@tula-tech/contract 0.0.0-stage → 0.1.0-alpha.1

package/dist/redirect-url.d.ts

@@ -0,0 +1,223 @@
+/**
+* Schemes that are never a custom-scheme redirect, whatever follows the colon: the two web
+* schemes (which have rules of their own) and the ones a browser or an operating system
+* handles itself, where a redirect would run script, open a file, start a call or hand the
+* URL to something that is nobody's app.
+*
+* **Best effort, and no more.** The entries without a full stop are also refused by the
+* rule that a custom scheme contains one; the ones with a full stop, and the families of
+* {@link REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM}, are refused by this list alone, and a
+* scheme an operating system handles that nobody put here passes. What bounds that is not
+* the list: every entry of `urls.allowedRedirectUrls` is written by the operator by hand,
+* and a redirect carries only a ticket that is useless without the binding (ADR 0044).
+*
+* @example
+* ```ts
+* REDIRECT_SCHEMES_NEVER_CUSTOM.includes('javascript') // true
+* ```
+*/
+declare const REDIRECT_SCHEMES_NEVER_CUSTOM: readonly ["http", "https", "javascript", "vbscript", "data", "file", "filesystem", "blob", "about", "mailto", "tel", "sms", "facetime", "geo", "maps", "intent", "content", "android-app", "market", "itms", "itms-apps", "itms-services", "app-settings", "ms-settings", "x-apple.systempreferences", "ftp", "ws", "wss", "chrome", "chrome-extension", "moz-extension", "resource", "jar", "cid", "mid", "view-source"];
+/**
+* Families of schemes that are never a custom-scheme redirect: every scheme that starts
+* with one of these. They are written with full stops, so the reverse-domain rule lets
+* them through, and each belongs to a platform and to no operator's app: the schemes of
+* Windows' built-in apps (`microsoft.windows.camera`, `microsoft.windows.photos.crop`, …),
+* Apple's `x-apple.` schemes (`x-apple.systempreferences`) and Apple's own bundle-id space
+* (`com.apple.`, which no third party's app can be in).
+*
+* Best effort, like {@link REDIRECT_SCHEMES_NEVER_CUSTOM}: a family that is not here passes.
+*
+* @example
+* ```ts
+* REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM.some((family) => 'com.apple.tv'.startsWith(family)) // true
+* ```
+*/
+declare const REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM: readonly ["microsoft.windows.", "x-apple.", "com.apple."];
+/**
+* The kinds of redirect URL an environment may list.
+*
+* @example
+* ```ts
+* const kind: RedirectUrlKind = 'custom_scheme'
+* ```
+*/
+type RedirectUrlKind = "https" | "loopback" | "custom_scheme";
+/**
+* Whether `value` holds a character no redirect URL of any kind may hold:
+*
+* - whitespace (`\s`) or a wildcard (`*`);
+* - a backslash or a control character (U+0000 to U+001F, U+007F to U+009F);
+* - a character that draws nothing, which is what `hasInvisibleCharacter` says: the one
+*   class `[\p{Cf}\p{Variation_Selector}\p{Default_Ignorable_Code_Point}]`, so every format
+*   character (the zero-width space, joiner and non-joiner, the word joiner, the soft
+*   hyphen, the Mongolian vowel separator, the text-direction controls, the tag
+*   characters), the variation selectors (U+FE00 to U+FE0F, U+E0100 to U+E01EF) and whatever
+*   else Unicode ignores by default (the combining grapheme joiner, the Hangul fillers);
+* - what `hasHiddenCharacter` refuses beside those: a private-use character (`Co`), an
+*   unassigned one (`Cn`), a lone surrogate.
+*
+* A `Location` header cannot carry the controls, and a reader cannot see the rest: two
