@vibes.diy/identity 12.2.9 → 12.2.11

package/clerk-oauth-token.test.d.ts

@@ -0,0 +1 @@
+export {};

package/clerk-oauth-token.test.js

@@ -0,0 +1,502 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { ClerkOauthFallbackToken, INSTANCE_AFFINITY_TTL_MS, NEGATIVE_CACHE_MAX, NEGATIVE_CACHE_TTL_MS, USERINFO_TIMEOUT_MS, } from "./dash-api/clerk-oauth-token.js";
+import { ClerkClaimSchema } from "./clerk-claim.js";
+import { ensureSuperThis } from "./runtime/superthis.js";
+const USERINFO = {
+    object: "oauth_user_info",
+    instance_id: "ins_x",
+    user_id: "user_36Jeya36aK4m5JTt7BFDeVkgfuk",
+    sub: "user_36Jeya36aK4m5JTt7BFDeVkgfuk",
+    email: "dev@example.com",
+    email_verified: true,
+    family_name: "Estes",
+    given_name: "Marcus",
+    name: "Marcus Estes",
+    picture: "https://img.example/x.png",
+    public_metadata: { plan: "plus" },
+    username: "popmechanic",
+};
+const USERINFO_URL = "https://issuer.test/oauth/userinfo";
+function fetchOk(body = USERINFO) {
+    return vi.fn(async () => new Response(JSON.stringify(body), { status: 200 }));
+}
+const CLERK_ENV_KEYS = ["CLERK_PUB_JWT_URL", "CLERK_PUB_JWT_KEY"];
+function fetchHang() {
+    return vi.fn((_url, init) => new Promise((_resolve, reject) => {
+        const signal = init?.signal;
+        if (!signal)
+            return;
+        signal.addEventListener("abort", () => reject(signal.reason ?? new Error("aborted")));
+    }));
+}
+function fetchByUrl(routes) {
+    return vi.fn(async (url) => {
+        const mk = routes[url];
+        return mk === undefined ? new Response("nope", { status: 404 }) : mk();
+    });
+}
+function urlsOf(f) {
+    return callsOf(f).map(([url]) => url);
+}
+function callsOf(f) {
+    return f.mock.calls;
+}
+function mkToken(opts) {
+    const sthis = ensureSuperThis();
+    for (const k of CLERK_ENV_KEYS) {
+        sthis.env.delete(k);
+    }
+    for (const [k, v] of Object.entries(opts.env ?? {})) {
+        sthis.env.set(k, v);
+    }
+    return new ClerkOauthFallbackToken(sthis, {
+        clockTolerance: 5,
+        ...(opts.userinfoUrl === undefined ? {} : { userinfoUrl: opts.userinfoUrl }),
+        ...(opts.userinfoTimeoutMs === undefined ? {} : { userinfoTimeoutMs: opts.userinfoTimeoutMs }),
+        ...(opts.walkTimeoutMs === undefined ? {} : { walkTimeoutMs: opts.walkTimeoutMs }),
+        ...(opts.now === undefined ? {} : { now: opts.now }),
+        fetch: opts.fetch,
+    });
+}
+describe("ClerkOauthFallbackToken", () => {
+    afterEach(() => {
+        const sthis = ensureSuperThis();
+        for (const k of CLERK_ENV_KEYS) {
+            sthis.env.delete(k);
+        }
+    });
+    it("verifies an oat_ token via userinfo and synthesizes schema-valid clerk claims", async () => {
+        const f = fetchOk();
+        const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+        const r = await t.verify("oat_abc123");
+        expect(r.isOk()).toBe(true);
+        const v = r.Ok();
+        expect(v.type).toBe("clerk");
+        expect(v.token).toBe("oat_abc123");
+        const parsed = ClerkClaimSchema.safeParse(v.claims);
+        expect(parsed.success).toBe(true);
+        if (!parsed.success)
+            return;
+        expect(parsed.data).toEqual({
+            role: "user",
+            sub: USERINFO.sub,
+            userId: USERINFO.user_id,
+            params: {
+                email: USERINFO.email,
+                email_verified: true,
+                public_meta: USERINFO.public_metadata,
+                first: USERINFO.given_name,
+                last: USERINFO.family_name,
+                name: USERINFO.name,
+                image_url: USERINFO.picture,
+            },
+        });
+    });
+    it("calls userinfo with the bearer token and nothing else", async () => {
+        const f = fetchOk();
+        const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+        await t.verify("oat_abc123");
+        expect(f).toHaveBeenCalledTimes(1);
+        const [url, init] = callsOf(f)[0];
+        expect(url).toBe(USERINFO_URL);
+        expect(init.headers.authorization).toBe("Bearer oat_abc123");
+    });
+    it("derives the userinfo URL from the CLERK_PUB_JWT_URL origin when not given", async () => {
+        const f = fetchOk();
+        const t = mkToken({
+            fetch: f,
+            env: { CLERK_PUB_JWT_URL: "https://sincere-cheetah-30.clerk.accounts.dev/.well-known/jwks.json" },
+        });
+        const r = await t.verify("oat_abc123");
+        expect(r.isOk()).toBe(true);
+        const [url] = callsOf(f)[0];
+        expect(url).toBe("https://sincere-cheetah-30.clerk.accounts.dev/oauth/userinfo");
+    });
+    it("returns Err without a network call when no userinfo URL can be resolved", async () => {
+        const f = fetchOk();
+        const t = mkToken({ fetch: f });
+        const r = await t.verify("oat_abc123");
+        expect(r.isErr()).toBe(true);
+        expect(f).not.toHaveBeenCalled();
+    });
+    it("does not touch the network for non-oat_ tokens (delegates to the JWT verifier)", async () => {
+        const f = fetchOk();
+        const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+        await t.verify("eyJhbGciOi.fake.jwt");
+        await t.decode("eyJhbGciOi.fake.jwt");
+        expect(f).not.toHaveBeenCalled();
+    });
+    it("threads clockTolerance into the wrapped JWT verifier and mirrors it", () => {
+        const t = mkToken({ fetch: fetchOk(), userinfoUrl: USERINFO_URL });
+        expect(t.jwt.clockTolerance).toBe(5);
+        expect(t.clockTolerance).toBe(t.jwt.clockTolerance);
+    });
+    it("hands a non-oat_ token to the wrapped JWT verifier unchanged", async () => {
+        const f = fetchOk();
+        const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+        const verifySpy = vi.spyOn(t.jwt, "verify");
+        const decodeSpy = vi.spyOn(t.jwt, "decode");
+        const jwtish = "eyJhbGciOi.fake.jwt";
+        await t.verify(jwtish);
+        await t.decode(jwtish);
+        expect(verifySpy).toHaveBeenCalledWith(jwtish);
+        expect(decodeSpy).toHaveBeenCalledWith(jwtish);
+    });
+    it("never hands an oat_ token to the JWT verifier", async () => {
+        const t = mkToken({ fetch: fetchOk(), userinfoUrl: USERINFO_URL });
+        const verifySpy = vi.spyOn(t.jwt, "verify");
+        const decodeSpy = vi.spyOn(t.jwt, "decode");
+        await t.verify("oat_abc123");
+        await t.decode("oat_abc123");
+        expect(verifySpy).not.toHaveBeenCalled();
+        expect(decodeSpy).not.toHaveBeenCalled();
+    });
+    it("gates on the exact oat_ prefix — near misses never reach the network", async () => {
+        for (const near of ["oat", "oat-abc", "OAT_abc", " oat_abc", "xoat_abc", ""]) {
+            const f = fetchOk();
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+            await t.verify(near);
+            expect(f, `token ${JSON.stringify(near)} must not reach userinfo`).not.toHaveBeenCalled();
+        }
+    });
+    it("decode() of an oat_ token introspects (opaque tokens have no offline decode)", async () => {
+        const f = fetchOk();
+        const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+        const r = await t.decode("oat_abc123");
+        expect(r.isOk()).toBe(true);
+        expect(r.Ok().type).toBe("clerk");
+        expect(f).toHaveBeenCalledTimes(1);
+    });
+    it("returns Err (not throw) on non-2xx and on non-JSON userinfo bodies", async () => {
+        const responses = [
+            () => new Response("nope", { status: 401 }),
+            () => new Response("nope", { status: 500 }),
+            () => new Response("<html>", { status: 200 }),
+        ];
+        for (const mk of responses) {
+            const t = mkToken({ fetch: vi.fn(async () => mk()), userinfoUrl: USERINFO_URL });
+            const r = await t.verify("oat_bad");
+            expect(r.isErr()).toBe(true);
+        }
+    });
+    it("returns Err when userinfo omits or mistypes user_id", async () => {
+        for (const body of [{ sub: "user_x" }, { user_id: 42, sub: "user_x" }, { user_id: "", sub: "user_x" }, null, "a string", []]) {
