@vielzeug/archive 26.11.12 → 26.11.13

package/dist/auth/worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker.js","names":["ROUTES","ROUTE_METHODS","ROUTE_LABELS","id","request","TOKEN_BYTES","LINK_TOKEN","PUBLISHER_ID","SUBJECT_MAX","CLOCK_TOLERANCE_SECONDS","AuthOperationError","origin","config","allowPublicOrigin","forbidden","cors","ACCOUNT_HEADER","PUBLISHER_HEADER","REQUEST_MARKER_HEADER","methods","maxAge","operator","OPERATOR_SESSION_MAX_AGE_SECONDS","SESSION_MAX_AGE_SECONDS","SignJWT","ARCHIVE_OPERATOR_ROLE","subject","token","sessionToken","unauthenticated","jwtVerify","payload","isWellFormedText","version","account","readAccount","env","error","errors","name","notice","LINK_TTL_MS","escapeHtml","link","body","readJsonBody","badRequest","keys","requestedEmail","email","isWellFormedEmail","nowMs","admissionRetry","spendSignInBudget","ApiError","user","ensureUser","retryAfterSeconds","spendLinkBudget","tokenHash","sha256Hex","insertToken","deleteToken","json","noStore","queryParams","confirmationPage","consumeToken","session","sessionCookieValue","row","text","response","parsed","envelope","archiveErrorResponseSchema","retryAfter","uuidSchema","headers","SESSION_COOKIE_NAME","publisher","archived","serviceRequest","deleteAccount","expiredSessionCookie","revokeSessions","sessionVersion","reason","dbSchemaVersion","authConfig","authReadiness","archiveAuthHealthSchema","method","routeId","next","key","value","tappers","handler","event","requestId","started","failure","toErrorResponse","code","forwardedCode","health","removed","sweep","options"],"sources":["../../src/auth/worker.ts"],"sourcesContent":["import { errors, jwtVerify, SignJWT } from 'jose';\nimport { sha256Hex } from '../_crypto';\nimport {\n  ACCOUNT_HEADER,\n  ARCHIVE_OPERATOR_ROLE,\n  type ArchiveErrorCode,\n  AUTH_SCHEMA_VERSION,\n  archiveAuthHealthSchema,\n  archiveErrorResponseSchema,\n  isWellFormedText,\n  OPERATOR_SESSION_MAX_AGE_SECONDS,\n  PUBLISHER_HEADER,\n  REQUEST_MARKER_HEADER,\n  SESSION_COOKIE_NAME,\n  SESSION_MAX_AGE_SECONDS,\n  sessionCookieValue,\n  uuidSchema,\n} from '../contract';\nimport { serviceRequest } from '../worker/_service';\nimport {\n  ApiError,\n  badRequest,\n  expiredSessionCookie,\n  forbidden,\n  json,\n  noStore,\n  queryParams,\n  readJsonBody,\n  sessionToken,\n  toErrorResponse,\n  unauthenticated,\n} from '../worker/http';\nimport type { ArchiveExecutionContext } from '../worker/worker';\nimport { confirmationPage, escapeHtml } from './_confirmation';\nimport { type AuthConfig, type AuthWorkerEnv, authConfig, isWellFormedEmail } from './config';\nimport { type AuthDiagnostic, AuthOperationError } from './errors';\nimport {\n  authReadiness,\n  consumeToken,\n  deleteAccount,\n  deleteToken,\n  ensureUser,\n  insertToken,\n  LINK_TTL_MS,\n  readAccount,\n  revokeSessions,\n  spendLinkBudget,\n  spendSignInBudget,\n  sweep,\n} from './store';\n\n/**\n * The reference identity issuer: passwordless email accounts. A POST with an email\n * address ensures the account row and sends a single-use magic link; consuming it\n * signs the browser in by setting the `archive_session` cookie a catalog Worker\n * verifies — an RS256 JWT minted by the active private key, verifiable through\n * `/jwks.json` alongside any configured retired public keys. `OPERATOR_EMAILS` is\n * the one operator-membership truth; operator sessions expire after one hour,\n * bounding authority from previously minted role claims. The account routes export the issuer's\n * own record and erase it together with the catalog profile.\n */\nexport interface AuthWorkerHandler<E extends AuthWorkerEnv = AuthWorkerEnv> {\n  fetch(request: Request, env: E, ctx?: ArchiveExecutionContext): Promise<Response>;\n  /** The cron sweep: expired links, closed send windows and never-verified accounts. */\n  scheduled(controller: unknown, env: E, ctx?: ArchiveExecutionContext): Promise<void>;\n  tap(handler: (event: AuthEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;\n}\n\nexport type AuthEvent =\n  | {\n      readonly type: 'request';\n      readonly requestId: string;\n      readonly route:\n        | '/auth/account'\n        | '/auth/jwks.json'\n        | '/auth/sign-in'\n        | '/auth/verify'\n        | '/auth/session'\n        | '/auth/sign-out-all'\n        | '/auth/health'\n        | 'unmatched';\n      readonly status: number;\n      readonly code: ArchiveErrorCode | 'ok';\n      readonly ms: number;\n      readonly diagnostic?: AuthDiagnostic;\n    }\n  | { readonly type: 'scheduled'; readonly status: 'ok'; readonly removed: number }\n  | { readonly type: 'scheduled'; readonly status: 'failed'; readonly diagnostic: AuthDiagnostic };\n\nconst ROUTES = {\n  account: /^\\/api\\/v1\\/auth\\/account$/,\n  health: /^\\/api\\/v1\\/auth\\/health$/,\n  jwks: /^\\/api\\/v1\\/auth\\/jwks\\.json$/,\n  session: /^\\/api\\/v1\\/auth\\/session$/,\n  signIn: /^\\/api\\/v1\\/auth\\/sign-in$/,\n  signOutAll: /^\\/api\\/v1\\/auth\\/sign-out-all$/,\n  verify: /^\\/api\\/v1\\/auth\\/verify$/,\n} as const;\n\nconst ROUTE_METHODS: Record<keyof typeof ROUTES, readonly string[]> = {\n  account: ['GET', 'DELETE'],\n  health: ['GET'],\n  jwks: ['GET'],\n  session: ['GET'],\n  signIn: ['POST'],\n  signOutAll: ['POST'],\n  verify: ['GET', 'POST'],\n};\n\nconst ROUTE_LABELS = {\n  account: '/auth/account',\n  health: '/auth/health',\n  jwks: '/auth/jwks.json',\n  session: '/auth/session',\n  signIn: '/auth/sign-in',\n  signOutAll: '/auth/sign-out-all',\n  verify: '/auth/verify',\n} as const;\n\nconst matchRoute = (request: Request): keyof typeof ROUTES | undefined =>\n  (Object.keys(ROUTES) as (keyof typeof ROUTES)[]).find((id) => ROUTES[id].test(new URL(request.url).pathname));\n\nconst TOKEN_BYTES = 32;\n// Base64url of TOKEN_BYTES random bytes, unpadded.\nconst LINK_TOKEN = /^[A-Za-z0-9_-]{43}$/;\nconst PUBLISHER_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;\nconst SUBJECT_MAX = 256;\nconst CLOCK_TOLERANCE_SECONDS = 5;\n\nconst randomToken = (): string =>\n  btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(TOKEN_BYTES))))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replace(/=+$/, '');\n\nconst unavailable = (): ApiError => new AuthOperationError(503, 'catalog');\n\n/** Exact allowed Origin plus the request marker, like the catalog's mutation guard. */\nfunction requireMutationGuard(request: Request, config: AuthConfig, allowPublicOrigin = false): string {\n  const origin = request.headers.get('origin');\n  if (origin === null || (!config.allowedOrigins.has(origin) && !(allowPublicOrigin && origin === config.publicOrigin)))\n    throw forbidden();\n  if (request.headers.get(REQUEST_MARKER_HEADER) !== '1') throw forbidden();\n  return origin;\n}\n\nfunction corsHeaders(request: Request, config: AuthConfig): Record<string, string> {\n  const origin = request.headers.get('origin');\n  if (\n    origin === null ||\n    (!config.allowedOrigins.has(origin) && !(matchRoute(request) === 'verify' && origin === config.publicOrigin))\n  )\n    return {};\n  return { 'access-control-allow-credentials': 'true', 'access-control-allow-origin': origin, vary: 'Origin' };\n}\n\nfunction preflight(request: Request, config: AuthConfig, methods: readonly string[]): Response {\n  const cors = corsHeaders(request, config);\n  if (Object.keys(cors).length === 0) throw forbidden();\n  return new Response(null, {\n    headers: {\n      ...cors,\n      'access-control-allow-headers': `Content-Type, ${ACCOUNT_HEADER}, ${PUBLISHER_HEADER}, ${REQUEST_MARKER_HEADER}`,\n      'access-control-allow-methods': [...methods, 'OPTIONS'].join(', '),\n      'access-control-max-age': '600',\n    },\n    status: 204,\n  });\n}\n\nconst secure = (config: AuthConfig): boolean => config.appEnv === 'production';\n\nasync function mintSession(\n  config: AuthConfig,\n  subject: string,\n  operator: boolean,\n  sessionVersion: number,\n): Promise<{ maxAge: number; token: string }> {\n  const maxAge = operator ? OPERATOR_SESSION_MAX_AGE_SECONDS : SESSION_MAX_AGE_SECONDS;\n  const token = await new SignJWT({ sessionVersion, ...(operator ? { roles: [ARCHIVE_OPERATOR_ROLE] } : {}) })\n    .setProtectedHeader({ alg: 'RS256', kid: config.signing.kid, typ: 'JWT' })\n    .setIssuedAt()\n    .setJti(crypto.randomUUID())\n    .setIssuer(config.issuer)\n    .setAudience(config.audience)\n    .setSubject(subject)\n    .setExpirationTime(`${maxAge}s`)\n    .sign(config.signing.key);\n  return { maxAge, token };\n}\n\n/** Verifies the request's own session cookie against every published key; returns the token and subject. */\nasync function requireSession(\n  request: Request,\n  config: AuthConfig,\n  env: AuthWorkerEnv,\n): Promise<{ subject: string; token: string; sessionVersion: number }> {\n  const token = sessionToken(request);\n  if (token === null) throw unauthenticated();\n  try {\n    const { payload } = await jwtVerify(token, config.verifier, {\n      algorithms: ['RS256'],\n      audience: config.audience,\n      clockTolerance: CLOCK_TOLERANCE_SECONDS,\n      issuer: config.issuer,\n      maxTokenAge: SESSION_MAX_AGE_SECONDS,\n      requiredClaims: ['sub', 'iss', 'aud', 'iat', 'exp', 'sessionVersion'],\n    });\n    const subject = payload.sub ?? '';\n    if (subject.length === 0 || subject.length > SUBJECT_MAX || !isWellFormedText(subject)) throw unauthenticated();\n    const version = payload.sessionVersion;\n    if (typeof version !== 'number' || !Number.isSafeInteger(version) || version < 0) throw unauthenticated();\n    if (typeof payload.iat !== 'number' || payload.iat > Date.now() / 1000 + CLOCK_TOLERANCE_SECONDS)\n      throw unauthenticated();\n    if (\n      Array.isArray(payload.roles) &&\n      payload.roles.includes(ARCHIVE_OPERATOR_ROLE) &&\n      (typeof payload.exp !== 'number' ||\n        payload.exp - payload.iat > OPERATOR_SESSION_MAX_AGE_SECONDS ||\n        Date.now() / 1000 - payload.iat > OPERATOR_SESSION_MAX_AGE_SECONDS + CLOCK_TOLERANCE_SECONDS)\n    )\n      throw unauthenticated();\n    const account = await readAccount(env.AUTH_DB, subject);\n    if (account === null || account.session_version !== version) throw unauthenticated();\n    return { sessionVersion: version, subject, token };\n  } catch (error) {\n    if (error instanceof errors.JOSEError) throw unauthenticated();\n    throw error;\n  }\n}\n\nasync function sendLink(env: AuthWorkerEnv, config: AuthConfig, to: string, link: string): Promise<void> {\n  const name = config.appName;\n  const minutes = LINK_TTL_MS / 60_000;\n  const notice = `The link works once and expires in ${minutes} minutes. If you did not request it, ignore this email.`;\n  await env.AUTH_EMAIL.send({\n    from: config.senderAddress,\n    html: `<p>Open this link to sign in to ${escapeHtml(name)}:</p><p><a href=\"${escapeHtml(link)}\">${escapeHtml(link)}</a></p><p>${notice}</p>`,\n    subject: `Your ${name} sign-in link`,\n    text: `Open this link to sign in to ${name}:\\n\\n${link}\\n\\n${notice}`,\n    to,\n  });\n}\n\nasync function handleSignIn(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  requireMutationGuard(request, config);\n  const body = await readJsonBody(request);\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) throw badRequest();\n  const keys = Object.keys(body);\n  const requestedEmail: unknown = Reflect.get(body, 'email');\n  if (keys.length !== 1 || keys[0] !== 'email' || typeof requestedEmail !== 'string') {\n    throw badRequest();\n  }\n  const email = requestedEmail.trim().toLowerCase();\n  if (!isWellFormedEmail(email)) {\n    throw badRequest();\n  }\n  const nowMs = Date.now();\n  const admissionRetry = await spendSignInBudget(env.AUTH_DB, nowMs);\n  if (admissionRetry !== null) {\n    throw new ApiError(429, 'rate-limited', 'Too many sign-in requests. Try again later.', {\n      retryAfterSeconds: admissionRetry,\n    });\n  }\n  const user = await ensureUser(env.AUTH_DB, email);\n  const retryAfterSeconds = await spendLinkBudget(env.AUTH_DB, user.id, nowMs);\n  if (retryAfterSeconds !== null) {\n    throw new ApiError(429, 'rate-limited', 'Too many sign-in emails. Try again later.', { retryAfterSeconds });\n  }\n  const token = randomToken();\n  const tokenHash = await sha256Hex(token);\n  await insertToken(env.AUTH_DB, tokenHash, user.id, nowMs);\n  try {\n    await sendLink(env, config, user.email, `${config.publicOrigin}/api/v1/auth/verify?token=${token}`);\n  } catch (error) {\n    // An unsent link is useless; the spent allowance is deliberately not refunded.\n    await deleteToken(env.AUTH_DB, tokenHash).catch(() => undefined);\n    throw new AuthOperationError(503, 'email', { cause: error });\n  }\n  return json(202, { ok: true }, noStore);\n}\n\nasync function handleVerify(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  if (request.method === 'GET') {\n    const token = queryParams(new URL(request.url), ['token']).get('token') ?? '';\n    if (!LINK_TOKEN.test(token)) throw badRequest('The link is not valid.');\n    return confirmationPage({ ...config, nonce: randomToken(), token });\n  }\n  requireMutationGuard(request, config, true);\n  queryParams(new URL(request.url), []);\n  const body = await readJsonBody(request);\n  if (typeof body !== 'object' || body === null || Array.isArray(body) || Object.keys(body).length !== 1) {\n    throw badRequest('The link is not valid.');\n  }\n  const token: unknown = Reflect.get(body, 'token');\n  if (typeof token !== 'string') throw badRequest('The link is not valid.');\n  if (!LINK_TOKEN.test(token)) throw badRequest('The link is not valid.');\n  const user = await consumeToken(env.AUTH_DB, await sha256Hex(token), Date.now());\n  if (user === null) throw new ApiError(410, 'gone', 'That link has expired or was already used.');\n  const session = await mintSession(config, user.id, config.operatorEmails.has(user.email), user.sessionVersion);\n  return new Response(null, {\n    headers: {\n      ...noStore,\n      'set-cookie': sessionCookieValue(session.token, { maxAgeSeconds: session.maxAge, secure: secure(config) }),\n    },\n    status: 204,\n  });\n}\n\n/** The issuer's half of a complete export: the account record only, never tokens or budget state. */\nasync function handleExport(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  const { subject } = await requireSession(request, config, env);\n  const row = await readAccount(env.AUTH_DB, subject);\n  if (row === null) throw unauthenticated();\n  return json(\n    200,\n    { createdAt: row.created_at, email: row.email, id: row.id, lastSignInAt: row.last_sign_in_at },\n    noStore,\n  );\n}\n\n/** Re-serializes a failed catalog response into the public envelope; anything unrecognizable is 503. */\nasync function archiveFailure(response: Response): Promise<Response> {\n  const text = await response.text().catch(() => '');\n  let parsed: unknown = null;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    parsed = null;\n  }\n  const envelope = archiveErrorResponseSchema.safeParse(parsed);\n  if (!envelope.success || response.status < 400 || response.status > 599) throw unavailable();\n  const { code, message, requestId } = envelope.data.error;\n  const retryAfter = response.headers.get('retry-after');\n  return json(\n    response.status,\n    { error: { code, message, requestId } },\n    retryAfter !== null && /^\\d{1,6}$/.test(retryAfter) ? { ...noStore, 'retry-after': retryAfter } : noStore,\n  );\n}\n\n/**\n * Full erasure: catalog session revocation and profile erasure first (through the AUTH_ARCHIVE service binding,\n * presenting the caller's own session), then the issuer's account row, and only then\n * the cookie is expired. Any failure keeps the browser session so the same request\n * can be retried; both halves are idempotent, so a retry after a partial success\n * re-runs the catalog no-op and finishes the issuer side. The account precondition\n * pins every attempt to the confirmed issuer subject, even without a publisher.\n */\nasync function handleErase(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  const origin = requireMutationGuard(request, config);\n  const { subject, token } = await requireSession(request, config, env);\n  const account = request.headers.get(ACCOUNT_HEADER);\n  if (account === null || !uuidSchema.safeParse(account).success) throw badRequest();\n  if (account !== subject) {\n    throw new ApiError(409, 'account-changed', 'The signed-in account changed since this request was prepared.');\n  }\n  const headers = new Headers({\n    cookie: `${SESSION_COOKIE_NAME}=${token}`,\n    origin,\n    [REQUEST_MARKER_HEADER]: '1',\n  });\n  const publisher = request.headers.get(PUBLISHER_HEADER);\n  if (publisher !== null) {\n    if (!PUBLISHER_ID.test(publisher)) throw badRequest();\n    headers.set(PUBLISHER_HEADER, publisher);\n  }\n  let archived: Response;\n  try {\n    archived = await serviceRequest(\n      env.AUTH_ARCHIVE,\n      new Request(`${config.publicOrigin}/api/v1/me/account`, { headers, method: 'DELETE', redirect: 'manual' }),\n      async (response) => {\n        if (response.status === 204) {\n          await response.body?.cancel();\n          return response;\n        }\n        return archiveFailure(response);\n      },\n    );\n  } catch (error) {\n    throw new AuthOperationError(503, 'catalog', { cause: error });\n  }\n  if (archived.status !== 204) return archived;\n  await deleteAccount(env.AUTH_DB, subject);\n  return new Response(null, {\n    headers: { ...noStore, 'set-cookie': expiredSessionCookie(secure(config)) },\n    status: 204,\n  });\n}\n\nasync function handleSignOutAll(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  requireMutationGuard(request, config);\n  const { subject, sessionVersion } = await requireSession(request, config, env);\n  const account = request.headers.get(ACCOUNT_HEADER);\n  if (account === null || !uuidSchema.safeParse(account).success) throw badRequest();\n  if (account !== subject)\n    throw new ApiError(409, 'account-changed', 'The signed-in account changed since this request was prepared.');\n  if ((await revokeSessions(env.AUTH_DB, subject, sessionVersion)) === null) throw unauthenticated();\n  return json(200, { ok: true }, { ...noStore, 'set-cookie': expiredSessionCookie(secure(config)) });\n}\n\nasync function handleHealth(env: AuthWorkerEnv): Promise<Response> {\n  let reason: 'configuration-unavailable' | 'database-unavailable' | 'schema-mismatch' | null = null;\n  let dbSchemaVersion: number | null = null;\n  try {\n    await authConfig(env);\n  } catch {\n    reason = 'configuration-unavailable';\n  }\n  if (reason === null) {\n    try {\n      dbSchemaVersion = await authReadiness(env.AUTH_DB);\n      if (dbSchemaVersion !