+* entries that differ by a zero-width space read the same on every screen. An entry is
+* compared as the string it is, so it holds only what can be seen. A visible letter outside
+* ASCII (`münchen.de`) and a percent-encoded octet (`%20`, `%E2%80%8B`) are not refused.
+*
+* The server asks this of every URL it is about to redirect to, listed or not, so that a
+* stored entry from before a rule is refused when a sign-in starts and never at the
+* provider's callback, where the state is already spent.
+*
+* @param value - A URL.
+* @returns `true` when it holds such a character.
+*
+* @example
+* ```ts
+* hasForbiddenRedirectCharacter('https://a.com/\u{202E}x') // true
+* hasForbiddenRedirectCharacter('https://a.com/x\u{200B}y') // true
+* hasForbiddenRedirectCharacter('https://a.com/cb?x=1') // false
+* ```
+*/
+declare function hasForbiddenRedirectCharacter(value: string): boolean;
+/**
+* Which kind of redirect URL `value` is, or `null` when an environment may not list it.
+*
+* - `https`: any absolute URL that starts with `https://` (lower case) and has no
+*   credentials, fragment, wildcard, whitespace, backslash, control character (U+0000 to
+*   U+001F, U+007F to U+009F), character that draws nothing (`hasInvisibleCharacter`: `Cf`,
+*   the variation selectors, `Default_Ignorable_Code_Point`) or character
+*   `hasHiddenCharacter` refuses. A query is allowed.
+*   An app link is one of these.
+* - `loopback`: the same over `http://` for `localhost`, `127.0.0.1` and `[::1]`.
+* - `custom_scheme`: `<scheme>:/<path>` or `<scheme>://<host>/<path>` where the scheme is in
+*   reverse-domain form (lower case, **with a full stop**: `com.example.app`), is not one of
+*   {@link REDIRECT_SCHEMES_NEVER_CUSTOM} nor in a family of
+*   {@link REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM}, and what follows is slashes and the characters
+*   `A-Z a-z 0-9 . _ ~ -` only. So: no user name or password, no port, **no query**, no
+*   fragment (the server adds one), no wildcard, no percent-encoded octet, no `.` or `..`
+*   segment, and no control or invisible character.
+*
+* Nothing is normalised, for any kind: the string that is listed is the string a request
+* must send, character for character.
+*
+* @param value - A URL as an operator wrote it.
+* @returns Its kind, or `null`.
+*
+* @example
+* ```ts
+* redirectUrlKind('com.example.app:/oauth') // 'custom_scheme'
+* redirectUrlKind('myapp://callback') // null: no full stop in the scheme
+* redirectUrlKind('javascript:alert(1)') // null
+* ```
+*/
+declare function redirectUrlKind(value: string): RedirectUrlKind | null;
+/**
+* Whether an environment may list `value` in `urls.allowedRedirectUrls`.
+*
+* @param value - A URL as an operator wrote it.
+* @returns `true` for any {@link RedirectUrlKind}.
+*
+* @example
+* ```ts
+* isRedirectUrl('https://app.example.com/oauth/callback') // true
+* ```
+*/
+declare function isRedirectUrl(value: string): boolean;
+/**
+* Whether `value` is a custom-scheme redirect URL ({@link redirectUrlKind}).
+*
+* @param value - A URL.
+* @returns `true` only for the `custom_scheme` kind.
+*
+* @example
+* ```ts
+* isCustomSchemeRedirectUrl('com.example.app:/oauth') // true
+* isCustomSchemeRedirectUrl('https://app.example.com/oauth') // false
+* ```
+*/
+declare function isCustomSchemeRedirectUrl(value: string): boolean;
+/**
+* The providers whose authorization code Tula binds to the attempt with PKCE (ADR 0026): the
+* code is redeemable only with the verifier the attempt holds.
+*
+* @example
+* ```ts
+* OAUTH_PROVIDERS_WITH_PKCE.includes('google') // true
+* ```
+*/