+            const t = mkToken({ fetch: fetchOk(body), userinfoUrl: USERINFO_URL });
+            const r = await t.verify("oat_bad");
+            expect(r.isErr()).toBe(true);
+        }
+    });
+    it("returns Err (not throw) when the fetch itself rejects", async () => {
+        const t = mkToken({
+            fetch: vi.fn(async () => {
+                throw new Error("network down");
+            }),
+            userinfoUrl: USERINFO_URL,
+        });
+        const r = await t.verify("oat_abc123");
+        expect(r.isErr()).toBe(true);
+    });
+    it("never leaks the token value into an error message", async () => {
+        const cases = [
+            () => vi.fn(async () => new Response("nope", { status: 401 })),
+            () => vi.fn(async () => new Response("<html>", { status: 200 })),
+            () => vi.fn(async () => ({})),
+            () => vi.fn(async () => {
+                throw new Error("network down oat_supersecret");
+            }),
+        ];
+        for (const mk of cases) {
+            const t = mkToken({ fetch: mk(), userinfoUrl: USERINFO_URL });
+            const r = await t.verify("oat_supersecret");
+            expect(r.isErr()).toBe(true);
+            expect(String(r.Err())).not.toContain("oat_supersecret");
+        }
+    });
+    it("falls back to schema defaults when userinfo omits the display fields", async () => {
+        const t = mkToken({
+            fetch: fetchOk({ user_id: "user_y", sub: "user_y", email: "y@example.com", email_verified: false }),
+            userinfoUrl: USERINFO_URL,
+        });
+        const r = await t.verify("oat_abc123");
+        expect(r.isOk()).toBe(true);
+        const parsed = ClerkClaimSchema.safeParse(r.Ok().claims);
+        expect(parsed.success).toBe(true);
+        if (!parsed.success)
+            return;
+        expect(parsed.data).toEqual({
+            role: "user",
+            sub: "user_y",
+            userId: "user_y",
+            params: {
+                email: "y@example.com",
+                email_verified: false,
+                public_meta: {},
+                first: "",
+                last: "",
+                name: null,
+                image_url: "",
+            },
+        });
+    });
+    it("falls back to user_id for sub, and treats a non-true email_verified as false", async () => {
+        const t = mkToken({
+            fetch: fetchOk({ user_id: "user_z", email: "z@example.com", email_verified: "yes" }),
+            userinfoUrl: USERINFO_URL,
+        });
+        const r = await t.verify("oat_abc123");
+        expect(r.isOk()).toBe(true);
+        const claims = r.Ok().claims;
+        expect(claims.sub).toBe("user_z");
+        expect(claims.params.email_verified).toBe(false);
+    });
+    it("defaults a missing email to the empty string the downstream guard expects", async () => {
+        const t = mkToken({ fetch: fetchOk({ user_id: "user_q", sub: "user_q" }), userinfoUrl: USERINFO_URL });
+        const r = await t.verify("oat_abc123");
+        expect(r.isOk()).toBe(true);
+        const claims = r.Ok().claims;
+        expect(claims.params.email).toBe("");
+        expect(claims.params.email_verified).toBe(false);
+    });
+    describe("bounded introspection (SSR first-glance amplification)", () => {
+        it("passes a live, unfired abort signal on every introspection", async () => {
+            const f = fetchOk();
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+            await t.verify("oat_abc123");
+            const [, init] = callsOf(f)[0];
+            expect(init.signal).toBeInstanceOf(AbortSignal);
+            expect(init.signal?.aborted).toBe(false);
+        });
+        it("defaults the deadline to USERINFO_TIMEOUT_MS", () => {
+            const t = mkToken({ fetch: fetchOk(), userinfoUrl: USERINFO_URL });
+            expect(t.userinfoTimeoutMs).toBe(USERINFO_TIMEOUT_MS);
+            expect(USERINFO_TIMEOUT_MS).toBeGreaterThan(0);
+        });
+        it("aborts a hanging userinfo call and returns Err instead of waiting forever", async () => {
+            const f = fetchHang();
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL, userinfoTimeoutMs: 10 });
+            const r = await t.verify("oat_supersecret");
+            expect(r.isErr()).toBe(true);
+            expect(String(r.Err())).not.toContain("oat_supersecret");
+        });
+        it("does not cache a timeout — a hiccup must not lock a real token out", async () => {
+            const f = fetchHang();
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL, userinfoTimeoutMs: 10 });
+            expect((await t.verify("oat_abc123")).isErr()).toBe(true);
+            expect((await t.verify("oat_abc123")).isErr()).toBe(true);
+            expect(f).toHaveBeenCalledTimes(2);
+            expect(t.negativeCache.size).toBe(0);
+        });
+        it("replaying a token Clerk rejected costs no further outbound requests", async () => {
+            const f = vi.fn(async () => new Response("nope", { status: 401 }));
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+            const first = await t.verify("oat_bad");
+            for (let i = 0; i < 25; i++) {
+                const again = await t.verify("oat_bad");
+                expect(again.isErr()).toBe(true);
+                expect(String(again.Err())).toBe(String(first.Err()));
+            }
+            expect(f).toHaveBeenCalledTimes(1);
+        });
+        it("caches an unusable 2xx body too (no user_id)", async () => {
+            const f = fetchOk({ sub: "user_x" });
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            expect(f).toHaveBeenCalledTimes(1);
+        });
+        it("does not cache a 5xx — that is Clerk failing, not a verdict on the token", async () => {
+            const f = vi.fn(async () => new Response("boom", { status: 503 }));
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+            expect((await t.verify("oat_abc123")).isErr()).toBe(true);
+            expect((await t.verify("oat_abc123")).isErr()).toBe(true);
+            expect(f).toHaveBeenCalledTimes(2);
+            expect(t.negativeCache.size).toBe(0);
+        });
+        it("never caches a success — a revoked token must not stay accepted", async () => {
+            const f = fetchOk();
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+            expect((await t.verify("oat_abc123")).isOk()).toBe(true);
+            expect((await t.verify("oat_abc123")).isOk()).toBe(true);
+            expect(f).toHaveBeenCalledTimes(2);
+            expect(t.negativeCache.size).toBe(0);
+        });
+        it("re-checks a rejected token once its verdict ages past the TTL", async () => {
+            let clock = 1_000_000;
+            const f = vi.fn(async () => new Response("nope", { status: 401 }));
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL, now: () => clock });
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            clock += NEGATIVE_CACHE_TTL_MS - 1;
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            expect(f).toHaveBeenCalledTimes(1);
+            clock += 2;
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            expect(f).toHaveBeenCalledTimes(2);
+        });
+        it("caps the negative cache — its keys are attacker-supplied", async () => {
+            const f = vi.fn(async () => new Response("nope", { status: 401 }));
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+            for (let i = 0; i < NEGATIVE_CACHE_MAX + 50; i++) {
+                await t.verify(`oat_${i}`);
+            }
+            expect(t.negativeCache.size).toBe(NEGATIVE_CACHE_MAX);
+            expect(t.negativeCache.has("oat_0")).toBe(false);
+            expect(t.negativeCache.has(`oat_${NEGATIVE_CACHE_MAX + 49}`)).toBe(true);
+        });
+        it("never introspects a non-oat_ bearer, so the JWT-verify budget is unchanged", async () => {
+            const f = fetchOk();
+            const t = mkToken({ fetch: f, userinfoUrl: USERINFO_URL });
