@zappie/sdk 0.1.16 → 0.1.18

package/dist/checkout/react.d.ts

@@ -0,0 +1,150 @@
+import { WireLine, WireMoney } from '@zappie/sdk';
+
+/**
+ * Address fields you can send with a delivery checkout request.
+ */
+type CheckoutAddress = {
+    line1?: string;
+    city?: string;
+    place_id?: string;
+    lat?: number;
+    lng?: number;
+};
+/**
+ * Pickup or delivery details for a checkout session, including an optional schedule.
+ */
+type CheckoutFulfilment = {
+    /** Dine-in orders are not checked out through a session. */
+    type: "pickup" | "delivery";
+    address?: CheckoutAddress;
+    scheduled_for?: string | null;
+    delivery_region_id?: string;
+    instructions?: string;
+};
+/**
+ * Cart lines, branch, fulfilment and return URLs you send to open checkout.
+ */
+type CheckoutRequest = {
+    branch_id: string;
+    menu_version: string;
+    lines: WireLine[];
+    fulfilment: CheckoutFulfilment;
+    contact_phone?: string;
+    promo_code?: string;
+    return_url: string;
+    cancel_url?: string;
+    source?: string;
+    campaign?: string;
+};
+/**
+ * A checkout session returned by the service, with its amount, expiry and order status.
+ */
+type CheckoutSession = {
+    id: string;
+    status: "open" | "completed" | "expired" | "cancelled";
+    url?: string;
+    amount: WireMoney;
+    order_id: string | null;
+    return_url: string;
+    cancel_url?: string;
+    expires_at: string;
+};
+/**
+ * A checkout session with a payment URL you can use to send the shopper to checkout.
+ */
+type OpenCheckoutSession = CheckoutSession & {
+    url: string;
+};
+/**
+ * A terminal checkout result: a completed order, an expired session or a cancelled session.
+ */
+type CheckoutCompletion = (CheckoutSession & {
+    status: "completed";
+    order_id: string;
+}) | (CheckoutSession & {
+    status: "expired" | "cancelled";
+});
+/**
+ * Optional customer API base URL and fetch implementation for the checkout client.
+ */
+type CheckoutClientOptions = {
+    customerBase?: string;
+    fetch?: typeof fetch;
+};
+/**
+ * Cancellation signal and polling interval in milliseconds for awaiting checkout completion.
+ */
+type AwaitCompletionOptions = {
+    signal?: AbortSignal;
+    intervalMs?: number;
+};
+
+/**
+ * Create a client that opens checkout sessions, reads them and polls for completion.
+ *
+ * @param options - Override the default `/_zappie/api` base or fetch implementation.
+ * @returns A checkout client. Retain each idempotency key when retrying the same cart.
+ */
+declare function createCheckout(options?: CheckoutClientOptions): {
+    /** The caller retains this key and reuses it when retrying the same cart. */
+    open(body: CheckoutRequest, idempotencyKey: string): Promise<OpenCheckoutSession>;
+    session(id: string): Promise<CheckoutSession>;
+    awaitCompletion(id: string, options?: AwaitCompletionOptions): Promise<CheckoutCompletion>;
+};
+/**
+ * The session creation, lookup and completion methods returned by createCheckout.
+ */
+type CheckoutClient = ReturnType<typeof createCheckout>;
+
+/** How checkout opens. Auto redirects in in-app browsers and framed pages, else a modal on desktop and a sheet on mobile. */
+type CheckoutPresentation = "auto" | "modal" | "sheet" | "fullscreen" | "redirect";
+/** The checkout look from toCheckoutTheme in @zappie/tokens/checkout. The checkout validates it before use. */
+type CheckoutTheme = {
+    version: 1;
+    tokens: Partial<Record<`--z-${string}`, string>>;
+    logo?: {
+        url: string;
+        alt: string;
+    };
+    fonts?: {
+        family: string;
+        role: "body" | "display";
+        weights?: number[];
+    }[];
+    copy?: {
+        payButton?: string;
+        successTitle?: string;
+    };
+};
+/** Presentation, theme and step reporting for an embedded checkout. */
+type EmbedOptions = {
+    presentation?: CheckoutPresentation;
+    theme?: CheckoutTheme;
+    /** Called with each checkout step, and whether a payment has started. */
+    onStep?: (step: string, paying: boolean) => void;
+};
+/** How an embedded checkout ended. A completed result is confirmed by the server first. */
+type CheckoutResult = {
+    status: "completed";
+    orderId: string;
+} | {
+    status: "cancelled";
+    reason: string;
+} | {
+    status: "redirected";
+};
+/** Ask the open checkout to close. Mid-payment it asks the shopper first. */
+declare function closeCheckout(): void;
+
+/**
+ * Open checkout for a cart and follow it. `open` creates the session, then embeds or redirects it as
+ * `presentation` decides, and resolves with how it ended. Retain the idempotency key when retrying a cart.
+ */
+declare function useCheckout(checkout: CheckoutClient): {
+    open: (body: CheckoutRequest, key: string, options?: EmbedOptions) => Promise<CheckoutResult>;
+    close: typeof closeCheckout;
+    status: "open" | "completed" | "cancelled" | "redirected" | "idle" | "opening";
+    step: string | undefined;
+};
+
+export { useCheckout };

package/dist/checkout/react.js

@@ -0,0 +1,39 @@
+"use client";
+
+// src/checkout/react.ts
+import { useCallback, useState } from "react";
+import {
+  closeCheckout,
+  embedCheckout
+} from "./embed.js";
+function useCheckout(checkout) {
+  const [status, setStatus] = useState("idle");
+  const [step, setStep] = useState();
+  const open = useCallback(
+    async (body, key, options = {}) => {
+      setStatus("opening");
+      try {
+        const session = await checkout.open(body, key);
+        setStatus("open");
+        const result = await embedCheckout(checkout, session, {
+          ...options,
+          onStep: (next, paying) => {
+            setStep(next);
+            options.onStep?.(next, paying);
+          }
+        });
+        setStatus(result.status);
+        return result;
+      } catch (failure) {
+        setStatus("idle");
+        throw failure;
+      }
+    },
+    [checkout]
+  );
+  return { open, close: closeCheckout, status, step };
+}
+export {
+  useCheckout
+};
+//# sourceMappingURL=react.js.map

