@udibo/oauth2 0.14.1 → 0.15.1

package/{esm → dist}/identity/external/github.js

@@ -29,8 +29,8 @@ const GITHUB_EMAILS_URL = "https://api.github.com/user/emails";
  * ```ts
  * const flow = new ExternalAuthFlow({
  *   provider: githubProvider({
- *     clientId: Deno.env.get("GITHUB_CLIENT_ID")!,
- *     clientSecret: Deno.env.get("GITHUB_CLIENT_SECRET")!,
+ *     clientId: process.env.GITHUB_CLIENT_ID!,
+ *     clientSecret: process.env.GITHUB_CLIENT_SECRET!,
  *   }),
  * });
  * ```
@@ -111,19 +111,16 @@ export function githubProvider(options) {
             }
             const emails = parseGithubEmails(emailsRaw);
             const chosen = emails?.find((entry) => entry.primary) ??
-                emails?.find((entry) => entry.verified) ?? emails?.[0];
-            const publicEmail = typeof user.email === "string"
-                ? user.email
-                : undefined;
+                emails?.find((entry) => entry.verified) ??
+                emails?.[0];
+            const publicEmail = typeof user.email === "string" ? user.email : undefined;
             return {
                 provider: id,
                 subject: String(user.id),
                 email: chosen?.email ?? publicEmail,
                 emailVerified: chosen?.verified === true,
                 name: typeof user.name === "string" ? user.name : undefined,
-                picture: typeof user.avatar_url === "string"
-                    ? user.avatar_url
-                    : undefined,
+                picture: typeof user.avatar_url === "string" ? user.avatar_url : undefined,
                 raw: Array.isArray(emailsRaw) ? { ...user, emails: emailsRaw } : user,
             };
         },
@@ -149,17 +146,15 @@ function parseGithubEmails(raw) {
 }
 function githubTokenErrorHint(error) {
     if (error === "incorrect_client_credentials") {
-        return `Check clientId/clientSecret against the GitHub OAuth App ` +
-            `settings.`;
+        return (`Check clientId/clientSecret against the GitHub OAuth App ` + `settings.`);
     }
     if (error === "redirect_uri_mismatch") {
-        return `The redirectUri must exactly match the "Authorization callback ` +
-            `URL" configured on the GitHub OAuth App.`;
+        return (`The redirectUri must exactly match the "Authorization callback ` +
+            `URL" configured on the GitHub OAuth App.`);
     }
     if (error === "bad_verification_code") {
-        return `The code expired or was already used — ask the user to start ` +
-            `signing in again.`;
+        return (`The code expired or was already used — ask the user to start ` +
+            `signing in again.`);
     }
-    return `See https://docs.github.com/apps/oauth-apps for the error's ` +
-        `meaning.`;
+    return (`See https://docs.github.com/apps/oauth-apps for the error's ` + `meaning.`);
 }

package/{esm → dist}/identity/external/google.d.ts

@@ -3,9 +3,9 @@
  *
  * @module
  */
-import type { DiscoveryCache } from "../../client/discovery-cache.js";
-import type { AzpPolicy } from "./_shared.js";
-import type { ExternalProvider } from "./provider.js";
+import type { DiscoveryCache } from "../../client/discovery-cache.ts";
+import type { AzpPolicy } from "./_shared.ts";
+import type { ExternalProvider } from "./provider.ts";
 /** Options for {@link googleProvider}. */
 export interface GoogleProviderOptions {
     /** OAuth client ID from the Google Cloud console ("Web application" type). */
@@ -47,8 +47,8 @@ export interface GoogleProviderOptions {
  * ```ts
  * const flow = new ExternalAuthFlow({
  *   provider: googleProvider({
- *     clientId: Deno.env.get("GOOGLE_CLIENT_ID")!,
- *     clientSecret: Deno.env.get("GOOGLE_CLIENT_SECRET")!,
+ *     clientId: process.env.GOOGLE_CLIENT_ID!,
+ *     clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
  *   }),
  * });
  * ```

package/{esm → dist}/identity/external/google.js

@@ -17,8 +17,8 @@ import { oidcProvider } from "./oidc.js";
  * ```ts
  * const flow = new ExternalAuthFlow({
  *   provider: googleProvider({
- *     clientId: Deno.env.get("GOOGLE_CLIENT_ID")!,
- *     clientSecret: Deno.env.get("GOOGLE_CLIENT_SECRET")!,
+ *     clientId: process.env.GOOGLE_CLIENT_ID!,
+ *     clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
  *   }),
  * });
  * ```