== AUTH_SCHEMA_VERSION) reason = 'schema-mismatch';\n    } catch {\n      reason = 'database-unavailable';\n    }\n  }\n  return json(\n    reason === null ? 200 : 503,\n    archiveAuthHealthSchema.parse({\n      dbSchemaVersion,\n      reason,\n      schemaVersion: AUTH_SCHEMA_VERSION,\n      status: reason === null ? 'ok' : 'degraded',\n    }),\n    noStore,\n  );\n}\nasync function route(request: Request, env: AuthWorkerEnv): Promise<Response> {\n  const method = request.method.toUpperCase();\n  const routeId = matchRoute(request);\n  if (routeId === undefined) throw new ApiError(404, 'not-found', 'No such route.');\n  if (routeId === 'health' && method === 'GET') return handleHealth(env);\n  const config = await authConfig(env);\n  const cors = corsHeaders(request, config);\n  if (method === 'OPTIONS') return preflight(request, config, ROUTE_METHODS[routeId]);\n  if (!ROUTE_METHODS[routeId].includes(method)) {\n    throw new ApiError(405, 'method-not-allowed', 'That method is not allowed here.');\n  }\n  let response: Response;\n  switch (routeId) {\n    case 'health':\n      response = await handleHealth(env);\n      break;\n    case 'session':\n      await requireSession(request, config, env);\n      response = json(200, { ok: true }, noStore);\n      break;\n    case 'signOutAll':\n      response = await handleSignOutAll(request, env, config);\n      break;\n    case 'jwks':\n      response = json(200, { keys: config.jwks }, noStore);\n      break;\n    case 'signIn':\n      response = await handleSignIn(request, env, config);\n      break;\n    case 'verify':\n      response = await handleVerify(request, env, config);\n      break;\n    case 'account':\n      response = method === 'GET' ? await handleExport(request, env, config) : await handleErase(request, env, config);\n      break;\n  }\n  return withCors(response, cors);\n}\n\nfunction withCors(response: Response, cors: Record<string, string>): Response {\n  if (Object.keys(cors).length === 0) return response;\n  const next = new Response(response.body, response);\n  for (const [key, value] of Object.entries(cors)) next.headers.set(key, value);\n  return next;\n}\n\nconst diagnostic = (error: unknown): AuthDiagnostic =>\n  error instanceof AuthOperationError ? error.authDiagnostic : { kind: 'internal' };\n\n/**\n * Builds the reference identity issuer. Route behavior is fixed; every deployment\n * difference is validated configuration — the app name, trusted origins, audience and\n * issuer claims, signing keys, operator roster, the catalog service binding, and\n * where links and redirects land.\n */\nexport function createAuthWorker<E extends AuthWorkerEnv>(): AuthWorkerHandler<E> {\n  const tappers = new Set<(event: AuthEvent) => void>();\n  const emit = (event: AuthEvent): void => {\n    for (const handler of tappers) {\n      try {\n        handler(event);\n      } catch {\n        // Observers never change request or scheduled outcomes.\n      }\n    }\n  };\n  return {\n    async fetch(request: Request, env: E): Promise<Response> {\n      const requestId = crypto.randomUUID();\n      const started = Date.now();\n      let response: Response;\n      let failure: unknown;\n      try {\n        response = await route(request, env);\n      } catch (error) {\n        failure = error;\n        response = toErrorResponse(error, requestId);\n        // Failures stay readable by allowed origins; config faults have no trusted origin set.\n        const config = await authConfig(env).catch(() => null);\n        if (config !== null) {\n          if (\n            matchRoute(request) === 'verify' &&\n            request.method === 'GET' &&\n            error instanceof ApiError &&\n            error.status === 400\n          )\n            response = confirmationPage({ ...config, nonce: randomToken(), token: null });\n          response = withCors(response, corsHeaders(request, config));\n        }\n      }\n      if (matchRoute(request) === 'verify') {\n        response.headers.set('cache-control', 'no-store');\n        response.headers.set('referrer-policy', 'no-referrer');\n        response.headers.set('x-content-type-options', 'nosniff');\n        if (!response.headers.has('content-security-policy')) {\n          response.headers.set(\n            'content-security-policy',\n            \"default-src 'none'; base-uri 'none'; frame-ancestors 'none'\",\n          );\n        }\n      }\n      if (tappers.size > 0) {\n        const routeId = matchRoute(request);\n        const code =\n          response.status < 400\n            ? 'ok'\n            : routeId === 'health'\n              ? 'unavailable'\n              : failure instanceof ApiError\n                ? failure.code\n                : 'internal';\n        // Account erasure may forward a catalog error response rather than throw.\n        const forwardedCode =\n          failure === undefined && response.status >= 400\n            ? archiveErrorResponseSchema.safeParse(\n                await response\n                  .clone()\n                  .json()\n                  .catch(() => null),\n              )\n            : null;\n        const health =\n          routeId === 'health' && response.status === 503\n            ? archiveAuthHealthSchema.safeParse(\n                await response\n                  .clone()\n                  .json()\n                  .catch(() => null),\n              )\n            : null;\n        emit({\n          code: forwardedCode?.success ? forwardedCode.data.error.code : code,\n          ms: Math.max(0, Date.now() - started),\n          requestId,\n          route: routeId === undefined ? 'unmatched' : ROUTE_LABELS[routeId],\n          status: response.status,\n          type: 'request',\n          ...(response.status >= 500\n            ? {\n                diagnostic: health?.success\n                  ? {\n                      kind:\n                        health.data.reason === 'configuration-unavailable'\n                          ? 'configuration'\n                          : health.data.reason === 'schema-mismatch'\n                            ? 'schema'\n                            : 'database',\n                    }\n                  : failure === undefined\n                    ? { kind: 'catalog' as const }\n                    : diagnostic(failure),\n              }\n            : {}),\n        });\n      }\n      return response;\n    },\n\n    async scheduled(_controller: unknown, env: E): Promise<void> {\n      try {\n        await authConfig(env);\n        const removed = await sweep(env.AUTH_DB, Date.now());\n        if (tappers.size > 0) emit({ removed, status: 'ok', type: 'scheduled' });\n      } catch (error) {\n        if (tappers.size > 0) emit({ diagnostic: diagnostic(error), status: 'failed', type: 'scheduled' });\n        throw error;\n      }\n    },\n    tap(handler, options) {\n      if (options?.signal?.aborted) return () => undefined;\n      const observer = (event: AuthEvent): void => handler(event);\n      const unsubscribe = (): void => {\n        tappers.delete(observer);\n        options?.signal?.removeEventListener('abort', unsubscribe);\n      };\n      tappers.add(observer);\n      options?.signal?.addEventListener('abort', unsubscribe, { once: true });\n      return unsubscribe;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;AAyFA,IAAMA,IAAS;CACb,SAAS;CACT,QAAQ;CACR,MAAM;CACN,SAAS;CACT,QAAQ;CACR,YAAY;CACZ,QAAQ;AACV,GAEMC,IAAgE;CACpE,SAAS,CAAC,OAAO,QAAQ;CACzB,QAAQ,CAAC,KAAK;CACd,MAAM,CAAC,KAAK;CACZ,SAAS,CAAC,KAAK;CACf,QAAQ,CAAC,MAAM;CACf,YAAY,CAAC,MAAM;CACnB,QAAQ,CAAC,OAAO,MAAM;AACxB,GAEMC,IAAe;CACnB,SAAS;CACT,QAAQ;CACR,MAAM;CACN,SAAS;CACT,QAAQ;CACR,YAAY;CACZ,QAAQ;AACV,GAEM,cAAc,MACjB,OAAO,KAAKF,CAAM,CAAC,CAA6B,MAAM,MAAOA,EAAOG,EAAG,CAAC,KAAK,IAAI,IAAIC,EAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAExGC,IAAc,IAEdC,IAAa,uBACbC,IAAe,kEACfC,IAAc,KACdC,IAA0B,GAE1B,oBACJ,KAAK,OAAO,aAAa,GAAG,OAAO,gBAAgB,IAAI,WAAWJ,CAAW,CAAC,CAAC,CAAC,CAAC,CAC9E,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,GAAG,CAAC,CACpB,QAAQ,OAAO,EAAE,GAEhB,oBAA8B,IAAIK,EAAmB,KAAK,SAAS;AAGzE,SAAS,qBAAqB,GAAkB,GAAoB,IAAoB,IAAe;CACrG,IAAMC,IAASP,EAAQ,QAAQ,IAAI,QAAQ;CAG3C,IAFIO,MAAW,QAAS,CAACC,EAAO,eAAe,IAAID,CAAM,KAAK,EAAEE,KAAqBF,MAAWC,EAAO,iBAEnGR,EAAQ,QAAQ,IAAA,mBAAyB,MAAM,KAAK,MAAMU,EAAU;CACxE,OAAOH;AACT;AAEA,SAAS,YAAY,GAAkB,GAA4C;CACjF,IAAMA,IAASP,EAAQ,QAAQ,IAAI,QAAQ;CAM3C,OAJEO,MAAW,QACV,CAACC,EAAO,eAAe,IAAID,CAAM,MAAO,WAAWP,CAAO,MAAM,YAAYO,MAAWC,EAAO,gBAExF,CAAC,IACH;EAAE,oCAAoC;EAAQ,+BAA+BD;EAAQ,MAAM;CAAS;AAC7G;AAEA,SAAS,UAAU,GAAkB,GAAoB,GAAsC;CAC7F,IAAMI,IAAO,YAAYX,GAASQ,CAAM;CACxC,IAAI,OAAO,KAAKG,CAAI,CAAC,CAAC,WAAW,GAAG,MAAMD,EAAU;CACpD,OAAO,IAAI,SAAS,MAAM;EACxB,SAAS;GACP,GAAGC;GACH,gCAAgC,iBAAiBC,EAAe,IAAIC,EAAiB,IAAIC;GACzF,gCAAgC,CAAC,GAAGC,GAAS,SAAS,CAAC,CAAC,KAAK,IAAI;GACjE,0BAA0B;EAC5B;EACA,QAAQ;CACV,CAAC;AACH;AAEA,IAAM,UAAU,MAAgCP,EAAO,WAAW;AAElE,eAAe,YACb,GACA,GACA,GACA,GAC4C;CAC5C,IAAMQ,IAASC,IAAWC,IAAmCC;CAU7D,OAAO;EAAE;EAAQ,OAAA,MATG,IAAIC,EAAQ;GAAE;GAAgB,GAAIH,IAAW,EAAE,OAAO,CAACI,CAAqB,EAAE,IAAI,CAAC;EAAG,CAAC,CAAC,CACzG,mBAAmB;GAAE,KAAK;GAAS,KAAKb,EAAO,QAAQ;GAAK,KAAK;EAAM,CAAC,CAAC,CACzE,YAAY,CAAC,CACb,OAAO,OAAO,WAAW,CAAC,CAAC,CAC3B,UAAUA,EAAO,MAAM,CAAC,CACxB,YAAYA,EAAO,QAAQ,CAAC,CAC5B,WAAWc,CAAO,CAAC,CACnB,kBAAkB,GAAGN,EAAO,EAAE,CAAC,CAC/B,KAAKR,EAAO,QAAQ,GAAG;CACH;AACzB;AAGA,eAAe,eACb,GACA,GACA,GACqE;CACrE,IAAMe,IAAQC,EAAaxB,CAAO;CAClC,IAAIuB,MAAU,MAAM,MAAME,EAAgB;CAC1C,IAAI;EACF,IAAM,EAAE,eAAY,MAAMC,EAAUH,GAAOf,EAAO,UAAU;GAC1D,YAAY,CAAC,OAAO;GACpB,UAAUA,EAAO;GACjB,gBAAgBH;GAChB,QAAQG,EAAO;GACf,aAAaW;GACb,gBAAgB;IAAC;IAAO;IAAO;IAAO;IAAO;IAAO;GAAgB;EACtE,CAAC,GACKG,IAAUK,EAAQ,OAAO;EAC/B,IAAIL,EAAQ,WAAW,KAAKA,EAAQ,SAASlB,KAAe,CAACwB,EAAiBN,CAAO,GAAG,MAAMG,EAAgB;EAC9G,IAAMI,IAAUF,EAAQ;EAIxB,IAHI,OAAOE,KAAY,YAAY,CAAC,OAAO,cAAcA,CAAO,KAAKA,IAAU,KAC3E,OAAOF,EAAQ,OAAQ,YAAYA,EAAQ,MAAM,KAAK,IAAI,IAAI,MAAOtB,KAGvE,MAAM,QAAQsB,EAAQ,KAAK,KAC3BA,EAAQ,MAAM,SAAA,kBAA8B,MAC3C,OAAOA,EAAQ,OAAQ,YACtBA,EAAQ,MAAMA,EAAQ,MAAA,QACtB,KAAK,IAAI,IAAI,MAAOA,EAAQ,MAAA,OAAyCtB,IAEvE,MAAMoB,EAAgB;EACxB,IAAMK,IAAU,MAAMC,EAAYC,EAAI,SAASV,CAAO;EACtD,IAAIQ,MAAY,QAAQA,EAAQ,oBAAoBD,GAAS,MAAMJ,EAAgB;EACnF,OAAO;GAAE,gBAAgBI;GAAS;GAAS;EAAM;CACnD,SAASI,GAAO;EAEd,MADIA,aAAiBC,EAAO,YAAiBT,EAAgB,IACvDQ;CACR;AACF;AAEA,eAAe,SAAS,GAAoB,GAAoB,GAAY,GAA6B;CACvG,IAAME,IAAO3B,EAAO,SAEd4B,IAAS,sCADCC,IAAc,IAC+B;CAC7D,MAAML,EAAI,WAAW,KAAK;EACxB,MAAMxB,EAAO;EACb,MAAM,mCAAmC8B,EAAWH,CAAI,EAAE,mBAAmBG,EAAWC,CAAI,EAAE,IAAID,EAAWC,CAAI,EAAE,aAAaH,EAAO;EACvI,SAAS,QAAQD,EAAK;EACtB,MAAM,gCAAgCA,EAAK,OAAOI,EAAK,MAAMH;EAC7D;CACF,CAAC;AACH;AAEA,eAAe,aAAa,GAAkB,GAAoB,GAAuC;CACvG,qBAAqBpC,GAASQ,CAAM;CACpC,IAAMgC,IAAO,MAAMC,EAAazC,CAAO;CACvC,IAAI,OAAOwC,KAAS,aAAYA,KAAiB,MAAM,QAAQA,CAAI,GAAG,MAAME,EAAW;CACvF,IAAMC,IAAO,OAAO,KAAKH,CAAI,GACvBI,IAA0B,QAAQ,IAAIJ,GAAM,OAAO;CACzD,IAAIG,EAAK,WAAW,KAAKA,EAAK,OAAO,WAAW,OAAOC,KAAmB,UACxE,MAAMF,EAAW;CAEnB,IAAMG,IAAQD,EAAe,KAAK,CAAC,CAAC,YAAY;CAChD,IAAI,CAACE,EAAkBD,CAAK,GAC1B,MAAMH,EAAW;CAEnB,IAAMK,IAAQ,KAAK,IAAI,GACjBC,IAAiB,MAAMC,EAAkBjB,EAAI,SAASe,CAAK;CACjE,IAAIC,MAAmB,MACrB,MAAM,IAAIE,EAAS,KAAK,gBAAgB,+CAA+C,EACrF,mBAAmBF,EACrB,CAAC;CAEH,IAAMG,IAAO,MAAMC,EAAWpB,EAAI,SAASa,CAAK,GAC1CQ,IAAoB,MAAMC,EAAgBtB,EAAI,SAASmB,EAAK,IAAIJ,CAAK;CAC3E,IAAIM,MAAsB,MACxB,MAAM,IAAIH,EAAS,KAAK,gBAAgB,6CAA6C,EAAE,qBAAkB,CAAC;CAE5G,IAAM3B,IAAQ,YAAY,GACpBgC,IAAY,MAAMC,EAAUjC,CAAK;CACvC,MAAMkC,EAAYzB,EAAI,SAASuB,GAAWJ,EAAK,IAAIJ,CAAK;CACxD,IAAI;EACF,MAAM,SAASf,GAAKxB,GAAQ2C,EAAK,OAAO,GAAG3C,EAAO,aAAa,4BAA4Be,GAAO;CACpG,SAASU,GAAO;EAGd,MADA,MAAMyB,EAAY1B,EAAI,SAASuB,CAAS,CAAC,CAAC,YAAY,KAAA,CAAS,GACzD,IAAIjD,EAAmB,KAAK,SAAS,EAAE,OAAO2B,EAAM,CAAC;CAC7D;CACA,OAAO0B,EAAK,KAAK,EAAE,IAAI,GAAK,GAAGC,CAAO;AACxC;AAEA,eAAe,aAAa,GAAkB,GAAoB,GAAuC;CACvG,IAAI5D,EAAQ,WAAW,OAAO;EAC5B,IAAMuB,IAAQsC,EAAY,IAAI,IAAI7D,EAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK;EAC3E,IAAI,CAACE,EAAW,KAAKqB,CAAK,GAAG,MAAMmB,EAAW,wBAAwB;EACtE,OAAOoB,EAAiB;GAAE,GAAGtD;GAAQ,OAAO,YAAY;GAAG;EAAM,CAAC;CACpE;CAEA,AADA,qBAAqBR,GAASQ,GAAQ,EAAI,GAC1CqD,EAAY,IAAI,IAAI7D,EAAQ,GAAG,GAAG,CAAC,CAAC;CACpC,IAAMwC,IAAO,MAAMC,EAAazC,CAAO;CACvC,IAAI,OAAOwC,KAAS,aAAYA,KAAiB,MAAM,QAAQA,CAAI,KAAK,OAAO,KAAKA,CAAI,CAAC,CAAC,WAAW,GACnG,MAAME,EAAW,wBAAwB;CAE3C,IAAMnB,IAAiB,QAAQ,IAAIiB,GAAM,OAAO;CAEhD,IADI,OAAOjB,KAAU,YACjB,CAACrB,EAAW,KAAKqB,CAAK,GAAG,MAAMmB,EAAW,wBAAwB;CACtE,IAAMS,IAAO,MAAMY,EAAa/B,EAAI,SAAS,MAAMwB,EAAUjC,CAAK,GAAG,KAAK,IAAI,CAAC;CAC/E,IAAI4B,MAAS,MAAM,MAAM,IAAID,EAAS,KAAK,QAAQ,4CAA4C;CAC/F,IAAMc,IAAU,MAAM,YAAYxD,GAAQ2C,EAAK,IAAI3C,EAAO,eAAe,IAAI2C,EAAK,KAAK,GAAGA,EAAK,cAAc;CAC7G,OAAO,IAAI,SAAS,MAAM;EACxB,SAAS;GACP,GAAGS;GACH,cAAcK,EAAmBD,EAAQ,OAAO;IAAE,eAAeA,EAAQ;IAAQ,QAAQ,OAAOxD,CAAM;GAAE,CAAC;EAC3G;EACA,QAAQ;CACV,CAAC;AACH;AAGA,eAAe,aAAa,GAAkB,GAAoB,GAAuC;CACvG,IAAM,EAAE,eAAY,MAAM,eAAeR,GAASQ,GAAQwB,CAAG,GACvDkC,IAAM,MAAMnC,EAAYC,EAAI,SAASV,CAAO;CAClD,IAAI4C,MAAQ,MAAM,MAAMzC,EAAgB;CACxC,OAAOkC,EACL,KACA;EAAE,WAAWO,EAAI;EAAY,OAAOA,EAAI;EAAO,IAAIA,EAAI;EAAI,cAAcA,EAAI;CAAgB,GAC7FN,CACF;AACF;AAGA,eAAe,eAAe,GAAuC;CACnE,IAAMO,IAAO,MAAMC,EAAS,KAAK,CAAC,CAAC,YAAY,EAAE,GAC7CC,IAAkB;CACtB,IAAI;EACF,IAAS,KAAK,MAAMF,CAAI;CAC1B,QAAQ;EACN,IAAS;CACX;CACA,IAAMG,IAAWC,EAA2B,UAAUF,CAAM;CAC5D,IAAI,CAACC,EAAS,WAAWF,EAAS,SAAS,OAAOA,EAAS,SAAS,KAAK,MAAM,YAAY;CAC3F,IAAM,EAAE,SAAM,YAAS,iBAAcE,EAAS,KAAK,OAC7CE,IAAaJ,EAAS,QAAQ,IAAI,aAAa;CACrD,OAAOT,EACLS,EAAS,QACT,EAAE,OAAO;EAAE;EAAM;EAAS;CAAU,EAAE,GACtCI,MAAe,QAAQ,YAAY,KAAKA,CAAU,IAAI;EAAE,GAAGZ;EAAS,eAAeY;CAAW,IAAIZ,CACpG;AACF;AAUA,eAAe,YAAY,GAAkB,GAAoB,GAAuC;CACtG,IAAMrD,IAAS,qBAAqBP,GAASQ,CAAM,GAC7C,EAAE,YAAS,aAAU,MAAM,eAAeR,GAASQ,GAAQwB,CAAG,GAC9DF,IAAU9B,EAAQ,QAAQ,IAAIY,CAAc;CAClD,IAAIkB,MAAY,QAAQ,CAAC2C,EAAW,UAAU3C,CAAO,CAAC,CAAC,SAAS,MAAMY,EAAW;CACjF,IAAIZ,MAAYR,GACd,MAAM,IAAI4B,EAAS,KAAK,mBAAmB,gEAAgE;CAE7G,IAAMwB,IAAU,IAAI,QAAQ;EAC1B,QAAQ,GAAGC,EAAoB,GAAGpD;EAClC;GACCT,IAAwB;CAC3B,CAAC,GACK8D,IAAY5E,EAAQ,QAAQ,IAAIa,CAAgB;CACtD,IAAI+D,MAAc,MAAM;EACtB,IAAI,CAACzE,EAAa,KAAKyE,CAAS,GAAG,MAAMlC,EAAW;EACpD,EAAQ,IAAI7B,GAAkB+D,CAAS;CACzC;CACA,IAAIC;CACJ,IAAI;EACF,IAAW,MAAMC,EACf9C,EAAI,cACJ,IAAI,QAAQ,GAAGxB,EAAO,aAAa,qBAAqB;GAAE;GAAS,QAAQ;GAAU,UAAU;EAAS,CAAC,GACzG,OAAO,MACD4D,EAAS,WAAW,OACtB,MAAMA,EAAS,MAAM,OAAO,GACrBA,KAEF,eAAeA,CAAQ,CAElC;CACF,SAASnC,GAAO;EACd,MAAM,IAAI3B,EAAmB,KAAK,WAAW,EAAE,OAAO2B,EAAM,CAAC;CAC/D;CAGA,OAFI4C,EAAS,WAAW,OACxB,MAAME,EAAc/C,EAAI,SAASV,CAAO,GACjC,IAAI,SAAS,MAAM;EACxB,SAAS;GAAE,GAAGsC;GAAS,cAAcoB,EAAqB,OAAOxE,CAAM,CAAC;EAAE;EAC1E,QAAQ;CACV,CAAC,KALmCqE;AAMtC;AAEA,eAAe,iBAAiB,GAAkB,GAAoB,GAAuC;CAC3G,qBAAqB7E,GAASQ,CAAM;CACpC,IAAM,EAAE,YAAS,sBAAmB,MAAM,eAAeR,GAASQ,GAAQwB,CAAG,GACvEF,IAAU9B,EAAQ,QAAQ,IAAIY,CAAc;CAClD,IAAIkB,MAAY,QAAQ,CAAC2C,EAAW,UAAU3C,CAAO,CAAC,CAAC,SAAS,MAAMY,EAAW;CACjF,IAAIZ,MAAYR,GACd,MAAM,IAAI4B,EAAS,KAAK,mBAAmB,gEAAgE;CAC7G,IAAK,MAAM+B,EAAejD,EAAI,SAASV,GAAS4D,CAAc,MAAO,MAAM,MAAMzD,EAAgB;CACjG,OAAOkC,EAAK,KAAK,EAAE,IAAI,GAAK,GAAG;EAAE,GAAGC;EAAS,cAAcoB,EAAqB,OAAOxE,CAAM,CAAC;CAAE,CAAC;AACnG;AAEA,eAAe,aAAa,GAAuC;CACjE,IAAI2E,IAA0F,MAC1FC,IAAiC;CACrC,IAAI;EACF,MAAMC,EAAWrD,CAAG;CACtB,QAAQ;EACN,IAAS;CACX;CACA,IAAImD,MAAW,MACb,IAAI;EAEF,AADA,IAAkB,MAAMG,EAActD,EAAI,OAAO,GAC7CoD,MAAA,MAAyC,IAAS;CACxD,QAAQ;EACN,IAAS;CACX;CAEF,OAAOzB,EACLwB,MAAW,OAAO,MAAM,KACxBI,EAAwB,MAAM;EAC5B;EACA;EACA,eAAA;EACA,QAAQJ,MAAW,OAAO,OAAO;CACnC,CAAC,GACDvB,CACF;AACF;AACA,eAAe,MAAM,GAAkB,GAAuC;CAC5E,IAAM4B,IAASxF,EAAQ,OAAO,YAAY,GACpCyF,IAAU,WAAWzF,CAAO;CAClC,IAAIyF,MAAY,KAAA,GAAW,MAAM,IAAIvC,EAAS,KAAK,aAAa,gBAAgB;CAChF,IAAIuC,MAAY,YAAYD,MAAW,OAAO,OAAO,aAAaxD,CAAG;CACrE,IAAMxB,IAAS,MAAM6E,EAAWrD,CAAG,GAC7BrB,IAAO,YAAYX,GAASQ,CAAM;CACxC,IAAIgF,MAAW,WAAW,OAAO,UAAUxF,GAASQ,GAAQX,EAAc4F,EAAQ;CAClF,IAAI,CAAC5F,EAAc4F,EAAQ,CAAC,SAASD,CAAM,GACzC,MAAM,IAAItC,EAAS,KAAK,sBAAsB,kCAAkC;CAElF,IAAIkB;CACJ,QAAQqB,GAAR;EACE,KAAK;GACH,IAAW,MAAM,aAAazD,CAAG;GACjC;EACF,KAAK;GAEH,AADA,MAAM,eAAehC,GAASQ,GAAQwB,CAAG,GACzC,IAAW2B,EAAK,KAAK,EAAE,IAAI,GAAK,GAAGC,CAAO;GAC1C;EACF,KAAK;GACH,IAAW,MAAM,iBAAiB5D,GAASgC,GAAKxB,CAAM;GACtD;EACF,KAAK;GACH,IAAWmD,EAAK,KAAK,EAAE,MAAMnD,EAAO,KAAK,GAAGoD,CAAO;GACnD;EACF,KAAK;GACH,IAAW,MAAM,aAAa5D,GAASgC,GAAKxB,CAAM;GAClD;EACF,KAAK;GACH,IAAW,MAAM,aAAaR,GAASgC,GAAKxB,CAAM;GAClD;EACF,KAAK,WACH,IAAWgF,MAAW,QAAQ,MAAM,aAAaxF,GAASgC,GAAKxB,CAAM,IAAI,MAAM,YAAYR,GAASgC,GAAKxB,CAAM;CAEnH;CACA,OAAO,SAAS4D,GAAUzD,CAAI;AAChC;AAEA,SAAS,SAAS,GAAoB,GAAwC;CAC5E,IAAI,OAAO,KAAKA,CAAI,CAAC,CAAC,WAAW,GAAG,OAAOyD;CAC3C,IAAMsB,IAAO,IAAI,SAAStB,EAAS,MAAMA,CAAQ;CACjD,KAAK,IAAM,CAACuB,GAAKC,MAAU,OAAO,QAAQjF,CAAI,GAAG,EAAK,QAAQ,IAAIgF,GAAKC,CAAK;CAC5E,OAAOF;AACT;AAEA,IAAM,cAAc,MAClBzD,aAAiB3B,IAAqB2B,EAAM,iBAAiB,EAAE,MAAM,WAAW;AAQlF,SAAgB,mBAAkE;CAChF,IAAM4D,oBAAU,IAAI,IAAgC,GAC9C,QAAQ,MAA2B;EACvC,KAAK,IAAMC,KAAWD,GACpB,IAAI;GACF,EAAQE,CAAK;EACf,QAAQ,CAER;CAEJ;CACA,OAAO;EACL,MAAM,MAAM,GAAkB,GAA2B;GACvD,IAAMC,IAAY,OAAO,WAAW,GAC9BC,IAAU,KAAK,IAAI,GACrB7B,GACA8B;GACJ,IAAI;IACF,IAAW,MAAM,MAAMlG,GAASgC,CAAG;GACrC,SAASC,GAAO;IAEd,AADA,IAAUA,GACV,IAAWkE,EAAgBlE,GAAO+D,CAAS;IAE3C,IAAMxF,IAAS,MAAM6E,EAAWrD,CAAG,CAAC,CAAC,YAAY,IAAI;IACrD,AAAIxB,MAAW,SAEX,WAAWR,CAAO,MAAM,YACxBA,EAAQ,WAAW,SACnBiC,aAAiBiB,KACjBjB,EAAM,WAAW,QAEjB,IAAW6B,EAAiB;KAAE,GAAGtD;KAAQ,OAAO,YAAY;KAAG,OAAO;IAAK,CAAC,IAC9E,IAAW,SAAS4D,GAAU,YAAYpE,GAASQ,CAAM,CAAC;GAE9D;GAYA,IAXI,WAAWR,CAAO,MAAM,aAC1BoE,EAAS,QAAQ,IAAI,iBAAiB,UAAU,GAChDA,EAAS,QAAQ,IAAI,mBAAmB,aAAa,GACrDA,EAAS,QAAQ,IAAI,0BAA0B,SAAS,GACnDA,EAAS,QAAQ,IAAI,yBAAyB,KACjDA,EAAS,QAAQ,IACf,2BACA,6DACF,IAGAyB,EAAQ,OAAO,GAAG;IACpB,IAAMJ,IAAU,WAAWzF,CAAO,GAC5BoG,IACJhC,EAAS,SAAS,MACd,OACAqB,MAAY,WACV,gBACAS,aAAmBhD,IACjBgD,EAAQ,OACR,YAEJG,IACJH,MAAY,KAAA,KAAa9B,EAAS,UAAU,MACxCG,EAA2B,UACzB,MAAMH,EACH,MAAM,CAAC,CACP,KAAK,CAAC,CACN,YAAY,IAAI,CACrB,IACA,MACAkC,IACJb,MAAY,YAAYrB,EAAS,WAAW,MACxCmB,EAAwB,UACtB,MAAMnB,EACH,MAAM,CAAC,CACP,KAAK,CAAC,CACN,YAAY,IAAI,CACrB,IACA;IACN,KAAK;KACH,MAAMiC,GAAe,UAAUA,EAAc,KAAK,MAAM,OAAOD;KAC/D,IAAI,KAAK,IAAI,GAAG,KAAK,IAAI,IAAIH,CAAO;KACpC;KACA,OAAOR,MAAY,KAAA,IAAY,cAAc3F,EAAa2F;KAC1D,QAAQrB,EAAS;KACjB,MAAM;KACN,GAAIA,EAAS,UAAU,MACnB,EACE,YAAYkC,GAAQ,UAChB,EACE,MACEA,EAAO,KAAK,WAAW,8BACnB,kBACAA,EAAO,KAAK,WAAW,oBACrB,WACA,WACV,IACAJ,MAAY,KAAA,IACV,EAAE,MAAM,UAAmB,IAC3B,WAAWA,CAAO,EAC1B,IACA,CAAC;IACP,CAAC;GACH;GACA,OAAO9B;EACT;EAEA,MAAM,UAAU,GAAsB,GAAuB;GAC3D,IAAI;IACF,MAAMiB,EAAWrD,CAAG;IACpB,IAAMuE,IAAU,MAAMC,EAAMxE,EAAI,SAAS,KAAK,IAAI,CAAC;IACnD,AAAI6D,EAAQ,OAAO,KAAG,KAAK;KAAE;KAAS,QAAQ;KAAM,MAAM;IAAY,CAAC;GACzE,SAAS5D,GAAO;IAEd,MADI4D,EAAQ,OAAO,KAAG,KAAK;KAAE,YAAY,WAAW5D,CAAK;KAAG,QAAQ;KAAU,MAAM;IAAY,CAAC,GAC3FA;GACR;EACF;EACA,IAAI,GAAS,GAAS;GACpB,IAAIwE,GAAS,QAAQ,SAAS,aAAa,KAAA;GAC3C,IAAM,YAAY,MAA2BX,EAAQC,CAAK,GACpD,oBAA0B;IAE9B,AADAF,EAAQ,OAAO,QAAQ,GACvBY,GAAS,QAAQ,oBAAoB,SAAS,WAAW;GAC3D;GAGA,OAFAZ,EAAQ,IAAI,QAAQ,GACpBY,GAAS,QAAQ,iBAAiB,SAAS,aAAa,EAAE,MAAM,GAAK,CAAC,GAC/D;EACT;CACF;AACF"}
