@vielzeug/archive 26.10.7 → 26.10.10

package/README.md

@@ -50,8 +50,10 @@ are the same schemas the Worker uses. Payloads are stable JSON objects with
 sorted-key serialization; vocabularies are optional readonly arrays. The root
 entry is browser-safe. Deploy the sibling `@vielzeug/archive/auth` issuer with its
 required `AUTH_ARCHIVE` binding for coordinated account deletion, and bind the
-catalog's required `AUTH_ISSUER_SERVICE` to that issuer for an uncached
-session-version check after local JWT verification.
+catalog's required `AUTH_ISSUER_SERVICE` to that issuer for signing-key retrieval
+and an uncached session-version check after local JWT verification.
+`JWT_JWKS_URL` selects the issuer's JWKS route; the catalog fetches it through
+the service binding, not global `fetch`, including same-zone deployments.
 
 Issuer sessions carry the required `sessionVersion` claim backed by
 `auth_users.session_version`. `POST /api/v1/sign-out` only clears the current
@@ -60,7 +62,14 @@ sessions. `GET /api/v1/auth/health` exposes the typed, read-only
 `archiveAuthHealthSchema` readiness response. Issuer admission is durable D1
 state: 20 requests per minute, plus three sends per email per hour; no issuer
 rate-limiter binding is required. Magic-link GETs show a confirmation page; only
-a deliberate guarded POST redeems the token.
+a deliberate guarded POST redeems the token. Confirmation uses escaped `APP_NAME`
+branding, nonce-protected inline styles/script and no external assets. Recovery
+links to the fixed `PUBLIC_ORIGIN/account` sign-in entry; successful sign-in
+navigates to `PUBLIC_ORIGIN/signed-in`. Your application must serve both pages.
+The initial “Back to app” exit links to `PUBLIC_ORIGIN/`. The issuer
+renders only the confirmation endpoint. Expired links require a new link, while
+temporary failures offer manual retry. With valid issuer configuration, malformed
+GET links return HTML 400 recovery; POST errors retain their JSON contract.
 
 Full account deletion revokes old issuer/subject sessions; profile-only deletion
 does not. Re-enrollment uses a fresh issuer subject. Both Worker factories expose
@@ -75,7 +84,7 @@ not update existing rows.
 - [Usage Guide](https://vielzeug.dev/archive/usage)
 - [API Reference](https://vielzeug.dev/archive/api)
 - [Examples](https://vielzeug.dev/archive/examples)
-- [Release Status](https://vielzeug.dev/archive/migration)
+- [Migration](https://vielzeug.dev/archive/migration)
 
 ## License
 

package/dist/auth/_confirmation.cjs

@@ -0,0 +1,180 @@
+const e=require("../contract.cjs"),t=require("../worker/http.cjs"),n=require("./store.cjs");var escapeHtml=e=>e.replace(/[&<>"']/g,e=>`&#${e.charCodeAt(0)};`),scriptValue=e=>JSON.stringify(e).replace(/[<>&\u2028\u2029]/g,e=>`\\u${e.charCodeAt(0).toString(16).padStart(4,`0`)}`);function confirmationPage({appName:r,nonce:i,publicOrigin:a,token:o}){let s=o!==null,c=s?`Confirm sign-in`:`This sign-in link is not valid`,l=s?`
+const button = document.getElementById('confirm');
+const status = document.getElementById('status');
+const recovery = document.getElementById('recovery');
+let pending = false;
+let terminal = false;
+let disposed = false;
+let cooldown;
+let timeout;
+let controller;
+let retryAt = 0;
+const announce = (message) => { status.textContent = message; };
+const ready = () => {
+  button.disabled = false;
+  button.textContent = 'Try again';
+};
+const stop = () => {
+  clearTimeout(cooldown);
+  clearTimeout(timeout);
+  controller?.abort();
+  controller = undefined;
+};
+const tick = () => {
+  if (disposed) return;
+  const seconds = Math.max(0, Math.ceil((retryAt - Date.now()) / 1000));
+  if (seconds === 0) {
+    ready();
+    announce('You can try signing in again now.');
+    return;
+  }
+  button.textContent = 'Try again in ' + seconds + 's';
+  cooldown = setTimeout(tick, 1000);
+};
+const recover = (message) => {
+  announce(message);
+  recovery.hidden = false;
+  document.getElementById('exit').hidden = true;
+};
+button.hidden = false;
+button.focus();
+addEventListener('pagehide', () => {
+  disposed = true;
+  stop();
+});
+addEventListener('pageshow', (event) => {
+  if (!event.persisted || !disposed) return;
+  disposed = false;
+  pending = false;
+  document.getElementById('actions').removeAttribute('aria-busy');
+  if (terminal) return;
+  if (retryAt > Date.now()) tick();
+  else {
+    ready();
+    announce('Confirm sign-in when you are ready.');
+  }
+});
+button.addEventListener('click', async () => {
+  if (disposed || pending || terminal || retryAt > Date.now()) return;
+  pending = true;
+  button.disabled = true;
+  button.textContent = 'Signing you in';
+  document.getElementById('actions').setAttribute('aria-busy', 'true');
+  announce('Signing you in. Please wait.');
+  const active = new AbortController();
+  controller = active;
+  let timedOut = false;
+  const requestTimeout = setTimeout(() => {
+    timedOut = true;
+    active.abort();
+  }, 15000);
+  timeout = requestTimeout;
+  try {
+    const response = await fetch('/api/v1/auth/verify', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': 'application/json', '${e.REQUEST_MARKER_HEADER}': '1' },
+      body: JSON.stringify({ token: ${scriptValue(o??``)} }),
+      signal: active.signal,
+      redirect: 'error',
+      referrerPolicy: 'no-referrer'
+    });
+    void response.body?.cancel().catch(() => {});
+    if (disposed || controller !== active) return;
+    if (response.status === 204) {
+      terminal = true;
+      button.textContent = 'Signed in';
+      announce('You are signed in. Continuing to the app.');
+      location.replace(${scriptValue(`${a}/signed-in`)});
+    } else if (response.status === 410 || response.status === 400) {
+      terminal = true;
+      button.hidden = true;
+      recovery.setAttribute('class', 'primary');
+      recover(response.status === 410
+        ? 'This link has expired or was already used. Request a new sign-in link.'
+        : 'This sign-in link is not valid. Request a new sign-in link.');
+      recovery.focus();
+    } else if (response.status === 429) {
+      const value = response.headers.get('retry-after');
+      const httpDate = /^(?:(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (?:0[1-9]|[12]\\d|3[01]) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \\d{4} (?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d GMT|(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (?:0[1-9]|[12]\\d|3[01])-(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-\\d{2} (?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d GMT|(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?: [1-9]|[12]\\d|3[01]) (?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d \\d{4})$/;
+      const seconds = value && /^\\d+$/.test(value)
+        ? Number(value) : (value && httpDate.test(value) ? (Date.parse(value) - Date.now()) / 1000 : NaN);
+      const wait = Number.isFinite(seconds) ? Math.min(300, Math.max(1, Math.ceil(seconds))) : 30;
+      retryAt = Date.now() + wait * 1000;
+      recover('Too many attempts. Wait ' + wait + ' seconds before trying again.');
+      tick();
+    } else if (response.status === 503) {
+      recover('Sign-in is temporarily unavailable. Try again shortly, or request a new sign-in link.');
+      ready();
+    } else {
+      recover('Sign-in could not be completed. Try again, or request a new sign-in link.');
+      ready();
+    }
+  } catch {
+    if (!disposed && controller === active) {
+      recover(timedOut
+        ? 'Sign-in took too long. Try again, or request a new sign-in link.'
+        : 'Unable to connect. Check your connection and try again, or request a new sign-in link.');
+      ready();
+    }
+  } finally {
+    active.abort();
+    clearTimeout(requestTimeout);
+    if (!disposed && controller === active) {
+      controller = undefined;
+      pending = false;
+      document.getElementById('actions').removeAttribute('aria-busy');
+    }
+  }
+});`:``,u=`<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<meta name="referrer" content="no-referrer">
+<title>${escapeHtml(c)} | ${escapeHtml(r)}</title>
+<script nonce="${i}">history.replaceState(null, '', location.pathname);<\/script>
+<style nonce="${i}">
+:root { color-scheme: light dark; --paper: #fcfbf9; --ink: #302d2b; --muted: #68615c; --accent: #934b2b; --hover: #783a20; --rule: #d6d0ca; --focus: #934b2b; }
+* { box-sizing: border-box; }
+body { margin: 0; background: var(--paper); color: var(--ink); font: 1rem/1.6 'Avenir Next', 'Segoe UI', sans-serif; letter-spacing: 0; }
+main { width: min(100%, 38rem); margin: 0 auto; padding: 5rem 1.5rem 3rem; }
+h1 { margin: 0 0 1.5rem; font-family: 'Iowan Old Style', 'Palatino Linotype', 'Book Antiqua', Palatino, serif; font-size: 2.25rem; line-height: 1.2; font-weight: 500; overflow-wrap: anywhere; text-wrap: balance; }
+p { margin: 0 0 1rem; }
+.detail { color: var(--muted); }
+.actions { margin-top: 2rem; display: flex; flex-wrap: wrap; gap: 1rem; align-items: center; }
+button, .primary { min-height: 44px; max-width: 100%; padding: .75rem 1.25rem; border: 1px solid var(--accent); border-radius: 4px; background: var(--accent); color: #fff; font: inherit; font-weight: 600; text-align: center; text-decoration: none; overflow-wrap: anywhere; cursor: pointer; transition: background-color 120ms ease-out; }
+button { min-width: 12rem; }
+button:hover:not(:disabled), .primary:hover { background: var(--hover); }
+button:disabled { cursor: wait; opacity: .75; }
+a { color: var(--accent); text-underline-offset: .2em; overflow-wrap: anywhere; }
+a:not(.primary) { display: inline-flex; align-items: center; min-height: 44px; }
+:focus-visible { outline: 3px solid var(--focus); outline-offset: 4px; }
+::selection { background: var(--accent); color: #fff; }
+#status { min-height: 3.2em; margin-top: 1.5rem; }
+footer { margin-top: 2rem; padding-top: 1rem; border-top: 1px solid var(--rule); }
+[hidden] { display: none !important; }
+@media (prefers-color-scheme: dark) { :root { --paper: #242220; --ink: #f2efeb; --muted: #bfb7b0; --accent: #e0a07b; --hover: #efb998; --rule: #504942; --focus: #e0a07b; } button, .primary { color: #242220; } ::selection { color: #242220; } }
+@media (max-width: 480px) { main { padding: 3rem 1.25rem 2rem; } h1 { font-size: 2rem; } .actions { align-items: stretch; flex-direction: column; } }
+@media (prefers-reduced-motion: reduce) { *, *::before, *::after { transition: none !important; } }
+</style>
+</head>
+<body>
+<main id="main" aria-labelledby="title">
+<h1 id="title" tabindex="-1">${s?`Sign in to ${escapeHtml(r)}`:escapeHtml(c)}</h1>
+<p>${s?`Continue only if you requested this sign-in link.`:`Request a new sign-in link for ${escapeHtml(r)}.`}</p>
+${s?`<p class="detail">This link works once and expires ${n.LINK_TTL_MS/6e4} minutes after it was requested.</p>`:``}
+<div class="actions" id="actions">
+${s?`<button type="button" id="confirm" hidden>Confirm sign-in</button>`:``}
+<a${s?``:` class="primary"`} id="recovery" href="${escapeHtml(`${a}/account`)}"${s?` hidden`:``}>Request a new sign-in link</a>
+</div>
+<p role="status" aria-live="polite" aria-atomic="true" id="status"></p>
+${s?`<noscript><p>JavaScript is required to confirm this sign-in. No sign-in has been completed. <a href="${escapeHtml(`${a}/account`)}">Request a new sign-in link</a>.</p></noscript>`:``}
+${s?`<footer id="exit"><a href="${escapeHtml(`${a}/`)}">Back to app</a></footer>`:``}
+</main>
+${s?`<script nonce="${i}">${l}
+<\/script>`:``}
+</body>
+</html>`;return new Response(u,{headers:{...t.noStore,"content-security-policy":`default-src 'none'; script-src 'nonce-${i}'; style-src 'nonce-${i}'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,"content-type":`text/html; charset=utf-8`,"referrer-policy":`no-referrer`,"x-content-type-options":`nosniff`},status:s?200:400})}exports.confirmationPage=confirmationPage,exports.escapeHtml=escapeHtml;
+//# sourceMappingURL=_confirmation.cjs.map

