@~lyre/auth 0.11.0 → 0.12.0

package/dist/chunk-F2GDXTY4.js

@@ -0,0 +1,971 @@
+// src/index.ts
+import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// src/oidc.ts
+import {
+  createHash,
+  createPublicKey,
+  randomBytes,
+  timingSafeEqual,
+  verify as cryptoVerify
+} from "crypto";
+var OidcError = class extends Error {
+  code;
+  /** HTTP status from Accounts, when the failure was an HTTP response. */
+  status;
+  /** OAuth `error` field (`invalid_grant`, `invalid_client`, `access_denied`, …). */
+  oauthError;
+  oauthErrorDescription;
+  constructor(code, message, details = {}) {
+    super(message, details.cause === void 0 ? void 0 : { cause: details.cause });
+    this.name = "OidcError";
+    this.code = code;
+    this.status = details.status;
+    this.oauthError = details.oauthError;
+    this.oauthErrorDescription = details.oauthErrorDescription;
+  }
+};
+function isOidcError(error, code) {
+  return error instanceof OidcError && (code === void 0 || error.code === code);
+}
+var ACCOUNTS_ENDPOINT_PATHS = Object.freeze({
+  authorization: "/auth/authorize",
+  token: "/api/auth/token",
+  userinfo: "/api/auth/userinfo",
+  jwks: "/api/.well-known/jwks.json",
+  revocation: "/api/auth/revoke",
+  endSession: "/auth/logout"
+});
+var DEFAULT_OIDC_SCOPES = ["openid", "profile", "email", "offline_access"];
+function b64url(buf) {
+  return buf.toString("base64url");
+}
+function randomToken(bytes = 32) {
+  return b64url(randomBytes(bytes));
+}
+function pkceChallenge(verifier) {
+  return b64url(createHash("sha256").update(verifier, "ascii").digest());
+}
+function createPkcePair() {
+  const codeVerifier = randomToken(32);
+  return { codeVerifier, codeChallenge: pkceChallenge(codeVerifier) };
+}
+function safeEqual(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+function stripSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function resolveUrl(value, issuer) {
+  return new URL(value, issuer + "/").toString();
+}
+function normalizeScopes(scopes) {
+  if (scopes === void 0) return DEFAULT_OIDC_SCOPES.join(" ");
+  const list = typeof scopes === "string" ? scopes.split(/[\s,]+/) : [...scopes];
+  return list.map((s) => s.trim()).filter(Boolean).join(" ");
+}
+function formEncode(value) {
+  return encodeURIComponent(value).replace(/%20/g, "+");
+}
+async function safeFetch(fetchImpl, url, init, code) {
+  try {
+    return await fetchImpl(url, init);
+  } catch (cause) {
+    throw new OidcError(code === "token_request_failed" ? "network_error" : code, `Request to ${url} failed.`, {
+      cause
+    });
+  }
+}
+async function readJson(res) {
+  try {
+    const data = await res.json();
+    return data && typeof data === "object" && !Array.isArray(data) ? data : null;
+  } catch {
+    return null;
+  }
+}
+function createMetadataSource(opts) {
+  const issuer = stripSlash(opts.issuer);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const now = opts.now ?? Date.now;
+  const ttl = opts.metadataCacheTtlMs ?? 60 * 60 * 1e3;
+  const override = (key) => opts.endpoints?.[key];
+  const fromPaths = () => {
+    const out = {};
+    for (const key of Object.keys(ACCOUNTS_ENDPOINT_PATHS)) {
+      out[key] = resolveUrl(override(key) ?? ACCOUNTS_ENDPOINT_PATHS[key], issuer);
+    }
+    return out;
+  };
+  if (!opts.discovery) {
+    const fixed = fromPaths();
+    return { get: async () => fixed };
+  }
+  let cached = null;
+  let inflight = null;
+  async function load() {
+    const url = `${issuer}/.well-known/openid-configuration`;
+    const res = await safeFetch(fetchImpl, url, { headers: { accept: "application/json" } }, "discovery_failed");
+    if (!res.ok) throw new OidcError("discovery_failed", `Discovery returned ${res.status}.`, { status: res.status });
+    const doc = await readJson(res);
+    if (!doc) throw new OidcError("discovery_failed", "Discovery document is not JSON.");
+    if (typeof doc.issuer !== "string" || stripSlash(doc.issuer) !== issuer) {
+      throw new OidcError("issuer_mismatch", `Discovery issuer ${String(doc.issuer)} is not ${issuer}.`);
+    }
+    const pick = (key, field) => {
+      const explicit = override(key);
+      if (explicit) return resolveUrl(explicit, issuer);
+      const advertised = doc[field];
+      return typeof advertised === "string" && advertised ? advertised : resolveUrl(ACCOUNTS_ENDPOINT_PATHS[key], issuer);
+    };
+    return {
+      authorization: pick("authorization", "authorization_endpoint"),
+      token: pick("token", "token_endpoint"),
+      userinfo: pick("userinfo", "userinfo_endpoint"),
+      jwks: pick("jwks", "jwks_uri"),
+      revocation: pick("revocation", "revocation_endpoint"),
+      endSession: pick("endSession", "end_session_endpoint")
