aui-auth 0.0.6 → 0.0.7

package/dist/accounts.d.ts

@@ -1,5 +1,5 @@
-import { h as RevalidateInput, v as SignInInput } from "./types-CEuhm7Nv.js";
-import { t as AccountsFetchOptions } from "./oidc-CaYOiMFO.js";
+import { h as RevalidateInput, v as SignInInput } from "./types-Cx223pmJ.js";
+import { t as AccountsFetchOptions } from "./oidc-CbVNB1IR.js";
 //#region src/accounts/index.d.ts
 type AccountsOrganization = {
   id: string;

package/dist/accounts.js

@@ -1 +1 @@
-import{a as e,t}from"./types-ICH7-e-H.js";import{n}from"./oidc-D2VwAdd3.js";async function r(e,r){let i=await n(e,`/api/oidc/organizations`,{headers:{Authorization:`Bearer ${r}`}});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function i(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function a(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function o(t){let n=t.preferredSlug??a;async function o(e){return{activeOrganization:i(await r(t,e.accessToken),n(e.redirectPath))}}async function s(n){let a;try{a=await r(t,n.accessToken)}catch(t){if(e(t))return null;throw t}let o=n.session.data.activeOrganization;if(!o)return{activeOrganization:i(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}export{r as fetchOrganizations,o as organizationHooks,a as preferredOrganizationSlug,i as selectOrganization};
+import{a as e,t}from"./types-B_7rFOLg.js";import{n}from"./oidc-CDcBo0qB.js";async function r(e,r){let i=await n(e,`/api/oidc/organizations`,{headers:{Authorization:`Bearer ${r}`}});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function i(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function a(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function o(t){let n=t.preferredSlug??a;async function o(e){return{activeOrganization:i(await r(t,e.accessToken),n(e.redirectPath))}}async function s(n){let a;try{a=await r(t,n.accessToken)}catch(t){if(e(t))return null;throw t}let o=n.session.data.activeOrganization;if(!o)return{activeOrganization:i(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}export{r as fetchOrganizations,o as organizationHooks,a as preferredOrganizationSlug,i as selectOrganization};

package/dist/{cache-kH1-Y-mz.js → cache-DNvwg4aa.js}

@@ -1 +1 @@
-import{o as e}from"./types-ICH7-e-H.js";import{u as t}from"./oidc-D2VwAdd3.js";function n(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function r(e){let t=new URL(e.url);return`${n(e.headers.get(`x-forwarded-proto`))||t.protocol.replace(`:`,``)}://${n(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||t.host}`}function i(e){return new URL(e).protocol===`https:`}function a(e,t){return t?`__Secure-${e}`:e}function o(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function s(e,t){let n=o(e.headers.get(`cookie`));return n.get(a(t,!0))||n.get(a(t,!1))||null}function c(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function l(e,t,n,r,o){let s=i(r);e.append(`set-cookie`,c(a(t,s),n,s,Math.floor(o/1e3)))}function u(e,t){if(t.length===0)return;let n=o(e.get(`cookie`));for(let e of t){let t=e.split(`;`)[0],r=t.indexOf(`=`);if(r<1)continue;let i=t.slice(0,r).trim(),a=t.slice(r+1).trim();a?n.set(i,a):n.delete(i)}e.set(`cookie`,[...n].map(([e,t])=>`${e}=${t}`).join(`; `))}function d(e,t){let n=i(t);return[n,!n].map(t=>c(a(e,t),``,t,0))}function f(e,t,n){for(let r of d(t,n))e.append(`set-cookie`,r)}function p(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function m(e,t){return`${e}_flow_${t}`}function h(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function g(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function _(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin!==t||n.pathname.startsWith(`//`)?`/`:`${n.pathname}${n.search}${n.hash}`}const v=4096;function y(e){return`${e}_cache`}function b(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e,i=Math.min(t.lastValidatedAt+r.revalidateIntervalMs,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs);return Math.min(e.cache.maxAgeMs,(i>n?i:n+r.retryIntervalMs)-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function x(e,t,n){if(!e.cache)return null;let r=b(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function S(e,n,r,i){if(!e.cache||!n||!r)return null;let a;try{let t=await e.cache.codec();a=JSON.parse(await t.decrypt(n))}catch{return null}return a.v!==1||typeof a.exp!=`number`||a.exp<=i||a.id!==await t(r)?null:{id:a.id,user:a.u,tokens:{accessToken:a.at,refreshToken:null,idToken:null,accessTokenExpiresAt:a.ate},data:a.d,createdAt:a.ca,lastValidatedAt:a.lv,refreshLeaseUntil:null}}async function C(t,n,r,o){try{let e=await x(t,n,o);if(!e)return null;let s=i(r),l=c(a(y(t.cookieName),s),e.value,s,Math.floor(e.maxAgeMs/1e3));if(l.length>v)throw Error(`Cache cookie is ${l.length} bytes and browsers drop cookies over ${v}; the session data is too large to cache`);return l}catch(n){return e(t,`cache_cookie`,n),null}}function w(e,t){return e.cache?d(y(e.cookieName),t):[]}export{c as _,f as a,g as c,u as d,o as f,_ as g,r as h,S as i,h as l,p as m,y as n,d as o,s as p,C as r,a as s,w as t,m as u,l as v};
+import{o as e}from"./types-B_7rFOLg.js";import{d as t}from"./oidc-CDcBo0qB.js";function n(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function r(e){let t=new URL(e.url);return`${n(e.headers.get(`x-forwarded-proto`))||t.protocol.replace(`:`,``)}://${n(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||t.host}`}function i(e){return new URL(e).protocol===`https:`}function a(e,t){return t?`__Secure-${e}`:e}function o(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function s(e,t){let n=o(e.headers.get(`cookie`));return n.get(a(t,!0))||n.get(a(t,!1))||null}function c(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function l(e,t,n,r,o){let s=i(r);e.append(`set-cookie`,c(a(t,s),n,s,Math.floor(o/1e3)))}function u(e,t){if(t.length===0)return;let n=o(e.get(`cookie`));for(let e of t){let t=e.split(`;`)[0],r=t.indexOf(`=`);if(r<1)continue;let i=t.slice(0,r).trim(),a=t.slice(r+1).trim();a?n.set(i,a):n.delete(i)}e.set(`cookie`,[...n].map(([e,t])=>`${e}=${t}`).join(`; `))}function d(e,t){let n=i(t);return[n,!n].map(t=>c(a(e,t),``,t,0))}function f(e,t,n){for(let r of d(t,n))e.append(`set-cookie`,r)}function p(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function m(e,t){return`${e}_flow_${t}`}function h(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function g(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function _(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin!==t||n.pathname.startsWith(`//`)?`/`:`${n.pathname}${n.search}${n.hash}`}const v=4096;function y(e){return`${e}_cache`}function b(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e,i=Math.min(t.lastValidatedAt+r.revalidateIntervalMs,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs);return Math.min(e.cache.maxAgeMs,(i>n?i:n+r.retryIntervalMs)-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function x(e,t,n){if(!e.cache)return null;let r=b(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function S(e,n,r,i){if(!e.cache||!n||!r)return null;let a;try{let t=await e.cache.codec();a=JSON.parse(await t.decrypt(n))}catch{return null}return a.v!==1||typeof a.exp!=`number`||a.exp<=i||a.id!==await t(r)?null:{id:a.id,user:a.u,tokens:{accessToken:a.at,refreshToken:null,idToken:null,accessTokenExpiresAt:a.ate},data:a.d,createdAt:a.ca,lastValidatedAt:a.lv,refreshLeaseUntil:null}}async function C(t,n,r,o){try{let e=await x(t,n,o);if(!e)return null;let s=i(r),l=c(a(y(t.cookieName),s),e.value,s,Math.floor(e.maxAgeMs/1e3));if(l.length>v)throw Error(`Cache cookie is ${l.length} bytes and browsers drop cookies over ${v}; the session data is too large to cache`);return l}catch(n){return e(t,`cache_cookie`,n),null}}function w(e,t){return e.cache?d(y(e.cookieName),t):[]}export{c as _,f as a,g as c,u as d,o as f,_ as g,r as h,S as i,h as l,p as m,y as n,d as o,s as p,C as r,a as s,w as t,m as u,l as v};

