aui-auth 0.0.7 → 0.0.9

package/dist/accounts.d.ts

@@ -1,6 +1,6 @@
-import { h as RevalidateInput, v as SignInInput } from "./types-Cx223pmJ.js";
-import { t as AccountsFetchOptions } from "./oidc-CbVNB1IR.js";
-//#region src/accounts/index.d.ts
+import { f as RevalidateInput, m as SignInInput } from "./types-B13HPcs5.js";
+import { t as AccountsFetchOptions } from "./fetch-C0ojJu8c.js";
+//#region src/accounts/organizations.d.ts
 type AccountsOrganization = {
   id: string;
   name: string;
@@ -22,5 +22,59 @@ declare function organizationHooks(options: OrganizationHooksOptions): {
   onSignIn: (input: SignInInput<OrganizationSessionData>) => Promise<OrganizationSessionData>;
   onRevalidate: (input: RevalidateInput<OrganizationSessionData>) => Promise<OrganizationSessionData | null>;
 };
+/** Owners and admins manage an organization; every other role only takes part in it. */
+declare function isOrganizationAdmin(role: string | null | undefined): boolean;
+/**
+ * The organization a route's segment names: the active one when no segment is
+ * given or the segment is its slug or id, one of the viewer's other
+ * organizations otherwise, and none when the viewer is not in it. A segment
+ * can be a slug or an id and nothing about its shape says which, so it is
+ * matched against both. The list is only read when the active one does not
+ * match, and the organization it returns carries the viewer's role there.
+ */
+declare function resolveRouteOrganization<Organization extends Pick<AccountsOrganization, "id" | "slug">>(segment: string | undefined, active: Organization | null, organizations: () => Promise<readonly Organization[]>): Promise<Organization | null>;
 //#endregion
-export { AccountsOrganization, OrganizationHooksOptions, OrganizationSessionData, fetchOrganizations, organizationHooks, preferredOrganizationSlug, selectOrganization };
+//#region src/accounts/projects.d.ts
+type OrganizationReference = {
+  id: string;
+} | {
+  slug: string;
+};
+type AccountsProject = {
+  id: string;
+  organizationId: string;
+  slug: string;
+  name: string;
+  color: string;
+  icon: string | null;
+  plan: string;
+  createdBy: string;
+  updatedBy: string;
+  createdAt: Date;
+  updatedAt: Date;
+  /** The caller's role in the project's organization; null from an accounts that predates the field. */
+  viewerRole: string | null;
+};
+type AccountsProjectPatch = {
+  name?: string;
+  slug?: string;
+  color?: string;
+  icon?: string | null;
+  plan?: string;
+};
+type DuplicateProjectSlug = {
+  reason: "duplicate";
+};
+/** The projects of an organization, or none when it does not exist or the caller is not in it. */
+declare function fetchProjects(options: AccountsFetchOptions, accessToken: string, organization: OrganizationReference): Promise<AccountsProject[]>;
+/** One project by slug, or null when there is nothing there for this caller. */
+declare function fetchProject(options: AccountsFetchOptions, accessToken: string, organization: OrganizationReference, slug: string): Promise<AccountsProject | null>;
+/** A refusal (403) and a missing organization (404) throw; a taken slug is an answer. */
+declare function createProject(options: AccountsFetchOptions, accessToken: string, organization: OrganizationReference, input: {
+  name: string;
+  slug: string;
+}): Promise<AccountsProject | DuplicateProjectSlug>;
+/** Null when the project is gone; a refusal (403) throws; a taken slug is an answer. */
+declare function updateProject(options: AccountsFetchOptions, accessToken: string, organization: OrganizationReference, slug: string, patch: AccountsProjectPatch): Promise<AccountsProject | DuplicateProjectSlug | null>;
+//#endregion
+export { type AccountsOrganization, type AccountsProject, type AccountsProjectPatch, type DuplicateProjectSlug, type OrganizationHooksOptions, type OrganizationReference, type OrganizationSessionData, createProject, fetchOrganizations, fetchProject, fetchProjects, isOrganizationAdmin, organizationHooks, preferredOrganizationSlug, resolveRouteOrganization, selectOrganization, updateProject };

package/dist/accounts.js

@@ -1 +1 @@
-import{a as e,t}from"./types-B_7rFOLg.js";import{n}from"./oidc-CDcBo0qB.js";async function r(e,r){let i=await n(e,`/api/oidc/organizations`,{headers:{Authorization:`Bearer ${r}`}});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function i(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function a(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function o(t){let n=t.preferredSlug??a;async function o(e){return{activeOrganization:i(await r(t,e.accessToken),n(e.redirectPath))}}async function s(n){let a;try{a=await r(t,n.accessToken)}catch(t){if(e(t))return null;throw t}let o=n.session.data.activeOrganization;if(!o)return{activeOrganization:i(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}export{r as fetchOrganizations,o as organizationHooks,a as preferredOrganizationSlug,i as selectOrganization};
+import{i as e,t}from"./errors-C7IxbL16.js";import{n}from"./fetch-CM1mVzPm.js";async function r(e,r){let i=await n(e,`/api/oidc/organizations`,{headers:{Authorization:`Bearer ${r}`}});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function i(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function a(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function o(t){let n=t.preferredSlug??a;async function o(e){return{activeOrganization:i(await r(t,e.accessToken),n(e.redirectPath))}}async function s(n){let a;try{a=await r(t,n.accessToken)}catch(t){if(e(t))return null;throw t}let o=n.session.data.activeOrganization;if(!o)return{activeOrganization:i(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}function s(e){return e===`owner`||e===`admin`}async function c(e,t,n){let r=t=>t.slug===e||t.id===e;return e===void 0||t&&r(t)?t:(await n()).find(r)??null}function l(e){return`id`in e?`org_id=${encodeURIComponent(e.id)}`:`org_slug=${encodeURIComponent(e.slug)}`}function u(e){let n=e,r=e=>{let r=n?.[e];if(typeof r!=`string`)throw new t(`Accounts project has no ${e}`,502);return r},i=e=>{let n=new Date(r(e));if(Number.isNaN(n.getTime()))throw new t(`Accounts project has no ${e}`,502);return n};return{id:r(`id`),organizationId:r(`organizationId`),slug:r(`slug`),name:r(`name`),color:r(`color`),icon:typeof n?.icon==`string`?n.icon:null,plan:r(`plan`),createdBy:r(`createdBy`),updatedBy:r(`updatedBy`),createdAt:i(`createdAt`),updatedAt:i(`updatedAt`),viewerRole:typeof n?.viewerRole==`string`?n.viewerRole:null}}async function d(e,r,i,a={},o=[]){let s=await n(e,i,{method:a.method,headers:{Authorization:`Bearer ${r}`,...a.body===void 0?void 0:{"Content-Type":`application/json`}},body:a.body===void 0?void 0:JSON.stringify(a.body)});if(s.ok||o.includes(s.status))return s;throw new t(`Accounts request ${i} failed: ${s.status}`,s.status)}async function f(e,t,n){let r=await d(e,t,`/api/projects?${l(n)}`,{},[403,404]);return r.ok?(await r.json()).map(u):[]}async function p(e,t,n,r){let i=await d(e,t,`/api/projects/${encodeURIComponent(r)}?${l(n)}`,{},[403,404]);return i.ok?u(await i.json()):null}async function m(e,t,n,r){let i=await d(e,t,`/api/projects`,{method:`POST`,body:{...`id`in n?{org_id:n.id}:{org_slug:n.slug},name:r.name,slug:r.slug}},[409]);return i.status===409?{reason:`duplicate`}:u(await i.json())}async function h(e,t,n,r,i){let a=await d(e,t,`/api/projects/${encodeURIComponent(r)}?${l(n)}`,{method:`PATCH`,body:i},[404,409]);return a.status===409?{reason:`duplicate`}:a.status===404?null:u(await a.json())}export{m as createProject,r as fetchOrganizations,p as fetchProject,f as fetchProjects,s as isOrganizationAdmin,o as organizationHooks,a as preferredOrganizationSlug,c as resolveRouteOrganization,i as selectOrganization,h as updateProject};

