@voltro/plugin-auth-social 0.85.0 → 0.87.0

package/dist/index.js

@@ -1,721 +1,16 @@
-import { Effect as e } from "effect";
-import { definePlugin as t } from "@voltro/protocol";
-import { buildSetCookie as n, readCookie as r, timingSafeStringEqual as i } from "@voltro/protocol/session";
-import { createHash as a, createPrivateKey as o, randomBytes as s, sign as c } from "node:crypto";
-import { JwtVerifyError as l, verifyJwt as u } from "@voltro/protocol/jwt";
-import { issueUserSession as d, newAuthId as f, runSubjectGuards as p } from "@voltro/plugin-auth";
-import { and as m, boolean as h, eq as g, generateId as _, id as v, table as y, text as b, timestamp as x } from "@voltro/database";
-//#region src/pkce.ts
-var S = () => s(32).toString("base64url"), ee = (e) => a("sha256").update(e, "ascii").digest().toString("base64url"), C = class extends Error {
-	status;
-	code;
-	constructor(e, t, n) {
-		super(n), this.status = e, this.code = t, this.name = "SocialAuthError";
-	}
-}, w = class extends C {
-	constructor(e) {
-		super(400, "state_mismatch", e), this.name = "SocialStateMismatchError";
-	}
-}, T = class extends C {
-	constructor(e, t, n = 502) {
-		super(n, e, t), this.name = "SocialExchangeError";
-	}
-}, E = class extends C {
-	constructor(e, t) {
-		super(401, e, t), this.name = "SocialIdTokenError";
-	}
-}, D = class extends C {
-	constructor(e) {
-		super(500, "config", e), this.name = "SocialConfigError";
-	}
-}, O = class extends C {
-	constructor(e, t, n = 409) {
-		super(n, e, t), this.name = "SocialAccountLinkError";
-	}
-}, te = {
-	id: "google",
-	label: "Google",
-	authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-	tokenUrl: "https://oauth2.googleapis.com/token",
-	jwksUrl: "https://www.googleapis.com/oauth2/v3/certs",
-	issuer: "https://accounts.google.com",
-	apiBase: null,
-	defaultScopes: [
-		"openid",
-		"email",
-		"profile"
-	],
-	kind: "oidc",
-	responseMode: "query",
-	assertsEmailVerification: !0,
-	pkceEnforced: !0
-}, ne = {
-	id: "github",
-	label: "GitHub",
-	authorizeUrl: "https://github.com/login/oauth/authorize",
-	tokenUrl: "https://github.com/login/oauth/access_token",
-	jwksUrl: null,
-	issuer: null,
-	apiBase: "https://api.github.com",
-	defaultScopes: ["read:user", "user:email"],
-	kind: "oauth2",
-	responseMode: "query",
-	assertsEmailVerification: !0,
-	pkceEnforced: !1
-}, k = {
-	id: "apple",
-	label: "Apple",
-	authorizeUrl: "https://appleid.apple.com/auth/authorize",
-	tokenUrl: "https://appleid.apple.com/auth/token",
-	jwksUrl: "https://appleid.apple.com/auth/keys",
-	issuer: "https://appleid.apple.com",
-	apiBase: null,
-	defaultScopes: ["name", "email"],
-	kind: "oidc",
-	responseMode: "form_post",
-	assertsEmailVerification: !0,
-	pkceEnforced: !0
-}, re = {
-	google: te,
-	github: ne,
-	apple: k
-}, ie = [
-	te,
-	ne,
-	k
-], A = [
-	"google",
-	"github",
-	"apple"
-], j = (e) => e === "google" || e === "github" || e === "apple", M = (e, t = {}) => {
-	if (!j(e)) throw new D(`unknown social provider '${e}' — expected one of ${A.join(", ")}`);
-	return {
-		...re[e],
-		...t.authorizeUrl === void 0 ? {} : { authorizeUrl: t.authorizeUrl },
-		...t.tokenUrl === void 0 ? {} : { tokenUrl: t.tokenUrl },
-		...t.jwksUrl === void 0 ? {} : { jwksUrl: t.jwksUrl },
-		...t.issuer === void 0 ? {} : { issuer: t.issuer },
-		...t.apiBase === void 0 ? {} : { apiBase: t.apiBase }
-	};
-}, N = (e) => {
-	if (!e.clientId) throw new D("socialBeginLogin: `clientId` is required");
-	if (!e.redirectUri) throw new D("socialBeginLogin: `redirectUri` is required");
-	let t = M(e.provider, e.endpoints ?? {}), n = e.randomness?.state ?? S(), r = e.randomness?.codeVerifier ?? S(), i = t.kind === "oidc" ? e.randomness?.nonce ?? S() : "", a = e.scopes ?? t.defaultScopes, o = new URLSearchParams({