+            await t.verify("eyJhbGciOi.fake.jwt");
+            expect(f).not.toHaveBeenCalled();
+            expect(t.negativeCache.size).toBe(0);
+        });
+    });
+    describe("multi-instance introspection (#4704)", () => {
+        const A = "https://a.clerk.accounts.dev/oauth/userinfo";
+        const B = "https://b.clerk.accounts.dev/oauth/userinfo";
+        const TWO_INSTANCES = {
+            CLERK_PUB_JWT_URL: "https://a.clerk.accounts.dev/.well-known/jwks.json,https://b.clerk.accounts.dev/.well-known/jwks.json",
+        };
+        const ok = () => new Response(JSON.stringify(USERINFO), { status: 200 });
+        const status = (code) => () => new Response("nope", { status: code });
+        it("derives one userinfo endpoint per configured instance, in configured order", () => {
+            const t = mkToken({ fetch: fetchOk(), env: TWO_INSTANCES });
+            expect(t.userinfoUrls().Ok()).toEqual([A, B]);
+        });
+        it("accepts a token the SECOND instance minted, having asked the first", async () => {
+            const f = fetchByUrl({ [B]: ok });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            const r = await t.verify("oat_from_b");
+            expect(r.isOk(), `expected instance B to carry it: ${r.isErr() ? String(r.Err()) : ""}`).toBe(true);
+            expect(urlsOf(f)).toEqual([A, B]);
+        });
+        it("stops at the first instance that accepts — no fan-out past a hit", async () => {
+            const f = fetchByUrl({ [A]: ok, [B]: ok });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            expect((await t.verify("oat_from_a")).isOk()).toBe(true);
+            expect(urlsOf(f)).toEqual([A]);
+        });
+        it("is invalid only once EVERY instance has rejected it, and caches that", async () => {
+            const f = fetchByUrl({ [A]: status(401), [B]: status(401) });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            expect(urlsOf(f)).toEqual([A, B]);
+            expect(t.negativeCache.size).toBe(1);
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            expect(f).toHaveBeenCalledTimes(2);
+        });
+        it("keeps 429/408 definitive per instance (unchanged semantics, applied to each)", async () => {
+            const f = fetchByUrl({ [A]: status(429), [B]: status(408) });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            expect(t.negativeCache.size).toBe(1);
+        });
+        it("walks past a transient first instance to a second that accepts", async () => {
+            const f = fetchByUrl({ [A]: status(503), [B]: ok });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            expect((await t.verify("oat_from_b")).isOk()).toBe(true);
+            expect(urlsOf(f)).toEqual([A, B]);
+            expect(t.negativeCache.size).toBe(0);
+        });
+        it("fails closed but UNCACHED when one instance rejected and another was transient", async () => {
+            const f = fetchByUrl({ [A]: status(503), [B]: status(401) });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            expect((await t.verify("oat_maybe")).isErr()).toBe(true);
+            expect(t.negativeCache.size).toBe(0);
+            expect((await t.verify("oat_maybe")).isErr()).toBe(true);
+            expect(f).toHaveBeenCalledTimes(4);
+        });
+        it("a transport failure at one instance is transient there, not a verdict", async () => {
+            const f = vi.fn(async (url) => {
+                if (url === A)
+                    throw new Error("network down");
+                return ok();
+            });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            expect((await t.verify("oat_from_b")).isOk()).toBe(true);
+            expect(t.negativeCache.size).toBe(0);
+        });
+        it("a 2xx with an unusable body is a VERDICT — no fallthrough to the next instance", async () => {
+            const f = fetchByUrl({
+                [A]: () => new Response(JSON.stringify({ sub: "user_x" }), { status: 200 }),
+                [B]: ok,
+            });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            expect((await t.verify("oat_bad")).isErr()).toBe(true);
+            expect(urlsOf(f)).toEqual([A]);
+            expect(t.negativeCache.size).toBe(1);
+        });
+        it("remembers which instance minted a token so the warm path skips the dead ones", async () => {
+            const f = fetchByUrl({ [B]: ok });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            expect((await t.verify("oat_from_b")).isOk()).toBe(true);
+            expect((await t.verify("oat_from_b")).isOk()).toBe(true);
+            expect(urlsOf(f)).toEqual([A, B, B]);
+        });
+        it("re-walks the full list once the affinity ages out", async () => {
+            let clock = 1_000_000;
+            const f = fetchByUrl({ [B]: ok });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES, now: () => clock });
+            expect((await t.verify("oat_from_b")).isOk()).toBe(true);
+            clock += INSTANCE_AFFINITY_TTL_MS + 1;
+            expect((await t.verify("oat_from_b")).isOk()).toBe(true);
+            expect(urlsOf(f)).toEqual([A, B, A, B]);
+        });
+        it("drops a stale affinity when that instance stops accepting the token", async () => {
+            const routes = { [B]: ok };
+            const f = fetchByUrl(routes);
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES, now: () => 1_000_000 });
+            expect((await t.verify("oat_from_b")).isOk()).toBe(true);
+            routes[B] = status(401);
+            expect((await t.verify("oat_from_b")).isErr()).toBe(true);
+            expect(t.instanceAffinity.size).toBe(0);
+        });
+        it("skips an entry that is not an http(s) origin rather than going blind on the rest", async () => {
+            const f = fetchByUrl({ [B]: ok });
+            const t = mkToken({
+                fetch: f,
+                env: { CLERK_PUB_JWT_URL: "not a url,https://b.clerk.accounts.dev/.well-known/jwks.json" },
+            });
+            expect((await t.verify("oat_from_b")).isOk()).toBe(true);
+            expect(urlsOf(f)).toEqual([B]);
+        });
+        it("introspects each instance under its OWN deadline", async () => {
+            const f = fetchByUrl({ [A]: status(404), [B]: ok });
+            const t = mkToken({ fetch: f, env: TWO_INSTANCES });
+            await t.verify("oat_from_b");
+            for (const [, init] of callsOf(f)) {
+                expect(init.signal).toBeInstanceOf(AbortSignal);
+                expect(init.signal?.aborted).toBe(false);
+            }
+        });
+        it("bounds the WHOLE walk, not each attempt — slow instances cannot stack", async () => {
+            const f = fetchHang();
+            const t = mkToken({
+                fetch: f,
+                env: {
+                    CLERK_PUB_JWT_URL: [
+                        "https://a.clerk.accounts.dev/.well-known/jwks.json",
+                        "https://b.clerk.accounts.dev/.well-known/jwks.json",
+                        "https://c.clerk.accounts.dev/.well-known/jwks.json",
+                    ].join(","),
+                },
+                userinfoTimeoutMs: 100,
+                walkTimeoutMs: 25,
+            });
+            const started = Date.now();
+            const r = await t.verify("oat_supersecret");
+            const elapsed = Date.now() - started;
+            expect(r.isErr()).toBe(true);
+            expect(elapsed).toBeLessThan(150);
+            expect(f).toHaveBeenCalledTimes(1);
+            expect(t.negativeCache.size).toBe(0);
+            expect(String(r.Err())).not.toContain("oat_supersecret");
+        });
+        it("still returns Err without any network call when nothing is configured", async () => {
+            const f = fetchOk();
+            const t = mkToken({ fetch: f, env: { CLERK_PUB_JWT_URL: "not a url" } });
+            expect((await t.verify("oat_abc123")).isErr()).toBe(true);
+            expect(f).not.toHaveBeenCalled();
+        });
+    });
+});
+//# sourceMappingURL=clerk-oauth-token.test.js.map