+declare const OAUTH_PROVIDERS_WITH_PKCE: readonly ["google", "github", "microsoft", "discord", "x"];
+/**
+* The providers that do **not** bind their code with PKCE, as a fact about the provider and
+* not a setting: Apple and LinkedIn document none, and Facebook's has it only in a flow that
+* is not used (ADR 0026).
+*
+* A provider sign-in with one of them is never returned to a custom scheme
+* ({@link customSchemeRedirectRefusal}). A new provider is added to this list or to
+* {@link OAUTH_PROVIDERS_WITH_PKCE}; a test fails for one that is in neither.
+*
+* @example
+* ```ts
+* OAUTH_PROVIDERS_WITHOUT_PKCE.includes('apple') // true
+* ```
+*/
+declare const OAUTH_PROVIDERS_WITHOUT_PKCE: readonly ["apple", "linkedin", "facebook"];
+/**
+* Whether a provider's code is bound to the attempt with PKCE
+* ({@link OAUTH_PROVIDERS_WITH_PKCE}). The one place that says so.
+*
+* @param provider - A provider's name.
+* @returns `true` only for a provider on the list; `false` for any other string.
+*
+* @example
+* ```ts
+* bindsCodeWithPkce('google') // true
+* bindsCodeWithPkce('apple') // false
+* ```
+*/
+declare function bindsCodeWithPkce(provider: string): boolean;
+/**
+* Why a listed custom-scheme redirect URL is still refused for one request, as the fixed word
+* in `params.reason` of `request.redirect_not_allowed`:
+*
+* - `provider_without_pkce`: the provider's code is not bound with PKCE.
+* - `client_not_native`: the attempt was not started as a native client (`x-tula-client: ios` or
+*   `android`).
+* - `not_a_provider_sign_in`: the redirect is not for a provider sign-in (an emailed link).
+*
+* @example
+* ```ts
+* const reason: CustomSchemeRedirectRefusal = CUSTOM_SCHEME_REDIRECT_REFUSALS[0]
+* ```
+*/
+declare const CUSTOM_SCHEME_REDIRECT_REFUSALS: readonly ["provider_without_pkce", "client_not_native", "not_a_provider_sign_in"];
+/** One of {@link CUSTOM_SCHEME_REDIRECT_REFUSALS}. */
+type CustomSchemeRedirectRefusal = (typeof CUSTOM_SCHEME_REDIRECT_REFUSALS)[number];
+/**
+* Why a redirect to `url` is refused for this use although the environment lists it, or
+* `null` when it is not.
+*
+* Only a custom-scheme URL is ever refused here. Any app on the device can claim a scheme,
+* so the app that receives the redirect may be another one. What then keeps a sign-in from
+* being completed by it:
+*
+* - the provider's code is bound with PKCE, so a provider that is told to return to the
+*   scheme's owner cannot be made to hand a usable code to someone else. Without PKCE the
+*   redirect is refused, whatever else holds;
+* - the attempt belongs to a native client. A browser page has no use for a custom scheme,
+*   and a `web` attempt ends in cookies.
+*
+* It depends on the URL, the provider and the client kind, never on a user.
+*
+* @param url - A redirect URL the environment lists.
+* @param use - The client kind of the attempt, and the provider when it is a provider
+*   sign-in.
+* @returns The reason, or `null`.
+*
+* @example
+* ```ts
+* customSchemeRedirectRefusal('com.example.app:/oauth', { client: 'ios', provider: 'apple' })
+* // 'provider_without_pkce'
+* ```
+*/
+declare function customSchemeRedirectRefusal(url: string, use: {
+	client: string;
+	provider?: string;
+}): CustomSchemeRedirectRefusal | null;
+export { CUSTOM_SCHEME_REDIRECT_REFUSALS, CustomSchemeRedirectRefusal, OAUTH_PROVIDERS_WITHOUT_PKCE, OAUTH_PROVIDERS_WITH_PKCE, REDIRECT_SCHEMES_NEVER_CUSTOM, REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM, RedirectUrlKind, bindsCodeWithPkce, customSchemeRedirectRefusal, hasForbiddenRedirectCharacter, isCustomSchemeRedirectUrl, isRedirectUrl, redirectUrlKind };