-		client_id: e.clientId,
-		redirect_uri: e.redirectUri,
-		response_type: "code",
-		scope: a.join(" "),
-		state: n,
-		code_challenge: ee(r),
-		code_challenge_method: "S256"
-	});
-	return i && o.set("nonce", i), t.responseMode === "form_post" && o.set("response_mode", "form_post"), e.prompt && o.set("prompt", e.prompt), e.loginHint && o.set(t.id === "github" ? "login" : "login_hint", e.loginHint), {
-		provider: t.id,
-		url: `${t.authorizeUrl}?${o.toString()}`,
-		state: n,
-		codeVerifier: r,
-		nonce: i,
-		responseMode: t.responseMode
-	};
-}, P = 15777e3, ae = 900, oe = "https://appleid.apple.com", F = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64url"), I = /* @__PURE__ */ new Map(), se = (e) => {
-	let t = I.get(e);
-	if (t) return t;
-	let n;
-	try {
-		n = o({ key: e });
-	} catch (e) {
-		throw new D(`apple: could not parse the .p8 private key — ${e.message}`);
-	}
-	if (n.asymmetricKeyType !== "ec") throw new D(`apple: the .p8 key must be an EC (P-256) key, got '${String(n.asymmetricKeyType)}'`);
-	let r = n.asymmetricKeyDetails?.namedCurve;
-	if (r !== void 0 && r !== "prime256v1") throw new D(`apple: ES256 requires the P-256 curve (prime256v1), got '${r}'`);
-	return I.set(e, n), n;
-}, L = /* @__PURE__ */ new Map(), ce = () => {
-	I.clear(), L.clear();
-}, R = (e, t, n = Date.now) => {
-	if (!e) throw new D("apple: `clientId` (Services ID) is required");
-	if (!t.teamId) throw new D("apple: `teamId` is required");
-	if (!t.keyId) throw new D("apple: `keyId` is required");
-	if (!t.privateKey) throw new D("apple: `privateKey` (.p8 contents) is required");
-	let r = t.ttlSeconds ?? 900;
-	if (!Number.isFinite(r) || r <= 0) throw new D("apple: `ttlSeconds` must be a positive number");
-	if (r > 15777e3) throw new D(`apple: \`ttlSeconds\` may not exceed ${P} (six months, Apple's cap) — got ${r}`);
-	let i = n(), a = `${t.teamId}\u0000${t.keyId}\u0000${e}\u0000${r}`, o = L.get(a);
-	if (o && o.expiresAtMs - i > 6e4) return o.secret;
-	let s = Math.floor(i / 1e3), l = s + r, u = `${F(JSON.stringify({
-		alg: "ES256",
-		kid: t.keyId,
-		typ: "JWT"
-	}))}.${F(JSON.stringify({
-		iss: t.teamId,
-		iat: s,
-		exp: l,
-		aud: oe,
-		sub: e
-	}))}`, d = `${u}.${c("sha256", Buffer.from(u, "ascii"), {
-		key: se(t.privateKey),
-		dsaEncoding: "ieee-p1363"
-	}).toString("base64url")}`;
-	return L.set(a, {
-		secret: d,
-		expiresAtMs: l * 1e3
-	}), d;
-}, z = (e) => {
-	if (!e) return null;
-	let t;
-	try {
-		t = JSON.parse(e);
-	} catch {
-		return null;
-	}
-	if (typeof t != "object" || !t) return null;
-	let n = t, r = typeof n.name == "object" && n.name !== null ? n.name : {}, i = (e) => typeof e == "string" && e.length > 0 ? e : null, a = {
-		firstName: i(r.firstName),
-		lastName: i(r.lastName),
-		email: i(n.email)
-	};
-	return a.firstName === null && a.lastName === null && a.email === null ? null : a;
-}, B = (e) => e !== null && e.toLowerCase().endsWith("@privaterelay.appleid.com"), V = (e) => ({
-	authorization: `Bearer ${e}`,
-	accept: "application/vnd.github+json",
-	"x-github-api-version": "2022-11-28",
-	"user-agent": "voltro-plugin-auth-social"
-}), H = async (e, t) => {
-	let n = t.fetchImpl ?? fetch, r = await n(`${t.apiBase}/user`, { headers: V(e) });
-	if (!r.ok) {
-		let e = await r.text().catch(() => "");
-		throw new T("exchange_failed", `github: GET /user failed (${r.status}): ${e.slice(0, 200)}`);
-	}
-	let i = await r.json();
-	if (i.id === void 0 || i.id === null || !i.login) throw new T("malformed_token_response", "github: GET /user response is missing id/login");
-	let a = null, o = !1, s = await n(`${t.apiBase}/user/emails`, { headers: V(e) });
-	if (s.ok) {
-		let e = await s.json();
-		if (Array.isArray(e)) {
-			let t = e.find((e) => e.primary === !0 && typeof e.email == "string");
