@wtfalch/auth 0.24.0 → 0.26.0

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import { type JWTPayload } from 'jose';
+import type { JWTPayload } from 'jose';
 import { type AuthRequest, type NewUser, type PeoplePage } from './broker.js';
 import { type AccessTokenResult, type AuthOptions } from './config.js';
 import { type SetCookie } from './cookies.js';
@@ -28,7 +28,7 @@ export interface User {
     claims: JWTPayload;
 }
 export interface ReadResult {
-    /** A cookie exists for another binding/revision or cannot be opened. Do not auto-switch. */
+    /** @deprecated Never set. A cookie that cannot be opened (another binding's, an older revision's) reads as no session. */
     accountChanged?: true;
     /** Namespace mode: the binding is suspended or its status cannot be confirmed. Do not start a sign-in. */
     unavailable?: true;
@@ -287,6 +287,8 @@ export interface Auth {
         givenName: string;
         familyName: string;
         next?: string;
+        /** See `NewUser['personalEmail']`. */
+        personalEmail?: string;
     }): Promise<{
         userId: string;
         invited: boolean;
@@ -419,8 +421,8 @@ export interface Auth {
     /**
      * Starts registering a passkey on this app's own domain, for whoever is
      * signed in on `request` -- never for a stranger. Throws `AuthError` when
-     * nobody is: `account_changed`/`unavailable` exactly as `read` reports
-     * them, `unauthenticated` otherwise.
+     * nobody is: `unavailable` exactly as `read` reports it,
+     * `unauthenticated` otherwise.
      */
     startPasskeyRegistration(request: Request): Promise<PasskeyRegistrationStart>;
     /** The second half of `startPasskeyRegistration`. Same signed-in requirement. */