package/dist/redirect-url.js

@@ -0,0 +1,26 @@
+import {
+  REDIRECT_SCHEMES_NEVER_CUSTOM2,
+  REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM2,
+  hasForbiddenRedirectCharacter2,
+  redirectUrlKind2,
+  isRedirectUrl2,
+  isCustomSchemeRedirectUrl2,
+  OAUTH_PROVIDERS_WITH_PKCE2,
+  OAUTH_PROVIDERS_WITHOUT_PKCE2,
+  bindsCodeWithPkce2,
+  CUSTOM_SCHEME_REDIRECT_REFUSALS2,
+  customSchemeRedirectRefusal2
+} from "./shared/chunk-r202nxfw.js";
+export {
+  CUSTOM_SCHEME_REDIRECT_REFUSALS2 as CUSTOM_SCHEME_REDIRECT_REFUSALS,
+  OAUTH_PROVIDERS_WITHOUT_PKCE2 as OAUTH_PROVIDERS_WITHOUT_PKCE,
+  OAUTH_PROVIDERS_WITH_PKCE2 as OAUTH_PROVIDERS_WITH_PKCE,
+  REDIRECT_SCHEMES_NEVER_CUSTOM2 as REDIRECT_SCHEMES_NEVER_CUSTOM,
+  REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM2 as REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM,
+  bindsCodeWithPkce2 as bindsCodeWithPkce,
+  customSchemeRedirectRefusal2 as customSchemeRedirectRefusal,
+  hasForbiddenRedirectCharacter2 as hasForbiddenRedirectCharacter,
+  isCustomSchemeRedirectUrl2 as isCustomSchemeRedirectUrl,
+  isRedirectUrl2 as isRedirectUrl,
+  redirectUrlKind2 as redirectUrlKind
+};

package/dist/shared/chunk-2xak18qy.js

@@ -0,0 +1,56 @@
+// src/webhook-signature.ts
+var WEBHOOK_ID_HEADER2 = "webhook-id";
+var WEBHOOK_TIMESTAMP_HEADER2 = "webhook-timestamp";
+var WEBHOOK_SIGNATURE_HEADER2 = "webhook-signature";
+var WEBHOOK_SECRET_PREFIX2 = "whsec_";
+var WEBHOOK_SIGNATURE_VERSION2 = "v1";
+var WEBHOOK_TOLERANCE_SECONDS2 = 5 * 60;
+var MIN_KEY_BYTES = 24;
+var MAX_KEY_BYTES = 64;
+var BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+function webhookSecretBytes2(secret) {
+  if (!secret.startsWith(WEBHOOK_SECRET_PREFIX2)) {
+    return null;
+  }
+  const encoded = secret.slice(WEBHOOK_SECRET_PREFIX2.length);
+  if (!BASE64.test(encoded) || encoded.length % 4 !== 0) {
+    return null;
+  }
+  let binary;
+  try {
+    binary = atob(encoded);
+  } catch {
+    return null;
+  }
+  if (binary.length < MIN_KEY_BYTES || binary.length > MAX_KEY_BYTES) {
+    return null;
+  }
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0;index < binary.length; index++) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+function formatWebhookSecret2(key) {
+  if (key.length < MIN_KEY_BYTES || key.length > MAX_KEY_BYTES) {
+    throw new RangeError("a webhook signing key is 24 to 64 bytes");
+  }
+  return `${WEBHOOK_SECRET_PREFIX2}${toBase64(key)}`;
+}
+async function signWebhook2(key, id, timestamp, body) {
+  const hmac = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const content = new TextEncoder().encode(`${id}.${timestamp}.${body}`);
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", hmac, content));
+  return `${WEBHOOK_SIGNATURE_VERSION2},${toBase64(signature)}`;
+}
+
+export { WEBHOOK_ID_HEADER2, WEBHOOK_TIMESTAMP_HEADER2, WEBHOOK_SIGNATURE_HEADER2, WEBHOOK_SECRET_PREFIX2, WEBHOOK_SIGNATURE_VERSION2, WEBHOOK_TOLERANCE_SECONDS2, webhookSecretBytes2, formatWebhookSecret2, signWebhook2 };