package/clerk-oauth-token.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk-oauth-token.test.js","sourceRoot":"","sources":["../jsr/clerk-oauth-token.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIzD,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE,iBAAiB;IACzB,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,kCAAkC;IAC3C,GAAG,EAAE,kCAAkC;IACvC,KAAK,EAAE,iBAAiB;IACxB,cAAc,EAAE,IAAI;IACpB,WAAW,EAAE,OAAO;IACpB,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,2BAA2B;IACpC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IACjC,QAAQ,EAAE,aAAa;CACxB,CAAC;AAEF,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D,SAAS,OAAO,CAAC,IAAI,GAAY,QAAQ;IACvC,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;AAC3G,CAAC;AAKD,MAAM,cAAc,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;AAKlE,SAAS,SAAS;IAChB,OAAO,EAAE,CAAC,EAAE,CACV,CAAC,IAAY,EAAE,IAAkB,EAAE,EAAE,CACnC,IAAI,OAAO,CAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CACsB,CAAC;AAC/B,CAAC;AAKD,SAAS,UAAU,CAAC,MAAsC;IACxD,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QACjC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzE,CAAC,CAA4B,CAAC;AAChC,CAAC;AAED,SAAS,MAAM,CAAC,CAAe;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,OAAO,CAAC,CAAe;IAC9B,OAAQ,CAA6D,CAAC,IAAI,CAAC,KAAK,CAAC;AACnF,CAAC;AAED,SAAS,OAAO,CAAC,IAOhB;IACC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC,KAAK,EAAE;QACxC,cAAc,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9F,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAInC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC1B,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,OAAO;YACxB,MAAM,EAAE;gBACN,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,cAAc,EAAE,IAAI;gBACpB,WAAW,EAAE,QAAQ,CAAC,eAAe;gBACrC,KAAK,EAAE,QAAQ,CAAC,UAAU;gBAC1B,IAAI,EAAE,QAAQ,CAAC,WAAW;gBAC1B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,QAAQ,CAAC,OAAO;aAC5B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,MAAM,CAAE,IAAI,CAAC,OAAkC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC;YAChB,KAAK,EAAE,CAAC;YACR,GAAG,EAAE,EAAE,iBAAiB,EAAE,qEAAqE,EAAE;SAClG,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACrC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,CAAC,CAAC,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,SAAS,GAAG;YAChB,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC3C,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC3C,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SAC9C,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAA4B,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5G,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7H,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YACvE,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,CAAC,GAAG,OAAO,CAAC;YAChB,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;gBACtB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,CAAC,CAA4B;YAC7B,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAA2B;YACpC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B;YACzF,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B;YAC3F,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAU,CAA4B;YACjE,GAAG,EAAE,CACH,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;gBACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC,CAA4B;SAChC,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,CAAC,GAAG,OAAO,CAAC;YAChB,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACnG,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC1B,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,KAAK,EAAE,eAAe;gBACtB,cAAc,EAAE,KAAK;gBACrB,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,EAAE;gBACT,IAAI,EAAE,EAAE;gBACR,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,EAAE;aACd;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,CAAC,GAAG,OAAO,CAAC;YAChB,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACpF,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,MAA8D,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,MAAgE,CAAC;QACvF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAKH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;QACtE,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YACnE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACtD,MAAM,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;YACzF,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;YAC9F,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACxC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;YACxF,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;YAC9F,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,IAAI,KAAK,GAAG,SAAS,CAAC;YACtB,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;YAC9F,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,KAAK,IAAI,qBAAqB,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YACnC,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;YAC9F,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACjD,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;YACD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAEtD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,kBAAkB,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;YAC1F,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACtC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACjC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAOH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,6CAA6C,CAAC;QACxD,MAAM,CAAC,GAAG,6CAA6C,CAAC;QACxD,MAAM,aAAa,GAAG;YACpB,iBAAiB,EAAE,uGAAuG;SAC3H,CAAC;QACF,MAAM,EAAE,GAAG,GAAa,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAa,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAExF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;YACpF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YAC5D,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACvC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YAChF,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACpF,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAErC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;YAC9E,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAC9F,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEzD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;gBACpC,IAAI,GAAG,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;gBAC/C,OAAO,EAAE,EAAE,CAAC;YACd,CAAC,CAA4B,CAAC;YAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAC9F,MAAM,CAAC,GAAG,UAAU,CAAC;gBACnB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;gBAC3E,CAAC,CAAC,CAAC,EAAE,EAAE;aACR,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAGzD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,IAAI,KAAK,GAAG,SAAS,CAAC;YACtB,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,KAAK,IAAI,wBAAwB,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,MAAM,GAAmC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YAC1E,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAIH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;YAChG,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,OAAO,CAAC;gBAChB,KAAK,EAAE,CAAC;gBACR,GAAG,EAAE,EAAE,iBAAiB,EAAE,8DAA8D,EAAE;aAC3F,CAAC,CAAC;YACH,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,CAAC;QAKH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,OAAO,CAAC;gBAChB,KAAK,EAAE,CAAC;gBACR,GAAG,EAAE;oBACH,iBAAiB,EAAE;wBACjB,oDAAoD;wBACpD,oDAAoD;wBACpD,oDAAoD;qBACrD,CAAC,IAAI,CAAC,GAAG,CAAC;iBACZ;gBACD,iBAAiB,EAAE,GAAG;gBACtB,aAAa,EAAE,EAAE;aAClB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACrC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAG7B,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dash-api/clerk-oauth-token.d.ts