package/dist/auth.js

@@ -1,12 +1,12 @@
-import { errors } from 'jose';
 import * as client from 'openid-client';
 import { Broker, BrokerError } from './broker.js';
 import { resolveOptions, } from './config.js';
 import { clearQrTransaction, clearSession, clearTransaction, cookieFrom, openQrTransaction, openRecord, openSession, openSilent, openTransaction, qrTransactionCookieName, sealQrTransaction, sealSession, sealSilent, sealTransaction, sessionCookieName, silentCookieName, transactionCookieName, } from './cookies.js';
 import { namespaceSessions } from './namespace-session.js';
-import { AuthError, ORG_CLAIM, Oidc, isOAuthRefusal, scopeFor } from './oidc.js';
+import { AuthError, ORG_CLAIM, Oidc, isOAuthRefusal, rejected, scopeFor, } from './oidc.js';
 import { pollDeviceToken, requestDeviceAuthorization } from './qr.js';
 import { safeLoginHint, safeNextPath } from './redirect.js';
+import { expiryOf, issuedAtOf, timeoutSignal } from './util.js';
 export function createAuth(input) {
     // Resolved on first use so `next build`, which imports every route module, needs none of the values set.
     let resolved = null;
@@ -77,9 +77,19 @@ export function createAuth(input) {
         return brokerInstance;
     };
     const sessions = namespaceSessions({ options, oidc, broker });
-    const sessionCookie = (tokens, requestHeaders) => options().namespace
-        ? sessions.create(tokens, requestHeaders)
-        : sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+    // Every way in ends here, so this is the one place that reports a sign-in.
+    const sessionCookie = async (tokens, requestHeaders) => {
+        const cookie = options().namespace
+            ? await sessions.create(tokens, requestHeaders)
+            : await sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+        const email = tokens.claims.email;
+        emit({
+            type: 'signIn',
+            email: typeof email === 'string' ? email : '',
+            userId: String(tokens.claims.sub),
+        });
+        return cookie;
+    };
     /**
      * Signing in again replaces this binding's previous session outright: in
      * namespace mode, ends whatever session record `cookieHeader` already
@@ -268,9 +278,7 @@ export function createAuth(input) {
             // `sessions.end` reaches the store, which can be briefly unreachable --
             // and a sign-out that 500s over that leaves the browser's own cookie
             // standing, which is worse than the record surviving a moment longer.
-            const status = await sessions.end(value).catch(() => 'ended');
-            if (status === 'changed')
-                return new Response('Account changed', { status: 409 });
+            await sessions.end(value).catch(() => { });
             return endIssuerSession(idToken, [clearSession(options())]);
         }
         const session = await openSession(options(), value);
@@ -335,8 +343,6 @@ export function createAuth(input) {
             const result = await sessions.read(value);
             if (result.kind === 'user')
                 return { user: boundUser(result.claims), cookies: [] };
-            if (result.kind === 'changed')
-                return { user: null, cookies: [], accountChanged: true };
             if (result.kind === 'unavailable')
                 return { user: null, cookies: [], unavailable: true };
             return { user: null, cookies: [] };
@@ -389,11 +395,9 @@ export function createAuth(input) {
         const isPublic = url.pathname === options().basePath ||
             url.pathname.startsWith(`${options().basePath}/`) ||
             matches(rules.public, url.pathname);
-        const { user, cookies, accountChanged, unavailable } = await read(request);
+        const { user, cookies, unavailable } = await read(request);
         if (user || isPublic)
             return { kind: 'next', user, cookies };
-        if (accountChanged)
-            return { kind: 'deny', cookies, reason: 'account_changed' };
         if (unavailable)
             return { kind: 'deny', cookies, reason: 'unavailable' };
         if (!isNavigation(request))
@@ -411,13 +415,11 @@ export function createAuth(input) {
     /**
      * The person signed in on `request`, for the passkey routes -- never a
      * stranger. Adapts `requireUser`'s reasons for a caller that throws rather
-     * than redirects: `account_changed`/`unavailable` are read's own, and
+     * than redirects: `unavailable` is read's own, and
      * plain absence becomes `unauthenticated`, which read has no reason for.
      */
     const currentUser = async (request) => {
-        const { user, accountChanged, unavailable } = await read(request, { refresh: false });
-        if (accountChanged)
-            throw new AuthError('account_changed', 'Choose an account to continue');
+        const { user, unavailable } = await read(request, { refresh: false });
         if (unavailable)
             throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
         if (!user)
@@ -484,8 +486,13 @@ export function createAuth(input) {
         const nonce = client.randomNonce();
         const verifier = client.randomPKCECodeVerifier();
         const target = await oidc().authorizationUrl(state, nonce, verifier);
-        const response = await options().fetch(target.href, { redirect: 'manual' });
+        const response = await options().fetch(target.href, {
+            redirect: 'manual',
+            signal: timeoutSignal(),
+        });
         const location = response.headers.get('location');
+        // Only the Location header is wanted; an unread body would hold the socket.
+        response.body?.cancel().catch(() => undefined);
         if (options().namespace &&
             location &&
             new URL(location, options().issuer).origin !== options().namespace?.loginOrigin)
@@ -542,7 +549,13 @@ export function createAuth(input) {
     const requestPasswordReset = (email, next) => quietly(() => broker().sendReset(email, safeNextPath(next, '')));
     const sendLink = (email, next) => quietly(() => broker().sendLink(email, safeNextPath(next, '')));
     const invite = async (input) => {
-        const result = await broker().invite({ ...input, next: safeNextPath(input.next, '') });
+        const result = await broker().invite({
+            email: input.email,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            next: safeNextPath(input.next, ''),
+            personalEmail: input.personalEmail,
+        });
         emit({ type: 'invite', email: input.email, userId: result.userId, invited: result.invited });
         return result;
     };
@@ -618,14 +631,11 @@ export function createAuth(input) {
     const signIn = async ({ authRequestId, email, password, }) => {
         try {
             const redirectTo = await broker().signIn({ authRequestId, email, password });
-            emit({ type: 'signIn', email });
             return { ok: true, redirectTo };
         }
         catch (error) {