package/dist/shared/chunk-4rb5jsfz.js

@@ -0,0 +1,102 @@
+// src/custom-claims.ts
+var CUSTOM_CLAIMS_CLAIM2 = "ext";
+var RESERVED_CLAIM_NAMES2 = [
+  "iss",
+  "sub",
+  "aud",
+  "exp",
+  "nbf",
+  "iat",
+  "jti",
+  "sid",
+  "pid",
+  "eid",
+  "v",
+  "auth_time",
+  "amr",
+  "sp",
+  "cnf",
+  CUSTOM_CLAIMS_CLAIM2
+];
+var MAX_CUSTOM_CLAIMS_BYTES2 = 1024;
+var MAX_JWT_TEMPLATES2 = 10;
+var MAX_JWT_TEMPLATE_CLAIMS2 = 16;
+var MAX_CUSTOM_CLAIM_KEY_LENGTH2 = 32;
+var MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2 = 256;
+var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var UNSAFE_KEYS = ["__proto__", "constructor", "prototype"];
+function isCustomClaimKey2(key) {
+  return typeof key === "string" && key.length <= MAX_CUSTOM_CLAIM_KEY_LENGTH2 && KEY.test(key) && !UNSAFE_KEYS.includes(key) && !RESERVED_CLAIM_NAMES2.includes(key);
+}
+function isCustomClaimValue2(value) {
+  return typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+}
+function utf8Length(text) {
+  let bytes = 0;
+  for (let index = 0;index < text.length; index += 1) {
+    const unit = text.charCodeAt(index);
+    if (unit < 128) {
+      bytes += 1;
+    } else if (unit < 2048) {
+      bytes += 2;
+    } else if (unit >= 55296 && unit <= 56319 && isLowSurrogate(text.charCodeAt(index + 1))) {
+      bytes += 4;
+      index += 1;
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function isLowSurrogate(unit) {
+  return unit >= 56320 && unit <= 57343;
+}
+function customClaimsBytes2(claims) {
+  return utf8Length(JSON.stringify(claims));
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function checkCustomClaims2(value) {
+  if (!isPlainObject(value)) {
+    return { problem: "invalid" };
+  }
+  const entries = [];
+  for (const key of Object.keys(value)) {
+    const claim = value[key];
+    if (!isCustomClaimKey2(key) || !isCustomClaimValue2(claim)) {
+      return { problem: "invalid" };
+    }
+    entries.push([key, claim]);
+  }
+  const claims = Object.fromEntries(entries);
+  return customClaimsBytes2(claims) > MAX_CUSTOM_CLAIMS_BYTES2 ? { problem: "too_large" } : { claims };
+}
+function readCustomClaims2(claims) {
+  if (!isPlainObject(claims) || !Object.hasOwn(claims, CUSTOM_CLAIMS_CLAIM2)) {
+    return null;
+  }
+  const raw = claims[CUSTOM_CLAIMS_CLAIM2];
+  if (!isPlainObject(raw)) {
+    return null;
+  }
+  const entries = [];
+  for (const key of Object.keys(raw)) {
+    const value = raw[key];
+    if (!isCustomClaimKey2(key) || !isCustomClaimValue2(value)) {
+      return null;
+    }
+    entries.push([key, value]);
+  }
+  if (entries.length === 0) {
+    return null;
+  }
+  const read = Object.fromEntries(entries);
+  return customClaimsBytes2(read) <= MAX_CUSTOM_CLAIMS_BYTES2 ? Object.freeze(read) : null;
+}
+
+export { CUSTOM_CLAIMS_CLAIM2, RESERVED_CLAIM_NAMES2, MAX_CUSTOM_CLAIMS_BYTES2, MAX_JWT_TEMPLATES2, MAX_JWT_TEMPLATE_CLAIMS2, MAX_CUSTOM_CLAIM_KEY_LENGTH2, MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2, isCustomClaimKey2, isCustomClaimValue2, customClaimsBytes2, checkCustomClaims2, readCustomClaims2 };