package/dist/database/index.d.ts

@@ -1,3 +1,3 @@
 import { n as createAesGcmCodec, t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { _ as SessionSweepCutoffs, c as AccountsSession, d as AccountsTokens, f as AccountsUser, g as SessionDecodeError, l as AccountsSessionPatch, u as AccountsSessionStore } from "../types-CEuhm7Nv.js";
+import { _ as SessionSweepCutoffs, c as AccountsSession, d as AccountsTokens, f as AccountsUser, g as SessionDecodeError, l as AccountsSessionPatch, u as AccountsSessionStore } from "../types-Cx223pmJ.js";
 export { type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, type SessionCodec, SessionDecodeError, type SessionSweepCutoffs, createAesGcmCodec };

package/dist/database/index.js

@@ -1 +1 @@
-import{c as e,i as t}from"../types-ICH7-e-H.js";export{t as SessionDecodeError,e as createAesGcmCodec};
+import{c as e,i as t}from"../types-B_7rFOLg.js";export{t as SessionDecodeError,e as createAesGcmCodec};

package/dist/database/pg.d.ts

@@ -1,5 +1,5 @@
 import { t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { u as AccountsSessionStore } from "../types-CEuhm7Nv.js";
+import { u as AccountsSessionStore } from "../types-Cx223pmJ.js";
 //#region src/database/pg.d.ts
 type PgQuery = (text: string, values?: unknown[]) => Promise<{
   rows: Record<string, unknown>[];

package/dist/database/pg.js

@@ -1,4 +1,4 @@
-import{i as e}from"../types-ICH7-e-H.js";const t=`CREATE TABLE "accounts_sessions" (
+import{i as e}from"../types-B_7rFOLg.js";const t=`CREATE TABLE "accounts_sessions" (
   "id" text PRIMARY KEY,
   "user_id" text NOT NULL,
   "user" jsonb NOT NULL,

package/dist/database/redis.d.ts

@@ -1,5 +1,5 @@
 import { t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { u as AccountsSessionStore } from "../types-CEuhm7Nv.js";
+import { u as AccountsSessionStore } from "../types-Cx223pmJ.js";
 //#region src/database/redis.d.ts
 /**
  * The slice of a Redis client this store uses, so the package takes no Redis

package/dist/database/redis.js

@@ -1,4 +1,4 @@
-import{i as e}from"../types-ICH7-e-H.js";const t=`refreshLeaseUntil`,n=`
+import{i as e}from"../types-B_7rFOLg.js";const t=`refreshLeaseUntil`,n=`
 local key, checkLease, expectedLease, ttl = KEYS[1], ARGV[1], ARGV[2], ARGV[3]
 if redis.call('EXISTS', key) == 0 then return 0 end
 if checkLease == '1' then

package/dist/{index-wc8vz71h.d.ts → index-Bte2SoPM.d.ts}

@@ -1,4 +1,4 @@
-import { c as AccountsSession, t as AccountsAuthConfig, u as AccountsSessionStore } from "./types-CEuhm7Nv.js";
+import { c as AccountsSession, t as AccountsAuthConfig, u as AccountsSessionStore } from "./types-Cx223pmJ.js";
 //#region src/core/cookies.d.ts
 declare function requestOrigin(request: Request): string;
 /**

