,WAAW,EAAE,CAAA;QAEpD,qGAAqG;QACrG,kGAAkG;QAClG,mGAAmG;QACnG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;aAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;aACjB,KAAK,CACJ,EAAE,CACA,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7B,EAAE,CACA,MAAM,CAAC,IAAI,CAAC,SAAS,EACrB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,CAC7D,CACF,CACF,CAAA;QACH,IAAI,MAAO,CAAC,KAAK,IAAI,QAAQ;YAAE,MAAM,IAAI,SAAS,EAAE,CAAA;QAEpD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;aACnB,MAAM,CAAC;YACN,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,4FAA4F;YAC5F,0FAA0F;YAC1F,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnD,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,4DAA4D;YAC5D,UAAU,EAAE,IAAI,CAAC,SAAS,CACxB,MAAM,gBAAgB,CAAC;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC;gBACxC,GAAG,EAAE,MAAM;aACZ,CAAC,CACH;YACD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC;SAC7C,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAEpC,2EAA2E;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,SAAS,EACP,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,SAAS;gBAC5C,CAAC,CAAC,KAAK,CAAC,SAAS;gBACjB,CAAC,CAAC,SAAS;YACf,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAC,CAAA;QACH,KAAK,MAAM,KAAK,IAAI,OAAO;YACzB,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;iBACnB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;iBACnC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAExC,OAAO;YACL,GAAG,EAAE,EAAE,EAAE,EAAE,GAAI,CAAC,EAAE,EAAE,SAAS,EAAE;YAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC;gBACrE,UAAU,EAAE,KAAK,CAAC,SAAS;aAC5B,CAAC,CAAC;SACJ,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/internal/TestInbox.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Selects the sign-in codes that a deployment sends to its test inbox instead of emailing them. A
+ * preview sets `TEST_EMAIL_DOMAIN` and binds `TEST_INBOX`, so the end-to-end suite reads the codes of
+ * its test addresses, while every other address still receives email. Only domains that RFC 2606
+ * reserves qualify, so no deployment can divert a real address.
+ * @module
+ */
+/** The domains that a test inbox can receive, which RFC 2606 reserves, so no real address uses them. */
+export declare const domains: readonly ['example.com', 'example.net', 'example.org'];
+/** A domain that a test inbox can receive. */
+export type Domain = (typeof domains)[number];
+/** A message to a test inbox, in the shape of Void's development inbox. */
+export type Message = {
+    /** The subject line. */
+    subject: string;
+    /** The plain-text body. */
+    text: string;
+    /** The recipients. */
+    to: readonly {
+        /** The recipient's address. */
+        email: string;
+    }[];
+};
+/** The test inbox's `Capture` entrypoint, which a deployment binds as `TEST_INBOX`. */
+export type Service = {
+    /** Stores `message`. */
+    capture(message: Message): Promise<void>;
+};
+/**
+ * Returns whether `email` belongs at the test inbox: `domain` is one of {@link domains}, and the
+ * address's domain is exactly `domain`. Returns `false` when `domain` is absent.
+ */
+export declare function matches(options: matches.Options): boolean;
+export declare namespace matches {
+    type Options = {
+        /** The deployment's `TEST_EMAIL_DOMAIN`, or `undefined` when it sets none. */
+        domain?: string | undefined;
+        /** The recipient's address. */
+        email: string;
+    };
+}
+//# sourceMappingURL=TestInbox.d.ts.map

package/dist/internal/TestInbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TestInbox.d.ts","sourceRoot":"","sources":["../../src/internal/TestInbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wGAAwG;AACxG,eAAO,MAAM,OAAO,YAAI,aAAa,EAAE,aAAa,EAAE,aAAa,CAAU,CAAA;AAE7E,8CAA8C;AAC9C,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7C,2EAA2E;AAC3E,MAAM,MAAM,OAAO,GAAG;IACpB,wBAAwB;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,sBAAsB;IACtB,EAAE,EAAE,SAAS;QACX,+BAA+B;QAC/B,KAAK,EAAE,MAAM,CAAA;KACd,EAAE,CAAA;CACJ,CAAA;AAED,uFAAuF;AACvF,MAAM,MAAM,OAAO,GAAG;IACpB,wBAAwB;IACxB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC,CAAA;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,WAI/C;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,GAAG;QACb,8EAA8E;QAC9E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,+BAA+B;QAC/B,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF"}