@@ -0,0 +1,60 @@
+import { Result } from "@adviser/cement";
+import type { SuperThis } from "../types/sthis.js";
+import type { FPApiToken, VerifiedClaimsResult } from "../types/wire.js";
+import { ClerkApiToken } from "./clerk-token.js";
+export declare const USERINFO_TIMEOUT_MS = 2000;
+export declare const WALK_TIMEOUT_FACTOR = 2;
+export declare const WALK_TIMEOUT_MS: number;
+export declare const NEGATIVE_CACHE_TTL_MS = 60000;
+export declare const NEGATIVE_CACHE_MAX = 512;
+export declare const INSTANCE_AFFINITY_TTL_MS = 600000;
+export declare const INSTANCE_AFFINITY_MAX = 512;
+export interface ClerkOauthFallbackOptions {
+    readonly clockTolerance?: number;
+    readonly userinfoUrl?: string;
+    readonly fetch?: typeof fetch;
+    readonly userinfoTimeoutMs?: number;
+    readonly walkTimeoutMs?: number;
+    readonly now?: () => number;
+}
+export declare class BoundedTokenMemo<V> {
+    readonly ttlMs: number;
+    readonly max: number;
+    readonly now: () => number;
+    readonly entries: Map<string, {
+        readonly at: number;
+        readonly value: V;
+    }>;
+    constructor(opts: {
+        readonly ttlMs: number;
+        readonly max: number;
+        readonly now: () => number;
+    });
+    get size(): number;
+    recall(key: string): V | undefined;
+    has(key: string): boolean;
+    forget(key: string): void;
+    remember(key: string, value: V): void;
+}
+export declare class ClerkOauthFallbackToken implements FPApiToken {
+    readonly sthis: SuperThis;
+    readonly jwt: ClerkApiToken;
+    readonly clockTolerance?: number;
+    readonly explicitUserinfoUrl?: string;
+    readonly fetchImpl: typeof fetch;
+    readonly userinfoTimeoutMs: number;
+    readonly walkTimeoutMs: number;
+    readonly now: () => number;
+    readonly negativeCache: BoundedTokenMemo<string>;
+    readonly instanceAffinity: BoundedTokenMemo<string>;
+    constructor(sthis: SuperThis, opts?: ClerkOauthFallbackOptions);
+    readonly userinfoUrls: () => Result<string[], Error>;
+    verify(token: string): Promise<Result<VerifiedClaimsResult>>;
+    decode(token: string): Promise<Result<VerifiedClaimsResult>>;
+    private rememberRejection;
+    private introspectionOrder;
+    private introspect;
+    private onVerdict;
+    private introspectAt;
+    private claimsFrom;
+}