-            if (needsHostedLogin(error)) {
-                emit({ type: 'signIn', email });
+            if (needsHostedLogin(error))
                 return { ok: true, redirectTo: hostedUrl(authRequestId), hosted: true };
-            }
             const change = changeRequired(error);
             if (change)
                 return change;
@@ -664,7 +674,6 @@ export function createAuth(input) {
         try {
             const flow = await serverFlow();
             const completed = await finishOrHandoff(() => broker().signIn({ authRequestId: flow.id, email, password }), flow, safeNextPath(next, options().afterLogin), requestHeaders);
-            emit({ type: 'signIn', email });
             return { ok: true, ...completed };
         }
         catch (error) {
@@ -690,26 +699,7 @@ export function createAuth(input) {
             return { ok: true, ...completed };
         }
         catch (error) {
-            if (error instanceof BrokerError && error.error === 'email_taken') {
-                return { ok: false, error: 'email_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'registration_closed') {
-                return { ok: false, error: 'registration_closed', message: error.detail ?? error.error };
-            }
-            // Both carry a sentence about the name, for the form to show as it is.
-            if (error instanceof BrokerError && error.error === 'username_taken') {
-                return { ok: false, error: 'username_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'username_invalid') {
-                return { ok: false, error: 'username_invalid', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'request') {
-                return { ok: false, error: 'request', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.status < 500) {
-                return { ok: false, error: 'invalid', message: error.detail ?? error.error };
-            }
-            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+            return signUpFailure(error);
         }
     };
     const signUp = async ({ authRequestId, ...user }) => {
@@ -726,26 +716,7 @@ export function createAuth(input) {
             const change = changeRequired(error);
             if (change)
                 return { ...change, message: 'choose a new password to continue' };
-            if (error instanceof BrokerError && error.error === 'email_taken') {
-                return { ok: false, error: 'email_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'registration_closed') {
-                return { ok: false, error: 'registration_closed', message: error.detail ?? error.error };
-            }
-            // Both carry a sentence about the name, for the form to show as it is.
-            if (error instanceof BrokerError && error.error === 'username_taken') {
-                return { ok: false, error: 'username_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'username_invalid') {
-                return { ok: false, error: 'username_invalid', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'request') {
-                return { ok: false, error: 'request', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.status < 500) {
-                return { ok: false, error: 'invalid', message: error.detail ?? error.error };
-            }
-            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+            return signUpFailure(error);
         }
     };
     const startPasskeyRegistration = async (request) => {
@@ -806,7 +777,11 @@ export function createAuth(input) {
     const changePassword = async (request, input) => {
         const user = await currentFreshUser(request);
         try {
-            await broker().changePassword({ userId: user.id, ...input });
+            await broker().changePassword({
+                userId: user.id,
+                currentPassword: input.currentPassword,
+                newPassword: input.newPassword,
+            });
             return { ok: true };
         }
         catch (error) {
@@ -862,7 +837,7 @@ export function createAuth(input) {
         if (options().namespace && !(await sessions.bindingActive()))
             throw new AuthError('unavailable', 'the namespace binding is not active');
         const device = await requestDeviceAuthorization(options(), scopeFor(options().organizationId, options().extraScopes));
-        const cookie = await sealQrTransaction(options(), { dc: device.deviceCode, iv: device.interval }, device.expiresIn);
+        const cookie = await sealQrTransaction(options(), { dc: device.deviceCode }, device.expiresIn);
         return {
             url: qrVerificationUrl(options(), device.verificationUriComplete),
             userCode: device.userCode,
@@ -1032,28 +1007,6 @@ function matches(rule, pathname) {
         return pathname === entry;
     });
 }
-function expiryOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.exp === 'number' ? json.exp : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Age, not time left: a disabled or revoked account must not ride out a
-// long-lived token just because it still has plenty of time on the clock.
-function issuedAtOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.iat === 'number' ? json.iat : null;
-    }
-    catch {
-        return null;
-    }
-}
 const PROMPTS = ['select_account', 'login'];
 function promptFrom(raw) {
     return PROMPTS.includes(raw ?? '') ? raw : undefined;
@@ -1117,15 +1070,6 @@ function userFrom(claims) {
     };
 }
 // The token itself is bad, as opposed to the keys being unreachable or rotating.
-function rejected(error) {
-    return (error instanceof AuthError ||
-        error instanceof errors.JWTExpired ||
-        error instanceof errors.JWTClaimValidationFailed ||
-        error instanceof errors.JWSSignatureVerificationFailed ||
-        error instanceof errors.JWSInvalid ||
-        error instanceof errors.JWTInvalid ||
-        error instanceof errors.JOSEAlgNotAllowed);
-}
 function isNavigation(request) {
     const mode = request.headers.get('sec-fetch-mode');
     if (mode && mode !== 'navigate')
@@ -1179,6 +1123,23 @@ function signInError(error) {
         return 'invalid_credentials';
     return 'unavailable';
 }
+/** The sign-up refusals the broker can name, each with its own sentence for the form to show as it is. */
+function signUpFailure(error) {
+    if (error instanceof BrokerError) {
+        const message = error.detail ?? error.error;
+        switch (error.error) {
+            case 'email_taken':
+            case 'registration_closed':
+            case 'username_taken':
+            case 'username_invalid':
+            case 'request':
+                return { ok: false, error: error.error, message };
+        }
+        if (error.status < 500)
+            return { ok: false, error: 'invalid', message };
+    }
+    return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+}
 function reasonOf(error) {
     if (error instanceof AuthError)
         return error.reason;

