aui-auth 0.0.8 → 0.0.10

package/dist/accounts.d.ts

@@ -1,6 +1,6 @@
-import { h as RevalidateInput, v as SignInInput } from "./types-Cx223pmJ.js";
-import { t as AccountsFetchOptions } from "./oidc-CbVNB1IR.js";
-//#region src/accounts/index.d.ts
+import { f as RevalidateInput, m as SignInInput } from "./types-B13HPcs5.js";
+import { t as AccountsFetchOptions } from "./fetch-C0ojJu8c.js";
+//#region src/accounts/organizations.d.ts
 type AccountsOrganization = {
   id: string;
   name: string;
@@ -22,5 +22,59 @@ declare function organizationHooks(options: OrganizationHooksOptions): {
   onSignIn: (input: SignInInput<OrganizationSessionData>) => Promise<OrganizationSessionData>;
   onRevalidate: (input: RevalidateInput<OrganizationSessionData>) => Promise<OrganizationSessionData | null>;
 };
+/** Owners and admins manage an organization; every other role only takes part in it. */
+declare function isOrganizationAdmin(role: string | null | undefined): boolean;
+/**
+ * The organization a route's segment names: the active one when no segment is
+ * given or the segment is its slug or id, one of the viewer's other
+ * organizations otherwise, and none when the viewer is not in it. A segment
+ * can be a slug or an id and nothing about its shape says which, so it is
+ * matched against both. The list is only read when the active one does not
+ * match, and the organization it returns carries the viewer's role there.
+ */
+declare function resolveRouteOrganization<Organization extends Pick<AccountsOrganization, "id" | "slug">>(segment: string | undefined, active: Organization | null, organizations: () => Promise<readonly Organization[]>): Promise<Organization | null>;
 //#endregion
-export { AccountsOrganization, OrganizationHooksOptions, OrganizationSessionData, fetchOrganizations, organizationHooks, preferredOrganizationSlug, selectOrganization };
+//#region src/accounts/projects.d.ts
+type OrganizationReference = {
+  id: string;
+} | {
+  slug: string;
+};
+type AccountsProject = {
+  id: string;
+  organizationId: string;
+  slug: string;
+  name: string;
+  color: string;
+  icon: string | null;
+  plan: string;
+  createdBy: string;
+  updatedBy: string;
+  createdAt: Date;
+  updatedAt: Date;
+  /** The caller's role in the project's organization; null from an accounts that predates the field. */
+  viewerRole: string | null;
+};
+type AccountsProjectPatch = {
+  name?: string;
+  slug?: string;
+  color?: string;
+  icon?: string | null;
+  plan?: string;
+};
+type DuplicateProjectSlug = {
+  reason: "duplicate";
+};
+/** The projects of an organization, or none when it does not exist or the caller is not in it. */
+declare function fetchProjects(options: AccountsFetchOptions, accessToken: string, organization: OrganizationReference): Promise<AccountsProject[]>;
+/** One project by slug, or null when there is nothing there for this caller. */
+declare function fetchProject(options: AccountsFetchOptions, accessToken: string, organization: OrganizationReference, slug: string): Promise<AccountsProject | null>;
+/** A refusal (403) and a missing organization (404) throw; a taken slug is an answer. */
+declare function createProject(options: AccountsFetchOptions, accessToken: string, organization: OrganizationReference, input: {
+  name: string;
+  slug: string;
+}): Promise<AccountsProject | DuplicateProjectSlug>;
+/** Null when the project is gone; a refusal (403) throws; a taken slug is an answer. */
+declare function updateProject(options: AccountsFetchOptions, accessToken: string, organization: OrganizationReference, slug: string, patch: AccountsProjectPatch): Promise<AccountsProject | DuplicateProjectSlug | null>;
+//#endregion
+export { type AccountsOrganization, type AccountsProject, type AccountsProjectPatch, type DuplicateProjectSlug, type OrganizationHooksOptions, type OrganizationReference, type OrganizationSessionData, createProject, fetchOrganizations, fetchProject, fetchProjects, isOrganizationAdmin, organizationHooks, preferredOrganizationSlug, resolveRouteOrganization, selectOrganization, updateProject };

package/dist/accounts.js

@@ -1 +1 @@
-import{a as e,t}from"./types-B_7rFOLg.js";import{n}from"./oidc-0pw9wXd4.js";async function r(e,r){let i=await n(e,`/api/oidc/organizations`,{headers:{Authorization:`Bearer ${r}`}});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function i(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function a(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function o(t){let n=t.preferredSlug??a;async function o(e){return{activeOrganization:i(await r(t,e.accessToken),n(e.redirectPath))}}async function s(n){let a;try{a=await r(t,n.accessToken)}catch(t){if(e(t))return null;throw t}let o=n.session.data.activeOrganization;if(!o)return{activeOrganization:i(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}export{r as fetchOrganizations,o as organizationHooks,a as preferredOrganizationSlug,i as selectOrganization};
+import{i as e,t}from"./errors-C7IxbL16.js";import{n}from"./fetch-CM1mVzPm.js";async function r(e,r){let i=await n(e,`/api/oidc/organizations`,{headers:{Authorization:`Bearer ${r}`}});if(!i.ok)throw new t(`Failed to load organizations: ${i.status}`,i.status);return await i.json()}function i(e,t){if(t){let n=e.find(e=>e.slug===t);if(n)return n}return e[0]??null}function a(e){let[,t]=new URL(e,`http://localhost`).pathname.split(`/`);return t&&t!==`org`?t:null}function o(t){let n=t.preferredSlug??a;async function o(e){return{activeOrganization:i(await r(t,e.accessToken),n(e.redirectPath))}}async function s(n){let a;try{a=await r(t,n.accessToken)}catch(t){if(e(t))return null;throw t}let o=n.session.data.activeOrganization;if(!o)return{activeOrganization:i(a)};let s=a.find(e=>e.id===o.id)??null;return s?{activeOrganization:s}:null}return{onSignIn:o,onRevalidate:s}}function s(e){return e===`owner`||e===`admin`}async function c(e,t,n){let r=t=>t.slug===e||t.id===e;return e===void 0||t&&r(t)?t:(await n()).find(r)??null}function l(e){return`id`in e?`org_id=${encodeURIComponent(e.id)}`:`org_slug=${encodeURIComponent(e.slug)}`}function u(e){let n=e,r=e=>{let r=n?.[e];if(typeof r!=`string`)throw new t(`Accounts project has no ${e}`,502);return r},i=e=>{let n=new Date(r(e));if(Number.isNaN(n.getTime()))throw new t(`Accounts project has no ${e}`,502);return n};return{id:r(`id`),organizationId:r(`organizationId`),slug:r(`slug`),name:r(`name`),color:r(`color`),icon:typeof n?.icon==`string`?n.icon:null,plan:r(`plan`),createdBy:r(`createdBy`),updatedBy:r(`updatedBy`),createdAt:i(`createdAt`),updatedAt:i(`updatedAt`),viewerRole:typeof n?.viewerRole==`string`?n.viewerRole:null}}async function d(e,r,i,a={},o=[]){let s=await n(e,i,{method:a.method,headers:{Authorization:`Bearer ${r}`,...a.body===void 0?void 0:{"Content-Type":`application/json`}},body:a.body===void 0?void 0:JSON.stringify(a.body)});if(s.ok||o.includes(s.status))return s;throw new t(`Accounts request ${i} failed: ${s.status}`,s.status)}async function f(e,t,n){let r=await d(e,t,`/api/projects?${l(n)}`,{},[403,404]);return r.ok?(await r.json()).map(u):[]}async function p(e,t,n,r){let i=await d(e,t,`/api/projects/${encodeURIComponent(r)}?${l(n)}`,{},[403,404]);return i.ok?u(await i.json()):null}async function m(e,t,n,r){let i=await d(e,t,`/api/projects`,{method:`POST`,body:{...`id`in n?{org_id:n.id}:{org_slug:n.slug},name:r.name,slug:r.slug}},[409]);return i.status===409?{reason:`duplicate`}:u(await i.json())}async function h(e,t,n,r,i){let a=await d(e,t,`/api/projects/${encodeURIComponent(r)}?${l(n)}`,{method:`PATCH`,body:i},[404,409]);return a.status===409?{reason:`duplicate`}:a.status===404?null:u(await a.json())}export{m as createProject,r as fetchOrganizations,p as fetchProject,f as fetchProjects,s as isOrganizationAdmin,o as organizationHooks,a as preferredOrganizationSlug,c as resolveRouteOrganization,i as selectOrganization,h as updateProject};