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { _ as SessionSweepCutoffs, a as AccountsLifetimes, c as AccountsSession, d as AccountsTokens, f as AccountsUser, g as SessionDecodeError, h as RevalidateInput, i as AccountsErrorPhase, l as AccountsSessionPatch, m as OAuthTokenError, n as AccountsCacheConfig, o as AccountsPaths, p as DEFAULT_LIFETIMES, r as AccountsErrorEvent, s as AccountsRequestError, t as AccountsAuthConfig, u as AccountsSessionStore, v as SignInInput, y as isAccessDenied } from "./types-CEuhm7Nv.js";
-import { n as accountsEndpoint, r as fetchUserInfo, t as AccountsFetchOptions } from "./oidc-CaYOiMFO.js";
-import { a as SessionResolution, c as cacheCookieBase, d as sanitizeRedirectPath, i as createMemorySessionStore, l as forwardCookies, n as SessionCookies, o as GuardOptions, r as createAccountsAuth, s as GuardResult, t as AccountsAuth, u as requestOrigin } from "./index-wc8vz71h.js";
+import { _ as SessionSweepCutoffs, a as AccountsLifetimes, c as AccountsSession, d as AccountsTokens, f as AccountsUser, g as SessionDecodeError, h as RevalidateInput, i as AccountsErrorPhase, l as AccountsSessionPatch, m as OAuthTokenError, n as AccountsCacheConfig, o as AccountsPaths, p as DEFAULT_LIFETIMES, r as AccountsErrorEvent, s as AccountsRequestError, t as AccountsAuthConfig, u as AccountsSessionStore, v as SignInInput, y as isAccessDenied } from "./types-Cx223pmJ.js";
+import { n as accountsEndpoint, r as fetchUserInfo, t as AccountsFetchOptions } from "./oidc-CbVNB1IR.js";
+import { a as SessionResolution, c as cacheCookieBase, d as sanitizeRedirectPath, i as createMemorySessionStore, l as forwardCookies, n as SessionCookies, o as GuardOptions, r as createAccountsAuth, s as GuardResult, t as AccountsAuth, u as requestOrigin } from "./index-Bte2SoPM.js";
 export { AccountsAuth, type AccountsAuthConfig, type AccountsCacheConfig, type AccountsErrorEvent, type AccountsErrorPhase, type AccountsFetchOptions, type AccountsLifetimes, type AccountsPaths, AccountsRequestError, type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, DEFAULT_LIFETIMES, type GuardOptions, type GuardResult, OAuthTokenError, type RevalidateInput, SessionCookies, SessionDecodeError, type SessionResolution, type SessionSweepCutoffs, type SignInInput, accountsEndpoint, cacheCookieBase, createAccountsAuth, createMemorySessionStore, fetchUserInfo, forwardCookies, isAccessDenied, requestOrigin, sanitizeRedirectPath };