package/dist/cache-vq-5GFN7.js

@@ -0,0 +1 @@
+import{n as e}from"./encoding-BhmNmloC.js";import{o as t}from"./errors-C7IxbL16.js";function n(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function r(e){let t=new URL(e.url);return`${n(e.headers.get(`x-forwarded-proto`))||t.protocol.replace(`:`,``)}://${n(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||t.host}`}function i(e){return new URL(e).protocol===`https:`}function a(e,t){return t?`__Secure-${e}`:e}function o(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function s(e,t){let n=o(e.headers.get(`cookie`));return n.get(a(t,!0))||n.get(a(t,!1))||null}function c(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function l(e,t,n,r,o){let s=i(r);e.append(`set-cookie`,c(a(t,s),n,s,Math.floor(o/1e3)))}function u(e,t){if(t.length===0)return;let n=o(e.get(`cookie`));for(let e of t){let t=e.split(`;`)[0],r=t.indexOf(`=`);if(r<1)continue;let i=t.slice(0,r).trim(),a=t.slice(r+1).trim();a?n.set(i,a):n.delete(i)}e.set(`cookie`,[...n].map(([e,t])=>`${e}=${t}`).join(`; `))}function d(e,t){let n=i(t);return[n,!n].map(t=>c(a(e,t),``,t,0))}function f(e,t,n){for(let r of d(t,n))e.append(`set-cookie`,r)}function p(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function m(e,t){return`${e}_flow_${t}`}function h(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function g(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function _(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin!==t||n.pathname.startsWith(`//`)?`/`:`${n.pathname}${n.search}${n.hash}`}const v=4096;function y(e){return`${e}_cache`}function b(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e,i=Math.min(t.lastValidatedAt+r.revalidateIntervalMs,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs);return Math.min(e.cache.maxAgeMs,(i>n?i:n+r.retryIntervalMs)-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function x(e,t,n){if(!e.cache)return null;let r=b(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function S(t,n,r,i){if(!t.cache||!n||!r)return null;let a;try{let e=await t.cache.codec();a=JSON.parse(await e.decrypt(n))}catch{return null}return a.v!==1||typeof a.exp!=`number`||a.exp<=i||a.id!==await e(r)?null:{id:a.id,user:a.u,tokens:{accessToken:a.at,refreshToken:null,idToken:null,accessTokenExpiresAt:a.ate},data:a.d,createdAt:a.ca,lastValidatedAt:a.lv,refreshLeaseUntil:null}}async function C(e,n,r,o){try{let t=await x(e,n,o);if(!t)return null;let s=i(r),l=c(a(y(e.cookieName),s),t.value,s,Math.floor(t.maxAgeMs/1e3));if(l.length>v)throw Error(`Cache cookie is ${l.length} bytes and browsers drop cookies over ${v}; the session data is too large to cache`);return l}catch(n){return t(e,`cache_cookie`,n),null}}function w(e,t){return e.cache?d(y(e.cookieName),t):[]}export{c as _,f as a,g as c,u as d,o as f,_ as g,r as h,S as i,h as l,p as m,y as n,d as o,s as p,C as r,a as s,w as t,m as u,l as v};

package/dist/codec-IJ2JySkR.js

@@ -0,0 +1 @@
+function e(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function t(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function n(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4),r;try{r=atob(n)}catch{throw Error(`Malformed encrypted value`)}let i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function r(e){let r=null,i=()=>r??=crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`]);return{async encrypt(e){let n=crypto.getRandomValues(new Uint8Array(12)),r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},await i(),new TextEncoder().encode(e))),a=new Uint8Array(12+r.length);return a.set(n),a.set(r,12),t(a)},async decrypt(e){let t=n(e);if(t.length<28)throw Error(`Malformed encrypted value`);let r;try{r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:t.subarray(0,12)},await i(),t.subarray(12))}catch{throw Error(`Malformed encrypted value`)}return new TextDecoder().decode(r)}}}function i(t){if(!/^[0-9a-fA-F]{64}$/.test(t))throw Error(`AES-GCM codec key must be 64 hex characters (32 bytes)`);return r(e(t))}function a(e){let t=null;return()=>t??=crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e)).then(e=>r(new Uint8Array(e)))}export{a as n,i as t};

package/dist/database/index.d.ts

@@ -1,3 +1,4 @@
 import { n as createAesGcmCodec, t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { _ as SessionSweepCutoffs, c as AccountsSession, d as AccountsTokens, f as AccountsUser, g as SessionDecodeError, l as AccountsSessionPatch, u as AccountsSessionStore } from "../types-Cx223pmJ.js";
+import { c as AccountsSessionPatch, d as AccountsUser, l as AccountsSessionStore, p as SessionSweepCutoffs, s as AccountsSession, u as AccountsTokens } from "../types-B13HPcs5.js";
+import { r as SessionDecodeError } from "../errors-DpQsDn4O.js";
 export { type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, type SessionCodec, SessionDecodeError, type SessionSweepCutoffs, createAesGcmCodec };

package/dist/database/index.js

@@ -1 +1 @@
-import{c as e,i as t}from"../types-B_7rFOLg.js";export{t as SessionDecodeError,e as createAesGcmCodec};
+import{r as e}from"../errors-C7IxbL16.js";import{t}from"../codec-IJ2JySkR.js";export{e as SessionDecodeError,t as createAesGcmCodec};

package/dist/database/pg.d.ts

@@ -1,5 +1,5 @@
 import { t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { u as AccountsSessionStore } from "../types-Cx223pmJ.js";
+import { l as AccountsSessionStore } from "../types-B13HPcs5.js";
 //#region src/database/pg.d.ts
 type PgQuery = (text: string, values?: unknown[]) => Promise<{
   rows: Record<string, unknown>[];

package/dist/database/pg.js

@@ -1,4 +1,4 @@
-import{i as e}from"../types-B_7rFOLg.js";const t=`CREATE TABLE "accounts_sessions" (
+import{r as e}from"../errors-C7IxbL16.js";const t=`CREATE TABLE "accounts_sessions" (
   "id" text PRIMARY KEY,
   "user_id" text NOT NULL,
   "user" jsonb NOT NULL,

package/dist/database/redis.d.ts

@@ -1,5 +1,5 @@
 import { t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { u as AccountsSessionStore } from "../types-Cx223pmJ.js";
+import { l as AccountsSessionStore } from "../types-B13HPcs5.js";
 //#region src/database/redis.d.ts
 /**
  * The slice of a Redis client this store uses, so the package takes no Redis

package/dist/database/redis.js

@@ -1,4 +1,4 @@
-import{i as e}from"../types-B_7rFOLg.js";const t=`refreshLeaseUntil`,n=`
+import{r as e}from"../errors-C7IxbL16.js";const t=`refreshLeaseUntil`,n=`
 local key, checkLease, expectedLease, ttl = KEYS[1], ARGV[1], ARGV[2], ARGV[3]
 if redis.call('EXISTS', key) == 0 then return 0 end
 if checkLease == '1' then

package/dist/device.d.ts

@@ -0,0 +1,70 @@
+import { d as AccountsUser, u as AccountsTokens } from "./types-B13HPcs5.js";
+import { i as isAccessDenied, n as OAuthTokenError, t as AccountsRequestError } from "./errors-DpQsDn4O.js";
+//#region src/device/index.d.ts
+declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+type DeviceLoginConfig = {
+  issuer: string;
+  clientId: string;
+  scope?: string;
+  /**
+   * The resource the tokens are minted for; `<issuer>/api/auth` unless set,
+   * `false` for opaque tokens. Sent with the device code request, so the
+   * approval binds it, and again when the code is redeemed.
+   */
+  audience?: string | false;
+  /** How close to expiry `ensureFresh` refreshes; five minutes by default. */
+  refreshBeforeExpiryMs?: number;
+  requestTimeoutMs?: number;
+  fetch?: typeof fetch;
+  now?: () => number;
+  /** The wait between polls, for tests; a plain timer otherwise. */
+  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+};
+type DeviceAuthorization = {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete: string;
+  expiresAt: number;
+  intervalMs: number;
+  /** The resource the approval binds; null when the provider refused it. */
+  resource: string | null;
+};
+type DeviceCredentials = {
+  user: AccountsUser;
+  tokens: AccountsTokens;
+};
+/**
+ * The RFC 8628 device authorization grant against accounts, for a CLI or any
+ * process without a browser of its own: `start` asks for a code, the person
+ * approves it on the accounts device page, `wait` polls the token endpoint
+ * until the approval lands, and `refresh` and `ensureFresh` keep the token set
+ * alive afterwards. The credentials the flow hands back belong to the device,
+ * not to the browser session that approved them, so they outlive it. Where
+ * they are stored is the app's decision.
+ */
+declare function createDeviceLogin(config: DeviceLoginConfig): {
+  /** Asks accounts for a device code and the user code to show. */
+  start(): Promise<DeviceAuthorization>;
+  /**
+   * Polls until the person approves, at the interval accounts asked for
+   * (`slow_down` adds five seconds), and resolves with the token set and the
+   * profile from userinfo. Rejects with `OAuthTokenError` `access_denied`
+   * when the person refuses and `expired_token` when nobody answers in time.
+   */
+  wait(authorization: DeviceAuthorization, options?: {
+    signal?: AbortSignal;
+  }): Promise<DeviceCredentials>;
+  /**
+   * Spends the refresh token for a new token set. accounts rotates the
+   * refresh token on every use, so the credentials this resolves with
+   * replace the ones passed in. A rejection that `isAccessDenied` accepts
+   * means the login is over; anything else says nothing about it.
+   */
+  refresh(credentials: DeviceCredentials): Promise<DeviceCredentials>;
+  /** The credentials as they are while the access token has time left, refreshed otherwise. */
+  ensureFresh(credentials: DeviceCredentials): Promise<DeviceCredentials>;
+};
+type DeviceLogin = ReturnType<typeof createDeviceLogin>;
+//#endregion
+export { AccountsRequestError, type AccountsTokens, type AccountsUser, DEVICE_CODE_GRANT_TYPE, DeviceAuthorization, DeviceCredentials, DeviceLogin, DeviceLoginConfig, OAuthTokenError, createDeviceLogin, isAccessDenied };