package/dist/checkout/react.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/checkout/react.ts"],
+  "sourcesContent": ["\"use client\";\nimport { useCallback, useState } from \"react\";\nimport type { CheckoutClient } from \"./client\";\nimport {\n  closeCheckout,\n  embedCheckout,\n  type CheckoutResult,\n  type EmbedOptions,\n} from \"./embed\";\nimport type { CheckoutRequest } from \"./types\";\n\n/**\n * Open checkout for a cart and follow it. `open` creates the session, then embeds or redirects it as\n * `presentation` decides, and resolves with how it ended. Retain the idempotency key when retrying a cart.\n */\nexport function useCheckout(checkout: CheckoutClient) {\n  const [status, setStatus] = useState<\n    \"idle\" | \"opening\" | \"open\" | CheckoutResult[\"status\"]\n  >(\"idle\");\n  const [step, setStep] = useState<string>();\n  const open = useCallback(\n    async (body: CheckoutRequest, key: string, options: EmbedOptions = {}) => {\n      setStatus(\"opening\");\n      try {\n        const session = await checkout.open(body, key);\n        setStatus(\"open\");\n        const result = await embedCheckout(checkout, session, {\n          ...options,\n          onStep: (next, paying) => {\n            setStep(next);\n            options.onStep?.(next, paying);\n          },\n        });\n        setStatus(result.status);\n        return result;\n      } catch (failure) {\n        setStatus(\"idle\");\n        throw failure;\n      }\n    },\n    [checkout],\n  );\n  return { open, close: closeCheckout, status, step };\n}\n"],
+  "mappings": ";;;AACA,SAAS,aAAa,gBAAgB;AAEtC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAOA,SAAS,YAAY,UAA0B;AACpD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAE1B,MAAM;AACR,QAAM,CAAC,MAAM,OAAO,IAAI,SAAiB;AACzC,QAAM,OAAO;AAAA,IACX,OAAO,MAAuB,KAAa,UAAwB,CAAC,MAAM;AACxE,gBAAU,SAAS;AACnB,UAAI;AACF,cAAM,UAAU,MAAM,SAAS,KAAK,MAAM,GAAG;AAC7C,kBAAU,MAAM;AAChB,cAAM,SAAS,MAAM,cAAc,UAAU,SAAS;AAAA,UACpD,GAAG;AAAA,UACH,QAAQ,CAAC,MAAM,WAAW;AACxB,oBAAQ,IAAI;AACZ,oBAAQ,SAAS,MAAM,MAAM;AAAA,UAC/B;AAAA,QACF,CAAC;AACD,kBAAU,OAAO,MAAM;AACvB,eAAO;AAAA,MACT,SAAS,SAAS;AAChB,kBAAU,MAAM;AAChB,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,EAAE,MAAM,OAAO,eAAe,QAAQ,KAAK;AACpD;",
+  "names": []
+}

package/dist/debug.js

@@ -1,5 +1,5 @@
 // src/debug.ts
-var VERSION = true ? "0.1.16" : "0.0.0-development";
+var VERSION = true ? "0.1.18" : "0.0.0-development";
 function installDebug(client) {
   if (typeof window === "undefined" || client.mode !== "test") {
     return;

package/dist/index.js

@@ -10,7 +10,7 @@ import { ZappieError, isZappieError } from "./errors.js";
 export * from "./models.js";
 import { format, money } from "./money.js";
 import { RestTransport } from "./transport/rest.js";
-var VERSION = true ? "0.1.16" : "0.0.0-development";
+var VERSION = true ? "0.1.18" : "0.0.0-development";
 export {
   API_VERSION,
   RestTransport,

package/dist/server/auth/crypto.js

@@ -0,0 +1,106 @@
+// src/server/auth/crypto.ts
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function base64UrlDecode(text) {
+  return /^[\w-]*$/.test(text) && text.length % 4 !== 1 ? Uint8Array.from(
+    atob(text.replaceAll("-", "+").replaceAll("_", "/")),
+    (c) => c.charCodeAt(0)
+  ) : null;
+}
+function randomToken(bytes = 32) {
+  if (!Number.isInteger(bytes) || bytes < 16 || bytes > 1024) {
+    throw new RangeError("randomToken takes between 16 and 1024 bytes.");
+  }
+  return base64UrlEncode(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    encoder.encode(verifier)
+  );
+  return base64UrlEncode(new Uint8Array(digest));
+}
+async function createPkce() {
+  const verifier = randomToken();
+  return { verifier, challenge: await pkceChallenge(verifier), method: "S256" };
+}
+function secretsOf(secret) {
+  const list = typeof secret === "string" ? [secret] : secret;
+  if (!list.length || list.some((value) => encoder.encode(value).length < 32)) {
+    throw new TypeError("Each sealing secret needs at least 32 bytes.");
+  }
+  return list;
+}
+var keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+  if (!keys.has(secret)) {
+    if (keys.size >= 16) {
+      keys.clear();
+    }
+    keys.set(
+      secret,
+      crypto.subtle.digest("SHA-256", encoder.encode(secret)).then(
+        (digest) => crypto.subtle.importKey("raw", digest, "AES-GCM", false, [
+          "encrypt",
+          "decrypt"
+        ])
+      )
+    );
+  }
+  return keys.get(secret);
+}
+var params = (iv, purpose) => ({
+  name: "AES-GCM",
+  iv,
+  ...purpose === void 0 ? {} : { additionalData: encoder.encode(purpose) }
+});
+async function sealValue(value, { secret, purpose }) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const cipher = await crypto.subtle.encrypt(
+    params(iv, purpose),
+    await keyFor(secretsOf(secret)[0]),
+    encoder.encode(JSON.stringify(value))
+  );
+  return `${base64UrlEncode(iv)}.${base64UrlEncode(new Uint8Array(cipher))}`;
+}
+async function openSealedValue(sealed, { secret, purpose }) {
+  const list = secretsOf(secret);
+  const [ivText = "", cipherText = "", extra] = (sealed ?? "").split(".");
+  const iv = base64UrlDecode(ivText);
+  const cipher = base64UrlDecode(cipherText);
+  if (iv?.length !== 12 || !cipher?.length || extra !== void 0) {
+    return null;
+  }
+  for (const candidate of list) {
+    try {
+      const plain = await crypto.subtle.decrypt(
+        params(iv, purpose),
+        await keyFor(candidate),
+        cipher
+      );
+      return JSON.parse(decoder.decode(plain));
+    } catch {
+    }
+  }
+  return null;
+}
+export {
+  base64UrlDecode,
+  base64UrlEncode,
+  createPkce,
+  decoder,
+  encoder,
+  openSealedValue,
+  pkceChallenge,
+  randomToken,
+  sealValue,
+  secretsOf
+};
+//# sourceMappingURL=crypto.js.map