package/{esm → dist}/identity/external/mod.d.ts

@@ -48,16 +48,15 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
-export { ExternalAuthError, type ExternalAuthErrorCode, isExternalAuthError, } from "./errors.js";
-export type { ExternalAuthorizationUrlInput, ExternalAuthTransient, ExternalProfile, ExternalProfileInput, ExternalProvider, } from "./provider.js";
-export { DEFAULT_MAX_TRANSIENT_AGE_MS, type ExternalAuthFinishInput, ExternalAuthFlow, type ExternalAuthFlowOptions, type ExternalAuthStartInput, type ExternalAuthStartResult, } from "./flow.js";
-export { oidcProvider, type OidcProviderOptions } from "./oidc.js";
-export type { AzpPolicy } from "./_shared.js";
-export { DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES, DEFAULT_DISCOVERY_TTL_MS, type DiscoveryCache, type DiscoveryCacheEntry, MemoryDiscoveryCache, type MemoryDiscoveryCacheOptions, } from "../../client/discovery-cache.js";
-export { googleProvider, type GoogleProviderOptions } from "./google.js";
-export { githubProvider, type GithubProviderOptions } from "./github.js";
-export { type OAuth2ProfileMapper, type OAuth2ProfileMapping, oauth2Provider, type OAuth2ProviderOptions, type OAuth2TokenResult, } from "./oauth2.js";
-export { discordProvider, type DiscordProviderOptions } from "./discord.js";
-export { appleProvider, type AppleProviderOptions } from "./apple.js";
-export { APPLE_AUDIENCE, APPLE_CLIENT_SECRET_MAX_TTL_SECONDS, type AppleClientSecretFactory, type AppleClientSecretOptions, createAppleClientSecretFactory, DEFAULT_APPLE_CLIENT_SECRET_TTL_SECONDS, generateAppleClientSecret, } from "./apple-client-secret.js";
+export { ExternalAuthError, type ExternalAuthErrorCode, isExternalAuthError, } from "./errors.ts";
+export type { ExternalAuthorizationUrlInput, ExternalAuthTransient, ExternalProfile, ExternalProfileInput, ExternalProvider, } from "./provider.ts";
+export { DEFAULT_MAX_TRANSIENT_AGE_MS, type ExternalAuthFinishInput, ExternalAuthFlow, type ExternalAuthFlowOptions, type ExternalAuthStartInput, type ExternalAuthStartResult, } from "./flow.ts";
+export { oidcProvider, type OidcProviderOptions } from "./oidc.ts";
+export type { AzpPolicy } from "./_shared.ts";
+export { DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES, DEFAULT_DISCOVERY_TTL_MS, type DiscoveryCache, type DiscoveryCacheEntry, MemoryDiscoveryCache, type MemoryDiscoveryCacheOptions, } from "../../client/discovery-cache.ts";
+export { googleProvider, type GoogleProviderOptions } from "./google.ts";
+export { githubProvider, type GithubProviderOptions } from "./github.ts";
+export { type OAuth2ProfileMapper, type OAuth2ProfileMapping, oauth2Provider, type OAuth2ProviderOptions, type OAuth2TokenResult, } from "./oauth2.ts";
+export { discordProvider, type DiscordProviderOptions } from "./discord.ts";
+export { appleProvider, type AppleProviderOptions } from "./apple.ts";
+export { APPLE_AUDIENCE, APPLE_CLIENT_SECRET_MAX_TTL_SECONDS, type AppleClientSecretFactory, type AppleClientSecretOptions, createAppleClientSecretFactory, DEFAULT_APPLE_CLIENT_SECRET_TTL_SECONDS, generateAppleClientSecret, } from "./apple-client-secret.ts";

package/{esm → dist}/identity/external/mod.js

@@ -48,7 +48,6 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 export { ExternalAuthError, isExternalAuthError, } from "./errors.js";
 export { DEFAULT_MAX_TRANSIENT_AGE_MS, ExternalAuthFlow, } from "./flow.js";
 export { oidcProvider } from "./oidc.js";

package/{esm → dist}/identity/external/oauth2.d.ts

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import type { ExternalProvider } from "./provider.js";
+import type { ExternalProvider } from "./provider.ts";
 /** The token-endpoint response fields the mapper may read. */
 export interface OAuth2TokenResult {
     /** The bearer access token issued by the token endpoint. */