package/dist/auth/_confirmation.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"_confirmation.cjs","names":[],"sources":["../../src/auth/_confirmation.ts"],"sourcesContent":["import { REQUEST_MARKER_HEADER } from '../contract';\nimport { noStore } from '../worker/http';\nimport { LINK_TTL_MS } from './store';\n\nexport const escapeHtml = (value: string): string => value.replace(/[&<>\"']/g, (char) => `&#${char.charCodeAt(0)};`);\n\nconst scriptValue = (value: string): string =>\n  JSON.stringify(value).replace(\n    /[<>&\\u2028\\u2029]/g,\n    (char) => `\\\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}`,\n  );\n\nexport function confirmationPage({\n  appName,\n  nonce,\n  publicOrigin,\n  token,\n}: {\n  appName: string;\n  nonce: string;\n  publicOrigin: string;\n  token: string | null;\n}): Response {\n  const valid = token !== null;\n  const title = valid ? 'Confirm sign-in' : 'This sign-in link is not valid';\n  const script = valid\n    ? `\nconst button = document.getElementById('confirm');\nconst status = document.getElementById('status');\nconst recovery = document.getElementById('recovery');\nlet pending = false;\nlet terminal = false;\nlet disposed = false;\nlet cooldown;\nlet timeout;\nlet controller;\nlet retryAt = 0;\nconst announce = (message) => { status.textContent = message; };\nconst ready = () => {\n  button.disabled = false;\n  button.textContent = 'Try again';\n};\nconst stop = () => {\n  clearTimeout(cooldown);\n  clearTimeout(timeout);\n  controller?.abort();\n  controller = undefined;\n};\nconst tick = () => {\n  if (disposed) return;\n  const seconds = Math.max(0, Math.ceil((retryAt - Date.now()) / 1000));\n  if (seconds === 0) {\n    ready();\n    announce('You can try signing in again now.');\n    return;\n  }\n  button.textContent = 'Try again in ' + seconds + 's';\n  cooldown = setTimeout(tick, 1000);\n};\nconst recover = (message) => {\n  announce(message);\n  recovery.hidden = false;\n  document.getElementById('exit').hidden = true;\n};\nbutton.hidden = false;\nbutton.focus();\naddEventListener('pagehide', () => {\n  disposed = true;\n  stop();\n});\naddEventListener('pageshow', (event) => {\n  if (!event.persisted || !disposed) return;\n  disposed = false;\n  pending = false;\n  document.getElementById('actions').removeAttribute('aria-busy');\n  if (terminal) return;\n  if (retryAt > Date.now()) tick();\n  else {\n    ready();\n    announce('Confirm sign-in when you are ready.');\n  }\n});\nbutton.addEventListener('click', async () => {\n  if (disposed || pending || terminal || retryAt > Date.now()) return;\n  pending = true;\n  button.disabled = true;\n  button.textContent = 'Signing you in';\n  document.getElementById('actions').setAttribute('aria-busy', 'true');\n  announce('Signing you in. Please wait.');\n  const active = new AbortController();\n  controller = active;\n  let timedOut = false;\n  const requestTimeout = setTimeout(() => {\n    timedOut = true;\n    active.abort();\n  }, 15000);\n  timeout = requestTimeout;\n  try {\n    const response = await fetch('/api/v1/auth/verify', {\n      method: 'POST',\n      credentials: 'same-origin',\n      headers: { 'content-type': 'application/json', '${REQUEST_MARKER_HEADER}': '1' },\n      body: JSON.stringify({ token: ${scriptValue(token ?? '')} }),\n      signal: active.signal,\n      redirect: 'error',\n      referrerPolicy: 'no-referrer'\n    });\n    void response.body?.cancel().catch(() => {});\n    if (disposed || controller !== active) return;\n    if (response.status === 204) {\n      terminal = true;\n      button.textContent = 'Signed in';\n      announce('You are signed in. Continuing to the app.');\n      location.replace(${scriptValue(`${publicOrigin}/signed-in`)});\n    } else if (response.status === 410 || response.status === 400) {\n      terminal = true;\n      button.hidden = true;\n      recovery.setAttribute('class', 'primary');\n      recover(response.status === 410\n        ? 'This link has expired or was already used. Request a new sign-in link.'\n        : 'This sign-in link is not valid. Request a new sign-in link.');\n      recovery.focus();\n    } else if (response.status === 429) {\n      const value = response.headers.get('retry-after');\n      const httpDate = /^(?:(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (?:0[1-9]|[12]\\\\d|3[01]) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \\\\d{4} (?:[01]\\\\d|2[0-3]):[0-5]\\\\d:[0-5]\\\\d GMT|(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (?:0[1-9]|[12]\\\\d|3[01])-(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-\\\\d{2} (?:[01]\\\\d|2[0-3]):[0-5]\\\\d:[0-5]\\\\d GMT|(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?: [1-9]|[12]\\\\d|3[01]) (?:[01]\\\\d|2[0-3]):[0-5]\\\\d:[0-5]\\\\d \\\\d{4})$/;\n      const seconds = value && /^\\\\d+$/.test(value)\n        ? Number(value) : (value && httpDate.test(value) ? (Date.parse(value) - Date.now()) / 1000 : NaN);\n      const wait = Number.isFinite(seconds) ? Math.min(300, Math.max(1, Math.ceil(seconds))) : 30;\n      retryAt = Date.now() + wait * 1000;\n      recover('Too many attempts. Wait ' + wait + ' seconds before trying again.');\n      tick();\n    } else if (response.status === 503) {\n      recover('Sign-in is temporarily unavailable. Try again shortly, or request a new sign-in link.');\n      ready();\n    } else {\n      recover('Sign-in could not be completed. Try again, or request a new sign-in link.');\n      ready();\n    }\n  } catch {\n    if (!disposed && controller === active) {\n      recover(timedOut\n        ? 'Sign-in took too long. Try again, or request a new sign-in link.'\n        : 'Unable to connect. Check your connection and try again, or request a new sign-in link.');\n      ready();\n    }\n  } finally {\n    active.abort();\n    clearTimeout(requestTimeout);\n    if (!disposed && controller === active) {\n      controller = undefined;\n      pending = false;\n      document.getElementById('actions').removeAttribute('aria-busy');\n    }\n  }\n});`\n    : '';\n  const html = `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<meta name=\"color-scheme\" content=\"light dark\">\n<meta name=\"referrer\" content=\"no-referrer\">\n<title>${escapeHtml(title)} | ${escapeHtml(appName)}</title>\n<script nonce=\"${nonce}\">history.replaceState(null, '', location.pathname);</script>\n<style nonce=\"${nonce}\">\n:root { color-scheme: light dark; --paper: #fcfbf9; --ink: #302d2b; --muted: #68615c; --accent: #934b2b; --hover: #783a20; --rule: #d6d0ca; --focus: #934b2b; }\n* { box-sizing: border-box; }\nbody { margin: 0; background: var(--paper); color: var(--ink); font: 1rem/1.6 'Avenir Next', 'Segoe UI', sans-serif; letter-spacing: 0; }\nmain { width: min(100%, 38rem); margin: 0 auto; padding: 5rem 1.5rem 3rem; }\nh1 { margin: 0 0 1.5rem; font-family: 'Iowan Old Style', 'Palatino Linotype', 'Book Antiqua', Palatino, serif; font-size: 2.25rem; line-height: 1.2; font-weight: 500; overflow-wrap: anywhere; text-wrap: balance; }\np { margin: 0 0 1rem; }\n.detail { color: var(--muted); }\n.actions { margin-top: 2rem; display: flex; flex-wrap: wrap; gap: 1rem; align-items: center; }\nbutton, .primary { min-height: 44px; max-width: 100%; padding: .75rem 1.25rem; border: 1px solid var(--accent); border-radius: 4px; background: var(--accent); color: #fff; font: inherit; font-weight: 600; text-align: center; text-decoration: none; overflow-wrap: anywhere; cursor: pointer; transition: background-color 120ms ease-out; }\nbutton { min-width: 12rem; }\nbutton:hover:not(:disabled), .primary:hover { background: var(--hover); }\nbutton:disabled { cursor: wait; opacity: .75; }\na { color: var(--accent); text-underline-offset: .2em; overflow-wrap: anywhere; }\na:not(.primary) { display: inline-flex; align-items: center; min-height: 44px; }\n:focus-visible { outline: 3px solid var(--focus); outline-offset: 4px; }\n::selection { background: var(--accent); color: #fff; }\n#status { min-height: 3.2em; margin-top: 1.5rem; }\nfooter { margin-top: 2rem; padding-top: 1rem; border-top: 1px solid var(--rule); }\n[hidden] { display: none !important; }\n@media (prefers-color-scheme: dark) { :root { --paper: #242220; --ink: #f2efeb; --muted: #bfb7b0; --accent: #e0a07b; --hover: #efb998; --rule: #504942; --focus: #e0a07b; } button, .primary { color: #242220; } ::selection { color: #242220; } }\n@media (max-width: 480px) { main { padding: 3rem 1.25rem 2rem; } h1 { font-size: 2rem; } .actions { align-items: stretch; flex-direction: column; } }\n@media (prefers-reduced-motion: reduce) { *, *::before, *::after { transition: none !important; } }\n</style>\n</head>\n<body>\n<main id=\"main\" aria-labelledby=\"title\">\n<h1 id=\"title\" tabindex=\"-1\">${valid ? `Sign in to ${escapeHtml(appName)}` : escapeHtml(title)}</h1>\n<p>${valid ? 'Continue only if you requested this sign-in link.' : `Request a new sign-in link for ${escapeHtml(appName)}.`}</p>\n${valid ? `<p class=\"detail\">This link works once and expires ${LINK_TTL_MS / 60_000} minutes after it was requested.</p>` : ''}\n<div class=\"actions\" id=\"actions\">\n${valid ? '<button type=\"button\" id=\"confirm\" hidden>Confirm sign-in</button>' : ''}\n<a${valid ? '' : ' class=\"primary\"'} id=\"recovery\" href=\"${escapeHtml(`${publicOrigin}/account`)}\"${valid ? ' hidden' : ''}>Request a new sign-in link</a>\n</div>\n<p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\" id=\"status\"></p>\n${valid ? `<noscript><p>JavaScript is required to confirm this sign-in. No sign-in has been completed. <a href=\"${escapeHtml(`${publicOrigin}/account`)}\">Request a new sign-in link</a>.</p></noscript>` : ''}\n${valid ? `<footer id=\"exit\"><a href=\"${escapeHtml(`${publicOrigin}/`)}\">Back to app</a></footer>` : ''}\n</main>\n${\n  valid\n    ? `<script nonce=\"${nonce}\">${script}\n</script>`\n    : ''\n}\n</body>\n</html>`;\n  return new Response(html, {\n    headers: {\n      ...noStore,\n      'content-security-policy': `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,\n      'content-type': 'text/html; charset=utf-8',\n      'referrer-policy': 'no-referrer',\n      'x-content-type-options': 'nosniff',\n    },\n    status: valid ? 200 : 400,\n  });\n}\n"],"mappings":"4FAIA,IAAa,WAAc,GAA0B,EAAM,QAAQ,WAAa,GAAS,KAAK,EAAK,WAAW,CAAC,EAAE,EAAE,EAE7G,YAAe,GACnB,KAAK,UAAU,CAAK,CAAC,CAAC,QACpB,qBACC,GAAS,MAAM,EAAK,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,GACjE,EAEF,SAAgB,iBAAiB,CAC/B,UACA,QACA,eACA,SAMW,CACX,IAAM,EAAQ,IAAU,KAClB,EAAQ,EAAQ,kBAAoB,iCACpC,EAAS,EACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA2EkD,EAAA,sBAAsB;sCACxC,YAAY,GAAS,EAAE,EAAE;;;;;;;;;;;yBAWtC,YAAY,GAAG,EAAa,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0C5D,GACE,EAAO;;;;;;;SAON,WAAW,CAAK,EAAE,KAAK,WAAW,CAAO,EAAE;iBACnC,EAAM;gBACP,EAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA2BS,EAAQ,cAAc,WAAW,CAAO,IAAM,WAAW,CAAK,EAAE;KAC1F,EAAQ,oDAAsD,kCAAkC,WAAW,CAAO,EAAE,GAAG;EAC1H,EAAQ,sDAAsD,EAAA,YAAc,IAAO,sCAAwC,GAAG;;EAE9H,EAAQ,qEAAuE,GAAG;IAChF,EAAQ,GAAK,mBAAmB,uBAAuB,WAAW,GAAG,EAAa,SAAS,EAAE,GAAG,EAAQ,UAAY,GAAG;;;EAGzH,EAAQ,wGAAwG,WAAW,GAAG,EAAa,SAAS,EAAE,kDAAoD,GAAG;EAC7M,EAAQ,8BAA8B,WAAW,GAAG,EAAa,EAAE,EAAE,4BAA8B,GAAG;;EAGtG,EACI,kBAAkB,EAAM,IAAI,EAAO;YAEnC,GACL;;SAGC,OAAO,IAAI,SAAS,EAAM,CACxB,QAAS,CACP,GAAG,EAAA,QACH,0BAA2B,yCAAyC,EAAM,sBAAsB,EAAM,oFACtG,eAAgB,2BAChB,kBAAmB,cACnB,yBAA0B,SAC5B,EACA,OAAQ,EAAQ,IAAM,GACxB,CAAC,CACH"}