package/dist/server/auth/crypto.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/server/auth/crypto.ts"],
+  "sourcesContent": ["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\n\nexport function base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary)\n    .replaceAll(\"+\", \"-\")\n    .replaceAll(\"/\", \"_\")\n    .replace(/=+$/, \"\");\n}\n\n// Null for anything but unpadded base64url, so a forged segment is refused\n// as malformed rather than thrown as a DOMException.\nexport function base64UrlDecode(text: string): Uint8Array<ArrayBuffer> | null {\n  return /^[\\w-]*$/.test(text) && text.length % 4 !== 1\n    ? Uint8Array.from(\n        atob(text.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\")),\n        (c) => c.charCodeAt(0),\n      )\n    : null;\n}\n\n/** A PKCE code verifier and its S256 challenge for one sign-in attempt. */\nexport type PkcePair = {\n  /** Keep this on the server and send it with the code exchange. */\n  verifier: string;\n  /** Send this to the authorize endpoint as `code_challenge`. */\n  challenge: string;\n  /** Send this as `code_challenge_method`. */\n  method: \"S256\";\n};\n\n/** One sealing secret, or several while you rotate them. The first one seals. */\nexport type SealSecret = string | readonly string[];\n\n/** Options for sealing a value into a cookie-safe string. */\nexport type SealOptions = {\n  /**\n   * At least 32 bytes each, from a random generator such as `randomToken()`,\n   * never a password or phrase. The key is the secret's SHA-256 with no\n   * stretching, so a guessable secret can be found offline from one sealed\n   * value. List the new secret first while you rotate.\n   */\n  secret: SealSecret;\n  /**\n   * Binds the sealed value to one use, such as `\"tx\"`, so it won't open for\n   * another. Leave it out to match the hosted sign-in Worker's format.\n   */\n  purpose?: string;\n};\n\n/** Create a random URL-safe token from `bytes` random bytes, for state, nonces and ids. */\nexport function randomToken(bytes = 32): string {\n  if (!Number.isInteger(bytes) || bytes < 16 || bytes > 1024) {\n    throw new RangeError(\"randomToken takes between 16 and 1024 bytes.\");\n  }\n  return base64UrlEncode(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\nexport async function pkceChallenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    encoder.encode(verifier),\n  );\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\n/** Create a PKCE verifier and its S256 challenge. */\nexport async function createPkce(): Promise<PkcePair> {\n  const verifier = randomToken();\n  return { verifier, challenge: await pkceChallenge(verifier), method: \"S256\" };\n}\n\nexport function secretsOf(secret: SealSecret): readonly string[] {\n  const list = typeof secret === \"string\" ? [secret] : secret;\n  if (!list.length || list.some((value) => encoder.encode(value).length < 32)) {\n    throw new TypeError(\"Each sealing secret needs at least 32 bytes.\");\n  }\n  return list;\n}\n\nconst keys = new Map<string, Promise<CryptoKey>>();\n\n// The key is the SHA-256 of the secret, as in the hosted sign-in Worker, so a\n// value it sealed opens here with the same secret.\nfunction keyFor(secret: string) {\n  if (!keys.has(secret)) {\n    if (keys.size >= 16) {\n      keys.clear();\n    }\n    keys.set(\n      secret,\n      crypto.subtle\n        .digest(\"SHA-256\", encoder.encode(secret))\n        .then((digest) =>\n          crypto.subtle.importKey(\"raw\", digest, \"AES-GCM\", false, [\n            \"encrypt\",\n            \"decrypt\",\n          ]),\n        ),\n    );\n  }\n  return keys.get(secret) as Promise<CryptoKey>;\n}\n\nconst params = (iv: Uint8Array<ArrayBuffer>, purpose?: string) => ({\n  name: \"AES-GCM\",\n  iv,\n  ...(purpose === undefined ? {} : { additionalData: encoder.encode(purpose) }),\n});\n\n/** Encrypt a JSON value with AES-GCM into a cookie-safe string. */\nexport async function sealValue(\n  value: unknown,\n  { secret, purpose }: SealOptions,\n): Promise<string> {\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n  const cipher = await crypto.subtle.encrypt(\n    params(iv, purpose),\n    await keyFor(secretsOf(secret)[0] as string),\n    encoder.encode(JSON.stringify(value)),\n  );\n  return `${base64UrlEncode(iv)}.${base64UrlEncode(new Uint8Array(cipher))}`;\n}\n\n/** Decrypt a sealed value with any listed secret. Returns null when none opens it. */\nexport async function openSealedValue<T = unknown>(\n  sealed: string | null | undefined,\n  { secret, purpose }: SealOptions,\n): Promise<T | null> {\n  const list = secretsOf(secret);\n  const [ivText = \"\", cipherText = \"\", extra] = (sealed ?? \"\").split(\".\");\n  const iv = base64UrlDecode(ivText);\n  const cipher = base64UrlDecode(cipherText);\n  if (iv?.length !== 12 || !cipher?.length || extra !== undefined) {\n    return null;\n  }\n  for (const candidate of list) {\n    try {\n      const plain = await crypto.subtle.decrypt(\n        params(iv, purpose),\n        await keyFor(candidate),\n        cipher,\n      );\n      return JSON.parse(decoder.decode(plain)) as T;\n    } catch {\n      // Try the next secret.\n    }\n  }\n  return null;\n}\n"],
+  "mappings": ";AAAO,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAEhC,SAAS,gBAAgB,OAA2B;AACzD,MAAI,SAAS;AACb,aAAW,QAAQ,OAAO;AACxB,cAAU,OAAO,aAAa,IAAI;AAAA,EACpC;AACA,SAAO,KAAK,MAAM,EACf,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,GAAG,EACnB,QAAQ,OAAO,EAAE;AACtB;AAIO,SAAS,gBAAgB,MAA8C;AAC5E,SAAO,WAAW,KAAK,IAAI,KAAK,KAAK,SAAS,MAAM,IAChD,WAAW;AAAA,IACT,KAAK,KAAK,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,CAAC;AAAA,IACnD,CAAC,MAAM,EAAE,WAAW,CAAC;AAAA,EACvB,IACA;AACN;AAgCO,SAAS,YAAY,QAAQ,IAAY;AAC9C,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,MAAM,QAAQ,MAAM;AAC1D,UAAM,IAAI,WAAW,8CAA8C;AAAA,EACrE;AACA,SAAO,gBAAgB,OAAO,gBAAgB,IAAI,WAAW,KAAK,CAAC,CAAC;AACtE;AAEA,eAAsB,cAAc,UAAmC;AACrE,QAAM,SAAS,MAAM,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,QAAQ,OAAO,QAAQ;AAAA,EACzB;AACA,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAGA,eAAsB,aAAgC;AACpD,QAAM,WAAW,YAAY;AAC7B,SAAO,EAAE,UAAU,WAAW,MAAM,cAAc,QAAQ,GAAG,QAAQ,OAAO;AAC9E;AAEO,SAAS,UAAU,QAAuC;AAC/D,QAAM,OAAO,OAAO,WAAW,WAAW,CAAC,MAAM,IAAI;AACrD,MAAI,CAAC,KAAK,UAAU,KAAK,KAAK,CAAC,UAAU,QAAQ,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG;AAC3E,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,SAAO;AACT;AAEA,IAAM,OAAO,oBAAI,IAAgC;AAIjD,SAAS,OAAO,QAAgB;AAC9B,MAAI,CAAC,KAAK,IAAI,MAAM,GAAG;AACrB,QAAI,KAAK,QAAQ,IAAI;AACnB,WAAK,MAAM;AAAA,IACb;AACA,SAAK;AAAA,MACH;AAAA,MACA,OAAO,OACJ,OAAO,WAAW,QAAQ,OAAO,MAAM,CAAC,EACxC;AAAA,QAAK,CAAC,WACL,OAAO,OAAO,UAAU,OAAO,QAAQ,WAAW,OAAO;AAAA,UACvD;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACJ;AAAA,EACF;AACA,SAAO,KAAK,IAAI,MAAM;AACxB;AAEA,IAAM,SAAS,CAAC,IAA6B,aAAsB;AAAA,EACjE,MAAM;AAAA,EACN;AAAA,EACA,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,OAAO,OAAO,EAAE;AAC7E;AAGA,eAAsB,UACpB,OACA,EAAE,QAAQ,QAAQ,GACD;AACjB,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,SAAS,MAAM,OAAO,OAAO;AAAA,IACjC,OAAO,IAAI,OAAO;AAAA,IAClB,MAAM,OAAO,UAAU,MAAM,EAAE,CAAC,CAAW;AAAA,IAC3C,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,EACtC;AACA,SAAO,GAAG,gBAAgB,EAAE,CAAC,IAAI,gBAAgB,IAAI,WAAW,MAAM,CAAC,CAAC;AAC1E;AAGA,eAAsB,gBACpB,QACA,EAAE,QAAQ,QAAQ,GACC;AACnB,QAAM,OAAO,UAAU,MAAM;AAC7B,QAAM,CAAC,SAAS,IAAI,aAAa,IAAI,KAAK,KAAK,UAAU,IAAI,MAAM,GAAG;AACtE,QAAM,KAAK,gBAAgB,MAAM;AACjC,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,IAAI,WAAW,MAAM,CAAC,QAAQ,UAAU,UAAU,QAAW;AAC/D,WAAO;AAAA,EACT;AACA,aAAW,aAAa,MAAM;AAC5B,QAAI;AACF,YAAM,QAAQ,MAAM,OAAO,OAAO;AAAA,QAChC,OAAO,IAAI,OAAO;AAAA,QAClB,MAAM,OAAO,SAAS;AAAA,QACtB;AAAA,MACF;AACA,aAAO,KAAK,MAAM,QAAQ,OAAO,KAAK,CAAC;AAAA,IACzC,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/server/auth/jwt.js