+{"version":3,"file":"worker.js","names":["ROUTES","ROUTE_METHODS","ROUTE_LABELS","id","request","TOKEN_BYTES","LINK_TOKEN","SUBJECT_MAX","CLOCK_TOLERANCE_SECONDS","AuthOperationError","origin","config","allowPublicOrigin","forbidden","cors","ACCOUNT_HEADER","PUBLISHER_HEADER","REQUEST_MARKER_HEADER","methods","maxAge","operator","OPERATOR_SESSION_MAX_AGE_SECONDS","SESSION_MAX_AGE_SECONDS","SignJWT","ARCHIVE_OPERATOR_ROLE","subject","token","sessionToken","unauthenticated","jwtVerify","payload","isWellFormedText","version","account","readAccount","env","error","errors","name","notice","LINK_TTL_MS","escapeHtml","link","body","readJsonBody","badRequest","keys","requestedEmail","email","isWellFormedEmail","nowMs","admissionRetry","spendSignInBudget","ApiError","user","ensureUser","retryAfterSeconds","spendLinkBudget","tokenHash","sha256Hex","insertToken","deleteToken","json","noStore","queryParams","confirmationPage","consumeToken","session","sessionCookieValue","row","text","response","parsed","envelope","archiveErrorResponseSchema","retryAfter","uuidSchema","headers","SESSION_COOKIE_NAME","publisher","UUID_RE","archived","serviceRequest","deleteAccount","expiredSessionCookie","revokeSessions","sessionVersion","reason","dbSchemaVersion","authConfig","authReadiness","archiveAuthHealthSchema","method","routeId","next","key","value","tappers","handler","event","requestId","started","failure","toErrorResponse","code","forwardedCode","health","removed","sweep","options"],"sources":["../../src/auth/worker.ts"],"sourcesContent":["import { errors, jwtVerify, SignJWT } from 'jose';\nimport { sha256Hex } from '../_crypto';\nimport type { ArchiveExecutionContext } from '../_server/execution';\nimport {\n  ApiError,\n  badRequest,\n  expiredSessionCookie,\n  forbidden,\n  json,\n  noStore,\n  queryParams,\n  readJsonBody,\n  sessionToken,\n  toErrorResponse,\n  unauthenticated,\n} from '../_server/http';\nimport { serviceRequest } from '../_server/service';\nimport { UUID_RE } from '../_server/uuid';\nimport {\n  ACCOUNT_HEADER,\n  ARCHIVE_OPERATOR_ROLE,\n  type ArchiveErrorCode,\n  AUTH_SCHEMA_VERSION,\n  archiveAuthHealthSchema,\n  archiveErrorResponseSchema,\n  isWellFormedText,\n  OPERATOR_SESSION_MAX_AGE_SECONDS,\n  PUBLISHER_HEADER,\n  REQUEST_MARKER_HEADER,\n  SESSION_COOKIE_NAME,\n  SESSION_MAX_AGE_SECONDS,\n  sessionCookieValue,\n  uuidSchema,\n} from '../contract';\nimport { confirmationPage, escapeHtml } from './_confirmation';\nimport { type AuthConfig, type AuthWorkerEnv, authConfig, isWellFormedEmail } from './config';\nimport { type AuthDiagnostic, AuthOperationError } from './errors';\nimport {\n  authReadiness,\n  consumeToken,\n  deleteAccount,\n  deleteToken,\n  ensureUser,\n  insertToken,\n  LINK_TTL_MS,\n  readAccount,\n  revokeSessions,\n  spendLinkBudget,\n  spendSignInBudget,\n  sweep,\n} from './store';\n\n/**\n * The reference identity issuer: passwordless email accounts. A POST with an email\n * address ensures the account row and sends a single-use magic link; consuming it\n * signs the browser in by setting the `archive_session` cookie a catalog Worker\n * verifies — an RS256 JWT minted by the active private key, verifiable through\n * `/jwks.json` alongside any configured retired public keys. `OPERATOR_EMAILS` is\n * the one operator-membership truth; operator sessions expire after one hour,\n * bounding authority from previously minted role claims. The account routes export the issuer's\n * own record and erase it together with the catalog profile.\n */\nexport interface AuthWorkerHandler<E extends AuthWorkerEnv = AuthWorkerEnv> {\n  fetch(request: Request, env: E, ctx?: ArchiveExecutionContext): Promise<Response>;\n  /** The cron sweep: expired links, closed send windows and never-verified accounts. */\n  scheduled(controller: unknown, env: E, ctx?: ArchiveExecutionContext): Promise<void>;\n  tap(handler: (event: AuthEvent) => void, options?: { readonly signal?: AbortSignal }): () => void;\n}\n\nexport type AuthEvent =\n  | {\n      readonly type: 'request';\n      readonly requestId: string;\n      readonly route:\n        | '/auth/account'\n        | '/auth/jwks.json'\n        | '/auth/sign-in'\n        | '/auth/verify'\n        | '/auth/session'\n        | '/auth/sign-out-all'\n        | '/auth/health'\n        | 'unmatched';\n      readonly status: number;\n      readonly code: ArchiveErrorCode | 'ok';\n      readonly ms: number;\n      readonly diagnostic?: AuthDiagnostic;\n    }\n  | { readonly type: 'scheduled'; readonly status: 'ok'; readonly removed: number }\n  | { readonly type: 'scheduled'; readonly status: 'failed'; readonly diagnostic: AuthDiagnostic };\n\nconst ROUTES = {\n  account: /^\\/api\\/v1\\/auth\\/account$/,\n  health: /^\\/api\\/v1\\/auth\\/health$/,\n  jwks: /^\\/api\\/v1\\/auth\\/jwks\\.json$/,\n  session: /^\\/api\\/v1\\/auth\\/session$/,\n  signIn: /^\\/api\\/v1\\/auth\\/sign-in$/,\n  signOutAll: /^\\/api\\/v1\\/auth\\/sign-out-all$/,\n  verify: /^\\/api\\/v1\\/auth\\/verify$/,\n} as const;\n\nconst ROUTE_METHODS: Record<keyof typeof ROUTES, readonly string[]> = {\n  account: ['GET', 'DELETE'],\n  health: ['GET'],\n  jwks: ['GET'],\n  session: ['GET'],\n  signIn: ['POST'],\n  signOutAll: ['POST'],\n  verify: ['GET', 'POST'],\n};\n\nconst ROUTE_LABELS = {\n  account: '/auth/account',\n  health: '/auth/health',\n  jwks: '/auth/jwks.json',\n  session: '/auth/session',\n  signIn: '/auth/sign-in',\n  signOutAll: '/auth/sign-out-all',\n  verify: '/auth/verify',\n} as const;\n\nconst matchRoute = (request: Request): keyof typeof ROUTES | undefined =>\n  (Object.keys(ROUTES) as (keyof typeof ROUTES)[]).find((id) => ROUTES[id].test(new URL(request.url).pathname));\n\nconst TOKEN_BYTES = 32;\n// Base64url of TOKEN_BYTES random bytes, unpadded.\nconst LINK_TOKEN = /^[A-Za-z0-9_-]{43}$/;\nconst SUBJECT_MAX = 256;\nconst CLOCK_TOLERANCE_SECONDS = 5;\n\nconst randomToken = (): string =>\n  btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(TOKEN_BYTES))))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replace(/=+$/, '');\n\nconst unavailable = (): ApiError => new AuthOperationError(503, 'catalog');\n\n/** Exact allowed Origin plus the request marker, like the catalog's mutation guard. */\nfunction requireMutationGuard(request: Request, config: AuthConfig, allowPublicOrigin = false): string {\n  const origin = request.headers.get('origin');\n  if (origin === null || (!config.allowedOrigins.has(origin) && !(allowPublicOrigin && origin === config.publicOrigin)))\n    throw forbidden();\n  if (request.headers.get(REQUEST_MARKER_HEADER) !== '1') throw forbidden();\n  return origin;\n}\n\nfunction corsHeaders(request: Request, config: AuthConfig): Record<string, string> {\n  const origin = request.headers.get('origin');\n  if (\n    origin === null ||\n    (!config.allowedOrigins.has(origin) && !(matchRoute(request) === 'verify' && origin === config.publicOrigin))\n  )\n    return {};\n  return { 'access-control-allow-credentials': 'true', 'access-control-allow-origin': origin, vary: 'Origin' };\n}\n\nfunction preflight(request: Request, config: AuthConfig, methods: readonly string[]): Response {\n  const cors = corsHeaders(request, config);\n  if (Object.keys(cors).length === 0) throw forbidden();\n  return new Response(null, {\n    headers: {\n      ...cors,\n      'access-control-allow-headers': `Content-Type, ${ACCOUNT_HEADER}, ${PUBLISHER_HEADER}, ${REQUEST_MARKER_HEADER}`,\n      'access-control-allow-methods': [...methods, 'OPTIONS'].join(', '),\n      'access-control-max-age': '600',\n    },\n    status: 204,\n  });\n}\n\nconst secure = (config: AuthConfig): boolean => config.appEnv === 'production';\n\nasync function mintSession(\n  config: AuthConfig,\n  subject: string,\n  operator: boolean,\n  sessionVersion: number,\n): Promise<{ maxAge: number; token: string }> {\n  const maxAge = operator ? OPERATOR_SESSION_MAX_AGE_SECONDS : SESSION_MAX_AGE_SECONDS;\n  const token = await new SignJWT({ sessionVersion, ...(operator ? { roles: [ARCHIVE_OPERATOR_ROLE] } : {}) })\n    .setProtectedHeader({ alg: 'RS256', kid: config.signing.kid, typ: 'JWT' })\n    .setIssuedAt()\n    .setJti(crypto.randomUUID())\n    .setIssuer(config.issuer)\n    .setAudience(config.audience)\n    .setSubject(subject)\n    .setExpirationTime(`${maxAge}s`)\n    .sign(config.signing.key);\n  return { maxAge, token };\n}\n\n/** Verifies the request's own session cookie against every published key; returns the token and subject. */\nasync function requireSession(\n  request: Request,\n  config: AuthConfig,\n  env: AuthWorkerEnv,\n): Promise<{ subject: string; token: string; sessionVersion: number }> {\n  const token = sessionToken(request);\n  if (token === null) throw unauthenticated();\n  try {\n    const { payload } = await jwtVerify(token, config.verifier, {\n      algorithms: ['RS256'],\n      audience: config.audience,\n      clockTolerance: CLOCK_TOLERANCE_SECONDS,\n      issuer: config.issuer,\n      maxTokenAge: SESSION_MAX_AGE_SECONDS,\n      requiredClaims: ['sub', 'iss', 'aud', 'iat', 'exp', 'sessionVersion'],\n    });\n    const subject = payload.sub ?? '';\n    if (subject.length === 0 || subject.length > SUBJECT_MAX || !isWellFormedText(subject)) throw unauthenticated();\n    const version = payload.sessionVersion;\n    if (typeof version !== 'number' || !Number.isSafeInteger(version) || version < 0) throw unauthenticated();\n    if (typeof payload.iat !== 'number' || payload.iat > Date.now() / 1000 + CLOCK_TOLERANCE_SECONDS)\n      throw unauthenticated();\n    if (\n      Array.isArray(payload.roles) &&\n      payload.roles.includes(ARCHIVE_OPERATOR_ROLE) &&\n      (typeof payload.exp !== 'number' ||\n        payload.exp - payload.iat > OPERATOR_SESSION_MAX_AGE_SECONDS ||\n        Date.now() / 1000 - payload.iat > OPERATOR_SESSION_MAX_AGE_SECONDS + CLOCK_TOLERANCE_SECONDS)\n    )\n      throw unauthenticated();\n    const account = await readAccount(env.AUTH_DB, subject);\n    if (account === null || account.session_version !== version) throw unauthenticated();\n    return { sessionVersion: version, subject, token };\n  } catch (error) {\n    if (error instanceof errors.JOSEError) throw unauthenticated();\n    throw error;\n  }\n}\n\nasync function sendLink(env: AuthWorkerEnv, config: AuthConfig, to: string, link: string): Promise<void> {\n  const name = config.appName;\n  const minutes = LINK_TTL_MS / 60_000;\n  const notice = `The link works once and expires in ${minutes} minutes. If you did not request it, ignore this email.`;\n  await env.AUTH_EMAIL.send({\n    from: config.senderAddress,\n    html: `<p>Open this link to sign in to ${escapeHtml(name)}:</p><p><a href=\"${escapeHtml(link)}\">${escapeHtml(link)}</a></p><p>${notice}</p>`,\n    subject: `Your ${name} sign-in link`,\n    text: `Open this link to sign in to ${name}:\\n\\n${link}\\n\\n${notice}`,\n    to,\n  });\n}\n\nasync function handleSignIn(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  requireMutationGuard(request, config);\n  const body = await readJsonBody(request);\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) throw badRequest();\n  const keys = Object.keys(body);\n  const requestedEmail: unknown = Reflect.get(body, 'email');\n  if (keys.length !== 1 || keys[0] !== 'email' || typeof requestedEmail !== 'string') {\n    throw badRequest();\n  }\n  const email = requestedEmail.trim().toLowerCase();\n  if (!isWellFormedEmail(email)) {\n    throw badRequest();\n  }\n  const nowMs = Date.now();\n  const admissionRetry = await spendSignInBudget(env.AUTH_DB, nowMs);\n  if (admissionRetry !== null) {\n    throw new ApiError(429, 'rate-limited', 'Too many sign-in requests. Try again later.', {\n      retryAfterSeconds: admissionRetry,\n    });\n  }\n  const user = await ensureUser(env.AUTH_DB, email);\n  const retryAfterSeconds = await spendLinkBudget(env.AUTH_DB, user.id, nowMs);\n  if (retryAfterSeconds !== null) {\n    throw new ApiError(429, 'rate-limited', 'Too many sign-in emails. Try again later.', { retryAfterSeconds });\n  }\n  const token = randomToken();\n  const tokenHash = await sha256Hex(token);\n  await insertToken(env.AUTH_DB, tokenHash, user.id, nowMs);\n  try {\n    await sendLink(env, config, user.email, `${config.publicOrigin}/api/v1/auth/verify?token=${token}`);\n  } catch (error) {\n    // An unsent link is useless; the spent allowance is deliberately not refunded.\n    await deleteToken(env.AUTH_DB, tokenHash).catch(() => undefined);\n    throw new AuthOperationError(503, 'email', { cause: error });\n  }\n  return json(202, { ok: true }, noStore);\n}\n\nasync function handleVerify(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  if (request.method === 'GET') {\n    const token = queryParams(new URL(request.url), ['token']).get('token') ?? '';\n    if (!LINK_TOKEN.test(token)) throw badRequest('The link is not valid.');\n    return confirmationPage({ ...config, nonce: randomToken(), token });\n  }\n  requireMutationGuard(request, config, true);\n  queryParams(new URL(request.url), []);\n  const body = await readJsonBody(request);\n  if (typeof body !== 'object' || body === null || Array.isArray(body) || Object.keys(body).length !== 1) {\n    throw badRequest('The link is not valid.');\n  }\n  const token: unknown = Reflect.get(body, 'token');\n  if (typeof token !== 'string') throw badRequest('The link is not valid.');\n  if (!LINK_TOKEN.test(token)) throw badRequest('The link is not valid.');\n  const user = await consumeToken(env.AUTH_DB, await sha256Hex(token), Date.now());\n  if (user === null) throw new ApiError(410, 'gone', 'That link has expired or was already used.');\n  const session = await mintSession(config, user.id, config.operatorEmails.has(user.email), user.sessionVersion);\n  return new Response(null, {\n    headers: {\n      ...noStore,\n      'set-cookie': sessionCookieValue(session.token, { maxAgeSeconds: session.maxAge, secure: secure(config) }),\n    },\n    status: 204,\n  });\n}\n\n/** The issuer's half of a complete export: the account record only, never tokens or budget state. */\nasync function handleExport(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  const { subject } = await requireSession(request, config, env);\n  const row = await readAccount(env.AUTH_DB, subject);\n  if (row === null) throw unauthenticated();\n  return json(\n    200,\n    { createdAt: row.created_at, email: row.email, id: row.id, lastSignInAt: row.last_sign_in_at },\n    noStore,\n  );\n}\n\n/** Re-serializes a failed catalog response into the public envelope; anything unrecognizable is 503. */\nasync function archiveFailure(response: Response): Promise<Response> {\n  const text = await response.text().catch(() => '');\n  let parsed: unknown = null;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    parsed = null;\n  }\n  const envelope = archiveErrorResponseSchema.safeParse(parsed);\n  if (!envelope.success || response.status < 400 || response.status > 599) throw unavailable();\n  const { code, message, requestId } = envelope.data.error;\n  const retryAfter = response.headers.get('retry-after');\n  return json(\n    response.status,\n    { error: { code, message, requestId } },\n    retryAfter !== null && /^\\d{1,6}$/.test(retryAfter) ? { ...noStore, 'retry-after': retryAfter } : noStore,\n  );\n}\n\n/**\n * Full erasure: catalog session revocation and profile erasure first (through the AUTH_ARCHIVE service binding,\n * presenting the caller's own session), then the issuer's account row, and only then\n * the cookie is expired. Any failure keeps the browser session so the same request\n * can be retried; both halves are idempotent, so a retry after a partial success\n * re-runs the catalog no-op and finishes the issuer side. The account precondition\n * pins every attempt to the confirmed issuer subject, even without a publisher.\n */\nasync function handleErase(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  const origin = requireMutationGuard(request, config);\n  const { subject, token } = await requireSession(request, config, env);\n  const account = request.headers.get(ACCOUNT_HEADER);\n  if (account === null || !uuidSchema.safeParse(account).success) throw badRequest();\n  if (account !== subject) {\n    throw new ApiError(409, 'account-changed', 'The signed-in account changed since this request was prepared.');\n  }\n  const headers = new Headers({\n    cookie: `${SESSION_COOKIE_NAME}=${token}`,\n    origin,\n    [REQUEST_MARKER_HEADER]: '1',\n  });\n  const publisher = request.headers.get(PUBLISHER_HEADER);\n  if (publisher !== null) {\n    if (!UUID_RE.test(publisher)) throw badRequest();\n    headers.set(PUBLISHER_HEADER, publisher);\n  }\n  let archived: Response;\n  try {\n    archived = await serviceRequest(\n      env.AUTH_ARCHIVE,\n      new Request(`${config.publicOrigin}/api/v1/me/account`, { headers, method: 'DELETE', redirect: 'manual' }),\n      async (response) => {\n        if (response.status === 204) {\n          await response.body?.cancel();\n          return response;\n        }\n        return archiveFailure(response);\n      },\n    );\n  } catch (error) {\n    throw new AuthOperationError(503, 'catalog', { cause: error });\n  }\n  if (archived.status !== 204) return archived;\n  await deleteAccount(env.AUTH_DB, subject);\n  return new Response(null, {\n    headers: { ...noStore, 'set-cookie': expiredSessionCookie(secure(config)) },\n    status: 204,\n  });\n}\n\nasync function handleSignOutAll(request: Request, env: AuthWorkerEnv, config: AuthConfig): Promise<Response> {\n  requireMutationGuard(request, config);\n  const { subject, sessionVersion } = await requireSession(request, config, env);\n  const account = request.headers.get(ACCOUNT_HEADER);\n  if (account === null || !uuidSchema.safeParse(account).success) throw badRequest();\n  if (account !== subject)\n    throw new ApiError(409, 'account-changed', 'The signed-in account changed since this request was prepared.');\n  if ((await revokeSessions(env.AUTH_DB, subject, sessionVersion)) === null) throw unauthenticated();\n  return json(200, { ok: true }, { ...noStore, 'set-cookie': expiredSessionCookie(secure(config)) });\n}\n\nasync function handleHealth(env: AuthWorkerEnv): Promise<Response> {\n  let reason: 'configuration-unavailable' | 'database-unavailable' | 'schema-mismatch' | null = null;\n  let dbSchemaVersion: number | null = null;\n  try {\n    await authConfig(env);\n  } catch {\n    reason = 'configuration-unavailable';\n  }\n  if (reason === null) {\n    try {\n      dbSchemaVersion = await authReadiness(env.AUTH_DB);\n      if (dbSchemaVersion !