-			t?.email && (a = t.email, o = t.verified === !0);
-		}
-	}
-	return {
-		accountId: String(i.id),
-		login: i.login,
-		name: typeof i.name == "string" && i.name.length > 0 ? i.name : null,
-		avatarUrl: typeof i.avatar_url == "string" && i.avatar_url.length > 0 ? i.avatar_url : null,
-		email: a,
-		emailVerified: o
-	};
-}, U = (e) => e === !0 || e === "true", W = (e) => typeof e == "string" && e.length > 0 ? e : null, G = async (e) => {
-	let t = M(e.provider, e.endpoints ?? {});
-	if (!e.code) throw new C(400, "missing_code", "socialCompleteLogin: missing `code`");
-	if (!e.expectedState) throw new w("socialCompleteLogin: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
-	if (!e.state || !i(e.state, e.expectedState)) throw new w("socialCompleteLogin: `state` does not match the value minted for this browser (possible login CSRF).");
-	if (!e.codeVerifier) throw new C(400, "missing_verifier", "socialCompleteLogin: missing `codeVerifier` (PKCE)");
-	if (t.kind === "oidc" && !e.expectedNonce) throw new D(`socialCompleteLogin: ${t.id} returns an ID token, so \`expectedNonce\` is required — without it a token captured from another login replays here.`);
-	let n = t.id === "apple" ? R(e.clientId, e.appleKey ?? (() => {
-		throw new D("apple: `appleKey` (teamId + keyId + .p8) is required");
-	})(), e.now ?? Date.now) : e.clientSecret ?? (() => {
-		throw new D(`${t.id}: \`clientSecret\` is required`);
-	})(), r = e.fetchImpl ?? fetch, a = new URLSearchParams({
-		grant_type: "authorization_code",
-		client_id: e.clientId,
-		client_secret: n,
-		code: e.code,
-		redirect_uri: e.redirectUri,
-		code_verifier: e.codeVerifier
-	}), o = await r(t.tokenUrl, {
-		method: "POST",
-		headers: {
-			"content-type": "application/x-www-form-urlencoded",
-			accept: "application/json"
-		},
-		body: a.toString()
-	});
-	if (!o.ok) {
-		let e = await o.text().catch(() => "");
-		throw new T("exchange_failed", `${t.id}: token exchange failed (${o.status}): ${e.slice(0, 200)}`);
-	}
-	let s;
-	try {
-		s = await o.json();
-	} catch {
-		throw new T("malformed_token_response", `${t.id}: token endpoint returned a body that is not JSON`);
-	}
-	if (s.error) throw new T("exchange_failed", `${t.id}: token exchange refused: ${s.error}${s.error_description ? ` (${s.error_description})` : ""}`);
-	if (t.kind === "oauth2") {
-		if (!s.access_token) throw new T("malformed_token_response", `${t.id}: token response carries no access_token`);
-		if (!t.apiBase) throw new D(`${t.id}: no apiBase configured`);
-		let n = await H(s.access_token, {
-			apiBase: t.apiBase,
-			...e.fetchImpl === void 0 ? {} : { fetchImpl: e.fetchImpl }
-		});
-		return {
-			provider: t.id,
-			providerAccountId: n.accountId,
-			email: n.email,
-			emailVerified: n.emailVerified,
-			emailIsPrivateRelay: !1,
-			name: n.name ?? n.login,
-			firstName: null,
-			lastName: null,
-			avatarUrl: n.avatarUrl,
-			nameIsFirstAuthorizationOnly: !1,
-			raw: { ...n }
-		};
-	}
-	if (!s.id_token) throw new T("malformed_token_response", `${t.id}: token response carries no id_token`);
-	if (!t.jwksUrl || !t.issuer) throw new D(`${t.id}: no JWKS/issuer configured`);
-	let c;
-	try {
-		c = await u(s.id_token, t.jwksUrl, {
-			issuer: t.issuer,
-			audience: e.clientId
-		});
-	} catch (e) {
-		throw e instanceof l ? new E("id_token_invalid", `${t.id}: id_token ${e.code}: ${e.message}`) : new E("id_token_invalid", `${t.id}: id_token verification failed: ${e.message}`);
-	}
-	let d = W(c.nonce);
-	if (!d || !i(d, e.expectedNonce ?? "")) throw new E("nonce_mismatch", `${t.id}: id_token nonce does not match the value minted for this login (possible replay).`);
-	let f = W(c.sub);
-	if (!f) throw new E("id_token_invalid", `${t.id}: id_token has no sub claim`);