package/dist/cache-iIzAusyV.js

@@ -0,0 +1 @@
+import{n as e}from"./encoding-BhmNmloC.js";import{o as t}from"./errors-C7IxbL16.js";function n(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function r(e){let t=new URL(e.url);return`${n(e.headers.get(`x-forwarded-proto`))||t.protocol.replace(`:`,``)}://${n(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||t.host}`}function i(e){return new URL(e).protocol===`https:`}function a(e,t){return t?`__Secure-${e}`:e}function o(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function s(e,t){let n=o(e.headers.get(`cookie`));return n.get(a(t,!0))||n.get(a(t,!1))||null}function c(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function l(e){let[t,...n]=e.split(`;`).map(e=>e.trim()),r=t.indexOf(`=`);if(r<1)return null;let i=new Map(n.map(e=>{let[t,n=``]=e.split(`=`);return[t.toLowerCase(),n]}));return{name:t.slice(0,r),value:t.slice(r+1),options:{path:i.get(`path`)||`/`,httpOnly:i.has(`httponly`),sameSite:`lax`,secure:i.has(`secure`),maxAge:Number(i.get(`max-age`)??0)}}}function u(e,t,n,r,o){let s=i(r);e.append(`set-cookie`,c(a(t,s),n,s,Math.floor(o/1e3)))}function d(e,t){if(t.length===0)return;let n=o(e.get(`cookie`));for(let e of t){let t=l(e);t&&(t.value?n.set(t.name,t.value):n.delete(t.name))}e.set(`cookie`,[...n].map(([e,t])=>`${e}=${t}`).join(`; `))}function f(e,t){let n=t===void 0||i(t);return[n,!n].map(t=>c(a(e,t),``,t,0))}function p(e,t,n){for(let r of f(t,n))e.append(`set-cookie`,r)}function m(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function h(e,t){return`${e}_flow_${t}`}function g(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function _(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function v(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin!==t||n.pathname.startsWith(`//`)?`/`:`${n.pathname}${n.search}${n.hash}`}const y=4096;function b(e){return`${e}_cache`}function x(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e,i=Math.min(t.lastValidatedAt+r.revalidateIntervalMs,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs);return Math.min(e.cache.maxAgeMs,(i>n?i:n+r.retryIntervalMs)-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function S(e,t,n){if(!e.cache)return null;let r=x(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function C(t,n,r,i){if(!t.cache||!n||!r)return null;let a;try{let e=await t.cache.codec();a=JSON.parse(await e.decrypt(n))}catch{return null}return a.v!==1||typeof a.exp!=`number`||a.exp<=i||a.id!==await e(r)?null:{id:a.id,user:a.u,tokens:{accessToken:a.at,refreshToken:null,idToken:null,accessTokenExpiresAt:a.ate},data:a.d,createdAt:a.ca,lastValidatedAt:a.lv,refreshLeaseUntil:null}}async function w(e,n,r,o){try{let t=await S(e,n,o);if(!t)return null;let s=i(r),l=c(a(b(e.cookieName),s),t.value,s,Math.floor(t.maxAgeMs/1e3));if(l.length>y)throw Error(`Cache cookie is ${l.length} bytes and browsers drop cookies over ${y}; the session data is too large to cache`);return l}catch(n){return t(e,`cache_cookie`,n),null}}function T(e,t){return e.cache?f(b(e.cookieName),t):[]}export{v as _,p as a,_ as c,d,o as f,r as g,m as h,C as i,g as l,s as m,b as n,f as o,l as p,w as r,a as s,T as t,h as u,c as v,u as y};

package/dist/codec-IJ2JySkR.js

@@ -0,0 +1 @@
+function e(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function t(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function n(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4),r;try{r=atob(n)}catch{throw Error(`Malformed encrypted value`)}let i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function r(e){let r=null,i=()=>r??=crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`]);return{async encrypt(e){let n=crypto.getRandomValues(new Uint8Array(12)),r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},await i(),new TextEncoder().encode(e))),a=new Uint8Array(12+r.length);return a.set(n),a.set(r,12),t(a)},async decrypt(e){let t=n(e);if(t.length<28)throw Error(`Malformed encrypted value`);let r;try{r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:t.subarray(0,12)},await i(),t.subarray(12))}catch{throw Error(`Malformed encrypted value`)}return new TextDecoder().decode(r)}}}function i(t){if(!/^[0-9a-fA-F]{64}$/.test(t))throw Error(`AES-GCM codec key must be 64 hex characters (32 bytes)`);return r(e(t))}function a(e){let t=null;return()=>t??=crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e)).then(e=>r(new Uint8Array(e)))}export{a as n,i as t};

package/dist/database/index.d.ts

@@ -1,3 +1,4 @@
 import { n as createAesGcmCodec, t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { _ as SessionSweepCutoffs, c as AccountsSession, d as AccountsTokens, f as AccountsUser, g as SessionDecodeError, l as AccountsSessionPatch, u as AccountsSessionStore } from "../types-Cx223pmJ.js";
+import { c as AccountsSessionPatch, d as AccountsUser, l as AccountsSessionStore, p as SessionSweepCutoffs, s as AccountsSession, u as AccountsTokens } from "../types-B13HPcs5.js";
+import { r as SessionDecodeError } from "../errors-DpQsDn4O.js";
 export { type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, type SessionCodec, SessionDecodeError, type SessionSweepCutoffs, createAesGcmCodec };