== AUTH_SCHEMA_VERSION) reason = 'schema-mismatch';\n    } catch {\n      reason = 'database-unavailable';\n    }\n  }\n  return json(\n    reason === null ? 200 : 503,\n    archiveAuthHealthSchema.parse({\n      dbSchemaVersion,\n      reason,\n      schemaVersion: AUTH_SCHEMA_VERSION,\n      status: reason === null ? 'ok' : 'degraded',\n    }),\n    noStore,\n  );\n}\nasync function route(request: Request, env: AuthWorkerEnv): Promise<Response> {\n  const method = request.method.toUpperCase();\n  const routeId = matchRoute(request);\n  if (routeId === undefined) throw new ApiError(404, 'not-found', 'No such route.');\n  if (routeId === 'health' && method === 'GET') return handleHealth(env);\n  const config = await authConfig(env);\n  const cors = corsHeaders(request, config);\n  if (method === 'OPTIONS') return preflight(request, config, ROUTE_METHODS[routeId]);\n  if (!ROUTE_METHODS[routeId].includes(method)) {\n    throw new ApiError(405, 'method-not-allowed', 'That method is not allowed here.');\n  }\n  let response: Response;\n  switch (routeId) {\n    case 'health':\n      response = await handleHealth(env);\n      break;\n    case 'session':\n      await requireSession(request, config, env);\n      response = json(200, { ok: true }, noStore);\n      break;\n    case 'signOutAll':\n      response = await handleSignOutAll(request, env, config);\n      break;\n    case 'jwks':\n      response = json(200, { keys: config.jwks }, noStore);\n      break;\n    case 'signIn':\n      response = await handleSignIn(request, env, config);\n      break;\n    case 'verify':\n      response = await handleVerify(request, env, config);\n      break;\n    case 'account':\n      response = method === 'GET' ? await handleExport(request, env, config) : await handleErase(request, env, config);\n      break;\n  }\n  return withCors(response, cors);\n}\n\nfunction withCors(response: Response, cors: Record<string, string>): Response {\n  if (Object.keys(cors).length === 0) return response;\n  const next = new Response(response.body, response);\n  for (const [key, value] of Object.entries(cors)) next.headers.set(key, value);\n  return next;\n}\n\nconst diagnostic = (error: unknown): AuthDiagnostic =>\n  error instanceof AuthOperationError ? error.authDiagnostic : { kind: 'internal' };\n\n/**\n * Builds the reference identity issuer. Route behavior is fixed; every deployment\n * difference is validated configuration — the app name, trusted origins, audience and\n * issuer claims, signing keys, operator roster, the catalog service binding, and\n * where links and redirects land.\n */\nexport function createAuthWorker<E extends AuthWorkerEnv>(): AuthWorkerHandler<E> {\n  const tappers = new Set<(event: AuthEvent) => void>();\n  const emit = (event: AuthEvent): void => {\n    for (const handler of tappers) {\n      try {\n        handler(event);\n      } catch {\n        // Observers never change request or scheduled outcomes.\n      }\n    }\n  };\n  return {\n    async fetch(request: Request, env: E): Promise<Response> {\n      const requestId = crypto.randomUUID();\n      const started = Date.now();\n      let response: Response;\n      let failure: unknown;\n      try {\n        response = await route(request, env);\n      } catch (error) {\n        failure = error;\n        response = toErrorResponse(error, requestId);\n        // Failures stay readable by allowed origins; config faults have no trusted origin set.\n        const config = await authConfig(env).catch(() => null);\n        if (config !== null) {\n          if (\n            matchRoute(request) === 'verify' &&\n            request.method === 'GET' &&\n            error instanceof ApiError &&\n            error.status === 400\n          )\n            response = confirmationPage({ ...config, nonce: randomToken(), token: null });\n          response = withCors(response, corsHeaders(request, config));\n        }\n      }\n      if (matchRoute(request) === 'verify') {\n        response.headers.set('cache-control', 'no-store');\n        response.headers.set('referrer-policy', 'no-referrer');\n        response.headers.set('x-content-type-options', 'nosniff');\n        if (!response.headers.has('content-security-policy')) {\n          response.headers.set(\n            'content-security-policy',\n            \"default-src 'none'; base-uri 'none'; frame-ancestors 'none'\",\n          );\n        }\n      }\n      if (tappers.size > 0) {\n        const routeId = matchRoute(request);\n        const code =\n          response.status < 400\n            ? 'ok'\n            : routeId === 'health'\n              ? 'unavailable'\n              : failure instanceof ApiError\n                ? failure.code\n                : 'internal';\n        // Account erasure may forward a catalog error response rather than throw.\n        const forwardedCode =\n          failure === undefined && response.status >= 400\n            ? archiveErrorResponseSchema.safeParse(\n                await response\n                  .clone()\n                  .json()\n                  .catch(() => null),\n              )\n            : null;\n        const health =\n          routeId === 'health' && response.status === 503\n            ? archiveAuthHealthSchema.safeParse(\n                await response\n                  .clone()\n                  .json()\n                  .catch(() => null),\n              )\n            : null;\n        emit({\n          code: forwardedCode?.success ? forwardedCode.data.error.code : code,\n          ms: Math.max(0, Date.now() - started),\n          requestId,\n          route: routeId === undefined ? 'unmatched' : ROUTE_LABELS[routeId],\n          status: response.status,\n          type: 'request',\n          ...(response.status >= 500\n            ? {\n                diagnostic: health?.success\n                  ? {\n                      kind:\n                        health.data.reason === 'configuration-unavailable'\n                          ? 'configuration'\n                          : health.data.reason === 'schema-mismatch'\n                            ? 'schema'\n                            : 'database',\n                    }\n                  : failure === undefined\n                    ? { kind: 'catalog' as const }\n                    : diagnostic(failure),\n              }\n            : {}),\n        });\n      }\n      return response;\n    },\n\n    async scheduled(_controller: unknown, env: E): Promise<void> {\n      try {\n        await authConfig(env);\n        const removed = await sweep(env.AUTH_DB, Date.now());\n        if (tappers.size > 0) emit({ removed, status: 'ok', type: 'scheduled' });\n      } catch (error) {\n        if (tappers.size > 0) emit({ diagnostic: diagnostic(error), status: 'failed', type: 'scheduled' });\n        throw error;\n      }\n    },\n    tap(handler, options) {\n      if (options?.signal?.aborted) return () => undefined;\n      const observer = (event: AuthEvent): void => handler(event);\n      const unsubscribe = (): void => {\n        tappers.delete(observer);\n        options?.signal?.removeEventListener('abort', unsubscribe);\n      };\n      tappers.add(observer);\n      options?.signal?.addEventListener('abort', unsubscribe, { once: true });\n      return unsubscribe;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;AA0FA,IAAMA,IAAS;CACb,SAAS;CACT,QAAQ;CACR,MAAM;CACN,SAAS;CACT,QAAQ;CACR,YAAY;CACZ,QAAQ;AACV,GAEMC,IAAgE;CACpE,SAAS,CAAC,OAAO,QAAQ;CACzB,QAAQ,CAAC,KAAK;CACd,MAAM,CAAC,KAAK;CACZ,SAAS,CAAC,KAAK;CACf,QAAQ,CAAC,MAAM;CACf,YAAY,CAAC,MAAM;CACnB,QAAQ,CAAC,OAAO,MAAM;AACxB,GAEMC,IAAe;CACnB,SAAS;CACT,QAAQ;CACR,MAAM;CACN,SAAS;CACT,QAAQ;CACR,YAAY;CACZ,QAAQ;AACV,GAEM,cAAc,MACjB,OAAO,KAAKF,CAAM,CAAC,CAA6B,MAAM,MAAOA,EAAOG,EAAG,CAAC,KAAK,IAAI,IAAIC,EAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,GAExGC,IAAc,IAEdC,IAAa,uBACbC,IAAc,KACdC,IAA0B,GAE1B,oBACJ,KAAK,OAAO,aAAa,GAAG,OAAO,gBAAgB,IAAI,WAAWH,CAAW,CAAC,CAAC,CAAC,CAAC,CAC9E,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,GAAG,CAAC,CACpB,QAAQ,OAAO,EAAE,GAEhB,oBAA8B,IAAII,EAAmB,KAAK,SAAS;AAGzE,SAAS,qBAAqB,GAAkB,GAAoB,IAAoB,IAAe;CACrG,IAAMC,IAASN,EAAQ,QAAQ,IAAI,QAAQ;CAG3C,IAFIM,MAAW,QAAS,CAACC,EAAO,eAAe,IAAID,CAAM,KAAK,EAAEE,KAAqBF,MAAWC,EAAO,iBAEnGP,EAAQ,QAAQ,IAAA,mBAAyB,MAAM,KAAK,MAAMS,EAAU;CACxE,OAAOH;AACT;AAEA,SAAS,YAAY,GAAkB,GAA4C;CACjF,IAAMA,IAASN,EAAQ,QAAQ,IAAI,QAAQ;CAM3C,OAJEM,MAAW,QACV,CAACC,EAAO,eAAe,IAAID,CAAM,MAAO,WAAWN,CAAO,MAAM,YAAYM,MAAWC,EAAO,gBAExF,CAAC,IACH;EAAE,oCAAoC;EAAQ,+BAA+BD;EAAQ,MAAM;CAAS;AAC7G;AAEA,SAAS,UAAU,GAAkB,GAAoB,GAAsC;CAC7F,IAAMI,IAAO,YAAYV,GAASO,CAAM;CACxC,IAAI,OAAO,KAAKG,CAAI,CAAC,CAAC,WAAW,GAAG,MAAMD,EAAU;CACpD,OAAO,IAAI,SAAS,MAAM;EACxB,SAAS;GACP,GAAGC;GACH,gCAAgC,iBAAiBC,EAAe,IAAIC,EAAiB,IAAIC;GACzF,gCAAgC,CAAC,GAAGC,GAAS,SAAS,CAAC,CAAC,KAAK,IAAI;GACjE,0BAA0B;EAC5B;EACA,QAAQ;CACV,CAAC;AACH;AAEA,IAAM,UAAU,MAAgCP,EAAO,WAAW;AAElE,eAAe,YACb,GACA,GACA,GACA,GAC4C;CAC5C,IAAMQ,IAASC,IAAWC,IAAmCC;CAU7D,OAAO;EAAE;EAAQ,OAAA,MATG,IAAIC,EAAQ;GAAE;GAAgB,GAAIH,IAAW,EAAE,OAAO,CAACI,CAAqB,EAAE,IAAI,CAAC;EAAG,CAAC,CAAC,CACzG,mBAAmB;GAAE,KAAK;GAAS,KAAKb,EAAO,QAAQ;GAAK,KAAK;EAAM,CAAC,CAAC,CACzE,YAAY,CAAC,CACb,OAAO,OAAO,WAAW,CAAC,CAAC,CAC3B,UAAUA,EAAO,MAAM,CAAC,CACxB,YAAYA,EAAO,QAAQ,CAAC,CAC5B,WAAWc,CAAO,CAAC,CACnB,kBAAkB,GAAGN,EAAO,EAAE,CAAC,CAC/B,KAAKR,EAAO,QAAQ,GAAG;CACH;AACzB;AAGA,eAAe,eACb,GACA,GACA,GACqE;CACrE,IAAMe,IAAQC,EAAavB,CAAO;CAClC,IAAIsB,MAAU,MAAM,MAAME,EAAgB;CAC1C,IAAI;EACF,IAAM,EAAE,eAAY,MAAMC,EAAUH,GAAOf,EAAO,UAAU;GAC1D,YAAY,CAAC,OAAO;GACpB,UAAUA,EAAO;GACjB,gBAAgBH;GAChB,QAAQG,EAAO;GACf,aAAaW;GACb,gBAAgB;IAAC;IAAO;IAAO;IAAO;IAAO;IAAO;GAAgB;EACtE,CAAC,GACKG,IAAUK,EAAQ,OAAO;EAC/B,IAAIL,EAAQ,WAAW,KAAKA,EAAQ,SAASlB,KAAe,CAACwB,EAAiBN,CAAO,GAAG,MAAMG,EAAgB;EAC9G,IAAMI,IAAUF,EAAQ;EAIxB,IAHI,OAAOE,KAAY,YAAY,CAAC,OAAO,cAAcA,CAAO,KAAKA,IAAU,KAC3E,OAAOF,EAAQ,OAAQ,YAAYA,EAAQ,MAAM,KAAK,IAAI,IAAI,MAAOtB,KAGvE,MAAM,QAAQsB,EAAQ,KAAK,KAC3BA,EAAQ,MAAM,SAAA,kBAA8B,MAC3C,OAAOA,EAAQ,OAAQ,YACtBA,EAAQ,MAAMA,EAAQ,MAAA,QACtB,KAAK,IAAI,IAAI,MAAOA,EAAQ,MAAA,OAAyCtB,IAEvE,MAAMoB,EAAgB;EACxB,IAAMK,IAAU,MAAMC,EAAYC,EAAI,SAASV,CAAO;EACtD,IAAIQ,MAAY,QAAQA,EAAQ,oBAAoBD,GAAS,MAAMJ,EAAgB;EACnF,OAAO;GAAE,gBAAgBI;GAAS;GAAS;EAAM;CACnD,SAASI,GAAO;EAEd,MADIA,aAAiBC,EAAO,YAAiBT,EAAgB,IACvDQ;CACR;AACF;AAEA,eAAe,SAAS,GAAoB,GAAoB,GAAY,GAA6B;CACvG,IAAME,IAAO3B,EAAO,SAEd4B,IAAS,sCADCC,IAAc,IAC+B;CAC7D,MAAML,EAAI,WAAW,KAAK;EACxB,MAAMxB,EAAO;EACb,MAAM,mCAAmC8B,EAAWH,CAAI,EAAE,mBAAmBG,EAAWC,CAAI,EAAE,IAAID,EAAWC,CAAI,EAAE,aAAaH,EAAO;EACvI,SAAS,QAAQD,EAAK;EACtB,MAAM,gCAAgCA,EAAK,OAAOI,EAAK,MAAMH;EAC7D;CACF,CAAC;AACH;AAEA,eAAe,aAAa,GAAkB,GAAoB,GAAuC;CACvG,qBAAqBnC,GAASO,CAAM;CACpC,IAAMgC,IAAO,MAAMC,EAAaxC,CAAO;CACvC,IAAI,OAAOuC,KAAS,aAAYA,KAAiB,MAAM,QAAQA,CAAI,GAAG,MAAME,EAAW;CACvF,IAAMC,IAAO,OAAO,KAAKH,CAAI,GACvBI,IAA0B,QAAQ,IAAIJ,GAAM,OAAO;CACzD,IAAIG,EAAK,WAAW,KAAKA,EAAK,OAAO,WAAW,OAAOC,KAAmB,UACxE,MAAMF,EAAW;CAEnB,IAAMG,IAAQD,EAAe,KAAK,CAAC,CAAC,YAAY;CAChD,IAAI,CAACE,EAAkBD,CAAK,GAC1B,MAAMH,EAAW;CAEnB,IAAMK,IAAQ,KAAK,IAAI,GACjBC,IAAiB,MAAMC,EAAkBjB,EAAI,SAASe,CAAK;CACjE,IAAIC,MAAmB,MACrB,MAAM,IAAIE,EAAS,KAAK,gBAAgB,+CAA+C,EACrF,mBAAmBF,EACrB,CAAC;CAEH,IAAMG,IAAO,MAAMC,EAAWpB,EAAI,SAASa,CAAK,GAC1CQ,IAAoB,MAAMC,EAAgBtB,EAAI,SAASmB,EAAK,IAAIJ,CAAK;CAC3E,IAAIM,MAAsB,MACxB,MAAM,IAAIH,EAAS,KAAK,gBAAgB,6CAA6C,EAAE,qBAAkB,CAAC;CAE5G,IAAM3B,IAAQ,YAAY,GACpBgC,IAAY,MAAMC,EAAUjC,CAAK;CACvC,MAAMkC,EAAYzB,EAAI,SAASuB,GAAWJ,EAAK,IAAIJ,CAAK;CACxD,IAAI;EACF,MAAM,SAASf,GAAKxB,GAAQ2C,EAAK,OAAO,GAAG3C,EAAO,aAAa,4BAA4Be,GAAO;CACpG,SAASU,GAAO;EAGd,MADA,MAAMyB,EAAY1B,EAAI,SAASuB,CAAS,CAAC,CAAC,YAAY,KAAA,CAAS,GACzD,IAAIjD,EAAmB,KAAK,SAAS,EAAE,OAAO2B,EAAM,CAAC;CAC7D;CACA,OAAO0B,EAAK,KAAK,EAAE,IAAI,GAAK,GAAGC,CAAO;AACxC;AAEA,eAAe,aAAa,GAAkB,GAAoB,GAAuC;CACvG,IAAI3D,EAAQ,WAAW,OAAO;EAC5B,IAAMsB,IAAQsC,EAAY,IAAI,IAAI5D,EAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK;EAC3E,IAAI,CAACE,EAAW,KAAKoB,CAAK,GAAG,MAAMmB,EAAW,wBAAwB;EACtE,OAAOoB,EAAiB;GAAE,GAAGtD;GAAQ,OAAO,YAAY;GAAG;EAAM,CAAC;CACpE;CAEA,AADA,qBAAqBP,GAASO,GAAQ,EAAI,GAC1CqD,EAAY,IAAI,IAAI5D,EAAQ,GAAG,GAAG,CAAC,CAAC;CACpC,IAAMuC,IAAO,MAAMC,EAAaxC,CAAO;CACvC,IAAI,OAAOuC,KAAS,aAAYA,KAAiB,MAAM,QAAQA,CAAI,KAAK,OAAO,KAAKA,CAAI,CAAC,CAAC,WAAW,GACnG,MAAME,EAAW,wBAAwB;CAE3C,IAAMnB,IAAiB,QAAQ,IAAIiB,GAAM,OAAO;CAEhD,IADI,OAAOjB,KAAU,YACjB,CAACpB,EAAW,KAAKoB,CAAK,GAAG,MAAMmB,EAAW,wBAAwB;CACtE,IAAMS,IAAO,MAAMY,EAAa/B,EAAI,SAAS,MAAMwB,EAAUjC,CAAK,GAAG,KAAK,IAAI,CAAC;CAC/E,IAAI4B,MAAS,MAAM,MAAM,IAAID,EAAS,KAAK,QAAQ,4CAA4C;CAC/F,IAAMc,IAAU,MAAM,YAAYxD,GAAQ2C,EAAK,IAAI3C,EAAO,eAAe,IAAI2C,EAAK,KAAK,GAAGA,EAAK,cAAc;CAC7G,OAAO,IAAI,SAAS,MAAM;EACxB,SAAS;GACP,GAAGS;GACH,cAAcK,EAAmBD,EAAQ,OAAO;IAAE,eAAeA,EAAQ;IAAQ,QAAQ,OAAOxD,CAAM;GAAE,CAAC;EAC3G;EACA,QAAQ;CACV,CAAC;AACH;AAGA,eAAe,aAAa,GAAkB,GAAoB,GAAuC;CACvG,IAAM,EAAE,eAAY,MAAM,eAAeP,GAASO,GAAQwB,CAAG,GACvDkC,IAAM,MAAMnC,EAAYC,EAAI,SAASV,CAAO;CAClD,IAAI4C,MAAQ,MAAM,MAAMzC,EAAgB;CACxC,OAAOkC,EACL,KACA;EAAE,WAAWO,EAAI;EAAY,OAAOA,EAAI;EAAO,IAAIA,EAAI;EAAI,cAAcA,EAAI;CAAgB,GAC7FN,CACF;AACF;AAGA,eAAe,eAAe,GAAuC;CACnE,IAAMO,IAAO,MAAMC,EAAS,KAAK,CAAC,CAAC,YAAY,EAAE,GAC7CC,IAAkB;CACtB,IAAI;EACF,IAAS,KAAK,MAAMF,CAAI;CAC1B,QAAQ;EACN,IAAS;CACX;CACA,IAAMG,IAAWC,EAA2B,UAAUF,CAAM;CAC5D,IAAI,CAACC,EAAS,WAAWF,EAAS,SAAS,OAAOA,EAAS,SAAS,KAAK,MAAM,YAAY;CAC3F,IAAM,EAAE,SAAM,YAAS,iBAAcE,EAAS,KAAK,OAC7CE,IAAaJ,EAAS,QAAQ,IAAI,aAAa;CACrD,OAAOT,EACLS,EAAS,QACT,EAAE,OAAO;EAAE;EAAM;EAAS;CAAU,EAAE,GACtCI,MAAe,QAAQ,YAAY,KAAKA,CAAU,IAAI;EAAE,GAAGZ;EAAS,eAAeY;CAAW,IAAIZ,CACpG;AACF;AAUA,eAAe,YAAY,GAAkB,GAAoB,GAAuC;CACtG,IAAMrD,IAAS,qBAAqBN,GAASO,CAAM,GAC7C,EAAE,YAAS,aAAU,MAAM,eAAeP,GAASO,GAAQwB,CAAG,GAC9DF,IAAU7B,EAAQ,QAAQ,IAAIW,CAAc;CAClD,IAAIkB,MAAY,QAAQ,CAAC2C,EAAW,UAAU3C,CAAO,CAAC,CAAC,SAAS,MAAMY,EAAW;CACjF,IAAIZ,MAAYR,GACd,MAAM,IAAI4B,EAAS,KAAK,mBAAmB,gEAAgE;CAE7G,IAAMwB,IAAU,IAAI,QAAQ;EAC1B,QAAQ,GAAGC,EAAoB,GAAGpD;EAClC;GACCT,IAAwB;CAC3B,CAAC,GACK8D,IAAY3E,EAAQ,QAAQ,IAAIY,CAAgB;CACtD,IAAI+D,MAAc,MAAM;EACtB,IAAI,CAACC,EAAQ,KAAKD,CAAS,GAAG,MAAMlC,EAAW;EAC/C,EAAQ,IAAI7B,GAAkB+D,CAAS;CACzC;CACA,IAAIE;CACJ,IAAI;EACF,IAAW,MAAMC,EACf/C,EAAI,cACJ,IAAI,QAAQ,GAAGxB,EAAO,aAAa,qBAAqB;GAAE;GAAS,QAAQ;GAAU,UAAU;EAAS,CAAC,GACzG,OAAO,MACD4D,EAAS,WAAW,OACtB,MAAMA,EAAS,MAAM,OAAO,GACrBA,KAEF,eAAeA,CAAQ,CAElC;CACF,SAASnC,GAAO;EACd,MAAM,IAAI3B,EAAmB,KAAK,WAAW,EAAE,OAAO2B,EAAM,CAAC;CAC/D;CAGA,OAFI6C,EAAS,WAAW,OACxB,MAAME,EAAchD,EAAI,SAASV,CAAO,GACjC,IAAI,SAAS,MAAM;EACxB,SAAS;GAAE,GAAGsC;GAAS,cAAcqB,EAAqB,OAAOzE,CAAM,CAAC;EAAE;EAC1E,QAAQ;CACV,CAAC,KALmCsE;AAMtC;AAEA,eAAe,iBAAiB,GAAkB,GAAoB,GAAuC;CAC3G,qBAAqB7E,GAASO,CAAM;CACpC,IAAM,EAAE,YAAS,sBAAmB,MAAM,eAAeP,GAASO,GAAQwB,CAAG,GACvEF,IAAU7B,EAAQ,QAAQ,IAAIW,CAAc;CAClD,IAAIkB,MAAY,QAAQ,CAAC2C,EAAW,UAAU3C,CAAO,CAAC,CAAC,SAAS,MAAMY,EAAW;CACjF,IAAIZ,MAAYR,GACd,MAAM,IAAI4B,EAAS,KAAK,mBAAmB,gEAAgE;CAC7G,IAAK,MAAMgC,EAAelD,EAAI,SAASV,GAAS6D,CAAc,MAAO,MAAM,MAAM1D,EAAgB;CACjG,OAAOkC,EAAK,KAAK,EAAE,IAAI,GAAK,GAAG;EAAE,GAAGC;EAAS,cAAcqB,EAAqB,OAAOzE,CAAM,CAAC;CAAE,CAAC;AACnG;AAEA,eAAe,aAAa,GAAuC;CACjE,IAAI4E,IAA0F,MAC1FC,IAAiC;CACrC,IAAI;EACF,MAAMC,EAAWtD,CAAG;CACtB,QAAQ;EACN,IAAS;CACX;CACA,IAAIoD,MAAW,MACb,IAAI;EAEF,AADA,IAAkB,MAAMG,EAAcvD,EAAI,OAAO,GAC7CqD,MAAA,MAAyC,IAAS;CACxD,QAAQ;EACN,IAAS;CACX;CAEF,OAAO1B,EACLyB,MAAW,OAAO,MAAM,KACxBI,EAAwB,MAAM;EAC5B;EACA;EACA,eAAA;EACA,QAAQJ,MAAW,OAAO,OAAO;CACnC,CAAC,GACDxB,CACF;AACF;AACA,eAAe,MAAM,GAAkB,GAAuC;CAC5E,IAAM6B,IAASxF,EAAQ,OAAO,YAAY,GACpCyF,IAAU,WAAWzF,CAAO;CAClC,IAAIyF,MAAY,KAAA,GAAW,MAAM,IAAIxC,EAAS,KAAK,aAAa,gBAAgB;CAChF,IAAIwC,MAAY,YAAYD,MAAW,OAAO,OAAO,aAAazD,CAAG;CACrE,IAAMxB,IAAS,MAAM8E,EAAWtD,CAAG,GAC7BrB,IAAO,YAAYV,GAASO,CAAM;CACxC,IAAIiF,MAAW,WAAW,OAAO,UAAUxF,GAASO,GAAQV,EAAc4F,EAAQ;CAClF,IAAI,CAAC5F,EAAc4F,EAAQ,CAAC,SAASD,CAAM,GACzC,MAAM,IAAIvC,EAAS,KAAK,sBAAsB,kCAAkC;CAElF,IAAIkB;CACJ,QAAQsB,GAAR;EACE,KAAK;GACH,IAAW,MAAM,aAAa1D,CAAG;GACjC;EACF,KAAK;GAEH,AADA,MAAM,eAAe/B,GAASO,GAAQwB,CAAG,GACzC,IAAW2B,EAAK,KAAK,EAAE,IAAI,GAAK,GAAGC,CAAO;GAC1C;EACF,KAAK;GACH,IAAW,MAAM,iBAAiB3D,GAAS+B,GAAKxB,CAAM;GACtD;EACF,KAAK;GACH,IAAWmD,EAAK,KAAK,EAAE,MAAMnD,EAAO,KAAK,GAAGoD,CAAO;GACnD;EACF,KAAK;GACH,IAAW,MAAM,aAAa3D,GAAS+B,GAAKxB,CAAM;GAClD;EACF,KAAK;GACH,IAAW,MAAM,aAAaP,GAAS+B,GAAKxB,CAAM;GAClD;EACF,KAAK,WACH,IAAWiF,MAAW,QAAQ,MAAM,aAAaxF,GAAS+B,GAAKxB,CAAM,IAAI,MAAM,YAAYP,GAAS+B,GAAKxB,CAAM;CAEnH;CACA,OAAO,SAAS4D,GAAUzD,CAAI;AAChC;AAEA,SAAS,SAAS,GAAoB,GAAwC;CAC5E,IAAI,OAAO,KAAKA,CAAI,CAAC,CAAC,WAAW,GAAG,OAAOyD;CAC3C,IAAMuB,IAAO,IAAI,SAASvB,EAAS,MAAMA,CAAQ;CACjD,KAAK,IAAM,CAACwB,GAAKC,MAAU,OAAO,QAAQlF,CAAI,GAAG,EAAK,QAAQ,IAAIiF,GAAKC,CAAK;CAC5E,OAAOF;AACT;AAEA,IAAM,cAAc,MAClB1D,aAAiB3B,IAAqB2B,EAAM,iBAAiB,EAAE,MAAM,WAAW;AAQlF,SAAgB,mBAAkE;CAChF,IAAM6D,oBAAU,IAAI,IAAgC,GAC9C,QAAQ,MAA2B;EACvC,KAAK,IAAMC,KAAWD,GACpB,IAAI;GACF,EAAQE,CAAK;EACf,QAAQ,CAER;CAEJ;CACA,OAAO;EACL,MAAM,MAAM,GAAkB,GAA2B;GACvD,IAAMC,IAAY,OAAO,WAAW,GAC9BC,IAAU,KAAK,IAAI,GACrB9B,GACA+B;GACJ,IAAI;IACF,IAAW,MAAM,MAAMlG,GAAS+B,CAAG;GACrC,SAASC,GAAO;IAEd,AADA,IAAUA,GACV,IAAWmE,EAAgBnE,GAAOgE,CAAS;IAE3C,IAAMzF,IAAS,MAAM8E,EAAWtD,CAAG,CAAC,CAAC,YAAY,IAAI;IACrD,AAAIxB,MAAW,SAEX,WAAWP,CAAO,MAAM,YACxBA,EAAQ,WAAW,SACnBgC,aAAiBiB,KACjBjB,EAAM,WAAW,QAEjB,IAAW6B,EAAiB;KAAE,GAAGtD;KAAQ,OAAO,YAAY;KAAG,OAAO;IAAK,CAAC,IAC9E,IAAW,SAAS4D,GAAU,YAAYnE,GAASO,CAAM,CAAC;GAE9D;GAYA,IAXI,WAAWP,CAAO,MAAM,aAC1BmE,EAAS,QAAQ,IAAI,iBAAiB,UAAU,GAChDA,EAAS,QAAQ,IAAI,mBAAmB,aAAa,GACrDA,EAAS,QAAQ,IAAI,0BAA0B,SAAS,GACnDA,EAAS,QAAQ,IAAI,yBAAyB,KACjDA,EAAS,QAAQ,IACf,2BACA,6DACF,IAGA0B,EAAQ,OAAO,GAAG;IACpB,IAAMJ,IAAU,WAAWzF,CAAO,GAC5BoG,IACJjC,EAAS,SAAS,MACd,OACAsB,MAAY,WACV,gBACAS,aAAmBjD,IACjBiD,EAAQ,OACR,YAEJG,IACJH,MAAY,KAAA,KAAa/B,EAAS,UAAU,MACxCG,EAA2B,UACzB,MAAMH,EACH,MAAM,CAAC,CACP,KAAK,CAAC,CACN,YAAY,IAAI,CACrB,IACA,MACAmC,IACJb,MAAY,YAAYtB,EAAS,WAAW,MACxCoB,EAAwB,UACtB,MAAMpB,EACH,MAAM,CAAC,CACP,KAAK,CAAC,CACN,YAAY,IAAI,CACrB,IACA;IACN,KAAK;KACH,MAAMkC,GAAe,UAAUA,EAAc,KAAK,MAAM,OAAOD;KAC/D,IAAI,KAAK,IAAI,GAAG,KAAK,IAAI,IAAIH,CAAO;KACpC;KACA,OAAOR,MAAY,KAAA,IAAY,cAAc3F,EAAa2F;KAC1D,QAAQtB,EAAS;KACjB,MAAM;KACN,GAAIA,EAAS,UAAU,MACnB,EACE,YAAYmC,GAAQ,UAChB,EACE,MACEA,EAAO,KAAK,WAAW,8BACnB,kBACAA,EAAO,KAAK,WAAW,oBACrB,WACA,WACV,IACAJ,MAAY,KAAA,IACV,EAAE,MAAM,UAAmB,IAC3B,WAAWA,CAAO,EAC1B,IACA,CAAC;IACP,CAAC;GACH;GACA,OAAO/B;EACT;EAEA,MAAM,UAAU,GAAsB,GAAuB;GAC3D,IAAI;IACF,MAAMkB,EAAWtD,CAAG;IACpB,IAAMwE,IAAU,MAAMC,EAAMzE,EAAI,SAAS,KAAK,IAAI,CAAC;IACnD,AAAI8D,EAAQ,OAAO,KAAG,KAAK;KAAE;KAAS,QAAQ;KAAM,MAAM;IAAY,CAAC;GACzE,SAAS7D,GAAO;IAEd,MADI6D,EAAQ,OAAO,KAAG,KAAK;KAAE,YAAY,WAAW7D,CAAK;KAAG,QAAQ;KAAU,MAAM;IAAY,CAAC,GAC3FA;GACR;EACF;EACA,IAAI,GAAS,GAAS;GACpB,IAAIyE,GAAS,QAAQ,SAAS,aAAa,KAAA;GAC3C,IAAM,YAAY,MAA2BX,EAAQC,CAAK,GACpD,oBAA0B;IAE9B,AADAF,EAAQ,OAAO,QAAQ,GACvBY,GAAS,QAAQ,oBAAoB,SAAS,WAAW;GAC3D;GAGA,OAFAZ,EAAQ,IAAI,QAAQ,GACpBY,GAAS,QAAQ,iBAAiB,SAAS,aAAa,EAAE,MAAM,GAAK,CAAC,GAC/D;EACT;CACF;AACF"}