+    };
+  }
+  return {
+    async get() {
+      if (cached && cached.expires > now()) return cached.value;
+      inflight ??= load().then((value) => {
+        cached = { value, expires: now() + ttl };
+        return value;
+      }).finally(() => {
+        inflight = null;
+      });
+      return inflight;
+    }
+  };
+}
+var JwksStore = class {
+  constructor(metadata, fetchImpl, ttlMs, cooldownMs, now) {
+    this.metadata = metadata;
+    this.fetchImpl = fetchImpl;
+    this.ttlMs = ttlMs;
+    this.cooldownMs = cooldownMs;
+    this.now = now;
+  }
+  metadata;
+  fetchImpl;
+  ttlMs;
+  cooldownMs;
+  now;
+  keys = /* @__PURE__ */ new Map();
+  anonymous = [];
+  fetchedAt = -Infinity;
+  inflight = null;
+  /** Number of JWKS fetches performed (observability / tests). */
+  fetchCount = 0;
+  async refresh() {
+    this.inflight ??= (async () => {
+      const { jwks } = await this.metadata.get();
+      const res = await safeFetch(this.fetchImpl, jwks, { headers: { accept: "application/json" } }, "jwks_fetch_failed");
+      if (!res.ok) throw new OidcError("jwks_fetch_failed", `JWKS returned ${res.status}.`, { status: res.status });
+      const body = await readJson(res);
+      if (!body || !Array.isArray(body.keys)) throw new OidcError("jwks_fetch_failed", "JWKS is not a key set.");
+      const keys = /* @__PURE__ */ new Map();
+      const anonymous = [];
+      for (const jwk of body.keys) {
+        if (!jwk || jwk.kty !== "RSA") continue;
+        if (jwk.use && jwk.use !== "sig") continue;
+        if (jwk.alg && jwk.alg !== "RS256") continue;
+        let key;
+        try {
+          key = createPublicKey({ key: jwk, format: "jwk" });
+        } catch {
+          continue;
+        }
+        if (jwk.kid) keys.set(jwk.kid, key);
+        else anonymous.push(key);
+      }
+      this.fetchCount++;
+      this.keys = keys;
+      this.anonymous = anonymous;
+      this.fetchedAt = this.now();
+    })().finally(() => {
+      this.inflight = null;
+    });
+    return this.inflight;
+  }
+  lookup(kid) {
+    if (kid) return this.keys.get(kid);
+    const all = [...this.keys.values(), ...this.anonymous];
+    return all.length === 1 ? all[0] : void 0;
+  }
+  async getKey(kid) {
+    const age = this.now() - this.fetchedAt;
+    if (age >= this.ttlMs) await this.refresh();
+    let key = this.lookup(kid);
+    if (!key && this.now() - this.fetchedAt >= this.cooldownMs) {
+      await this.refresh();
+      key = this.lookup(kid);
+    }
+    if (!key) throw new OidcError("unknown_kid", `No signing key for kid ${kid ?? "(none)"}.`);
+    return key;
+  }
+};
+function decodeJwt(token) {
+  const parts = typeof token === "string" ? token.split(".") : [];
+  if (parts.length !== 3 || parts.some((p) => !/^[A-Za-z0-9_-]*$/.test(p)) || !parts[0] || !parts[1]) {
+    throw new OidcError("invalid_jwt", "Token is not a compact JWS.");
+  }
+  const parse = (segment) => {
+    try {
+      const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("not an object");
+      return value;
+    } catch {
+      throw new OidcError("invalid_jwt", "Token segment is not base64url JSON.");
+    }
+  };
+  return {
+    header: parse(parts[0]),
+    payload: parse(parts[1]),
+    signingInput: `${parts[0]}.${parts[1]}`,
+    signature: Buffer.from(parts[2], "base64url")
+  };
+}
+function looksLikeJwt(token) {
+  return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/.test(token);
+}
+function checkClaims(payload, checks) {
+  if (typeof payload.iss !== "string" || stripSlash(payload.iss) !== checks.issuer) {
+    throw new OidcError("issuer_mismatch", `Token issuer ${String(payload.iss)} is not ${checks.issuer}.`);
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    throw new OidcError("invalid_jwt", "Token has no subject.");
+  }
+  const aud = payload.aud;
+  const auds = typeof aud === "string" ? [aud] : Array.isArray(aud) ? aud.filter((a) => typeof a === "string") : [];
+  if (auds.length === 0) throw new OidcError("audience_mismatch", "Token has no audience.");
+  if (checks.audience) {
+    if (!auds.some((a) => checks.audience.includes(a))) {
+      throw new OidcError("audience_mismatch", `Token audience ${auds.join(",")} is not accepted.`);
+    }
+    if (auds.length > 1 && typeof payload.azp === "string" && !checks.audience.includes(payload.azp)) {
+      throw new OidcError("audience_mismatch", `Token azp ${payload.azp} is not accepted.`);
+    }
+  }
+  const nowSec = checks.nowMs / 1e3;
+  if (typeof payload.exp !== "number") throw new OidcError("invalid_jwt", "Token has no exp.");
+  if (nowSec > payload.exp + checks.clockToleranceSec) throw new OidcError("token_expired", "Token has expired.");
