@udibo/oauth2 0.14.0 → 0.15.0

package/dist/cli/mod.js

@@ -0,0 +1,94 @@
+/**
+ * Command table for the `udibo-oauth2` executable: the one-off operator
+ * commands a deployment needs, so generating key material never means pasting
+ * a scratch script into a terminal.
+ *
+ * ```sh
+ * npx udibo-oauth2 oidc keygen
+ * npx udibo-oauth2 idp dev
+ * ```
+ *
+ * No command writes to disk. `idp dev` serves a socket and reads its config
+ * file and `OIDC_SIGNING_KEY` from the environment.
+ *
+ * @module
+ */
+import { idpDev } from "./idp/mod.js";
+import { oidcKeygen } from "./keygen.js";
+const commands = new Map([
+    [
+        "oidc keygen",
+        {
+            summary: "Generate an ES256 OIDC signing key for OIDC_SIGNING_KEY.",
+            run: oidcKeygen,
+        },
+    ],
+    [
+        "idp dev",
+        {
+            summary: "Run a local identity provider for development and CI.",
+            run: idpDev,
+        },
+    ],
+]);
+function usage() {
+    const width = Math.max(...commands.keys().map((name) => name.length));
+    return [
+        "@udibo/oauth2 — operator commands for OAuth2/OIDC deployments.",
+        "",
+        "Usage:",
+        "  udibo-oauth2 <command>",
+        "",
+        "Commands:",
+        ...commands
+            .entries()
+            .map(([name, { summary }]) => `  ${name.padEnd(width)}  ${summary}`),
+        "",
+        "Options:",
+        `  ${"-h, --help".padEnd(width)}  Show this help.`,
+    ].join("\n");
+}
+function matchCommand(args) {
+    for (const depth of [2, 1]) {
+        const command = commands.get(args.slice(0, depth).join(" "));
+        if (command)
+            return { command, args: args.slice(depth) };
+    }
+    return undefined;
+}
+/**
+ * Runs one CLI invocation and resolves with the exit code the process should
+ * use: `0` when the command succeeded or help was requested, `1` for no
+ * command, an unknown command, a bad argument, or a command failure.
+ *
+ * Help text and development-provider banners use stdout. Missing or unknown
+ * commands and command failures report on stderr. Successful `oidc keygen`
+ * without help writes one JWK line on stdout and guidance on stderr. Use that
+ * exact invocation and check its exit code before storing stdout as a secret.
+ *
+ * The `udibo-oauth2` executable calls this with `process.argv.slice(2)` and
+ * sets `process.exitCode` to the result.
+ */
+export async function runCli(args, options = {}) {
+    if (args.length === 0) {
+        console.error(usage());
+        return 1;
+    }
+    if (args.includes("--help") || args.includes("-h")) {
+        console.log(usage());
+        return 0;
+    }
+    const match = matchCommand(args);
+    if (!match) {
+        console.error(`error: unknown command "${args.join(" ")}"\n\n${usage()}`);
+        return 1;
+    }
+    try {
+        await match.command.run(match.args, options.signal);
+        return 0;
+    }
+    catch (error) {
+        console.error(`error: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+}

package/{esm → dist}/client/_http.d.ts

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { type OAuth2Error } from "../errors.js";
+import { type OAuth2Error } from "../errors.ts";
 /** Response bytes accepted from an endpoint before the call is refused. */
 export declare const MAX_RESPONSE_BYTES: number;
 /** Wall-clock budget for one call, covering the connect and the body read. */

package/{esm → dist}/client/base.d.ts

@@ -11,7 +11,7 @@
  *
  * @module
  */
-import { type OAuth2ClientEvent, type OAuth2ClientEventListener } from "./events.js";
+import { type OAuth2ClientEvent, type OAuth2ClientEventListener } from "./events.ts";
 /** Generic user-info claims returned by the userinfo or `id_token` helpers. */
 export type UserInfoClaims = Record<string, unknown>;
 /**