package/dist/device.js

@@ -0,0 +1 @@
+import{i as e,n as t,t as n}from"./errors-C7IxbL16.js";import{a as r,n as i,r as a}from"./fetch-CM1mVzPm.js";import{c as o,i as s,l as c,o as l,s as u}from"./oidc-qInr-2mE.js";const d=`urn:ietf:params:oauth:grant-type:device_code`;function f(e,t){return new Promise((n,r)=>{if(t?.aborted){r(t.reason??Error(`Device login aborted`));return}let i=setTimeout(()=>{t?.removeEventListener(`abort`,a),n()},e);function a(){clearTimeout(i),r(t?.reason??Error(`Device login aborted`))}t?.addEventListener(`abort`,a,{once:!0})})}function p(e){let n=e.now??Date.now,p=e.sleep??f,m=e.scope??`openid profile email offline_access`,h=e.audience===void 0?a(e.issuer):e.audience||null,g=e.refreshBeforeExpiryMs??r.refreshBeforeExpiryMs,_={issuer:e.issuer,fetch:e.fetch,timeoutMs:e.requestTimeoutMs},v=t=>({..._,clientId:e.clientId,audience:t});async function y(t){let r=new URLSearchParams({client_id:e.clientId,scope:m});t&&r.set(`resource`,t);let a=await i(_,`/api/auth/device/code`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:r});if(!a.ok){let e=await o(a);if(t&&l(e))return y(null);throw e}let s=await a.json();return{deviceCode:s.device_code,userCode:s.user_code,verificationUri:s.verification_uri,verificationUriComplete:s.verification_uri_complete,expiresAt:n()+s.expires_in*1e3,intervalMs:(s.interval??5)*1e3,resource:t}}async function b(e,t){let r=c(e,t?.tokens??null,n());return{user:t?.user??await s(_,r.accessToken),tokens:r}}return{start(){return y(h)},async wait(e,r={}){let i=e.intervalMs;for(;;){if(n()>=e.expiresAt)throw new t(400,`expired_token`,`The device code expired before it was approved`);await p(i,r.signal);try{return await b(await u(v(e.resource),{grant_type:d,device_code:e.deviceCode},void 0,e.resource!==null),null)}catch(e){if(e instanceof t){if(e.code===`authorization_pending`)continue;if(e.code===`slow_down`){i+=5e3;continue}}throw e}}},async refresh(e){let{refreshToken:n}=e.tokens;if(!n)throw new t(400,`invalid_grant`,`The credentials carry no refresh token`);return b(await u(v(h),{grant_type:`refresh_token`,refresh_token:n}),e)},async ensureFresh(e){return e.tokens.accessTokenExpiresAt-g>n()?e:this.refresh(e)}}}export{n as AccountsRequestError,d as DEVICE_CODE_GRANT_TYPE,t as OAuthTokenError,p as createDeviceLogin,e as isAccessDenied};

package/dist/encoding-BhmNmloC.js

@@ -0,0 +1 @@
+function e(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function t(t){return e(crypto.getRandomValues(new Uint8Array(t)))}async function n(t){let n=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(t));return e(new Uint8Array(n))}export{n,t};

package/dist/errors-C7IxbL16.js

@@ -0,0 +1 @@
+var e=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},t=class extends Error{constructor(e){super(`Stored session could not be decoded`,{cause:e}),this.name=`SessionDecodeError`}},n=class extends e{code;description;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t,this.description=n}};const r=new Set([408,425,429]);function i(t){return t instanceof e&&t.status>=400&&t.status<500&&!r.has(t.status)}function a({phase:e,error:t}){console.error(`[aui-auth] ${e}`,t)}function o(e,t,n){try{e.onError({phase:t,error:n})}catch{}}export{a,i,n,o,t as r,e as t};

package/dist/errors-DpQsDn4O.d.ts

@@ -0,0 +1,30 @@
+//#region src/core/errors.d.ts
+declare class AccountsRequestError extends Error {
+  readonly status: number;
+  constructor(message: string, status: number);
+}
+/**
+ * A stored session that cannot be turned back into one: a token the codec
+ * cannot decrypt because another key wrote it, a column that does not hold
+ * what it should. The session manager reads it as the session being over,
+ * removes the row and sends the user back to sign in, so a store that decodes
+ * what it stored raises this rather than the failure underneath; every other
+ * store failure is a fault and propagates.
+ */
+declare class SessionDecodeError extends Error {
+  constructor(cause: unknown);
+}
+declare class OAuthTokenError extends AccountsRequestError {
+  readonly code: string;
+  readonly description: string;
+  constructor(status: number, code: string, description: string);
+}
+/**
+ * Whether accounts rejected the token, the client, or the user, which ends
+ * the session, as opposed to failing to answer, which keeps it. Any 4xx but a
+ * timeout or a rate limit counts: the provider answers a revoked token or a
+ * disabled client with 400 as readily as with 401.
+ */
+declare function isAccessDenied(error: unknown): boolean;
+//#endregion
+export { isAccessDenied as i, OAuthTokenError as n, SessionDecodeError as r, AccountsRequestError as t };

package/dist/fetch-C0ojJu8c.d.ts

@@ -0,0 +1,9 @@
+//#region src/core/fetch.d.ts
+type AccountsFetchOptions = {
+  issuer: string;
+  fetch?: typeof fetch;
+  timeoutMs?: number;
+};
+declare function accountsEndpoint(issuer: string, path: string): string;
+//#endregion
+export { accountsEndpoint as n, AccountsFetchOptions as t };

package/dist/fetch-CM1mVzPm.js

@@ -0,0 +1 @@
+import{a as e,t}from"./errors-C7IxbL16.js";import{n}from"./codec-IJ2JySkR.js";const r={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},i={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3,requestTimeoutMs:1e4,retryIntervalMs:1e4},a=Object.freeze({});function o(t){return{...t,scope:t.scope??`openid profile email offline_access`,onSignIn:t.onSignIn??(async()=>a),onRevalidate:t.onRevalidate??(async()=>a),onError:t.onError??e,revalidateUser:t.revalidateUser??!1,logout:t.logout??`global`,paths:{...r,...t.paths},lifetimes:{...i,...t.lifetimes},fetch:t.fetch??globalThis.fetch.bind(globalThis),now:t.now??Date.now,cache:t.cache?{codec:n(t.cache.secret),maxAgeMs:t.cache.maxAgeMs??6e4}:null,audience:t.audience===!1?null:t.audience??new URL(`/api/auth`,t.issuer).toString()}}function s(e,t){return new URL(t,e).toString()}function c(e){return s(e,`/api/auth`)}function l(e){return{issuer:e.issuer,fetch:e.fetch,timeoutMs:e.lifetimes.requestTimeoutMs}}async function u(e,n,r={},a){let o=e.fetch??globalThis.fetch.bind(globalThis),c=e.timeoutMs??i.requestTimeoutMs,l=a===void 0?c:Math.min(c,a-Date.now());if(l<=0)throw new t(`Accounts request deadline passed`,0);return o(s(e.issuer,n),{...r,cache:`no-store`,signal:AbortSignal.timeout(l)})}export{i as a,l as i,u as n,o,c as r,s as t};

package/dist/{index-Bte2SoPM.d.ts → index-CNcSwzgU.d.ts}

@@ -1,4 +1,8 @@
-import { c as AccountsSession, t as AccountsAuthConfig, u as AccountsSessionStore } from "./types-Cx223pmJ.js";
+import { a as AccountsLifetimes, d as AccountsUser, l as AccountsSessionStore, s as AccountsSession, t as AccountsAuthConfig } from "./types-B13HPcs5.js";
+import { t as AccountsFetchOptions } from "./fetch-C0ojJu8c.js";
+//#region src/core/config.d.ts
+declare const DEFAULT_LIFETIMES: AccountsLifetimes;
+//#endregion
 //#region src/core/cookies.d.ts
 declare function requestOrigin(request: Request): string;
 /**
@@ -10,6 +14,9 @@ declare function requestOrigin(request: Request): string;
 declare function forwardCookies(headers: Headers, issued: readonly string[]): void;
 declare function sanitizeRedirectPath(rawRedirect: string | null | undefined, origin: string): string;
 //#endregion
+//#region src/core/oidc.d.ts
+declare function fetchUserInfo(options: AccountsFetchOptions, accessToken: string): Promise<AccountsUser>;
+//#endregion
 //#region src/core/cache.d.ts
 declare function cacheCookieBase(sessionCookie: string): string;
 //#endregion
@@ -67,4 +74,4 @@ declare function createAccountsAuth<Data>(input: AccountsAuthConfig<Data>): {
 };
 type AccountsAuth<Data> = ReturnType<typeof createAccountsAuth<Data>>;
 //#endregion
-export { SessionResolution as a, cacheCookieBase as c, sanitizeRedirectPath as d, createMemorySessionStore as i, forwardCookies as l, SessionCookies as n, GuardOptions as o, createAccountsAuth as r, GuardResult as s, AccountsAuth as t, requestOrigin as u };
+export { SessionResolution as a, cacheCookieBase as c, requestOrigin as d, sanitizeRedirectPath as f, createMemorySessionStore as i, fetchUserInfo as l, SessionCookies as n, GuardOptions as o, DEFAULT_LIFETIMES as p, createAccountsAuth as r, GuardResult as s, AccountsAuth as t, forwardCookies as u };