-	let p = W(c.email), m = U(c.email_verified);
-	if (t.id === "apple") {
-		let t = z(e.appleUserPayload), n = U(c.is_private_email) || B(p), r = t?.firstName ?? null, i = t?.lastName ?? null, a = [r, i].filter((e) => e !== null).join(" ");
-		return {
-			provider: "apple",
-			providerAccountId: f,
-			email: p ?? t?.email ?? null,
-			emailVerified: m,
-			emailIsPrivateRelay: n,
-			name: a.length > 0 ? a : null,
-			firstName: r,
-			lastName: i,
-			avatarUrl: null,
-			nameIsFirstAuthorizationOnly: t !== null,
-			raw: c
-		};
-	}
-	return {
-		provider: t.id,
-		providerAccountId: f,
-		email: p,
-		emailVerified: m,
-		emailIsPrivateRelay: !1,
-		name: W(c.name),
-		firstName: W(c.given_name),
-		lastName: W(c.family_name),
-		avatarUrl: W(c.picture),
-		nameIsFirstAuthorizationOnly: !1,
-		raw: c
-	};
-}, K = (e) => {
-	let { profile: t, linkedUserId: n, existingUserIdByEmail: r, policy: i } = e;
-	return n === null ? t.email === null ? {
-		kind: "refuse",
-		error: new O("no_email", `${t.provider} did not return an email address for this account. Add and verify an email with the provider, or sign in another way.`, 400)
-	} : r === null ? { kind: "create-user" } : i === "never" ? {
-		kind: "refuse",
-		error: new O("account_exists_unlinked", `An account already exists for ${t.email}. Sign in with your existing method, then connect ${t.provider} from your account settings.`)
-	} : t.emailVerified ? t.emailIsPrivateRelay ? {
-		kind: "refuse",
-		error: new O("private_relay_email", "This is an Apple private-relay address, which is unique to this app and cannot identify an existing account. Sign in with your existing method, then connect Apple from your account settings.")
-	} : {
-		kind: "link",
-		userId: r
-	} : {
-		kind: "refuse",
-		error: new O("email_not_verified", `${t.provider} did not verify ownership of ${t.email}, so it cannot be attached to the existing account with that address.`)
-	} : {
-		kind: "sign-in",
-		userId: n
-	};
-}, q = (e) => ({
-	kind: "refused",
-	status: e.status,
-	code: e.code,
-	message: e.message
-}), J = (t) => e.gen(function* () {
-	let { profile: n, identities: r, users: i, config: a } = t, o = t.policy ?? "never", s = yield* r.findByProviderAccount(n.provider, n.providerAccountId), c = n.email === null ? null : yield* i.findByEmail(n.email), l = K({
-		profile: n,
-		linkedUserId: s?.userId ?? null,
-		existingUserIdByEmail: c?.id ?? null,
-		policy: o
-	});
-	if (l.kind === "refuse") return q(l.error);
-	let u = null, m = !1, h = !1;
-	if (l.kind === "create-user") {
-		let t = n.email, r = yield* i.insert({
-			id: f("user"),
-			email: t,
-			passwordHash: null,
-			tenantId: a.defaultTenantId
-		}).pipe(e.catchTag("UserAlreadyExistsError", (t) => e.succeed(new O("account_exists_unlinked", `An account already exists for ${t.email}. Sign in with your existing method, then connect ${n.provider} from your account settings.`))));
-		if (r instanceof O) return q(r);
-		u = r, m = !0;
-	} else {
-		if (h = l.kind === "link", u = yield* i.findById(l.userId), !u) return q(new O("account_exists_unlinked", "The account this login is linked to no longer exists.", 409));
-		let e = a.subjectGuards ?? [];
-		if (e.length > 0) {
-			let t = yield* p(e, u);
-			if (!t.ok) return {
-				kind: "refused",
-				status: 403,
-				code: t.code,
-				message: t.message
-			};
-		}
-	}
-	s === null ? yield* r.insert({
-		userId: u.id,
-		provider: n.provider,
-		providerAccountId: n.providerAccountId,
-		email: n.email,
-		emailVerified: n.emailVerified
-	}) : yield* r.touch(s.id, /* @__PURE__ */ new Date());
-	let g = yield* d(u, i, a, {
-		ipAddress: t.ipAddress ?? null,
-		userAgent: t.userAgent ?? null
-	});
-	return {
-		kind: "ok",
-		userId: u.id,
-		subject: g.subject,
-		setCookie: g.setCookie,