package/dash-api/clerk-oauth-token.js

@@ -0,0 +1,230 @@
+import { exception2Result, Lazy, Result, URI } from "@adviser/cement";
+import { ClerkClaimSchema } from "../clerk-claim.js";
+import { ClerkApiToken } from "./clerk-token.js";
+const OAT_PREFIX = "oat_";
+const USERINFO_PATH = "/oauth/userinfo";
+export const USERINFO_TIMEOUT_MS = 2000;
+export const WALK_TIMEOUT_FACTOR = 2;
+export const WALK_TIMEOUT_MS = USERINFO_TIMEOUT_MS * WALK_TIMEOUT_FACTOR;
+export const NEGATIVE_CACHE_TTL_MS = 60_000;
+export const NEGATIVE_CACHE_MAX = 512;
+export const INSTANCE_AFFINITY_TTL_MS = 600_000;
+export const INSTANCE_AFFINITY_MAX = 512;
+const INTROSPECTABLE_PROTOCOLS = ["http:", "https:"];
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+export class BoundedTokenMemo {
+    ttlMs;
+    max;
+    now;
+    entries = new Map();
+    constructor(opts) {
+        this.ttlMs = opts.ttlMs;
+        this.max = opts.max;
+        this.now = opts.now;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    recall(key) {
+        const hit = this.entries.get(key);
+        if (hit === undefined) {
+            return undefined;
+        }
+        if (this.now() - hit.at >= this.ttlMs) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        return hit.value;
+    }
+    has(key) {
+        return this.recall(key) !== undefined;
+    }
+    forget(key) {
+        this.entries.delete(key);
+    }
+    remember(key, value) {
+        this.entries.delete(key);
+        while (this.entries.size >= this.max) {
+            const oldest = this.entries.keys().next();
+            if (oldest.done) {
+                break;
+            }
+            this.entries.delete(oldest.value);
+        }
+        this.entries.set(key, { at: this.now(), value });
+    }
+}
+export class ClerkOauthFallbackToken {
+    sthis;
+    jwt;
+    clockTolerance;
+    explicitUserinfoUrl;
+    fetchImpl;
+    userinfoTimeoutMs;
+    walkTimeoutMs;
+    now;
+    negativeCache;
+    instanceAffinity;
+    constructor(sthis, opts) {
+        this.sthis = sthis;
+        this.jwt = new ClerkApiToken(sthis, { clockTolerance: opts?.clockTolerance });
+        this.clockTolerance = this.jwt.clockTolerance;
+        this.explicitUserinfoUrl = opts?.userinfoUrl;
+        this.fetchImpl = opts?.fetch ?? ((input, init) => globalThis.fetch(input, init));
+        this.userinfoTimeoutMs = opts?.userinfoTimeoutMs ?? USERINFO_TIMEOUT_MS;
+        this.walkTimeoutMs = opts?.walkTimeoutMs ?? this.userinfoTimeoutMs * WALK_TIMEOUT_FACTOR;
+        this.now = opts?.now ?? (() => Date.now());
+        this.negativeCache = new BoundedTokenMemo({
+            ttlMs: NEGATIVE_CACHE_TTL_MS,
+            max: NEGATIVE_CACHE_MAX,
+            now: this.now,
+        });
+        this.instanceAffinity = new BoundedTokenMemo({
+            ttlMs: INSTANCE_AFFINITY_TTL_MS,
+            max: INSTANCE_AFFINITY_MAX,
+            now: this.now,
+        });
+    }
+    userinfoUrls = Lazy(() => {
+        if (this.explicitUserinfoUrl !== undefined) {
+            return Result.Ok([this.explicitUserinfoUrl]);
+        }
+        const rKaUs = this.jwt.keysAndUrls();
+        if (rKaUs.isErr()) {
+            return Result.Err(rKaUs);
+        }
+        const derived = [];
+        for (const jwksUrl of rKaUs.Ok().urls) {
+            const rJwks = URI.fromResult(jwksUrl);
+            if (rJwks.isErr()) {
+                continue;
+            }
+            const jwks = rJwks.Ok();
+            if (!INTROSPECTABLE_PROTOCOLS.includes(jwks.protocol) || jwks.hostname.length === 0) {
+                continue;
+            }
+            const url = jwks.build().pathname(USERINFO_PATH).cleanParams().hash("").toString();
+            if (!derived.includes(url)) {
+                derived.push(url);
+            }
+        }
+        if (derived.length === 0) {
+            return Result.Err("clerk oauth: no usable CLERK_PUB_JWT_URL to derive a userinfo endpoint from");
+        }
+        return Result.Ok(derived);
+    });
+    async verify(token) {
+        if (!token.startsWith(OAT_PREFIX)) {
+            return this.jwt.verify(token);
+        }
+        return this.introspect(token);
+    }
+    async decode(token) {
+        if (!token.startsWith(OAT_PREFIX)) {
+            return this.jwt.decode(token);
+        }
+        return this.introspect(token);
+    }
+    rememberRejection(token, reason) {
+        this.negativeCache.remember(token, reason);
+        this.instanceAffinity.forget(token);
+        return Result.Err(reason);
+    }
+    introspectionOrder(opts) {
+        const preferred = this.instanceAffinity.recall(opts.token);
+        if (preferred === undefined || !opts.urls.includes(preferred)) {
+            return [...opts.urls];
+        }
+        return [preferred, ...opts.urls.filter((u) => u !== preferred)];
+    }
+    async introspect(token) {
+        const remembered = this.negativeCache.recall(token);
+        if (remembered !== undefined) {
+            return Result.Err(remembered);
+        }
+        const rUrls = this.userinfoUrls();
+        if (rUrls.isErr()) {
+            return Result.Err(rUrls);
+        }
+        const configured = rUrls.Ok();
+        const urls = this.introspectionOrder({ token, urls: configured });
+        const walkSignal = AbortSignal.timeout(this.walkTimeoutMs);
+        let sawTransient = false;
+        let lastReason = "clerk oauth: no clerk instance accepted the token";
+        for (const url of urls) {
+            if (walkSignal.aborted) {
+                return Result.Err("clerk oauth: userinfo introspection ran out of time");
+            }
+            const attempt = await this.introspectAt({ token, url, walkSignal });
+            if (attempt.kind === "verdict") {
+                return this.onVerdict({ token, url, value: attempt.value, isPrimary: url === configured[0] });
+            }
+            sawTransient = sawTransient || attempt.kind === "transient";
+            lastReason = attempt.reason;
+        }
+        if (sawTransient) {
+            return Result.Err(lastReason);
+        }
+        return this.rememberRejection(token, lastReason);
+    }
+    onVerdict(opts) {
+        if (opts.value.isErr()) {
+            return opts.value;
+        }
+        this.instanceAffinity.remember(opts.token, opts.url);
+        const line = opts.isPrimary ? this.sthis.logger.Debug() : this.sthis.logger.Info();
+        line.Str("clerkInstance", URI.from(opts.url).host).Msg("clerk oauth: userinfo accepted");
+        return opts.value;
+    }
+    async introspectAt(opts) {
+        const { token, url, walkSignal } = opts;
+        const rRes = await exception2Result(() => this.fetchImpl(url, {
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.any([walkSignal, AbortSignal.timeout(this.userinfoTimeoutMs)]),
+        }));
+        if (rRes.isErr()) {
+            return { kind: "transient", reason: "clerk oauth: userinfo introspection failed" };
+        }
+        const res = rRes.Ok();
+        if (!res.ok) {
+            const reason = `clerk oauth token rejected by userinfo: ${res.status}`;
+            return res.status >= 500 ? { kind: "transient", reason } : { kind: "rejected", reason };
+        }
+        return { kind: "verdict", value: await this.claimsFrom({ token, res }) };
+    }
+    async claimsFrom(opts) {
+        const { token, res } = opts;
+        const rInfo = await exception2Result(() => res.json());
+        if (rInfo.isErr()) {
+            return Result.Err("clerk oauth: userinfo introspection failed");
+        }
+        const info = rInfo.Ok();
+        if (!isRecord(info)) {
+            return this.rememberRejection(token, "clerk oauth: userinfo body is not an object");
+        }
+        if (typeof info.user_id !== "string" || info.user_id.length === 0) {
+            return this.rememberRejection(token, "clerk oauth: userinfo response has no user_id");
+        }
+        const parsed = ClerkClaimSchema.safeParse({
+            role: "user",
+            sub: typeof info.sub === "string" ? info.sub : info.user_id,
+            userId: info.user_id,
+            params: {
+                email: typeof info.email === "string" ? info.email : "",
+                email_verified: info.email_verified === true,
+                public_meta: info.public_metadata ?? {},
+                first: info.given_name,
+                last: info.family_name,
+                name: info.name,
+                image_url: info.picture,
+            },
+        });
+        if (!parsed.success) {
+            return Result.Err(parsed.error);
+        }
+        return Result.Ok({ type: "clerk", token, claims: parsed.data });
+    }
+}
+//# sourceMappingURL=clerk-oauth-token.js.map