package/dist/database/index.js

@@ -1 +1 @@
-import{c as e,i as t}from"../types-B_7rFOLg.js";export{t as SessionDecodeError,e as createAesGcmCodec};
+import{r as e}from"../errors-C7IxbL16.js";import{t}from"../codec-IJ2JySkR.js";export{e as SessionDecodeError,t as createAesGcmCodec};

package/dist/database/pg.d.ts

@@ -1,5 +1,5 @@
 import { t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { u as AccountsSessionStore } from "../types-Cx223pmJ.js";
+import { l as AccountsSessionStore } from "../types-B13HPcs5.js";
 //#region src/database/pg.d.ts
 type PgQuery = (text: string, values?: unknown[]) => Promise<{
   rows: Record<string, unknown>[];

package/dist/database/pg.js

@@ -1,4 +1,4 @@
-import{i as e}from"../types-B_7rFOLg.js";const t=`CREATE TABLE "accounts_sessions" (
+import{r as e}from"../errors-C7IxbL16.js";const t=`CREATE TABLE "accounts_sessions" (
   "id" text PRIMARY KEY,
   "user_id" text NOT NULL,
   "user" jsonb NOT NULL,

package/dist/database/redis.d.ts

@@ -1,5 +1,5 @@
 import { t as SessionCodec } from "../codec-BPnk_EfF.js";
-import { u as AccountsSessionStore } from "../types-Cx223pmJ.js";
+import { l as AccountsSessionStore } from "../types-B13HPcs5.js";
 //#region src/database/redis.d.ts
 /**
  * The slice of a Redis client this store uses, so the package takes no Redis

package/dist/database/redis.js

@@ -1,4 +1,4 @@
-import{i as e}from"../types-B_7rFOLg.js";const t=`refreshLeaseUntil`,n=`
+import{r as e}from"../errors-C7IxbL16.js";const t=`refreshLeaseUntil`,n=`
 local key, checkLease, expectedLease, ttl = KEYS[1], ARGV[1], ARGV[2], ARGV[3]
 if redis.call('EXISTS', key) == 0 then return 0 end
 if checkLease == '1' then

package/dist/device.d.ts

@@ -1,4 +1,5 @@
-import { d as AccountsTokens, f as AccountsUser, m as OAuthTokenError, s as AccountsRequestError, y as isAccessDenied } from "./types-Cx223pmJ.js";
+import { d as AccountsUser, u as AccountsTokens } from "./types-B13HPcs5.js";
+import { i as isAccessDenied, n as OAuthTokenError, t as AccountsRequestError } from "./errors-DpQsDn4O.js";
 //#region src/device/index.d.ts
 declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 type DeviceLoginConfig = {

package/dist/device.js

@@ -1 +1 @@
-import{a as e,n as t,r as n,t as r}from"./types-B_7rFOLg.js";import{c as i,d as a,f as o,h as s,m as c,n as l,r as u}from"./oidc-0pw9wXd4.js";const d=`urn:ietf:params:oauth:grant-type:device_code`;function f(e,t){return new Promise((n,r)=>{if(t?.aborted){r(t.reason??Error(`Device login aborted`));return}let i=setTimeout(()=>{t?.removeEventListener(`abort`,a),n()},e);function a(){clearTimeout(i),r(t?.reason??Error(`Device login aborted`))}t?.addEventListener(`abort`,a,{once:!0})})}function p(e){let r=e.now??Date.now,p=e.sleep??f,m=e.scope??`openid profile email offline_access`,h=e.audience===void 0?u(e.issuer):e.audience||null,g=e.refreshBeforeExpiryMs??t.refreshBeforeExpiryMs,_={issuer:e.issuer,fetch:e.fetch,timeoutMs:e.requestTimeoutMs},v=t=>({..._,clientId:e.clientId,audience:t});async function y(t){let n=new URLSearchParams({client_id:e.clientId,scope:m});t&&n.set(`resource`,t);let i=await l(_,`/api/auth/device/code`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:n});if(!i.ok){let e=await c(i);if(t&&a(e))return y(null);throw e}let o=await i.json();return{deviceCode:o.device_code,userCode:o.user_code,verificationUri:o.verification_uri,verificationUriComplete:o.verification_uri_complete,expiresAt:r()+o.expires_in*1e3,intervalMs:(o.interval??5)*1e3,resource:t}}async function b(e,t){let n=s(e,t?.tokens??null,r());return{user:t?.user??await i(_,n.accessToken),tokens:n}}return{start(){return y(h)},async wait(e,t={}){let i=e.intervalMs;for(;;){if(r()>=e.expiresAt)throw new n(400,`expired_token`,`The device code expired before it was approved`);await p(i,t.signal);try{return await b(await o(v(e.resource),{grant_type:d,device_code:e.deviceCode},void 0,e.resource!==null),null)}catch(e){if(e instanceof n){if(e.code===`authorization_pending`)continue;if(e.code===`slow_down`){i+=5e3;continue}}throw e}}},async refresh(e){let{refreshToken:t}=e.tokens;if(!t)throw new n(400,`invalid_grant`,`The credentials carry no refresh token`);return b(await o(v(h),{grant_type:`refresh_token`,refresh_token:t}),e)},async ensureFresh(e){return e.tokens.accessTokenExpiresAt-g>r()?e:this.refresh(e)}}}export{r as AccountsRequestError,d as DEVICE_CODE_GRANT_TYPE,n as OAuthTokenError,p as createDeviceLogin,e as isAccessDenied};
+import{i as e,n as t,t as n}from"./errors-C7IxbL16.js";import{a as r,n as i,r as a}from"./fetch-CM1mVzPm.js";import{c as o,i as s,l as c,o as l,s as u}from"./oidc-qInr-2mE.js";const d=`urn:ietf:params:oauth:grant-type:device_code`;function f(e,t){return new Promise((n,r)=>{if(t?.aborted){r(t.reason??Error(`Device login aborted`));return}let i=setTimeout(()=>{t?.removeEventListener(`abort`,a),n()},e);function a(){clearTimeout(i),r(t?.reason??Error(`Device login aborted`))}t?.addEventListener(`abort`,a,{once:!0})})}function p(e){let n=e.now??Date.now,p=e.sleep??f,m=e.scope??`openid profile email offline_access`,h=e.audience===void 0?a(e.issuer):e.audience||null,g=e.refreshBeforeExpiryMs??r.refreshBeforeExpiryMs,_={issuer:e.issuer,fetch:e.fetch,timeoutMs:e.requestTimeoutMs},v=t=>({..._,clientId:e.clientId,audience:t});async function y(t){let r=new URLSearchParams({client_id:e.clientId,scope:m});t&&r.set(`resource`,t);let a=await i(_,`/api/auth/device/code`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:r});if(!a.ok){let e=await o(a);if(t&&l(e))return y(null);throw e}let s=await a.json();return{deviceCode:s.device_code,userCode:s.user_code,verificationUri:s.verification_uri,verificationUriComplete:s.verification_uri_complete,expiresAt:n()+s.expires_in*1e3,intervalMs:(s.interval??5)*1e3,resource:t}}async function b(e,t){let r=c(e,t?.tokens??null,n());return{user:t?.user??await s(_,r.accessToken),tokens:r}}return{start(){return y(h)},async wait(e,r={}){let i=e.intervalMs;for(;;){if(n()>=e.expiresAt)throw new t(400,`expired_token`,`The device code expired before it was approved`);await p(i,r.signal);try{return await b(await u(v(e.resource),{grant_type:d,device_code:e.deviceCode},void 0,e.resource!==null),null)}catch(e){if(e instanceof t){if(e.code===`authorization_pending`)continue;if(e.code===`slow_down`){i+=5e3;continue}}throw e}}},async refresh(e){let{refreshToken:n}=e.tokens;if(!n)throw new t(400,`invalid_grant`,`The credentials carry no refresh token`);return b(await u(v(h),{grant_type:`refresh_token`,refresh_token:n}),e)},async ensureFresh(e){return e.tokens.accessTokenExpiresAt-g>n()?e:this.refresh(e)}}}export{n as AccountsRequestError,d as DEVICE_CODE_GRANT_TYPE,t as OAuthTokenError,p as createDeviceLogin,e as isAccessDenied};