+  if (typeof payload.nbf === "number" && nowSec + checks.clockToleranceSec < payload.nbf) {
+    throw new OidcError("token_not_yet_valid", "Token is not valid yet.");
+  }
+  if (checks.nonce !== void 0) {
+    if (typeof payload.nonce !== "string" || !safeEqual(payload.nonce, checks.nonce)) {
+      throw new OidcError("nonce_mismatch", "id_token nonce is not the one this app sent.");
+    }
+  }
+}
+async function verifyJwt(token, store, checks) {
+  const { header, payload, signingInput, signature } = decodeJwt(token);
+  if (header.alg !== "RS256") throw new OidcError("unsupported_alg", `Unsupported alg ${String(header.alg)}.`);
+  const key = await store.getKey(typeof header.kid === "string" ? header.kid : void 0);
+  const valid = cryptoVerify("RSA-SHA256", Buffer.from(signingInput), key, signature);
+  if (!valid) throw new OidcError("invalid_signature", "Token signature is invalid.");
+  checkClaims(payload, checks);
+  return payload;
+}
+function toList(value) {
+  if (value === void 0) return null;
+  return typeof value === "string" ? [value] : [...value];
+}
+function createInternals(opts) {
+  if (!opts.issuer) throw new OidcError("invalid_config", "issuer is required.");
+  const fetchImpl = opts.fetchImpl ?? ((...args) => fetch(...args));
+  const now = opts.now ?? Date.now;
+  const metadata = createMetadataSource({ ...opts, fetchImpl, now });
+  return {
+    issuer: stripSlash(opts.issuer),
+    metadata,
+    jwks: new JwksStore(metadata, fetchImpl, opts.jwksCacheTtlMs ?? 60 * 60 * 1e3, opts.jwksRefetchCooldownMs ?? 5e3, now),
+    fetchImpl,
+    now,
+    tolerance: opts.clockToleranceSec ?? 30
+  };
+}
+async function userInfoRequest(internals, accessToken) {
+  const { userinfo } = await internals.metadata.get();
+  const res = await safeFetch(
+    internals.fetchImpl,
+    userinfo,
+    { headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" } },
+    "userinfo_failed"
+  );
+  const body = await readJson(res);
+  if (!res.ok || !body || typeof body.sub !== "string") {
+    throw new OidcError("userinfo_failed", `userinfo returned ${res.status}.`, {
+      status: res.status,
+      oauthError: typeof body?.error === "string" ? body.error : void 0
+    });
+  }
+  return body;
+}
+async function verifyAccess(internals, token, audience, remoteFallback) {
+  const checks = {
+    issuer: internals.issuer,
+    audience,
+    clockToleranceSec: internals.tolerance,
+    nowMs: internals.now()
+  };
+  const guardType = (payload) => {
+    if ("nonce" in payload) throw new OidcError("wrong_token_type", "An id_token is not an access token.");
+  };
+  try {
+    const payload = await verifyJwt(token, internals.jwks, checks);
+    guardType(payload);
+    return { claims: payload, verifiedBy: "jwks" };
+  } catch (error) {
+    const unreachable = isOidcError(error, "jwks_fetch_failed") || isOidcError(error, "discovery_failed");
+    if (!remoteFallback || !unreachable) throw error;
+    const { payload } = decodeJwt(token);
+    checkClaims(payload, checks);
+    guardType(payload);
+    const info = await userInfoRequest(internals, token);
+    if (info.sub !== payload.sub) throw new OidcError("userinfo_failed", "userinfo subject does not match the token.");
+    return { claims: payload, verifiedBy: "userinfo" };
+  }
+}
+function createAccessTokenVerifier(opts) {
+  const internals = createInternals(opts);
+  const defaultAudience = toList(opts.audience);
+  const remoteFallback = opts.remoteFallback ?? true;
+  return {
+    verify(token, options) {
+      const audience = options?.audience !== void 0 ? toList(options.audience) : defaultAudience;
+      return verifyAccess(internals, token, audience, remoteFallback);
+    },
+    fetchUserInfo: (accessToken) => userInfoRequest(internals, accessToken),
+    metadata: () => internals.metadata.get(),
+    _jwks: internals.jwks
+  };
+}
+function createOidcClient(opts) {
+  if (!opts.clientId) throw new OidcError("invalid_config", "clientId is required.");
+  if (!opts.redirectUri) throw new OidcError("invalid_config", "redirectUri is required.");
+  const internals = createInternals(opts);
+  const secret = opts.clientSecret?.trim() || void 0;
+  const authMethod = opts.tokenEndpointAuthMethod ?? (secret ? "client_secret_basic" : "none");
+  if (authMethod !== "none" && !secret) {
+    throw new OidcError("invalid_config", `${authMethod} needs a clientSecret.`);
+  }
+  const scope = normalizeScopes(opts.scopes);
+  const clientId = opts.clientId;
+  function applyClientAuth(body, headers) {
+    if (authMethod === "client_secret_basic") {
+      const raw = `${formEncode(clientId)}:${formEncode(secret)}`;