package/dash-api/clerk-oauth-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk-oauth-token.js","sourceRoot":"","sources":["../../jsr/dash-api/clerk-oauth-token.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD,MAAM,UAAU,GAAG,MAAM,CAAC;AAG1B,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAMxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAQxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAMzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAK5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAOtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAIhD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAOzC,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AA0CrD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAOD,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAS;IACd,GAAG,CAAS;IACZ,GAAG,CAAe;IAClB,OAAO,GAAG,IAAI,GAAG,EAAsD,CAAC;IAEjF,YAAY,IAAkF;QAC5F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,QAAQ,CAAC,GAAW,EAAE,KAAQ;QAG5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;CACF;AAcD,MAAM,OAAO,uBAAuB;IACzB,KAAK,CAAY;IACjB,GAAG,CAAgB;IAKnB,cAAc,CAAU;IACxB,mBAAmB,CAAU;IAC7B,SAAS,CAAe;IACxB,iBAAiB,CAAS;IAC1B,aAAa,CAAS;IACtB,GAAG,CAAe;IAIlB,aAAa,CAA2B;IAExC,gBAAgB,CAA2B;IAEpD,YAAY,KAAgB,EAAE,IAAgC;QAC5D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,mBAAmB,GAAG,IAAI,EAAE,WAAW,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,iBAAiB,GAAG,IAAI,EAAE,iBAAiB,IAAI,mBAAmB,CAAC;QACxE,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC,iBAAiB,GAAG,mBAAmB,CAAC;QACzF,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,IAAI,gBAAgB,CAAS;YAChD,KAAK,EAAE,qBAAqB;YAC5B,GAAG,EAAE,kBAAkB;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAS;YACnD,KAAK,EAAE,wBAAwB;YAC/B,GAAG,EAAE,qBAAqB;YAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;IACL,CAAC;IASQ,YAAY,GAAG,IAAI,CAAC,GAAqB,EAAE;QAClD,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC;YAGxB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpF,SAAS;YACX,CAAC;YAGD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAGnF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAGD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAIO,iBAAiB,CAAC,KAAa,EAAE,MAAc;QACrD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAMO,kBAAkB,CAAC,IAAkE;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa;QAGpC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAKlE,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,UAAU,GAAG,mDAAmD,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBAEvB,OAAO,MAAM,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,YAAY,GAAG,YAAY,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC;YAC5D,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,CAAC;QAID,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACnD,CAAC;IAKO,SAAS,CAAC,IAKjB;QACC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAIrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAI1B;QACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAIxC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YAClB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAI7C,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;SACnF,CAAC,CACH,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAIZ,MAAM,MAAM,GAAG,2CAA2C,GAAG,CAAC,MAAM,EAAE,CAAC;YACvE,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3E,CAAC;IAIO,KAAK,CAAC,UAAU,CAAC,IAAwD;QAC/E,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAU,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAY,KAAK,CAAC,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,6CAA6C,CAAC,CAAC;QACtF,CAAC;QAGD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC;QACxF,CAAC;QAID,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC;YAGxC,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;YAC3D,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,MAAM,EAAE;gBACN,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBACvD,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC5C,WAAW,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;gBAGvC,KAAK,EAAE,IAAI,CAAC,UAAU;gBACtB,IAAI,EAAE,IAAI,CAAC,WAAW;gBACtB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,IAAI,CAAC,OAAO;aACxB;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dash-api/token.d.ts

@@ -2,9 +2,10 @@ import { Result } from "@adviser/cement";
 import type { SuperThis } from "../types/sthis.js";
 import type { VerifyWithCertificateOptions } from "../types/device-id-types.js";
 import { DeviceIdCA } from "../device-id/ca.js";
-import { ClerkApiToken } from "./clerk-token.js";
+import { ClerkOauthFallbackToken } from "./clerk-oauth-token.js";
 import type { FPApiToken, VerifiedClaimsResult, JWKPublic } from "../types/wire.js";
 export { ClerkApiToken } from "./clerk-token.js";
+export { ClerkOauthFallbackToken } from "./clerk-oauth-token.js";
 export declare class DeviceIdApiToken implements FPApiToken {
     readonly sthis: SuperThis;
     readonly opts: VerifyWithCertificateOptions;
@@ -18,5 +19,5 @@ export declare function getCloudPubkeyFromEnv(cloudToken?: string, sthis?: Super
 }>>;
 export declare const tokenApi: (sthis: SuperThis, opts: VerifyWithCertificateOptions) => Promise<{
     "device-id": DeviceIdApiToken;
-    clerk: ClerkApiToken;
+    clerk: ClerkOauthFallbackToken;
 }>;