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-import { _ as SessionSweepCutoffs, a as AccountsLifetimes, c as AccountsSession, d as AccountsTokens, f as AccountsUser, g as SessionDecodeError, h as RevalidateInput, i as AccountsErrorPhase, l as AccountsSessionPatch, m as OAuthTokenError, n as AccountsCacheConfig, o as AccountsPaths, p as DEFAULT_LIFETIMES, r as AccountsErrorEvent, s as AccountsRequestError, t as AccountsAuthConfig, u as AccountsSessionStore, v as SignInInput, y as isAccessDenied } from "./types-Cx223pmJ.js";
-import { n as accountsEndpoint, r as fetchUserInfo, t as AccountsFetchOptions } from "./oidc-CbVNB1IR.js";
-import { a as SessionResolution, c as cacheCookieBase, d as sanitizeRedirectPath, i as createMemorySessionStore, l as forwardCookies, n as SessionCookies, o as GuardOptions, r as createAccountsAuth, s as GuardResult, t as AccountsAuth, u as requestOrigin } from "./index-Bte2SoPM.js";
+import { a as AccountsLifetimes, c as AccountsSessionPatch, d as AccountsUser, f as RevalidateInput, i as AccountsErrorPhase, l as AccountsSessionStore, m as SignInInput, n as AccountsCacheConfig, o as AccountsPaths, p as SessionSweepCutoffs, r as AccountsErrorEvent, s as AccountsSession, t as AccountsAuthConfig, u as AccountsTokens } from "./types-B13HPcs5.js";
+import { n as accountsEndpoint, t as AccountsFetchOptions } from "./fetch-C0ojJu8c.js";
+import { i as isAccessDenied, n as OAuthTokenError, r as SessionDecodeError, t as AccountsRequestError } from "./errors-DpQsDn4O.js";
+import { a as SessionResolution, c as cacheCookieBase, d as requestOrigin, f as sanitizeRedirectPath, i as createMemorySessionStore, l as fetchUserInfo, n as SessionCookies, o as GuardOptions, p as DEFAULT_LIFETIMES, r as createAccountsAuth, s as GuardResult, t as AccountsAuth, u as forwardCookies } from "./index-CNcSwzgU.js";
 export { AccountsAuth, type AccountsAuthConfig, type AccountsCacheConfig, type AccountsErrorEvent, type AccountsErrorPhase, type AccountsFetchOptions, type AccountsLifetimes, type AccountsPaths, AccountsRequestError, type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, DEFAULT_LIFETIMES, type GuardOptions, type GuardResult, OAuthTokenError, type RevalidateInput, SessionCookies, SessionDecodeError, type SessionResolution, type SessionSweepCutoffs, type SignInInput, accountsEndpoint, cacheCookieBase, createAccountsAuth, createMemorySessionStore, fetchUserInfo, forwardCookies, isAccessDenied, requestOrigin, sanitizeRedirectPath };