package/dist/auth/_confirmation.d.ts

@@ -0,0 +1,8 @@
+export declare const escapeHtml: (value: string) => string;
+export declare function confirmationPage({ appName, nonce, publicOrigin, token, }: {
+    appName: string;
+    nonce: string;
+    publicOrigin: string;
+    token: string | null;
+}): Response;
+//# sourceMappingURL=_confirmation.d.ts.map

package/dist/auth/_confirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_confirmation.d.ts","sourceRoot":"","sources":["../../src/auth/_confirmation.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,KAAG,MAAyE,CAAC;AAQrH,wBAAgB,gBAAgB,CAAC,EAC/B,OAAO,EACP,KAAK,EACL,YAAY,EACZ,KAAK,GACN,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,QAAQ,CAuMX"}

package/dist/auth/_confirmation.js

@@ -0,0 +1,180 @@
+import{REQUEST_MARKER_HEADER as e}from"../contract.js";import{noStore as t}from"../worker/http.js";import{LINK_TTL_MS as n}from"./store.js";var escapeHtml=e=>e.replace(/[&<>"']/g,e=>`&#${e.charCodeAt(0)};`),scriptValue=e=>JSON.stringify(e).replace(/[<>&\u2028\u2029]/g,e=>`\\u${e.charCodeAt(0).toString(16).padStart(4,`0`)}`);function confirmationPage({appName:r,nonce:i,publicOrigin:a,token:o}){let s=o!==null,c=s?`Confirm sign-in`:`This sign-in link is not valid`,l=s?`
+const button = document.getElementById('confirm');
+const status = document.getElementById('status');
+const recovery = document.getElementById('recovery');
+let pending = false;
+let terminal = false;
+let disposed = false;
+let cooldown;
+let timeout;
+let controller;
+let retryAt = 0;
+const announce = (message) => { status.textContent = message; };
+const ready = () => {
+  button.disabled = false;
+  button.textContent = 'Try again';
+};
+const stop = () => {
+  clearTimeout(cooldown);
+  clearTimeout(timeout);
+  controller?.abort();
+  controller = undefined;
+};
+const tick = () => {
+  if (disposed) return;
+  const seconds = Math.max(0, Math.ceil((retryAt - Date.now()) / 1000));
+  if (seconds === 0) {
+    ready();
+    announce('You can try signing in again now.');
+    return;
+  }
+  button.textContent = 'Try again in ' + seconds + 's';
+  cooldown = setTimeout(tick, 1000);
+};
+const recover = (message) => {
+  announce(message);
+  recovery.hidden = false;
+  document.getElementById('exit').hidden = true;
+};
+button.hidden = false;
+button.focus();
+addEventListener('pagehide', () => {
+  disposed = true;
+  stop();
+});
+addEventListener('pageshow', (event) => {
+  if (!event.persisted || !disposed) return;
+  disposed = false;
+  pending = false;
+  document.getElementById('actions').removeAttribute('aria-busy');
+  if (terminal) return;
+  if (retryAt > Date.now()) tick();
+  else {
+    ready();
+    announce('Confirm sign-in when you are ready.');
+  }
+});
+button.addEventListener('click', async () => {
+  if (disposed || pending || terminal || retryAt > Date.now()) return;
+  pending = true;
+  button.disabled = true;
+  button.textContent = 'Signing you in';
+  document.getElementById('actions').setAttribute('aria-busy', 'true');
+  announce('Signing you in. Please wait.');
+  const active = new AbortController();
+  controller = active;
+  let timedOut = false;
+  const requestTimeout = setTimeout(() => {
+    timedOut = true;
+    active.abort();
+  }, 15000);
+  timeout = requestTimeout;
+  try {
+    const response = await fetch('/api/v1/auth/verify', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': 'application/json', '${e}': '1' },
+      body: JSON.stringify({ token: ${scriptValue(o??``)} }),
+      signal: active.signal,
+      redirect: 'error',
+      referrerPolicy: 'no-referrer'
+    });
+    void response.body?.cancel().catch(() => {});
+    if (disposed || controller !== active) return;
+    if (response.status === 204) {
+      terminal = true;
+      button.textContent = 'Signed in';
+      announce('You are signed in. Continuing to the app.');
+      location.replace(${scriptValue(`${a}/signed-in`)});
+    } else if (response.status === 410 || response.status === 400) {
+      terminal = true;
+      button.hidden = true;
+      recovery.setAttribute('class', 'primary');
+      recover(response.status === 410
+        ? 'This link has expired or was already used. Request a new sign-in link.'
+        : 'This sign-in link is not valid. Request a new sign-in link.');
+      recovery.focus();
+    } else if (response.status === 429) {
+      const value = response.headers.get('retry-after');
+      const httpDate = /^(?:(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (?:0[1-9]|[12]\\d|3[01]) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \\d{4} (?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d GMT|(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (?:0[1-9]|[12]\\d|3[01])-(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-\\d{2} (?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d GMT|(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?: [1-9]|[12]\\d|3[01]) (?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d \\d{4})$/;
+      const seconds = value && /^\\d+$/.test(value)
+        ? Number(value) : (value && httpDate.test(value) ? (Date.parse(value) - Date.now()) / 1000 : NaN);
+      const wait = Number.isFinite(seconds) ? Math.min(300, Math.max(1, Math.ceil(seconds))) : 30;
+      retryAt = Date.now() + wait * 1000;
+      recover('Too many attempts. Wait ' + wait + ' seconds before trying again.');
+      tick();
+    } else if (response.status === 503) {
+      recover('Sign-in is temporarily unavailable. Try again shortly, or request a new sign-in link.');
+      ready();
+    } else {
+      recover('Sign-in could not be completed. Try again, or request a new sign-in link.');
+      ready();
+    }
+  } catch {
+    if (!disposed && controller === active) {
+      recover(timedOut
+        ? 'Sign-in took too long. Try again, or request a new sign-in link.'
+        : 'Unable to connect. Check your connection and try again, or request a new sign-in link.');
+      ready();
+    }
+  } finally {
+    active.abort();
+    clearTimeout(requestTimeout);
+    if (!disposed && controller === active) {
+      controller = undefined;
+      pending = false;
+      document.getElementById('actions').removeAttribute('aria-busy');
+    }
+  }
+});`:``,u=`<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<meta name="referrer" content="no-referrer">
+<title>${escapeHtml(c)} | ${escapeHtml(r)}</title>
+<script nonce="${i}">history.replaceState(null, '', location.pathname);<\/script>
+<style nonce="${i}">
+:root { color-scheme: light dark; --paper: #fcfbf9; --ink: #302d2b; --muted: #68615c; --accent: #934b2b; --hover: #783a20; --rule: #d6d0ca; --focus: #934b2b; }
+* { box-sizing: border-box; }
+body { margin: 0; background: var(--paper); color: var(--ink); font: 1rem/1.6 'Avenir Next', 'Segoe UI', sans-serif; letter-spacing: 0; }
+main { width: min(100%, 38rem); margin: 0 auto; padding: 5rem 1.5rem 3rem; }
+h1 { margin: 0 0 1.5rem; font-family: 'Iowan Old Style', 'Palatino Linotype', 'Book Antiqua', Palatino, serif; font-size: 2.25rem; line-height: 1.2; font-weight: 500; overflow-wrap: anywhere; text-wrap: balance; }
+p { margin: 0 0 1rem; }
+.detail { color: var(--muted); }
+.actions { margin-top: 2rem; display: flex; flex-wrap: wrap; gap: 1rem; align-items: center; }
+button, .primary { min-height: 44px; max-width: 100%; padding: .75rem 1.25rem; border: 1px solid var(--accent); border-radius: 4px; background: var(--accent); color: #fff; font: inherit; font-weight: 600; text-align: center; text-decoration: none; overflow-wrap: anywhere; cursor: pointer; transition: background-color 120ms ease-out; }
+button { min-width: 12rem; }
+button:hover:not(:disabled), .primary:hover { background: var(--hover); }
+button:disabled { cursor: wait; opacity: .75; }
+a { color: var(--accent); text-underline-offset: .2em; overflow-wrap: anywhere; }
+a:not(.primary) { display: inline-flex; align-items: center; min-height: 44px; }
+:focus-visible { outline: 3px solid var(--focus); outline-offset: 4px; }
+::selection { background: var(--accent); color: #fff; }
+#status { min-height: 3.2em; margin-top: 1.5rem; }
+footer { margin-top: 2rem; padding-top: 1rem; border-top: 1px solid var(--rule); }
+[hidden] { display: none !important; }
+@media (prefers-color-scheme: dark) { :root { --paper: #242220; --ink: #f2efeb; --muted: #bfb7b0; --accent: #e0a07b; --hover: #efb998; --rule: #504942; --focus: #e0a07b; } button, .primary { color: #242220; } ::selection { color: #242220; } }
+@media (max-width: 480px) { main { padding: 3rem 1.25rem 2rem; } h1 { font-size: 2rem; } .actions { align-items: stretch; flex-direction: column; } }
+@media (prefers-reduced-motion: reduce) { *, *::before, *::after { transition: none !important; } }
+</style>
+</head>
+<body>
+<main id="main" aria-labelledby="title">
+<h1 id="title" tabindex="-1">${s?`Sign in to ${escapeHtml(r)}`:escapeHtml(c)}</h1>
+<p>${s?`Continue only if you requested this sign-in link.`:`Request a new sign-in link for ${escapeHtml(r)}.`}</p>
+${s?`<p class="detail">This link works once and expires ${n/6e4} minutes after it was requested.</p>`:``}
+<div class="actions" id="actions">
+${s?`<button type="button" id="confirm" hidden>Confirm sign-in</button>`:``}
+<a${s?``:` class="primary"`} id="recovery" href="${escapeHtml(`${a}/account`)}"${s?` hidden`:``}>Request a new sign-in link</a>
+</div>
+<p role="status" aria-live="polite" aria-atomic="true" id="status"></p>
+${s?`<noscript><p>JavaScript is required to confirm this sign-in. No sign-in has been completed. <a href="${escapeHtml(`${a}/account`)}">Request a new sign-in link</a>.</p></noscript>`:``}
+${s?`<footer id="exit"><a href="${escapeHtml(`${a}/`)}">Back to app</a></footer>`:``}
+</main>
+${s?`<script nonce="${i}">${l}
+<\/script>`:``}
+</body>
+</html>`;return new Response(u,{headers:{...t,"content-security-policy":`default-src 'none'; script-src 'nonce-${i}'; style-src 'nonce-${i}'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,"content-type":`text/html; charset=utf-8`,"referrer-policy":`no-referrer`,"x-content-type-options":`nosniff`},status:s?200:400})}export{confirmationPage,escapeHtml};
+//# sourceMappingURL=_confirmation.js.map