@@ -0,0 +1,204 @@
+// src/server/auth/jwt.ts
+import { ZappieError } from "../../errors.js";
+import { base64UrlDecode, decoder, encoder } from "./crypto.js";
+var messages = {
+  malformed: "The token isn't a signed JWT.",
+  unsupported_algorithm: "The token uses an algorithm this verifier refuses.",
+  unknown_key: "The token was signed with a key the issuer doesn't publish.",
+  invalid_signature: "The token's signature doesn't match.",
+  wrong_issuer: "The token comes from a different issuer.",
+  wrong_audience: "The token was issued for a different audience.",
+  wrong_nonce: "The token wasn't issued for this sign-in.",
+  wrong_subject: "The token's subject isn't a Zappie customer.",
+  wrong_type: "The token isn't an ID token.",
+  expired: "The token has expired.",
+  not_yet_valid: "The token isn't valid yet.",
+  keys_unavailable: "The identity issuer's signing keys couldn't be read."
+};
+var ZappieTokenError = class extends ZappieError {
+  constructor(reason, cause) {
+    super(
+      reason === "keys_unavailable" ? "network_error" : "unauthorized",
+      messages[reason],
+      cause === void 0 ? {} : { cause }
+    );
+    this.reason = reason;
+    this.name = "ZappieTokenError";
+  }
+};
+var specs = {
+  RS256: {
+    kty: "RSA",
+    jwk: (key) => ({ kty: "RSA", n: key.n, e: key.e }),
+    import: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    verify: { name: "RSASSA-PKCS1-v1_5" }
+  },
+  ES256: {
+    kty: "EC",
+    jwk: (key) => ({ kty: "EC", crv: "P-256", x: key.x, y: key.y }),
+    import: { name: "ECDSA", namedCurve: "P-256" },
+    verify: { name: "ECDSA", hash: "SHA-256" }
+  }
+};
+var fail = (reason, cause) => {
+  throw new ZappieTokenError(reason, cause);
+};
+var numeric = (value) => typeof value === "number" && Number.isFinite(value);
+var trimSlash = (value) => value.replace(/\/+$/, "");
+var KEY_RETRY_MS = 3e4;
+function decodeJson(text) {
+  const bytes = base64UrlDecode(text) ?? fail("malformed");
+  let value;
+  try {
+    value = JSON.parse(decoder.decode(bytes));
+  } catch {
+  }
+  return value && typeof value === "object" && !Array.isArray(value) ? value : fail("malformed");
+}
+function createTokenVerifier(options) {
+  const issuer = trimSlash(options.issuer);
+  const allowed = options.algorithms ?? ["RS256", "ES256"];
+  const tolerance = options.clockToleranceSec ?? 60;
+  const ttl = (options.cacheTtlSec ?? 3600) * 1e3;
+  const prefix = options.subjectPrefix === void 0 ? "cus_" : options.subjectPrefix;
+  const now = options.now ?? Date.now;
+  const read = options.fetch ?? ((url, init) => fetch(url, init));
+  if (!issuer || !options.audience || !allowed.length || allowed.some((alg) => !(alg in specs)) || !numeric(tolerance) || tolerance < 0 || !numeric(ttl) || ttl < 0) {
+    throw new TypeError(
+      "createTokenVerifier needs an issuer, an audience, RS256 or ES256, and a clock tolerance and cache time of 0 or more."
+    );
+  }
+  let cached;
+  let pending;
+  let triedAt = Number.NEGATIVE_INFINITY;
+  let lastError;
+  const load = async () => {
+    try {
+      const response = await read(
+        options.jwksUrl ?? `${issuer}/.well-known/jwks.json`,
+        {
+          headers: { accept: "application/json" },
+          signal: AbortSignal.timeout(1e4)
+        }
+      );
+      const text = response.ok ? await response.text() : "";
+      if (!text || text.length > 1 << 20) {
+        throw new Error(`The key set answered ${response.status}.`);
+      }
+      const keys = /* @__PURE__ */ new Map();
+      const list = JSON.parse(text).keys;
+      for (const jwk of Array.isArray(list) ? list : []) {
+        for (const alg of allowed) {
+          const spec = specs[alg];
+          if (jwk.kty === spec.kty && (jwk.use ?? "sig") === "sig" && (jwk.alg ?? alg) === alg && (alg === "RS256" || jwk.crv === "P-256")) {
+            await crypto.subtle.importKey(
+              "jwk",
+              spec.jwk(jwk),
+              spec.import,
+              false,
+              ["verify"]
+            ).then((key) => keys.set(`${alg}:${String(jwk.kid ?? "")}`, key)).catch(() => void 0);
+          }
+        }
+      }
+      if (!keys.size) {
+        throw new Error("The key set has no keys this verifier can use.");
+      }
+      return cached = { keys, at: now() };
+    } catch (error) {
+      return fail("keys_unavailable", error);
+    }
+  };
+  const find = (set, kid, alg) => {
+    if (typeof kid === "string") {
+      return set.keys.get(`${alg}:${kid}`);
+    }
+    const fits = [...set.keys].filter(([id]) => id.startsWith(`${alg}:`));
+    return fits.length === 1 ? fits[0]?.[1] : void 0;
+  };
+  const keyFor = async (kid, alg) => {
+    if (!pending) {
+      const key = cached && find(cached, kid, alg);
+      if (key && cached && now() - cached.at < ttl) {
+        return key;
+      }
+      if (now() - triedAt < KEY_RETRY_MS) {
+        return cached ? key : fail("keys_unavailable", lastError);
+      }
+      triedAt = now();
+      pending = load().finally(() => pending = void 0);
+    }
+    try {
+      const set = await pending;
+      lastError = void 0;
+      return find(set, kid, alg);
+    } catch (error) {
+      lastError = error;
+      return (cached && find(cached, kid, alg)) ?? fail("keys_unavailable", error);
+    }
+  };
+  const check = async (token, checks, idToken) => {
+    const parts = typeof token === "string" && token.length < 16384 ? token.split(".") : [];
+    const [head = "", body = "", sig = ""] = parts.length === 3 ? parts : fail("malformed");
+    const header = decodeJson(head);
+    const claims = decodeJson(body);
+    const signature = base64UrlDecode(sig) ?? fail("malformed");
+    const alg = header.alg;
+    if (!allowed.includes(alg) || header.crit !== void 0) {
+      fail("unsupported_algorithm");
+    }
+    if (idToken && header.typ !== void 0 && (typeof header.typ !== "string" || header.typ.toLowerCase().replace(/^application\//, "") !== "jwt")) {
+      fail("wrong_type");
+    }
+    const key = await keyFor(header.kid, alg) ?? fail("unknown_key");
+    if (alg === "ES256" && signature.length !== 64 || !await crypto.subtle.verify(
+      specs[alg].verify,
+      key,
+      signature,
+      encoder.encode(`${head}.${body}`)
+    )) {
+      fail("invalid_signature");
+    }
+    const seconds = now() / 1e3;
+    const times = [claims.nbf, claims.iat];
+    const sub = claims.sub;
+    if (typeof claims.iss !== "string" || trimSlash(claims.iss) !== issuer) {
+      fail("wrong_issuer");
+    }
+    if (![claims.aud].flat().includes(checks.audience ?? options.audience)) {
+      fail("wrong_audience");
+    }
+    if (!numeric(claims.exp) || times.some((time) => time !== void 0 && !numeric(time))) {
+      fail("malformed");
+    }
+    if (seconds > claims.exp + tolerance) {
+      fail("expired");
+    }
+    if (times.some((time) => time > seconds + tolerance)) {
+      fail("not_yet_valid");
+    }
+    if (checks.nonce !== void 0 && claims.nonce !== checks.nonce) {
+      fail("wrong_nonce");
+    }
+    if ((prefix !== null || idToken) && (typeof sub !== "string" || !sub || prefix !== null && (!sub.startsWith(prefix) || sub.length === prefix.length))) {
+      fail("wrong_subject");
+    }
+    return claims;
+  };
+  return {
+    verify: (token, checks = {}) => check(token, checks, false),
+    async verifyIdToken(token, checks) {
+      if (typeof checks?.nonce !== "string" || !checks.nonce) {
+        throw new TypeError(
+          "verifyIdToken needs the nonce you sent with the sign-in."
+        );
+      }
+      return await check(token, checks, true);
+    }
+  };
+}
+export {
+  ZappieTokenError,
+  createTokenVerifier
+};
+//# sourceMappingURL=jwt.js.map