+      headers.authorization = `Basic ${Buffer.from(raw).toString("base64")}`;
+    } else if (authMethod === "client_secret_post") {
+      body.set("client_id", clientId);
+      body.set("client_secret", secret);
+    } else {
+      body.set("client_id", clientId);
+    }
+  }
+  async function tokenRequest(params, requireIdToken) {
+    const { token: endpoint } = await internals.metadata.get();
+    const body = new URLSearchParams(params);
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    };
+    applyClientAuth(body, headers);
+    const res = await safeFetch(
+      internals.fetchImpl,
+      endpoint,
+      { method: "POST", headers, body: body.toString() },
+      "token_request_failed"
+    );
+    const json = await readJson(res);
+    if (!res.ok) {
+      const oauthError = typeof json?.error === "string" ? json.error : void 0;
+      throw new OidcError(
+        "token_request_failed",
+        `Token endpoint returned ${res.status}${oauthError ? ` (${oauthError})` : ""}.`,
+        {
+          status: res.status,
+          oauthError,
+          oauthErrorDescription: typeof json?.error_description === "string" ? json.error_description : void 0
+        }
+      );
+    }
+    if (!json || typeof json.access_token !== "string" || !json.access_token) {
+      throw new OidcError("invalid_token_response", "Token response has no access_token.");
+    }
+    if (typeof json.token_type !== "string" || json.token_type.toLowerCase() !== "bearer") {
+      throw new OidcError("invalid_token_response", `Unexpected token_type ${String(json.token_type)}.`);
+    }
+    const expiresIn = typeof json.expires_in === "number" ? json.expires_in : Number(json.expires_in ?? 0) || 0;
+    const tokens = {
+      accessToken: json.access_token,
+      tokenType: "Bearer",
+      expiresIn,
+      expiresAt: internals.now() + expiresIn * 1e3,
+      refreshToken: typeof json.refresh_token === "string" && json.refresh_token ? json.refresh_token : void 0,
+      idToken: typeof json.id_token === "string" && json.id_token ? json.id_token : void 0,
+      scope: typeof json.scope === "string" ? json.scope : void 0,
+      raw: json
+    };
+    if (requireIdToken && !tokens.idToken) {
+      throw new OidcError("missing_id_token", "openid was requested but no id_token was returned.");
+    }
+    return tokens;
+  }
+  async function verifyIdToken(idToken, options) {
+    const payload = await verifyJwt(idToken, internals.jwks, {
+      issuer: internals.issuer,
+      audience: [clientId],
+      nonce: options?.nonce,
+      clockToleranceSec: internals.tolerance,
+      nowMs: internals.now()
+    });
+    return payload;
+  }
+  const scopeHasOpenId = (value) => value.split(" ").includes("openid");
+  return {
+    clientId,
+    issuer: internals.issuer,
+    scope,
+    authMethod,
+    metadata: () => internals.metadata.get(),
+    _jwks: internals.jwks,
+    async beginLogin(options = {}) {
+      const { authorization } = await internals.metadata.get();
+      const state = randomToken(32);
+      const nonce = randomToken(32);
+      const { codeVerifier, codeChallenge } = createPkcePair();
+      const url = new URL(authorization);
+      for (const [k, v] of Object.entries(options.extraParams ?? {})) url.searchParams.set(k, v);
+      url.searchParams.set("client_id", clientId);
+      url.searchParams.set("redirect_uri", opts.redirectUri);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("scope", options.scopes !== void 0 ? normalizeScopes(options.scopes) : scope);
+      url.searchParams.set("state", state);
+      url.searchParams.set("nonce", nonce);
+      url.searchParams.set("code_challenge", codeChallenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      if (options.prompt) url.searchParams.set("prompt", options.prompt);
+      if (options.loginHint) url.searchParams.set("login_hint", options.loginHint);
+      return { url: url.toString(), state, nonce, codeVerifier };
+    },
+    async handleCallback(input) {
+      let params;
+      if (input.url !== void 0) params = new URL(input.url.toString()).searchParams;
+      else if (input.params instanceof URLSearchParams) params = input.params;
+      else {
+        params = new URLSearchParams();
+        for (const [k, v] of Object.entries(input.params ?? {})) if (v !== void 0) params.set(k, v);
+      }
+      const expected = input.expected;
+      const state = params.get("state");
+      if (!expected?.state || !state || !safeEqual(state, expected.state)) {
+        throw new OidcError("state_mismatch", "Callback state does not match the login this browser started.");
+      }
+      const error = params.get("error");
+      if (error) {