package/dist/auth/_confirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_confirmation.js","names":[],"sources":["../../src/auth/_confirmation.ts"],"sourcesContent":["import { REQUEST_MARKER_HEADER } from '../contract';\nimport { noStore } from '../worker/http';\nimport { LINK_TTL_MS } from './store';\n\nexport const escapeHtml = (value: string): string => value.replace(/[&<>\"']/g, (char) => `&#${char.charCodeAt(0)};`);\n\nconst scriptValue = (value: string): string =>\n  JSON.stringify(value).replace(\n    /[<>&\\u2028\\u2029]/g,\n    (char) => `\\\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}`,\n  );\n\nexport function confirmationPage({\n  appName,\n  nonce,\n  publicOrigin,\n  token,\n}: {\n  appName: string;\n  nonce: string;\n  publicOrigin: string;\n  token: string | null;\n}): Response {\n  const valid = token !== null;\n  const title = valid ? 'Confirm sign-in' : 'This sign-in link is not valid';\n  const script = valid\n    ? `\nconst button = document.getElementById('confirm');\nconst status = document.getElementById('status');\nconst recovery = document.getElementById('recovery');\nlet pending = false;\nlet terminal = false;\nlet disposed = false;\nlet cooldown;\nlet timeout;\nlet controller;\nlet retryAt = 0;\nconst announce = (message) => { status.textContent = message; };\nconst ready = () => {\n  button.disabled = false;\n  button.textContent = 'Try again';\n};\nconst stop = () => {\n  clearTimeout(cooldown);\n  clearTimeout(timeout);\n  controller?.abort();\n  controller = undefined;\n};\nconst tick = () => {\n  if (disposed) return;\n  const seconds = Math.max(0, Math.ceil((retryAt - Date.now()) / 1000));\n  if (seconds === 0) {\n    ready();\n    announce('You can try signing in again now.');\n    return;\n  }\n  button.textContent = 'Try again in ' + seconds + 's';\n  cooldown = setTimeout(tick, 1000);\n};\nconst recover = (message) => {\n  announce(message);\n  recovery.hidden = false;\n  document.getElementById('exit').hidden = true;\n};\nbutton.hidden = false;\nbutton.focus();\naddEventListener('pagehide', () => {\n  disposed = true;\n  stop();\n});\naddEventListener('pageshow', (event) => {\n  if (!event.persisted || !disposed) return;\n  disposed = false;\n  pending = false;\n  document.getElementById('actions').removeAttribute('aria-busy');\n  if (terminal) return;\n  if (retryAt > Date.now()) tick();\n  else {\n    ready();\n    announce('Confirm sign-in when you are ready.');\n  }\n});\nbutton.addEventListener('click', async () => {\n  if (disposed || pending || terminal || retryAt > Date.now()) return;\n  pending = true;\n  button.disabled = true;\n  button.textContent = 'Signing you in';\n  document.getElementById('actions').setAttribute('aria-busy', 'true');\n  announce('Signing you in. Please wait.');\n  const active = new AbortController();\n  controller = active;\n  let timedOut = false;\n  const requestTimeout = setTimeout(() => {\n    timedOut = true;\n    active.abort();\n  }, 15000);\n  timeout = requestTimeout;\n  try {\n    const response = await fetch('/api/v1/auth/verify', {\n      method: 'POST',\n      credentials: 'same-origin',\n      headers: { 'content-type': 'application/json', '${REQUEST_MARKER_HEADER}': '1' },\n      body: JSON.stringify({ token: ${scriptValue(token ?? '')} }),\n      signal: active.signal,\n      redirect: 'error',\n      referrerPolicy: 'no-referrer'\n    });\n    void response.body?.cancel().catch(() => {});\n    if (disposed || controller !== active) return;\n    if (response.status === 204) {\n      terminal = true;\n      button.textContent = 'Signed in';\n      announce('You are signed in. Continuing to the app.');\n      location.replace(${scriptValue(`${publicOrigin}/signed-in`)});\n    } else if (response.status === 410 || response.status === 400) {\n      terminal = true;\n      button.hidden = true;\n      recovery.setAttribute('class', 'primary');\n      recover(response.status === 410\n        ? 'This link has expired or was already used. Request a new sign-in link.'\n        : 'This sign-in link is not valid. Request a new sign-in link.');\n      recovery.focus();\n    } else if (response.status === 429) {\n      const value = response.headers.get('retry-after');\n      const httpDate = /^(?:(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (?:0[1-9]|[12]\\\\d|3[01]) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \\\\d{4} (?:[01]\\\\d|2[0-3]):[0-5]\\\\d:[0-5]\\\\d GMT|(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (?:0[1-9]|[12]\\\\d|3[01])-(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-\\\\d{2} (?:[01]\\\\d|2[0-3]):[0-5]\\\\d:[0-5]\\\\d GMT|(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?: [1-9]|[12]\\\\d|3[01]) (?:[01]\\\\d|2[0-3]):[0-5]\\\\d:[0-5]\\\\d \\\\d{4})$/;\n      const seconds = value && /^\\\\d+$/.test(value)\n        ? Number(value) : (value && httpDate.test(value) ? (Date.parse(value) - Date.now()) / 1000 : NaN);\n      const wait = Number.isFinite(seconds) ? Math.min(300, Math.max(1, Math.ceil(seconds))) : 30;\n      retryAt = Date.now() + wait * 1000;\n      recover('Too many attempts. Wait ' + wait + ' seconds before trying again.');\n      tick();\n    } else if (response.status === 503) {\n      recover('Sign-in is temporarily unavailable. Try again shortly, or request a new sign-in link.');\n      ready();\n    } else {\n      recover('Sign-in could not be completed. Try again, or request a new sign-in link.');\n      ready();\n    }\n  } catch {\n    if (!disposed && controller === active) {\n      recover(timedOut\n        ? 'Sign-in took too long. Try again, or request a new sign-in link.'\n        : 'Unable to connect. Check your connection and try again, or request a new sign-in link.');\n      ready();\n    }\n  } finally {\n    active.abort();\n    clearTimeout(requestTimeout);\n    if (!disposed && controller === active) {\n      controller = undefined;\n      pending = false;\n      document.getElementById('actions').removeAttribute('aria-busy');\n    }\n  }\n});`\n    : '';\n  const html = `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<meta name=\"color-scheme\" content=\"light dark\">\n<meta name=\"referrer\" content=\"no-referrer\">\n<title>${escapeHtml(title)} | ${escapeHtml(appName)}</title>\n<script nonce=\"${nonce}\">history.replaceState(null, '', location.pathname);</script>\n<style nonce=\"${nonce}\">\n:root { color-scheme: light dark; --paper: #fcfbf9; --ink: #302d2b; --muted: #68615c; --accent: #934b2b; --hover: #783a20; --rule: #d6d0ca; --focus: #934b2b; }\n* { box-sizing: border-box; }\nbody { margin: 0; background: var(--paper); color: var(--ink); font: 1rem/1.6 'Avenir Next', 'Segoe UI', sans-serif; letter-spacing: 0; }\nmain { width: min(100%, 38rem); margin: 0 auto; padding: 5rem 1.5rem 3rem; }\nh1 { margin: 0 0 1.5rem; font-family: 'Iowan Old Style', 'Palatino Linotype', 'Book Antiqua', Palatino, serif; font-size: 2.25rem; line-height: 1.2; font-weight: 500; overflow-wrap: anywhere; text-wrap: balance; }\np { margin: 0 0 1rem; }\n.detail { color: var(--muted); }\n.actions { margin-top: 2rem; display: flex; flex-wrap: wrap; gap: 1rem; align-items: center; }\nbutton, .primary { min-height: 44px; max-width: 100%; padding: .75rem 1.25rem; border: 1px solid var(--accent); border-radius: 4px; background: var(--accent); color: #fff; font: inherit; font-weight: 600; text-align: center; text-decoration: none; overflow-wrap: anywhere; cursor: pointer; transition: background-color 120ms ease-out; }\nbutton { min-width: 12rem; }\nbutton:hover:not(:disabled), .primary:hover { background: var(--hover); }\nbutton:disabled { cursor: wait; opacity: .75; }\na { color: var(--accent); text-underline-offset: .2em; overflow-wrap: anywhere; }\na:not(.primary) { display: inline-flex; align-items: center; min-height: 44px; }\n:focus-visible { outline: 3px solid var(--focus); outline-offset: 4px; }\n::selection { background: var(--accent); color: #fff; }\n#status { min-height: 3.2em; margin-top: 1.5rem; }\nfooter { margin-top: 2rem; padding-top: 1rem; border-top: 1px solid var(--rule); }\n[hidden] { display: none !important; }\n@media (prefers-color-scheme: dark) { :root { --paper: #242220; --ink: #f2efeb; --muted: #bfb7b0; --accent: #e0a07b; --hover: #efb998; --rule: #504942; --focus: #e0a07b; } button, .primary { color: #242220; } ::selection { color: #242220; } }\n@media (max-width: 480px) { main { padding: 3rem 1.25rem 2rem; } h1 { font-size: 2rem; } .actions { align-items: stretch; flex-direction: column; } }\n@media (prefers-reduced-motion: reduce) { *, *::before, *::after { transition: none !important; } }\n</style>\n</head>\n<body>\n<main id=\"main\" aria-labelledby=\"title\">\n<h1 id=\"title\" tabindex=\"-1\">${valid ? `Sign in to ${escapeHtml(appName)}` : escapeHtml(title)}</h1>\n<p>${valid ? 'Continue only if you requested this sign-in link.' : `Request a new sign-in link for ${escapeHtml(appName)}.`}</p>\n${valid ? `<p class=\"detail\">This link works once and expires ${LINK_TTL_MS / 60_000} minutes after it was requested.</p>` : ''}\n<div class=\"actions\" id=\"actions\">\n${valid ? '<button type=\"button\" id=\"confirm\" hidden>Confirm sign-in</button>' : ''}\n<a${valid ? '' : ' class=\"primary\"'} id=\"recovery\" href=\"${escapeHtml(`${publicOrigin}/account`)}\"${valid ? ' hidden' : ''}>Request a new sign-in link</a>\n</div>\n<p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\" id=\"status\"></p>\n${valid ? `<noscript><p>JavaScript is required to confirm this sign-in. No sign-in has been completed. <a href=\"${escapeHtml(`${publicOrigin}/account`)}\">Request a new sign-in link</a>.</p></noscript>` : ''}\n${valid ? `<footer id=\"exit\"><a href=\"${escapeHtml(`${publicOrigin}/`)}\">Back to app</a></footer>` : ''}\n</main>\n${\n  valid\n    ? `<script nonce=\"${nonce}\">${script}\n</script>`\n    : ''\n}\n</body>\n</html>`;\n  return new Response(html, {\n    headers: {\n      ...noStore,\n      'content-security-policy': `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,\n      'content-type': 'text/html; charset=utf-8',\n      'referrer-policy': 'no-referrer',\n      'x-content-type-options': 'nosniff',\n    },\n    status: valid ? 200 : 400,\n  });\n}\n"],"mappings":"4IAIA,IAAa,WAAc,GAA0B,EAAM,QAAQ,WAAa,GAAS,KAAK,EAAK,WAAW,CAAC,EAAE,EAAE,EAE7G,YAAe,GACnB,KAAK,UAAU,CAAK,CAAC,CAAC,QACpB,qBACC,GAAS,MAAM,EAAK,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAG,GAAG,GACjE,EAEF,SAAgB,iBAAiB,CAC/B,UACA,QACA,eACA,SAMW,CACX,IAAM,EAAQ,IAAU,KAClB,EAAQ,EAAQ,kBAAoB,iCACpC,EAAS,EACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA2EkD,EAAsB;sCACxC,YAAY,GAAS,EAAE,EAAE;;;;;;;;;;;yBAWtC,YAAY,GAAG,EAAa,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0C5D,GACE,EAAO;;;;;;;SAON,WAAW,CAAK,EAAE,KAAK,WAAW,CAAO,EAAE;iBACnC,EAAM;gBACP,EAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA2BS,EAAQ,cAAc,WAAW,CAAO,IAAM,WAAW,CAAK,EAAE;KAC1F,EAAQ,oDAAsD,kCAAkC,WAAW,CAAO,EAAE,GAAG;EAC1H,EAAQ,sDAAsD,EAAc,IAAO,sCAAwC,GAAG;;EAE9H,EAAQ,qEAAuE,GAAG;IAChF,EAAQ,GAAK,mBAAmB,uBAAuB,WAAW,GAAG,EAAa,SAAS,EAAE,GAAG,EAAQ,UAAY,GAAG;;;EAGzH,EAAQ,wGAAwG,WAAW,GAAG,EAAa,SAAS,EAAE,kDAAoD,GAAG;EAC7M,EAAQ,8BAA8B,WAAW,GAAG,EAAa,EAAE,EAAE,4BAA8B,GAAG;;EAGtG,EACI,kBAAkB,EAAM,IAAI,EAAO;YAEnC,GACL;;SAGC,OAAO,IAAI,SAAS,EAAM,CACxB,QAAS,CACP,GAAG,EACH,0BAA2B,yCAAyC,EAAM,sBAAsB,EAAM,oFACtG,eAAgB,2BAChB,kBAAmB,cACnB,yBAA0B,SAC5B,EACA,OAAQ,EAAQ,IAAM,GACxB,CAAC,CACH"}