package/dist/errors.cjs

@@ -1,2 +1,2 @@
-var ArchiveError=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name,Object.setPrototypeOf(this,new.target.prototype)}},ArchiveDefinitionError=class extends ArchiveError{},ArchiveDerivationError=class extends ArchiveError{stage;constructor(e,t,n){super(t,n),this.stage=e}};exports.ArchiveDefinitionError=ArchiveDefinitionError,exports.ArchiveDerivationError=ArchiveDerivationError,exports.ArchiveError=ArchiveError;
+var ArchiveError=class extends Error{constructor(e,t){super(e,t),this.name=new.target.name}},ArchiveDefinitionError=class extends ArchiveError{},ArchiveDerivationError=class extends ArchiveError{stage;constructor(e,t,n){super(t,n),this.stage=e}};exports.ArchiveDefinitionError=ArchiveDefinitionError,exports.ArchiveDerivationError=ArchiveDerivationError,exports.ArchiveError=ArchiveError;
 //# sourceMappingURL=errors.cjs.map

package/dist/errors.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"errors.cjs","names":["message","opts","stage"],"sources":["../src/errors.ts"],"sourcesContent":["export class ArchiveError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\nexport class ArchiveDefinitionError extends ArchiveError {}\n\nexport type ArchiveDerivationStage = 'canonicalize' | 'hash' | 'index' | 'schema';\n\n/** A collection callback or core runtime fault, not invalid submitted content. */\nexport class ArchiveDerivationError extends ArchiveError {\n  readonly stage: ArchiveDerivationStage;\n\n  constructor(stage: ArchiveDerivationStage, message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.stage = stage;\n  }\n}\n"],"mappings":"AAAA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAMA,EAASC,CAAI,EACnB,KAAK,KAAO,WAAW,KACvB,OAAO,eAAe,KAAM,WAAW,SAAS,CAClD,CACF,EAEa,uBAAb,cAA4C,YAAa,CAAC,EAK7C,uBAAb,cAA4C,YAAa,CACvD,MAEA,YAAY,EAA+B,EAAiB,EAAqB,CAC/E,MAAMD,EAASC,CAAI,EACnB,KAAK,MAAQC,CACf,CACF,E"}
+{"version":3,"file":"errors.cjs","names":["message","opts","stage"],"sources":["../src/errors.ts"],"sourcesContent":["export class ArchiveError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n  }\n}\n\nexport class ArchiveDefinitionError extends ArchiveError {}\n\nexport type ArchiveDerivationStage = 'canonicalize' | 'hash' | 'index' | 'schema';\n\n/** A collection callback or core runtime fault, not invalid submitted content. */\nexport class ArchiveDerivationError extends ArchiveError {\n  readonly stage: ArchiveDerivationStage;\n\n  constructor(stage: ArchiveDerivationStage, message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.stage = stage;\n  }\n}\n"],"mappings":"AAAA,IAAa,aAAb,cAAkC,KAAM,CACtC,YAAY,EAAiB,EAAqB,CAChD,MAAMA,EAASC,CAAI,EACnB,KAAK,KAAO,WAAW,IACzB,CACF,EAEa,uBAAb,cAA4C,YAAa,CAAC,EAK7C,uBAAb,cAA4C,YAAa,CACvD,MAEA,YAAY,EAA+B,EAAiB,EAAqB,CAC/E,MAAMD,EAASC,CAAI,EACnB,KAAK,MAAQC,CACf,CACF,E"}

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAKjD;AAED,qBAAa,sBAAuB,SAAQ,YAAY;CAAG;AAE3D,MAAM,MAAM,sBAAsB,GAAG,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElF,kFAAkF;AAClF,qBAAa,sBAAuB,SAAQ,YAAY;IACtD,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBAE3B,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAIhF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAIjD;AAED,qBAAa,sBAAuB,SAAQ,YAAY;CAAG;AAE3D,MAAM,MAAM,sBAAsB,GAAG,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElF,kFAAkF;AAClF,qBAAa,sBAAuB,SAAQ,YAAY;IACtD,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBAE3B,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY;CAIhF"}

package/dist/errors.js

@@ -1,7 +1,7 @@
 // src/errors.ts
 var ArchiveError = class extends Error {
 	constructor(e, t) {
-		super(e, t), this.name = new.target.name, Object.setPrototypeOf(this, new.target.prototype);
+		super(e, t), this.name = new.target.name;
 	}
 }, ArchiveDefinitionError = class extends ArchiveError {}, ArchiveDerivationError = class extends ArchiveError {
 	stage;

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","names":["message","opts","stage"],"sources":["../src/errors.ts"],"sourcesContent":["export class ArchiveError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\nexport class ArchiveDefinitionError extends ArchiveError {}\n\nexport type ArchiveDerivationStage = 'canonicalize' | 'hash' | 'index' | 'schema';\n\n/** A collection callback or core runtime fault, not invalid submitted content. */\nexport class ArchiveDerivationError extends ArchiveError {\n  readonly stage: ArchiveDerivationStage;\n\n  constructor(stage: ArchiveDerivationStage, message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.stage = stage;\n  }\n}\n"],"mappings":";AAAA,IAAa,eAAb,cAAkC,MAAM;CACtC,YAAY,GAAiB,GAAqB;EAGhD,AAFA,MAAMA,GAASC,CAAI,GACnB,KAAK,OAAO,WAAW,MACvB,OAAO,eAAe,MAAM,WAAW,SAAS;CAClD;AACF,GAEa,yBAAb,cAA4C,aAAa,CAAC,GAK7C,yBAAb,cAA4C,aAAa;CACvD;CAEA,YAAY,GAA+B,GAAiB,GAAqB;EAE/E,AADA,MAAMD,GAASC,CAAI,GACnB,KAAK,QAAQC;CACf;AACF"}
+{"version":3,"file":"errors.js","names":["message","opts","stage"],"sources":["../src/errors.ts"],"sourcesContent":["export class ArchiveError extends Error {\n  constructor(message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.name = new.target.name;\n  }\n}\n\nexport class ArchiveDefinitionError extends ArchiveError {}\n\nexport type ArchiveDerivationStage = 'canonicalize' | 'hash' | 'index' | 'schema';\n\n/** A collection callback or core runtime fault, not invalid submitted content. */\nexport class ArchiveDerivationError extends ArchiveError {\n  readonly stage: ArchiveDerivationStage;\n\n  constructor(stage: ArchiveDerivationStage, message: string, opts?: ErrorOptions) {\n    super(message, opts);\n    this.stage = stage;\n  }\n}\n"],"mappings":";AAAA,IAAa,eAAb,cAAkC,MAAM;CACtC,YAAY,GAAiB,GAAqB;EAEhD,AADA,MAAMA,GAASC,CAAI,GACnB,KAAK,OAAO,WAAW;CACzB;AACF,GAEa,yBAAb,cAA4C,aAAa,CAAC,GAK7C,yBAAb,cAA4C,aAAa;CACvD;CAEA,YAAY,GAA+B,GAAiB,GAAqB;EAE/E,AADA,MAAMD,GAASC,CAAI,GACnB,KAAK,QAAQC;CACf;AACF"}

package/dist/worker/_cors.cjs

@@ -0,0 +1,2 @@
+const e=require("../_server/http.cjs"),t=require("../contract.cjs");function requireMutationGuard(t,n){let r=t.headers.get(`origin`);if(r===null||!n.allowedOrigins.has(r)||t.headers.get(`x-archive-request`)!==`1`)throw e.forbidden()}function corsHeaders(e,t){let n=e.headers.get(`origin`);return n===null||!t.allowedOrigins.has(n)?{}:{"access-control-allow-credentials":`true`,"access-control-allow-origin":n,vary:`Origin`}}function preflight(n,r){let i=n.headers.get(`origin`);return i===null||!r.allowedOrigins.has(i)?e.errorBody(403,`forbidden`,`That action is not allowed.`,crypto.randomUUID()):new Response(null,{headers:{"access-control-allow-credentials":`true`,"access-control-allow-headers":`Content-Type, ${t.PUBLISHER_HEADER}, ${t.REQUEST_MARKER_HEADER}`,"access-control-allow-methods":`GET, POST, PUT, DELETE, OPTIONS`,"access-control-allow-origin":i,"access-control-max-age":`600`,vary:`Origin`},status:204})}exports.corsHeaders=corsHeaders,exports.preflight=preflight,exports.requireMutationGuard=requireMutationGuard;
+//# sourceMappingURL=_cors.cjs.map

package/dist/worker/_cors.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"_cors.cjs","names":["forbidden","errorBody","PUBLISHER_HEADER","REQUEST_MARKER_HEADER","require_http","require_contract","origin","request","config"],"sources":["../../src/worker/_cors.ts"],"sourcesContent":["import { errorBody, forbidden } from '../_server/http';\nimport { PUBLISHER_HEADER, REQUEST_MARKER_HEADER } from '../contract';\nimport type { ApiConfig } from './env';\n\n/**\n * The catalog's origin posture: exact allowed origins plus the request marker.\n * The issuer runs its own guard (the public-origin verify exception, the account\n * header) because its CORS contract genuinely differs.\n */\n\n/** Exact-origin plus request-marker guard for every mutation: no wildcards, no nulls. */\nexport function requireMutationGuard(request: Request, config: ApiConfig): void {\n  const origin = request.headers.get('origin');\n  if (origin === null || !config.allowedOrigins.has(origin)) throw forbidden();\n  if (request.headers.get(REQUEST_MARKER_HEADER) !== '1') throw forbidden();\n}\n\n/** CORS response headers for one already-allowed origin; absent for foreign origins. */\nexport function corsHeaders(request: Request, config: ApiConfig): Record<string, string> {\n  const origin = request.headers.get('origin');\n  if (origin === null || !config.allowedOrigins.has(origin)) return {};\n  return {\n    'access-control-allow-credentials': 'true',\n    'access-control-allow-origin': origin,\n    vary: 'Origin',\n  };\n}\n\n/** Answers a preflight for an allowed origin; foreign or missing origins get 403. */\nexport function preflight(request: Request, config: ApiConfig): Response {\n  const origin = request.headers.get('origin');\n  if (origin === null || !config.allowedOrigins.has(origin)) {\n    return errorBody(403, 'forbidden', 'That action is not allowed.', crypto.randomUUID());\n  }\n  return new Response(null, {\n    headers: {\n      'access-control-allow-credentials': 'true',\n      // Header names are case-insensitive; the values derive from the contract constants.\n      'access-control-allow-headers': `Content-Type, ${PUBLISHER_HEADER}, ${REQUEST_MARKER_HEADER}`,\n      'access-control-allow-methods': 'GET, POST, PUT, DELETE, OPTIONS',\n      'access-control-allow-origin': origin,\n      'access-control-max-age': '600',\n      vary: 'Origin',\n    },\n    status: 204,\n  });\n}\n"],"mappings":"A,oEAWA,SAAgB,qBAAqB,EAAkB,EAAyB,CAC9E,IAAMM,EAASC,EAAQ,QAAQ,IAAI,QAAQ,EAE3C,GADID,IAAW,MAAQ,CAACE,EAAO,eAAe,IAAIF,CAAM,GACpDC,EAAQ,QAAQ,IAAA,mBAAyB,IAAM,IAAK,MAAMP,EAAAA,UAAU,CAC1E,CAGA,SAAgB,YAAY,EAAkB,EAA2C,CACvF,IAAMM,EAASC,EAAQ,QAAQ,IAAI,QAAQ,EAE3C,OADID,IAAW,MAAQ,CAACE,EAAO,eAAe,IAAIF,CAAM,EAAU,CAAC,EAC5D,CACL,mCAAoC,OACpC,8BAA+BA,EAC/B,KAAM,QACR,CACF,CAGA,SAAgB,UAAU,EAAkB,EAA6B,CACvE,IAAMA,EAASC,EAAQ,QAAQ,IAAI,QAAQ,EAI3C,OAHID,IAAW,MAAQ,CAACE,EAAO,eAAe,IAAIF,CAAM,EAC/CL,EAAAA,UAAU,IAAK,YAAa,8BAA+B,OAAO,WAAW,CAAC,EAEhF,IAAI,SAAS,KAAM,CACxB,QAAS,CACP,mCAAoC,OAEpC,+BAAgC,iBAAiBC,EAAAA,iBAAiB,IAAIC,EAAAA,wBACtE,+BAAgC,kCAChC,8BAA+BG,EAC/B,yBAA0B,MAC1B,KAAM,QACR,EACA,OAAQ,GACV,CAAC,CACH,C"}

package/dist/worker/_cors.d.ts

@@ -0,0 +1,13 @@
+import type { ApiConfig } from './env';
+/**
+ * The catalog's origin posture: exact allowed origins plus the request marker.
+ * The issuer runs its own guard (the public-origin verify exception, the account
+ * header) because its CORS contract genuinely differs.
+ */
+/** Exact-origin plus request-marker guard for every mutation: no wildcards, no nulls. */
+export declare function requireMutationGuard(request: Request, config: ApiConfig): void;
+/** CORS response headers for one already-allowed origin; absent for foreign origins. */
+export declare function corsHeaders(request: Request, config: ApiConfig): Record<string, string>;
+/** Answers a preflight for an allowed origin; foreign or missing origins get 403. */
+export declare function preflight(request: Request, config: ApiConfig): Response;
+//# sourceMappingURL=_cors.d.ts.map

package/dist/worker/_cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_cors.d.ts","sourceRoot":"","sources":["../../src/worker/_cors.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC;;;;GAIG;AAEH,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAI9E;AAED,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQvF;AAED,qFAAqF;AACrF,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,QAAQ,CAiBvE"}

package/dist/worker/_cors.js

@@ -0,0 +1,32 @@
+import { errorBody as e, forbidden as t } from "../_server/http.js";
+import { PUBLISHER_HEADER as n, REQUEST_MARKER_HEADER as r } from "../contract.js";
+// src/worker/_cors.ts
+function requireMutationGuard(e, n) {
+	let r = e.headers.get("origin");
+	if (r === null || !n.allowedOrigins.has(r) || e.headers.get("x-archive-request") !== "1") throw t();
+}
+function corsHeaders(e, t) {
+	let n = e.headers.get("origin");
+	return n === null || !t.allowedOrigins.has(n) ? {} : {
+		"access-control-allow-credentials": "true",
+		"access-control-allow-origin": n,
+		vary: "Origin"
+	};
+}
+function preflight(t, i) {
+	let a = t.headers.get("origin");
+	return a === null || !i.allowedOrigins.has(a) ? e(403, "forbidden", "That action is not allowed.", crypto.randomUUID()) : new Response(null, {
+		headers: {
+			"access-control-allow-credentials": "true",
+			"access-control-allow-headers": `Content-Type, ${n}, ${r}`,
+			"access-control-allow-methods": "GET, POST, PUT, DELETE, OPTIONS",
+			"access-control-allow-origin": a,
+			"access-control-max-age": "600",
+			vary: "Origin"
+		},
+		status: 204
+	});
+}
+export { corsHeaders, preflight, requireMutationGuard };
+
+//# sourceMappingURL=_cors.js.map