package/dist/encoding-BhmNmloC.js

@@ -0,0 +1 @@
+function e(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function t(t){return e(crypto.getRandomValues(new Uint8Array(t)))}async function n(t){let n=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(t));return e(new Uint8Array(n))}export{n,t};

package/dist/errors-C7IxbL16.js

@@ -0,0 +1 @@
+var e=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},t=class extends Error{constructor(e){super(`Stored session could not be decoded`,{cause:e}),this.name=`SessionDecodeError`}},n=class extends e{code;description;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t,this.description=n}};const r=new Set([408,425,429]);function i(t){return t instanceof e&&t.status>=400&&t.status<500&&!r.has(t.status)}function a({phase:e,error:t}){console.error(`[aui-auth] ${e}`,t)}function o(e,t,n){try{e.onError({phase:t,error:n})}catch{}}export{a,i,n,o,t as r,e as t};

package/dist/errors-DpQsDn4O.d.ts

@@ -0,0 +1,30 @@
+//#region src/core/errors.d.ts
+declare class AccountsRequestError extends Error {
+  readonly status: number;
+  constructor(message: string, status: number);
+}
+/**
+ * A stored session that cannot be turned back into one: a token the codec
+ * cannot decrypt because another key wrote it, a column that does not hold
+ * what it should. The session manager reads it as the session being over,
+ * removes the row and sends the user back to sign in, so a store that decodes
+ * what it stored raises this rather than the failure underneath; every other
+ * store failure is a fault and propagates.
+ */
+declare class SessionDecodeError extends Error {
+  constructor(cause: unknown);
+}
+declare class OAuthTokenError extends AccountsRequestError {
+  readonly code: string;
+  readonly description: string;
+  constructor(status: number, code: string, description: string);
+}
+/**
+ * Whether accounts rejected the token, the client, or the user, which ends
+ * the session, as opposed to failing to answer, which keeps it. Any 4xx but a
+ * timeout or a rate limit counts: the provider answers a revoked token or a
+ * disabled client with 400 as readily as with 401.
+ */
+declare function isAccessDenied(error: unknown): boolean;
+//#endregion
+export { isAccessDenied as i, OAuthTokenError as n, SessionDecodeError as r, AccountsRequestError as t };

package/dist/fetch-C0ojJu8c.d.ts

@@ -0,0 +1,9 @@
+//#region src/core/fetch.d.ts
+type AccountsFetchOptions = {
+  issuer: string;
+  fetch?: typeof fetch;
+  timeoutMs?: number;
+};
+declare function accountsEndpoint(issuer: string, path: string): string;
+//#endregion
+export { accountsEndpoint as n, AccountsFetchOptions as t };

package/dist/fetch-CM1mVzPm.js

@@ -0,0 +1 @@
+import{a as e,t}from"./errors-C7IxbL16.js";import{n}from"./codec-IJ2JySkR.js";const r={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},i={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3,requestTimeoutMs:1e4,retryIntervalMs:1e4},a=Object.freeze({});function o(t){return{...t,scope:t.scope??`openid profile email offline_access`,onSignIn:t.onSignIn??(async()=>a),onRevalidate:t.onRevalidate??(async()=>a),onError:t.onError??e,revalidateUser:t.revalidateUser??!1,logout:t.logout??`global`,paths:{...r,...t.paths},lifetimes:{...i,...t.lifetimes},fetch:t.fetch??globalThis.fetch.bind(globalThis),now:t.now??Date.now,cache:t.cache?{codec:n(t.cache.secret),maxAgeMs:t.cache.maxAgeMs??6e4}:null,audience:t.audience===!1?null:t.audience??new URL(`/api/auth`,t.issuer).toString()}}function s(e,t){return new URL(t,e).toString()}function c(e){return s(e,`/api/auth`)}function l(e){return{issuer:e.issuer,fetch:e.fetch,timeoutMs:e.lifetimes.requestTimeoutMs}}async function u(e,n,r={},a){let o=e.fetch??globalThis.fetch.bind(globalThis),c=e.timeoutMs??i.requestTimeoutMs,l=a===void 0?c:Math.min(c,a-Date.now());if(l<=0)throw new t(`Accounts request deadline passed`,0);return o(s(e.issuer,n),{...r,cache:`no-store`,signal:AbortSignal.timeout(l)})}export{i as a,l as i,u as n,o,c as r,s as t};