package/{esm → dist}/client/bff-client.d.ts

@@ -8,7 +8,7 @@
  *
  * @module
  */
-import { type BaseLoginOptions, type BaseOptions, type LoginRedirect, type LogoutOptions, type LogoutRedirect, OAuth2ClientBase, type SessionState, type UserInfoClaims } from "./base.js";
+import { type BaseLoginOptions, type BaseOptions, type LoginRedirect, type LogoutOptions, type LogoutRedirect, OAuth2ClientBase, type SessionState, type UserInfoClaims } from "./base.ts";
 /** Paths (or absolute URLs) for the BFF session endpoints. */
 export interface BffEndpoints {
     /** Base URL the BFF is mounted under (e.g. `""` for same-origin). */

package/{esm → dist}/client/bff-client.js

@@ -67,14 +67,15 @@ export class BffClient extends OAuth2ClientBase {
             session: endpoints.session ?? "/auth/session",
         };
         this.#authorizePath = options.authorizePath;
-        this.#csrfHeader = options.csrfHeader === false ? {} : {
-            [options.csrfHeader?.name ?? "x-csrf"]: options.csrfHeader?.value ?? "1",
-        };
+        this.#csrfHeader =
+            options.csrfHeader === false
+                ? {}
+                : {
+                    [options.csrfHeader?.name ?? "x-csrf"]: options.csrfHeader?.value ?? "1",
+                };
     }
     #url(path) {
-        const origin = typeof location !== "undefined"
-            ? location.origin
-            : "http://localhost";
+        const origin = typeof location !== "undefined" ? location.origin : "http://localhost";
         return new URL(`${this.#endpoints.baseUrl}${path}`, origin).toString();
     }
     /**

package/{esm → dist}/client/browser-storage.d.ts

@@ -9,7 +9,7 @@
  *
  * @module
  */
-import type { AuthRequestRecord, AuthRequestStorage, RefreshTokenStorage } from "./storage.js";
+import type { AuthRequestRecord, AuthRequestStorage, RefreshTokenStorage } from "./storage.ts";
 /** Options for {@link IndexedDBRefreshTokenStorage}. */
 export interface IndexedDBRefreshTokenStorageOptions {
     /**

package/{esm → dist}/client/check.js

@@ -94,5 +94,5 @@ export async function checkPermissions(options) {
         await response.body?.cancel();
         throw new ServerError(`check request refused: ${response.status}`);
     }
-    return await receiveJson(response, CHECK_ENDPOINT);
+    return (await receiveJson(response, CHECK_ENDPOINT));
 }

package/{esm → dist}/client/direct-client.d.ts

@@ -10,11 +10,11 @@
  *
  * @module
  */
-import type { AuthorizationServerMetadata, DeviceAuthorizationResponse } from "../models/responses.js";
-import type { IntrospectionResponse, TokenResponse } from "../models/token.js";
-import { type BaseLoginOptions, type BaseOptions, type LogoutOptions, type LogoutRedirect, OAuth2ClientBase, type SessionState, type UserInfoClaims } from "./base.js";
-import { type DiscoveryCache } from "./discovery-cache.js";
-import { type AuthRequestStorage, type RefreshTokenStorage, type TokenBundle, type TokenStorage } from "./storage.js";
+import type { AuthorizationServerMetadata, DeviceAuthorizationResponse } from "../models/responses.ts";
+import type { IntrospectionResponse, TokenResponse } from "../models/token.ts";
+import { type BaseLoginOptions, type BaseOptions, type LogoutOptions, type LogoutRedirect, OAuth2ClientBase, type SessionState, type UserInfoClaims } from "./base.ts";
+import { type DiscoveryCache } from "./discovery-cache.ts";
+import { type AuthRequestStorage, type RefreshTokenStorage, type TokenBundle, type TokenStorage } from "./storage.ts";
 /** Endpoints resolved via discovery or provided explicitly by the caller. */
 export interface AuthorizationServerEndpoints {
     /** URL of the authorization endpoint (required for the auth-code flow). */
@@ -236,7 +236,7 @@ export interface ExchangeResult {
  *
  * const client = new DirectClient({
  *   clientId: "worker",
- *   clientSecret: Deno.env.get("CLIENT_SECRET")!,
+ *   clientSecret: process.env.CLIENT_SECRET!,
  *   endpoints: { token: "https://auth.example.com/token" },
  * });
  *