package/{esm → dist}/identity/external/oauth2.js

@@ -142,18 +142,18 @@ export function oauth2Provider(options) {
 }
 function oauth2TokenErrorHint(error) {
     if (error === "invalid_client" || error === "unauthorized_client") {
-        return `The provider rejected the client credentials — check clientId ` +
-            `and clientSecret against the app registration.`;
+        return (`The provider rejected the client credentials — check clientId ` +
+            `and clientSecret against the app registration.`);
     }
     if (error === "invalid_grant") {
-        return `The provider rejected the code — it expired, was already used, ` +
+        return (`The provider rejected the code — it expired, was already used, ` +
             `or the redirect URI does not match the registered one. Ask the user ` +
-            `to start again.`;
+            `to start again.`);
     }
     if (error === "invalid_scope") {
-        return `The provider rejected the requested scopes — check the ` +
-            `connector's scopes against what the app registration allows.`;
+        return (`The provider rejected the requested scopes — check the ` +
+            `connector's scopes against what the app registration allows.`);
     }
-    return `The code may have expired or already been used — ask the user to ` +
-        `start again.`;
+    return (`The code may have expired or already been used — ask the user to ` +
+        `start again.`);
 }

package/{esm → dist}/identity/external/oidc.d.ts

@@ -4,9 +4,9 @@
  *
  * @module
  */
-import type { DiscoveryCache } from "../../client/discovery-cache.js";
-import { type AzpPolicy } from "./_shared.js";
-import type { ExternalProvider } from "./provider.js";
+import type { DiscoveryCache } from "../../client/discovery-cache.ts";
+import { type AzpPolicy } from "./_shared.ts";
+import type { ExternalProvider } from "./provider.ts";
 /** Options for {@link oidcProvider}. */
 export interface OidcProviderOptions {
     /** Provider id used in profiles and error messages. Defaults to `"oidc"`. */
@@ -84,7 +84,7 @@ export interface OidcProviderOptions {
  *   displayName: "Acme SSO",
  *   issuer: "https://sso.acme.example",
  *   clientId: "my-app",
- *   clientSecret: Deno.env.get("ACME_CLIENT_SECRET")!,
+ *   clientSecret: process.env.ACME_CLIENT_SECRET!,
  * });
  * const flow = new ExternalAuthFlow({ provider });
  * ```

package/{esm → dist}/identity/external/oidc.js

@@ -42,7 +42,7 @@ import { ExternalAuthError } from "./errors.js";
  *   displayName: "Acme SSO",
  *   issuer: "https://sso.acme.example",
  *   clientId: "my-app",
- *   clientSecret: Deno.env.get("ACME_CLIENT_SECRET")!,
+ *   clientSecret: process.env.ACME_CLIENT_SECRET!,
  * });
  * const flow = new ExternalAuthFlow({ provider });
  * ```
@@ -232,7 +232,8 @@ function assertSecureIssuer(id, issuer) {
         throw new ExternalAuthError(id, "configuration", `issuer "${issuer}" is not a valid absolute URL.`);
     }
     const loopback = url.hostname === "localhost" ||
-        url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+        url.hostname === "127.0.0.1" ||
+        url.hostname === "[::1]";
     if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
         throw new ExternalAuthError(id, "configuration", `issuer "${issuer}" must use https — this connector trusts the ` +
             `id_token because it arrives directly from the token endpoint over ` +
@@ -243,14 +244,14 @@ function assertSecureIssuer(id, issuer) {
 function tokenExchangeHint(error) {
     const code = isOAuth2Error(error) ? error.extensions.error : undefined;
     if (code === "invalid_client") {
-        return `The provider rejected the client credentials — check clientId ` +
-            `and clientSecret against the provider's app registration.`;
+        return (`The provider rejected the client credentials — check clientId ` +
+            `and clientSecret against the provider's app registration.`);
     }
     if (code === "invalid_grant") {
-        return `The provider rejected the code — most often the redirectUri ` +
+        return (`The provider rejected the code — most often the redirectUri ` +
             `does not exactly match the URI registered with the provider, or the ` +
-            `code expired or was already used.`;
+            `code expired or was already used.`);
     }
-    return `Check the provider's app registration (client credentials and ` +
-        `redirect URI) if this persists.`;
+    return (`Check the provider's app registration (client credentials and ` +
+        `redirect URI) if this persists.`);
 }