package/dist/internal/TestInbox.js

@@ -0,0 +1,20 @@
+/**
+ * Selects the sign-in codes that a deployment sends to its test inbox instead of emailing them. A
+ * preview sets `TEST_EMAIL_DOMAIN` and binds `TEST_INBOX`, so the end-to-end suite reads the codes of
+ * its test addresses, while every other address still receives email. Only domains that RFC 2606
+ * reserves qualify, so no deployment can divert a real address.
+ * @module
+ */
+/** The domains that a test inbox can receive, which RFC 2606 reserves, so no real address uses them. */
+export const domains = ['example.com', 'example.net', 'example.org'];
+/**
+ * Returns whether `email` belongs at the test inbox: `domain` is one of {@link domains}, and the
+ * address's domain is exactly `domain`. Returns `false` when `domain` is absent.
+ */
+export function matches(options) {
+    const { domain, email } = options;
+    if (!domain || !domains.some((entry) => entry === domain))
+        return false;
+    return email.toLowerCase().endsWith(`@${domain}`);
+}
+//# sourceMappingURL=TestInbox.js.map

package/dist/internal/TestInbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TestInbox.js","sourceRoot":"","sources":["../../src/internal/TestInbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wGAAwG;AACxG,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAU,CAAA;AAwB7E;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAAwB;IAC9C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACvE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAA;AACnD,CAAC"}

package/dist/internal/Timing.d.ts

@@ -0,0 +1,51 @@
+import type { Env } from './Env.js';
+/** One awaited call. */
+export type Span = {
+    /** When the call settled, in the request's sequence of opens and settles. Pending spans hold `Infinity`. */
+    closed: number;
+    /**
+     * What the header shows beside the span, such as an in-process call's path. Logs leave it out,
+     * since a path can carry a device's user code.
+     */
+    description?: string | undefined;
+    /** How long the call took, in milliseconds. */
+    duration: number;
+    /**
+     * `service.operation` for a call to another service, such as `db.session.get`, or
+     * `Module.function` for a step of Tempo ID's own, such as `Session.get`.
+     */
+    name: string;
+    /** When the call's span opened, in the request's sequence of opens and settles. */
+    opened: number;
+    /** When the call started, in milliseconds after the request did. */
+    start: number;
+};
+/** A request's timings, which {@link middleware} creates and {@link measure} appends to. */
+export type Timing = {
+    /** How many spans opened or settled so far, which orders spans that start at the same instant. */
+    events: number;
+    /** The request's spans, in the order they opened. A span still pending has a zero duration. */
+    spans: Span[];
+    /** When the request started, from `performance.now()`. */
+    start: number;
+};
+/**
+ * Awaits `promise` as the span `name`, and returns its result. A rejection is timed too, then
+ * rethrown. Concurrent spans may share a name. The header shows `description` beside the span, and
+ * logs leave it out.
+ */
+export declare function measure<promise extends PromiseLike<unknown>>(c: measure.Context, promise: promise, name: string, description?: string): Promise<Awaited<promise>>;
+export declare namespace measure {
+    /** A context that carries the request's timing, such as a route's or a page loader's. */
+    type Context = {
+        /** The request's variables. */
+        var: Pick<Env['Variables'], 'timing'>;
+    };
+}
+/**
+ * Times the request. Once the response is ready, it appends a `Server-Timing` header with the
+ * request's `total` and each span. Outside the Vite dev server, it also logs the same timings. A
+ * streamed page's `total` ends when its headers are ready.
+ */
+export declare const middleware: import("hono").MiddlewareHandler<Env, string, {}, Response>;
+//# sourceMappingURL=Timing.d.ts.map

package/dist/internal/Timing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Timing.d.ts","sourceRoot":"","sources":["../../src/internal/Timing.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAGnC,wBAAwB;AACxB,MAAM,MAAM,IAAI,GAAG;IACjB,4GAA4G;IAC5G,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAA;IACd,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAA;IACd,+FAA+F;IAC/F,KAAK,EAAE,IAAI,EAAE,CAAA;IACb,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,EAChE,CAAC,EAAE,OAAO,CAAC,OAAO,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAkB3B;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,yFAAyF;IACzF,KAAK,OAAO,GAAG;QACb,+BAA+B;QAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAA;KACtC,CAAA;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,6DAmCrB,CAAA"}