package/{esm → dist}/client/direct-client.js

@@ -10,11 +10,11 @@
  *
  * @module
  */
-import { delay } from "../deps/jsr.io/@std/async/1.5.0/delay.js";
 import { AccessDeniedError, InvalidGrantError, isOAuth2Error, OAuth2Error as OAuth2ErrorClass, ServerError, } from "../errors.js";
 import { challengeMethods, generateCodeVerifier, generateState, } from "../utils/pkce.js";
 import { encodeBasicAuth } from "../utils/basic-auth.js";
 import { base64urlDecode } from "../utils/crypto.js";
+import { delay } from "../utils/_delay.js";
 import { sanitizeProviderText } from "../utils/text.js";
 import { assertField, assertTokenResponse, errorFromResponse, receiveJson, sendGuarded, } from "./_http.js";
 import { mergedHeaders, OAuth2ClientBase, SIGNED_OUT, } from "./base.js";
@@ -66,7 +66,7 @@ const REFRESH_SKEW_MS = 30_000;
  *
  * const client = new DirectClient({
  *   clientId: "worker",
- *   clientSecret: Deno.env.get("CLIENT_SECRET")!,
+ *   clientSecret: process.env.CLIENT_SECRET!,
  *   endpoints: { token: "https://auth.example.com/token" },
  * });
  *
@@ -119,11 +119,12 @@ export class DirectClient extends OAuth2ClientBase {
         this.#discoveryCache = options.discoveryCache;
         this.#endpoints = { ...options.endpoints };
         this.#tokenStorage = options.tokenStorage ?? new MemoryTokenStorage();
-        this.#refreshTokenStorage = options.refreshTokenStorage ??
-            new MemoryRefreshTokenStorage();
+        this.#refreshTokenStorage =
+            options.refreshTokenStorage ?? new MemoryRefreshTokenStorage();
         this.#authRequestTtlMs = options.authRequestTtlMs ?? 10 * 60 * 1000;
-        this.#authRequestStorage = options.authRequestStorage ??
-            defaultAuthRequestStorage(this.#authRequestTtlMs);
+        this.#authRequestStorage =
+            options.authRequestStorage ??
+                defaultAuthRequestStorage(this.#authRequestTtlMs);
     }
     /** True when the client was given a secret and authenticates via Basic. */
     get isConfidential() {
@@ -335,8 +336,7 @@ export class DirectClient extends OAuth2ClientBase {
         const codeVerifier = generateCodeVerifier();
         const codeChallenge = await challengeMethods.S256(codeVerifier);
         const scope = options.scope ?? this.#scope;
-        const authRequestStorage = options.authRequestStorage ??
-            this.#authRequestStorage;
+        const authRequestStorage = options.authRequestStorage ?? this.#authRequestStorage;
         await authRequestStorage.set(state, {
             codeVerifier,
             returnTo: options.returnTo,
@@ -463,8 +463,7 @@ export class DirectClient extends OAuth2ClientBase {
      * `cause` is the transport failure.
      */
     async exchangeAuthorizationCode(code, state, options = {}) {
-        const authRequestStorage = options.authRequestStorage ??
-            this.#authRequestStorage;
+        const authRequestStorage = options.authRequestStorage ?? this.#authRequestStorage;
         const record = await claimAuthRequest(authRequestStorage, state);
         if (!record)
             throw new InvalidGrantError("unknown state parameter");
@@ -609,7 +608,7 @@ export class DirectClient extends OAuth2ClientBase {
     }
     async #doRefresh(reportTransient, snapshot) {
         const { version, refreshToken } = await this.#mutateSession(async () => {
-            const version = snapshot.version = this.#sessionVersion;
+            const version = (snapshot.version = this.#sessionVersion);
             return {
                 version,
                 refreshToken: await this.#readRefreshToken(reportTransient),
@@ -1221,8 +1220,7 @@ function toSearchParams(input) {
     }
 }
 function defaultAuthRequestStorage(ttlMs) {
-    const inBrowserDocument = typeof document !== "undefined" &&
-        typeof sessionStorage !== "undefined";
+    const inBrowserDocument = typeof document !== "undefined" && typeof sessionStorage !== "undefined";
     return inBrowserDocument
         ? new SessionStorageAuthRequestStorage({ ttlMs })
         : new MemoryAuthRequestStorage({ ttlMs });