package/dist/server/auth/jwt.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/server/auth/jwt.ts"],
+  "sourcesContent": ["import { ZappieError } from \"../../errors\";\nimport { base64UrlDecode, decoder, encoder } from \"./crypto\";\n\n/** Signing algorithms Sign in with Zappie tokens can use. */\nexport type TokenAlgorithm = \"RS256\" | \"ES256\";\n\nconst messages = {\n  malformed: \"The token isn't a signed JWT.\",\n  unsupported_algorithm: \"The token uses an algorithm this verifier refuses.\",\n  unknown_key: \"The token was signed with a key the issuer doesn't publish.\",\n  invalid_signature: \"The token's signature doesn't match.\",\n  wrong_issuer: \"The token comes from a different issuer.\",\n  wrong_audience: \"The token was issued for a different audience.\",\n  wrong_nonce: \"The token wasn't issued for this sign-in.\",\n  wrong_subject: \"The token's subject isn't a Zappie customer.\",\n  wrong_type: \"The token isn't an ID token.\",\n  expired: \"The token has expired.\",\n  not_yet_valid: \"The token isn't valid yet.\",\n  keys_unavailable: \"The identity issuer's signing keys couldn't be read.\",\n};\n\n/** Why a token was refused. */\nexport type TokenErrorReason = keyof typeof messages;\n\n/** A token Zappie's identity issuer didn't sign for you, or one that is no longer valid. */\nexport class ZappieTokenError extends ZappieError {\n  constructor(\n    readonly reason: TokenErrorReason,\n    cause?: unknown,\n  ) {\n    super(\n      reason === \"keys_unavailable\" ? \"network_error\" : \"unauthorized\",\n      messages[reason],\n      cause === undefined ? {} : { cause },\n    );\n    this.name = \"ZappieTokenError\";\n  }\n}\n\n/** The verified claims of a token. Extra claims stay on the object. */\nexport type TokenClaims = {\n  iss: string;\n  aud: string | string[];\n  exp: number;\n  sub?: string;\n  iat?: number;\n  nbf?: number;\n  nonce?: string;\n  sid?: string;\n  [claim: string]: unknown;\n};\n\n/** Settings for verifying tokens from Zappie's identity issuer. */\nexport type TokenVerifierOptions = {\n  /** The issuer URL, such as `https://accounts.zappie.ai`. The token's `iss` must equal it. A trailing slash on either is ignored. */\n  issuer: string;\n  /** The audience the token must name: your site's client id for ID tokens, or the API audience for access tokens. */\n  audience: string;\n  /** Where to read the signing keys. Defaults to `<issuer>/.well-known/jwks.json`. */\n  jwksUrl?: string;\n  /** Allowed algorithms. Defaults to RS256 and ES256. */\n  algorithms?: readonly TokenAlgorithm[];\n  /** Seconds of clock skew allowed on `exp`, `nbf` and `iat`. Defaults to 60. */\n  clockToleranceSec?: number;\n  /** Seconds to keep the key set before reading it again, 0 or more. Defaults to one hour. */\n  cacheTtlSec?: number;\n  /** Prefix the `sub` claim must start with. Zappie customers are `cus_`. A token without `sub` is refused. Pass `null` to skip both checks. */\n  subjectPrefix?: string | null;\n  /** The fetch to read keys with. Defaults to the global fetch. */\n  fetch?: typeof fetch;\n  /** The current time in milliseconds. For tests. */\n  now?: () => number;\n};\n\n/** Per-call checks on top of the verifier's settings. */\nexport type VerifyTokenChecks = {\n  /** The nonce you sent with the sign-in. When you pass it, the token's `nonce` must equal it. */\n  nonce?: string;\n  /** Overrides the verifier's audience for this token. */\n  audience?: string;\n};\n\n/** Checks for an ID token from a sign-in. */\nexport type IdTokenChecks = {\n  /** The nonce you sent with this sign-in. The token's `nonce` must equal it. */\n  nonce: string;\n  /** Overrides the verifier's audience for this token. */\n  audience?: string;\n};\n\n/** The verified claims of an ID token. */\nexport type IdTokenClaims = TokenClaims & { sub: string; nonce: string };\n\n/** Verifies signed tokens against the issuer's published keys. */\nexport type TokenVerifier = {\n  /** Verify a token's signature and claims, and return its claims. */\n  verify(token: string, checks?: VerifyTokenChecks): Promise<TokenClaims>;\n  /**\n   * Verify the ID token from a sign-in. It needs the nonce you sent, a `sub`,\n   * and refuses a token whose `typ` header names another kind of token, such\n   * as an access token (`at+jwt`).\n   */\n  verifyIdToken(token: string, checks: IdTokenChecks): Promise<IdTokenClaims>;\n};\n\ntype Jwk = Record<string, unknown>;\ntype KeySet = { keys: Map<string, CryptoKey>; at: number };\n\nconst specs = {\n  RS256: {\n    kty: \"RSA\",\n    jwk: (key: Jwk) => ({ kty: \"RSA\", n: key.n, e: key.e }),\n    import: { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n    verify: { name: \"RSASSA-PKCS1-v1_5\" },\n  },\n  ES256: {\n    kty: \"EC\",\n    jwk: (key: Jwk) => ({ kty: \"EC\", crv: \"P-256\", x: key.x, y: key.y }),\n    import: { name: \"ECDSA\", namedCurve: \"P-256\" },\n    verify: { name: \"ECDSA\", hash: \"SHA-256\" },\n  },\n} as const;\n\nconst fail = (reason: TokenErrorReason, cause?: unknown): never => {\n  throw new ZappieTokenError(reason, cause);\n};\nconst numeric = (value: unknown): value is number =>\n  typeof value === \"number\" && Number.isFinite(value);\nconst trimSlash = (value: string) => value.replace(/\\/+$/, \"\");\nconst KEY_RETRY_MS = 30_000;\n\nfunction decodeJson(text: string): Record<string, unknown> {\n  const bytes = base64UrlDecode(text) ?? fail(\"malformed\");\n  let value: unknown;\n  try {\n    value = JSON.parse(decoder.decode(bytes));\n  } catch {\n    // Refused below.\n  }\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : fail(\"malformed\");\n}\n\n/**\n * Create a verifier for tokens from Zappie's identity issuer. It caches the\n * issuer's key set, reads it again when a token names an unknown key, and\n * keeps the last good set while the issuer is down. It uses Web Crypto only,\n * so it runs in Workers and Node 20 or later.\n */\nexport function createTokenVerifier(\n  options: TokenVerifierOptions,\n): TokenVerifier {\n  const issuer = trimSlash(options.issuer);\n  const allowed: readonly string[] = options.algorithms ?? [\"RS256\", \"ES256\"];\n  const tolerance = options.clockToleranceSec ?? 