package/{esm → dist}/identity/hibp.d.ts

@@ -17,7 +17,7 @@
  *
  * @module
  */
-import { type IdentityEventHook } from "./events.js";
+import { type IdentityEventHook } from "./events.ts";
 /** Options for {@link breachedPasswordValidator}. */
 export interface BreachedPasswordOptions {
     /**

package/{esm → dist}/identity/hibp.js

@@ -17,7 +17,7 @@
  *
  * @module
  */
-import { encodeHex } from "../deps/jsr.io/@std/encoding/1.0.11/hex.js";
+import { encodeHex } from "../utils/_encoding.js";
 import { defaultFetch, packageDeadlineSignal, } from "../utils/_default-fetch.js";
 import { dispatchIdentityEvent } from "./events.js";
 const DEFAULT_BASE_URL = "https://api.pwnedpasswords.com/range/";

package/{esm → dist}/identity/lockout.js

@@ -92,8 +92,7 @@ export class MemoryLockoutStore {
     /** Add one failure synchronously (atomic in a single-process store). */
     increment(userId, now) {
         const record = this.#records.get(userId);
-        const lockExpired = record?.lockedUntil !== undefined &&
-            record.lockedUntil <= now;
+        const lockExpired = record?.lockedUntil !== undefined && record.lockedUntil <= now;
         const next = record && !lockExpired
             ? {
                 failures: record.failures + 1,

package/{esm → dist}/identity/mfa/mod.d.ts

@@ -2,7 +2,7 @@
  * MFA primitives for apps that own their login: TOTP (RFC 6238) and single-use
  * recovery codes, plus a small orchestrator over an app-owned store — the same
  * thin-seam philosophy as the rest of the identity layer. Built entirely on
- * Web Crypto and `@std`; no other dependencies.
+ * Web Crypto; no other dependencies.
  *
  * - {@link generateTotpSecret} / {@link buildOtpauthUri} /
  *   {@link generateTotpCode} / {@link verifyTotpCode} — the TOTP math, with a
@@ -37,7 +37,6 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
-export { buildOtpauthUri, decodeTotpSecret, type GeneratedTotpSecret, generateTotpCode, type GenerateTotpCodeOptions, generateTotpSecret, type OtpauthUriOptions, type TotpAlgorithm, type TotpVerification, verifyTotpCode, type VerifyTotpCodeOptions, } from "./totp.js";
-export { type GeneratedRecoveryCodes, generateRecoveryCodes, type GenerateRecoveryCodesOptions, hashRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_LENGTH, type RecoveryCodeVerification, verifyRecoveryCode, type VerifyRecoveryCodeOptions, } from "./recovery-codes.js";
-export { MemoryMfaStore, type MfaEnrollmentConfirmation, type MfaEnrollmentStart, type MfaEnrollmentStatus, MfaService, type MfaServiceOptions, type MfaStore, type MfaTotpOptions, type MfaTotpRecord, type MfaVerification, type MfaVerifyFailureReason, type MfaVerifyOptions, type StartEnrollmentOptions, } from "./service.js";
+export { buildOtpauthUri, decodeTotpSecret, type GeneratedTotpSecret, generateTotpCode, type GenerateTotpCodeOptions, generateTotpSecret, type OtpauthUriOptions, type TotpAlgorithm, type TotpVerification, verifyTotpCode, type VerifyTotpCodeOptions, } from "./totp.ts";
+export { type GeneratedRecoveryCodes, generateRecoveryCodes, type GenerateRecoveryCodesOptions, hashRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_LENGTH, type RecoveryCodeVerification, verifyRecoveryCode, type VerifyRecoveryCodeOptions, } from "./recovery-codes.ts";
+export { MemoryMfaStore, type MfaEnrollmentConfirmation, type MfaEnrollmentStart, type MfaEnrollmentStatus, MfaService, type MfaServiceOptions, type MfaStore, type MfaTotpOptions, type MfaTotpRecord, type MfaVerification, type MfaVerifyFailureReason, type MfaVerifyOptions, type StartEnrollmentOptions, } from "./service.ts";

package/{esm → dist}/identity/mfa/mod.js

@@ -2,7 +2,7 @@
  * MFA primitives for apps that own their login: TOTP (RFC 6238) and single-use
  * recovery codes, plus a small orchestrator over an app-owned store — the same
  * thin-seam philosophy as the rest of the identity layer. Built entirely on
- * Web Crypto and `@std`; no other dependencies.
+ * Web Crypto; no other dependencies.
  *
  * - {@link generateTotpSecret} / {@link buildOtpauthUri} /
  *   {@link generateTotpCode} / {@link verifyTotpCode} — the TOTP math, with a
@@ -37,7 +37,6 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 export { buildOtpauthUri, decodeTotpSecret, generateTotpCode, generateTotpSecret, verifyTotpCode, } from "./totp.js";
 export { generateRecoveryCodes, hashRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_LENGTH, verifyRecoveryCode, } from "./recovery-codes.js";
 export { MemoryMfaStore, MfaService, } from "./service.js";