-		created: m,
-		linked: h,
-		oneTimeName: n.nameIsFirstAuthorizationOnly ? {
-			firstName: n.firstName,
-			lastName: n.lastName
-		} : null
-	};
-}), Y = "_voltro_oauth_identities", le = y(Y, {
-	id: v({ prefix: "oauthid" }),
-	userId: b(),
-	provider: b(),
-	providerAccountId: b(),
-	email: b().nullable(),
-	emailVerified: h().default(!1),
-	createdAt: x().default("now"),
-	lastLoginAt: x().nullable()
-}).unique("byOauthProviderAccount", ["provider", "providerAccountId"]).index(["userId"]), ue = [le], de = () => _({
-	kind: "typeid",
-	prefix: "oauthid"
-}, "oauthid"), fe = (t = []) => {
-	let n = [...t];
-	return {
-		findByProviderAccount: (t, r) => e.sync(() => n.find((e) => e.provider === t && e.providerAccountId === r) ?? null),
-		listForUser: (t) => e.sync(() => n.filter((e) => e.userId === t)),
-		insert: (t) => e.sync(() => {
-			let e = {
-				...t,
-				id: de(),
-				createdAt: /* @__PURE__ */ new Date(),
-				lastLoginAt: null
-			};
-			return n.push(e), e;
-		}),
-		touch: (t, r) => e.sync(() => {
-			let e = n.findIndex((e) => e.id === t);
-			e >= 0 && (n[e] = {
-				...n[e],
-				lastLoginAt: r
-			});
-		}),
-		remove: (t, r) => e.sync(() => {
-			let e = n.findIndex((e) => e.userId === t && e.provider === r);
-			return e < 0 ? !1 : (n.splice(e, 1), !0);
-		})
-	};
-}, pe = (e) => {
-	if (e instanceof Date) return e;
-	if (typeof e == "string" || typeof e == "number") {
-		let t = new Date(e);
-		return Number.isNaN(t.getTime()) ? null : t;
-	}
-	return null;
-}, X = (e) => ({
-	id: String(e.id ?? ""),
-	userId: String(e.userId ?? ""),
-	provider: String(e.provider ?? ""),
-	providerAccountId: String(e.providerAccountId ?? ""),
-	email: typeof e.email == "string" && e.email.length > 0 ? e.email : null,
-	emailVerified: e.emailVerified === !0 || e.emailVerified === 1,
-	createdAt: pe(e.createdAt) ?? /* @__PURE__ */ new Date(0),
-	lastLoginAt: pe(e.lastLoginAt)
-}), me = (t) => ({
-	findByProviderAccount: (n, r) => e.promise(async () => {
-		let e = (await t.query({
-			table: Y,
-			predicate: m(g("provider", n), g("providerAccountId", r)),
-			limit: 1
-		}))[0];
-		return e ? X(e) : null;
-	}),
-	listForUser: (n) => e.promise(async () => (await t.query({
-		table: Y,
-		predicate: g("userId", n),
-		order: [{
-			column: "createdAt",
-			direction: "asc"
-		}]
-	})).map(X)),
-	insert: (n) => e.promise(async () => X(await t.insert(Y, {
-		id: de(),
-		userId: n.userId,
-		provider: n.provider,
-		providerAccountId: n.providerAccountId,
-		email: n.email,
-		emailVerified: n.emailVerified,
-		createdAt: /* @__PURE__ */ new Date(),
-		lastLoginAt: null
-	}))),
-	touch: (n, r) => e.promise(async () => {
-		await t.update(Y, n, { lastLoginAt: r });
-	}),
-	remove: (n, r) => e.promise(async () => {
-		let e = (await t.query({
-			table: Y,
-			predicate: m(g("userId", n), g("provider", r)),
-			limit: 1
-		}))[0];
-		return e ? t.delete(Y, String(e.id ?? "")) : !1;
-	})
-}), he = (t, n, r) => e.gen(function* () {
-	let i = yield* t.findByProviderAccount(r.provider, r.providerAccountId);
-	return i ? i.userId === n ? i : yield* e.fail(/* @__PURE__ */ Error(`linkSocialIdentity: this ${r.provider} account is already linked to another user`)) : yield* t.insert({
-		...r,
-		userId: n
-	});
-}), ge = "/auth/social", _e = 600, ve = "voltro:oauth", Z = {
-	google: [{
-		name: "VOLTRO_GOOGLE_CLIENT_ID",
-		secret: !1,
-		description: "Google OAuth client id (…apps.googleusercontent.com)."
-	}, {
-		name: "VOLTRO_GOOGLE_CLIENT_SECRET",
-		secret: !0,
-		description: "Google OAuth client secret."
-	}],
-	github: [{
-		name: "VOLTRO_GITHUB_CLIENT_ID",
-		secret: !1,
-		description: "GitHub OAuth app client id."
-	}, {
-		name: "VOLTRO_GITHUB_CLIENT_SECRET",
-		secret: !0,
-		description: "GitHub OAuth app client secret."