package/dist/worker/_cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_cors.js","names":["origin","request","config","forbidden","errorBody","PUBLISHER_HEADER","REQUEST_MARKER_HEADER"],"sources":["../../src/worker/_cors.ts"],"sourcesContent":["import { errorBody, forbidden } from '../_server/http';\nimport { PUBLISHER_HEADER, REQUEST_MARKER_HEADER } from '../contract';\nimport type { ApiConfig } from './env';\n\n/**\n * The catalog's origin posture: exact allowed origins plus the request marker.\n * The issuer runs its own guard (the public-origin verify exception, the account\n * header) because its CORS contract genuinely differs.\n */\n\n/** Exact-origin plus request-marker guard for every mutation: no wildcards, no nulls. */\nexport function requireMutationGuard(request: Request, config: ApiConfig): void {\n  const origin = request.headers.get('origin');\n  if (origin === null || !config.allowedOrigins.has(origin)) throw forbidden();\n  if (request.headers.get(REQUEST_MARKER_HEADER) !== '1') throw forbidden();\n}\n\n/** CORS response headers for one already-allowed origin; absent for foreign origins. */\nexport function corsHeaders(request: Request, config: ApiConfig): Record<string, string> {\n  const origin = request.headers.get('origin');\n  if (origin === null || !config.allowedOrigins.has(origin)) return {};\n  return {\n    'access-control-allow-credentials': 'true',\n    'access-control-allow-origin': origin,\n    vary: 'Origin',\n  };\n}\n\n/** Answers a preflight for an allowed origin; foreign or missing origins get 403. */\nexport function preflight(request: Request, config: ApiConfig): Response {\n  const origin = request.headers.get('origin');\n  if (origin === null || !config.allowedOrigins.has(origin)) {\n    return errorBody(403, 'forbidden', 'That action is not allowed.', crypto.randomUUID());\n  }\n  return new Response(null, {\n    headers: {\n      'access-control-allow-credentials': 'true',\n      // Header names are case-insensitive; the values derive from the contract constants.\n      'access-control-allow-headers': `Content-Type, ${PUBLISHER_HEADER}, ${REQUEST_MARKER_HEADER}`,\n      'access-control-allow-methods': 'GET, POST, PUT, DELETE, OPTIONS',\n      'access-control-allow-origin': origin,\n      'access-control-max-age': '600',\n      vary: 'Origin',\n    },\n    status: 204,\n  });\n}\n"],"mappings":";;;AAWA,SAAgB,qBAAqB,GAAkB,GAAyB;CAC9E,IAAMA,IAASC,EAAQ,QAAQ,IAAI,QAAQ;CAE3C,IADID,MAAW,QAAQ,CAACE,EAAO,eAAe,IAAIF,CAAM,KACpDC,EAAQ,QAAQ,IAAA,mBAAyB,MAAM,KAAK,MAAME,EAAU;AAC1E;AAGA,SAAgB,YAAY,GAAkB,GAA2C;CACvF,IAAMH,IAASC,EAAQ,QAAQ,IAAI,QAAQ;CAE3C,OADID,MAAW,QAAQ,CAACE,EAAO,eAAe,IAAIF,CAAM,IAAU,CAAC,IAC5D;EACL,oCAAoC;EACpC,+BAA+BA;EAC/B,MAAM;CACR;AACF;AAGA,SAAgB,UAAU,GAAkB,GAA6B;CACvE,IAAMA,IAASC,EAAQ,QAAQ,IAAI,QAAQ;CAI3C,OAHID,MAAW,QAAQ,CAACE,EAAO,eAAe,IAAIF,CAAM,IAC/CI,EAAU,KAAK,aAAa,+BAA+B,OAAO,WAAW,CAAC,IAEhF,IAAI,SAAS,MAAM;EACxB,SAAS;GACP,oCAAoC;GAEpC,gCAAgC,iBAAiBC,EAAiB,IAAIC;GACtE,gCAAgC;GAChC,+BAA+BN;GAC/B,0BAA0B;GAC1B,MAAM;EACR;EACA,QAAQ;CACV,CAAC;AACH"}

package/dist/worker/_pagination.cjs

@@ -1,2 +1,2 @@
-const e=require("../contract.cjs"),t=require("./http.cjs");let n=require("@vielzeug/spell");var encodeCursorValue=e=>{let t=new TextEncoder().encode(JSON.stringify(e));return btoa(Array.from(t,e=>String.fromCharCode(e)).join(``)).replaceAll(`+`,`-`).replaceAll(`/`,`_`).replaceAll(`=`,``)};function decodeCursorValue(n,r){if(n.length>e.ARCHIVE_LIMITS.cursorChars||!/^[A-Za-z0-9_-]+$/.test(n))throw t.badRequest();let i;try{let e=n.replaceAll(`-`,`+`).replaceAll(`_`,`/`),t=Uint8Array.from(atob(e+`=`.repeat((4-e.length%4)%4)),e=>e.charCodeAt(0));i=JSON.parse(new TextDecoder(`utf-8`,{fatal:!0}).decode(t))}catch{throw t.badRequest()}let a=r.safeParse(i);if(!a.success||encodeCursorValue(i)!==n)throw t.badRequest();return a.data}var r=n.s.object({context:n.s.string(),createdAt:e.isoTimestampSchema,id:e.uuidSchema,likeCount:n.s.number().int().min(0).max(2**53-1).optional()});function forwardPageParams(n,i){let a=n.get(`limit`),o=a===null?e.ARCHIVE_LIMITS.pageSize:Number(a);if(!Number.isInteger(o)||o<1||o>e.ARCHIVE_LIMITS.maxPageSize)throw t.badRequest();let s=n.get(`cursor`),c=s===null?null:decodeCursorValue(s,r);if(c!==null&&c.context!==i)throw t.badRequest();return{cursor:c,limit:o}}function forwardPage(e,n,r=[]){let i=t.queryParams(new URL(e.url),[`cursor`,`limit`,...r]);return{...forwardPageParams(i,n),params:i}}var nextCursor=(e,t)=>encodeCursorValue({...e,context:t});exports.decodeCursorValue=decodeCursorValue,exports.encodeCursorValue=encodeCursorValue,exports.forwardPage=forwardPage,exports.forwardPageParams=forwardPageParams,exports.nextCursor=nextCursor;
+const e=require("../_server/http.cjs"),t=require("../contract.cjs");let n=require("@vielzeug/spell");var encodeCursorValue=e=>{let t=new TextEncoder().encode(JSON.stringify(e));return btoa(Array.from(t,e=>String.fromCharCode(e)).join(``)).replaceAll(`+`,`-`).replaceAll(`/`,`_`).replaceAll(`=`,``)};function decodeCursorValue(n,r){if(n.length>t.ARCHIVE_LIMITS.cursorChars||!/^[A-Za-z0-9_-]+$/.test(n))throw e.badRequest();let i;try{let e=n.replaceAll(`-`,`+`).replaceAll(`_`,`/`),t=Uint8Array.from(atob(e+`=`.repeat((4-e.length%4)%4)),e=>e.charCodeAt(0));i=JSON.parse(new TextDecoder(`utf-8`,{fatal:!0}).decode(t))}catch{throw e.badRequest()}let a=r.safeParse(i);if(!a.success||encodeCursorValue(i)!==n)throw e.badRequest();return a.data}var r=n.s.object({context:n.s.string(),createdAt:t.isoTimestampSchema,id:t.uuidSchema,likeCount:n.s.number().int().min(0).max(2**53-1).optional()});function forwardPageParams(n,i){let a=n.get(`limit`),o=a===null?t.ARCHIVE_LIMITS.pageSize:Number(a);if(!Number.isInteger(o)||o<1||o>t.ARCHIVE_LIMITS.maxPageSize)throw e.badRequest();let s=n.get(`cursor`),c=s===null?null:decodeCursorValue(s,r);if(c!==null&&c.context!==i)throw e.badRequest();return{cursor:c,limit:o}}function forwardPage(t,n,r=[]){let i=e.queryParams(new URL(t.url),[`cursor`,`limit`,...r]);return{...forwardPageParams(i,n),params:i}}var nextCursor=(e,t)=>encodeCursorValue({...e,context:t});exports.decodeCursorValue=decodeCursorValue,exports.encodeCursorValue=encodeCursorValue,exports.forwardPage=forwardPage,exports.forwardPageParams=forwardPageParams,exports.nextCursor=nextCursor;
 //# sourceMappingURL=_pagination.cjs.map

package/dist/worker/_pagination.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"_pagination.cjs","names":["ARCHIVE_LIMITS","badRequest","s","isoTimestampSchema","uuidSchema","queryParams","require_contract","require_http","_vielzeug_spell","bytes","value","byte","raw","base64","char","parsed","schema","forwardCursorSchema","rawLimit","params","limit","cursor","context","request","extra"],"sources":["../../src/worker/_pagination.ts"],"sourcesContent":["import { type Schema, s } from '@vielzeug/spell';\nimport { ARCHIVE_LIMITS, isoTimestampSchema, uuidSchema } from '../contract';\nimport { badRequest, queryParams } from './http';\n\n/**\n * The package's one pagination idiom: forward-only keyset pages. A cursor is an\n * opaque envelope of `{ context, createdAt, id, likeCount }` — `createdAt`/`id`\n * are the sort boundary (a timestamp and the row id), `likeCount` is the optional\n * extra sort field (the boundary count of the liked-sorted entry list), and\n * `context` names the query the cursor was minted for, so a cursor replayed under\n * a different query is a 400, never a silently wrong page.\n */\nexport const encodeCursorValue = (value: unknown): string => {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  return btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(''))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replaceAll('=', '');\n};\n\nexport function decodeCursorValue<T>(raw: string, schema: Schema<T>): T {\n  if (raw.length > ARCHIVE_LIMITS.cursorChars || !/^[A-Za-z0-9_-]+$/.test(raw)) throw badRequest();\n  let value: unknown;\n  try {\n    const base64 = raw.replaceAll('-', '+').replaceAll('_', '/');\n    const bytes = Uint8Array.from(atob(base64 + '='.repeat((4 - (base64.length % 4)) % 4)), (char) =>\n      char.charCodeAt(0),\n    );\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n  } catch {\n    throw badRequest();\n  }\n  const parsed = schema.safeParse(value);\n  if (!parsed.success || encodeCursorValue(value) !== raw) throw badRequest();\n  return parsed.data;\n}\n\n/** One keyset boundary: timestamp, row id, and the liked sort's boundary count. */\nexport interface ForwardCursor {\n  context: string;\n  createdAt: string;\n  id: string;\n  likeCount?: number;\n}\n\nconst forwardCursorSchema: Schema<ForwardCursor> = s.object({\n  context: s.string(),\n  createdAt: isoTimestampSchema,\n  id: uuidSchema,\n  // Only the liked-sorted entry list carries a boundary count; every other list\n  // omits the key entirely.\n  likeCount: s.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),\n});\n\n/** Parses `limit` and the forward cursor from an already allow-listed parameter set. */\nexport function forwardPageParams(params: URLSearchParams, context: string) {\n  const rawLimit = params.get('limit');\n  const limit = rawLimit === null ? ARCHIVE_LIMITS.pageSize : Number(rawLimit);\n  if (!Number.isInteger(limit) || limit < 1 || limit > ARCHIVE_LIMITS.maxPageSize) throw badRequest();\n  const raw = params.get('cursor');\n  const cursor = raw === null ? null : decodeCursorValue(raw, forwardCursorSchema);\n  if (cursor !== null && cursor.context !== context) throw badRequest();\n  return { cursor, limit };\n}\n\n/** Allow-lists the query, then parses `limit` and the forward cursor. */\nexport function forwardPage(request: Request, context: string, extra: readonly string[] = []) {\n  const params = queryParams(new URL(request.url), ['cursor', 'limit', ...extra]);\n  return { ...forwardPageParams(params, context), params };\n}\n\nexport const nextCursor = (cursor: Omit<ForwardCursor, 'context'>, context: string): string =>\n  encodeCursorValue({ ...cursor, context });\n"],"mappings":"A,4FAYA,IAAa,kBAAqB,GAA2B,CAC3D,IAAMS,EAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAUC,CAAK,CAAC,EAC5D,OAAO,KAAK,MAAM,KAAKD,EAAQ,GAAS,OAAO,aAAaE,CAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CACzE,WAAW,IAAK,GAAG,CAAC,CACpB,WAAW,IAAK,GAAG,CAAC,CACpB,WAAW,IAAK,EAAE,CACvB,EAEA,SAAgB,kBAAqB,EAAa,EAAsB,CACtE,GAAIC,EAAI,OAASZ,EAAAA,eAAe,aAAe,CAAC,mBAAmB,KAAKY,CAAG,EAAG,MAAMX,EAAAA,WAAW,EAC/F,IAAIS,EACJ,GAAI,CACF,IAAMG,EAASD,EAAI,WAAW,IAAK,GAAG,CAAC,CAAC,WAAW,IAAK,GAAG,EACrDH,EAAQ,WAAW,KAAK,KAAKI,EAAS,IAAI,QAAQ,EAAKA,EAAO,OAAS,GAAM,CAAC,CAAC,EAAI,GACvFC,EAAK,WAAW,CAAC,CACnB,EACA,EAAQ,KAAK,MAAM,IAAI,YAAY,QAAS,CAAE,MAAO,EAAK,CAAC,CAAC,CAAC,OAAOL,CAAK,CAAC,CAC5E,MAAQ,CACN,MAAMR,EAAAA,WAAW,CACnB,CACA,IAAMc,EAASC,EAAO,UAAUN,CAAK,EACrC,GAAI,CAACK,EAAO,SAAW,kBAAkBL,CAAK,IAAME,EAAK,MAAMX,EAAAA,WAAW,EAC1E,OAAOc,EAAO,IAChB,CAUA,IAAME,EAA6Cf,EAAAA,EAAE,OAAO,CAC1D,QAASA,EAAAA,EAAE,OAAO,EAClB,UAAWC,EAAAA,mBACX,GAAIC,EAAAA,WAGJ,UAAWF,EAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAA2B,CAAC,CAAC,SAAS,CAC3E,CAAC,EAGD,SAAgB,kBAAkB,EAAyB,EAAiB,CAC1E,IAAMgB,EAAWC,EAAO,IAAI,OAAO,EAC7BC,EAAQF,IAAa,KAAOlB,EAAAA,eAAe,SAAW,OAAOkB,CAAQ,EAC3E,GAAI,CAAC,OAAO,UAAUE,CAAK,GAAKA,EAAQ,GAAKA,EAAQpB,EAAAA,eAAe,YAAa,MAAMC,EAAAA,WAAW,EAClG,IAAMW,EAAMO,EAAO,IAAI,QAAQ,EACzBE,EAAST,IAAQ,KAAO,KAAO,kBAAkBA,EAAKK,CAAmB,EAC/E,GAAII,IAAW,MAAQA,EAAO,UAAYC,EAAS,MAAMrB,EAAAA,WAAW,EACpE,MAAO,CAAE,SAAQ,OAAM,CACzB,CAGA,SAAgB,YAAY,EAAkB,EAAiB,EAA2B,CAAC,EAAG,CAC5F,IAAMkB,EAASd,EAAAA,YAAY,IAAI,IAAIkB,EAAQ,GAAG,EAAG,CAAC,SAAU,QAAS,GAAGC,CAAK,CAAC,EAC9E,MAAO,CAAE,GAAG,kBAAkBL,EAAQG,CAAO,EAAG,QAAO,CACzD,CAEA,IAAa,YAAc,EAAwC,IACjE,kBAAkB,CAAE,GAAGD,EAAQ,SAAQ,CAAC,E"}
+{"version":3,"file":"_pagination.cjs","names":["ARCHIVE_LIMITS","badRequest","s","isoTimestampSchema","uuidSchema","queryParams","require_http","require_contract","_vielzeug_spell","bytes","value","byte","raw","base64","char","parsed","schema","forwardCursorSchema","rawLimit","params","limit","cursor","context","request","extra"],"sources":["../../src/worker/_pagination.ts"],"sourcesContent":["import { type Schema, s } from '@vielzeug/spell';\nimport { badRequest, queryParams } from '../_server/http';\nimport { ARCHIVE_LIMITS, isoTimestampSchema, uuidSchema } from '../contract';\n\n/**\n * The package's one pagination idiom: forward-only keyset pages. A cursor is an\n * opaque envelope of `{ context, createdAt, id, likeCount }` — `createdAt`/`id`\n * are the sort boundary (a timestamp and the row id), `likeCount` is the optional\n * extra sort field (the boundary count of the liked-sorted entry list), and\n * `context` names the query the cursor was minted for, so a cursor replayed under\n * a different query is a 400, never a silently wrong page.\n */\nexport const encodeCursorValue = (value: unknown): string => {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  return btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(''))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replaceAll('=', '');\n};\n\nexport function decodeCursorValue<T>(raw: string, schema: Schema<T>): T {\n  if (raw.length > ARCHIVE_LIMITS.cursorChars || !/^[A-Za-z0-9_-]+$/.test(raw)) throw badRequest();\n  let value: unknown;\n  try {\n    const base64 = raw.replaceAll('-', '+').replaceAll('_', '/');\n    const bytes = Uint8Array.from(atob(base64 + '='.repeat((4 - (base64.length % 4)) % 4)), (char) =>\n      char.charCodeAt(0),\n    );\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n  } catch {\n    throw badRequest();\n  }\n  const parsed = schema.safeParse(value);\n  if (!parsed.success || encodeCursorValue(value) !== raw) throw badRequest();\n  return parsed.data;\n}\n\n/** One keyset boundary: timestamp, row id, and the liked sort's boundary count. */\nexport interface ForwardCursor {\n  context: string;\n  createdAt: string;\n  id: string;\n  likeCount?: number;\n}\n\nconst forwardCursorSchema: Schema<ForwardCursor> = s.object({\n  context: s.string(),\n  createdAt: isoTimestampSchema,\n  id: uuidSchema,\n  // Only the liked-sorted entry list carries a boundary count; every other list\n  // omits the key entirely.\n  likeCount: s.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),\n});\n\n/** Parses `limit` and the forward cursor from an already allow-listed parameter set. */\nexport function forwardPageParams(params: URLSearchParams, context: string) {\n  const rawLimit = params.get('limit');\n  const limit = rawLimit === null ? ARCHIVE_LIMITS.pageSize : Number(rawLimit);\n  if (!Number.isInteger(limit) || limit < 1 || limit > ARCHIVE_LIMITS.maxPageSize) throw badRequest();\n  const raw = params.get('cursor');\n  const cursor = raw === null ? null : decodeCursorValue(raw, forwardCursorSchema);\n  if (cursor !== null && cursor.context !== context) throw badRequest();\n  return { cursor, limit };\n}\n\n/** Allow-lists the query, then parses `limit` and the forward cursor. */\nexport function forwardPage(request: Request, context: string, extra: readonly string[] = []) {\n  const params = queryParams(new URL(request.url), ['cursor', 'limit', ...extra]);\n  return { ...forwardPageParams(params, context), params };\n}\n\nexport const nextCursor = (cursor: Omit<ForwardCursor, 'context'>, context: string): string =>\n  encodeCursorValue({ ...cursor, context });\n"],"mappings":"A,qGAYA,IAAa,kBAAqB,GAA2B,CAC3D,IAAMS,EAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAUC,CAAK,CAAC,EAC5D,OAAO,KAAK,MAAM,KAAKD,EAAQ,GAAS,OAAO,aAAaE,CAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CACzE,WAAW,IAAK,GAAG,CAAC,CACpB,WAAW,IAAK,GAAG,CAAC,CACpB,WAAW,IAAK,EAAE,CACvB,EAEA,SAAgB,kBAAqB,EAAa,EAAsB,CACtE,GAAIC,EAAI,OAASZ,EAAAA,eAAe,aAAe,CAAC,mBAAmB,KAAKY,CAAG,EAAG,MAAMX,EAAAA,WAAW,EAC/F,IAAIS,EACJ,GAAI,CACF,IAAMG,EAASD,EAAI,WAAW,IAAK,GAAG,CAAC,CAAC,WAAW,IAAK,GAAG,EACrDH,EAAQ,WAAW,KAAK,KAAKI,EAAS,IAAI,QAAQ,EAAKA,EAAO,OAAS,GAAM,CAAC,CAAC,EAAI,GACvFC,EAAK,WAAW,CAAC,CACnB,EACA,EAAQ,KAAK,MAAM,IAAI,YAAY,QAAS,CAAE,MAAO,EAAK,CAAC,CAAC,CAAC,OAAOL,CAAK,CAAC,CAC5E,MAAQ,CACN,MAAMR,EAAAA,WAAW,CACnB,CACA,IAAMc,EAASC,EAAO,UAAUN,CAAK,EACrC,GAAI,CAACK,EAAO,SAAW,kBAAkBL,CAAK,IAAME,EAAK,MAAMX,EAAAA,WAAW,EAC1E,OAAOc,EAAO,IAChB,CAUA,IAAME,EAA6Cf,EAAAA,EAAE,OAAO,CAC1D,QAASA,EAAAA,EAAE,OAAO,EAClB,UAAWC,EAAAA,mBACX,GAAIC,EAAAA,WAGJ,UAAWF,EAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAA2B,CAAC,CAAC,SAAS,CAC3E,CAAC,EAGD,SAAgB,kBAAkB,EAAyB,EAAiB,CAC1E,IAAMgB,EAAWC,EAAO,IAAI,OAAO,EAC7BC,EAAQF,IAAa,KAAOlB,EAAAA,eAAe,SAAW,OAAOkB,CAAQ,EAC3E,GAAI,CAAC,OAAO,UAAUE,CAAK,GAAKA,EAAQ,GAAKA,EAAQpB,EAAAA,eAAe,YAAa,MAAMC,EAAAA,WAAW,EAClG,IAAMW,EAAMO,EAAO,IAAI,QAAQ,EACzBE,EAAST,IAAQ,KAAO,KAAO,kBAAkBA,EAAKK,CAAmB,EAC/E,GAAII,IAAW,MAAQA,EAAO,UAAYC,EAAS,MAAMrB,EAAAA,WAAW,EACpE,MAAO,CAAE,SAAQ,OAAM,CACzB,CAGA,SAAgB,YAAY,EAAkB,EAAiB,EAA2B,CAAC,EAAG,CAC5F,IAAMkB,EAASd,EAAAA,YAAY,IAAI,IAAIkB,EAAQ,GAAG,EAAG,CAAC,SAAU,QAAS,GAAGC,CAAK,CAAC,EAC9E,MAAO,CAAE,GAAG,kBAAkBL,EAAQG,CAAO,EAAG,QAAO,CACzD,CAEA,IAAa,YAAc,EAAwC,IACjE,kBAAkB,CAAE,GAAGD,EAAQ,SAAQ,CAAC,E"}

package/dist/worker/_pagination.js

@@ -1,49 +1,49 @@
-import { ARCHIVE_LIMITS as e, isoTimestampSchema as t, uuidSchema as n } from "../contract.js";
-import { badRequest as r, queryParams as i } from "./http.js";
+import { badRequest as e, queryParams as t } from "../_server/http.js";
+import { ARCHIVE_LIMITS as n, isoTimestampSchema as r, uuidSchema as i } from "../contract.js";
 import { s as a } from "@vielzeug/spell";
 // src/worker/_pagination.ts
 var encodeCursorValue = (e) => {
 	let t = new TextEncoder().encode(JSON.stringify(e));
 	return btoa(Array.from(t, (e) => String.fromCharCode(e)).join("")).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 };
-function decodeCursorValue(t, n) {
-	if (t.length > e.cursorChars || !/^[A-Za-z0-9_-]+$/.test(t)) throw r();
+function decodeCursorValue(t, r) {
+	if (t.length > n.cursorChars || !/^[A-Za-z0-9_-]+$/.test(t)) throw e();
 	let i;
 	try {
 		let e = t.replaceAll("-", "+").replaceAll("_", "/"), n = Uint8Array.from(atob(e + "=".repeat((4 - e.length % 4) % 4)), (e) => e.charCodeAt(0));
 		i = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(n));
 	} catch {
-		throw r();
+		throw e();
 	}
-	let a = n.safeParse(i);
-	if (!a.success || encodeCursorValue(i) !== t) throw r();
+	let a = r.safeParse(i);
+	if (!a.success || encodeCursorValue(i) !== t) throw e();
 	return a.data;
 }
 var o = a.object({
 	context: a.string(),
-	createdAt: t,
-	id: n,
+	createdAt: r,
+	id: i,
 	likeCount: a.number().int().min(0).max(2 ** 53 - 1).optional()
 });
-function forwardPageParams(t, n) {
-	let i = t.get("limit"), a = i === null ? e.pageSize : Number(i);
-	if (!Number.isInteger(a) || a < 1 || a > e.maxPageSize) throw r();
+function forwardPageParams(t, r) {
+	let i = t.get("limit"), a = i === null ? n.pageSize : Number(i);
+	if (!Number.isInteger(a) || a < 1 || a > n.maxPageSize) throw e();
 	let s = t.get("cursor"), c = s === null ? null : decodeCursorValue(s, o);
-	if (c !== null && c.context !== n) throw r();
+	if (c !== null && c.context !== r) throw e();
 	return {
 		cursor: c,
 		limit: a
 	};
 }
-function forwardPage(e, t, n = []) {
-	let r = i(new URL(e.url), [
+function forwardPage(e, n, r = []) {
+	let i = t(new URL(e.url), [
 		"cursor",
 		"limit",
-		...n
+		...r
 	]);
 	return {
-		...forwardPageParams(r, t),
-		params: r
+		...forwardPageParams(i, n),
+		params: i
 	};
 }
 var nextCursor = (e, t) => encodeCursorValue({