package/dist/index.js

@@ -1 +1 @@
-import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,p as f,r as p,t as m,u as h,v as g}from"./cache-DNvwg4aa.js";import{a as _,i as v,n as y,o as b,r as x,s as S,t as C}from"./types-B_7rFOLg.js";import{a as w,c as T,d as E,f as D,i as O,l as k,o as A,r as j,s as M,t as N,u as P}from"./oidc-CDcBo0qB.js";function F(e,t){return[...d(e.cookieName,t),...m(e,t)]}function I(e,t){return async function(n){let r=o(n),i=f(n,e.cookieName),a=f(n,u(e.cookieName)),c=await s(e,a,i,e.now());if(c)return{session:c,cookies:[]};let l={session:null,cookies:i!==null||a!==null?F(e,r):[]},d=await t.load(i);if(!d)return l;let{deferRevalidation:m}=e;if(m&&t.revalidationDue(d)&&L(e,m,t,d)){let t=await p(e,d,r,e.now());return{session:d,cookies:t?[t]:[]}}let h=d;try{let e=await t.revalidate(d);if(!e)return l;h=e}catch(t){b(e,`revalidate`,t)}let g=await p(e,h,r,e.now());return{session:h,cookies:g?[g]:[]}}}function L(e,t,n,r){try{return t(async()=>{try{await n.revalidate(r)}catch(t){b(e,`revalidate`,t)}}),!0}catch(t){return b(e,`revalidate`,t),!1}}function R(e,t){let n=I(e,t);return async function(t,i={}){let a=new URL(t.url);if([e.paths.login,e.paths.callback,e.paths.logout,e.paths.logoutComplete,e.paths.error,...i.publicPaths??[]].some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,a=new URL(e.url),o=(t.apiPaths??[`/api`,`/trpc`]).some(e=>a.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):l(i(e,t,r));for(let e of n)o.headers.append(`set-cookie`,e);return{kind:`response`,response:o}}function i(t,n,r){let i=new URL(t.url),a=new URL(e.paths.login,o(t));return a.searchParams.set(`redirect`,n.redirectPath?.(t)??`${i.pathname}${i.search}`),r&&a.searchParams.set(`silent`,`1`),a}}const z=/^[A-Za-z0-9_-]{1,128}$/,B=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function V(r,s){function u(e,t){let n=new URL(r.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let i=new URL(r.paths.error,e);return i.searchParams.set(`reason`,t),n&&i.searchParams.set(`description`,n),i}function _(t,n){let a=h(r.cookieName,``),o=[...i(t.headers.get(`cookie`)).keys()].filter(e=>e.replace(/^__Secure-/,``).startsWith(a)),s=o.length-4;for(let t of o.slice(0,Math.max(0,s)))n.headers.append(`set-cookie`,e(t,``,t.startsWith(`__Secure-`),0))}async function v(e){try{let t=await s.load(e);t&&await s.end(t)}catch(e){b(r,`session_store`,e)}}async function y(e){let t=o(e),n=new URL(e.url).searchParams,i=a(n.get(`redirect`),t),s=n.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await O(r,{origin:t,silent:s}),p=l(u);return _(e,p),g(p.headers,h(r.cookieName,d),c({verifier:f,redirectPath:i,silent:s}),t,r.lifetimes.flowMaxAgeMs),p}async function S(e){let i=o(e),c=new URL(e.url).searchParams,_=c.get(`state`),y=_&&z.test(_)?h(r.cookieName,_):null,S=y?n(f(e,y)):null,C=e=>(y&&t(e.headers,y,i),e);if(!S)return C(l(d(i,`invalid_state`,null)));let w=a(S.redirectPath,i),E=c.get(`iss`);if(E!==null&&E!==j(r.issuer))return C(l(d(i,`invalid_issuer`,null)));let O=c.get(`error`);if(O)return S.silent&&B.has(O)?C(l(u(i,w))):C(l(d(i,O,c.get(`error_description`))));let k=c.get(`code`);if(!k)return C(l(d(i,`invalid_request`,null)));let N,P,F;try{let e=await A(r,{code:k,verifier:S.verifier,redirectUri:new URL(r.paths.callback,i).toString()});N=D(e,null,r.now()),P=await T(M(r),N.accessToken),F=await r.onSignIn({user:P,accessToken:N.accessToken,redirectPath:w,previous:null})}catch(e){return b(r,`sign_in`,e),e instanceof x?C(l(d(i,e.code,e.description||null))):C(l(d(i,`accounts_unavailable`,null)))}let I=f(e,r.cookieName);if(F===null){let e=l(d(i,`access_denied`,null));I!==null&&(await v(I),t(e.headers,r.cookieName,i));for(let t of m(r,i))e.headers.append(`set-cookie`,t);return C(e)}let L,R;try{({cookieValue:L,session:R}=await s.start({user:P,tokens:N,data:F}))}catch(e){return b(r,`session_store`,e),C(l(d(i,`session_store_error`,null)))}I!==null&&await v(I);let V=l(new URL(w,i));g(V.headers,r.cookieName,L,i,r.lifetimes.absoluteMaxAgeMs);let H=await p(r,R,i,r.now());return H&&V.headers.append(`set-cookie`,H),C(V)}async function C(e){let t=o(e),n=await s.load(f(e,r.cookieName));n&&await s.end(n);let i=n?.tokens.idToken&&r.logout===`global`?w(r,{origin:t,idToken:n.tokens.idToken}):new URL(r.paths.logoutComplete,t).toString(),a=l(i,303);for(let e of F(r,t))a.headers.append(`set-cookie`,e);return a}return{login:y,callback:S,logout:C}}const H=e=>new Promise(t=>setTimeout(t,e));function U(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}function a(t){let r=e.now();return!i(t.tokens,r)&&r-t.lastValidatedAt>=n.revalidateIntervalMs}async function o(n){if(!n)return null;let i=await E(n),a;try{a=await t.read(i)}catch(n){if(!(n instanceof v))throw n;return b(e,`session_store`,n),await t.delete(i),null}return a?r(a,e.now())?(await t.delete(a.id),null):a:null}async function s(n){let r=k(32),i=e.now(),a={id:await E(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function c(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return l(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await P(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:D(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(_(n))return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return b(e,`refresh`,n),r??o;throw n}}async function l(r,a){for(;;){await H(100);let o=await t.read(r);if(!o)return null;let s=e.now();if(!i(o.tokens,s))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=s)return c(o);if(s-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>s)return o;throw new C(`Timed out waiting for the session refresh lease`,0)}}}async function u(r){let i;try{i=await c(r)}catch(t){b(e,`refresh`,t),i=r}if(!i)return null;if(e.now()-i.lastValidatedAt<n.revalidateIntervalMs||!d(i.tokens))return i;let a=e.revalidateUser?await p(i):i.user;if(!a)return f(i);if(!d(i.tokens))return i;let o=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken,user:a});if(o===null)return f(i);let s={data:o,lastValidatedAt:e.now()};return a!==i.user&&(s.user=a),t.update(i.id,s)}function d(t){return t.accessTokenExpiresAt-e.now()>n.requestTimeoutMs}async function f(n){return n.tokens.accessTokenExpiresAt<=e.now()?n:(await t.delete(n.id),null)}async function p(t){try{return await T(M(e),t.tokens.accessToken)}catch(n){return _(n)?null:(b(e,`revalidate`,n),t.user)}}async function m(e){await t.delete(e.id)}async function h(){if(!t.sweep)return 0;let r=e.now();return t.sweep({createdBefore:r-n.absoluteMaxAgeMs,validatedBefore:r-n.idleMaxAgeMs})}return{load:o,start:s,ensureFreshTokens:c,revalidate:u,revalidationDue:a,end:m,sweep:h}}function W(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)},async sweep(t){let n=0;for(let[r,i]of e)(i.createdAt<t.createdBefore||i.lastValidatedAt<t.validatedBefore)&&(e.delete(r),n+=1);return n}}}function G(e){let t=S(e),n=U(t),r=V(t,n),i=R(t,n),a=I(t,n);function o(e){return{session:f(e,t.cookieName),cache:f(e,u(t.cookieName))}}async function c(e){return await s(t,e.cache,e.session,t.now())??n.load(e.session)}async function l(e){return c(o(e))}async function d(e){let r=await s(t,e.cache,e.session,t.now());if(r&&r.tokens.accessTokenExpiresAt>t.now())return r.tokens.accessToken;let i=await n.load(e.session);return i?(await n.ensureFreshTokens(i))?.tokens.accessToken??null:null}async function p(e){return d(o(e))}async function m(e,r){let i=await n.load(e.session);return i?t.store.update(i.id,{data:r(i.data)}):null}function h(){return n.sweep()}return{cookieName:t.cookieName,handlers:r,guard:i,resolveSession:a,sessionFromCookies:c,sessionFromRequest:l,accessTokenFromCookies:d,accessTokenFromRequest:p,updateSessionData:m,sweepSessions:h}}export{C as AccountsRequestError,y as DEFAULT_LIFETIMES,x as OAuthTokenError,v as SessionDecodeError,N as accountsEndpoint,u as cacheCookieBase,G as createAccountsAuth,W as createMemorySessionStore,T as fetchUserInfo,r as forwardCookies,_ as isAccessDenied,o as requestOrigin,a as sanitizeRedirectPath};
+import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,p as f,r as p,t as m,u as h,v as g}from"./cache-vq-5GFN7.js";import{n as _,t as v}from"./encoding-BhmNmloC.js";import{i as y,n as b,o as x,r as S,t as C}from"./errors-C7IxbL16.js";import{a as w,i as T,o as E,r as D,t as O}from"./fetch-CM1mVzPm.js";import{a as k,i as A,l as j,n as M,r as N,t as P}from"./oidc-qInr-2mE.js";function F(e,t){return[...d(e.cookieName,t),...m(e,t)]}function I(e,t){return async function(n){let r=o(n),i=f(n,e.cookieName),a=f(n,u(e.cookieName)),c=await s(e,a,i,e.now());if(c)return{session:c,cookies:[]};let l={session:null,cookies:i!==null||a!==null?F(e,r):[]},d=await t.load(i);if(!d)return l;let{deferRevalidation:m}=e;if(m&&t.revalidationDue(d)&&L(e,m,t,d)){let t=await p(e,d,r,e.now());return{session:d,cookies:t?[t]:[]}}let h=d;try{let e=await t.revalidate(d);if(!e)return l;h=e}catch(t){x(e,`revalidate`,t)}let g=await p(e,h,r,e.now());return{session:h,cookies:g?[g]:[]}}}function L(e,t,n,r){try{return t(async()=>{try{await n.revalidate(r)}catch(t){x(e,`revalidate`,t)}}),!0}catch(t){return x(e,`revalidate`,t),!1}}function R(e,t){let n=I(e,t);return async function(t,i={}){let a=new URL(t.url);if([e.paths.login,e.paths.callback,e.paths.logout,e.paths.logoutComplete,e.paths.error,...i.publicPaths??[]].some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,a=new URL(e.url),o=(t.apiPaths??[`/api`,`/trpc`]).some(e=>a.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):l(i(e,t,r));for(let e of n)o.headers.append(`set-cookie`,e);return{kind:`response`,response:o}}function i(t,n,r){let i=new URL(t.url),a=new URL(e.paths.login,o(t));return a.searchParams.set(`redirect`,n.redirectPath?.(t)??`${i.pathname}${i.search}`),r&&a.searchParams.set(`silent`,`1`),a}}const z=/^[A-Za-z0-9_-]{1,128}$/,B=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function V(r,s){function u(e,t){let n=new URL(r.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let i=new URL(r.paths.error,e);return i.searchParams.set(`reason`,t),n&&i.searchParams.set(`description`,n),i}function _(t,n){let a=h(r.cookieName,``),o=[...i(t.headers.get(`cookie`)).keys()].filter(e=>e.replace(/^__Secure-/,``).startsWith(a)),s=o.length-4;for(let t of o.slice(0,Math.max(0,s)))n.headers.append(`set-cookie`,e(t,``,t.startsWith(`__Secure-`),0))}async function v(e){try{let t=await s.load(e);t&&await s.end(t)}catch(e){x(r,`session_store`,e)}}async function y(e){let t=o(e),n=new URL(e.url).searchParams,i=a(n.get(`redirect`),t),s=n.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await P(r,{origin:t,silent:s}),p=l(u);return _(e,p),g(p.headers,h(r.cookieName,d),c({verifier:f,redirectPath:i,silent:s}),t,r.lifetimes.flowMaxAgeMs),p}async function S(e){let i=o(e),c=new URL(e.url).searchParams,_=c.get(`state`),y=_&&z.test(_)?h(r.cookieName,_):null,S=y?n(f(e,y)):null,C=e=>(y&&t(e.headers,y,i),e);if(!S)return C(l(d(i,`invalid_state`,null)));let w=a(S.redirectPath,i),E=c.get(`iss`);if(E!==null&&E!==D(r.issuer))return C(l(d(i,`invalid_issuer`,null)));let O=c.get(`error`);if(O)return S.silent&&B.has(O)?C(l(u(i,w))):C(l(d(i,O,c.get(`error_description`))));let k=c.get(`code`);if(!k)return C(l(d(i,`invalid_request`,null)));let M,P,F;try{let e=await N(r,{code:k,verifier:S.verifier,redirectUri:new URL(r.paths.callback,i).toString()});M=j(e,null,r.now()),P=await A(T(r),M.accessToken),F=await r.onSignIn({user:P,accessToken:M.accessToken,redirectPath:w,previous:null})}catch(e){return x(r,`sign_in`,e),e instanceof b?C(l(d(i,e.code,e.description||null))):C(l(d(i,`accounts_unavailable`,null)))}let I=f(e,r.cookieName);if(F===null){let e=l(d(i,`access_denied`,null));I!==null&&(await v(I),t(e.headers,r.cookieName,i));for(let t of m(r,i))e.headers.append(`set-cookie`,t);return C(e)}let L,R;try{({cookieValue:L,session:R}=await s.start({user:P,tokens:M,data:F}))}catch(e){return x(r,`session_store`,e),C(l(d(i,`session_store_error`,null)))}I!==null&&await v(I);let V=l(new URL(w,i));g(V.headers,r.cookieName,L,i,r.lifetimes.absoluteMaxAgeMs);let H=await p(r,R,i,r.now());return H&&V.headers.append(`set-cookie`,H),C(V)}async function C(e){let t=o(e),n=await s.load(f(e,r.cookieName));n&&await s.end(n);let i=n?.tokens.idToken&&r.logout===`global`?M(r,{origin:t,idToken:n.tokens.idToken}):new URL(r.paths.logoutComplete,t).toString(),a=l(i,303);for(let e of F(r,t))a.headers.append(`set-cookie`,e);return a}return{login:y,callback:S,logout:C}}const H=e=>new Promise(t=>setTimeout(t,e));function U(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}function a(t){let r=e.now();return!i(t.tokens,r)&&r-t.lastValidatedAt>=n.revalidateIntervalMs}async function o(n){if(!n)return null;let i=await _(n),a;try{a=await t.read(i)}catch(n){if(!(n instanceof S))throw n;return x(e,`session_store`,n),await t.delete(i),null}return a?r(a,e.now())?(await t.delete(a.id),null):a:null}async function s(n){let r=v(32),i=e.now(),a={id:await _(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function c(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return l(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await k(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:j(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(y(n))return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return x(e,`refresh`,n),r??o;throw n}}async function l(r,a){for(;;){await H(100);let o=await t.read(r);if(!o)return null;let s=e.now();if(!i(o.tokens,s))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=s)return c(o);if(s-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>s)return o;throw new C(`Timed out waiting for the session refresh lease`,0)}}}async function u(r){let i;try{i=await c(r)}catch(t){x(e,`refresh`,t),i=r}if(!i)return null;if(e.now()-i.lastValidatedAt<n.revalidateIntervalMs||!d(i.tokens))return i;let a=e.revalidateUser?await p(i):i.user;if(!a)return f(i);if(!d(i.tokens))return i;let o=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken,user:a});if(o===null)return f(i);let s={data:o,lastValidatedAt:e.now()};return a!==i.user&&(s.user=a),t.update(i.id,s)}function d(t){return t.accessTokenExpiresAt-e.now()>n.requestTimeoutMs}async function f(n){return n.tokens.accessTokenExpiresAt<=e.now()?n:(await t.delete(n.id),null)}async function p(t){try{return await A(T(e),t.tokens.accessToken)}catch(n){return y(n)?null:(x(e,`revalidate`,n),t.user)}}async function m(e){await t.delete(e.id)}async function h(){if(!t.sweep)return 0;let r=e.now();return t.sweep({createdBefore:r-n.absoluteMaxAgeMs,validatedBefore:r-n.idleMaxAgeMs})}return{load:o,start:s,ensureFreshTokens:c,revalidate:u,revalidationDue:a,end:m,sweep:h}}function W(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)},async sweep(t){let n=0;for(let[r,i]of e)(i.createdAt<t.createdBefore||i.lastValidatedAt<t.validatedBefore)&&(e.delete(r),n+=1);return n}}}function G(e){let t=E(e),n=U(t),r=V(t,n),i=R(t,n),a=I(t,n);function o(e){return{session:f(e,t.cookieName),cache:f(e,u(t.cookieName))}}async function c(e){return await s(t,e.cache,e.session,t.now())??n.load(e.session)}async function l(e){return c(o(e))}async function d(e){let r=await s(t,e.cache,e.session,t.now());if(r&&r.tokens.accessTokenExpiresAt>t.now())return r.tokens.accessToken;let i=await n.load(e.session);return i?(await n.ensureFreshTokens(i))?.tokens.accessToken??null:null}async function p(e){return d(o(e))}async function m(e,r){let i=await n.load(e.session);return i?t.store.update(i.id,{data:r(i.data)}):null}function h(){return n.sweep()}return{cookieName:t.cookieName,handlers:r,guard:i,resolveSession:a,sessionFromCookies:c,sessionFromRequest:l,accessTokenFromCookies:d,accessTokenFromRequest:p,updateSessionData:m,sweepSessions:h}}export{C as AccountsRequestError,w as DEFAULT_LIFETIMES,b as OAuthTokenError,S as SessionDecodeError,O as accountsEndpoint,u as cacheCookieBase,G as createAccountsAuth,W as createMemorySessionStore,A as fetchUserInfo,r as forwardCookies,y as isAccessDenied,o as requestOrigin,a as sanitizeRedirectPath};