package/{esm → dist}/client/discovery-cache.d.ts

@@ -4,7 +4,7 @@
  *
  * @module
  */
-import type { AuthorizationServerMetadata } from "../models/responses.js";
+import type { AuthorizationServerMetadata } from "../models/responses.ts";
 /**
  * Default discovery-document lifetime, one hour: the TTL of a
  * {@link MemoryDiscoveryCache}, and how long a `DirectClient` without a

package/{esm → dist}/client/discovery-cache.js

@@ -47,8 +47,8 @@ export class MemoryDiscoveryCache {
     /** Creates a cache with the given TTL and entry ceiling. */
     constructor(options = {}) {
         this.#ttlMs = options.ttlMs ?? DEFAULT_DISCOVERY_TTL_MS;
-        this.#maxEntries = options.maxEntries ??
-            DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES;
+        this.#maxEntries =
+            options.maxEntries ?? DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES;
     }
     /**
      * Returns the fresh cached entry for `issuer`, joins the in-flight `load`

package/{esm → dist}/client/events.d.ts

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import type { TokenBundle } from "./storage.js";
+import type { TokenBundle } from "./storage.ts";
 /** The authenticated user has been resolved or has changed. */
 export interface AuthenticatedEvent {
     /** Discriminant tag for this event variant. */