60;\n  const ttl = (options.cacheTtlSec ?? 3600) * 1000;\n  const prefix =\n    options.subjectPrefix === undefined ? \"cus_\" : options.subjectPrefix;\n  const now = options.now ?? Date.now;\n  const read = options.fetch ?? ((url, init) => fetch(url, init));\n  if (\n    !issuer ||\n    !options.audience ||\n    !allowed.length ||\n    allowed.some((alg) => !(alg in specs)) ||\n    !numeric(tolerance) ||\n    tolerance < 0 ||\n    !numeric(ttl) ||\n    ttl < 0\n  ) {\n    throw new TypeError(\n      \"createTokenVerifier needs an issuer, an audience, RS256 or ES256, and a clock tolerance and cache time of 0 or more.\",\n    );\n  }\n\n  let cached: KeySet | undefined;\n  let pending: Promise<KeySet> | undefined;\n  let triedAt = Number.NEGATIVE_INFINITY;\n  let lastError: unknown;\n\n  const load = async (): Promise<KeySet> => {\n    try {\n      const response = await read(\n        options.jwksUrl ?? `${issuer}/.well-known/jwks.json`,\n        {\n          headers: { accept: \"application/json\" },\n          signal: AbortSignal.timeout(10_000),\n        },\n      );\n      const text = response.ok ? await response.text() : \"\";\n      if (!text || text.length > 1 << 20) {\n        throw new Error(`The key set answered ${response.status}.`);\n      }\n      const keys = new Map<string, CryptoKey>();\n      const list = (JSON.parse(text) as { keys?: unknown }).keys;\n      for (const jwk of Array.isArray(list) ? (list as Jwk[]) : []) {\n        for (const alg of allowed as TokenAlgorithm[]) {\n          const spec = specs[alg];\n          if (\n            jwk.kty === spec.kty &&\n            (jwk.use ?? \"sig\") === \"sig\" &&\n            (jwk.alg ?? alg) === alg &&\n            (alg === \"RS256\" || jwk.crv === \"P-256\")\n          ) {\n            // A key this runtime can't import can't have signed a token we accept.\n            await crypto.subtle\n              .importKey(\n                \"jwk\",\n                spec.jwk(jwk) as JsonWebKey,\n                spec.import,\n                false,\n                [\"verify\"],\n              )\n              .then((key) => keys.set(`${alg}:${String(jwk.kid ?? \"\")}`, key))\n              .catch(() => undefined);\n          }\n        }\n      }\n      // An empty or unusable set is an issuer fault, not a rotation, so it\n      // never replaces the keys that verified tokens until now.\n      if (!keys.size) {\n        throw new Error(\"The key set has no keys this verifier can use.\");\n      }\n      return (cached = { keys, at: now() });\n    } catch (error) {\n      return fail(\"keys_unavailable\", error);\n    }\n  };\n\n  const find = (set: KeySet, kid: unknown, alg: string) => {\n    if (typeof kid === \"string\") {\n      return set.keys.get(`${alg}:${kid}`);\n    }\n    // Without a kid, only a key set with one key for the algorithm can answer.\n    const fits = [...set.keys].filter(([id]) => id.startsWith(`${alg}:`));\n    return fits.length === 1 ? fits[0]?.[1] : undefined;\n  };\n\n  // The key set is read at most every 30 seconds, whether a forged kid\n  // missed the cache or the issuer is down, so neither can make every\n  // request call the issuer.\n  const keyFor = async (kid: unknown, alg: string) => {\n    if (!pending) {\n      const key = cached && find(cached, kid, alg);\n      if (key && cached && now() - cached.at < ttl) {\n        return key;\n      }\n      if (now() - triedAt < KEY_RETRY_MS) {\n        return cached ? key : fail(\"keys_unavailable\", lastError);\n      }\n      triedAt = now();\n      pending = load().finally(() => (pending = undefined));\n    }\n    try {\n      const set = await pending;\n      lastError = undefined;\n      return find(set, kid, alg);\n    } catch (error) {\n      lastError = error;\n      return (\n        (cached && find(cached, kid, alg)) ?? fail(\"keys_unavailable\", error)\n      );\n    }\n  };\n\n  const check = async (\n    token: string,\n    checks: VerifyTokenChecks,\n    idToken: boolean,\n  ): Promise<TokenClaims> => {\n    const parts =\n      typeof token === \"string\" && token.length < 16_384\n        ? token.split(\".\")\n        : [];\n    const [head = \"\", body = \"\", sig = \"\"] =\n      parts.length === 3 ? parts : fail(\"malformed\");\n    const header = decodeJson(head);\n    const claims = decodeJson(body);\n    const signature = base64UrlDecode(sig) ?? fail(\"malformed\");\n    const alg = header.alg as TokenAlgorithm;\n    if (!allowed.includes(alg) || header.crit !== undefined) {\n      fail(\"unsupported_algorithm\");\n    }\n    if (\n      idToken &&\n      header.typ !== undefined &&\n      (typeof header.typ !== \"string\" ||\n        header.typ.toLowerCase().replace(/^application\\//, \"\") !== \"jwt\")\n    ) {\n      fail(\"wrong_type\");\n    }\n    const key = (await keyFor(header.kid, alg)) ?? fail(\"unknown_key\");\n    if (\n      (alg === \"ES256\" && signature.length !== 64) ||\n      !(await crypto.subtle.verify(\n        specs[alg].verify,\n        key,\n        signature,\n        encoder.encode(`${head}.${body}`),\n      ))\n    ) {\n      fail(\"invalid_signature\");\n    }\n\n    const seconds = now() / 1000;\n    const times = [claims.nbf, claims.iat];\n    const sub = claims.sub;\n    if (typeof claims.iss !== \"string\" || trimSlash(claims.iss) !== issuer) {\n      fail(\"wrong_issuer\");\n    }\n    if (![claims.aud].flat().includes(checks.audience ?? options.audience)) {\n      fail(\"wrong_audience\");\n    }\n    if (\n      !numeric(claims.exp) ||\n      times.some((time) => time !== undefined && !numeric(time))\n    ) {\n      fail(\"malformed\");\n    }\n    if (seconds > (claims.exp as number) + tolerance) {\n      fail(\"expired\");\n    }\n    if (times.some((time) => (time as number) > seconds + tolerance)) {\n      fail(\"not_yet_valid\");\n    }\n    if (checks.nonce !== undefined && claims.nonce !== checks.nonce) {\n      fail(\"wrong_nonce\");\n    }\n    if (\n      (prefix !== null || idToken) &&\n      (typeof sub !== \"string\" ||\n        !sub ||\n        (prefix !== null &&\n          (!sub.startsWith(prefix) || sub.length === prefix.length)))\n    ) {\n      fail(\"wrong_subject\");\n    }\n    return claims as TokenClaims;\n  };\n\n  return {\n    verify: (token, checks = {}) => check(token, checks, false),\n    async verifyIdToken(token, checks) {\n      if (typeof checks?.nonce !== \"string\" || !checks.nonce) {\n        throw new TypeError(\n          \"verifyIdToken needs the nonce you sent with the sign-in.\",\n        );\n      }\n      return (await check(token, checks, true)) as IdTokenClaims;\n    },\n  };\n}\n"],