+        throw new OidcError("authorization_error", `Accounts refused the sign-in: ${error}.`, {
+          oauthError: error,
+          oauthErrorDescription: params.get("error_description") ?? void 0
+        });
+      }
+      const iss = params.get("iss");
+      if (iss && stripSlash(iss) !== internals.issuer) {
+        throw new OidcError("issuer_mismatch", `Callback iss ${iss} is not ${internals.issuer}.`);
+      }
+      const code = params.get("code");
+      if (!code) throw new OidcError("missing_code", "Callback has no authorization code.");
+      if (!expected.nonce || !expected.codeVerifier) {
+        throw new OidcError("state_mismatch", "Stored login is missing its nonce or PKCE verifier.");
+      }
+      const tokens = await tokenRequest(
+        {
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: opts.redirectUri,
+          code_verifier: expected.codeVerifier
+        },
+        true
+      );
+      const claims = await verifyIdToken(tokens.idToken, { nonce: expected.nonce });
+      return { claims, tokens };
+    },
+    exchangeCode({ code, codeVerifier }) {
+      return tokenRequest(
+        { grant_type: "authorization_code", code, redirect_uri: opts.redirectUri, code_verifier: codeVerifier },
+        scopeHasOpenId(scope)
+      );
+    },
+    async refresh(refreshToken, options) {
+      const params = { grant_type: "refresh_token", refresh_token: refreshToken };
+      if (options?.scopes !== void 0) params.scope = normalizeScopes(options.scopes);
+      const tokens = await tokenRequest(params, false);
+      if (tokens.idToken) await verifyIdToken(tokens.idToken);
+      return tokens;
+    },
+    async revoke(token, tokenTypeHint = "refresh_token") {
+      const { revocation } = await internals.metadata.get();
+      const body = new URLSearchParams({ token, token_type_hint: tokenTypeHint });
+      const headers = { "content-type": "application/x-www-form-urlencoded" };
+      applyClientAuth(body, headers);
+      const res = await safeFetch(
+        internals.fetchImpl,
+        revocation,
+        { method: "POST", headers, body: body.toString() },
+        "revocation_failed"
+      );
+      if (!res.ok) throw new OidcError("revocation_failed", `Revocation returned ${res.status}.`, { status: res.status });
+    },
+    verifyIdToken,
+    verifyAccessToken(token, options) {
+      const audience = options?.audience !== void 0 ? toList(options.audience) : [clientId];
+      return verifyAccess(internals, token, audience, options?.remoteFallback ?? true);
+    },
+    fetchUserInfo: (accessToken) => userInfoRequest(internals, accessToken),
+    async logoutUrl(options = {}) {
+      const { endSession } = await internals.metadata.get();
+      const url = new URL(endSession);
+      url.searchParams.set("client_id", clientId);
+      const target = options.postLogoutRedirectUri ?? opts.postLogoutRedirectUri;
+      if (target) url.searchParams.set("post_logout_redirect_uri", target);
+      if (options.state) url.searchParams.set("state", options.state);
+      if (options.idTokenHint) url.searchParams.set("id_token_hint", options.idTokenHint);
+      return url.toString();
+    }
+  };
+}
+
+// src/index.ts
+var SESSION_COOKIE_NAME = "platform_session";
+var STATE_COOKIE_NAME = "accounts_auth_state";
+function normalizeOptionalString(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : void 0;
+}
+function createAccountsClientConfig(input = {}) {
+  return {
+    baseUrl: normalizeOptionalString(input.baseUrl ?? process.env.ACCOUNTS_BASE_URL),
+    issuer: normalizeOptionalString(input.issuer ?? process.env.ACCOUNTS_ISSUER),
+    scopes: input.scopes ?? (normalizeOptionalString(process.env.ACCOUNTS_SCOPES)?.split(/[\s,]+/).filter(Boolean) ?? [
+      ...DEFAULT_OIDC_SCOPES
+    ]),
+    discovery: input.discovery ?? process.env.ACCOUNTS_DISCOVERY === "true",
+    clientId: input.clientId ?? process.env.ACCOUNTS_CLIENT_ID ?? "accounts-app",
+    clientSecret: normalizeOptionalString(input.clientSecret ?? process.env.ACCOUNTS_CLIENT_SECRET),
+    redirectUri: input.redirectUri ?? process.env.ACCOUNTS_REDIRECT_URI ?? "http://localhost:5173/auth/callback",
+    logoutRedirectUri: input.logoutRedirectUri ?? process.env.ACCOUNTS_LOGOUT_REDIRECT_URI ?? "http://localhost:5173/",
+    useMock: input.useMock ?? (process.env.ACCOUNTS_USE_MOCK === "true" || !process.env.ACCOUNTS_BASE_URL || !process.env.ACCOUNTS_CLIENT_ID)
+  };
+}
+function createOidcClientFromConfig(config, overrides = {}) {
+  const issuer = overrides.issuer ?? config.issuer ?? config.baseUrl;
+  if (!issuer) throw new Error("Accounts issuer/baseUrl is required for sign-in.");
+  return createOidcClient({
+    issuer,