package/{esm → dist}/client/mod.d.ts

@@ -23,15 +23,14 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
-export { type BaseLoginOptions, type BaseOptions, type LoginRedirect, type LogoutOptions, type LogoutRedirect, OAuth2ClientBase, type SessionState, SIGNED_OUT, type UserInfoClaims, } from "./base.js";
-export { BffClient, type BffClientOptions, type BffEndpoints, } from "./bff-client.js";
-export { type AuthorizationCallbackResult, type AuthorizationRedirect, type AuthorizationServerEndpoints, type DeviceAuthorizationOptions, DirectClient, type DirectClientOptions, type ExchangeOptions, type ExchangeResult, type IntrospectionResult, type LoginOptions, type PollDeviceTokenOptions, } from "./direct-client.js";
-export { DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES, DEFAULT_DISCOVERY_TTL_MS, type DiscoveryCache, type DiscoveryCacheEntry, MemoryDiscoveryCache, type MemoryDiscoveryCacheOptions, } from "./discovery-cache.js";
-export { type AuthenticatedEvent, type ErrorEvent, type LoggedOutEvent, type OAuth2ClientEvent, type OAuth2ClientEventListener, type TokenRefreshedEvent, } from "./events.js";
-export { type AuthRequestRecord, type AuthRequestStorage, MemoryAuthRequestStorage, type MemoryAuthRequestStorageOptions, MemoryRefreshTokenStorage, MemoryTokenStorage, type RefreshTokenStorage, type TokenBundle, type TokenStorage, } from "./storage.js";
-export { checkPermissions, type CheckPermissionsOptions, type CheckPermissionsResult, type CheckResource, } from "./check.js";
-export { Authorization, authorizationFromClaims, } from "../models/authorization.js";
-export type { OrganizationContext } from "../models/authorization.js";
-export { isOAuth2Error, OAuth2Error } from "../errors.js";
-export { IndexedDBRefreshTokenStorage, type IndexedDBRefreshTokenStorageOptions, SessionStorageAuthRequestStorage, type SessionStorageAuthRequestStorageOptions, } from "./browser-storage.js";
+export { type BaseLoginOptions, type BaseOptions, type LoginRedirect, type LogoutOptions, type LogoutRedirect, OAuth2ClientBase, type SessionState, SIGNED_OUT, type UserInfoClaims, } from "./base.ts";
+export { BffClient, type BffClientOptions, type BffEndpoints, } from "./bff-client.ts";
+export { type AuthorizationCallbackResult, type AuthorizationRedirect, type AuthorizationServerEndpoints, type DeviceAuthorizationOptions, DirectClient, type DirectClientOptions, type ExchangeOptions, type ExchangeResult, type IntrospectionResult, type LoginOptions, type PollDeviceTokenOptions, } from "./direct-client.ts";
+export { DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES, DEFAULT_DISCOVERY_TTL_MS, type DiscoveryCache, type DiscoveryCacheEntry, MemoryDiscoveryCache, type MemoryDiscoveryCacheOptions, } from "./discovery-cache.ts";
+export { type AuthenticatedEvent, type ErrorEvent, type LoggedOutEvent, type OAuth2ClientEvent, type OAuth2ClientEventListener, type TokenRefreshedEvent, } from "./events.ts";
+export { type AuthRequestRecord, type AuthRequestStorage, MemoryAuthRequestStorage, type MemoryAuthRequestStorageOptions, MemoryRefreshTokenStorage, MemoryTokenStorage, type RefreshTokenStorage, type TokenBundle, type TokenStorage, } from "./storage.ts";
+export { checkPermissions, type CheckPermissionsOptions, type CheckPermissionsResult, type CheckResource, } from "./check.ts";
+export { Authorization, authorizationFromClaims, } from "../models/authorization.ts";
+export type { OrganizationContext } from "../models/authorization.ts";
+export { isOAuth2Error, OAuth2Error } from "../errors.ts";
+export { IndexedDBRefreshTokenStorage, type IndexedDBRefreshTokenStorageOptions, SessionStorageAuthRequestStorage, type SessionStorageAuthRequestStorageOptions, } from "./browser-storage.ts";

package/{esm → dist}/client/mod.js

@@ -23,11 +23,11 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
 export { OAuth2ClientBase, SIGNED_OUT, } from "./base.js";
 export { BffClient, } from "./bff-client.js";
 export { DirectClient, } from "./direct-client.js";
 export { DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES, DEFAULT_DISCOVERY_TTL_MS, MemoryDiscoveryCache, } from "./discovery-cache.js";
+export {} from "./events.js";
 export { MemoryAuthRequestStorage, MemoryRefreshTokenStorage, MemoryTokenStorage, } from "./storage.js";
 export { checkPermissions, } from "./check.js";
 export { Authorization, authorizationFromClaims, } from "../models/authorization.js";

package/{esm → dist}/errors.d.ts

@@ -11,7 +11,7 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6750#section-3.1
  * @module
  */
-import { HttpError, type HttpErrorOptions } from "./deps/jsr.io/@udibo/http-error/0.11.1/mod.js";
+import { HttpError, type HttpErrorOptions } from "@udibo/http-error";
 /**
  * Problem Details extension members carried by every {@linkcode OAuth2Error}.
  *

package/{esm → dist}/errors.js

@@ -11,7 +11,7 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6750#section-3.1
  * @module
  */
-import { createHttpErrorClass, HttpError, } from "./deps/jsr.io/@udibo/http-error/0.11.1/mod.js";
+import { createHttpErrorClass, HttpError, } from "@udibo/http-error";
 /**
  * The base OAuth2 error class, an {@linkcode HttpError} subclass that defaults
  * to the `server_error` code. Used as a catch-all and as the value-side