+  "mappings": ";AAAA,SAAS,mBAAmB;AAC5B,SAAS,iBAAiB,SAAS,eAAe;AAKlD,IAAM,WAAW;AAAA,EACf,WAAW;AAAA,EACX,uBAAuB;AAAA,EACvB,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,eAAe;AAAA,EACf,kBAAkB;AACpB;AAMO,IAAM,mBAAN,cAA+B,YAAY;AAAA,EAChD,YACW,QACT,OACA;AACA;AAAA,MACE,WAAW,qBAAqB,kBAAkB;AAAA,MAClD,SAAS,MAAM;AAAA,MACf,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACrC;AAPS;AAQT,SAAK,OAAO;AAAA,EACd;AACF;AAuEA,IAAM,QAAQ;AAAA,EACZ,OAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK,CAAC,SAAc,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE;AAAA,IACrD,QAAQ,EAAE,MAAM,qBAAqB,MAAM,UAAU;AAAA,IACrD,QAAQ,EAAE,MAAM,oBAAoB;AAAA,EACtC;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK,CAAC,SAAc,EAAE,KAAK,MAAM,KAAK,SAAS,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE;AAAA,IAClE,QAAQ,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IAC7C,QAAQ,EAAE,MAAM,SAAS,MAAM,UAAU;AAAA,EAC3C;AACF;AAEA,IAAM,OAAO,CAAC,QAA0B,UAA2B;AACjE,QAAM,IAAI,iBAAiB,QAAQ,KAAK;AAC1C;AACA,IAAM,UAAU,CAAC,UACf,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AACpD,IAAM,YAAY,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAC7D,IAAM,eAAe;AAErB,SAAS,WAAW,MAAuC;AACzD,QAAM,QAAQ,gBAAgB,IAAI,KAAK,KAAK,WAAW;AACvD,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,QAAQ,OAAO,KAAK,CAAC;AAAA,EAC1C,QAAQ;AAAA,EAER;AACA,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD,KAAK,WAAW;AACtB;AAQO,SAAS,oBACd,SACe;AACf,QAAM,SAAS,UAAU,QAAQ,MAAM;AACvC,QAAM,UAA6B,QAAQ,cAAc,CAAC,SAAS,OAAO;AAC1E,QAAM,YAAY,QAAQ,qBAAqB;AAC/C,QAAM,OAAO,QAAQ,eAAe,QAAQ;AAC5C,QAAM,SACJ,QAAQ,kBAAkB,SAAY,SAAS,QAAQ;AACzD,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,OAAO,QAAQ,UAAU,CAAC,KAAK,SAAS,MAAM,KAAK,IAAI;AAC7D,MACE,CAAC,UACD,CAAC,QAAQ,YACT,CAAC,QAAQ,UACT,QAAQ,KAAK,CAAC,QAAQ,EAAE,OAAO,MAAM,KACrC,CAAC,QAAQ,SAAS,KAClB,YAAY,KACZ,CAAC,QAAQ,GAAG,KACZ,MAAM,GACN;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,UAAU,OAAO;AACrB,MAAI;AAEJ,QAAM,OAAO,YAA6B;AACxC,QAAI;AACF,YAAM,WAAW,MAAM;AAAA,QACrB,QAAQ,WAAW,GAAG,MAAM;AAAA,QAC5B;AAAA,UACE,SAAS,EAAE,QAAQ,mBAAmB;AAAA,UACtC,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC;AAAA,MACF;AACA,YAAM,OAAO,SAAS,KAAK,MAAM,SAAS,KAAK,IAAI;AACnD,UAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,IAAI;AAClC,cAAM,IAAI,MAAM,wBAAwB,SAAS,MAAM,GAAG;AAAA,MAC5D;AACA,YAAM,OAAO,oBAAI,IAAuB;AACxC,YAAM,OAAQ,KAAK,MAAM,IAAI,EAAyB;AACtD,iBAAW,OAAO,MAAM,QAAQ,IAAI,IAAK,OAAiB,CAAC,GAAG;AAC5D,mBAAW,OAAO,SAA6B;AAC7C,gBAAM,OAAO,MAAM,GAAG;AACtB,cACE,IAAI,QAAQ,KAAK,QAChB,IAAI,OAAO,WAAW,UACtB,IAAI,OAAO,SAAS,QACpB,QAAQ,WAAW,IAAI,QAAQ,UAChC;AAEA,kBAAM,OAAO,OACV;AAAA,cACC;AAAA,cACA,KAAK,IAAI,GAAG;AAAA,cACZ,KAAK;AAAA,cACL;AAAA,cACA,CAAC,QAAQ;AAAA,YACX,EACC,KAAK,CAAC,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC,IAAI,GAAG,CAAC,EAC9D,MAAM,MAAM,MAAS;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,KAAK,MAAM;AACd,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,aAAQ,SAAS,EAAE,MAAM,IAAI,IAAI,EAAE;AAAA,IACrC,SAAS,OAAO;AACd,aAAO,KAAK,oBAAoB,KAAK;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,OAAO,CAAC,KAAa,KAAc,QAAgB;AACvD,QAAI,OAAO,QAAQ,UAAU;AAC3B,aAAO,IAAI,KAAK,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE;AAAA,IACrC;AAEA,UAAM,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,GAAG,GAAG,CAAC;AACpE,WAAO,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI;AAAA,EAC5C;AAKA,QAAM,SAAS,OAAO,KAAc,QAAgB;AAClD,QAAI,CAAC,SAAS;AACZ,YAAM,MAAM,UAAU,KAAK,QAAQ,KAAK,GAAG;AAC3C,UAAI,OAAO,UAAU,IAAI,IAAI,OAAO,KAAK,KAAK;AAC5C,eAAO;AAAA,MACT;AACA,UAAI,IAAI,IAAI,UAAU,cAAc;AAClC,eAAO,SAAS,MAAM,KAAK,oBAAoB,SAAS;AAAA,MAC1D;AACA,gBAAU,IAAI;AACd,gBAAU,KAAK,EAAE,QAAQ,MAAO,UAAU,MAAU;AAAA,IACtD;AACA,QAAI;AACF,YAAM,MAAM,MAAM;AAClB,kBAAY;AACZ,aAAO,KAAK,KAAK,KAAK,GAAG;AAAA,IAC3B,SAAS,OAAO;AACd,kBAAY;AACZ,cACG,UAAU,KAAK,QAAQ,KAAK,GAAG,MAAM,KAAK,oBAAoB,KAAK;AAAA,IAExE;AAAA,EACF;AAEA,QAAM,QAAQ,OACZ,OACA,QACA,YACyB;AACzB,UAAM,QACJ,OAAO,UAAU,YAAY,MAAM,SAAS,QACxC,MAAM,MAAM,GAAG,IACf,CAAC;AACP,UAAM,CAAC,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE,IACnC,MAAM,WAAW,IAAI,QAAQ,KAAK,WAAW;AAC/C,UAAM,SAAS,WAAW,IAAI;AAC9B,UAAM,SAAS,WAAW,IAAI;AAC9B,UAAM,YAAY,gBAAgB,GAAG,KAAK,KAAK,WAAW;AAC1D,UAAM,MAAM,OAAO;AACnB,QAAI,CAAC,QAAQ,SAAS,GAAG,KAAK,OAAO,SAAS,QAAW;AACvD,WAAK,uBAAuB;AAAA,IAC9B;AACA,QACE,WACA,OAAO,QAAQ,WACd,OAAO,OAAO,QAAQ,YACrB,OAAO,IAAI,YAAY,EAAE,QAAQ,kBAAkB,EAAE,MAAM,QAC7D;AACA,WAAK,YAAY;AAAA,IACnB;AACA,UAAM,MAAO,MAAM,OAAO,OAAO,KAAK,GAAG,KAAM,KAAK,aAAa;AACjE,QACG,QAAQ,WAAW,UAAU,WAAW,MACzC,CAAE,MAAM,OAAO,OAAO;AAAA,MACpB,MAAM,GAAG,EAAE;AAAA,MACX;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE;AAAA,IAClC,GACA;AACA,WAAK,mBAAmB;AAAA,IAC1B;AAEA,UAAM,UAAU,IAAI,IAAI;AACxB,UAAM,QAAQ,CAAC,OAAO,KAAK,OAAO,GAAG;AACrC,UAAM,MAAM,OAAO;AACnB,QAAI,OAAO,OAAO,QAAQ,YAAY,UAAU,OAAO,GAAG,MAAM,QAAQ;AACtE,WAAK,cAAc;AAAA,IACrB;AACA,QAAI,CAAC,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,YAAY,QAAQ,QAAQ,GAAG;AACtE,WAAK,gBAAgB;AAAA,IACvB;AACA,QACE,CAAC,QAAQ,OAAO,GAAG,KACnB,MAAM,KAAK,CAAC,SAAS,SAAS,UAAa,CAAC,QAAQ,IAAI,CAAC,GACzD;AACA,WAAK,WAAW;AAAA,IAClB;AACA,QAAI,UAAW,OAAO,MAAiB,WAAW;AAChD,WAAK,SAAS;AAAA,IAChB;AACA,QAAI,MAAM,KAAK,CAAC,SAAU,OAAkB,UAAU,SAAS,GAAG;AAChE,WAAK,eAAe;AAAA,IACtB;AACA,QAAI,OAAO,UAAU,UAAa,OAAO,UAAU,OAAO,OAAO;AAC/D,WAAK,aAAa;AAAA,IACpB;AACA,SACG,WAAW,QAAQ,aACnB,OAAO,QAAQ,YACd,CAAC,OACA,WAAW,SACT,CAAC,IAAI,WAAW,MAAM,KAAK,IAAI,WAAW,OAAO,UACtD;AACA,WAAK,eAAe;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,QAAQ,CAAC,OAAO,SAAS,CAAC,MAAM,MAAM,OAAO,QAAQ,KAAK;AAAA,IAC1D,MAAM,cAAc,OAAO,QAAQ;AACjC,UAAI,OAAO,QAAQ,UAAU,YAAY,CAAC,OAAO,OAAO;AACtD,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAQ,MAAM,MAAM,OAAO,QAAQ,IAAI;AAAA,IACzC;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/server/auth/session-store.js