package/dash-api/token.js

@@ -7,8 +7,9 @@ import { JWKPublicSchema, toJwksAlg } from "../types/wire.js";
 import { FPDeviceIDSessionSchema } from "../types/device-id-payload.js";
 import { DeviceIdCA } from "../device-id/ca.js";
 import { DeviceIdVerifyMsg } from "../device-id/verify.js";
-import { ClerkApiToken } from "./clerk-token.js";
+import { ClerkOauthFallbackToken } from "./clerk-oauth-token.js";
 export { ClerkApiToken } from "./clerk-token.js";
+export { ClerkOauthFallbackToken } from "./clerk-oauth-token.js";
 export class DeviceIdApiToken {
     sthis;
     opts;
@@ -103,7 +104,7 @@ export async function getCloudPubkeyFromEnv(cloudToken, sthis = ensureSuperThis(
 export const tokenApi = Lazy(async (sthis, opts) => {
     return {
         "device-id": new DeviceIdApiToken(sthis, opts),
-        clerk: new ClerkApiToken(sthis, { clockTolerance: opts.clockTolerance }),
+        clerk: new ClerkOauthFallbackToken(sthis, { clockTolerance: opts.clockTolerance }),
     };
 });
 //# sourceMappingURL=token.js.map

package/dash-api/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../jsr/dash-api/token.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAGxE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAY;IACjB,IAAI,CAA+B;IAC5C,YAAY,KAAgB,EAAE,IAAkC;QAC9D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAE,GAAG,CAAC,EAAE,EAA8C,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvH,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QACvD,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAOD,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC,KAAK,MAAM,CAAC;QAC3F,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5H,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAWd,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,cAAc,GAClB,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,OAAQ,OAAO,CAAC,EAAE,EAA8B,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtH,IAAI,CAAC,KAAK,CAAC,MAAM;iBACd,KAAK,EAAE;iBACP,GAAG,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;iBACtE,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACpC,MAAM,YAAY,GAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAA6D;iBAClH,YAAY,CAAC;YAChB,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnD,OAAO,MAAM,CAAC,GAAG,CAAC,2DAA2D,YAAY,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,CAAC,KAAgB,EAA+B,EAAE;IACtF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;IAC1B,OAAO,UAAU,CAAC,IAAI,CACpB,KAAK,EACL,EAAE,UAAU,EAAE,OAAO,CAAC,qBAAqB,EAAE,UAAU,EAAE,OAAO,CAAC,iBAAiB,EAAE,EACpF,EAAE,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAC3D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAmB,EACnB,KAAK,GAAc,eAAe,EAAE;IAEpC,MAAM,MAAM,GAAG,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,aAAa,GAAG,eAAe,CAAC,SAAS,CAAC;YAC9C,GAAG,EAAE,KAAK;YACV,GAAG,KAAK;YACR,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;YACd,GAAG,EAAE,SAAS;YACd,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE,SAAS;SACf,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAiB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,KAAgB,EAAE,IAAkC,EAAE,EAAE;IAC1F,OAAO;QACL,WAAW,EAAE,IAAI,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC;QAK9C,KAAK,EAAE,IAAI,aAAa,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../jsr/dash-api/token.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAGxE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAMjE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAY;IACjB,IAAI,CAA+B;IAC5C,YAAY,KAAgB,EAAE,IAAkC;QAC9D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAE,GAAG,CAAC,EAAE,EAA8C,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvH,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QACvD,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAOD,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC,KAAK,MAAM,CAAC;QAC3F,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5H,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAWd,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,cAAc,GAClB,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,OAAQ,OAAO,CAAC,EAAE,EAA8B,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtH,IAAI,CAAC,KAAK,CAAC,MAAM;iBACd,KAAK,EAAE;iBACP,GAAG,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;iBACtE,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACpC,MAAM,YAAY,GAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAA6D;iBAClH,YAAY,CAAC;YAChB,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnD,OAAO,MAAM,CAAC,GAAG,CAAC,2DAA2D,YAAY,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,CAAC,KAAgB,EAA+B,EAAE;IACtF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;IAC1B,OAAO,UAAU,CAAC,IAAI,CACpB,KAAK,EACL,EAAE,UAAU,EAAE,OAAO,CAAC,qBAAqB,EAAE,UAAU,EAAE,OAAO,CAAC,iBAAiB,EAAE,EACpF,EAAE,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAC3D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAmB,EACnB,KAAK,GAAc,eAAe,EAAE;IAEpC,MAAM,MAAM,GAAG,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,aAAa,GAAG,eAAe,CAAC,SAAS,CAAC;YAC9C,GAAG,EAAE,KAAK;YACV,GAAG,KAAK;YACR,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;YACd,GAAG,EAAE,SAAS;YACd,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE,SAAS;SACf,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAiB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,KAAgB,EAAE,IAAkC,EAAE,EAAE;IAC1F,OAAO;QACL,WAAW,EAAE,IAAI,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC;QAU9C,KAAK,EAAE,IAAI,uBAAuB,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;KACnF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/identity",
-  "version": "12.2.9",
+  "version": "12.2.11",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./index.js",
@@ -17,13 +17,13 @@
   "dependencies": {
     "@adviser/cement": "~0.5.34",
     "@adviser/ts-xxhash": "~1.0.2",
-    "@clerk/shared": "~4.27.0",
-    "@hono/node-server": "~2.0.12",
-    "@vibes.diy/cmd-tools": "12.2.9",
+    "@clerk/shared": "~4.28.1",
+    "@hono/node-server": "~2.1.0",
+    "@vibes.diy/cmd-tools": "12.2.11",
     "arktype": "~2.2.3",
-    "hono": "~4.12.34",
+    "hono": "~4.13.2",
     "jose": "~6.2.8",
-    "multiformats": "~14.0.4",
+    "multiformats": "~14.0.5",
     "open": "~8.4.2",
     "zod": "~4.4.3"
   },

package/server.d.ts

@@ -1 +1 @@
-export { deviceIdCAFromEnv, getCloudPubkeyFromEnv, tokenApi, DeviceIdApiToken } from "./dash-api/token.js";
+export { deviceIdCAFromEnv, getCloudPubkeyFromEnv, tokenApi, DeviceIdApiToken, ClerkOauthFallbackToken } from "./dash-api/token.js";

package/server.js

@@ -1,2 +1,2 @@
-export { deviceIdCAFromEnv, getCloudPubkeyFromEnv, tokenApi, DeviceIdApiToken } from "./dash-api/token.js";
+export { deviceIdCAFromEnv, getCloudPubkeyFromEnv, tokenApi, DeviceIdApiToken, ClerkOauthFallbackToken } from "./dash-api/token.js";
 //# sourceMappingURL=server.js.map

package/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../jsr/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../jsr/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC"}