package/{esm → dist}/identity/events.d.ts

@@ -24,7 +24,7 @@
  *
  * @module
  */
-import type { DeliveryHooks } from "./delivery.js";
+import type { DeliveryHooks } from "./delivery.ts";
 /** Why a sign-in attempt failed. Internal detail — never shown to the user. */
 export type SignInFailureReason = "unknown_identifier" | "no_password" | "wrong_password";
 /**

package/{esm → dist}/identity/external/_shared.d.ts

@@ -8,7 +8,7 @@
  *
  * @module
  */
-import { PROVIDER_TEXT_MAX_LENGTH, sanitizeProviderText } from "../../utils/text.js";
+import { PROVIDER_TEXT_MAX_LENGTH, sanitizeProviderText } from "../../utils/text.ts";
 export { PROVIDER_TEXT_MAX_LENGTH, sanitizeProviderText };
 /**
  * Clock-skew allowance, in seconds, when checking an id_token's `exp` claim.

package/{esm → dist}/identity/external/_shared.js

@@ -75,8 +75,7 @@ export function assertIdTokenClaims(input) {
             `configured issuer points at a proxy or the wrong tenant.`);
     }
     const aud = claims.aud;
-    const audienceOk = aud === clientId ||
-        (Array.isArray(aud) && aud.includes(clientId));
+    const audienceOk = aud === clientId || (Array.isArray(aud) && aud.includes(clientId));
     if (!audienceOk) {
         throw new ExternalAuthError(provider, "provider_error", `id_token "aud" (${JSON.stringify(aud)}) does not include clientId ` +
             `"${clientId}" — the token was issued to a different client ` +

package/{esm → dist}/identity/external/apple-client-secret.d.ts

@@ -63,7 +63,7 @@ export interface AppleClientSecretOptions {
  *   teamId: "ABCDE12345",
  *   keyId: "KEY1234567",
  *   clientId: "com.example.web",
- *   privateKey: Deno.env.get("APPLE_PRIVATE_KEY")!,
+ *   privateKey: process.env.APPLE_PRIVATE_KEY!,
  * });
  * ```
  */

package/{esm → dist}/identity/external/apple-client-secret.js

@@ -6,8 +6,8 @@
  *
  * @module
  */
-import { decodeBase64 } from "../../deps/jsr.io/@std/encoding/1.0.11/base64.js";
 import { toArrayBuffer } from "../../utils/_buffer.js";
+import { decodeBase64 } from "../../utils/_encoding.js";
 import { base64urlEncode } from "../../utils/crypto.js";
 import { ExternalAuthError } from "./errors.js";
 /** Apple's audience for the client-secret JWT. */
@@ -76,7 +76,7 @@ async function importPrivateKey(providerId, pem) {
  *   teamId: "ABCDE12345",
  *   keyId: "KEY1234567",
  *   clientId: "com.example.web",
- *   privateKey: Deno.env.get("APPLE_PRIVATE_KEY")!,
+ *   privateKey: process.env.APPLE_PRIVATE_KEY!,
  * });
  * ```
  */
@@ -85,9 +85,9 @@ export async function generateAppleClientSecret(options) {
     const teamId = requireNonEmpty(providerId, options.teamId, "team id");
     const keyId = requireNonEmpty(providerId, options.keyId, "key id");
     const clientId = requireNonEmpty(providerId, options.clientId, "client id (Services ID)");
-    const ttl = options.expiresInSeconds ??
-        DEFAULT_APPLE_CLIENT_SECRET_TTL_SECONDS;
-    if (!Number.isFinite(ttl) || ttl <= 0 ||
+    const ttl = options.expiresInSeconds ?? DEFAULT_APPLE_CLIENT_SECRET_TTL_SECONDS;
+    if (!Number.isFinite(ttl) ||
+        ttl <= 0 ||
         ttl > APPLE_CLIENT_SECRET_MAX_TTL_SECONDS) {
         throw configError(providerId, `Apple client secret TTL must be between 1 and ` +
             `${APPLE_CLIENT_SECRET_MAX_TTL_SECONDS} seconds (6 months); ` +
@@ -120,8 +120,7 @@ function encodeSegment(value) {
  * {@link ExternalAuthError}; a failed call caches nothing.
  */
 export function createAppleClientSecretFactory(options) {
-    const ttl = options.expiresInSeconds ??
-        DEFAULT_APPLE_CLIENT_SECRET_TTL_SECONDS;
+    const ttl = options.expiresInSeconds ?? DEFAULT_APPLE_CLIENT_SECRET_TTL_SECONDS;
     const renewBefore = options.renewBeforeSeconds ?? 60 * 60;
     let cached = null;
     return async () => {