package/dist/internal/Timing.js

@@ -0,0 +1,103 @@
+/**
+ * Request timings: how long each call that a request awaits takes. The calls range from Tempo ID's
+ * own steps to the Better Auth, database, and email calls inside them. The middleware sends them in
+ * a `Server-Timing` header, which browser developer tools show beside each request. Outside the Vite
+ * dev server, it also logs them with `Log.info`. Workers advance the clock only across I/O, so a span
+ * measures the I/O it awaits, and computation reads as zero.
+ * @module
+ */
+import { createMiddleware } from 'hono/factory';
+import * as Log from './Log.js';
+/**
+ * Awaits `promise` as the span `name`, and returns its result. A rejection is timed too, then
+ * rethrown. Concurrent spans may share a name. The header shows `description` beside the span, and
+ * logs leave it out.
+ */
+export async function measure(c, promise, name, description) {
+    const timing = c.var.timing;
+    const start = performance.now();
+    const span = {
+        closed: Infinity,
+        ...(description ? { description } : {}),
+        duration: 0,
+        name,
+        opened: timing.events++,
+        start: start - timing.start,
+    };
+    timing.spans.push(span);
+    try {
+        return await promise;
+    }
+    finally {
+        span.closed = timing.events++;
+        span.duration = performance.now() - start;
+    }
+}
+/**
+ * Times the request. Once the response is ready, it appends a `Server-Timing` header with the
+ * request's `total` and each span. Outside the Vite dev server, it also logs the same timings. A
+ * streamed page's `total` ends when its headers are ready.
+ */
+export const middleware = createMiddleware(async (c, next) => {
+    const timing = { events: 0, spans: [], start: performance.now() };
+    c.set('timing', timing);
+    await next();
+    const total = performance.now() - timing.start;
+    const spans = order(timing.spans);
+    c.res.headers.append('server-timing', [`total;dur=${round(total)}`, ...spans.map(serialize)].join(', '));
+    // The dev server prints every entry to the terminal, and the header carries the same spans.
+    if (Log.dev())
+        return;
+    // Without the context, `Log` leaves the request's path out, since callers control it and it can
+    // carry a user code. The route pattern stands in, and pages without a route share `/*`.
+    Log.info({
+        fields: {
+            duration: round(total),
+            errorCode: c.var.refusal?.error,
+            method: c.req.method,
+            reason: c.var.refusal?.reason,
+            requestId: c.var.requestId,
+            route: Log.route(c),
+            spans: spans
+                .map((span) => `${span.name};dur=${round(span.duration)};start=${round(span.start)}`)
+                .join(', '),
+            status: c.res.status,
+        },
+        message: 'The Worker timed a request.',
+    });
+});
+/**
+ * Orders spans with each step before the calls inside it. The order reads only the sequence of
+ * opens and settles, since the clock can advance between the span of a call and the span of its
+ * step. Spans that open with no settle between them all overlap. Of those, the one that settles
+ * last encloses the others, since a step's promise is created before the step's span opens. Spans
+ * that open after a settle come after.
+ */
+function order(spans) {
+    // `spans` holds the spans in the order they opened, so each event before a span that is not an
+    // earlier span's open is a settle.
+    return spans
+        .map((span, index) => ({ settles: span.opened - index, span }))
+        .toSorted((a, b) => {
+        if (a.settles !== b.settles)
+            return a.settles - b.settles;
+        // Pending spans hold `Infinity`, which subtraction cannot compare.
+        if (a.span.closed !== b.span.closed)
+            return a.span.closed > b.span.closed ? -1 : 1;
+        return a.span.opened - b.span.opened;
+    })
+        .map((entry) => entry.span);
+}
+/** Rounds milliseconds to one decimal. */
+function round(milliseconds) {
+    return Math.round(milliseconds * 10) / 10;
+}
+/** Serializes a span as a `Server-Timing` metric. */
+function serialize(span) {
+    const metric = `${span.name};dur=${round(span.duration)}`;
+    if (!span.description)
+        return metric;
+    // The description is a quoted string, which escapes quotes and backslashes.
+    return `${metric};desc="${span.description.replace(/["\\]/g, '\\$&')}"`;
+}
+//# sourceMappingURL=Timing.js.map

package/dist/internal/Timing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Timing.js","sourceRoot":"","sources":["../../src/internal/Timing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAkC/B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,CAAkB,EAClB,OAAgB,EAChB,IAAY,EACZ,WAAoB;IAEpB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;IAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAS;QACjB,MAAM,EAAE,QAAQ;QAChB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,QAAQ,EAAE,CAAC;QACX,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACvB,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK;KAC5B,CAAA;IACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAA;IACtB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;QAC7B,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAA;IAC3C,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAM,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChE,MAAM,MAAM,GAAW,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,EAAE,CAAA;IACzE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACvB,MAAM,IAAI,EAAE,CAAA;IAEZ,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAA;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAClB,eAAe,EACf,CAAC,aAAa,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClE,CAAA;IAED,4FAA4F;IAC5F,IAAI,GAAG,CAAC,GAAG,EAAE;QAAE,OAAM;IAErB,gGAAgG;IAChG,wFAAwF;IACxF,GAAG,CAAC,IAAI,CAAC;QACP,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;YACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK;YAC/B,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;YAC7B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnB,KAAK,EAAE,KAAK;iBACT,GAAG,CACF,CAAC,IAAI,EAAE,EAAE,CACP,GAAG,IAAI,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACxE;iBACA,IAAI,CAAC,IAAI,CAAC;YACb,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;SACrB;QACD,OAAO,EAAE,6BAA6B;KACvC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,KAAsB;IACnC,+FAA+F;IAC/F,mCAAmC;IACnC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;SAC9D,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjB,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;QACzD,mEAAmE;QACnE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM;YACjC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtC,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,0CAA0C;AAC1C,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,EAAE,CAAA;AAC3C,CAAC;AAED,qDAAqD;AACrD,SAAS,SAAS,CAAC,IAAU;IAC3B,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAA;IACzD,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAA;IACpC,4EAA4E;IAC5E,OAAO,GAAG,MAAM,UAAU,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAA;AACzE,CAAC"}