package/dist/{index-Bte2SoPM.d.ts → index-DdBQue0N.d.ts}

@@ -1,4 +1,18 @@
-import { c as AccountsSession, t as AccountsAuthConfig, u as AccountsSessionStore } from "./types-Cx223pmJ.js";
+import { a as AccountsLifetimes, d as AccountsUser, l as AccountsSessionStore, s as AccountsSession, t as AccountsAuthConfig } from "./types-B13HPcs5.js";
+import { t as AccountsFetchOptions } from "./fetch-C0ojJu8c.js";
+//#region src/core/resolve.d.ts
+type SessionResolution<Data> = {
+  session: AccountsSession<Data> | null;
+  /**
+   * The Set-Cookie headers to attach to the response: the cache cookie while
+   * the session is alive, the cookies that clear a session that is gone.
+   */
+  cookies: string[];
+};
+//#endregion
+//#region src/core/config.d.ts
+declare const DEFAULT_LIFETIMES: AccountsLifetimes;
+//#endregion
 //#region src/core/cookies.d.ts
 declare function requestOrigin(request: Request): string;
 /**
@@ -10,6 +24,9 @@ declare function requestOrigin(request: Request): string;
 declare function forwardCookies(headers: Headers, issued: readonly string[]): void;
 declare function sanitizeRedirectPath(rawRedirect: string | null | undefined, origin: string): string;
 //#endregion
+//#region src/core/oidc.d.ts
+declare function fetchUserInfo(options: AccountsFetchOptions, accessToken: string): Promise<AccountsUser>;
+//#endregion
 //#region src/core/cache.d.ts
 declare function cacheCookieBase(sessionCookie: string): string;
 //#endregion
@@ -29,16 +46,6 @@ type GuardResult<Data> = {
   response: Response;
 };
 //#endregion
-//#region src/core/resolve.d.ts
-type SessionResolution<Data> = {
-  session: AccountsSession<Data> | null;
-  /**
-   * The Set-Cookie headers to attach to the response: the cache cookie while
-   * the session is alive, the cookies that clear a session that is gone.
-   */
-  cookies: string[];
-};
-//#endregion
 //#region src/core/store/memory.d.ts
 declare function createMemorySessionStore<Data>(): AccountsSessionStore<Data> & {
   rows: Map<string, AccountsSession<Data>>;
@@ -62,9 +69,9 @@ declare function createAccountsAuth<Data>(input: AccountsAuthConfig<Data>): {
   sessionFromRequest: (request: Request) => Promise<AccountsSession<Data> | null>;
   accessTokenFromCookies: (cookies: SessionCookies) => Promise<string | null>;
   accessTokenFromRequest: (request: Request) => Promise<string | null>;
-  updateSessionData: (cookies: SessionCookies, update: (data: Data) => Data) => Promise<AccountsSession<Data> | null>;
+  updateSessionData: (cookies: SessionCookies, update: (data: Data) => Data) => Promise<SessionResolution<Data>>;
   sweepSessions: () => Promise<number>;
 };
 type AccountsAuth<Data> = ReturnType<typeof createAccountsAuth<Data>>;
 //#endregion
-export { SessionResolution as a, cacheCookieBase as c, sanitizeRedirectPath as d, createMemorySessionStore as i, forwardCookies as l, SessionCookies as n, GuardOptions as o, createAccountsAuth as r, GuardResult as s, AccountsAuth as t, requestOrigin as u };
+export { GuardOptions as a, fetchUserInfo as c, sanitizeRedirectPath as d, DEFAULT_LIFETIMES as f, createMemorySessionStore as i, forwardCookies as l, SessionCookies as n, GuardResult as o, SessionResolution as p, createAccountsAuth as r, cacheCookieBase as s, AccountsAuth as t, requestOrigin as u };

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-import { _ as SessionSweepCutoffs, a as AccountsLifetimes, c as AccountsSession, d as AccountsTokens, f as AccountsUser, g as SessionDecodeError, h as RevalidateInput, i as AccountsErrorPhase, l as AccountsSessionPatch, m as OAuthTokenError, n as AccountsCacheConfig, o as AccountsPaths, p as DEFAULT_LIFETIMES, r as AccountsErrorEvent, s as AccountsRequestError, t as AccountsAuthConfig, u as AccountsSessionStore, v as SignInInput, y as isAccessDenied } from "./types-Cx223pmJ.js";
-import { n as accountsEndpoint, r as fetchUserInfo, t as AccountsFetchOptions } from "./oidc-CbVNB1IR.js";
-import { a as SessionResolution, c as cacheCookieBase, d as sanitizeRedirectPath, i as createMemorySessionStore, l as forwardCookies, n as SessionCookies, o as GuardOptions, r as createAccountsAuth, s as GuardResult, t as AccountsAuth, u as requestOrigin } from "./index-Bte2SoPM.js";
+import { a as AccountsLifetimes, c as AccountsSessionPatch, d as AccountsUser, f as RevalidateInput, i as AccountsErrorPhase, l as AccountsSessionStore, m as SignInInput, n as AccountsCacheConfig, o as AccountsPaths, p as SessionSweepCutoffs, r as AccountsErrorEvent, s as AccountsSession, t as AccountsAuthConfig, u as AccountsTokens } from "./types-B13HPcs5.js";
+import { n as accountsEndpoint, t as AccountsFetchOptions } from "./fetch-C0ojJu8c.js";
+import { i as isAccessDenied, n as OAuthTokenError, r as SessionDecodeError, t as AccountsRequestError } from "./errors-DpQsDn4O.js";
+import { a as GuardOptions, c as fetchUserInfo, d as sanitizeRedirectPath, f as DEFAULT_LIFETIMES, i as createMemorySessionStore, l as forwardCookies, n as SessionCookies, o as GuardResult, p as SessionResolution, r as createAccountsAuth, s as cacheCookieBase, t as AccountsAuth, u as requestOrigin } from "./index-DdBQue0N.js";
 export { AccountsAuth, type AccountsAuthConfig, type AccountsCacheConfig, type AccountsErrorEvent, type AccountsErrorPhase, type AccountsFetchOptions, type AccountsLifetimes, type AccountsPaths, AccountsRequestError, type AccountsSession, type AccountsSessionPatch, type AccountsSessionStore, type AccountsTokens, type AccountsUser, DEFAULT_LIFETIMES, type GuardOptions, type GuardResult, OAuthTokenError, type RevalidateInput, SessionCookies, SessionDecodeError, type SessionResolution, type SessionSweepCutoffs, type SignInInput, accountsEndpoint, cacheCookieBase, createAccountsAuth, createMemorySessionStore, fetchUserInfo, forwardCookies, isAccessDenied, requestOrigin, sanitizeRedirectPath };