package/dist/index.js

@@ -1 +1 @@
-import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,p as f,r as p,t as m,u as h,v as g}from"./cache-kH1-Y-mz.js";import{a as _,i as v,n as y,o as b,r as x,s as S,t as C}from"./types-ICH7-e-H.js";import{a as w,c as T,d as E,i as D,l as O,o as k,r as A,s as j,t as M,u as N}from"./oidc-D2VwAdd3.js";function P(e,t){return[...d(e.cookieName,t),...m(e,t)]}function F(e,t){return async function(n){let r=o(n),i=f(n,e.cookieName),a=f(n,u(e.cookieName)),c=await s(e,a,i,e.now());if(c)return{session:c,cookies:[]};let l={session:null,cookies:i!==null||a!==null?P(e,r):[]},d=await t.load(i);if(!d)return l;let{deferRevalidation:m}=e;if(m&&t.revalidationDue(d)&&I(e,m,t,d)){let t=await p(e,d,r,e.now());return{session:d,cookies:t?[t]:[]}}let h=d;try{let e=await t.revalidate(d);if(!e)return l;h=e}catch(t){b(e,`revalidate`,t)}let g=await p(e,h,r,e.now());return{session:h,cookies:g?[g]:[]}}}function I(e,t,n,r){try{return t(async()=>{try{await n.revalidate(r)}catch(t){b(e,`revalidate`,t)}}),!0}catch(t){return b(e,`revalidate`,t),!1}}function L(e,t){let n=F(e,t);return async function(t,i={}){let a=new URL(t.url);if([e.paths.login,e.paths.callback,e.paths.logout,e.paths.logoutComplete,e.paths.error,...i.publicPaths??[]].some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,a=new URL(e.url),o=(t.apiPaths??[`/api`,`/trpc`]).some(e=>a.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):l(i(e,t,r));for(let e of n)o.headers.append(`set-cookie`,e);return{kind:`response`,response:o}}function i(t,n,r){let i=new URL(t.url),a=new URL(e.paths.login,o(t));return a.searchParams.set(`redirect`,n.redirectPath?.(t)??`${i.pathname}${i.search}`),r&&a.searchParams.set(`silent`,`1`),a}}const R=/^[A-Za-z0-9_-]{1,128}$/,z=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function B(r,s){function u(e,t){let n=new URL(r.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let i=new URL(r.paths.error,e);return i.searchParams.set(`reason`,t),n&&i.searchParams.set(`description`,n),i}function _(t,n){let a=h(r.cookieName,``),o=[...i(t.headers.get(`cookie`)).keys()].filter(e=>e.replace(/^__Secure-/,``).startsWith(a)),s=o.length-4;for(let t of o.slice(0,Math.max(0,s)))n.headers.append(`set-cookie`,e(t,``,t.startsWith(`__Secure-`),0))}async function v(e){try{let t=await s.load(e);t&&await s.end(t)}catch(e){b(r,`session_store`,e)}}async function y(e){let t=o(e),n=new URL(e.url).searchParams,i=a(n.get(`redirect`),t),s=n.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await A(r,{origin:t,silent:s}),p=l(u);return _(e,p),g(p.headers,h(r.cookieName,d),c({verifier:f,redirectPath:i,silent:s}),t,r.lifetimes.flowMaxAgeMs),p}async function S(e){let i=o(e),c=new URL(e.url).searchParams,_=c.get(`state`),y=_&&R.test(_)?h(r.cookieName,_):null,S=y?n(f(e,y)):null,C=e=>(y&&t(e.headers,y,i),e);if(!S)return C(l(d(i,`invalid_state`,null)));let T=a(S.redirectPath,i),D=c.get(`error`);if(D)return S.silent&&z.has(D)?C(l(u(i,T))):C(l(d(i,D,c.get(`error_description`))));let O=c.get(`code`);if(!O)return C(l(d(i,`invalid_request`,null)));let A,M,N;try{let e=await w(r,{code:O,verifier:S.verifier,redirectUri:new URL(r.paths.callback,i).toString()});A=E(e,null,r.now()),M=await j(k(r),A.accessToken),N=await r.onSignIn({user:M,accessToken:A.accessToken,redirectPath:T,previous:null})}catch(e){return b(r,`sign_in`,e),e instanceof x?C(l(d(i,e.code,e.description||null))):C(l(d(i,`accounts_unavailable`,null)))}let P=f(e,r.cookieName);if(N===null){let e=l(d(i,`access_denied`,null));P!==null&&(await v(P),t(e.headers,r.cookieName,i));for(let t of m(r,i))e.headers.append(`set-cookie`,t);return C(e)}let F,I;try{({cookieValue:F,session:I}=await s.start({user:M,tokens:A,data:N}))}catch(e){return b(r,`session_store`,e),C(l(d(i,`session_store_error`,null)))}P!==null&&await v(P);let L=l(new URL(T,i));g(L.headers,r.cookieName,F,i,r.lifetimes.absoluteMaxAgeMs);let B=await p(r,I,i,r.now());return B&&L.headers.append(`set-cookie`,B),C(L)}async function C(e){let t=o(e),n=await s.load(f(e,r.cookieName));n&&await s.end(n);let i=n?.tokens.idToken?D(r,{origin:t,idToken:n.tokens.idToken}):new URL(r.paths.logoutComplete,t).toString(),a=l(i,303);for(let e of P(r,t))a.headers.append(`set-cookie`,e);return a}return{login:y,callback:S,logout:C}}const V=e=>new Promise(t=>setTimeout(t,e));function H(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}function a(t){let r=e.now();return!i(t.tokens,r)&&r-t.lastValidatedAt>=n.revalidateIntervalMs}async function o(n){if(!n)return null;let i=await N(n),a;try{a=await t.read(i)}catch(n){if(!(n instanceof v))throw n;return b(e,`session_store`,n),await t.delete(i),null}return a?r(a,e.now())?(await t.delete(a.id),null):a:null}async function s(n){let r=T(32),i=e.now(),a={id:await N(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function c(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return l(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await O(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:E(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(n instanceof x&&n.code===`invalid_grant`)return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return b(e,`refresh`,n),r??o;throw n}}async function l(r,a){for(;;){await V(100);let o=await t.read(r);if(!o)return null;let s=e.now();if(!i(o.tokens,s))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=s)return c(o);if(s-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>s)return o;throw new C(`Timed out waiting for the session refresh lease`,0)}}}async function u(r){let i;try{i=await c(r)}catch(t){b(e,`refresh`,t),i=r}if(!i)return null;if(e.now()-i.lastValidatedAt<n.revalidateIntervalMs||!d(i.tokens))return i;let a=e.revalidateUser?await p(i):i.user;if(!a)return f(i);if(!d(i.tokens))return i;let o=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken,user:a});if(o===null)return f(i);let s={data:o,lastValidatedAt:e.now()};return a!==i.user&&(s.user=a),t.update(i.id,s)}function d(t){return t.accessTokenExpiresAt-e.now()>n.requestTimeoutMs}async function f(n){return n.tokens.accessTokenExpiresAt<=e.now()?n:(await t.delete(n.id),null)}async function p(t){try{return await j(k(e),t.tokens.accessToken)}catch(n){return _(n)?null:(b(e,`revalidate`,n),t.user)}}async function m(e){await t.delete(e.id)}async function h(){if(!t.sweep)return 0;let r=e.now();return t.sweep({createdBefore:r-n.absoluteMaxAgeMs,validatedBefore:r-n.idleMaxAgeMs})}return{load:o,start:s,ensureFreshTokens:c,revalidate:u,revalidationDue:a,end:m,sweep:h}}function U(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)},async sweep(t){let n=0;for(let[r,i]of e)(i.createdAt<t.createdBefore||i.lastValidatedAt<t.validatedBefore)&&(e.delete(r),n+=1);return n}}}function W(e){let t=S(e),n=H(t),r=B(t,n),i=L(t,n),a=F(t,n);function o(e){return{session:f(e,t.cookieName),cache:f(e,u(t.cookieName))}}async function c(e){return await s(t,e.cache,e.session,t.now())??n.load(e.session)}async function l(e){return c(o(e))}async function d(e){let r=await s(t,e.cache,e.session,t.now());if(r&&r.tokens.accessTokenExpiresAt>t.now())return r.tokens.accessToken;let i=await n.load(e.session);return i?(await n.ensureFreshTokens(i))?.tokens.accessToken??null:null}async function p(e){return d(o(e))}async function m(e,r){let i=await n.load(e.session);return i?t.store.update(i.id,{data:r(i.data)}):null}function h(){return n.sweep()}return{cookieName:t.cookieName,handlers:r,guard:i,resolveSession:a,sessionFromCookies:c,sessionFromRequest:l,accessTokenFromCookies:d,accessTokenFromRequest:p,updateSessionData:m,sweepSessions:h}}export{C as AccountsRequestError,y as DEFAULT_LIFETIMES,x as OAuthTokenError,v as SessionDecodeError,M as accountsEndpoint,u as cacheCookieBase,W as createAccountsAuth,U as createMemorySessionStore,j as fetchUserInfo,r as forwardCookies,_ as isAccessDenied,o as requestOrigin,a as sanitizeRedirectPath};