package/dist/broker.js

@@ -1,3 +1,4 @@
+import { timeoutSignal } from './util.js';
 export class BrokerError extends Error {
     status;
     error;
@@ -34,7 +35,7 @@ export class Broker {
                 url.searchParams.set(k, String(v));
         const response = await this.options.fetch(url.href, {
             method,
-            signal,
+            signal: timeoutSignal(signal),
             headers: {
                 authorization: `Bearer ${this.options.appKey}`,
                 'content-type': 'application/json',
@@ -84,8 +85,16 @@ export class Broker {
         return callbackUrl;
     }
     async signUp(input) {
+        // Named fields: `input` can come from a form a client controls.
         const { callbackUrl } = await this.call('POST', '/sign-up', {
-            ...input,
+            authRequestId: input.authRequestId,
+            email: input.email,
+            password: input.password,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            username: input.username,
+            changeRequired: input.changeRequired,
+            personalEmail: input.personalEmail,
         });
         return callbackUrl;
     }
@@ -113,7 +122,13 @@ export class Broker {
         return callbackUrl;
     }
     invite(input) {
-        return this.call('POST', '/invite', input);
+        return this.call('POST', '/invite', {
+            email: input.email,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            next: input.next,
+            personalEmail: input.personalEmail,
+        });
     }
     sendLink(email, next) {
         return this.call('POST', '/link/send', { email, next });
@@ -148,7 +163,11 @@ export class Broker {
         return this.call('POST', '/email/change/complete', { userId, code });
     }
     changePassword(input) {
-        return this.call('POST', '/password/change', input);
+        return this.call('POST', '/password/change', {
+            userId: input.userId,
+            currentPassword: input.currentPassword,
+            newPassword: input.newPassword,
+        });
     }
     passkeys(userId) {
         return this.call('GET', '/passkeys', { userId });
@@ -158,14 +177,26 @@ export class Broker {
     }
     /** A public client revoking its own token: no key, no service. */
     async revoke(refreshToken) {
-        await this.options.fetch(`${this.options.issuer}/oauth/v2/revoke`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                token: refreshToken,
-                token_type_hint: 'refresh_token',
-                client_id: this.options.clientId,
-            }),
-        });
+        let response;
+        try {
+            response = await this.options.fetch(`${this.options.issuer}/oauth/v2/revoke`, {
+                method: 'POST',
+                signal: timeoutSignal(),
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    token: refreshToken,
+                    token_type_hint: 'refresh_token',
+                    client_id: this.options.clientId,
+                }),
+            });
+        }
+        catch (error) {
+            console.error('@wtfalch/auth: the revoke request failed', error instanceof Error ? error.name : 'unknown');
+            throw error;
+        }
+        if (!response.ok) {
+            console.error('@wtfalch/auth: the issuer refused to revoke a refresh token', response.status);
+            throw new BrokerError(response.status, 'unavailable', 'the issuer did not revoke the token');
+        }
     }
 }