package/dist/shared/chunk-4stpmame.js

@@ -0,0 +1,58 @@
+// src/device-binding.ts
+var DPOP_HEADER2 = "DPoP";
+var DPOP_NONCE_HEADER2 = "DPoP-Nonce";
+var DPOP_PROOF_TYPE2 = "dpop+jwt";
+var DPOP_ALGORITHMS2 = ["ES256"];
+var MAX_DPOP_PROOF_LENGTH2 = 2048;
+var encoder = new TextEncoder;
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var THIRTY_TWO_BYTES = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var COORDINATE = THIRTY_TWO_BYTES;
+var THUMBPRINT = THIRTY_TWO_BYTES;
+function isDevicePublicJwk2(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const jwk = value;
+  return Object.keys(jwk).length === 4 && jwk.kty === "EC" && jwk.crv === "P-256" && typeof jwk.x === "string" && COORDINATE.test(jwk.x) && typeof jwk.y === "string" && COORDINATE.test(jwk.y);
+}
+function isKeyThumbprint2(value) {
+  return typeof value === "string" && THUMBPRINT.test(value);
+}
+async function jwkThumbprint2(jwk) {
+  const canonical = `{"crv":"${jwk.crv}","kty":"${jwk.kty}","x":"${jwk.x}","y":"${jwk.y}"}`;
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(canonical));
+  return base64url(new Uint8Array(digest));
+}
+async function createDpopProof2(key, input) {
+  const header = { typ: DPOP_PROOF_TYPE2, alg: DPOP_ALGORITHMS2[0], jwk: key.publicJwk };
+  const payload = {
+    htm: input.method,
+    htu: input.url,
+    iat: Math.floor((input.now ?? Date.now()) / 1000),
+    jti: input.jti ?? key.proofId?.() ?? base64url(crypto.getRandomValues(new Uint8Array(16))),
+    ...input.nonce !== undefined && { nonce: input.nonce }
+  };
+  const signed = `${base64url(encoder.encode(JSON.stringify(header)))}.${base64url(encoder.encode(JSON.stringify(payload)))}`;
+  return `${signed}.${base64url(await key.sign(encoder.encode(signed)))}`;
+}
+async function generateSoftwareDeviceKey2() {
+  const algorithm = { name: "ECDSA", namedCurve: "P-256" };
+  const pair = await crypto.subtle.generateKey(algorithm, false, ["sign"]);
+  const { x, y } = await crypto.subtle.exportKey("jwk", pair.publicKey);
+  return {
+    publicJwk: { kty: "EC", crv: "P-256", x, y },
+    async sign(data) {
+      const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, pair.privateKey, new Uint8Array(data));
+      return new Uint8Array(signature);
+    }
+  };
+}
+
+export { DPOP_HEADER2, DPOP_NONCE_HEADER2, DPOP_PROOF_TYPE2, DPOP_ALGORITHMS2, MAX_DPOP_PROOF_LENGTH2, isDevicePublicJwk2, isKeyThumbprint2, jwkThumbprint2, createDpopProof2, generateSoftwareDeviceKey2 };