+import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,p as f,r as p,t as m,u as h,v as g}from"./cache-DNvwg4aa.js";import{a as _,i as v,n as y,o as b,r as x,s as S,t as C}from"./types-B_7rFOLg.js";import{a as w,c as T,d as E,f as D,i as O,l as k,o as A,r as j,s as M,t as N,u as P}from"./oidc-CDcBo0qB.js";function F(e,t){return[...d(e.cookieName,t),...m(e,t)]}function I(e,t){return async function(n){let r=o(n),i=f(n,e.cookieName),a=f(n,u(e.cookieName)),c=await s(e,a,i,e.now());if(c)return{session:c,cookies:[]};let l={session:null,cookies:i!==null||a!==null?F(e,r):[]},d=await t.load(i);if(!d)return l;let{deferRevalidation:m}=e;if(m&&t.revalidationDue(d)&&L(e,m,t,d)){let t=await p(e,d,r,e.now());return{session:d,cookies:t?[t]:[]}}let h=d;try{let e=await t.revalidate(d);if(!e)return l;h=e}catch(t){b(e,`revalidate`,t)}let g=await p(e,h,r,e.now());return{session:h,cookies:g?[g]:[]}}}function L(e,t,n,r){try{return t(async()=>{try{await n.revalidate(r)}catch(t){b(e,`revalidate`,t)}}),!0}catch(t){return b(e,`revalidate`,t),!1}}function R(e,t){let n=I(e,t);return async function(t,i={}){let a=new URL(t.url);if([e.paths.login,e.paths.callback,e.paths.logout,e.paths.logoutComplete,e.paths.error,...i.publicPaths??[]].some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,a=new URL(e.url),o=(t.apiPaths??[`/api`,`/trpc`]).some(e=>a.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):l(i(e,t,r));for(let e of n)o.headers.append(`set-cookie`,e);return{kind:`response`,response:o}}function i(t,n,r){let i=new URL(t.url),a=new URL(e.paths.login,o(t));return a.searchParams.set(`redirect`,n.redirectPath?.(t)??`${i.pathname}${i.search}`),r&&a.searchParams.set(`silent`,`1`),a}}const z=/^[A-Za-z0-9_-]{1,128}$/,B=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function V(r,s){function u(e,t){let n=new URL(r.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let i=new URL(r.paths.error,e);return i.searchParams.set(`reason`,t),n&&i.searchParams.set(`description`,n),i}function _(t,n){let a=h(r.cookieName,``),o=[...i(t.headers.get(`cookie`)).keys()].filter(e=>e.replace(/^__Secure-/,``).startsWith(a)),s=o.length-4;for(let t of o.slice(0,Math.max(0,s)))n.headers.append(`set-cookie`,e(t,``,t.startsWith(`__Secure-`),0))}async function v(e){try{let t=await s.load(e);t&&await s.end(t)}catch(e){b(r,`session_store`,e)}}async function y(e){let t=o(e),n=new URL(e.url).searchParams,i=a(n.get(`redirect`),t),s=n.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await O(r,{origin:t,silent:s}),p=l(u);return _(e,p),g(p.headers,h(r.cookieName,d),c({verifier:f,redirectPath:i,silent:s}),t,r.lifetimes.flowMaxAgeMs),p}async function S(e){let i=o(e),c=new URL(e.url).searchParams,_=c.get(`state`),y=_&&z.test(_)?h(r.cookieName,_):null,S=y?n(f(e,y)):null,C=e=>(y&&t(e.headers,y,i),e);if(!S)return C(l(d(i,`invalid_state`,null)));let w=a(S.redirectPath,i),E=c.get(`iss`);if(E!==null&&E!==j(r.issuer))return C(l(d(i,`invalid_issuer`,null)));let O=c.get(`error`);if(O)return S.silent&&B.has(O)?C(l(u(i,w))):C(l(d(i,O,c.get(`error_description`))));let k=c.get(`code`);if(!k)return C(l(d(i,`invalid_request`,null)));let N,P,F;try{let e=await A(r,{code:k,verifier:S.verifier,redirectUri:new URL(r.paths.callback,i).toString()});N=D(e,null,r.now()),P=await T(M(r),N.accessToken),F=await r.onSignIn({user:P,accessToken:N.accessToken,redirectPath:w,previous:null})}catch(e){return b(r,`sign_in`,e),e instanceof x?C(l(d(i,e.code,e.description||null))):C(l(d(i,`accounts_unavailable`,null)))}let I=f(e,r.cookieName);if(F===null){let e=l(d(i,`access_denied`,null));I!==null&&(await v(I),t(e.headers,r.cookieName,i));for(let t of m(r,i))e.headers.append(`set-cookie`,t);return C(e)}let L,R;try{({cookieValue:L,session:R}=await s.start({user:P,tokens:N,data:F}))}catch(e){return b(r,`session_store`,e),C(l(d(i,`session_store_error`,null)))}I!==null&&await v(I);let V=l(new URL(w,i));g(V.headers,r.cookieName,L,i,r.lifetimes.absoluteMaxAgeMs);let H=await p(r,R,i,r.now());return H&&V.headers.append(`set-cookie`,H),C(V)}async function C(e){let t=o(e),n=await s.load(f(e,r.cookieName));n&&await s.end(n);let i=n?.tokens.idToken&&r.logout===`global`?w(r,{origin:t,idToken:n.tokens.idToken}):new URL(r.paths.logoutComplete,t).toString(),a=l(i,303);for(let e of F(r,t))a.headers.append(`set-cookie`,e);return a}return{login:y,callback:S,logout:C}}const H=e=>new Promise(t=>setTimeout(t,e));function U(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}function a(t){let r=e.now();return!i(t.tokens,r)&&r-t.lastValidatedAt>=n.revalidateIntervalMs}async function o(n){if(!n)return null;let i=await E(n),a;try{a=await t.read(i)}catch(n){if(!(n instanceof v))throw n;return b(e,`session_store`,n),await t.delete(i),null}return a?r(a,e.now())?(await t.delete(a.id),null):a:null}async function s(n){let r=k(32),i=e.now(),a={id:await E(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function c(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return l(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await P(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:D(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(_(n))return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return b(e,`refresh`,n),r??o;throw n}}async function l(r,a){for(;;){await H(100);let o=await t.read(r);if(!o)return null;let s=e.now();if(!i(o.tokens,s))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=s)return c(o);if(s-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>s)return o;throw new C(`Timed out waiting for the session refresh lease`,0)}}}async function u(r){let i;try{i=await c(r)}catch(t){b(e,`refresh`,t),i=r}if(!i)return null;if(e.now()-i.lastValidatedAt<n.revalidateIntervalMs||!d(i.tokens))return i;let a=e.revalidateUser?await p(i):i.user;if(!a)return f(i);if(!d(i.tokens))return i;let o=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken,user:a});if(o===null)return f(i);let s={data:o,lastValidatedAt:e.now()};return a!==i.user&&(s.user=a),t.update(i.id,s)}function d(t){return t.accessTokenExpiresAt-e.now()>n.requestTimeoutMs}async function f(n){return n.tokens.accessTokenExpiresAt<=e.now()?n:(await t.delete(n.id),null)}async function p(t){try{return await T(M(e),t.tokens.accessToken)}catch(n){return _(n)?null:(b(e,`revalidate`,n),t.user)}}async function m(e){await t.delete(e.id)}async function h(){if(!t.sweep)return 0;let r=e.now();return t.sweep({createdBefore:r-n.absoluteMaxAgeMs,validatedBefore:r-n.idleMaxAgeMs})}return{load:o,start:s,ensureFreshTokens:c,revalidate:u,revalidationDue:a,end:m,sweep:h}}function W(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)},async sweep(t){let n=0;for(let[r,i]of e)(i.createdAt<t.createdBefore||i.lastValidatedAt<t.validatedBefore)&&(e.delete(r),n+=1);return n}}}function G(e){let t=S(e),n=U(t),r=V(t,n),i=R(t,n),a=I(t,n);function o(e){return{session:f(e,t.cookieName),cache:f(e,u(t.cookieName))}}async function c(e){return await s(t,e.cache,e.session,t.now())??n.load(e.session)}async function l(e){return c(o(e))}async function d(e){let r=await s(t,e.cache,e.session,t.now());if(r&&r.tokens.accessTokenExpiresAt>t.now())return r.tokens.accessToken;let i=await n.load(e.session);return i?(await n.ensureFreshTokens(i))?.tokens.accessToken??null:null}async function p(e){return d(o(e))}async function m(e,r){let i=await n.load(e.session);return i?t.store.update(i.id,{data:r(i.data)}):null}function h(){return n.sweep()}return{cookieName:t.cookieName,handlers:r,guard:i,resolveSession:a,sessionFromCookies:c,sessionFromRequest:l,accessTokenFromCookies:d,accessTokenFromRequest:p,updateSessionData:m,sweepSessions:h}}export{C as AccountsRequestError,y as DEFAULT_LIFETIMES,x as OAuthTokenError,v as SessionDecodeError,N as accountsEndpoint,u as cacheCookieBase,G as createAccountsAuth,W as createMemorySessionStore,T as fetchUserInfo,r as forwardCookies,_ as isAccessDenied,o as requestOrigin,a as sanitizeRedirectPath};