-	}],
-	apple: [
-		{
-			name: "VOLTRO_APPLE_CLIENT_ID",
-			secret: !1,
-			description: "Apple Services ID, e.g. com.example.web."
-		},
-		{
-			name: "VOLTRO_APPLE_TEAM_ID",
-			secret: !1,
-			description: "Apple Developer Team ID (10 chars)."
-		},
-		{
-			name: "VOLTRO_APPLE_KEY_ID",
-			secret: !1,
-			description: "Key ID of the Sign-in-with-Apple .p8 key."
-		},
-		{
-			name: "VOLTRO_APPLE_PRIVATE_KEY",
-			secret: !0,
-			description: "Contents of the .p8 file (PKCS#8 PEM). Apple signs no static secret — this key mints one per exchange."
-		}
-	]
-}, Q = (e, t) => ({
-	status: e,
-	body: JSON.stringify(t),
-	contentType: "application/json; charset=utf-8"
-}), $ = (e, t) => ({
-	status: 302,
-	body: "",
-	contentType: "text/plain; charset=utf-8",
-	headers: {
-		location: e,
-		...t === void 0 ? {} : { "set-cookie": t }
-	}
-}), ye = (e) => Buffer.from(JSON.stringify(e), "utf8").toString("base64url"), be = (e) => {
-	if (!e) return null;
-	try {
-		let t = JSON.parse(Buffer.from(e, "base64url").toString("utf8"));
-		return typeof t.p != "string" || typeof t.s != "string" || typeof t.v != "string" || typeof t.n != "string" ? null : {
-			p: t.p,
-			s: t.s,
-			v: t.v,
-			n: t.n
-		};
-	} catch {
-		return null;
-	}
-}, xe = (e) => e.method === "POST" && (e.headers["content-type"] ?? "").includes("application/x-www-form-urlencoded") ? new URLSearchParams(Buffer.from(e.rawBody).toString("utf8")) : new URLSearchParams(e.query), Se = (i) => {
-	let a = i.prefix ?? ge, o = i.stateTtlSeconds ?? _e, s = i.stateCookieName ?? ve, c = i.linkPolicy ?? "never", l = i.auth.cookieSecure ?? !0, u = Object.keys(i.providers).filter(j);
-	if (u.length === 0) throw new D("socialAuthPlugin: `providers` is empty — enable at least one of google / github / apple");
-	let d = (i.appBaseUrl ?? i.auth.appBaseUrl ?? "").replace(/\/+$/, ""), f = (e) => {
-		let t = i.providers[e] ?? {}, n = process.env, r = t.clientId ?? n[Z[e][0].name] ?? "";
-		if (!r) throw new D(`socialAuthPlugin: ${e} has no client id — pass \`providers.${e}.clientId\` or set ${Z[e][0].name}`);
-		let o = t.redirectUri ?? `${d}${a}/${e}/callback`;
-		if (!o.startsWith("http")) throw new D(`socialAuthPlugin: ${e} needs an absolute redirect URI — set \`appBaseUrl\` (or \`providers.${e}.redirectUri\`)`);
-		let s = {
-			id: e,
-			clientId: r,
-			redirectUri: o,
-			endpoints: t.endpoints ?? {},
-			...t.scopes === void 0 ? {} : { scopes: t.scopes }
-		};
-		if (e === "apple") {
-			let e = t.appleKey ?? (n.VOLTRO_APPLE_TEAM_ID && n.VOLTRO_APPLE_KEY_ID && n.VOLTRO_APPLE_PRIVATE_KEY ? {
-				teamId: n.VOLTRO_APPLE_TEAM_ID,
-				keyId: n.VOLTRO_APPLE_KEY_ID,
-				privateKey: n.VOLTRO_APPLE_PRIVATE_KEY.replace(/\\n/g, "\n")
-			} : void 0);
-			if (!e) throw new D("socialAuthPlugin: apple needs `appleKey` (teamId + keyId + .p8) or VOLTRO_APPLE_TEAM_ID / VOLTRO_APPLE_KEY_ID / VOLTRO_APPLE_PRIVATE_KEY");
-			return {
-				...s,
-				appleKey: e
-			};
-		}
-		let c = t.clientSecret ?? n[Z[e][1].name] ?? "";
-		if (!c) throw new D(`socialAuthPlugin: ${e} has no client secret — pass \`providers.${e}.clientSecret\` or set ${Z[e][1].name}`);
-		return {
-			...s,
-			clientSecret: c
-		};
-	}, p = i.identities ?? null, m = (e) => {
-		if (p) return p;
-		let t = e.store;
-		if (!t) throw new D("socialAuthPlugin: no identity store — pass `identities`, or run on an app with a DataStore");
-		return p = me(t), p;
-	}, h = (e) => {
-		if (!e.startsWith(`${a}/`)) return null;
-		let [t, ...n] = e.slice(a.length + 1).split("/");
-		return !t || !j(t) || !u.includes(t) ? null : n.length === 0 ? {
-			id: t,
-			isCallback: !1
-		} : n.length === 1 && n[0] === "callback" ? {