package/dist/shared/chunk-7yqzghgm.js

@@ -0,0 +1,108 @@
+// src/event-types.ts
+var ACTIVITY_TYPES2 = [
+  "user.created",
+  "user.email_verified",
+  "user.banned",
+  "user.unbanned",
+  "user.deleted",
+  "user.password_changed",
+  "user.mfa_enabled",
+  "user.mfa_disabled",
+  "user.backup_codes_regenerated",
+  "user.backup_code_used",
+  "user.identity_linked",
+  "user.identity_unlinked",
+  "user.email_added",
+  "user.passkey_added",
+  "user.passkey_renamed",
+  "user.passkey_removed",
+  "user.passkey_counter_regressed",
+  "user.phone_number_added",
+  "user.phone_number_removed",
+  "user.sms_factor_enabled",
+  "user.sms_factor_removed",
+  "session.created",
+  "session.revoked",
+  "session.reuse_detected",
+  "session.stepped_up",
+  "session.refresh_proof_refused",
+  "api_key.created",
+  "api_key.revoked",
+  "signing_key.rotated",
+  "environment.settings_updated",
+  "oauth_provider.updated",
+  "oauth_provider.deleted",
+  "webhook_endpoint.created",
+  "webhook_endpoint.updated",
+  "webhook_endpoint.deleted",
+  "webhook_endpoint.disabled",
+  "webhook_endpoint.secret_rotated",
+  "webhook_endpoint.previous_secret_revoked",
+  "hook.created",
+  "hook.updated",
+  "hook.deleted",
+  "native_app.created",
+  "native_app.updated",
+  "native_app.deleted",
+  "proposal.created",
+  "proposal.approved",
+  "proposal.executed",
+  "proposal.failed",
+  "sign_in_test.started",
+  "sign_in_test.finished"
+];
+var EVENT_SCHEMA_VERSION2 = 1;
+var EVENT_TARGET_TYPES2 = {
+  "user.created": "user",
+  "user.email_verified": "user",
+  "user.banned": "user",
+  "user.unbanned": "user",
+  "user.deleted": "user",
+  "user.password_changed": "user",
+  "user.mfa_enabled": "user",
+  "user.mfa_disabled": "user",
+  "user.backup_codes_regenerated": "user",
+  "user.backup_code_used": "user",
+  "user.identity_linked": "user",
+  "user.email_added": "user",
+  "user.identity_unlinked": "user",
+  "user.passkey_added": "user",
+  "user.passkey_renamed": "user",
+  "user.passkey_removed": "user",
+  "user.passkey_counter_regressed": "user",
+  "user.phone_number_added": "user",
+  "user.phone_number_removed": "user",
+  "user.sms_factor_enabled": "user",
+  "user.sms_factor_removed": "user",
+  "session.created": "session",
+  "session.revoked": "session",
+  "session.reuse_detected": "session",
+  "session.stepped_up": "session",
+  "session.refresh_proof_refused": "session",
+  "api_key.created": "api_key",
+  "api_key.revoked": "api_key",
+  "signing_key.rotated": "signing_key",
+  "environment.settings_updated": "environment",
+  "oauth_provider.updated": "environment",
+  "oauth_provider.deleted": "environment",
+  "webhook_endpoint.created": "webhook_endpoint",
+  "webhook_endpoint.updated": "webhook_endpoint",
+  "webhook_endpoint.deleted": "webhook_endpoint",
+  "webhook_endpoint.disabled": "webhook_endpoint",
+  "webhook_endpoint.secret_rotated": "webhook_endpoint",
+  "webhook_endpoint.previous_secret_revoked": "webhook_endpoint",
+  "hook.created": "hook",
+  "hook.updated": "hook",
+  "hook.deleted": "hook",
+  "native_app.created": "native_app",
+  "native_app.updated": "native_app",
+  "native_app.deleted": "native_app",
+  "proposal.created": "proposal",
+  "proposal.approved": "proposal",
+  "proposal.executed": "proposal",
+  "proposal.failed": "proposal",
+  "sign_in_test.started": "environment",
+  "sign_in_test.finished": "environment"
+};
+
+export { ACTIVITY_TYPES2, EVENT_SCHEMA_VERSION2, EVENT_TARGET_TYPES2 };

package/dist/shared/chunk-9pvdavrw.js

@@ -0,0 +1,9 @@
+// src/issuer.ts
+function environmentIssuer2(apiUrl, environmentId) {
+  return `${apiUrl.replace(/\/+$/, "")}/v1/environments/${encodeURIComponent(environmentId)}`;
+}
+function jwksUrl2(issuer) {
+  return `${issuer.replace(/\/+$/, "")}/.well-known/jwks.json`;
+}
+
+export { environmentIssuer2, jwksUrl2 };