package/{esm → dist}/identity/mfa/service.d.ts

@@ -7,9 +7,9 @@
  *
  * @module
  */
-import { type IdentityEventHook } from "../events.js";
-import { type RateLimiterLike } from "../rate-limit.js";
-import { type TotpAlgorithm } from "./totp.js";
+import { type IdentityEventHook } from "../events.ts";
+import { type RateLimiterLike } from "../rate-limit.ts";
+import { type TotpAlgorithm } from "./totp.ts";
 /**
  * A user's TOTP state as the store persists it. `secretBase32` is a symmetric
  * key — encrypt it at rest. A record may hold only a pending secret (enrollment

package/{esm → dist}/identity/mfa/service.js

@@ -228,7 +228,7 @@ export class MfaService {
      * TOTP enrollment.
      */
     async regenerateRecoveryCodes(userId) {
-        if (!await this.isEnrolled(userId)) {
+        if (!(await this.isEnrolled(userId))) {
             throw new IdentityError("mfa_not_enrolled", "cannot regenerate recovery codes: MFA is not enrolled");
         }
         const codes = await this.#issueRecoveryCodes(userId);
@@ -244,7 +244,7 @@ export class MfaService {
         });
         if (!result.valid)
             return undefined;
-        if (!await this.#store.advanceLastStep(userId, result.matchedStep)) {
+        if (!(await this.#store.advanceLastStep(userId, result.matchedStep))) {
             return await this.#verifyFailed(userId, "replayed");
         }
         await this.#resetThrottle(userId);
@@ -258,7 +258,8 @@ export class MfaService {
         const consumed = await this.#store.consumeRecoveryHash(userId, await hashRecoveryCode(code));
         if (!consumed)
             return undefined;
-        const remainingRecoveryCodes = (await this.#store.getRecoveryHashes(userId)).length;
+        const remainingRecoveryCodes = (await this.#store.getRecoveryHashes(userId))
+            .length;
         await this.#resetThrottle(userId);
         await this.#emit({
             type: "mfa.verify.succeeded",

package/{esm → dist}/identity/mfa/totp.d.ts

@@ -1,6 +1,6 @@
 /**
  * TOTP primitives (RFC 6238 over RFC 4226 HOTP) built on Web Crypto — no
- * dependencies beyond `@std`. Generate a secret, render the `otpauth://` URI an
+ * dependencies. Generate a secret, render the `otpauth://` URI an
  * authenticator app scans, and verify submitted codes with a constant-time
  * comparison.
  *

package/{esm → dist}/identity/mfa/totp.js

@@ -1,6 +1,6 @@
 /**
  * TOTP primitives (RFC 6238 over RFC 4226 HOTP) built on Web Crypto — no
- * dependencies beyond `@std`. Generate a secret, render the `otpauth://` URI an
+ * dependencies. Generate a secret, render the `otpauth://` URI an
  * authenticator app scans, and verify submitted codes with a constant-time
  * comparison.
  *
@@ -11,8 +11,8 @@
  *
  * @module
  */
-import { decodeBase32, encodeBase32 } from "../../deps/jsr.io/@std/encoding/1.0.11/base32.js";
 import { toArrayBuffer } from "../../utils/_buffer.js";
+import { decodeBase32, encodeBase32 } from "../../utils/_encoding.js";
 import { timingSafeMatchIndex } from "../../utils/_timing-safe.js";
 const DEFAULT_DIGITS = 6;
 const DEFAULT_PERIOD_SECONDS = 30;