@@ -0,0 +1,46 @@
+// src/server/auth/session-store.ts
+import { ZappieError } from "../../errors.js";
+import {
+  openSealedValue,
+  sealValue,
+  secretsOf
+} from "./crypto.js";
+function cookieSessionStore(options) {
+  const maxAge = (options.maxAgeSec ?? 30 * 24 * 60 * 60) * 1e3;
+  const now = options.now ?? Date.now;
+  const sealing = { secret: options.secret, purpose: "zappie_session" };
+  secretsOf(options.secret);
+  if (!(maxAge > 0 && Number.isFinite(maxAge))) {
+    throw new TypeError("maxAgeSec must be a positive number of seconds.");
+  }
+  const refuse = (message) => {
+    throw new ZappieError("invalid_request", message);
+  };
+  const seal = async (envelope) => {
+    const sealed = await sealValue(envelope, sealing);
+    return sealed.length > 3800 ? refuse(
+      "This session is too large for a cookie. Use a session store that keeps sessions on the server."
+    ) : sealed;
+  };
+  const open = async (sid) => {
+    const envelope = await openSealedValue(sid, sealing);
+    return envelope?.v === 1 && envelope.exp > now() ? envelope : null;
+  };
+  return {
+    create: (data) => seal({ v: 1, exp: now() + maxAge, data }),
+    get: async (sid) => (await open(sid))?.data ?? null,
+    async update(sid, patch) {
+      const envelope = await open(sid);
+      return envelope ? seal({ ...envelope, data: { ...envelope.data, ...patch } }) : null;
+    },
+    // The session is the cookie, so clearing the cookie ends it.
+    delete: async () => void 0,
+    deleteBySub: async () => refuse(
+      "A cookie session store can't end sessions from the server. Use a session store that keeps sessions on the server for back-channel logout."
+    )
+  };
+}
+export {
+  cookieSessionStore
+};
+//# sourceMappingURL=session-store.js.map