package/dist/auth/config.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.cjs","names":[],"sources":["../../src/auth/config.ts"],"sourcesContent":["import {\n  type CryptoKey,\n  calculateJwkThumbprint,\n  createLocalJWKSet,\n  importJWK,\n  type JWK_RSA_Private,\n  type JWK_RSA_Public,\n  jwtVerify,\n  SignJWT,\n} from 'jose';\nimport type { D1Like } from '../worker/env';\nimport type { ApiError } from '../worker/http';\nimport { AuthOperationError } from './errors';\n\n/** The send-email binding subset the issuer calls; the runtime's SendEmail satisfies it. */\nexport interface SendEmail {\n  send(message: { from: string; html?: string; subject: string; text: string; to: string }): Promise<unknown>;\n}\n\n/**\n * The catalog Worker as the issuer reaches it: a Cloudflare service binding (or any\n * `fetch`-shaped stub). Account erasure calls the catalog's `DELETE /api/v1/me/account`\n * through it before removing the issuer's own row.\n */\nexport interface AuthArchiveBinding {\n  fetch(request: Request): Promise<Response>;\n}\n\n/**\n * The bindings the auth issuer reads. Declared structurally, like the catalog\n * Worker's Env: a deployment's generated `ExportedHandler<Env>` accepts the factory's\n * result as-is, with no `@cloudflare/workers-types` dependency. Every value is\n * validated on first use per bindings object; a missing or malformed one answers\n * 503 `unavailable` on every route, never a permissive fallback.\n */\nexport interface AuthWorkerEnv {\n  /** Comma-separated exact origins allowed to call unsafe routes and read CORS responses. */\n  ALLOWED_ORIGINS: string;\n  /** Exactly `local` (loopback HTTP only) or `production` (non-loopback HTTPS, Secure cookies). */\n  APP_ENV: string;\n  /** The app's display name: the magic-link email's subject and copy name it. */\n  APP_NAME: string;\n  AUDIENCE: string;\n  /** Service binding to the sibling catalog Worker: account erasure removes the catalog profile through it. */\n  AUTH_ARCHIVE: AuthArchiveBinding;\n  /** The issuer's own D1: accounts, links, per-account send and singleton admission budgets. */\n  AUTH_DB: D1Like;\n  AUTH_EMAIL: SendEmail;\n  /** The `iss` claim every token carries, exactly as the catalog Worker's `JWT_ISSUER` knows it. */\n  AUTH_ISSUER: string;\n  /**\n   * Optional JWKS JSON (`{\"keys\":[...]}`) of retired PUBLIC RS256 keys, still served\n   * from `/jwks.json` and accepted by the issuer so sessions minted before a rotation\n   * keep verifying until they expire. Private members are rejected.\n   */\n  AUTH_JWT_PREVIOUS_PUBLIC_JWKS?: string;\n  /** The active RS256 private key as a JWK JSON string (a wrangler secret): signs every new session. */\n  AUTH_JWT_PRIVATE_JWK: string;\n  /** Comma-separated emails whose sessions carry the operator role claim. */\n  OPERATOR_EMAILS: string;\n  /** The app's public origin: magic links, the signed-in redirect and the catalog erasure URL point here. */\n  PUBLIC_ORIGIN: string;\n  /** The address emails come from: a domain onboarded to Cloudflare Email Service. */\n  SENDER_ADDRESS: string;\n}\n\nexport type AuthAppEnv = 'local' | 'production';\n\nexport interface PublicSigningKey extends JWK_RSA_Public {\n  alg: 'RS256';\n  kid: string;\n  kty: 'RSA';\n  use: 'sig';\n}\n\nexport interface AuthConfig {\n  allowedOrigins: ReadonlySet<string>;\n  appEnv: AuthAppEnv;\n  appName: string;\n  audience: string;\n  issuer: string;\n  /** Every key a session may be verified with: the active key first, then retired ones. */\n  jwks: readonly PublicSigningKey[];\n  operatorEmails: ReadonlySet<string>;\n  publicOrigin: string;\n  senderAddress: string;\n  signing: { key: CryptoKey; kid: string };\n  verifier: ReturnType<typeof createLocalJWKSet>;\n}\n\n// Configuration faults never name the offending field: the response must not leak\n// Env names, only a generic temporary unavailability.\nconst configError = (): ApiError => new AuthOperationError(503, 'configuration');\n\nconst EMAIL_MAX = 320;\nconst APP_NAME_MAX = 64;\n// 2048-bit RSA modulus: 256 bytes, 342 base64url characters unpadded.\nconst MIN_MODULUS_CHARS = 342;\nconst BASE64URL = /^[A-Za-z0-9_-]+$/;\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]']);\nconst PRIVATE_RSA_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'] as const;\n\nexport const isWellFormedEmail = (value: string): boolean =>\n  value.length <= EMAIL_MAX &&\n  value === value.toLowerCase() &&\n  /^[^\\s@<>\"',;]+@[^\\s@<>\"',;]+\\.[^\\s@<>\"',;]+$/.test(value);\n\nconst requireString = (value: unknown): string => {\n  if (typeof value !== 'string' || value.length === 0) throw configError();\n  return value;\n};\n\nconst requireBinding = (value: unknown, method: string): void => {\n  if (typeof value !== 'object' || value === null) throw configError();\n  if (typeof Reflect.get(value, method) !== 'function') throw configError();\n};\n\n/** Transport rules: local is loopback HTTP only, production is non-loopback HTTPS; no credentials or fragments. */\nconst validateUrl = (raw: string, appEnv: AuthAppEnv): URL => {\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    throw configError();\n  }\n  if (url.username !== '' || url.password !== '' || url.hash !== '') throw configError();\n  const loopback = LOOPBACK_HOSTS.has(url.hostname);\n  if (appEnv === 'local' ? url.protocol !== 'http:' || !loopback : url.protocol !== 'https:' || loopback) {\n    throw configError();\n  }\n  return url;\n};\n\n/** An exact canonical origin: scheme + host (+port), no path, query, wildcard or `null`. */\nconst validateOrigin = (raw: string, appEnv: AuthAppEnv): string => {\n  const url = validateUrl(raw, appEnv);\n  if (url.pathname !== '/' || url.search !== '' || url.origin !== raw) throw configError();\n  return url.origin;\n};\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null;\n\nconst parseJson = (raw: string): unknown => {\n  try {\n    return JSON.parse(raw);\n  } catch {\n    throw configError();\n  }\n};\n\nconst b64urlMember = (jwk: Record<string, unknown>, name: string): string => {\n  const value = jwk[name];\n  if (typeof value !== 'string' || !BASE64URL.test(value)) throw configError();\n  return value;\n};\n\n/** RS256 signing-key metadata, when present, must agree with how the issuer uses the key. */\nconst checkRsaMetadata = (jwk: Record<string, unknown>): void => {\n  if (jwk.kty !== 'RSA') throw configError();\n  if (jwk.alg !== undefined && jwk.alg !== 'RS256') throw configError();\n  if (jwk.use !== undefined && jwk.use !== 'sig') throw configError();\n};\n\nconst publicMembers = (jwk: Record<string, unknown>): JWK_RSA_Public => {\n  const n = b64urlMember(jwk, 'n');\n  if (n.length < MIN_MODULUS_CHARS) throw configError();\n  return { e: b64urlMember(jwk, 'e'), kty: 'RSA', n };\n};\n\nconst toSigningKey = async (pub: JWK_RSA_Public): Promise<PublicSigningKey> => ({\n  alg: 'RS256',\n  e: pub.e,\n  kid: await calculateJwkThumbprint({ e: pub.e, kty: 'RSA', n: pub.n }),\n  kty: 'RSA',\n  n: pub.n,\n  use: 'sig',\n});\n\nasync function activeKey(raw: string): Promise<{ key: CryptoKey; public: PublicSigningKey }> {\n  const parsed = parseJson(raw);\n  if (!isRecord(parsed)) throw configError();\n  checkRsaMetadata(parsed);\n  const pub = publicMembers(parsed);\n  const jwk: JWK_RSA_Private = {\n    ...pub,\n    d: b64urlMember(parsed, 'd'),\n    dp: b64urlMember(parsed, 'dp'),\n    dq: b64urlMember(parsed, 'dq'),\n    p: b64urlMember(parsed, 'p'),\n    q: b64urlMember(parsed, 'q'),\n    qi: b64urlMember(parsed, 'qi'),\n  };\n  let key: CryptoKey;\n  try {\n    const imported = await importJWK(jwk, 'RS256', { extractable: false });\n    if (imported instanceof Uint8Array) throw configError();\n    key = imported;\n  } catch {\n    throw configError();\n  }\n  return { key, public: await toSigningKey(pub) };\n}\n\n/** Retired verification keys: public RSA members only; any private member is a misconfiguration. */\nasync function previousKeys(raw: string | undefined): Promise<PublicSigningKey[]> {\n  if (raw === undefined || raw.trim().length === 0) return [];\n  const parsed = parseJson(raw);\n  if (!isRecord(parsed) || !Array.isArray(parsed.keys)) throw configError();\n  const keys: PublicSigningKey[] = [];\n  for (const entry of parsed.keys) {\n    if (!isRecord(entry)) throw configError();\n    checkRsaMetadata(entry);\n    if (PRIVATE_RSA_MEMBERS.some((member) => member in entry)) throw configError();\n    keys.push(await toSigningKey(publicMembers(entry)));\n  }\n  return keys;\n}\n\nconst configs = new WeakMap<AuthWorkerEnv, Promise<AuthConfig>>();\n\nasync function buildConfig(env: AuthWorkerEnv): Promise<AuthConfig> {\n  const appEnvRaw = requireString(env.APP_ENV);\n  if (appEnvRaw !== 'local' && appEnvRaw !== 'production') throw configError();\n  const appEnv: AuthAppEnv = appEnvRaw;\n\n  const allowedOrigins = new Set(\n    requireString(env.ALLOWED_ORIGINS)\n      .split(',')\n      .map((origin) => origin.trim())\n      .filter((origin) => origin.length > 0)\n      .map((origin) => validateOrigin(origin, appEnv)),\n  );\n  if (allowedOrigins.size === 0) throw configError();\n\n  const publicOrigin = validateOrigin(requireString(env.PUBLIC_ORIGIN), appEnv);\n  // The issuer is matched as the exact configured string (a trailing slash is meaningful).\n  const issuer = requireString(env.AUTH_ISSUER);\n  validateUrl(issuer, appEnv);\n  const audience = requireString(env.AUDIENCE);\n  const appName = requireString(env.APP_NAME);\n  if (appName.length > APP_NAME_MAX || /[\\p{Cc}\\p{Cs}]/u.test(appName)) throw configError();\n  const senderAddress = requireString(env.SENDER_ADDRESS);\n  if (!isWellFormedEmail(senderAddress)) throw configError();\n  if (typeof env.OPERATOR_EMAILS !== 'string') throw configError();\n  const operatorEmails = new Set(\n    env.OPERATOR_EMAILS.split(',')\n      .map((entry) => entry.trim().toLowerCase())\n      .filter((entry) => entry.length > 0),\n  );\n  for (const email of operatorEmails) if (!isWellFormedEmail(email)) throw configError();\n\n  requireBinding(env.AUTH_DB, 'prepare');\n  requireBinding(env.AUTH_DB, 'batch');\n  requireBinding(env.AUTH_EMAIL, 'send');\n  requireBinding(env.AUTH_ARCHIVE, 'fetch');\n\n  const active = await activeKey(requireString(env.AUTH_JWT_PRIVATE_JWK));\n  try {\n    const proof = await new SignJWT({}).setProtectedHeader({ alg: 'RS256', kid: active.public.kid }).sign(active.key);\n    await jwtVerify(proof, createLocalJWKSet({ keys: [active.public] }), { algorithms: ['RS256'] });\n  } catch {\n    throw configError();\n  }\n  const retired = (await previousKeys(env.AUTH_JWT_PREVIOUS_PUBLIC_JWKS)).filter(\n    (key) => key.kid !