package/{esm → dist}/identity/migration.d.ts

@@ -16,7 +16,7 @@
  * only built-in verifier is {@link pbkdf2Verifier} (PBKDF2 is a Web Crypto
  * primitive). **bcrypt, argon2, and scrypt cannot be implemented dep-free** —
  * bcrypt and argon2 have no Web Crypto primitive, and scrypt is not exposed by
- * Web Crypto or `@std/crypto`. Those are **BYO**: you implement the
+ * Web Crypto. Those are **BYO**: you implement the
  * {@link LegacyPasswordVerifier} seam with your app's own bcrypt/argon2/scrypt
  * dependency and pass it in. {@link parsePhc} is provided to parse the PHC /
  * modular-crypt strings those algorithms store, so a BYO verifier is a few
@@ -24,7 +24,6 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
 /**
  * A verifier for one foreign password-hash format, used during
  * upgrade-on-login. Connectors identify the formats they handle by sniffing the
@@ -35,7 +34,7 @@ import "../_dnt.polyfills.js";
  * Implement this to bring your own bcrypt/argon2/scrypt verifier (using your
  * app's dependency) — the package only ships {@link pbkdf2Verifier} built-in.
  *
- * @example Bring-your-own bcrypt (app adds an `npm:bcryptjs` dependency)
+ * @example Bring-your-own bcrypt (app adds a `bcryptjs` dependency)
  * ```ts
  * import { compare } from "bcryptjs";
  * import type { LegacyPasswordVerifier } from "@udibo/oauth2/identity/migration";

package/{esm → dist}/identity/migration.js

@@ -16,7 +16,7 @@
  * only built-in verifier is {@link pbkdf2Verifier} (PBKDF2 is a Web Crypto
  * primitive). **bcrypt, argon2, and scrypt cannot be implemented dep-free** —
  * bcrypt and argon2 have no Web Crypto primitive, and scrypt is not exposed by
- * Web Crypto or `@std/crypto`. Those are **BYO**: you implement the
+ * Web Crypto. Those are **BYO**: you implement the
  * {@link LegacyPasswordVerifier} seam with your app's own bcrypt/argon2/scrypt
  * dependency and pass it in. {@link parsePhc} is provided to parse the PHC /
  * modular-crypt strings those algorithms store, so a BYO verifier is a few
@@ -24,9 +24,8 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
-import { decodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.11/mod.js";
-import { timingSafeEqual } from "../deps/jsr.io/@std/crypto/1.1.0/timing_safe_equal.js";
+import { timingSafeEqual } from "node:crypto";
+import { decodeBase64 } from "../utils/_encoding.js";
 /**
  * The first verifier in `verifiers` (in order) whose `canVerify` accepts `phc`,
  * or `undefined` if none do. A verifier that throws from `canVerify` is skipped

package/{esm → dist}/identity/mod.d.ts

@@ -48,18 +48,17 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
-export { DEFAULT_PBKDF2_ITERATIONS, generateSalt, hashPassword, LEGACY_PBKDF2_ITERATIONS, type PasswordCredential, type PasswordHasherLike, type PasswordHashParams, PasswordIdentityService, type PasswordIdentityServiceOptions, PBKDF2_SHA256, verifyPassword, } from "./password.js";
-export { classifyIdentifier, createIdentifierResolver, type IdentifierKind, type IdentifierLookups, } from "./identifier.js";
-export { type CreatedToken, type CreateTokenOptions, MemoryTokenFlowStore, type ResolvedToken, type TokenFlowRecord, TokenFlowService, type TokenFlowStore, TokenPurpose, type TokenStatus, } from "./token-flow.js";
-export { buildResetUrl, buildSignInUrl, buildTokenUrl, buildUnlockUrl, buildVerificationUrl, type CodeDeliveryHook, type CodeDeliveryMessage, type DeliveryHook, type DeliveryHooks, type DeliveryMessage, } from "./delivery.js";
-export { isRecentlyAuthenticated, type ListableSessionService, type RevocableSessionService, type SessionSummary, supportsSessionListing, } from "./session.js";
-export { type ConsumeSignInLinkResult, type IdentityRateLimiters, IdentityService, type IdentityServiceOptions, type IdentityUser, type IdentityUserStore, type UnlockAccountResult, type VerifyEmailResult, type VerifySignInCodeResult, } from "./service.js";
-export { EmailOtpService, type EmailOtpServiceOptions, MemoryOtpStore, type OtpRecord, type OtpStore, type RequestedOtp, type RequestOtpOptions, type VerifyOtpOptions, type VerifyOtpResult, } from "./otp.js";