package/{esm → dist}/identity/external/apple.d.ts

@@ -15,8 +15,8 @@
  *
  * @module
  */
-import { type AppleClientSecretFactory, type AppleClientSecretOptions } from "./apple-client-secret.js";
-import type { ExternalProvider } from "./provider.js";
+import { type AppleClientSecretFactory, type AppleClientSecretOptions } from "./apple-client-secret.ts";
+import type { ExternalProvider } from "./provider.ts";
 /** Options for {@link appleProvider}. */
 export interface AppleProviderOptions extends Pick<AppleClientSecretOptions, "teamId" | "keyId" | "privateKey"> {
     /** The Services ID configured for web Sign in with Apple (the `client_id`). */
@@ -61,9 +61,9 @@ export interface AppleProviderOptions extends Pick<AppleClientSecretOptions, "te
  * const flow = new ExternalAuthFlow({
  *   provider: appleProvider({
  *     clientId: "com.example.web",
- *     teamId: Deno.env.get("APPLE_TEAM_ID")!,
- *     keyId: Deno.env.get("APPLE_KEY_ID")!,
- *     privateKey: Deno.env.get("APPLE_PRIVATE_KEY")!,
+ *     teamId: process.env.APPLE_TEAM_ID!,
+ *     keyId: process.env.APPLE_KEY_ID!,
+ *     privateKey: process.env.APPLE_PRIVATE_KEY!,
  *   }),
  * });
  * ```

package/{esm → dist}/identity/external/apple.js

@@ -52,9 +52,9 @@ const SIGNATURE_NOT_VERIFIED = `Apple id_token signature did not verify against
  * const flow = new ExternalAuthFlow({
  *   provider: appleProvider({
  *     clientId: "com.example.web",
- *     teamId: Deno.env.get("APPLE_TEAM_ID")!,
- *     keyId: Deno.env.get("APPLE_KEY_ID")!,
- *     privateKey: Deno.env.get("APPLE_PRIVATE_KEY")!,
+ *     teamId: process.env.APPLE_TEAM_ID!,
+ *     keyId: process.env.APPLE_KEY_ID!,
+ *     privateKey: process.env.APPLE_PRIVATE_KEY!,
  *   }),
  * });
  * ```
@@ -178,8 +178,7 @@ export function appleProvider(options) {
             match = pick(await loadJwks());
         }
         if (!match) {
-            throw new ExternalAuthError(id, "provider_error", `Apple's JWKS has no key with kid "${String(kid)}" — the id_token was ` +
-                `signed by a key Apple no longer publishes.`);
+            throw new ExternalAuthError(id, "provider_error", `Apple's JWKS has no key with kid "${String(kid)}" — the id_token was ` + `signed by a key Apple no longer publishes.`);
         }
         return match;
     }
@@ -231,16 +230,16 @@ function appleTokenErrorHint(error) {
         return `Ensure the sign-in requested the "openid" flow scopes.`;
     }
     if (error === "invalid_client") {
-        return `The client-secret JWT is wrong — check the team id, key id, and ` +
-            `Services ID (client id).`;
+        return (`The client-secret JWT is wrong — check the team id, key id, and ` +
+            `Services ID (client id).`);
     }
     if (error === "invalid_grant") {
-        return `Apple rejected the code — it expired, was already used, or the ` +
+        return (`Apple rejected the code — it expired, was already used, or the ` +
             `redirect URI does not match the Services ID configuration. Ask the ` +
-            `user to start again.`;
+            `user to start again.`);
     }
-    return `See Apple's "Generate and validate tokens" documentation for the ` +
-        `error's meaning.`;
+    return (`See Apple's "Generate and validate tokens" documentation for the ` +
+        `error's meaning.`);
 }
 function decodeJson(providerId, segment, what) {
     try {