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    redirectUri: config.redirectUri,
+    postLogoutRedirectUri: config.logoutRedirectUri,
+    scopes: config.scopes,
+    discovery: config.discovery,
+    ...overrides
+  });
+}
+function identityFromClaims(claims, userInfo) {
+  const c = { ...claims, ...userInfo ?? {} };
+  const str = (k) => typeof c[k] === "string" && c[k] ? c[k] : void 0;
+  const firstName = str("given_name");
+  const lastName = str("family_name");
+  const sub = claims.sub;
+  return {
+    id: sub,
+    email: str("email") ?? `${sub}@accounts.local`,
+    name: str("name") ?? ([firstName, lastName].filter(Boolean).join(" ") || "Accounts User"),
+    firstName,
+    lastName,
+    avatarUrl: str("picture")
+  };
+}
+function safeNextPath(value) {
+  if (!value || !value.startsWith("/") || value.startsWith("//") || value.startsWith("/\\")) return "/";
+  return value;
+}
+function createPlatformAuth() {
+  return {
+    readSession(cookieHeader) {
+      return readPlatformSessionCookie(cookieHeader);
+    },
+    requirePrincipal(session) {
+      if (!session.principal) {
+        throw new Error("Authentication required.");
+      }
+      return session.principal;
+    }
+  };
+}
+function beginAccountsLoginRedirect(config, options) {
+  const nonce = globalThis.crypto?.randomUUID?.() ?? Math.random().toString(36).slice(2);
+  const state = {
+    nonce,
+    nextPath: options.nextPath && options.nextPath.startsWith("/") ? options.nextPath : "/",
+    tenantSlug: options.tenantSlug
+  };
+  if (config.useMock) {
+    const redirectUrl = new URL(config.redirectUri);
+    redirectUrl.searchParams.set("code", `demo_${nonce}`);
+    redirectUrl.searchParams.set("state", serializeAuthorizationState(state));
+    return {
+      redirectUrl: redirectUrl.toString(),
+      stateValue: serializeAuthorizationState(state),
+      stateCookie: createStateCookie(serializeAuthorizationState(state), options.cookieOptions)
+    };
+  }
+  const authorizeUrl = new URL("/auth/authorize", config.baseUrl);
+  authorizeUrl.searchParams.set("app_id", config.clientId);
+  authorizeUrl.searchParams.set("redirect_uri", config.redirectUri);
+  authorizeUrl.searchParams.set("state", serializeAuthorizationState(state));
+  return {
+    redirectUrl: authorizeUrl.toString(),
+    stateValue: serializeAuthorizationState(state),
+    stateCookie: createStateCookie(serializeAuthorizationState(state))
+  };
+}
+async function handleAccountsCallback(input) {
+  if (!input.code) {
+    throw new Error("Missing authorization code.");
+  }
+  if (input.storedState && input.state !== input.storedState) {
+    throw new Error("Invalid authorization state.");
+  }
+  const parsedState = parseAuthorizationState(input.state);
+  const tokenResponse = await exchangeAuthorizationCode({
+    config: input.config,
+    code: input.code,
+    fetchImpl: input.fetchImpl
+  });
+  const identity = normalizeIdentity(tokenResponse.user);
+  const local = await input.syncAccountsUser(identity);
+  const session = {
+    principal: {
+      identity,
+      user: local.user,
+      tenantAccess: {
+        activeTenantId: local.activeTenantId,
+        memberships: local.memberships
+      }
+    },
+    tenant: null,
+    accessToken: tokenResponse.access_token,
+    refreshToken: tokenResponse.refresh_token,
+    expiresAt: new Date(Date.now() + tokenResponse.expires_in * 1e3).toISOString()
+  };
+  return {
+    session,
+    nextPath: parsedState.nextPath,
+    tenantSlug: parsedState.tenantSlug,
+    sessionCookie: createSessionCookie(session, input.cookieOptions, input.secret),
+    clearStateCookie: clearStateCookie(input.cookieOptions)
+  };
+}
+async function exchangeAuthorizationCode(input) {
+  if (input.config.useMock) {
+    return createMockTokenResponse(input.code);
+  }
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const clientSecret = normalizeOptionalString(input.config.clientSecret);
+  const tokenBody = {
+    grant_type: "authorization_code",
+    code: input.code,
+    redirect_uri: input.config.redirectUri,
+    client_id: input.config.clientId
+  };
+  if (clientSecret) {
+    tokenBody.client_secret = clientSecret;
+  }
+  const response = await fetchImpl(new URL("/api/auth/token", input.config.baseUrl), {
+    method: "POST",
+    headers: {
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(tokenBody)
+  });
+  if (!response.ok) {
+    throw new Error(`Accounts token exchange failed with status ${response.status}.`);
+  }
+  return await response.json();
+}
+function syncAccountsUser(identity, syncer) {
+  return syncer(identity);
+}
+var identityPassthroughSync = (identity) => ({
+  user: {
+    id: identity.id,
+    externalIdentityId: identity.id,