-export { AccountLockout, type AccountLockoutLike, type AccountLockoutOptions, type LockoutFailureResult, type LockoutRecord, type LockoutStatus, type LockoutStore, MemoryLockoutStore, } from "./lockout.js";
-export type { IdentityEvent, IdentityEventHook, SignInCodeFailureReason, SignInFailureReason, } from "./events.js";
-export { IdentityError, type IdentityErrorCode, type IdentityErrorOptions, type IdentityErrorStatus, identityErrorStatus, isIdentityError, } from "./errors.js";
-export { MemoryRateLimitStore, RateLimiter, type RateLimiterLike, type RateLimiterOptions, type RateLimitResult, type RateLimitStore, } from "./rate-limit.js";
-export { type CaptchaOutcome, type CaptchaProvider, type CaptchaVerifyContext, type CaptchaVerifyResult, verifyCaptcha, type VerifyCaptchaOptions, } from "./captcha.js";
-export { assertPasswordPolicy, checkPasswordPolicy, type PasswordPolicy, type PasswordPolicyResult, } from "./password-policy.js";
-export { type BreachedPasswordOptions, breachedPasswordValidator, } from "./hibp.js";
+export { DEFAULT_PBKDF2_ITERATIONS, generateSalt, hashPassword, LEGACY_PBKDF2_ITERATIONS, type PasswordCredential, type PasswordHasherLike, type PasswordHashParams, PasswordIdentityService, type PasswordIdentityServiceOptions, PBKDF2_SHA256, verifyPassword, } from "./password.ts";
+export { classifyIdentifier, createIdentifierResolver, type IdentifierKind, type IdentifierLookups, } from "./identifier.ts";
+export { type CreatedToken, type CreateTokenOptions, MemoryTokenFlowStore, type ResolvedToken, type TokenFlowRecord, TokenFlowService, type TokenFlowStore, TokenPurpose, type TokenStatus, } from "./token-flow.ts";
+export { buildResetUrl, buildSignInUrl, buildTokenUrl, buildUnlockUrl, buildVerificationUrl, type CodeDeliveryHook, type CodeDeliveryMessage, type DeliveryHook, type DeliveryHooks, type DeliveryMessage, } from "./delivery.ts";
+export { isRecentlyAuthenticated, type ListableSessionService, type RevocableSessionService, type SessionSummary, supportsSessionListing, } from "./session.ts";
+export { type ConsumeSignInLinkResult, type IdentityRateLimiters, IdentityService, type IdentityServiceOptions, type IdentityUser, type IdentityUserStore, type UnlockAccountResult, type VerifyEmailResult, type VerifySignInCodeResult, } from "./service.ts";
+export { EmailOtpService, type EmailOtpServiceOptions, MemoryOtpStore, type OtpRecord, type OtpStore, type RequestedOtp, type RequestOtpOptions, type VerifyOtpOptions, type VerifyOtpResult, } from "./otp.ts";
+export { AccountLockout, type AccountLockoutLike, type AccountLockoutOptions, type LockoutFailureResult, type LockoutRecord, type LockoutStatus, type LockoutStore, MemoryLockoutStore, } from "./lockout.ts";
+export type { IdentityEvent, IdentityEventHook, SignInCodeFailureReason, SignInFailureReason, } from "./events.ts";
+export { IdentityError, type IdentityErrorCode, type IdentityErrorOptions, type IdentityErrorStatus, identityErrorStatus, isIdentityError, } from "./errors.ts";
+export { MemoryRateLimitStore, RateLimiter, type RateLimiterLike, type RateLimiterOptions, type RateLimitResult, type RateLimitStore, } from "./rate-limit.ts";
+export { type CaptchaOutcome, type CaptchaProvider, type CaptchaVerifyContext, type CaptchaVerifyResult, verifyCaptcha, type VerifyCaptchaOptions, } from "./captcha.ts";
+export { assertPasswordPolicy, checkPasswordPolicy, type PasswordPolicy, type PasswordPolicyResult, } from "./password-policy.ts";
+export { type BreachedPasswordOptions, breachedPasswordValidator, } from "./hibp.ts";

package/{esm → dist}/identity/mod.js

@@ -48,7 +48,6 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
 export { DEFAULT_PBKDF2_ITERATIONS, generateSalt, hashPassword, LEGACY_PBKDF2_ITERATIONS, PasswordIdentityService, PBKDF2_SHA256, verifyPassword, } from "./password.js";
 export { classifyIdentifier, createIdentifierResolver, } from "./identifier.js";
 export { MemoryTokenFlowStore, TokenFlowService, TokenPurpose, } from "./token-flow.js";

package/{esm → dist}/identity/otp.d.ts

@@ -17,7 +17,7 @@
  *
  * @module
  */
-import { type RateLimiterLike } from "./rate-limit.js";
+import { type RateLimiterLike } from "./rate-limit.ts";
 /**
  * The rate-limit key a one-time-code request is throttled under. Exported so
  * `IdentityService` throttles its sign-in-code flow under the very key