== active.public.kid,\n  );\n  const jwks = [\n    active.public,\n    ...retired.filter((key, i) => retired.findIndex((other) => other.kid === key.kid) === i),\n  ];\n\n  return {\n    allowedOrigins,\n    appEnv,\n    appName,\n    audience,\n    issuer,\n    jwks,\n    operatorEmails,\n    publicOrigin,\n    senderAddress,\n    signing: { key: active.key, kid: active.public.kid },\n    verifier: createLocalJWKSet({ keys: [...jwks] }),\n  };\n}\n\n/**\n * Validates the env and imports its keys once per bindings object. A failed\n * validation is not cached, so a corrected binding set recovers without a restart.\n */\nexport function authConfig(env: AuthWorkerEnv): Promise<AuthConfig> {\n  const cached = configs.get(env);\n  if (cached !== undefined) return cached;\n  const pending = buildConfig(env);\n  configs.set(env, pending);\n  pending.catch(() => configs.delete(env));\n  return pending;\n}\n"],"mappings":"sDA4FA,IAAM,gBAA8B,IAAI,EAAA,mBAAmB,IAAK,eAAe,EAEzE,EAAY,IACZ,EAAe,GAEf,EAAoB,IACpB,EAAY,mBACZ,EAAiB,IAAI,IAAI,CAAC,YAAa,YAAa,OAAO,CAAC,EAC5D,EAAsB,CAAC,IAAK,IAAK,IAAK,KAAM,KAAM,KAAM,MAAO,GAAG,EAE3D,kBAAqB,GAChC,EAAM,QAAU,GAChB,IAAU,EAAM,YAAY,GAC5B,+CAA+C,KAAK,CAAK,EAErD,cAAiB,GAA2B,CAChD,GAAI,OAAO,GAAU,UAAY,EAAM,SAAW,EAAG,MAAM,YAAY,EACvE,OAAO,CACT,EAEM,gBAAkB,EAAgB,IAAyB,CAE/D,GADI,OAAO,GAAU,WAAY,GAC7B,OAAO,QAAQ,IAAI,EAAO,CAAM,GAAM,WAAY,MAAM,YAAY,CAC1E,EAGM,aAAe,EAAa,IAA4B,CAC5D,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAG,CACnB,MAAQ,CACN,MAAM,YAAY,CACpB,CACA,GAAI,EAAI,WAAa,IAAM,EAAI,WAAa,IAAM,EAAI,OAAS,GAAI,MAAM,YAAY,EACrF,IAAM,EAAW,EAAe,IAAI,EAAI,QAAQ,EAChD,GAAI,IAAW,QAAU,EAAI,WAAa,SAAW,CAAC,EAAW,EAAI,WAAa,UAAY,EAC5F,MAAM,YAAY,EAEpB,OAAO,CACT,EAGM,gBAAkB,EAAa,IAA+B,CAClE,IAAM,EAAM,YAAY,EAAK,CAAM,EACnC,GAAI,EAAI,WAAa,KAAO,EAAI,SAAW,IAAM,EAAI,SAAW,EAAK,MAAM,YAAY,EACvF,OAAO,EAAI,MACb,EAEM,SAAY,GAAqD,OAAO,GAAU,YAAY,EAE9F,UAAa,GAAyB,CAC1C,GAAI,CACF,OAAO,KAAK,MAAM,CAAG,CACvB,MAAQ,CACN,MAAM,YAAY,CACpB,CACF,EAEM,cAAgB,EAA8B,IAAyB,CAC3E,IAAM,EAAQ,EAAI,GAClB,GAAI,OAAO,GAAU,UAAY,CAAC,EAAU,KAAK,CAAK,EAAG,MAAM,YAAY,EAC3E,OAAO,CACT,EAGM,iBAAoB,GAAuC,CAG/D,GAFI,EAAI,MAAQ,OACZ,EAAI,MAAQ,IAAA,IAAa,EAAI,MAAQ,SACrC,EAAI,MAAQ,IAAA,IAAa,EAAI,MAAQ,MAAO,MAAM,YAAY,CACpE,EAEM,cAAiB,GAAiD,CACtE,IAAM,EAAI,aAAa,EAAK,GAAG,EAC/B,GAAI,EAAE,OAAS,EAAmB,MAAM,YAAY,EACpD,MAAO,CAAE,EAAG,aAAa,EAAK,GAAG,EAAG,IAAK,MAAO,GAAE,CACpD,EAEM,aAAe,KAAO,KAAoD,CAC9E,IAAK,QACL,EAAG,EAAI,EACP,IAAK,MAAA,EAAM,EAAA,uBAAA,CAAuB,CAAE,EAAG,EAAI,EAAG,IAAK,MAAO,EAAG,EAAI,CAAE,CAAC,EACpE,IAAK,MACL,EAAG,EAAI,EACP,IAAK,KACP,GAEA,eAAe,UAAU,EAAoE,CAC3F,IAAM,EAAS,UAAU,CAAG,EAC5B,GAAI,CAAC,SAAS,CAAM,EAAG,MAAM,YAAY,EACzC,iBAAiB,CAAM,EACvB,IAAM,EAAM,cAAc,CAAM,EAC1B,EAAuB,CAC3B,GAAG,EACH,EAAG,aAAa,EAAQ,GAAG,EAC3B,GAAI,aAAa,EAAQ,IAAI,EAC7B,GAAI,aAAa,EAAQ,IAAI,EAC7B,EAAG,aAAa,EAAQ,GAAG,EAC3B,EAAG,aAAa,EAAQ,GAAG,EAC3B,GAAI,aAAa,EAAQ,IAAI,CAC/B,EACI,EACJ,GAAI,CACF,IAAM,EAAW,MAAA,EAAM,EAAA,UAAA,CAAU,EAAK,QAAS,CAAE,YAAa,EAAM,CAAC,EACrE,GAAI,aAAoB,WAAY,MAAM,YAAY,EACtD,EAAM,CACR,MAAQ,CACN,MAAM,YAAY,CACpB,CACA,MAAO,CAAE,MAAK,OAAQ,MAAM,aAAa,CAAG,CAAE,CAChD,CAGA,eAAe,aAAa,EAAsD,CAChF,GAAI,IAAQ,IAAA,IAAa,EAAI,KAAK,CAAC,CAAC,SAAW,EAAG,MAAO,CAAC,EAC1D,IAAM,EAAS,UAAU,CAAG,EAC5B,GAAI,CAAC,SAAS,CAAM,GAAK,CAAC,MAAM,QAAQ,EAAO,IAAI,EAAG,MAAM,YAAY,EACxE,IAAM,EAA2B,CAAC,EAClC,IAAK,IAAM,KAAS,EAAO,KAAM,CAG/B,GAFI,CAAC,SAAS,CAAK,IACnB,iBAAiB,CAAK,EAClB,EAAoB,KAAM,GAAW,KAAU,CAAK,GAAG,MAAM,YAAY,EAC7E,EAAK,KAAK,MAAM,aAAa,cAAc,CAAK,CAAC,CAAC,CACpD,CACA,OAAO,CACT,CAEA,IAAM,EAAU,IAAI,QAEpB,eAAe,YAAY,EAAyC,CAClE,IAAM,EAAY,cAAc,EAAI,OAAO,EAC3C,GAAI,IAAc,SAAW,IAAc,aAAc,MAAM,YAAY,EAC3E,IAAM,EAAqB,EAErB,EAAiB,IAAI,IACzB,cAAc,EAAI,eAAe,CAAC,CAC/B,MAAM,GAAG,CAAC,CACV,IAAK,GAAW,EAAO,KAAK,CAAC,CAAC,CAC9B,OAAQ,GAAW,EAAO,OAAS,CAAC,CAAC,CACrC,IAAK,GAAW,eAAe,EAAQ,CAAM,CAAC,CACnD,EACA,GAAI,EAAe,OAAS,EAAG,MAAM,YAAY,EAEjD,IAAM,EAAe,eAAe,cAAc,EAAI,aAAa,EAAG,CAAM,EAEtE,EAAS,cAAc,EAAI,WAAW,EAC5C,YAAY,EAAQ,CAAM,EAC1B,IAAM,EAAW,cAAc,EAAI,QAAQ,EACrC,EAAU,cAAc,EAAI,QAAQ,EAC1C,GAAI,EAAQ,OAAS,GAAgB,kBAAkB,KAAK,CAAO,EAAG,MAAM,YAAY,EACxF,IAAM,EAAgB,cAAc,EAAI,cAAc,EAEtD,GADI,CAAC,kBAAkB,CAAa,GAChC,OAAO,EAAI,iBAAoB,SAAU,MAAM,YAAY,EAC/D,IAAM,EAAiB,IAAI,IACzB,EAAI,gBAAgB,MAAM,GAAG,CAAC,CAC3B,IAAK,GAAU,EAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAC1C,OAAQ,GAAU,EAAM,OAAS,CAAC,CACvC,EACA,IAAK,IAAM,KAAS,EAAgB,GAAI,CAAC,kBAAkB,CAAK,EAAG,MAAM,YAAY,EAErF,eAAe,EAAI,QAAS,SAAS,EACrC,eAAe,EAAI,QAAS,OAAO,EACnC,eAAe,EAAI,WAAY,MAAM,EACrC,eAAe,EAAI,aAAc,OAAO,EAExC,IAAM,EAAS,MAAM,UAAU,cAAc,EAAI,oBAAoB,CAAC,EACtE,GAAI,CACF,IAAM,EAAQ,MAAM,IAAI,EAAA,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAE,IAAK,QAAS,IAAK,EAAO,OAAO,GAAI,CAAC,CAAC,CAAC,KAAK,EAAO,GAAG,EAChH,MAAA,EAAM,EAAA,UAAA,CAAU,GAAA,EAAO,EAAA,kBAAA,CAAkB,CAAE,KAAM,CAAC,EAAO,MAAM,CAAE,CAAC,EAAG,CAAE,WAAY,CAAC,OAAO,CAAE,CAAC,CAChG,MAAQ,CACN,MAAM,YAAY,CACpB,CACA,IAAM,GAAW,MAAM,aAAa,EAAI,6BAA6B,EAAA,CAAG,OACrE,GAAQ,EAAI,MAAQ,EAAO,OAAO,GACrC,EACM,EAAO,CACX,EAAO,OACP,GAAG,EAAQ,QAAQ,EAAK,IAAM,EAAQ,UAAW,GAAU,EAAM,MAAQ,EAAI,GAAG,IAAM,CAAC,CACzF,EAEA,MAAO,CACL,iBACA,SACA,UACA,WACA,SACA,OACA,iBACA,eACA,gBACA,QAAS,CAAE,IAAK,EAAO,IAAK,IAAK,EAAO,OAAO,GAAI,EACnD,UAAA,EAAU,EAAA,kBAAA,CAAkB,CAAE,KAAM,CAAC,GAAG,CAAI,CAAE,CAAC,CACjD,CACF,CAMA,SAAgB,WAAW,EAAyC,CAClE,IAAM,EAAS,EAAQ,IAAI,CAAG,EAC9B,GAAI,IAAW,IAAA,GAAW,OAAO,EACjC,IAAM,EAAU,YAAY,CAAG,EAG/B,OAFA,EAAQ,IAAI,EAAK,CAAO,EACxB,EAAQ,UAAY,EAAQ,OAAO,CAAG,CAAC,EAChC,CACT"}
+{"version":3,"file":"config.cjs","names":[],"sources":["../../src/auth/config.ts"],"sourcesContent":["import {\n  type CryptoKey,\n  calculateJwkThumbprint,\n  createLocalJWKSet,\n  importJWK,\n  type JWK_RSA_Private,\n  type JWK_RSA_Public,\n  jwtVerify,\n  SignJWT,\n} from 'jose';\nimport type { D1Like } from '../worker/env';\nimport type { ApiError } from '../worker/http';\nimport { AuthOperationError } from './errors';\n\n/** The send-email binding subset the issuer calls; the runtime's SendEmail satisfies it. */\nexport interface SendEmail {\n  send(message: { from: string; html?: string; subject: string; text: string; to: string }): Promise<unknown>;\n}\n\n/**\n * The catalog Worker as the issuer reaches it: a Cloudflare service binding (or any\n * `fetch`-shaped stub). Account erasure calls the catalog's `DELETE /api/v1/me/account`\n * through it before removing the issuer's own row.\n */\nexport interface AuthArchiveBinding {\n  fetch(request: Request): Promise<Response>;\n}\n\n/**\n * The bindings the auth issuer reads. Declared structurally, like the catalog\n * Worker's Env: a deployment's generated `ExportedHandler<Env>` accepts the factory's\n * result as-is, with no `@cloudflare/workers-types` dependency. Every value is\n * validated on first use per bindings object; a missing or malformed one answers\n * 503 `unavailable` on every route, never a permissive fallback.\n */\nexport interface AuthWorkerEnv {\n  /** Comma-separated exact origins allowed to call unsafe routes and read CORS responses. */\n  ALLOWED_ORIGINS: string;\n  /** Exactly `local` (loopback HTTP only) or `production` (non-loopback HTTPS, Secure cookies). */\n  APP_ENV: string;\n  /** The app's display name in magic-link email and escaped confirmation-page branding. */\n  APP_NAME: string;\n  AUDIENCE: string;\n  /** Service binding to the sibling catalog Worker: account erasure removes the catalog profile through it. */\n  AUTH_ARCHIVE: AuthArchiveBinding;\n  /** The issuer's own D1: accounts, links, per-account send and singleton admission budgets. */\n  AUTH_DB: D1Like;\n  AUTH_EMAIL: SendEmail;\n  /** The `iss` claim every token carries, exactly as the catalog Worker's `JWT_ISSUER` knows it. */\n  AUTH_ISSUER: string;\n  /**\n   * Optional JWKS JSON (`{\"keys\":[...]}`) of retired PUBLIC RS256 keys, still served\n   * from `/jwks.json` and accepted by the issuer so sessions minted before a rotation\n   * keep verifying until they expire. Private members are rejected.\n   */\n  AUTH_JWT_PREVIOUS_PUBLIC_JWKS?: string;\n  /** The active RS256 private key as a JWK JSON string (a wrangler secret): signs every new session. */\n  AUTH_JWT_PRIVATE_JWK: string;\n  /** Comma-separated emails whose sessions carry the operator role claim. */\n  OPERATOR_EMAILS: string;\n  /** The app's public origin: magic links, app recovery, signed-in navigation and catalog erasure point here. */\n  PUBLIC_ORIGIN: string;\n  /** The address emails come from: a domain onboarded to Cloudflare Email Service. */\n  SENDER_ADDRESS: string;\n}\n\nexport type AuthAppEnv = 'local' | 'production';\n\nexport interface PublicSigningKey extends JWK_RSA_Public {\n  alg: 'RS256';\n  kid: string;\n  kty: 'RSA';\n  use: 'sig';\n}\n\nexport interface AuthConfig {\n  allowedOrigins: ReadonlySet<string>;\n  appEnv: AuthAppEnv;\n  appName: string;\n  audience: string;\n  issuer: string;\n  /** Every key a session may be verified with: the active key first, then retired ones. */\n  jwks: readonly PublicSigningKey[];\n  operatorEmails: ReadonlySet<string>;\n  publicOrigin: string;\n  senderAddress: string;\n  signing: { key: CryptoKey; kid: string };\n  verifier: ReturnType<typeof createLocalJWKSet>;\n}\n\n// Configuration faults never name the offending field: the response must not leak\n// Env names, only a generic temporary unavailability.\nconst configError = (): ApiError => new AuthOperationError(503, 'configuration');\n\nconst EMAIL_MAX = 320;\nconst APP_NAME_MAX = 64;\n// 2048-bit RSA modulus: 256 bytes, 342 base64url characters unpadded.\nconst MIN_MODULUS_CHARS = 342;\nconst BASE64URL = /^[A-Za-z0-9_-]+$/;\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]']);\nconst PRIVATE_RSA_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'] as const;\n\nexport const isWellFormedEmail = (value: string): boolean =>\n  value.length <= EMAIL_MAX &&\n  value === value.toLowerCase() &&\n  /^[^\\s@<>\"',;]+@[^\\s@<>\"',;]+\\.[^\\s@<>\"',;]+$/.test(value);\n\nconst requireString = (value: unknown): string => {\n  if (typeof value !== 'string' || value.length === 0) throw configError();\n  return value;\n};\n\nconst requireBinding = (value: unknown, method: string): void => {\n  if (typeof value !== 'object' || value === null) throw configError();\n  if (typeof Reflect.get(value, method) !== 'function') throw configError();\n};\n\n/** Transport rules: local is loopback HTTP only, production is non-loopback HTTPS; no credentials or fragments. */\nconst validateUrl = (raw: string, appEnv: AuthAppEnv): URL => {\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    throw configError();\n  }\n  if (url.username !== '' || url.password !== '' || url.hash !== '') throw configError();\n  const loopback = LOOPBACK_HOSTS.has(url.hostname);\n  if (appEnv === 'local' ? url.protocol !