package/dist/index.js

@@ -1 +1 @@
-import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,p as f,r as p,t as m,u as h,v as g}from"./cache-m-qvewq5.js";import{a as _,i as v,n as y,o as b,r as x,s as S,t as C}from"./types-B_7rFOLg.js";import{a as w,c as T,h as E,i as D,l as O,o as k,p as A,r as j,s as M,t as N,u as P}from"./oidc-0pw9wXd4.js";function F(e,t){return[...d(e.cookieName,t),...m(e,t)]}function I(e,t){return async function(n){let r=o(n),i=f(n,e.cookieName),a=f(n,u(e.cookieName)),c=await s(e,a,i,e.now());if(c)return{session:c,cookies:[]};let l={session:null,cookies:i!==null||a!==null?F(e,r):[]},d=await t.load(i);if(!d)return l;let{deferRevalidation:m}=e;if(m&&t.revalidationDue(d)&&L(e,m,t,d)){let t=await p(e,d,r,e.now());return{session:d,cookies:t?[t]:[]}}let h=d;try{let e=await t.revalidate(d);if(!e)return l;h=e}catch(t){b(e,`revalidate`,t)}let g=await p(e,h,r,e.now());return{session:h,cookies:g?[g]:[]}}}function L(e,t,n,r){try{return t(async()=>{try{await n.revalidate(r)}catch(t){b(e,`revalidate`,t)}}),!0}catch(t){return b(e,`revalidate`,t),!1}}function R(e,t){let n=I(e,t);return async function(t,i={}){let a=new URL(t.url);if([e.paths.login,e.paths.callback,e.paths.logout,e.paths.logoutComplete,e.paths.error,...i.publicPaths??[]].some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,a=new URL(e.url),o=(t.apiPaths??[`/api`,`/trpc`]).some(e=>a.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):l(i(e,t,r));for(let e of n)o.headers.append(`set-cookie`,e);return{kind:`response`,response:o}}function i(t,n,r){let i=new URL(t.url),a=new URL(e.paths.login,o(t));return a.searchParams.set(`redirect`,n.redirectPath?.(t)??`${i.pathname}${i.search}`),r&&a.searchParams.set(`silent`,`1`),a}}const z=/^[A-Za-z0-9_-]{1,128}$/,B=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function V(r,s){function u(e,t){let n=new URL(r.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let i=new URL(r.paths.error,e);return i.searchParams.set(`reason`,t),n&&i.searchParams.set(`description`,n),i}function _(t,n){let a=h(r.cookieName,``),o=[...i(t.headers.get(`cookie`)).keys()].filter(e=>e.replace(/^__Secure-/,``).startsWith(a)),s=o.length-4;for(let t of o.slice(0,Math.max(0,s)))n.headers.append(`set-cookie`,e(t,``,t.startsWith(`__Secure-`),0))}async function v(e){try{let t=await s.load(e);t&&await s.end(t)}catch(e){b(r,`session_store`,e)}}async function y(e){let t=o(e),n=new URL(e.url).searchParams,i=a(n.get(`redirect`),t),s=n.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await D(r,{origin:t,silent:s}),p=l(u);return _(e,p),g(p.headers,h(r.cookieName,d),c({verifier:f,redirectPath:i,silent:s}),t,r.lifetimes.flowMaxAgeMs),p}async function S(e){let i=o(e),c=new URL(e.url).searchParams,_=c.get(`state`),y=_&&z.test(_)?h(r.cookieName,_):null,S=y?n(f(e,y)):null,C=e=>(y&&t(e.headers,y,i),e);if(!S)return C(l(d(i,`invalid_state`,null)));let w=a(S.redirectPath,i),D=c.get(`iss`);if(D!==null&&D!==j(r.issuer))return C(l(d(i,`invalid_issuer`,null)));let O=c.get(`error`);if(O)return S.silent&&B.has(O)?C(l(u(i,w))):C(l(d(i,O,c.get(`error_description`))));let A=c.get(`code`);if(!A)return C(l(d(i,`invalid_request`,null)));let N,P,F;try{let e=await k(r,{code:A,verifier:S.verifier,redirectUri:new URL(r.paths.callback,i).toString()});N=E(e,null,r.now()),P=await T(M(r),N.accessToken),F=await r.onSignIn({user:P,accessToken:N.accessToken,redirectPath:w,previous:null})}catch(e){return b(r,`sign_in`,e),e instanceof x?C(l(d(i,e.code,e.description||null))):C(l(d(i,`accounts_unavailable`,null)))}let I=f(e,r.cookieName);if(F===null){let e=l(d(i,`access_denied`,null));I!==null&&(await v(I),t(e.headers,r.cookieName,i));for(let t of m(r,i))e.headers.append(`set-cookie`,t);return C(e)}let L,R;try{({cookieValue:L,session:R}=await s.start({user:P,tokens:N,data:F}))}catch(e){return b(r,`session_store`,e),C(l(d(i,`session_store_error`,null)))}I!==null&&await v(I);let V=l(new URL(w,i));g(V.headers,r.cookieName,L,i,r.lifetimes.absoluteMaxAgeMs);let H=await p(r,R,i,r.now());return H&&V.headers.append(`set-cookie`,H),C(V)}async function C(e){let t=o(e),n=await s.load(f(e,r.cookieName));n&&await s.end(n);let i=n?.tokens.idToken&&r.logout===`global`?w(r,{origin:t,idToken:n.tokens.idToken}):new URL(r.paths.logoutComplete,t).toString(),a=l(i,303);for(let e of F(r,t))a.headers.append(`set-cookie`,e);return a}return{login:y,callback:S,logout:C}}const H=e=>new Promise(t=>setTimeout(t,e));function U(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}function a(t){let r=e.now();return!i(t.tokens,r)&&r-t.lastValidatedAt>=n.revalidateIntervalMs}async function o(n){if(!n)return null;let i=await A(n),a;try{a=await t.read(i)}catch(n){if(!(n instanceof v))throw n;return b(e,`session_store`,n),await t.delete(i),null}return a?r(a,e.now())?(await t.delete(a.id),null):a:null}async function s(n){let r=O(32),i=e.now(),a={id:await A(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function c(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return l(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await P(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:E(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(_(n))return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return b(e,`refresh`,n),r??o;throw n}}async function l(r,a){for(;;){await H(100);let o=await t.read(r);if(!o)return null;let s=e.now();if(!i(o.tokens,s))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=s)return c(o);if(s-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>s)return o;throw new C(`Timed out waiting for the session refresh lease`,0)}}}async function u(r){let i;try{i=await c(r)}catch(t){b(e,`refresh`,t),i=r}if(!i)return null;if(e.now()-i.lastValidatedAt<n.revalidateIntervalMs||!d(i.tokens))return i;let a=e.revalidateUser?await p(i):i.user;if(!a)return f(i);if(!d(i.tokens))return i;let o=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken,user:a});if(o===null)return f(i);let s={data:o,lastValidatedAt:e.now()};return a!