package/dist/next.d.ts

@@ -1,5 +1,5 @@
-import { c as AccountsSession } from "./types-Cx223pmJ.js";
-import { t as AccountsAuth } from "./index-Bte2SoPM.js";
+import { s as AccountsSession } from "./types-B13HPcs5.js";
+import { t as AccountsAuth } from "./index-CNcSwzgU.js";
 import { NextRequest, NextResponse } from "next/server";
 //#region src/next/index.d.ts
 /**

package/dist/next.js

@@ -1 +1 @@
-import{d as e,n as t,s as n}from"./cache-DNvwg4aa.js";import{cookies as r}from"next/headers";import{NextResponse as i,connection as a}from"next/server";function o(t,n=[]){e(t.headers,n);let r=i.next({request:{headers:t.headers}});for(let e of n)r.headers.append(`set-cookie`,e);return r}async function s(e){await a();let i=await r(),o=e=>i.get(n(e,!0))?.value||i.get(n(e,!1))?.value||null;return{session:o(e),cache:o(t(e))}}async function c(e){let i=await r(),a=t(e);for(let e of[n(a,!0),n(a,!1)])try{i.delete(e)}catch{}}function l(e){let t=e.cookieName;return{async getSession(){return e.sessionFromCookies(await s(t))},async getAccessToken(){return e.accessTokenFromCookies(await s(t))},async updateSessionData(n){let r=await e.updateSessionData(await s(t),n);return r&&await c(t),r}}}export{o as continueRequest,l as withNextRequestScope};
+import{d as e,n as t,s as n}from"./cache-vq-5GFN7.js";import{io as r}from"next/cache.js";import{cookies as i}from"next/headers";import{NextResponse as a}from"next/server";function o(t,n=[]){e(t.headers,n);let r=a.next({request:{headers:t.headers}});for(let e of n)r.headers.append(`set-cookie`,e);return r}async function s(e){await r();let a=await i(),o=e=>a.get(n(e,!0))?.value||a.get(n(e,!1))?.value||null;return{session:o(e),cache:o(t(e))}}async function c(e){let r=await i(),a=t(e);for(let e of[n(a,!0),n(a,!1)])try{r.delete(e)}catch{}}function l(e){let t=e.cookieName;return{async getSession(){return e.sessionFromCookies(await s(t))},async getAccessToken(){return e.accessTokenFromCookies(await s(t))},async updateSessionData(n){let r=await e.updateSessionData(await s(t),n);return r&&await c(t),r}}}export{o as continueRequest,l as withNextRequestScope};

package/dist/oidc-qInr-2mE.js

@@ -0,0 +1 @@
+import{n as e,t}from"./encoding-BhmNmloC.js";import{n,t as r}from"./errors-C7IxbL16.js";import{i,n as a,t as o}from"./fetch-CM1mVzPm.js";async function s(n,r){let i=t(24),a=t(32),s=new URL(o(n.issuer,`/api/auth/oauth2/authorize`));return s.searchParams.set(`client_id`,n.clientId),s.searchParams.set(`redirect_uri`,new URL(n.paths.callback,r.origin).toString()),s.searchParams.set(`response_type`,`code`),s.searchParams.set(`scope`,n.scope),s.searchParams.set(`state`,i),s.searchParams.set(`code_challenge`,await e(a)),s.searchParams.set(`code_challenge_method`,`S256`),r.silent&&s.searchParams.set(`prompt`,`none`),{url:s.toString(),state:i,verifier:a}}function c(e,t){let n=new URL(o(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}function l(e){return{...i(e),clientId:e.clientId,clientSecret:e.clientSecret,audience:e.audience}}async function u(e){let t=await e.text().catch(()=>``),r=`unknown_error`,i=t;try{let e=JSON.parse(t);r=e.error??r,i=e.error_description??i}catch{}return new n(e.status,r,i)}function d(e){return e.code===`invalid_target`||e.code===`invalid_request`&&/resource/i.test(e.description)}async function f(e,t,n,r=!0){let i=new URLSearchParams({client_id:e.clientId,...t});e.clientSecret&&i.set(`client_secret`,e.clientSecret),e.audience&&r&&i.set(`resource`,e.audience);let o=await a(e,`/api/auth/oauth2/token`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i},n);if(!o.ok){let i=await u(o);if(r&&e.audience&&d(i))return f(e,t,n,!1);throw i}return await o.json()}function p(e,t){return f(l(e),{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function m(e,t,n){return f(l(e),{grant_type:`refresh_token`,refresh_token:t},n===void 0?void 0:Date.now()+n)}async function h(e,t){let n=await a(e,`/api/auth/oauth2/userinfo`,{headers:{Authorization:`Bearer ${t}`}});if(!n.ok)throw new r(`Failed to load user info: ${n.status}`,n.status);let i=await n.json();return{id:i.sub,email:i.email??``,name:i.name??i.email??i.sub,image:i.picture??null}}function g(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}export{m as a,u as c,h as i,g as l,c as n,d as o,p as r,f as s,s as t};

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { u as AccountsSessionStore } from "./types-Cx223pmJ.js";
+import { l as AccountsSessionStore } from "./types-B13HPcs5.js";
 //#region src/testing/index.d.ts
 /**
  * A behavioural conformance suite for the session store contract.