package/dist/worker/_pagination.js.map

@@ -1 +1 @@
-{"version":3,"file":"_pagination.js","names":["bytes","value","byte","raw","ARCHIVE_LIMITS","badRequest","base64","char","parsed","schema","forwardCursorSchema","s","isoTimestampSchema","uuidSchema","rawLimit","params","limit","cursor","context","queryParams","request","extra"],"sources":["../../src/worker/_pagination.ts"],"sourcesContent":["import { type Schema, s } from '@vielzeug/spell';\nimport { ARCHIVE_LIMITS, isoTimestampSchema, uuidSchema } from '../contract';\nimport { badRequest, queryParams } from './http';\n\n/**\n * The package's one pagination idiom: forward-only keyset pages. A cursor is an\n * opaque envelope of `{ context, createdAt, id, likeCount }` — `createdAt`/`id`\n * are the sort boundary (a timestamp and the row id), `likeCount` is the optional\n * extra sort field (the boundary count of the liked-sorted entry list), and\n * `context` names the query the cursor was minted for, so a cursor replayed under\n * a different query is a 400, never a silently wrong page.\n */\nexport const encodeCursorValue = (value: unknown): string => {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  return btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(''))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replaceAll('=', '');\n};\n\nexport function decodeCursorValue<T>(raw: string, schema: Schema<T>): T {\n  if (raw.length > ARCHIVE_LIMITS.cursorChars || !/^[A-Za-z0-9_-]+$/.test(raw)) throw badRequest();\n  let value: unknown;\n  try {\n    const base64 = raw.replaceAll('-', '+').replaceAll('_', '/');\n    const bytes = Uint8Array.from(atob(base64 + '='.repeat((4 - (base64.length % 4)) % 4)), (char) =>\n      char.charCodeAt(0),\n    );\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n  } catch {\n    throw badRequest();\n  }\n  const parsed = schema.safeParse(value);\n  if (!parsed.success || encodeCursorValue(value) !== raw) throw badRequest();\n  return parsed.data;\n}\n\n/** One keyset boundary: timestamp, row id, and the liked sort's boundary count. */\nexport interface ForwardCursor {\n  context: string;\n  createdAt: string;\n  id: string;\n  likeCount?: number;\n}\n\nconst forwardCursorSchema: Schema<ForwardCursor> = s.object({\n  context: s.string(),\n  createdAt: isoTimestampSchema,\n  id: uuidSchema,\n  // Only the liked-sorted entry list carries a boundary count; every other list\n  // omits the key entirely.\n  likeCount: s.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),\n});\n\n/** Parses `limit` and the forward cursor from an already allow-listed parameter set. */\nexport function forwardPageParams(params: URLSearchParams, context: string) {\n  const rawLimit = params.get('limit');\n  const limit = rawLimit === null ? ARCHIVE_LIMITS.pageSize : Number(rawLimit);\n  if (!Number.isInteger(limit) || limit < 1 || limit > ARCHIVE_LIMITS.maxPageSize) throw badRequest();\n  const raw = params.get('cursor');\n  const cursor = raw === null ? null : decodeCursorValue(raw, forwardCursorSchema);\n  if (cursor !== null && cursor.context !== context) throw badRequest();\n  return { cursor, limit };\n}\n\n/** Allow-lists the query, then parses `limit` and the forward cursor. */\nexport function forwardPage(request: Request, context: string, extra: readonly string[] = []) {\n  const params = queryParams(new URL(request.url), ['cursor', 'limit', ...extra]);\n  return { ...forwardPageParams(params, context), params };\n}\n\nexport const nextCursor = (cursor: Omit<ForwardCursor, 'context'>, context: string): string =>\n  encodeCursorValue({ ...cursor, context });\n"],"mappings":";;;;AAYA,IAAa,qBAAqB,MAA2B;CAC3D,IAAMA,IAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAUC,CAAK,CAAC;CAC5D,OAAO,KAAK,MAAM,KAAKD,IAAQ,MAAS,OAAO,aAAaE,CAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CACzE,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,EAAE;AACvB;AAEA,SAAgB,kBAAqB,GAAa,GAAsB;CACtE,IAAIC,EAAI,SAASC,EAAe,eAAe,CAAC,mBAAmB,KAAKD,CAAG,GAAG,MAAME,EAAW;CAC/F,IAAIJ;CACJ,IAAI;EACF,IAAMK,IAASH,EAAI,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,GACrDH,IAAQ,WAAW,KAAK,KAAKM,IAAS,IAAI,QAAQ,IAAKA,EAAO,SAAS,KAAM,CAAC,CAAC,IAAI,MACvFC,EAAK,WAAW,CAAC,CACnB;EACA,IAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,GAAK,CAAC,CAAC,CAAC,OAAOP,CAAK,CAAC;CAC5E,QAAQ;EACN,MAAMK,EAAW;CACnB;CACA,IAAMG,IAASC,EAAO,UAAUR,CAAK;CACrC,IAAI,CAACO,EAAO,WAAW,kBAAkBP,CAAK,MAAME,GAAK,MAAME,EAAW;CAC1E,OAAOG,EAAO;AAChB;AAUA,IAAME,IAA6CC,EAAE,OAAO;CAC1D,SAASA,EAAE,OAAO;CAClB,WAAWC;CACX,IAAIC;CAGJ,WAAWF,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAA2B,CAAC,CAAC,SAAS;AAC3E,CAAC;AAGD,SAAgB,kBAAkB,GAAyB,GAAiB;CAC1E,IAAMG,IAAWC,EAAO,IAAI,OAAO,GAC7BC,IAAQF,MAAa,OAAOV,EAAe,WAAW,OAAOU,CAAQ;CAC3E,IAAI,CAAC,OAAO,UAAUE,CAAK,KAAKA,IAAQ,KAAKA,IAAQZ,EAAe,aAAa,MAAMC,EAAW;CAClG,IAAMF,IAAMY,EAAO,IAAI,QAAQ,GACzBE,IAASd,MAAQ,OAAO,OAAO,kBAAkBA,GAAKO,CAAmB;CAC/E,IAAIO,MAAW,QAAQA,EAAO,YAAYC,GAAS,MAAMb,EAAW;CACpE,OAAO;EAAE;EAAQ;CAAM;AACzB;AAGA,SAAgB,YAAY,GAAkB,GAAiB,IAA2B,CAAC,GAAG;CAC5F,IAAMU,IAASI,EAAY,IAAI,IAAIC,EAAQ,GAAG,GAAG;EAAC;EAAU;EAAS,GAAGC;CAAK,CAAC;CAC9E,OAAO;EAAE,GAAG,kBAAkBN,GAAQG,CAAO;EAAG;CAAO;AACzD;AAEA,IAAa,cAAc,GAAwC,MACjE,kBAAkB;CAAE,GAAGD;CAAQ;AAAQ,CAAC"}
+{"version":3,"file":"_pagination.js","names":["bytes","value","byte","raw","ARCHIVE_LIMITS","badRequest","base64","char","parsed","schema","forwardCursorSchema","s","isoTimestampSchema","uuidSchema","rawLimit","params","limit","cursor","context","queryParams","request","extra"],"sources":["../../src/worker/_pagination.ts"],"sourcesContent":["import { type Schema, s } from '@vielzeug/spell';\nimport { badRequest, queryParams } from '../_server/http';\nimport { ARCHIVE_LIMITS, isoTimestampSchema, uuidSchema } from '../contract';\n\n/**\n * The package's one pagination idiom: forward-only keyset pages. A cursor is an\n * opaque envelope of `{ context, createdAt, id, likeCount }` — `createdAt`/`id`\n * are the sort boundary (a timestamp and the row id), `likeCount` is the optional\n * extra sort field (the boundary count of the liked-sorted entry list), and\n * `context` names the query the cursor was minted for, so a cursor replayed under\n * a different query is a 400, never a silently wrong page.\n */\nexport const encodeCursorValue = (value: unknown): string => {\n  const bytes = new TextEncoder().encode(JSON.stringify(value));\n  return btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(''))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replaceAll('=', '');\n};\n\nexport function decodeCursorValue<T>(raw: string, schema: Schema<T>): T {\n  if (raw.length > ARCHIVE_LIMITS.cursorChars || !/^[A-Za-z0-9_-]+$/.test(raw)) throw badRequest();\n  let value: unknown;\n  try {\n    const base64 = raw.replaceAll('-', '+').replaceAll('_', '/');\n    const bytes = Uint8Array.from(atob(base64 + '='.repeat((4 - (base64.length % 4)) % 4)), (char) =>\n      char.charCodeAt(0),\n    );\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));\n  } catch {\n    throw badRequest();\n  }\n  const parsed = schema.safeParse(value);\n  if (!parsed.success || encodeCursorValue(value) !== raw) throw badRequest();\n  return parsed.data;\n}\n\n/** One keyset boundary: timestamp, row id, and the liked sort's boundary count. */\nexport interface ForwardCursor {\n  context: string;\n  createdAt: string;\n  id: string;\n  likeCount?: number;\n}\n\nconst forwardCursorSchema: Schema<ForwardCursor> = s.object({\n  context: s.string(),\n  createdAt: isoTimestampSchema,\n  id: uuidSchema,\n  // Only the liked-sorted entry list carries a boundary count; every other list\n  // omits the key entirely.\n  likeCount: s.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),\n});\n\n/** Parses `limit` and the forward cursor from an already allow-listed parameter set. */\nexport function forwardPageParams(params: URLSearchParams, context: string) {\n  const rawLimit = params.get('limit');\n  const limit = rawLimit === null ? ARCHIVE_LIMITS.pageSize : Number(rawLimit);\n  if (!Number.isInteger(limit) || limit < 1 || limit > ARCHIVE_LIMITS.maxPageSize) throw badRequest();\n  const raw = params.get('cursor');\n  const cursor = raw === null ? null : decodeCursorValue(raw, forwardCursorSchema);\n  if (cursor !== null && cursor.context !== context) throw badRequest();\n  return { cursor, limit };\n}\n\n/** Allow-lists the query, then parses `limit` and the forward cursor. */\nexport function forwardPage(request: Request, context: string, extra: readonly string[] = []) {\n  const params = queryParams(new URL(request.url), ['cursor', 'limit', ...extra]);\n  return { ...forwardPageParams(params, context), params };\n}\n\nexport const nextCursor = (cursor: Omit<ForwardCursor, 'context'>, context: string): string =>\n  encodeCursorValue({ ...cursor, context });\n"],"mappings":";;;;AAYA,IAAa,qBAAqB,MAA2B;CAC3D,IAAMA,IAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAUC,CAAK,CAAC;CAC5D,OAAO,KAAK,MAAM,KAAKD,IAAQ,MAAS,OAAO,aAAaE,CAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CACzE,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,GAAG,CAAC,CACpB,WAAW,KAAK,EAAE;AACvB;AAEA,SAAgB,kBAAqB,GAAa,GAAsB;CACtE,IAAIC,EAAI,SAASC,EAAe,eAAe,CAAC,mBAAmB,KAAKD,CAAG,GAAG,MAAME,EAAW;CAC/F,IAAIJ;CACJ,IAAI;EACF,IAAMK,IAASH,EAAI,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,GACrDH,IAAQ,WAAW,KAAK,KAAKM,IAAS,IAAI,QAAQ,IAAKA,EAAO,SAAS,KAAM,CAAC,CAAC,IAAI,MACvFC,EAAK,WAAW,CAAC,CACnB;EACA,IAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,GAAK,CAAC,CAAC,CAAC,OAAOP,CAAK,CAAC;CAC5E,QAAQ;EACN,MAAMK,EAAW;CACnB;CACA,IAAMG,IAASC,EAAO,UAAUR,CAAK;CACrC,IAAI,CAACO,EAAO,WAAW,kBAAkBP,CAAK,MAAME,GAAK,MAAME,EAAW;CAC1E,OAAOG,EAAO;AAChB;AAUA,IAAME,IAA6CC,EAAE,OAAO;CAC1D,SAASA,EAAE,OAAO;CAClB,WAAWC;CACX,IAAIC;CAGJ,WAAWF,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAA2B,CAAC,CAAC,SAAS;AAC3E,CAAC;AAGD,SAAgB,kBAAkB,GAAyB,GAAiB;CAC1E,IAAMG,IAAWC,EAAO,IAAI,OAAO,GAC7BC,IAAQF,MAAa,OAAOV,EAAe,WAAW,OAAOU,CAAQ;CAC3E,IAAI,CAAC,OAAO,UAAUE,CAAK,KAAKA,IAAQ,KAAKA,IAAQZ,EAAe,aAAa,MAAMC,EAAW;CAClG,IAAMF,IAAMY,EAAO,IAAI,QAAQ,GACzBE,IAASd,MAAQ,OAAO,OAAO,kBAAkBA,GAAKO,CAAmB;CAC/E,IAAIO,MAAW,QAAQA,EAAO,YAAYC,GAAS,MAAMb,EAAW;CACpE,OAAO;EAAE;EAAQ;CAAM;AACzB;AAGA,SAAgB,YAAY,GAAkB,GAAiB,IAA2B,CAAC,GAAG;CAC5F,IAAMU,IAASI,EAAY,IAAI,IAAIC,EAAQ,GAAG,GAAG;EAAC;EAAU;EAAS,GAAGC;CAAK,CAAC;CAC9E,OAAO;EAAE,GAAG,kBAAkBN,GAAQG,CAAO;EAAG;CAAO;AACzD;AAEA,IAAa,cAAc,GAAwC,MACjE,kBAAkB;CAAE,GAAGD;CAAQ;AAAQ,CAAC"}

package/dist/worker/auth.cjs

@@ -1,2 +1,2 @@
-const e=require("../contract.cjs"),t=require("./_service.cjs"),n=require("./http.cjs"),r=require("./sql.cjs");let i=require("jose");var a=e.SESSION_MAX_AGE_SECONDS,o=256,authUnavailable=()=>new n.ApiError(503,`auth-unavailable`,`Sign-in is currently unavailable.`);async function verifySession(s,c,l,u=!1){let d=n.sessionToken(s);if(d===null)return null;let f;try{f=(await(0,i.jwtVerify)(d,c.jwks,{algorithms:[`RS256`],audience:c.audience,clockTolerance:5,issuer:c.issuer,maxTokenAge:a,requiredClaims:[`sub`,`iss`,`aud`,`iat`,`exp`,`sessionVersion`]})).payload}catch(e){throw e instanceof i.errors.JWKSTimeout||e instanceof i.errors.JWKSInvalid||e instanceof i.errors.JWKSMultipleMatchingKeys?authUnavailable():e instanceof i.errors.JOSEError?n.unauthenticated():authUnavailable()}let p=f.sub,m=f.iss,h=f.iat,g=f.roles;if(!Number.isSafeInteger(f.sessionVersion)||f.sessionVersion<0)throw n.unauthenticated();let _=Array.isArray(g)&&g.includes(`archive-operator`);if(typeof p!=`string`||p.length===0||p.length>o||!e.isWellFormedText(p)||typeof m!=`string`||typeof h==`number`&&h*1e3>Date.now()+5e3||_&&(typeof h!=`number`||typeof f.exp!=`number`||f.exp-h>3600||Date.now()/1e3-h>3605))throw n.unauthenticated();if(!(u&&await l.DB.prepare(r.SQL.revokedSubject).bind(m,p,Date.now()).first()!==null))try{await t.serviceRequest(l.AUTH_ISSUER_SERVICE,new Request(new URL(`/api/v1/auth/session`,c.issuer),{headers:{cookie:`archive_session=${d}`},redirect:`manual`}),async t=>{let r=await t.json();if(t.status===200&&e.archiveOkSchema.safeParse(r).success)return;let i=e.archiveErrorResponseSchema.safeParse(r);throw t.status===401&&i.success&&i.data.error.code===`unauthenticated`?n.unauthenticated():authUnavailable()})}catch(e){throw e instanceof n.ApiError&&e.status===401?e:authUnavailable()}if(!u&&await l.DB.prepare(r.SQL.revokedSubject).bind(m,p,Date.now()).first()!==null)throw n.unauthenticated();let v=await l.DB.prepare(r.SQL.publisher).bind(m,p).first();return{operator:_,publisher:v===null?null:{displayName:v.display_name,id:v.id},subject:{issuer:m,subject:p}}}function requireSession(e){if(e===null)throw n.unauthenticated();return e}exports.requireSession=requireSession,exports.verifySession=verifySession;
+const e=require("../_server/http.cjs"),t=require("../_server/service.cjs"),n=require("../contract.cjs"),r=require("./sql.cjs");let i=require("jose");var a=n.SESSION_MAX_AGE_SECONDS,o=256,authUnavailable=()=>new e.ApiError(503,`auth-unavailable`,`Sign-in is currently unavailable.`);async function verifySession(s,c,l,u=!1){let d=e.sessionToken(s);if(d===null)return null;let f;try{f=(await(0,i.jwtVerify)(d,c.jwks,{algorithms:[`RS256`],audience:c.audience,clockTolerance:5,issuer:c.issuer,maxTokenAge:a,requiredClaims:[`sub`,`iss`,`aud`,`iat`,`exp`,`sessionVersion`]})).payload}catch(t){throw t instanceof i.errors.JWKSTimeout||t instanceof i.errors.JWKSInvalid||t instanceof i.errors.JWKSMultipleMatchingKeys?authUnavailable():t instanceof i.errors.JOSEError?e.unauthenticated():authUnavailable()}let p=f.sub,m=f.iss,h=f.iat,g=f.roles;if(!Number.isSafeInteger(f.sessionVersion)||f.sessionVersion<0)throw e.unauthenticated();let _=Array.isArray(g)&&g.includes(`archive-operator`);if(typeof p!=`string`||p.length===0||p.length>o||!n.isWellFormedText(p)||typeof m!=`string`||typeof h==`number`&&h*1e3>Date.now()+5e3||_&&(typeof h!=`number`||typeof f.exp!=`number`||f.exp-h>3600||Date.now()/1e3-h>3605))throw e.unauthenticated();if(!(u&&await l.DB.prepare(r.SQL.revokedSubject).bind(m,p,Date.now()).first()!==null))try{await t.serviceRequest(l.AUTH_ISSUER_SERVICE,new Request(new URL(`/api/v1/auth/session`,c.issuer),{headers:{cookie:`archive_session=${d}`},redirect:`manual`}),async t=>{let r=await t.json();if(t.status===200&&n.archiveOkSchema.safeParse(r).success)return;let i=n.archiveErrorResponseSchema.safeParse(r);throw t.status===401&&i.success&&i.data.error.code===`unauthenticated`?e.unauthenticated():authUnavailable()})}catch(t){throw t instanceof e.ApiError&&t.status===401?t:authUnavailable()}if(!u&&await l.DB.prepare(r.SQL.revokedSubject).bind(m,p,Date.now()).first()!==null)throw e.unauthenticated();let v=await l.DB.prepare(r.SQL.publisher).bind(m,p).first();return{operator:_,publisher:v===null?null:{displayName:v.display_name,id:v.id},subject:{issuer:m,subject:p}}}function requireSession(t){if(t===null)throw e.unauthenticated();return t}exports.requireSession=requireSession,exports.verifySession=verifySession;
 //# sourceMappingURL=auth.cjs.map