package/dist/browser.d.ts

@@ -125,8 +125,9 @@ export type RefreshOutcome = {
     kind: 'no-refresh-token';
 }
 /**
- * The issuer refused rotation, or this operation was cancelled. An issuer
- * refusal drops the held session because the old refresh token was spent.
+ * The issuer refused rotation, or this operation was cancelled. A 4xx other
+ * than 429 drops the held session because the old refresh token was spent;
+ * a 429 or 5xx keeps it.
  * Cancellation discards the old response and preserves any newer session.
  */
  | {

package/dist/browser.js

@@ -1,5 +1,6 @@
 import { createNamespaceBrowserAuth } from './namespace-browser.js';
 import { safeLoginHint } from './redirect.js';
+import { base64url, decodeJwtPayload, timeoutSignal } from './util.js';
 const TOKEN = 'wtfalch.auth.token';
 const VERIFIER = 'wtfalch.auth.verifier';
 /** CSRF protection on the callback: checked before the code exchange, never persisted past it. */
@@ -37,12 +38,6 @@ const defaultStore = {
         }
     },
 };
-function base64url(bytes) {
-    return btoa(String.fromCharCode(...new Uint8Array(bytes)))
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=+$/, '');
-}
 async function challengeFor(verifier) {
     const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
     return base64url(digest);
@@ -53,22 +48,6 @@ function verifier() {
     // too -- a random, unguessable token is exactly what each of the three is.
     return base64url(crypto.getRandomValues(new Uint8Array(32)).buffer);
 }
-/** The payload of a JWT, read without verifying its signature -- the ID token here comes straight
- *  from the token endpoint over TLS, which OIDC Core 1.0 3.1.3.7 allows in place of a signature
- *  check for the authorization code flow. Never used to trust a claim from anywhere else. */
-function decodeJwtPayload(jwt) {
-    try {
-        const part = jwt.split('.')[1];
-        if (!part)
-            return null;
-        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
-        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
-        return JSON.parse(atob(padded));
-    }
-    catch {
-        return null;
-    }
-}
 function publicSession(session) {
     const { refreshToken, ...rest } = session;
     return rest;
@@ -212,6 +191,7 @@ export function createBrowserAuth(options) {
             return { kind: 'no-refresh-token' };
         const response = await fetch(`${options.issuer}/oauth/v2/token`, {
             method: 'POST',
+            signal: timeoutSignal(),
             headers: { 'content-type': 'application/x-www-form-urlencoded' },
             body: new URLSearchParams({
                 grant_type: 'refresh_token',
@@ -223,10 +203,13 @@ export function createBrowserAuth(options) {
             return cancelledRefresh();
         if (!response.ok) {
             const body = await response.text();
+            // A 5xx or 429 says the issuer is struggling, not that the grant is gone: keep the session for the next try.
+            const definitive = response.status >= 400 && response.status < 500 && response.status !== 429;
             return mutate(async () => {
                 if (!current(generation))
                     return cancelledRefresh();
-                await store.drop(tokenKey);
+                if (definitive)
+                    await store.drop(tokenKey);
                 if (!current(generation))
                     return cancelledRefresh();
                 return {
@@ -322,6 +305,7 @@ export function createBrowserAuth(options) {
                 };
             const response = await fetch(`${options.issuer}/oauth/v2/token`, {
                 method: 'POST',
+                signal: timeoutSignal(),
                 headers: { 'content-type': 'application/x-www-form-urlencoded' },
                 body: new URLSearchParams({
                     grant_type: 'authorization_code',