+    email: identity.email,
+    name: identity.name,
+    firstName: identity.firstName,
+    lastName: identity.lastName
+  },
+  memberships: []
+});
+function resolveActiveTenant(memberships, preferredTenantId) {
+  if (preferredTenantId && memberships.some((membership) => membership.tenantId === preferredTenantId)) {
+    return preferredTenantId;
+  }
+  return memberships.find((membership) => membership.isDefault)?.tenantId ?? memberships[0]?.tenantId;
+}
+function readPlatformSessionCookie(cookieHeader, opts) {
+  const cookieValue = readCookie(cookieHeader, SESSION_COOKIE_NAME);
+  if (!cookieValue) {
+    return { principal: null, tenant: null };
+  }
+  let raw = cookieValue;
+  if (opts?.secret) {
+    const verified = unsignValue(cookieValue, opts.secret);
+    if (verified == null) return { principal: null, tenant: null };
+    raw = verified;
+  }
+  try {
+    return JSON.parse(decodeURIComponent(raw));
+  } catch {
+    return { principal: null, tenant: null };
+  }
+}
+function cookieAttrs(opts) {
+  const sameSite = opts?.sameSite ?? "lax";
+  const secure = opts?.secure || sameSite === "none";
+  const cap = sameSite.charAt(0).toUpperCase() + sameSite.slice(1);
+  return `Path=/; HttpOnly; SameSite=${cap}${secure ? "; Secure" : ""}`;
+}
+function signValue(value, secret) {
+  const sig = createHmac("sha256", secret).update(value).digest("hex");
+  return `${value}.${sig}`;
+}
+function unsignValue(signed, secret) {
+  const dot = signed.lastIndexOf(".");
+  if (dot < 0) return null;
+  const value = signed.slice(0, dot);
+  const sig = signed.slice(dot + 1);
+  if (!/^[0-9a-f]{64}$/.test(sig)) return null;
+  const expected = createHmac("sha256", secret).update(value).digest("hex");
+  const a = Buffer.from(sig, "hex");
+  const b = Buffer.from(expected, "hex");
+  if (a.length !== b.length) return null;
+  return timingSafeEqual2(a, b) ? value : null;
+}
+function clearPlatformSessionCookie(opts) {
+  return `${SESSION_COOKIE_NAME}=; ${cookieAttrs(opts)}; Max-Age=0`;
+}
+function createPlatformSessionCookie(session, opts, secret) {
+  return createSessionCookie(session, opts, secret);
+}
+var LOGIN_STATE_COOKIE_NAME = "accounts_oidc_login";
+var LOGIN_STATE_MAX_AGE_SEC = 60 * 10;
+function createLoginStateCookie(login, options = {}) {
+  const payload = {
+    state: login.state,
+    nonce: login.nonce,
+    codeVerifier: login.codeVerifier,
+    nextPath: safeNextPath(options.nextPath),
+    tenantSlug: options.tenantSlug,
+    issuedAt: Math.floor(Date.now() / 1e3)
+  };
+  const raw = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const value = options.secret ? signValue(raw, options.secret) : raw;
+  return `${LOGIN_STATE_COOKIE_NAME}=${value}; ${cookieAttrs(options.cookieOptions)}; Max-Age=${LOGIN_STATE_MAX_AGE_SEC}`;
+}
+function readLoginStateCookie(cookieHeader, options = {}) {
+  const value = readCookie(cookieHeader, LOGIN_STATE_COOKIE_NAME);
+  if (!value) return null;
+  const raw = options.secret ? unsignValue(value, options.secret) : value;
+  if (raw == null) return null;
+  try {
+    const parsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+    if (!parsed || typeof parsed.state !== "string" || typeof parsed.nonce !== "string") return null;
+    if (typeof parsed.codeVerifier !== "string") return null;
+    if (typeof parsed.issuedAt !== "number" || Date.now() / 1e3 - parsed.issuedAt > LOGIN_STATE_MAX_AGE_SEC) return null;
+    return { ...parsed, nextPath: safeNextPath(parsed.nextPath) };
+  } catch {
+    return null;
+  }
+}
+function clearLoginStateCookie(opts) {
+  return `${LOGIN_STATE_COOKIE_NAME}=; ${cookieAttrs(opts)}; Max-Age=0`;
+}
+function createSessionCookie(session, opts, secret) {
+  const raw = encodeURIComponent(JSON.stringify(session));
+  const value = secret ? signValue(raw, secret) : raw;
+  return `${SESSION_COOKIE_NAME}=${value}; ${cookieAttrs(opts)}; Max-Age=${60 * 60 * 24 * 7}`;
+}
+function createStateCookie(value, opts) {
+  return `${STATE_COOKIE_NAME}=${encodeURIComponent(value)}; ${cookieAttrs(opts)}; Max-Age=${60 * 10}`;
+}
+function clearStateCookie(opts) {
+  return `${STATE_COOKIE_NAME}=; ${cookieAttrs(opts)}; Max-Age=0`;
+}
+function serializeAuthorizationState(state) {
+  return encodeURIComponent(JSON.stringify(state));
+}
+function parseAuthorizationState(value) {
+  try {
+    return JSON.parse(decodeURIComponent(value));
+  } catch {
+    throw new Error("Invalid authorization state payload.");
+  }
+}
+function normalizeIdentity(user) {
+  const firstName = user.firstName ?? user.first_name;
+  const lastName = user.lastName ?? user.last_name;
+  return {
+    id: user.id,
+    // Prefer the real address under either key; only synthesize when truly absent.