package/dist/worker/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.cjs","names":["SESSION_MAX_AGE_SECONDS","ApiError","sessionToken","jwtVerify","errors","unauthenticated","isWellFormedText","SQL","serviceRequest","archiveOkSchema","archiveErrorResponseSchema","require_contract","require__service","require_http","require_sql","jose","JWT_MAX_AGE_SECONDS","SUBJECT_MAX_CHARS","token","request","payload","config","error","subject","issuer","iat","roles","operator","allowErasureRetry","env","body","response","failure","row","session"],"sources":["../../src/worker/auth.ts"],"sourcesContent":["import { errors, type JWTPayload, jwtVerify } from 'jose';\nimport {\n  ARCHIVE_OPERATOR_ROLE,\n  archiveErrorResponseSchema,\n  archiveOkSchema,\n  isWellFormedText,\n  OPERATOR_SESSION_MAX_AGE_SECONDS,\n  SESSION_MAX_AGE_SECONDS,\n} from '../contract';\nimport { serviceRequest } from './_service';\nimport type { ApiConfig, ArchiveWorkerEnv } from './env';\nimport { ApiError, sessionToken, unauthenticated } from './http';\nimport { SQL } from './sql';\n\n/**\n * Session authentication. The Worker trusts exactly one source: the archive_session\n * HttpOnly cookie holding an RS256 JWT from the configured issuer. Tokens are verified\n * before any database read and are never echoed into DTOs; the publisher row maps the\n * opaque (issuer, subject) pair to the public publisher id. An optional `roles` claim\n * from the same trusted issuer grants operator authority (moderation routes).\n */\nexport interface VerifiedSubject {\n  issuer: string;\n  subject: string;\n}\n\nexport interface Publisher {\n  displayName: string;\n  id: string;\n}\n\nexport interface Session {\n  /** True only when the verified token's `roles` claim carries the operator role. */\n  operator: boolean;\n  /** The registered publisher row; null while the verified user has not registered. */\n  publisher: Publisher | null;\n  subject: VerifiedSubject;\n}\n\nconst JWT_MAX_AGE_SECONDS = SESSION_MAX_AGE_SECONDS;\nexport const JWT_CLOCK_TOLERANCE_SECONDS = 5;\nconst SUBJECT_MAX_CHARS = 256;\n\nconst authUnavailable = (): ApiError => new ApiError(503, 'auth-unavailable', 'Sign-in is currently unavailable.');\n\n/**\n * Verifies the session cookie; returns null for anonymous requests.\n * Token/signature/claim problems are 401; JWKS provider faults (fetch failure,\n * timeout, undecodable document) are 503 `auth-unavailable` — an outage is not a\n * reason to treat the caller as signed out.\n */\nexport async function verifySession(\n  request: Request,\n  config: ApiConfig,\n  env: ArchiveWorkerEnv,\n  allowErasureRetry = false,\n): Promise<Session | null> {\n  const token = sessionToken(request);\n  if (token === null) return null;\n\n  let payload: JWTPayload;\n  try {\n    const result = await jwtVerify(token, config.jwks, {\n      algorithms: ['RS256'],\n      audience: config.audience,\n      clockTolerance: JWT_CLOCK_TOLERANCE_SECONDS,\n      issuer: config.issuer,\n      maxTokenAge: JWT_MAX_AGE_SECONDS,\n      requiredClaims: ['sub', 'iss', 'aud', 'iat', 'exp', 'sessionVersion'],\n    });\n    payload = result.payload;\n  } catch (error) {\n    // Provider faults are 503: a JWKS outage must never read as a signed-out user.\n    if (\n      error instanceof errors.JWKSTimeout ||\n      error instanceof errors.JWKSInvalid ||\n      error instanceof errors.JWKSMultipleMatchingKeys\n    ) {\n      throw authUnavailable();\n    }\n    // Everything else in the JOSE family — malformed, expired, wrong alg/aud/iss,\n    // bad signature, no matching key — is a token problem.\n    if (error instanceof errors.JOSEError) throw unauthenticated();\n    // Network fetch failures surface outside the JOSE error family.\n    throw authUnavailable();\n  }\n  const subject = payload.sub;\n  const issuer = payload.iss;\n  const iat = payload.iat;\n  const roles = payload.roles;\n  if (!Number.isSafeInteger(payload.sessionVersion) || (payload.sessionVersion as number) < 0) throw unauthenticated();\n  // Least authority: a malformed roles claim grants nothing, and operator authority\n  // only ever comes from this verified, audience- and issuer-checked token.\n  const operator = Array.isArray(roles) && roles.includes(ARCHIVE_OPERATOR_ROLE);\n  // Malformed subjects must reject outright: lone surrogates/control characters\n  // could otherwise collapse distinct claims into the same stored identity.\n  if (\n    typeof subject !== 'string' ||\n    subject.length === 0 ||\n    subject.length > SUBJECT_MAX_CHARS ||\n    !isWellFormedText(subject)\n  ) {\n    throw unauthenticated();\n  }\n  if (typeof issuer !== 'string') throw unauthenticated();\n  // A token claiming to be issued in the future beyond clock tolerance is a claims failure.\n  if (typeof iat === 'number' && iat * 1000 > Date.now() + JWT_CLOCK_TOLERANCE_SECONDS * 1000) {\n    throw unauthenticated();\n  }\n  if (\n    operator &&\n    (typeof iat !== 'number' ||\n      typeof payload.exp !== 'number' ||\n      payload.exp - iat > OPERATOR_SESSION_MAX_AGE_SECONDS ||\n      Date.now() / 1000 - iat > OPERATOR_SESSION_MAX_AGE_SECONDS + JWT_CLOCK_TOLERANCE_SECONDS)\n  )\n    throw unauthenticated();\n\n  // Only a previously tombstoned principal can bypass live validation to finish\n  // partial erasure. Its profile cannot be re-created while the tombstone lives.\n  const erasureRetry =\n    allowErasureRetry && (await env.DB.prepare(SQL.revokedSubject).bind(issuer, subject, Date.now()).first()) !== null;\n  if (!erasureRetry) {\n    try {\n      await serviceRequest(\n        env.AUTH_ISSUER_SERVICE,\n        new Request(new URL('/api/v1/auth/session', config.issuer), {\n          headers: { cookie: `archive_session=${token}` },\n          redirect: 'manual',\n        }),\n        async (response) => {\n          const body: unknown = await response.json();\n          if (response.status === 200 && archiveOkSchema.safeParse(body).success) return;\n          const failure = archiveErrorResponseSchema.safeParse(body);\n          if (response.status === 401 && failure.success && failure.data.error.code === 'unauthenticated')\n            throw unauthenticated();\n          throw authUnavailable();\n        },\n      );\n    } catch (error) {\n      if (error instanceof ApiError && error.status === 401) throw error;\n      throw authUnavailable();\n    }\n  }\n  if (!allowErasureRetry) {\n    const revoked = await env.DB.prepare(SQL.revokedSubject).bind(issuer, subject, Date.now()).first();\n    if (revoked !== null) throw unauthenticated();\n  }\n  const row = await env.DB.prepare(SQL.publisher).bind(issuer, subject).first<{\n    display_name: string;\n    id: string;\n  }>();\n  return {\n    operator,\n    publisher: row === null ? null : { displayName: row.display_name, id: row.id },\n    subject: { issuer, subject },\n  };\n}\n\n/** Session required for private routes; anonymous gets 401. */\nexport function requireSession(session: Session | null): Session {\n  if (session === null) throw unauthenticated();\n  return session;\n}\n"],"mappings":"A,oIAuCA,IAAMgB,EAAsBhB,EAAAA,wBAEtBiB,EAAoB,IAEpB,oBAAkC,IAAIhB,EAAAA,SAAS,IAAK,mBAAoB,mCAAmC,EAQjH,eAAsB,cACpB,EACA,EACA,EACA,EAAoB,GACK,CACzB,IAAMiB,EAAQhB,EAAAA,aAAaiB,CAAO,EAClC,GAAID,IAAU,KAAM,OAAO,KAE3B,IAAIE,EACJ,GAAI,CASF,GAAU,MAAA,EARWjB,EAAAA,UAAAA,CAAUe,EAAOG,EAAO,KAAM,CACjD,WAAY,CAAC,OAAO,EACpB,SAAUA,EAAO,SACjB,eAAA,EACA,OAAQA,EAAO,OACf,YAAaL,EACb,eAAgB,CAAC,MAAO,MAAO,MAAO,MAAO,MAAO,gBAAgB,CACtE,CAAC,EAAA,CACgB,OACnB,OAASM,EAAO,CAad,MAVEA,aAAiBlB,EAAAA,OAAO,aACxBkB,aAAiBlB,EAAAA,OAAO,aACxBkB,aAAiBlB,EAAAA,OAAO,yBAElB,gBAAgB,EAIpBkB,aAAiBlB,EAAAA,OAAO,UAAiBC,EAAAA,gBAAgB,EAEvD,gBAAgB,CACxB,CACA,IAAMkB,EAAUH,EAAQ,IAClBI,EAASJ,EAAQ,IACjBK,EAAML,EAAQ,IACdM,EAAQN,EAAQ,MACtB,GAAI,CAAC,OAAO,cAAcA,EAAQ,cAAc,GAAMA,EAAQ,eAA4B,EAAG,MAAMf,EAAAA,gBAAgB,EAGnH,IAAMsB,EAAW,MAAM,QAAQD,CAAK,GAAKA,EAAM,SAAA,kBAA8B,EAgB7E,GAZE,OAAOH,GAAY,UACnBA,EAAQ,SAAW,GACnBA,EAAQ,OAASN,GACjB,CAACX,EAAAA,iBAAiBiB,CAAO,GAIvB,OAAOC,GAAW,UAElB,OAAOC,GAAQ,UAAYA,EAAM,IAAO,KAAK,IAAI,EAAA,KAInDE,IACC,OAAOF,GAAQ,UACd,OAAOL,EAAQ,KAAQ,UACvBA,EAAQ,IAAMK,EAAA,MACd,KAAK,IAAI,EAAI,IAAOA,EAAA,MAEtB,MAAMpB,EAAAA,gBAAgB,EAMxB,GAAI,EADFuB,GAAsB,MAAMC,EAAI,GAAG,QAAQtB,EAAAA,IAAI,cAAc,CAAC,CAAC,KAAKiB,EAAQD,EAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAO,MAE9G,GAAI,CACF,MAAMf,EAAAA,eACJqB,EAAI,oBACJ,IAAI,QAAQ,IAAI,IAAI,uBAAwBR,EAAO,MAAM,EAAG,CAC1D,QAAS,CAAE,OAAQ,mBAAmBH,GAAQ,EAC9C,SAAU,QACZ,CAAC,EACD,KAAO,IAAa,CAClB,IAAMY,EAAgB,MAAMC,EAAS,KAAK,EAC1C,GAAIA,EAAS,SAAW,KAAOtB,EAAAA,gBAAgB,UAAUqB,CAAI,CAAC,CAAC,QAAS,OACxE,IAAME,EAAUtB,EAAAA,2BAA2B,UAAUoB,CAAI,EAGzD,MAFIC,EAAS,SAAW,KAAOC,EAAQ,SAAWA,EAAQ,KAAK,MAAM,OAAS,kBACtE3B,EAAAA,gBAAgB,EAClB,gBAAgB,CACxB,CACF,CACF,OAASiB,EAAO,CAEd,MADIA,aAAiBrB,EAAAA,UAAYqB,EAAM,SAAW,IAAWA,EACvD,gBAAgB,CACxB,CAEF,GAAI,CAACM,GAEC,MADkBC,EAAI,GAAG,QAAQtB,EAAAA,IAAI,cAAc,CAAC,CAAC,KAAKiB,EAAQD,EAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IACjF,KAAM,MAAMlB,EAAAA,gBAAgB,EAE9C,IAAM4B,EAAM,MAAMJ,EAAI,GAAG,QAAQtB,EAAAA,IAAI,SAAS,CAAC,CAAC,KAAKiB,EAAQD,CAAO,CAAC,CAAC,MAGnE,EACH,MAAO,CACL,WACA,UAAWU,IAAQ,KAAO,KAAO,CAAE,YAAaA,EAAI,aAAc,GAAIA,EAAI,EAAG,EAC7E,QAAS,CAAE,SAAQ,SAAQ,CAC7B,CACF,CAGA,SAAgB,eAAe,EAAkC,CAC/D,GAAIC,IAAY,KAAM,MAAM7B,EAAAA,gBAAgB,EAC5C,OAAO6B,CACT,C"}
+{"version":3,"file":"auth.cjs","names":["SESSION_MAX_AGE_SECONDS","ApiError","sessionToken","jwtVerify","errors","unauthenticated","isWellFormedText","SQL","serviceRequest","archiveOkSchema","archiveErrorResponseSchema","require_http","require_service","require_contract","require_sql","jose","JWT_MAX_AGE_SECONDS","SUBJECT_MAX_CHARS","token","request","payload","config","error","subject","issuer","iat","roles","operator","allowErasureRetry","env","body","response","failure","row","session"],"sources":["../../src/worker/auth.ts"],"sourcesContent":["import { errors, type JWTPayload, jwtVerify } from 'jose';\nimport { ApiError, sessionToken, unauthenticated } from '../_server/http';\nimport { serviceRequest } from '../_server/service';\nimport {\n  ARCHIVE_OPERATOR_ROLE,\n  archiveErrorResponseSchema,\n  archiveOkSchema,\n  isWellFormedText,\n  OPERATOR_SESSION_MAX_AGE_SECONDS,\n  SESSION_MAX_AGE_SECONDS,\n} from '../contract';\nimport type { ApiConfig, ArchiveWorkerEnv } from './env';\nimport { SQL } from './sql';\n\n/**\n * Session authentication. The Worker trusts exactly one source: the archive_session\n * HttpOnly cookie holding an RS256 JWT from the configured issuer. Tokens are verified\n * before any database read and are never echoed into DTOs; the publisher row maps the\n * opaque (issuer, subject) pair to the public publisher id. An optional `roles` claim\n * from the same trusted issuer grants operator authority (moderation routes).\n */\nexport interface VerifiedSubject {\n  issuer: string;\n  subject: string;\n}\n\nexport interface Publisher {\n  displayName: string;\n  id: string;\n}\n\nexport interface Session {\n  /** True only when the verified token's `roles` claim carries the operator role. */\n  operator: boolean;\n  /** The registered publisher row; null while the verified user has not registered. */\n  publisher: Publisher | null;\n  subject: VerifiedSubject;\n}\n\nconst JWT_MAX_AGE_SECONDS = SESSION_MAX_AGE_SECONDS;\nexport const JWT_CLOCK_TOLERANCE_SECONDS = 5;\nconst SUBJECT_MAX_CHARS = 256;\n\nconst authUnavailable = (): ApiError => new ApiError(503, 'auth-unavailable', 'Sign-in is currently unavailable.');\n\n/**\n * Verifies the session cookie; returns null for anonymous requests.\n * Token/signature/claim problems are 401; JWKS provider faults (fetch failure,\n * timeout, undecodable document) are 503 `auth-unavailable` — an outage is not a\n * reason to treat the caller as signed out.\n */\nexport async function verifySession(\n  request: Request,\n  config: ApiConfig,\n  env: ArchiveWorkerEnv,\n  allowErasureRetry = false,\n): Promise<Session | null> {\n  const token = sessionToken(request);\n  if (token === null) return null;\n\n  let payload: JWTPayload;\n  try {\n    const result = await jwtVerify(token, config.jwks, {\n      algorithms: ['RS256'],\n      audience: config.audience,\n      clockTolerance: JWT_CLOCK_TOLERANCE_SECONDS,\n      issuer: config.issuer,\n      maxTokenAge: JWT_MAX_AGE_SECONDS,\n      requiredClaims: ['sub', 'iss', 'aud', 'iat', 'exp', 'sessionVersion'],\n    });\n    payload = result.payload;\n  } catch (error) {\n    // Provider faults are 503: a JWKS outage must never read as a signed-out user.\n    if (\n      error instanceof errors.JWKSTimeout ||\n      error instanceof errors.JWKSInvalid ||\n      error instanceof errors.JWKSMultipleMatchingKeys\n    ) {\n      throw authUnavailable();\n    }\n    // Everything else in the JOSE family — malformed, expired, wrong alg/aud/iss,\n    // bad signature, no matching key — is a token problem.\n    if (error instanceof errors.JOSEError) throw unauthenticated();\n    // Network fetch failures surface outside the JOSE error family.\n    throw authUnavailable();\n  }\n  const subject = payload.sub;\n  const issuer = payload.iss;\n  const iat = payload.iat;\n  const roles = payload.roles;\n  if (!Number.isSafeInteger(payload.sessionVersion) || (payload.sessionVersion as number) < 0) throw unauthenticated();\n  // Least authority: a malformed roles claim grants nothing, and operator authority\n  // only ever comes from this verified, audience- and issuer-checked token.\n  const operator = Array.isArray(roles) && roles.includes(ARCHIVE_OPERATOR_ROLE);\n  // Malformed subjects must reject outright: lone surrogates/control characters\n  // could otherwise collapse distinct claims into the same stored identity.\n  if (\n    typeof subject !== 'string' ||\n    subject.length === 0 ||\n    subject.length > SUBJECT_MAX_CHARS ||\n    !isWellFormedText(subject)\n  ) {\n    throw unauthenticated();\n  }\n  if (typeof issuer !== 'string') throw unauthenticated();\n  // A token claiming to be issued in the future beyond clock tolerance is a claims failure.\n  if (typeof iat === 'number' && iat * 1000 > Date.now() + JWT_CLOCK_TOLERANCE_SECONDS * 1000) {\n    throw unauthenticated();\n  }\n  if (\n    operator &&\n    (typeof iat !== 'number' ||\n      typeof payload.exp !== 'number' ||\n      payload.exp - iat > OPERATOR_SESSION_MAX_AGE_SECONDS ||\n      Date.now() / 1000 - iat > OPERATOR_SESSION_MAX_AGE_SECONDS + JWT_CLOCK_TOLERANCE_SECONDS)\n  )\n    throw unauthenticated();\n\n  // Only a previously tombstoned principal can bypass live validation to finish\n  // partial erasure. Its profile cannot be re-created while the tombstone lives.\n  const erasureRetry =\n    allowErasureRetry && (await env.DB.prepare(SQL.revokedSubject).bind(issuer, subject, Date.now()).first()) !== null;\n  if (!erasureRetry) {\n    try {\n      await serviceRequest(\n        env.AUTH_ISSUER_SERVICE,\n        new Request(new URL('/api/v1/auth/session', config.issuer), {\n          headers: { cookie: `archive_session=${token}` },\n          redirect: 'manual',\n        }),\n        async (response) => {\n          const body: unknown = await response.json();\n          if (response.status === 200 && archiveOkSchema.safeParse(body).success) return;\n          const failure = archiveErrorResponseSchema.safeParse(body);\n          if (response.status === 401 && failure.success && failure.data.error.code === 'unauthenticated')\n            throw unauthenticated();\n          throw authUnavailable();\n        },\n      );\n    } catch (error) {\n      if (error instanceof ApiError && error.status === 401) throw error;\n      throw authUnavailable();\n    }\n  }\n  if (!allowErasureRetry) {\n    const revoked = await env.DB.prepare(SQL.revokedSubject).bind(issuer, subject, Date.now()).first();\n    if (revoked !== null) throw unauthenticated();\n  }\n  const row = await env.DB.prepare(SQL.publisher).bind(issuer, subject).first<{\n    display_name: string;\n    id: string;\n  }>();\n  return {\n    operator,\n    publisher: row === null ? null : { displayName: row.display_name, id: row.id },\n    subject: { issuer, subject },\n  };\n}\n\n/** Session required for private routes; anonymous gets 401. */\nexport function requireSession(session: Session | null): Session {\n  if (session === null) throw unauthenticated();\n  return session;\n}\n"],"mappings":"A,qJAuCA,IAAMgB,EAAsBhB,EAAAA,wBAEtBiB,EAAoB,IAEpB,oBAAkC,IAAIhB,EAAAA,SAAS,IAAK,mBAAoB,mCAAmC,EAQjH,eAAsB,cACpB,EACA,EACA,EACA,EAAoB,GACK,CACzB,IAAMiB,EAAQhB,EAAAA,aAAaiB,CAAO,EAClC,GAAID,IAAU,KAAM,OAAO,KAE3B,IAAIE,EACJ,GAAI,CASF,GAAU,MAAA,EARWjB,EAAAA,UAAAA,CAAUe,EAAOG,EAAO,KAAM,CACjD,WAAY,CAAC,OAAO,EACpB,SAAUA,EAAO,SACjB,eAAA,EACA,OAAQA,EAAO,OACf,YAAaL,EACb,eAAgB,CAAC,MAAO,MAAO,MAAO,MAAO,MAAO,gBAAgB,CACtE,CAAC,EAAA,CACgB,OACnB,OAASM,EAAO,CAad,MAVEA,aAAiBlB,EAAAA,OAAO,aACxBkB,aAAiBlB,EAAAA,OAAO,aACxBkB,aAAiBlB,EAAAA,OAAO,yBAElB,gBAAgB,EAIpBkB,aAAiBlB,EAAAA,OAAO,UAAiBC,EAAAA,gBAAgB,EAEvD,gBAAgB,CACxB,CACA,IAAMkB,EAAUH,EAAQ,IAClBI,EAASJ,EAAQ,IACjBK,EAAML,EAAQ,IACdM,EAAQN,EAAQ,MACtB,GAAI,CAAC,OAAO,cAAcA,EAAQ,cAAc,GAAMA,EAAQ,eAA4B,EAAG,MAAMf,EAAAA,gBAAgB,EAGnH,IAAMsB,EAAW,MAAM,QAAQD,CAAK,GAAKA,EAAM,SAAA,kBAA8B,EAgB7E,GAZE,OAAOH,GAAY,UACnBA,EAAQ,SAAW,GACnBA,EAAQ,OAASN,GACjB,CAACX,EAAAA,iBAAiBiB,CAAO,GAIvB,OAAOC,GAAW,UAElB,OAAOC,GAAQ,UAAYA,EAAM,IAAO,KAAK,IAAI,EAAA,KAInDE,IACC,OAAOF,GAAQ,UACd,OAAOL,EAAQ,KAAQ,UACvBA,EAAQ,IAAMK,EAAA,MACd,KAAK,IAAI,EAAI,IAAOA,EAAA,MAEtB,MAAMpB,EAAAA,gBAAgB,EAMxB,GAAI,EADFuB,GAAsB,MAAMC,EAAI,GAAG,QAAQtB,EAAAA,IAAI,cAAc,CAAC,CAAC,KAAKiB,EAAQD,EAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAO,MAE9G,GAAI,CACF,MAAMf,EAAAA,eACJqB,EAAI,oBACJ,IAAI,QAAQ,IAAI,IAAI,uBAAwBR,EAAO,MAAM,EAAG,CAC1D,QAAS,CAAE,OAAQ,mBAAmBH,GAAQ,EAC9C,SAAU,QACZ,CAAC,EACD,KAAO,IAAa,CAClB,IAAMY,EAAgB,MAAMC,EAAS,KAAK,EAC1C,GAAIA,EAAS,SAAW,KAAOtB,EAAAA,gBAAgB,UAAUqB,CAAI,CAAC,CAAC,QAAS,OACxE,IAAME,EAAUtB,EAAAA,2BAA2B,UAAUoB,CAAI,EAGzD,MAFIC,EAAS,SAAW,KAAOC,EAAQ,SAAWA,EAAQ,KAAK,MAAM,OAAS,kBACtE3B,EAAAA,gBAAgB,EAClB,gBAAgB,CACxB,CACF,CACF,OAASiB,EAAO,CAEd,MADIA,aAAiBrB,EAAAA,UAAYqB,EAAM,SAAW,IAAWA,EACvD,gBAAgB,CACxB,CAEF,GAAI,CAACM,GAEC,MADkBC,EAAI,GAAG,QAAQtB,EAAAA,IAAI,cAAc,CAAC,CAAC,KAAKiB,EAAQD,EAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IACjF,KAAM,MAAMlB,EAAAA,gBAAgB,EAE9C,IAAM4B,EAAM,MAAMJ,EAAI,GAAG,QAAQtB,EAAAA,IAAI,SAAS,CAAC,CAAC,KAAKiB,EAAQD,CAAO,CAAC,CAAC,MAGnE,EACH,MAAO,CACL,WACA,UAAWU,IAAQ,KAAO,KAAO,CAAE,YAAaA,EAAI,aAAc,GAAIA,EAAI,EAAG,EAC7E,QAAS,CAAE,SAAQ,SAAQ,CAC7B,CACF,CAGA,SAAgB,eAAe,EAAkC,CAC/D,GAAIC,IAAY,KAAM,MAAM7B,EAAAA,gBAAgB,EAC5C,OAAO6B,CACT,C"}

package/dist/worker/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/worker/auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAIzD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,OAAO;IACtB,mFAAmF;IACnF,QAAQ,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;CAC1B;AAGD,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAK7C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,gBAAgB,EACrB,iBAAiB,UAAQ,GACxB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAqGzB;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAG/D"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/worker/auth.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAGzD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,OAAO;IACtB,mFAAmF;IACnF,QAAQ,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;CAC1B;AAGD,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAK7C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,gBAAgB,EACrB,iBAAiB,UAAQ,GACxB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAqGzB;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAG/D"}

package/dist/worker/auth.js

@@ -1,12 +1,12 @@
-import { SESSION_MAX_AGE_SECONDS as e, archiveErrorResponseSchema as t, archiveOkSchema as n, isWellFormedText as r } from "../contract.js";
-import { serviceRequest as i } from "./_service.js";
-import { ApiError as a, sessionToken as o, unauthenticated as s } from "./http.js";
+import { ApiError as e, sessionToken as t, unauthenticated as n } from "../_server/http.js";
+import { serviceRequest as r } from "../_server/service.js";
+import { SESSION_MAX_AGE_SECONDS as i, archiveErrorResponseSchema as a, archiveOkSchema as o, isWellFormedText as s } from "../contract.js";
 import { SQL as c } from "./sql.js";
 import { errors as l, jwtVerify as u } from "jose";
 // src/worker/auth.ts
-var d = e, f = 256, authUnavailable = () => new a(503, "auth-unavailable", "Sign-in is currently unavailable.");
-async function verifySession(e, p, m, h = !1) {
-	let g = o(e);
+var d = i, f = 256, authUnavailable = () => new e(503, "auth-unavailable", "Sign-in is currently unavailable.");
+async function verifySession(i, p, m, h = !1) {
+	let g = t(i);
 	if (g === null) return null;
 	let _;
 	try {
@@ -26,26 +26,26 @@ async function verifySession(e, p, m, h = !1) {
 			]
 		})).payload;
 	} catch (e) {
-		throw e instanceof l.JWKSTimeout || e instanceof l.JWKSInvalid || e instanceof l.JWKSMultipleMatchingKeys ? authUnavailable() : e instanceof l.JOSEError ? s() : authUnavailable();
+		throw e instanceof l.JWKSTimeout || e instanceof l.JWKSInvalid || e instanceof l.JWKSMultipleMatchingKeys ? authUnavailable() : e instanceof l.JOSEError ? n() : authUnavailable();
 	}
 	let v = _.sub, y = _.iss, b = _.iat, x = _.roles;
-	if (!Number.isSafeInteger(_.sessionVersion) || _.sessionVersion < 0) throw s();
+	if (!Number.isSafeInteger(_.sessionVersion) || _.sessionVersion < 0) throw n();
 	let S = Array.isArray(x) && x.includes("archive-operator");
-	if (typeof v != "string" || v.length === 0 || v.length > f || !r(v) || typeof y != "string" || typeof b == "number" && b * 1e3 > Date.now() + 5e3 || S && (typeof b != "number" || typeof _.exp != "number" || _.exp - b > 3600 || Date.now() / 1e3 - b > 3605)) throw s();
+	if (typeof v != "string" || v.length === 0 || v.length > f || !s(v) || typeof y != "string" || typeof b == "number" && b * 1e3 > Date.now() + 5e3 || S && (typeof b != "number" || typeof _.exp != "number" || _.exp - b > 3600 || Date.now() / 1e3 - b > 3605)) throw n();
 	if (!(h && await m.DB.prepare(c.revokedSubject).bind(y, v, Date.now()).first() !== null)) try {
-		await i(m.AUTH_ISSUER_SERVICE, new Request(new URL("/api/v1/auth/session", p.issuer), {
+		await r(m.AUTH_ISSUER_SERVICE, new Request(new URL("/api/v1/auth/session", p.issuer), {
 			headers: { cookie: `archive_session=${g}` },
 			redirect: "manual"
 		}), async (e) => {
-			let r = await e.json();
-			if (e.status === 200 && n.safeParse(r).success) return;
-			let i = t.safeParse(r);
-			throw e.status === 401 && i.success && i.data.error.code === "unauthenticated" ? s() : authUnavailable();
+			let t = await e.json();
+			if (e.status === 200 && o.safeParse(t).success) return;
+			let r = a.safeParse(t);
+			throw e.status === 401 && r.success && r.data.error.code === "unauthenticated" ? n() : authUnavailable();
 		});
-	} catch (e) {
-		throw e instanceof a && e.status === 401 ? e : authUnavailable();
+	} catch (t) {
+		throw t instanceof e && t.status === 401 ? t : authUnavailable();
 	}
-	if (!h && await m.DB.prepare(c.revokedSubject).bind(y, v, Date.now()).first() !== null) throw s();
+	if (!h && await m.DB.prepare(c.revokedSubject).bind(y, v, Date.now()).first() !== null) throw n();
 	let C = await m.DB.prepare(c.publisher).bind(y, v).first();
 	return {
 		operator: S,
@@ -60,7 +60,7 @@ async function verifySession(e, p, m, h = !1) {
 	};
 }
 function requireSession(e) {
-	if (e === null) throw s();
+	if (e === null) throw n();
 	return e;
 }
 export { requireSession, verifySession };