package/dist/config.d.ts

@@ -8,9 +8,12 @@ import type { SessionStore } from './sessions.js';
  * to offer there; `invite` calls the broker's own endpoint, which returns
  * one.
  */
-export type AuthEvent = {
+export type AuthEvent = 
+/** A session was established, by any method: password, passkey, link, reset, QR or the hosted login. `email` is empty when the id token carries none. */
+{
     type: 'signIn';
     email: string;
+    userId: string;
 } | {
     type: 'signUp';
     email: string;

package/dist/cookies.d.ts

@@ -32,10 +32,9 @@ export interface LinkPayload extends JWTPayload {
     stk: string;
     ar: string;
 }
-/** The QR device-grant transaction: the device_code, never handed to the caller, and the interval the issuer asked us to poll at. Its own `exp` -- set to the issuer's `expires_in` -- is what makes an unsealed-past-expiry cookie fail open with the others below. */
+/** The QR device-grant transaction: the device_code, never handed to the caller, and nothing else: the issuer answers `slow_down` to a client that polls too fast, and `pollQrSignIn` passes that on. Its own `exp` -- set to the issuer's `expires_in` -- is what makes an unsealed-past-expiry cookie fail open with the others below. */
 export interface QrTransactionPayload extends JWTPayload {
     dc: string;
-    iv: number;
 }
 export interface SetCookie {
     name: string;

package/dist/cookies.js

@@ -1,6 +1,7 @@
 import { EncryptJWT, jwtDecrypt } from 'jose';
 import { deriveCookieKey } from './config.js';
 import { AuthError } from './oidc.js';
+import { base64url } from './util.js';
 // `options.cookieKey` decodes once per `ResolvedOptions` (config.ts) and is
 // always the same `Uint8Array` reference after that, so keying the derived
 // key's own cache off it means every seal/open after the first reuses it
@@ -78,10 +79,7 @@ export async function contextDigest(options) {
 /** SHA-256, base64url. */
 export async function digest(value) {
     const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
-    return btoa(String.fromCharCode(...new Uint8Array(bytes)))
-        .replaceAll('+', '-')
-        .replaceAll('/', '_')
-        .replace(/=+$/, '');
+    return base64url(bytes);
 }
 export async function sealTransaction(options, payload) {
     const value = await seal(options, 'transaction', payload, TRANSACTION_TTL);
@@ -125,9 +123,7 @@ export async function sealQrTransaction(options, payload, ttl) {
 }
 export async function openQrTransaction(options, value) {
     const payload = await open(options, 'qr', value);
-    return payload && typeof payload.dc === 'string' && typeof payload.iv === 'number'
-        ? payload
-        : null;
+    return payload && typeof payload.dc === 'string' ? payload : null;
 }
 export function clearQrTransaction(options) {
     return setCookie(qrTransactionCookieName(options), '', 0, options.secure);

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type MaxAge, type NewUser, type PasskeyRegistrationResult, type PasswordChangeRequired, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, STEP_UP_MAX_AGE, createAuth, } from './auth.js';
+export { type Auth, type AuthRequest, type ChangePasswordError, type ChangePasswordResult, type Completed, type DeletePasskeyResult, type EmailChangeError, type EmailChangeResult, type Gate, type GateRules, type Intent, type MaxAge, type NewUser, type Passkey, type PasskeyRegistrationResult, type PasswordChangeRequired, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollResult, type QrPollStatus, type QrSignInStart, type ReadResult, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, STEP_UP_MAX_AGE, createAuth, } from './auth.js';
 export type { AccessTokenReason, AccessTokenResult, AuthEvent, AuthOptions } from './config.js';
 export type { SetCookie } from './cookies.js';
 export type { SessionRecord, SessionStore, SessionUpdate } from './sessions.js';
 export type { PersonTokenConfig, PersonTokenVerifier } from './person-token.js';
-export { BrokerError } from './broker.js';
+export { BrokerError, type PeoplePage, type Person } from './broker.js';
 export { AuthError, type AuthErrorReason, ORG_CLAIM } from './oidc.js';
 export { safeLoginHint, safeNextPath } from './redirect.js';