== 'http:' || !loopback : url.protocol !== 'https:' || loopback) {\n    throw configError();\n  }\n  return url;\n};\n\n/** An exact canonical origin: scheme + host (+port), no path, query, wildcard or `null`. */\nconst validateOrigin = (raw: string, appEnv: AuthAppEnv): string => {\n  const url = validateUrl(raw, appEnv);\n  if (url.pathname !== '/' || url.search !== '' || url.origin !== raw) throw configError();\n  return url.origin;\n};\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null;\n\nconst parseJson = (raw: string): unknown => {\n  try {\n    return JSON.parse(raw);\n  } catch {\n    throw configError();\n  }\n};\n\nconst b64urlMember = (jwk: Record<string, unknown>, name: string): string => {\n  const value = jwk[name];\n  if (typeof value !== 'string' || !BASE64URL.test(value)) throw configError();\n  return value;\n};\n\n/** RS256 signing-key metadata, when present, must agree with how the issuer uses the key. */\nconst checkRsaMetadata = (jwk: Record<string, unknown>): void => {\n  if (jwk.kty !== 'RSA') throw configError();\n  if (jwk.alg !== undefined && jwk.alg !== 'RS256') throw configError();\n  if (jwk.use !== undefined && jwk.use !== 'sig') throw configError();\n};\n\nconst publicMembers = (jwk: Record<string, unknown>): JWK_RSA_Public => {\n  const n = b64urlMember(jwk, 'n');\n  if (n.length < MIN_MODULUS_CHARS) throw configError();\n  return { e: b64urlMember(jwk, 'e'), kty: 'RSA', n };\n};\n\nconst toSigningKey = async (pub: JWK_RSA_Public): Promise<PublicSigningKey> => ({\n  alg: 'RS256',\n  e: pub.e,\n  kid: await calculateJwkThumbprint({ e: pub.e, kty: 'RSA', n: pub.n }),\n  kty: 'RSA',\n  n: pub.n,\n  use: 'sig',\n});\n\nasync function activeKey(raw: string): Promise<{ key: CryptoKey; public: PublicSigningKey }> {\n  const parsed = parseJson(raw);\n  if (!isRecord(parsed)) throw configError();\n  checkRsaMetadata(parsed);\n  const pub = publicMembers(parsed);\n  const jwk: JWK_RSA_Private = {\n    ...pub,\n    d: b64urlMember(parsed, 'd'),\n    dp: b64urlMember(parsed, 'dp'),\n    dq: b64urlMember(parsed, 'dq'),\n    p: b64urlMember(parsed, 'p'),\n    q: b64urlMember(parsed, 'q'),\n    qi: b64urlMember(parsed, 'qi'),\n  };\n  let key: CryptoKey;\n  try {\n    const imported = await importJWK(jwk, 'RS256', { extractable: false });\n    if (imported instanceof Uint8Array) throw configError();\n    key = imported;\n  } catch {\n    throw configError();\n  }\n  return { key, public: await toSigningKey(pub) };\n}\n\n/** Retired verification keys: public RSA members only; any private member is a misconfiguration. */\nasync function previousKeys(raw: string | undefined): Promise<PublicSigningKey[]> {\n  if (raw === undefined || raw.trim().length === 0) return [];\n  const parsed = parseJson(raw);\n  if (!isRecord(parsed) || !Array.isArray(parsed.keys)) throw configError();\n  const keys: PublicSigningKey[] = [];\n  for (const entry of parsed.keys) {\n    if (!isRecord(entry)) throw configError();\n    checkRsaMetadata(entry);\n    if (PRIVATE_RSA_MEMBERS.some((member) => member in entry)) throw configError();\n    keys.push(await toSigningKey(publicMembers(entry)));\n  }\n  return keys;\n}\n\nconst configs = new WeakMap<AuthWorkerEnv, Promise<AuthConfig>>();\n\nasync function buildConfig(env: AuthWorkerEnv): Promise<AuthConfig> {\n  const appEnvRaw = requireString(env.APP_ENV);\n  if (appEnvRaw !== 'local' && appEnvRaw !== 'production') throw configError();\n  const appEnv: AuthAppEnv = appEnvRaw;\n\n  const allowedOrigins = new Set(\n    requireString(env.ALLOWED_ORIGINS)\n      .split(',')\n      .map((origin) => origin.trim())\n      .filter((origin) => origin.length > 0)\n      .map((origin) => validateOrigin(origin, appEnv)),\n  );\n  if (allowedOrigins.size === 0) throw configError();\n\n  const publicOrigin = validateOrigin(requireString(env.PUBLIC_ORIGIN), appEnv);\n  // The issuer is matched as the exact configured string (a trailing slash is meaningful).\n  const issuer = requireString(env.AUTH_ISSUER);\n  validateUrl(issuer, appEnv);\n  const audience = requireString(env.AUDIENCE);\n  const appName = requireString(env.APP_NAME);\n  if (appName.length > APP_NAME_MAX || /[\\p{Cc}\\p{Cs}]/u.test(appName)) throw configError();\n  const senderAddress = requireString(env.SENDER_ADDRESS);\n  if (!isWellFormedEmail(senderAddress)) throw configError();\n  if (typeof env.OPERATOR_EMAILS !== 'string') throw configError();\n  const operatorEmails = new Set(\n    env.OPERATOR_EMAILS.split(',')\n      .map((entry) => entry.trim().toLowerCase())\n      .filter((entry) => entry.length > 0),\n  );\n  for (const email of operatorEmails) if (!isWellFormedEmail(email)) throw configError();\n\n  requireBinding(env.AUTH_DB, 'prepare');\n  requireBinding(env.AUTH_DB, 'batch');\n  requireBinding(env.AUTH_EMAIL, 'send');\n  requireBinding(env.AUTH_ARCHIVE, 'fetch');\n\n  const active = await activeKey(requireString(env.AUTH_JWT_PRIVATE_JWK));\n  try {\n    const proof = await new SignJWT({}).setProtectedHeader({ alg: 'RS256', kid: active.public.kid }).sign(active.key);\n    await jwtVerify(proof, createLocalJWKSet({ keys: [active.public] }), { algorithms: ['RS256'] });\n  } catch {\n    throw configError();\n  }\n  const retired = (await previousKeys(env.AUTH_JWT_PREVIOUS_PUBLIC_JWKS)).filter(\n    (key) => key.kid !== active.public.kid,\n  );\n  const jwks = [\n    active.public,\n    ...retired.filter((key, i) => retired.findIndex((other) => other.kid === key.kid) === i),\n  ];\n\n  return {\n    allowedOrigins,\n    appEnv,\n    appName,\n    audience,\n    issuer,\n    jwks,\n    operatorEmails,\n    publicOrigin,\n    senderAddress,\n    signing: { key: active.key, kid: active.public.kid },\n    verifier: createLocalJWKSet({ keys: [...jwks] }),\n  };\n}\n\n/**\n * Validates the env and imports its keys once per bindings object. A failed\n * validation is not cached, so a corrected binding set recovers without a restart.\n */\nexport function authConfig(env: AuthWorkerEnv): Promise<AuthConfig> {\n  const cached = configs.get(env);\n  if (cached !== undefined) return cached;\n  const pending = buildConfig(env);\n  configs.set(env, pending);\n  pending.catch(() => configs.delete(env));\n  return pending;\n}\n"],"mappings":"sDA4FA,IAAM,gBAA8B,IAAI,EAAA,mBAAmB,IAAK,eAAe,EAEzE,EAAY,IACZ,EAAe,GAEf,EAAoB,IACpB,EAAY,mBACZ,EAAiB,IAAI,IAAI,CAAC,YAAa,YAAa,OAAO,CAAC,EAC5D,EAAsB,CAAC,IAAK,IAAK,IAAK,KAAM,KAAM,KAAM,MAAO,GAAG,EAE3D,kBAAqB,GAChC,EAAM,QAAU,GAChB,IAAU,EAAM,YAAY,GAC5B,+CAA+C,KAAK,CAAK,EAErD,cAAiB,GAA2B,CAChD,GAAI,OAAO,GAAU,UAAY,EAAM,SAAW,EAAG,MAAM,YAAY,EACvE,OAAO,CACT,EAEM,gBAAkB,EAAgB,IAAyB,CAE/D,GADI,OAAO,GAAU,WAAY,GAC7B,OAAO,QAAQ,IAAI,EAAO,CAAM,GAAM,WAAY,MAAM,YAAY,CAC1E,EAGM,aAAe,EAAa,IAA4B,CAC5D,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAG,CACnB,MAAQ,CACN,MAAM,YAAY,CACpB,CACA,GAAI,EAAI,WAAa,IAAM,EAAI,WAAa,IAAM,EAAI,OAAS,GAAI,MAAM,YAAY,EACrF,IAAM,EAAW,EAAe,IAAI,EAAI,QAAQ,EAChD,GAAI,IAAW,QAAU,EAAI,WAAa,SAAW,CAAC,EAAW,EAAI,WAAa,UAAY,EAC5F,MAAM,YAAY,EAEpB,OAAO,CACT,EAGM,gBAAkB,EAAa,IAA+B,CAClE,IAAM,EAAM,YAAY,EAAK,CAAM,EACnC,GAAI,EAAI,WAAa,KAAO,EAAI,SAAW,IAAM,EAAI,SAAW,EAAK,MAAM,YAAY,EACvF,OAAO,EAAI,MACb,EAEM,SAAY,GAAqD,OAAO,GAAU,YAAY,EAE9F,UAAa,GAAyB,CAC1C,GAAI,CACF,OAAO,KAAK,MAAM,CAAG,CACvB,MAAQ,CACN,MAAM,YAAY,CACpB,CACF,EAEM,cAAgB,EAA8B,IAAyB,CAC3E,IAAM,EAAQ,EAAI,GAClB,GAAI,OAAO,GAAU,UAAY,CAAC,EAAU,KAAK,CAAK,EAAG,MAAM,YAAY,EAC3E,OAAO,CACT,EAGM,iBAAoB,GAAuC,CAG/D,GAFI,EAAI,MAAQ,OACZ,EAAI,MAAQ,IAAA,IAAa,EAAI,MAAQ,SACrC,EAAI,MAAQ,IAAA,IAAa,EAAI,MAAQ,MAAO,MAAM,YAAY,CACpE,EAEM,cAAiB,GAAiD,CACtE,IAAM,EAAI,aAAa,EAAK,GAAG,EAC/B,GAAI,EAAE,OAAS,EAAmB,MAAM,YAAY,EACpD,MAAO,CAAE,EAAG,aAAa,EAAK,GAAG,EAAG,IAAK,MAAO,GAAE,CACpD,EAEM,aAAe,KAAO,KAAoD,CAC9E,IAAK,QACL,EAAG,EAAI,EACP,IAAK,MAAA,EAAM,EAAA,uBAAA,CAAuB,CAAE,EAAG,EAAI,EAAG,IAAK,MAAO,EAAG,EAAI,CAAE,CAAC,EACpE,IAAK,MACL,EAAG,EAAI,EACP,IAAK,KACP,GAEA,eAAe,UAAU,EAAoE,CAC3F,IAAM,EAAS,UAAU,CAAG,EAC5B,GAAI,CAAC,SAAS,CAAM,EAAG,MAAM,YAAY,EACzC,iBAAiB,CAAM,EACvB,IAAM,EAAM,cAAc,CAAM,EAC1B,EAAuB,CAC3B,GAAG,EACH,EAAG,aAAa,EAAQ,GAAG,EAC3B,GAAI,aAAa,EAAQ,IAAI,EAC7B,GAAI,aAAa,EAAQ,IAAI,EAC7B,EAAG,aAAa,EAAQ,GAAG,EAC3B,EAAG,aAAa,EAAQ,GAAG,EAC3B,GAAI,aAAa,EAAQ,IAAI,CAC/B,EACI,EACJ,GAAI,CACF,IAAM,EAAW,MAAA,EAAM,EAAA,UAAA,CAAU,EAAK,QAAS,CAAE,YAAa,EAAM,CAAC,EACrE,GAAI,aAAoB,WAAY,MAAM,YAAY,EACtD,EAAM,CACR,MAAQ,CACN,MAAM,YAAY,CACpB,CACA,MAAO,CAAE,MAAK,OAAQ,MAAM,aAAa,CAAG,CAAE,CAChD,CAGA,eAAe,aAAa,EAAsD,CAChF,GAAI,IAAQ,IAAA,IAAa,EAAI,KAAK,CAAC,CAAC,SAAW,EAAG,MAAO,CAAC,EAC1D,IAAM,EAAS,UAAU,CAAG,EAC5B,GAAI,CAAC,SAAS,CAAM,GAAK,CAAC,MAAM,QAAQ,EAAO,IAAI,EAAG,MAAM,YAAY,EACxE,IAAM,EAA2B,CAAC,EAClC,IAAK,IAAM,KAAS,EAAO,KAAM,CAG/B,GAFI,CAAC,SAAS,CAAK,IACnB,iBAAiB,CAAK,EAClB,EAAoB,KAAM,GAAW,KAAU,CAAK,GAAG,MAAM,YAAY,EAC7E,EAAK,KAAK,MAAM,aAAa,cAAc,CAAK,CAAC,CAAC,CACpD,CACA,OAAO,CACT,CAEA,IAAM,EAAU,IAAI,QAEpB,eAAe,YAAY,EAAyC,CAClE,IAAM,EAAY,cAAc,EAAI,OAAO,EAC3C,GAAI,IAAc,SAAW,IAAc,aAAc,MAAM,YAAY,EAC3E,IAAM,EAAqB,EAErB,EAAiB,IAAI,IACzB,cAAc,EAAI,eAAe,CAAC,CAC/B,MAAM,GAAG,CAAC,CACV,IAAK,GAAW,EAAO,KAAK,CAAC,CAAC,CAC9B,OAAQ,GAAW,EAAO,OAAS,CAAC,CAAC,CACrC,IAAK,GAAW,eAAe,EAAQ,CAAM,CAAC,CACnD,EACA,GAAI,EAAe,OAAS,EAAG,MAAM,YAAY,EAEjD,IAAM,EAAe,eAAe,cAAc,EAAI,aAAa,EAAG,CAAM,EAEtE,EAAS,cAAc,EAAI,WAAW,EAC5C,YAAY,EAAQ,CAAM,EAC1B,IAAM,EAAW,cAAc,EAAI,QAAQ,EACrC,EAAU,cAAc,EAAI,QAAQ,EAC1C,GAAI,EAAQ,OAAS,GAAgB,kBAAkB,KAAK,CAAO,EAAG,MAAM,YAAY,EACxF,IAAM,EAAgB,cAAc,EAAI,cAAc,EAEtD,GADI,CAAC,kBAAkB,CAAa,GAChC,OAAO,EAAI,iBAAoB,SAAU,MAAM,YAAY,EAC/D,IAAM,EAAiB,IAAI,IACzB,EAAI,gBAAgB,MAAM,GAAG,CAAC,CAC3B,IAAK,GAAU,EAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAC1C,OAAQ,GAAU,EAAM,OAAS,CAAC,CACvC,EACA,IAAK,IAAM,KAAS,EAAgB,GAAI,CAAC,kBAAkB,CAAK,EAAG,MAAM,YAAY,EAErF,eAAe,EAAI,QAAS,SAAS,EACrC,eAAe,EAAI,QAAS,OAAO,EACnC,eAAe,EAAI,WAAY,MAAM,EACrC,eAAe,EAAI,aAAc,OAAO,EAExC,IAAM,EAAS,MAAM,UAAU,cAAc,EAAI,oBAAoB,CAAC,EACtE,GAAI,CACF,IAAM,EAAQ,MAAM,IAAI,EAAA,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAE,IAAK,QAAS,IAAK,EAAO,OAAO,GAAI,CAAC,CAAC,CAAC,KAAK,EAAO,GAAG,EAChH,MAAA,EAAM,EAAA,UAAA,CAAU,GAAA,EAAO,EAAA,kBAAA,CAAkB,CAAE,KAAM,CAAC,EAAO,MAAM,CAAE,CAAC,EAAG,CAAE,WAAY,CAAC,OAAO,CAAE,CAAC,CAChG,MAAQ,CACN,MAAM,YAAY,CACpB,CACA,IAAM,GAAW,MAAM,aAAa,EAAI,6BAA6B,EAAA,CAAG,OACrE,GAAQ,EAAI,MAAQ,EAAO,OAAO,GACrC,EACM,EAAO,CACX,EAAO,OACP,GAAG,EAAQ,QAAQ,EAAK,IAAM,EAAQ,UAAW,GAAU,EAAM,MAAQ,EAAI,GAAG,IAAM,CAAC,CACzF,EAEA,MAAO,CACL,iBACA,SACA,UACA,WACA,SACA,OACA,iBACA,eACA,gBACA,QAAS,CAAE,IAAK,EAAO,IAAK,IAAK,EAAO,OAAO,GAAI,EACnD,UAAA,EAAU,EAAA,kBAAA,CAAkB,CAAE,KAAM,CAAC,GAAG,CAAI,CAAE,CAAC,CACjD,CACF,CAMA,SAAgB,WAAW,EAAyC,CAClE,IAAM,EAAS,EAAQ,IAAI,CAAG,EAC9B,GAAI,IAAW,IAAA,GAAW,OAAO,EACjC,IAAM,EAAU,YAAY,CAAG,EAG/B,OAFA,EAAQ,IAAI,EAAK,CAAO,EACxB,EAAQ,UAAY,EAAQ,OAAO,CAAG,CAAC,EAChC,CACT"}