==i.user&&(s.user=a),t.update(i.id,s)}function d(t){return t.accessTokenExpiresAt-e.now()>n.requestTimeoutMs}async function f(n){return n.tokens.accessTokenExpiresAt<=e.now()?n:(await t.delete(n.id),null)}async function p(t){try{return await T(M(e),t.tokens.accessToken)}catch(n){return _(n)?null:(b(e,`revalidate`,n),t.user)}}async function m(e){await t.delete(e.id)}async function h(){if(!t.sweep)return 0;let r=e.now();return t.sweep({createdBefore:r-n.absoluteMaxAgeMs,validatedBefore:r-n.idleMaxAgeMs})}return{load:o,start:s,ensureFreshTokens:c,revalidate:u,revalidationDue:a,end:m,sweep:h}}function W(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)},async sweep(t){let n=0;for(let[r,i]of e)(i.createdAt<t.createdBefore||i.lastValidatedAt<t.validatedBefore)&&(e.delete(r),n+=1);return n}}}function G(e){let t=S(e),n=U(t),r=V(t,n),i=R(t,n),a=I(t,n);function o(e){return{session:f(e,t.cookieName),cache:f(e,u(t.cookieName))}}async function c(e){return await s(t,e.cache,e.session,t.now())??n.load(e.session)}async function l(e){return c(o(e))}async function d(e){let r=await s(t,e.cache,e.session,t.now());if(r&&r.tokens.accessTokenExpiresAt>t.now())return r.tokens.accessToken;let i=await n.load(e.session);return i?(await n.ensureFreshTokens(i))?.tokens.accessToken??null:null}async function p(e){return d(o(e))}async function m(e,r){let i=await n.load(e.session);return i?t.store.update(i.id,{data:r(i.data)}):null}function h(){return n.sweep()}return{cookieName:t.cookieName,handlers:r,guard:i,resolveSession:a,sessionFromCookies:c,sessionFromRequest:l,accessTokenFromCookies:d,accessTokenFromRequest:p,updateSessionData:m,sweepSessions:h}}export{C as AccountsRequestError,y as DEFAULT_LIFETIMES,x as OAuthTokenError,v as SessionDecodeError,N as accountsEndpoint,u as cacheCookieBase,G as createAccountsAuth,W as createMemorySessionStore,T as fetchUserInfo,r as forwardCookies,_ as isAccessDenied,o as requestOrigin,a as sanitizeRedirectPath};
+import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,r as f,t as p,u as m,v as h,y as g}from"./cache-iIzAusyV.js";import{n as _,t as v}from"./encoding-BhmNmloC.js";import{i as y,n as b,o as x,r as S,t as C}from"./errors-C7IxbL16.js";import{a as w,i as T,o as E,r as D,t as O}from"./fetch-CM1mVzPm.js";import{a as k,i as A,l as j,n as M,r as N,t as P}from"./oidc-qInr-2mE.js";function F(e,t){return[...d(e.cookieName,t),...p(e,t)]}function I(e,t){return async function(n){let r=a(n),i=l(n,e.cookieName),o=l(n,u(e.cookieName)),c=await s(e,o,i,e.now());if(c)return{session:c,cookies:[]};let d={session:null,cookies:i!==null||o!==null?F(e,r):[]},p=await t.load(i);if(!p)return d;let{deferRevalidation:m}=e;if(m&&t.revalidationDue(p)&&L(e,m,t,p)){let t=await f(e,p,r,e.now());return{session:p,cookies:t?[t]:[]}}let h=p;try{let e=await t.revalidate(p);if(!e)return d;h=e}catch(t){x(e,`revalidate`,t)}let g=await f(e,h,r,e.now());return{session:h,cookies:g?[g]:[]}}}function L(e,t,n,r){try{return t(async()=>{try{await n.revalidate(r)}catch(t){x(e,`revalidate`,t)}}),!0}catch(t){return x(e,`revalidate`,t),!1}}function R(e,t){let n=I(e,t);return async function(t,i={}){let a=new URL(t.url);if([e.paths.login,e.paths.callback,e.paths.logout,e.paths.logoutComplete,e.paths.error,...i.publicPaths??[]].some(e=>a.pathname.startsWith(e)))return{kind:`ok`,session:null};let{session:o,cookies:s}=await n(t);return o?s.length>0?{kind:`ok`,session:o,cookies:s}:{kind:`ok`,session:o}:r(t,i,s)};function r(e,t,n){let r=n.length>0,a=new URL(e.url),s=(t.apiPaths??[`/api`,`/trpc`]).some(e=>a.pathname.startsWith(e))?Response.json({error:`Unauthorized`},{status:401}):o(i(e,t,r));for(let e of n)s.headers.append(`set-cookie`,e);return{kind:`response`,response:s}}function i(t,n,r){let i=new URL(t.url),o=new URL(e.paths.login,a(t));return o.searchParams.set(`redirect`,n.redirectPath?.(t)??`${i.pathname}${i.search}`),r&&o.searchParams.set(`silent`,`1`),o}}const z=/^[A-Za-z0-9_-]{1,128}$/,B=new Set([`login_required`,`consent_required`,`interaction_required`,`account_selection_required`]);function V(r,s){function u(e,t){let n=new URL(r.paths.login,e);return n.searchParams.set(`redirect`,t),n}function d(e,t,n){let i=new URL(r.paths.error,e);return i.searchParams.set(`reason`,t),n&&i.searchParams.set(`description`,n),i}function _(e,t){let n=m(r.cookieName,``),a=[...i(e.headers.get(`cookie`)).keys()].filter(e=>e.replace(/^__Secure-/,``).startsWith(n)),o=a.length-4;for(let e of a.slice(0,Math.max(0,o)))t.headers.append(`set-cookie`,h(e,``,e.startsWith(`__Secure-`),0))}async function v(e){try{let t=await s.load(e);t&&await s.end(t)}catch(e){x(r,`session_store`,e)}}async function y(t){let n=a(t),i=new URL(t.url).searchParams,s=e(i.get(`redirect`),n),l=i.get(`silent`)===`1`,{url:u,state:d,verifier:f}=await P(r,{origin:n,silent:l}),p=o(u);return _(t,p),g(p.headers,m(r.cookieName,d),c({verifier:f,redirectPath:s,silent:l}),n,r.lifetimes.flowMaxAgeMs),p}async function S(i){let c=a(i),h=new URL(i.url).searchParams,_=h.get(`state`),y=_&&z.test(_)?m(r.cookieName,_):null,S=y?n(l(i,y)):null,C=e=>(y&&t(e.headers,y,c),e);if(!S)return C(o(d(c,`invalid_state`,null)));let w=e(S.redirectPath,c),E=h.get(`iss`);if(E!==null&&E!