package/dist/{types-Cx223pmJ.d.ts → types-B13HPcs5.d.ts}

@@ -161,33 +161,5 @@ type AccountsCacheConfig = {
   secret: string;
   maxAgeMs?: number;
 };
-declare const DEFAULT_LIFETIMES: AccountsLifetimes;
-declare class AccountsRequestError extends Error {
-  readonly status: number;
-  constructor(message: string, status: number);
-}
-/**
- * A stored session that cannot be turned back into one: a token the codec
- * cannot decrypt because another key wrote it, a column that does not hold
- * what it should. The session manager reads it as the session being over,
- * removes the row and sends the user back to sign in, so a store that decodes
- * what it stored raises this rather than the failure underneath; every other
- * store failure is a fault and propagates.
- */
-declare class SessionDecodeError extends Error {
-  constructor(cause: unknown);
-}
-declare class OAuthTokenError extends AccountsRequestError {
-  readonly code: string;
-  readonly description: string;
-  constructor(status: number, code: string, description: string);
-}
-/**
- * Whether accounts rejected the token, the client, or the user, which ends
- * the session, as opposed to failing to answer, which keeps it. Any 4xx but a
- * timeout or a rate limit counts: the provider answers a revoked token or a
- * disabled client with 400 as readily as with 401.
- */
-declare function isAccessDenied(error: unknown): boolean;
 //#endregion
-export { SessionSweepCutoffs as _, AccountsLifetimes as a, AccountsSession as c, AccountsTokens as d, AccountsUser as f, SessionDecodeError as g, RevalidateInput as h, AccountsErrorPhase as i, AccountsSessionPatch as l, OAuthTokenError as m, AccountsCacheConfig as n, AccountsPaths as o, DEFAULT_LIFETIMES as p, AccountsErrorEvent as r, AccountsRequestError as s, AccountsAuthConfig as t, AccountsSessionStore as u, SignInInput as v, isAccessDenied as y };
+export { AccountsLifetimes as a, AccountsSessionPatch as c, AccountsUser as d, RevalidateInput as f, AccountsErrorPhase as i, AccountsSessionStore as l, SignInInput as m, AccountsCacheConfig as n, AccountsPaths as o, SessionSweepCutoffs as p, AccountsErrorEvent as r, AccountsSession as s, AccountsAuthConfig as t, AccountsTokens as u };

package/dist/verify.d.ts

@@ -0,0 +1,51 @@
+import { t as AccountsRequestError } from "./errors-DpQsDn4O.js";
+//#region src/verify/index.d.ts
+type AccountsTokenClaims = {
+  iss: string;
+  sub: string;
+  aud: string | string[];
+  exp: number;
+  iat?: number;
+  nbf?: number;
+  scope?: string;
+  client_id?: string;
+  email?: string;
+  name?: string;
+  picture?: string;
+  sid?: string;
+} & Record<string, unknown>;
+type TokenVerifierConfig = {
+  issuer: string;
+  /** The audience the token must name: the resource for an access token, the client id for an id token. */
+  audience: string | string[];
+  /** How long a fetched key set is served before it is read again; ten minutes by default. */
+  keysMaxAgeMs?: number;
+  /** How soon after a read for an unknown key id the next such read may happen; thirty seconds by default. */
+  keysRetryMs?: number;
+  /** Tolerance on `exp` and `nbf`; thirty seconds by default. */
+  clockSkewMs?: number;
+  requestTimeoutMs?: number;
+  fetch?: typeof fetch;
+  now?: () => number;
+};
+/**
+ * Verifies a JWT accounts issued, for a server that receives one as a bearer
+ * token: the EdDSA signature against the accounts key set, then `iss`, `aud`,
+ * `exp`, `nbf` and `sub`. A token that fails any of them answers null; only a
+ * key set that cannot be read at all, with nothing cached to fall back on,
+ * throws, because that is the verifier's outage rather than the caller's bad
+ * token. Keys are cached and re-read once when a token names a key id the
+ * cache does not hold, which is how a rotation shows up.
+ */
+declare function createTokenVerifier(config: TokenVerifierConfig): {
+  /**
+   * The claims of a token accounts issued, or null. `scopes` names the
+   * scopes the endpoint needs; a token missing any of them is null as well.
+   */
+  verify(token: string, options?: {
+    scopes?: string[];
+  }): Promise<AccountsTokenClaims | null>;
+};
+type TokenVerifier = ReturnType<typeof createTokenVerifier>;
+//#endregion
+export { AccountsRequestError, AccountsTokenClaims, TokenVerifier, TokenVerifierConfig, createTokenVerifier };

package/dist/verify.js

@@ -0,0 +1 @@
+import{t as e}from"./errors-C7IxbL16.js";import{n as t,r as n}from"./fetch-CM1mVzPm.js";function r(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=atob(t+`=`.repeat((4-t.length%4)%4)),r=new Uint8Array(n.length);for(let e=0;e<n.length;e++)r[e]=n.charCodeAt(e);return r}function i(e){try{let t=JSON.parse(new TextDecoder().decode(r(e)));return typeof t==`object`&&t&&!Array.isArray(t)?t:null}catch{return null}}async function a(e){let t=typeof e==`object`&&e&&Array.isArray(e.keys)?e.keys:null;if(t===null)throw Error(`The key set has no keys array`);let n=new Map;for(let[e,r]of t.entries())if(!(typeof r!=`object`||!r||r.kty!==`OKP`||r.crv!==`Ed25519`||typeof r.x!=`string`))try{let t=await crypto.subtle.importKey(`jwk`,{kty:r.kty,crv:r.crv,x:r.x},{name:`Ed25519`},!1,[`verify`]);n.set(typeof r.kid==`string`?r.kid:`#${e}`,t)}catch{}return n}function o(o){let s=o.now??Date.now,c=n(o.issuer),l=new Set(Array.isArray(o.audience)?o.audience:[o.audience]),u=o.keysMaxAgeMs??6e5,d=o.keysRetryMs??3e4,f=o.clockSkewMs??3e4,p={issuer:o.issuer,fetch:o.fetch,timeoutMs:o.requestTimeoutMs},m=null,h=null;function g(){return h??=(async()=>{try{let n=await t(p,`/api/auth/jwks`);if(!n.ok)throw new e(`Failed to load the accounts key set: ${n.status}`,n.status);let r;try{r=await a(await n.json())}catch(t){throw new e(`Failed to read the accounts key set: ${t instanceof Error?t.message:String(t)}`,n.status)}return m={keys:r,loadedAt:s()},m}finally{h=null}})(),h}async function _(){try{return await g()}catch(e){if(m)return m;throw e}}let v=-1/0;async function y(e){let t=m&&s()-m.loadedAt<u?m:await _();if(e!==null&&!t.keys.has(e)&&s()-v>=d&&(v=s(),t=await _()),e===null)return[...t.keys.values()];let n=t.keys.get(e);return n?[n]:[]}return{async verify(e,t={}){let n=e.split(`.`);if(n.length!==3)return null;let a=i(n[0]),o=i(n[1]);if(!a||!o||a.alg!==`EdDSA`)return null;let u;try{u=r(n[2])}catch{return null}let d=new TextEncoder().encode(`${n[0]}.${n[1]}`),p=!1;for(let e of await y(typeof a.kid==`string`?a.kid:null))if(await crypto.subtle.verify(`Ed25519`,e,u,d)){p=!0;break}if(!p||o.iss!==c||!(Array.isArray(o.aud)?o.aud:typeof o.aud==`string`?[o.aud]:[]).some(e=>typeof e==`string`&&l.has(e)))return null;let m=s()/1e3,h=f/1e3;if(typeof o.exp!=`number`||o.exp+h<=m||typeof o.nbf==`number`&&o.nbf-h>m||typeof o.sub!=`string`||o.sub===``)return null;if(t.scopes?.length){let e=new Set(typeof o.scope==`string`?o.scope.split(` `):[]);if(!t.scopes.every(t=>e.has(t)))return null}return o}}}export{e as AccountsRequestError,o as createTokenVerifier};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aui-auth",
-  "version": "0.0.7",
-  "description": "Server side sessions for web apps that sign in through assistant-ui accounts: OIDC code flow with PKCE, tokens kept in the app's database, single flight refresh",
+  "version": "0.0.9",
+  "description": "Sign in through assistant-ui accounts: server side sessions for web apps (OIDC code flow with PKCE, tokens kept in the app's store, single flight refresh), the device grant for CLIs, and token verification for resource servers",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -21,6 +21,14 @@
       "types": "./dist/next.d.ts",
       "default": "./dist/next.js"
     },
+    "./device": {
+      "types": "./dist/device.d.ts",
+      "default": "./dist/device.js"
+    },
+    "./verify": {
+      "types": "./dist/verify.d.ts",
+      "default": "./dist/verify.js"
+    },
     "./database": {
       "types": "./dist/database/index.d.ts",
       "default": "./dist/database/index.js"
@@ -39,7 +47,7 @@
     }
   },
   "peerDependencies": {
-    "next": ">=15"
+    "next": ">=16.3"
   },
   "peerDependenciesMeta": {
     "next": {