package/dist/next.d.ts

@@ -1,5 +1,5 @@
-import { c as AccountsSession } from "./types-CEuhm7Nv.js";
-import { t as AccountsAuth } from "./index-wc8vz71h.js";
+import { c as AccountsSession } from "./types-Cx223pmJ.js";
+import { t as AccountsAuth } from "./index-Bte2SoPM.js";
 import { NextRequest, NextResponse } from "next/server";
 //#region src/next/index.d.ts
 /**

package/dist/next.js

@@ -1 +1 @@
-import{d as e,n as t,s as n}from"./cache-kH1-Y-mz.js";import{cookies as r}from"next/headers";import{NextResponse as i,connection as a}from"next/server";function o(t,n=[]){e(t.headers,n);let r=i.next({request:{headers:t.headers}});for(let e of n)r.headers.append(`set-cookie`,e);return r}async function s(e){await a();let i=await r(),o=e=>i.get(n(e,!0))?.value||i.get(n(e,!1))?.value||null;return{session:o(e),cache:o(t(e))}}async function c(e){let i=await r(),a=t(e);for(let e of[n(a,!0),n(a,!1)])try{i.delete(e)}catch{}}function l(e){let t=e.cookieName;return{async getSession(){return e.sessionFromCookies(await s(t))},async getAccessToken(){return e.accessTokenFromCookies(await s(t))},async updateSessionData(n){let r=await e.updateSessionData(await s(t),n);return r&&await c(t),r}}}export{o as continueRequest,l as withNextRequestScope};
+import{d as e,n as t,s as n}from"./cache-DNvwg4aa.js";import{cookies as r}from"next/headers";import{NextResponse as i,connection as a}from"next/server";function o(t,n=[]){e(t.headers,n);let r=i.next({request:{headers:t.headers}});for(let e of n)r.headers.append(`set-cookie`,e);return r}async function s(e){await a();let i=await r(),o=e=>i.get(n(e,!0))?.value||i.get(n(e,!1))?.value||null;return{session:o(e),cache:o(t(e))}}async function c(e){let i=await r(),a=t(e);for(let e of[n(a,!0),n(a,!1)])try{i.delete(e)}catch{}}function l(e){let t=e.cookieName;return{async getSession(){return e.sessionFromCookies(await s(t))},async getAccessToken(){return e.accessTokenFromCookies(await s(t))},async updateSessionData(n){let r=await e.updateSessionData(await s(t),n);return r&&await c(t),r}}}export{o as continueRequest,l as withNextRequestScope};