+    email: user.emailAddress ?? user.email ?? `${user.id}@accounts.local`,
+    name: user.name ?? ([firstName, lastName].filter(Boolean).join(" ") || "Accounts User"),
+    firstName,
+    lastName,
+    avatarUrl: user.avatarUrl ?? user.avatar_url
+  };
+}
+function createMockTokenResponse(code) {
+  const suffix = code.replace("demo_", "").slice(0, 8) || "demo";
+  return {
+    access_token: `access_${suffix}`,
+    refresh_token: `refresh_${suffix}`,
+    token_type: "Bearer",
+    expires_in: 60 * 60 * 24 * 7,
+    user: {
+      id: "accounts-user-demo-admin",
+      email: "hello@babyplanet.example",
+      name: "Baby Planet Admin",
+      first_name: "Baby",
+      last_name: "Planet"
+    }
+  };
+}
+function readCookie(cookieHeader, name) {
+  if (!cookieHeader) return null;
+  for (const part of cookieHeader.split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name) {
+      return rest.join("=");
+    }
+  }
+  return null;
+}
+function serviceKeyFromRequest(request) {
+  const explicit = request.headers.get("x-api-key");
+  if (explicit && explicit.trim()) return explicit.trim();
+  const auth = request.headers.get("authorization");
+  if (auth && auth.startsWith("Bearer ")) {
+    const token = auth.slice(7).trim();
+    if (token.startsWith("sk_")) return token;
+  }
+  return null;
+}
+async function introspectServiceKey(input) {
+  const base = normalizeOptionalString(input.config.baseUrl);
+  if (!input.key || !base) return null;
+  const fetchImpl = input.fetchImpl ?? fetch;
+  try {
+    const res = await fetchImpl(new URL("/api/auth/service-keys/introspect", base), {
+      method: "POST",
+      headers: { "x-api-key": input.key, accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (!data.valid || !data.keyId) return null;
+    const accessibleApps = (data.accessibleApps ?? []).filter(
+      (a) => Boolean(a) && typeof a.id === "string" && typeof a.slug === "string"
+    ).map((a) => ({ id: a.id, slug: a.slug, name: a.name }));
+    return {
+      keyId: data.keyId,
+      tenantId: data.tenantId ?? null,
+      scopes: Array.isArray(data.scopes) ? data.scopes : [],
+      accessibleApps,
+      expiresAt: data.expiresAt ?? null
+    };
+  } catch {
+    return null;
+  }
+}
+async function logoutFromAccounts(input) {
+  const base = normalizeOptionalString(input.config.baseUrl);
+  if (!base || !input.accessToken) return { success: false };
+  const fetchImpl = input.fetchImpl ?? fetch;
+  try {
+    const res = await fetchImpl(new URL("/api/auth/logout", base), {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${input.accessToken}`,
+        accept: "application/json"
+      },
+      body: JSON.stringify({ all: input.all ?? false })
+    });
+    if (!res.ok) return { success: false };
+    return await res.json();
+  } catch {
+    return { success: false };
+  }
+}
+function verifyWebhookSignature(rawBody, signature, secret) {
+  if (!signature || !secret) return false;
+  const provided = (signature.startsWith("sha256=") ? signature.slice(7) : signature).toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(provided)) return false;
+  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
+  const a = Buffer.from(provided, "hex");
+  const b = Buffer.from(expected, "hex");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual2(a, b);
+}
+function normalizeAccountsWebhook(payload) {
+  const body = payload && typeof payload === "object" ? payload : {};
+  const type = String(body.event ?? body.type ?? "unknown");
+  return { ...body, type, data: body.data };
+}
+function scopeSatisfied(granted, required) {
+  if (!granted || granted.length === 0) return false;
+  return granted.includes(required);
+}
+
+export {
+  OidcError,
+  isOidcError,
+  ACCOUNTS_ENDPOINT_PATHS,
+  DEFAULT_OIDC_SCOPES,
+  randomToken,
+  pkceChallenge,
+  createPkcePair,
+  looksLikeJwt,
+  createAccessTokenVerifier,
+  createOidcClient,
+  createAccountsClientConfig,
+  createOidcClientFromConfig,
+  identityFromClaims,
+  safeNextPath,
+  createPlatformAuth,
+  beginAccountsLoginRedirect,
+  handleAccountsCallback,
+  exchangeAuthorizationCode,
+  syncAccountsUser,
+  identityPassthroughSync,
+  resolveActiveTenant,
+  readPlatformSessionCookie,
+  clearPlatformSessionCookie,
+  createPlatformSessionCookie,
+  LOGIN_STATE_COOKIE_NAME,
+  createLoginStateCookie,
+  readLoginStateCookie,
+  clearLoginStateCookie,
+  serviceKeyFromRequest,
+  introspectServiceKey,
+  logoutFromAccounts,
+  verifyWebhookSignature,
+  normalizeAccountsWebhook,
+  scopeSatisfied
+};