package/{esm → dist}/identity/external/discord.d.ts

@@ -3,7 +3,7 @@
  *
  * @module
  */
-import type { ExternalProvider } from "./provider.js";
+import type { ExternalProvider } from "./provider.ts";
 /** Options for {@link discordProvider}. */
 export interface DiscordProviderOptions {
     /** Client ID of the Discord application (OAuth2 tab). */
@@ -33,8 +33,8 @@ export interface DiscordProviderOptions {
  * ```ts
  * const flow = new ExternalAuthFlow({
  *   provider: discordProvider({
- *     clientId: Deno.env.get("DISCORD_CLIENT_ID")!,
- *     clientSecret: Deno.env.get("DISCORD_CLIENT_SECRET")!,
+ *     clientId: process.env.DISCORD_CLIENT_ID!,
+ *     clientSecret: process.env.DISCORD_CLIENT_SECRET!,
  *   }),
  * });
  * ```

package/{esm → dist}/identity/external/discord.js

@@ -30,8 +30,8 @@ function avatarUrl(user) {
  * ```ts
  * const flow = new ExternalAuthFlow({
  *   provider: discordProvider({
- *     clientId: Deno.env.get("DISCORD_CLIENT_ID")!,
- *     clientSecret: Deno.env.get("DISCORD_CLIENT_SECRET")!,
+ *     clientId: process.env.DISCORD_CLIENT_ID!,
+ *     clientSecret: process.env.DISCORD_CLIENT_SECRET!,
  *   }),
  * });
  * ```

package/{esm → dist}/identity/external/flow.d.ts

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import type { ExternalAuthTransient, ExternalProfile, ExternalProvider } from "./provider.js";
+import type { ExternalAuthTransient, ExternalProfile, ExternalProvider } from "./provider.ts";
 /** Default {@link ExternalAuthFlowOptions.maxTransientAgeMs}: 10 minutes. */
 export declare const DEFAULT_MAX_TRANSIENT_AGE_MS: number;
 /** Options for {@link ExternalAuthFlow}. */

package/{esm → dist}/identity/external/flow.js

@@ -48,8 +48,8 @@ export class ExternalAuthFlow {
     /** Creates a flow for one configured provider. */
     constructor(options) {
         this.provider = options.provider;
-        this.#maxTransientAgeMs = options.maxTransientAgeMs ??
-            DEFAULT_MAX_TRANSIENT_AGE_MS;
+        this.#maxTransientAgeMs =
+            options.maxTransientAgeMs ?? DEFAULT_MAX_TRANSIENT_AGE_MS;
     }
     /**
      * Begins a sign-in attempt: generates the per-attempt `state` (plus a PKCE

package/{esm → dist}/identity/external/github.d.ts

@@ -4,7 +4,7 @@
  *
  * @module
  */
-import type { ExternalProvider } from "./provider.js";
+import type { ExternalProvider } from "./provider.ts";
 /** Options for {@link githubProvider}. */
 export interface GithubProviderOptions {
     /** Client ID of the GitHub OAuth App (or GitHub App). */
@@ -37,8 +37,8 @@ export interface GithubProviderOptions {
  * ```ts
  * const flow = new ExternalAuthFlow({
  *   provider: githubProvider({
- *     clientId: Deno.env.get("GITHUB_CLIENT_ID")!,
- *     clientSecret: Deno.env.get("GITHUB_CLIENT_SECRET")!,
+ *     clientId: process.env.GITHUB_CLIENT_ID!,
+ *     clientSecret: process.env.GITHUB_CLIENT_SECRET!,
  *   }),
  * });
  * ```