package/dist/oidc-CDcBo0qB.js

@@ -0,0 +1 @@
+import{n as e,r as t,t as n}from"./types-B_7rFOLg.js";function r(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function i(e){return r(crypto.getRandomValues(new Uint8Array(e)))}async function a(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return r(new Uint8Array(t))}function o(e,t){return new URL(t,e).toString()}function s(e){return o(e,`/api/auth`)}function c(e){return{issuer:e.issuer,fetch:e.fetch,timeoutMs:e.lifetimes.requestTimeoutMs}}async function l(t,r,i={},a){let s=t.fetch??globalThis.fetch.bind(globalThis),c=t.timeoutMs??e.requestTimeoutMs,l=a===void 0?c:Math.min(c,a-Date.now());if(l<=0)throw new n(`Accounts request deadline passed`,0);return s(o(t.issuer,r),{...i,cache:`no-store`,signal:AbortSignal.timeout(l)})}async function u(e,t){let n=i(24),r=i(32),s=new URL(o(e.issuer,`/api/auth/oauth2/authorize`));return s.searchParams.set(`client_id`,e.clientId),s.searchParams.set(`redirect_uri`,new URL(e.paths.callback,t.origin).toString()),s.searchParams.set(`response_type`,`code`),s.searchParams.set(`scope`,e.scope),s.searchParams.set(`state`,n),s.searchParams.set(`code_challenge`,await a(r)),s.searchParams.set(`code_challenge_method`,`S256`),t.silent&&s.searchParams.set(`prompt`,`none`),{url:s.toString(),state:n,verifier:r}}function d(e,t){let n=new URL(o(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}async function f(e,n,r,i=!0){let a=new URLSearchParams({client_id:e.clientId,...n});e.clientSecret&&a.set(`client_secret`,e.clientSecret),e.audience&&i&&a.set(`resource`,e.audience);let o=await l(c(e),`/api/auth/oauth2/token`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:a},r);if(!o.ok){let a=await o.text().catch(()=>``),s=`unknown_error`,c=a;try{let e=JSON.parse(a);s=e.error??s,c=e.error_description??c}catch{}if(i&&e.audience&&(s===`invalid_target`||s===`invalid_request`&&/resource/i.test(c)))return f(e,n,r,!1);throw new t(o.status,s,c)}return await o.json()}function p(e,t){return f(e,{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function m(e,t,n){return f(e,{grant_type:`refresh_token`,refresh_token:t},n===void 0?void 0:Date.now()+n)}async function h(e,t){let r=await l(e,`/api/auth/oauth2/userinfo`,{headers:{Authorization:`Bearer ${t}`}});if(!r.ok)throw new n(`Failed to load user info: ${r.status}`,r.status);let i=await r.json();return{id:i.sub,email:i.email??``,name:i.name??i.email??i.sub,image:i.picture??null}}function g(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}export{d as a,h as c,a as d,g as f,u as i,i as l,l as n,p as o,s as r,c as s,o as t,m as u};

package/dist/{oidc-CaYOiMFO.d.ts → oidc-CbVNB1IR.d.ts}

@@ -1,4 +1,4 @@
-import { f as AccountsUser } from "./types-CEuhm7Nv.js";
+import { f as AccountsUser } from "./types-Cx223pmJ.js";
 //#region src/core/oidc.d.ts
 type AccountsFetchOptions = {
   issuer: string;

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { u as AccountsSessionStore } from "./types-CEuhm7Nv.js";
+import { u as AccountsSessionStore } from "./types-Cx223pmJ.js";
 //#region src/testing/index.d.ts
 /**
  * A behavioural conformance suite for the session store contract.

package/dist/{types-ICH7-e-H.js → types-B_7rFOLg.js}

@@ -1 +1 @@
-function e(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function t(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function n(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4),r;try{r=atob(n)}catch{throw Error(`Malformed encrypted value`)}let i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function r(e){let r=null,i=()=>r??=crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`]);return{async encrypt(e){let n=crypto.getRandomValues(new Uint8Array(12)),r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},await i(),new TextEncoder().encode(e))),a=new Uint8Array(12+r.length);return a.set(n),a.set(r,12),t(a)},async decrypt(e){let t=n(e);if(t.length<28)throw Error(`Malformed encrypted value`);let r;try{r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:t.subarray(0,12)},await i(),t.subarray(12))}catch{throw Error(`Malformed encrypted value`)}return new TextDecoder().decode(r)}}}function i(t){if(!/^[0-9a-fA-F]{64}$/.test(t))throw Error(`AES-GCM codec key must be 64 hex characters (32 bytes)`);return r(e(t))}function a(e){let t=null;return()=>t??=crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e)).then(e=>r(new Uint8Array(e)))}const o={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},s={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3,requestTimeoutMs:1e4,retryIntervalMs:1e4},c=Object.freeze({});function l({phase:e,error:t}){console.error(`[aui-auth] ${e}`,t)}function u(e,t,n){try{e.onError({phase:t,error:n})}catch{}}function d(e){return{...e,scope:e.scope??`openid profile email offline_access`,onSignIn:e.onSignIn??(async()=>c),onRevalidate:e.onRevalidate??(async()=>c),onError:e.onError??l,revalidateUser:e.revalidateUser??!1,paths:{...o,...e.paths},lifetimes:{...s,...e.lifetimes},fetch:e.fetch??globalThis.fetch.bind(globalThis),now:e.now??Date.now,cache:e.cache?{codec:a(e.cache.secret),maxAgeMs:e.cache.maxAgeMs??6e4}:null,audience:e.audience===!1?null:e.audience??new URL(`/api/auth`,e.issuer).toString()}}var f=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},p=class extends Error{constructor(e){super(`Stored session could not be decoded`,{cause:e}),this.name=`SessionDecodeError`}},m=class extends f{code;description;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t,this.description=n}};const h=new Set([408,425,429]);function g(e){return e instanceof f&&e.status>=400&&e.status<500&&!h.has(e.status)}export{g as a,i as c,p as i,s as n,u as o,m as r,d as s,f as t};
+function e(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function t(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function n(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4),r;try{r=atob(n)}catch{throw Error(`Malformed encrypted value`)}let i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function r(e){let r=null,i=()=>r??=crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`]);return{async encrypt(e){let n=crypto.getRandomValues(new Uint8Array(12)),r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},await i(),new TextEncoder().encode(e))),a=new Uint8Array(12+r.length);return a.set(n),a.set(r,12),t(a)},async decrypt(e){let t=n(e);if(t.length<28)throw Error(`Malformed encrypted value`);let r;try{r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:t.subarray(0,12)},await i(),t.subarray(12))}catch{throw Error(`Malformed encrypted value`)}return new TextDecoder().decode(r)}}}function i(t){if(!/^[0-9a-fA-F]{64}$/.test(t))throw Error(`AES-GCM codec key must be 64 hex characters (32 bytes)`);return r(e(t))}function a(e){let t=null;return()=>t??=crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e)).then(e=>r(new Uint8Array(e)))}const o={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},s={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3,requestTimeoutMs:1e4,retryIntervalMs:1e4},c=Object.freeze({});function l({phase:e,error:t}){console.error(`[aui-auth] ${e}`,t)}function u(e,t,n){try{e.onError({phase:t,error:n})}catch{}}function d(e){return{...e,scope:e.scope??`openid profile email offline_access`,onSignIn:e.onSignIn??(async()=>c),onRevalidate:e.onRevalidate??(async()=>c),onError:e.onError??l,revalidateUser:e.revalidateUser??!1,logout:e.logout??`global`,paths:{...o,...e.paths},lifetimes:{...s,...e.lifetimes},fetch:e.fetch??globalThis.fetch.bind(globalThis),now:e.now??Date.now,cache:e.cache?{codec:a(e.cache.secret),maxAgeMs:e.cache.maxAgeMs??6e4}:null,audience:e.audience===!1?null:e.audience??new URL(`/api/auth`,e.issuer).toString()}}var f=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},p=class extends Error{constructor(e){super(`Stored session could not be decoded`,{cause:e}),this.name=`SessionDecodeError`}},m=class extends f{code;description;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t,this.description=n}};const h=new Set([408,425,429]);function g(e){return e instanceof f&&e.status>=400&&e.status<500&&!h.has(e.status)}export{g as a,i as c,p as i,s as n,u as o,m as r,d as s,f as t};