package/{esm → dist}/identity/otp.js

@@ -181,7 +181,7 @@ export class EmailOtpService {
         }
         if (timingSafeEqualString(record.codeHash, submittedHash)) {
             return {
-                status: await this.#store.consume(record.id) ? "success" : "invalid",
+                status: (await this.#store.consume(record.id)) ? "success" : "invalid",
             };
         }
         if (attempts === record.maxAttempts) {
@@ -209,7 +209,9 @@ export class MemoryOtpStore {
         let latest = null;
         for (const id of this.#active) {
             const record = this.#records.get(id);
-            if (record && record.email === email && record.purpose === purpose &&
+            if (record &&
+                record.email === email &&
+                record.purpose === purpose &&
                 (!latest || record.createdAt >= latest.createdAt)) {
                 latest = record;
             }

package/{esm → dist}/identity/password.js

@@ -14,8 +14,8 @@
  *
  * @module
  */
-import { encodeHex } from "../deps/jsr.io/@std/encoding/1.0.11/mod.js";
-import { timingSafeEqual } from "../deps/jsr.io/@std/crypto/1.1.0/timing_safe_equal.js";
+import { timingSafeEqual } from "node:crypto";
+import { encodeHex } from "../utils/_encoding.js";
 /**
  * Generates a cryptographically random salt for password hashing.
  *
@@ -81,7 +81,11 @@ export async function verifyPassword(password, salt, hash, iterations = DEFAULT_
     // Both are fixed-width hex digests, so length carries no secret.
     if (computedHash.length !== hash.length)
         return false;
-    return timingSafeEqual(encoder.encode(computedHash), encoder.encode(hash));
+    const computedBytes = encoder.encode(computedHash);
+    const expectedBytes = encoder.encode(hash);
+    if (computedBytes.byteLength !== expectedBytes.byteLength)
+        return false;
+    return timingSafeEqual(computedBytes, expectedBytes);
 }
 /**
  * Hashes and verifies passwords (PBKDF2-SHA-256, constant-time digest
@@ -153,7 +157,6 @@ export class PasswordIdentityService {
         const params = credential.params;
         if (!params)
             return LEGACY_PBKDF2_ITERATIONS < this.#iterations;
-        return params.algorithm !== PBKDF2_SHA256 ||
-            params.iterations < this.#iterations;
+        return (params.algorithm !== PBKDF2_SHA256 || params.iterations < this.#iterations);
     }
 }

package/{esm → dist}/identity/rate-limit.d.ts

@@ -9,7 +9,7 @@
  *
  * @module
  */
-import type { IdentityEvent, RateLimitedEventInit } from "./events.js";
+import type { IdentityEvent, RateLimitedEventInit } from "./events.ts";
 /** Pluggable counter store for {@link RateLimiter}. */
 export interface RateLimitStore {
     /**

package/{esm → dist}/identity/service.d.ts

@@ -17,16 +17,16 @@
  *
  * @module
  */
-import { type DeliveryHooks } from "./delivery.js";
-import type { AccountLockoutLike } from "./lockout.js";
-import { type PasswordCredential, type PasswordHasherLike } from "./password.js";
-import { type TokenFlowService } from "./token-flow.js";
-import type { RevocableSessionService } from "./session.js";
-import { type PasswordPolicy } from "./password-policy.js";
-import { type RateLimiterLike } from "./rate-limit.js";
-import { type OtpStore } from "./otp.js";
-import { type IdentityEventHook } from "./events.js";
-import { type LegacyPasswordVerifier } from "./migration.js";
+import { type DeliveryHooks } from "./delivery.ts";
+import type { AccountLockoutLike } from "./lockout.ts";
+import { type PasswordCredential, type PasswordHasherLike } from "./password.ts";
+import { type TokenFlowService } from "./token-flow.ts";
+import type { RevocableSessionService } from "./session.ts";
+import { type PasswordPolicy } from "./password-policy.ts";
+import { type RateLimiterLike } from "./rate-limit.ts";
+import { type OtpStore } from "./otp.ts";
+import { type IdentityEventHook } from "./events.ts";
+import { type LegacyPasswordVerifier } from "./migration.ts";
 /** The minimum the identity flows require of your user record. */
 export interface IdentityUser {
     /** Opaque user id the flows address users by; never interpreted by the library. */