package/dist/auth/config.d.ts

@@ -30,7 +30,7 @@ export interface AuthWorkerEnv {
     ALLOWED_ORIGINS: string;
     /** Exactly `local` (loopback HTTP only) or `production` (non-loopback HTTPS, Secure cookies). */
     APP_ENV: string;
-    /** The app's display name: the magic-link email's subject and copy name it. */
+    /** The app's display name in magic-link email and escaped confirmation-page branding. */
     APP_NAME: string;
     AUDIENCE: string;
     /** Service binding to the sibling catalog Worker: account erasure removes the catalog profile through it. */
@@ -50,7 +50,7 @@ export interface AuthWorkerEnv {
     AUTH_JWT_PRIVATE_JWK: string;
     /** Comma-separated emails whose sessions carry the operator role claim. */
     OPERATOR_EMAILS: string;
-    /** The app's public origin: magic links, the signed-in redirect and the catalog erasure URL point here. */
+    /** The app's public origin: magic links, app recovery, signed-in navigation and catalog erasure point here. */
     PUBLIC_ORIGIN: string;
     /** The address emails come from: a domain onboarded to Cloudflare Email Service. */
     SENDER_ADDRESS: string;

package/dist/auth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,SAAS,EAEd,iBAAiB,EAGjB,KAAK,cAAc,EAGpB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAI5C,4FAA4F;AAC5F,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7G;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,2FAA2F;IAC3F,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,6GAA6G;IAC7G,YAAY,EAAE,kBAAkB,CAAC;IACjC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,CAAC;IACtB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,sGAAsG;IACtG,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,2GAA2G;IAC3G,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAC;AAEhD,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,KAAK,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,IAAI,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,QAAQ,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;CAChD;AAcD,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,OAGU,CAAC;AAqL7D;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAOlE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,SAAS,EAEd,iBAAiB,EAGjB,KAAK,cAAc,EAGpB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAI5C,4FAA4F;AAC5F,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7G;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,2FAA2F;IAC3F,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,6GAA6G;IAC7G,YAAY,EAAE,kBAAkB,CAAC;IACjC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,CAAC;IACtB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,sGAAsG;IACtG,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAC;AAEhD,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,KAAK,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,IAAI,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,QAAQ,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;CAChD;AAcD,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,OAGU,CAAC;AAqL7D;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAOlE"}