package/dist/mcp.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Resource side of MCP authorization for an org app (ADR 0002, section 4).
+ * Only `jose` and `fetch`: this entry runs on workerd, so nothing here may
+ * reach a `node:` module.
+ */
+export interface McpOptions {
+    /** The bound login host, e.g. `https://login.candorfx.com`. */
+    issuer: string;
+    /** The ZITADEL project id of the MCP project (env `MCP_AUDIENCE`). */
+    audience: string;
+    /** The MCP URL clients send as `resource` (env `MCP_RESOURCE`). */
+    resource: string;
+    /** Test seam. */
+    fetch?: typeof fetch;
+}
+export interface McpTokenClaims {
+    userId: string;
+}
+/** Claims for a valid bearer token for this resource, otherwise null. Never
+ *  throws on a bad token; says nothing about why. */
+export declare function verifyMcpToken(req: Request, opts: McpOptions): Promise<McpTokenClaims | null>;
+/** The 401 or 403 the app returns when `verifyMcpToken` gives null (401) or
+ *  the user may not do the thing (403). */
+export declare function mcpChallenge(opts: McpOptions, status: 401 | 403): Response;
+/** The document the app serves at `/.well-known/oauth-protected-resource` (and
+ *  the path form). */
+export declare function protectedResourceMetadata(opts: McpOptions): {
+    resource: string;
+    authorization_servers: string[];
+};

package/dist/mcp.js

@@ -0,0 +1,55 @@
+import { createPersonTokenCore } from './person-token.js';
+/** One person-token core per (fetch, issuer, audience), so discovery and the
+ *  JWKS are fetched once and cached, not once per request. Weakly keyed by the
+ *  fetch function so a test seam never leaks across tests. */
+const cores = new WeakMap();
+function coreFor(opts) {
+    const fetchImpl = opts.fetch ?? fetch;
+    let byKey = cores.get(fetchImpl);
+    if (!byKey) {
+        byKey = new Map();
+        cores.set(fetchImpl, byKey);
+    }
+    const key = JSON.stringify([opts.issuer, opts.audience]);
+    let core = byKey.get(key);
+    if (!core) {
+        core = createPersonTokenCore({
+            issuer: opts.issuer,
+            audience: opts.audience,
+            fetch: opts.fetch,
+        });
+        byKey.set(key, core);
+    }
+    return core;
+}
+const BEARER = /^Bearer ([^\s]+)$/i;
+/** Claims for a valid bearer token for this resource, otherwise null. Never
+ *  throws on a bad token; says nothing about why. */
+export async function verifyMcpToken(req, opts) {
+    const match = BEARER.exec(req.headers.get('authorization') ?? '');
+    if (!match?.[1])
+        return null;
+    const payload = await coreFor(opts).verifyJwtClaims(match[1]);
+    if (!payload || typeof payload.sub !== 'string' || !payload.sub)
+        return null;
+    return { userId: payload.sub };
+}
+function metadataUrl(opts) {
+    const url = new URL(opts.resource);
+    const path = url.pathname === '/' ? '' : url.pathname;
+    return `${url.origin}/.well-known/oauth-protected-resource${path}`;
+}
+/** The 401 or 403 the app returns when `verifyMcpToken` gives null (401) or
+ *  the user may not do the thing (403). */
+export function mcpChallenge(opts, status) {
+    const resourceMetadata = `resource_metadata="${metadataUrl(opts)}"`;
+    const challenge = status === 403
+        ? `Bearer error="insufficient_scope", ${resourceMetadata}`
+        : `Bearer ${resourceMetadata}`;
+    return new Response(null, { status, headers: { 'WWW-Authenticate': challenge } });
+}
+/** The document the app serves at `/.well-known/oauth-protected-resource` (and
+ *  the path form). */
+export function protectedResourceMetadata(opts) {
+    return { resource: opts.resource, authorization_servers: [opts.issuer] };
+}