-			id: t,
-			isCallback: !0
-		} : null;
-	}, g = (e, t, r) => {
-		if (!i.failureRedirect) return Q(e, {
-			error: t,
-			message: r
-		});
-		let o = i.failureRedirect.includes("?") ? "&" : "?";
-		return $(`${i.failureRedirect}${o}social_error=${encodeURIComponent(t)}`, n(s, "", {
-			maxAgeSeconds: 0,
-			path: a,
-			secure: l
-		}));
-	}, _ = (e, t) => {
-		let r = f(t), c = M(t, r.endpoints), u = N({
-			provider: t,
-			clientId: r.clientId,
-			redirectUri: r.redirectUri,
-			...r.scopes === void 0 ? {} : { scopes: r.scopes },
-			endpoints: r.endpoints,
-			...new URLSearchParams(e.query).get("login_hint") ? { loginHint: new URLSearchParams(e.query).get("login_hint") } : {}
-		}), d = n(s, ye({
-			p: t,
-			s: u.state,
-			v: u.codeVerifier,
-			n: u.nonce
-		}), {
-			maxAgeSeconds: o,
-			httpOnly: !0,
-			sameSite: c.responseMode === "form_post" ? "none" : "lax",
-			secure: c.responseMode === "form_post" || l,
-			...i.auth.cookieDomain ? { domain: i.auth.cookieDomain } : {},
-			path: a
-		});
-		return $(u.url, d);
-	}, v = async (t, o) => {
-		let u = xe(t), d = u.get("error");
-		if (d) return g(400, "exchange_failed", `${o} refused the authorization: ${d}`);
-		let p = be(r(t.headers.cookie, s)), h = p && p.p === o ? p : null, _ = f(o), v = await G({
-			provider: o,
-			clientId: _.clientId,
-			..._.clientSecret === void 0 ? {} : { clientSecret: _.clientSecret },
-			..._.appleKey === void 0 ? {} : { appleKey: _.appleKey },
-			redirectUri: _.redirectUri,
-			code: u.get("code") ?? "",
-			state: u.get("state") ?? "",
-			expectedState: h?.s ?? "",
-			codeVerifier: h?.v ?? "",
-			expectedNonce: h?.n ?? "",
-			...u.get("user") ? { appleUserPayload: u.get("user") } : {},
-			endpoints: _.endpoints
-		}), y = await e.runPromise(J({
-			profile: v,
-			identities: m(t),
-			users: i.users,
-			config: i.auth,
-			policy: c,
-			ipAddress: t.remoteAddr ?? null,
-			userAgent: t.headers["user-agent"] ?? null
-		}));
-		if (y.kind === "refused") return g(y.status, y.code, y.message);
-		let b = n(s, "", {
-			maxAgeSeconds: 0,
-			path: a,
-			secure: l
-		});
-		return {
-			status: 302,
-			body: "",
-			contentType: "text/plain; charset=utf-8",
-			headers: {
-				location: i.successRedirect ?? i.auth.successRedirect ?? "/",
-				"set-cookie": [b, y.setCookie]
-			}
-		};
-	}, y = {
-		method: "*",
-		path: a,
-		handle: async (e) => {
-			let t = h(e.path);
-			if (!t) return Q(404, { error: "not_found" });
-			try {
-				return t.isCallback ? e.method !== "GET" && e.method !== "POST" ? Q(405, { error: "method_not_allowed" }) : await v(e, t.id) : e.method === "GET" ? _(e, t.id) : Q(405, { error: "method_not_allowed" });
-			} catch (e) {
-				if (e instanceof C) return g(e.status, e.code, e.message);
-				throw e;
-			}
-		}
-	}, b = [
-		"store:write",
-		"network:outbound:oauth2.googleapis.com",
-		"network:outbound:www.googleapis.com",
-		"network:outbound:github.com",
-		"network:outbound:api.github.com",
-		"network:outbound:appleid.apple.com"
-	], x = u.flatMap((e) => Z[e].map((t) => ({
-		name: t.name,
-		required: i.providers[e]?.clientId === void 0,
-		secret: t.secret,
-		description: t.description
-	})));
-	return t({
-		name: i.name ? `@voltro/plugin-auth-social#${i.name}` : "@voltro/plugin-auth-social",
-		description: "Social login — Sign in with Google / GitHub / Apple. Mandatory PKCE (S256) + state, JWKS-verified ID tokens, a deliberate account-linking policy, and sessions issued through @voltro/plugin-auth.",
-		permissions: b,
-		declaredEnv: x,
-		extendSchema: { tables: ue },
-		httpRoutes: [y],
-		onActivate: (t) => e.sync(() => {