package/dist/internal/Validation.d.ts

@@ -0,0 +1,52 @@
+/** Turns a failed request validation into an `invalid_field` refusal that names each field. @module */
+import * as ErrorResponse from './ErrorResponse.js';
+declare const InvalidFieldError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "invalid_request";
+            reason: "invalid_field";
+        };
+    };
+    readonly reason: "invalid_field";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** A field is missing or malformed. Names each field the issues refused, with what it expects. `field` is the first. */
+export declare class InvalidFieldError extends InvalidFieldError_base {
+    readonly name = "Validation.InvalidFieldError";
+    constructor(options: InvalidFieldError.Options);
+}
+export declare namespace InvalidFieldError {
+    type Options = {
+        /** The issues validation reported. */
+        issues: readonly Issue[];
+    };
+    /** A Standard Schema issue, as Zod and Hono's validators report it. */
+    type Issue = {
+        /** The validator's description of the problem. */
+        message: string;
+        /** The segments from the input's root to the refused value. Absent for the root itself. */
+        path?: readonly (PropertyKey | {
+            /** The segment's property key. */
+            key: PropertyKey;
+        })[] | undefined;
+    };
+}
+export {};
+//# sourceMappingURL=Validation.d.ts.map

package/dist/internal/Validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.d.ts","sourceRoot":"","sources":["../../src/internal/Validation.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEnD,wHAAwH;AACxH,qBAAa,iBAAkB,SAAQ,sBAAqC;IAC1E,SAAkB,IAAI,kCAAiC;IAEvD,YAAY,OAAO,EAAE,iBAAiB,CAAC,OAAO,EAW7C;CACF;AAED,MAAM,CAAC,OAAO,WAAW,iBAAiB,CAAC;IACzC,KAAK,OAAO,GAAG;QACb,sCAAsC;QACtC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAA;KACzB,CAAA;IAED,uEAAuE;IACvE,KAAK,KAAK,GAAG;QACX,kDAAkD;QAClD,OAAO,EAAE,MAAM,CAAA;QACf,2FAA2F;QAC3F,IAAI,CAAC,EACD,SAAS,CACL,WAAW,GACX;YACE,kCAAkC;YAClC,GAAG,EAAE,WAAW,CAAA;SACjB,CACJ,EAAE,GACH,SAAS,CAAA;KACd,CAAA;CACF"}

package/dist/internal/Validation.js

@@ -0,0 +1,22 @@
+/** Turns a failed request validation into an `invalid_field` refusal that names each field. @module */
+import * as ErrorResponse from './ErrorResponse.js';
+/** A field is missing or malformed. Names each field the issues refused, with what it expects. `field` is the first. */
+export class InvalidFieldError extends ErrorResponse.define('invalid_field') {
+    name = 'Validation.InvalidFieldError';
+    constructor(options) {
+        const { issues } = options;
+        super({
+            error_description: `Invalid request. ${issues
+                .map((issue) => `${path(issue) ? `\`${path(issue)}\`` : 'Body'}: ${issue.message}.`)
+                .join(' ')}`,
+            field: issues[0] && path(issues[0]) ? path(issues[0]) : undefined,
+        });
+    }
+}
+/** The dotted path of the field `issue` refused. */
+function path(issue) {
+    return (issue.path ?? [])
+        .map((segment) => typeof segment === 'object' ? String(segment.key) : String(segment))
+        .join('.');
+}
+//# sourceMappingURL=Validation.js.map

package/dist/internal/Validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.js","sourceRoot":"","sources":["../../src/internal/Validation.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,wHAAwH;AACxH,MAAM,OAAO,iBAAkB,SAAQ,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;IACxD,IAAI,GAAG,8BAA8B,CAAA;IAEvD,YAAY,OAAkC;QAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,KAAK,CAAC;YACJ,iBAAiB,EAAE,oBAAoB,MAAM;iBAC1C,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,GAAG,CACtE;iBACA,IAAI,CAAC,GAAG,CAAC,EAAE;YACd,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC,CAAA;IACJ,CAAC;CACF;AAyBD,oDAAoD;AACpD,SAAS,IAAI,CAAC,KAA8B;IAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;SACtB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACpE;SACA,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}