package/dist/{types-CEuhm7Nv.d.ts → types-Cx223pmJ.d.ts}

@@ -134,6 +134,17 @@ type AccountsAuthConfig<Data> = {
    * scheduler that throws is answered by revalidating inline.
    */
   deferRevalidation?(task: () => Promise<void>): void;
+  /**
+   * What signing out ends. `global`, the default, ends this app's session and
+   * then the accounts session through `end-session` with `id_token_hint`, so
+   * every app signed in through that accounts session is signed out with it.
+   * `local` ends this app's session alone and finishes at
+   * `paths.logoutComplete`, for a site where signing in is optional and a
+   * visitor who signs out did not ask to leave every other product; the
+   * accounts session lives on, so the next sign-in there completes without a
+   * prompt.
+   */
+  logout?: "global" | "local";
   /**
    * Reports a failure the flow handled rather than threw. Every one of them is
    * invisible otherwise, which turns `session_store_error` into a redirect

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aui-auth",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Server side sessions for web apps that sign in through assistant-ui accounts: OIDC code flow with PKCE, tokens kept in the app's database, single flight refresh",
   "license": "MIT",
   "type": "module",
@@ -48,8 +48,10 @@
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
+    "@types/pg": "^8.20.0",
     "ioredis": "^6.0.0",
     "next": "^16.3.0",
+    "pg": "^8.22.0",
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2"
   },

package/dist/oidc-D2VwAdd3.js

@@ -1 +0,0 @@
-import{n as e,r as t,t as n}from"./types-ICH7-e-H.js";function r(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function i(e){return r(crypto.getRandomValues(new Uint8Array(e)))}async function a(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return r(new Uint8Array(t))}function o(e,t){return new URL(t,e).toString()}function s(e){return{issuer:e.issuer,fetch:e.fetch,timeoutMs:e.lifetimes.requestTimeoutMs}}async function c(t,r,i={},a){let s=t.fetch??globalThis.fetch.bind(globalThis),c=t.timeoutMs??e.requestTimeoutMs,l=a===void 0?c:Math.min(c,a-Date.now());if(l<=0)throw new n(`Accounts request deadline passed`,0);return s(o(t.issuer,r),{...i,cache:`no-store`,signal:AbortSignal.timeout(l)})}async function l(e,t){let n=i(24),r=i(32),s=new URL(o(e.issuer,`/api/auth/oauth2/authorize`));return s.searchParams.set(`client_id`,e.clientId),s.searchParams.set(`redirect_uri`,new URL(e.paths.callback,t.origin).toString()),s.searchParams.set(`response_type`,`code`),s.searchParams.set(`scope`,e.scope),s.searchParams.set(`state`,n),s.searchParams.set(`code_challenge`,await a(r)),s.searchParams.set(`code_challenge_method`,`S256`),t.silent&&s.searchParams.set(`prompt`,`none`),{url:s.toString(),state:n,verifier:r}}function u(e,t){let n=new URL(o(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}async function d(e,n,r,i=!0){let a=new URLSearchParams({client_id:e.clientId,...n});e.clientSecret&&a.set(`client_secret`,e.clientSecret),e.audience&&i&&a.set(`resource`,e.audience);let o=await c(s(e),`/api/auth/oauth2/token`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:a},r);if(!o.ok){let a=await o.text().catch(()=>``),s=`unknown_error`,c=a;try{let e=JSON.parse(a);s=e.error??s,c=e.error_description??c}catch{}if(i&&e.audience&&s===`invalid_request`&&/resource/i.test(c))return d(e,n,r,!1);throw new t(o.status,s,c)}return await o.json()}function f(e,t){return d(e,{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function p(e,t,n){return d(e,{grant_type:`refresh_token`,refresh_token:t},n===void 0?void 0:Date.now()+n)}async function m(e,t){let r=await c(e,`/api/auth/oauth2/userinfo`,{headers:{Authorization:`Bearer ${t}`}});if(!r.ok)throw new n(`Failed to load user info: ${r.status}`,r.status);let i=await r.json();return{id:i.sub,email:i.email??``,name:i.name??i.email??i.sub,image:i.picture??null}}function h(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}export{f as a,i as c,h as d,u as i,p as l,c as n,s as o,l as r,m as s,o as t,a as u};