-			for (let e of u) f(e);
-			t.logger.info("social auth active", {
-				prefix: a,
-				providers: u.join(","),
-				linkPolicy: c,
-				stateTtlSeconds: o
-			});
-		}),
-		onDeactivate: () => e.void
-	});
-};
-//#endregion
-export { ae as APPLE_CLIENT_SECRET_DEFAULT_TTL_S, P as APPLE_CLIENT_SECRET_MAX_TTL_S, Y as SOCIAL_IDENTITY_TABLE, ie as SOCIAL_PROVIDERS, A as SOCIAL_PROVIDER_IDS, O as SocialAccountLinkError, C as SocialAuthError, D as SocialConfigError, T as SocialExchangeError, E as SocialIdTokenError, w as SocialStateMismatchError, ce as _resetAppleSecretCache, R as appleClientSecret, J as completeSocialSignIn, me as dataStoreSocialIdentityStore, K as decideSocialLink, H as fetchGithubIdentity, B as isApplePrivateRelayEmail, j as isSocialProviderId, he as linkSocialIdentity, fe as memorySocialIdentityStore, z as parseAppleUserPayload, Se as socialAuthPlugin, ue as socialAuthTables, N as socialBeginLogin, G as socialCompleteLogin, le as socialIdentitiesTable, M as socialProvider };
+import { PlatformTicketError as e, SocialAccountLinkError as t, SocialAuthError as n, SocialConfigError as r, SocialExchangeError as i, SocialIdTokenError as a, SocialStateMismatchError as o } from "./errors.js";
+import { SOCIAL_PROVIDERS as s, SOCIAL_PROVIDER_IDS as c, isSocialProviderId as l, socialProvider as u } from "./providers.js";
+import { socialBeginLogin as d } from "./login.js";
+import { APPLE_CLIENT_SECRET_DEFAULT_TTL_S as f, APPLE_CLIENT_SECRET_MAX_TTL_S as p, _resetAppleSecretCache as m, appleClientSecret as h, isApplePrivateRelayEmail as g, parseAppleUserPayload as _ } from "./apple.js";
+import { fetchGithubIdentity as v } from "./github.js";
+import { fetchDiscordIdentity as y } from "./discord.js";
+import { fetchEpicIdentity as b } from "./epic.js";
+import { socialCompleteLogin as x } from "./callback.js";
+import { decideSocialLink as S } from "./linking.js";
+import { completeSocialSignIn as C } from "./signIn.js";
+import { SOCIAL_IDENTITY_TABLE as w, SocialIdentityConflict as T, dataStoreSocialIdentityStore as E, linkSocialIdentity as D, memorySocialIdentityStore as O, socialAuthTables as k, socialIdentitiesTable as A } from "./identityStore.js";
+import { completeGuestSocialUpgrade as j } from "./guestUpgrade.js";
+import { steamBeginOpenId as M, steamCompleteOpenId as N, verifySteamWebApiTicket as P } from "./steam.js";
+import { definePlatformLogin as F, eosPlatformLogin as I, steamPlatformLogin as L, verifyPlatformTicket as R } from "./platform.js";
+import { socialAuthPlugin as z } from "./plugin.js";
+export { f as APPLE_CLIENT_SECRET_DEFAULT_TTL_S, p as APPLE_CLIENT_SECRET_MAX_TTL_S, e as PlatformTicketError, w as SOCIAL_IDENTITY_TABLE, s as SOCIAL_PROVIDERS, c as SOCIAL_PROVIDER_IDS, t as SocialAccountLinkError, n as SocialAuthError, r as SocialConfigError, i as SocialExchangeError, a as SocialIdTokenError, T as SocialIdentityConflict, o as SocialStateMismatchError, m as _resetAppleSecretCache, h as appleClientSecret, j as completeGuestSocialUpgrade, C as completeSocialSignIn, E as dataStoreSocialIdentityStore, S as decideSocialLink, F as definePlatformLogin, I as eosPlatformLogin, y as fetchDiscordIdentity, b as fetchEpicIdentity, v as fetchGithubIdentity, g as isApplePrivateRelayEmail, l as isSocialProviderId, D as linkSocialIdentity, O as memorySocialIdentityStore, _ as parseAppleUserPayload, z as socialAuthPlugin, k as socialAuthTables, d as socialBeginLogin, x as socialCompleteLogin, A as socialIdentitiesTable, u as socialProvider, M as steamBeginOpenId, N as steamCompleteOpenId, L as steamPlatformLogin, R as verifyPlatformTicket, P as verifySteamWebApiTicket };