package/dist/cache-DNvwg4aa.js

@@ -1 +0,0 @@
-import{o as e}from"./types-B_7rFOLg.js";import{d as t}from"./oidc-CDcBo0qB.js";function n(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function r(e){let t=new URL(e.url);return`${n(e.headers.get(`x-forwarded-proto`))||t.protocol.replace(`:`,``)}://${n(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||t.host}`}function i(e){return new URL(e).protocol===`https:`}function a(e,t){return t?`__Secure-${e}`:e}function o(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function s(e,t){let n=o(e.headers.get(`cookie`));return n.get(a(t,!0))||n.get(a(t,!1))||null}function c(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function l(e,t,n,r,o){let s=i(r);e.append(`set-cookie`,c(a(t,s),n,s,Math.floor(o/1e3)))}function u(e,t){if(t.length===0)return;let n=o(e.get(`cookie`));for(let e of t){let t=e.split(`;`)[0],r=t.indexOf(`=`);if(r<1)continue;let i=t.slice(0,r).trim(),a=t.slice(r+1).trim();a?n.set(i,a):n.delete(i)}e.set(`cookie`,[...n].map(([e,t])=>`${e}=${t}`).join(`; `))}function d(e,t){let n=i(t);return[n,!n].map(t=>c(a(e,t),``,t,0))}function f(e,t,n){for(let r of d(t,n))e.append(`set-cookie`,r)}function p(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function m(e,t){return`${e}_flow_${t}`}function h(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function g(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function _(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin!==t||n.pathname.startsWith(`//`)?`/`:`${n.pathname}${n.search}${n.hash}`}const v=4096;function y(e){return`${e}_cache`}function b(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e,i=Math.min(t.lastValidatedAt+r.revalidateIntervalMs,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs);return Math.min(e.cache.maxAgeMs,(i>n?i:n+r.retryIntervalMs)-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function x(e,t,n){if(!e.cache)return null;let r=b(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function S(e,n,r,i){if(!e.cache||!n||!r)return null;let a;try{let t=await e.cache.codec();a=JSON.parse(await t.decrypt(n))}catch{return null}return a.v!==1||typeof a.exp!=`number`||a.exp<=i||a.id!==await t(r)?null:{id:a.id,user:a.u,tokens:{accessToken:a.at,refreshToken:null,idToken:null,accessTokenExpiresAt:a.ate},data:a.d,createdAt:a.ca,lastValidatedAt:a.lv,refreshLeaseUntil:null}}async function C(t,n,r,o){try{let e=await x(t,n,o);if(!e)return null;let s=i(r),l=c(a(y(t.cookieName),s),e.value,s,Math.floor(e.maxAgeMs/1e3));if(l.length>v)throw Error(`Cache cookie is ${l.length} bytes and browsers drop cookies over ${v}; the session data is too large to cache`);return l}catch(n){return e(t,`cache_cookie`,n),null}}function w(e,t){return e.cache?d(y(e.cookieName),t):[]}export{c as _,f as a,g as c,u as d,o as f,_ as g,r as h,S as i,h as l,p as m,y as n,d as o,s as p,C as r,a as s,w as t,m as u,l as v};

package/dist/oidc-CDcBo0qB.js

@@ -1 +0,0 @@
-import{n as e,r as t,t as n}from"./types-B_7rFOLg.js";function r(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function i(e){return r(crypto.getRandomValues(new Uint8Array(e)))}async function a(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return r(new Uint8Array(t))}function o(e,t){return new URL(t,e).toString()}function s(e){return o(e,`/api/auth`)}function c(e){return{issuer:e.issuer,fetch:e.fetch,timeoutMs:e.lifetimes.requestTimeoutMs}}async function l(t,r,i={},a){let s=t.fetch??globalThis.fetch.bind(globalThis),c=t.timeoutMs??e.requestTimeoutMs,l=a===void 0?c:Math.min(c,a-Date.now());if(l<=0)throw new n(`Accounts request deadline passed`,0);return s(o(t.issuer,r),{...i,cache:`no-store`,signal:AbortSignal.timeout(l)})}async function u(e,t){let n=i(24),r=i(32),s=new URL(o(e.issuer,`/api/auth/oauth2/authorize`));return s.searchParams.set(`client_id`,e.clientId),s.searchParams.set(`redirect_uri`,new URL(e.paths.callback,t.origin).toString()),s.searchParams.set(`response_type`,`code`),s.searchParams.set(`scope`,e.scope),s.searchParams.set(`state`,n),s.searchParams.set(`code_challenge`,await a(r)),s.searchParams.set(`code_challenge_method`,`S256`),t.silent&&s.searchParams.set(`prompt`,`none`),{url:s.toString(),state:n,verifier:r}}function d(e,t){let n=new URL(o(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}async function f(e,n,r,i=!0){let a=new URLSearchParams({client_id:e.clientId,...n});e.clientSecret&&a.set(`client_secret`,e.clientSecret),e.audience&&i&&a.set(`resource`,e.audience);let o=await l(c(e),`/api/auth/oauth2/token`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:a},r);if(!o.ok){let a=await o.text().catch(()=>``),s=`unknown_error`,c=a;try{let e=JSON.parse(a);s=e.error??s,c=e.error_description??c}catch{}if(i&&e.audience&&(s===`invalid_target`||s===`invalid_request`&&/resource/i.test(c)))return f(e,n,r,!1);throw new t(o.status,s,c)}return await o.json()}function p(e,t){return f(e,{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function m(e,t,n){return f(e,{grant_type:`refresh_token`,refresh_token:t},n===void 0?void 0:Date.now()+n)}async function h(e,t){let r=await l(e,`/api/auth/oauth2/userinfo`,{headers:{Authorization:`Bearer ${t}`}});if(!r.ok)throw new n(`Failed to load user info: ${r.status}`,r.status);let i=await r.json();return{id:i.sub,email:i.email??``,name:i.name??i.email??i.sub,image:i.picture??null}}function g(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}export{d as a,h as c,a as d,g as f,u as i,i as l,l as n,p as o,s as r,c as s,o as t,m as u};

package/dist/oidc-CbVNB1IR.d.ts

@@ -1,11 +0,0 @@
-import { f as AccountsUser } from "./types-Cx223pmJ.js";
-//#region src/core/oidc.d.ts
-type AccountsFetchOptions = {
-  issuer: string;
-  fetch?: typeof fetch;
-  timeoutMs?: number;
-};
-declare function accountsEndpoint(issuer: string, path: string): string;
-declare function fetchUserInfo(options: AccountsFetchOptions, accessToken: string): Promise<AccountsUser>;
-//#endregion
-export { accountsEndpoint as n, fetchUserInfo as r, AccountsFetchOptions as t };

package/dist/types-B_7rFOLg.js

@@ -1 +0,0 @@
-function e(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function t(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function n(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4),r;try{r=atob(n)}catch{throw Error(`Malformed encrypted value`)}let i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function r(e){let r=null,i=()=>r??=crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`]);return{async encrypt(e){let n=crypto.getRandomValues(new Uint8Array(12)),r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},await i(),new TextEncoder().encode(e))),a=new Uint8Array(12+r.length);return a.set(n),a.set(r,12),t(a)},async decrypt(e){let t=n(e);if(t.length<28)throw Error(`Malformed encrypted value`);let r;try{r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:t.subarray(0,12)},await i(),t.subarray(12))}catch{throw Error(`Malformed encrypted value`)}return new TextDecoder().decode(r)}}}function i(t){if(!/^[0-9a-fA-F]{64}$/.test(t))throw Error(`AES-GCM codec key must be 64 hex characters (32 bytes)`);return r(e(t))}function a(e){let t=null;return()=>t??=crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e)).then(e=>r(new Uint8Array(e)))}const o={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},s={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3,requestTimeoutMs:1e4,retryIntervalMs:1e4},c=Object.freeze({});function l({phase:e,error:t}){console.error(`[aui-auth] ${e}`,t)}function u(e,t,n){try{e.onError({phase:t,error:n})}catch{}}function d(e){return{...e,scope:e.scope??`openid profile email offline_access`,onSignIn:e.onSignIn??(async()=>c),onRevalidate:e.onRevalidate??(async()=>c),onError:e.onError??l,revalidateUser:e.revalidateUser??!1,logout:e.logout??`global`,paths:{...o,...e.paths},lifetimes:{...s,...e.lifetimes},fetch:e.fetch??globalThis.fetch.bind(globalThis),now:e.now??Date.now,cache:e.cache?{codec:a(e.cache.secret),maxAgeMs:e.cache.maxAgeMs??6e4}:null,audience:e.audience===!1?null:e.audience??new URL(`/api/auth`,e.issuer).toString()}}var f=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},p=class extends Error{constructor(e){super(`Stored session could not be decoded`,{cause:e}),this.name=`SessionDecodeError`}},m=class extends f{code;description;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t,this.description=n}};const h=new Set([408,425,429]);function g(e){return e instanceof f&&e.status>=400&&e.status<500&&!h.has(e.status)}export{g as a,i as c,p as i,s as n,u as o,m as r,d as s,f as t};