==D(r.issuer))return C(o(d(c,`invalid_issuer`,null)));let O=h.get(`error`);if(O)return S.silent&&B.has(O)?C(o(u(c,w))):C(o(d(c,O,h.get(`error_description`))));let k=h.get(`code`);if(!k)return C(o(d(c,`invalid_request`,null)));let M,P,F;try{let e=await N(r,{code:k,verifier:S.verifier,redirectUri:new URL(r.paths.callback,c).toString()});M=j(e,null,r.now()),P=await A(T(r),M.accessToken),F=await r.onSignIn({user:P,accessToken:M.accessToken,redirectPath:w,previous:null})}catch(e){return x(r,`sign_in`,e),e instanceof b?C(o(d(c,e.code,e.description||null))):C(o(d(c,`accounts_unavailable`,null)))}let I=l(i,r.cookieName);if(F===null){let e=o(d(c,`access_denied`,null));I!==null&&(await v(I),t(e.headers,r.cookieName,c));for(let t of p(r,c))e.headers.append(`set-cookie`,t);return C(e)}let L,R;try{({cookieValue:L,session:R}=await s.start({user:P,tokens:M,data:F}))}catch(e){return x(r,`session_store`,e),C(o(d(c,`session_store_error`,null)))}I!==null&&await v(I);let V=o(new URL(w,c));g(V.headers,r.cookieName,L,c,r.lifetimes.absoluteMaxAgeMs);let H=await f(r,R,c,r.now());return H&&V.headers.append(`set-cookie`,H),C(V)}async function C(e){let t=a(e),n=await s.load(l(e,r.cookieName));n&&await s.end(n);let i=n?.tokens.idToken&&r.logout===`global`?M(r,{origin:t,idToken:n.tokens.idToken}):new URL(r.paths.logoutComplete,t).toString(),c=o(i,303);for(let e of F(r,t))c.headers.append(`set-cookie`,e);return c}return{login:y,callback:S,logout:C}}const H=e=>new Promise(t=>setTimeout(t,e));function U(e){let{store:t,lifetimes:n}=e;function r(e,t){return t-e.createdAt>=n.absoluteMaxAgeMs||t-e.lastValidatedAt>=n.idleMaxAgeMs}function i(e,t){return e.accessTokenExpiresAt-t<=n.refreshBeforeExpiryMs}function a(t){let r=e.now();return!i(t.tokens,r)&&r-t.lastValidatedAt>=n.revalidateIntervalMs}async function o(n){if(!n)return null;let i=await _(n),a;try{a=await t.read(i)}catch(n){if(!(n instanceof S))throw n;return x(e,`session_store`,n),await t.delete(i),null}return a?r(a,e.now())?(await t.delete(a.id),null):a:null}async function s(n){let r=v(32),i=e.now(),a={id:await _(r),user:n.user,tokens:n.tokens,data:n.data,createdAt:i,lastValidatedAt:i,refreshLeaseUntil:null};return await t.create(a),{session:a,cookieValue:r}}async function c(r){let a=e.now();if(!i(r.tokens,a))return r;if(!r.tokens.refreshToken)return await t.delete(r.id),null;let o=await t.claimRefreshLease(r.id,a+n.refreshLeaseMs,a);if(!o)return l(r.id,a);let s=o.refreshLeaseUntil??void 0;if(!i(o.tokens,a))return await t.update(o.id,{refreshLeaseUntil:null},s)??t.read(o.id);try{let r=await k(e,o.tokens.refreshToken,Math.max(n.refreshLeaseMs-1e3,n.refreshLeaseMs/2));return await t.update(o.id,{tokens:j(r,o.tokens,e.now()),refreshLeaseUntil:null},s)??t.read(o.id)}catch(n){if(y(n))return await t.delete(o.id,s)?null:await t.read(o.id)??null;let r=await t.update(o.id,{refreshLeaseUntil:null},s);if(o.tokens.accessTokenExpiresAt>e.now())return x(e,`refresh`,n),r??o;throw n}}async function l(r,a){for(;;){await H(100);let o=await t.read(r);if(!o)return null;let s=e.now();if(!i(o.tokens,s))return o;if(o.refreshLeaseUntil===null||o.refreshLeaseUntil<=s)return c(o);if(s-a>=n.leaseWaitMs){if(o.tokens.accessTokenExpiresAt>s)return o;throw new C(`Timed out waiting for the session refresh lease`,0)}}}async function u(r){let i;try{i=await c(r)}catch(t){x(e,`refresh`,t),i=r}if(!i)return null;if(e.now()-i.lastValidatedAt<n.revalidateIntervalMs||!d(i.tokens))return i;let a=e.revalidateUser?await p(i):i.user;if(!a)return f(i);if(!d(i.tokens))return i;let o=await e.onRevalidate({session:i,accessToken:i.tokens.accessToken,user:a});if(o===null)return f(i);let s={data:o,lastValidatedAt:e.now()};return a!==i.user&&(s.user=a),t.update(i.id,s)}function d(t){return t.accessTokenExpiresAt-e.now()>n.requestTimeoutMs}async function f(n){return n.tokens.accessTokenExpiresAt<=e.now()?n:(await t.delete(n.id),null)}async function p(t){try{return await A(T(e),t.tokens.accessToken)}catch(n){return y(n)?null:(x(e,`revalidate`,n),t.user)}}async function m(e){await t.delete(e.id)}async function h(){if(!t.sweep)return 0;let r=e.now();return t.sweep({createdBefore:r-n.absoluteMaxAgeMs,validatedBefore:r-n.idleMaxAgeMs})}return{load:o,start:s,ensureFreshTokens:c,revalidate:u,revalidationDue:a,end:m,sweep:h}}function W(){let e=new Map;return{rows:e,async create(t){e.set(t.id,structuredClone(t))},async read(t){let n=e.get(t);return n?structuredClone(n):null},async update(t,n,r){let i=e.get(t);if(!i||r!==void 0&&i.refreshLeaseUntil!==r)return null;let a=structuredClone({...i,...n});return e.set(t,a),structuredClone(a)},async claimRefreshLease(t,n,r){let i=e.get(t);if(!i||i.refreshLeaseUntil!==null&&i.refreshLeaseUntil>r)return null;let a={...i,refreshLeaseUntil:n};return e.set(t,a),structuredClone(a)},async delete(t,n){let r=e.get(t);return!r||n!==void 0&&r.refreshLeaseUntil!==n?!1:(e.delete(t),!0)},async sweep(t){let n=0;for(let[r,i]of e)(i.createdAt<t.createdBefore||i.lastValidatedAt<t.validatedBefore)&&(e.delete(r),n+=1);return n}}}function G(e){let t=E(e),n=U(t),r=V(t,n),i=R(t,n),a=I(t,n);function o(e){return{session:l(e,t.cookieName),cache:l(e,u(t.cookieName))}}async function c(e){return await s(t,e.cache,e.session,t.now())??n.load(e.session)}async function d(e){return c(o(e))}async function f(e){let r=await s(t,e.cache,e.session,t.now());if(r&&r.tokens.accessTokenExpiresAt>t.now())return r.tokens.accessToken;let i=await n.load(e.session);return i?(await n.ensureFreshTokens(i))?.tokens.accessToken??null:null}async function m(e){return f(o(e))}async function h(e,r){let i=await n.load(e.session),a=i&&await t.store.update(i.id,{data:r(i.data)});return a?{session:a,cookies:p(t)}:{session:null,cookies:[]}}function g(){return n.sweep()}return{cookieName:t.cookieName,handlers:r,guard:i,resolveSession:a,sessionFromCookies:c,sessionFromRequest:d,accessTokenFromCookies:f,accessTokenFromRequest:m,updateSessionData:h,sweepSessions:g}}export{C as AccountsRequestError,w as DEFAULT_LIFETIMES,b as OAuthTokenError,S as SessionDecodeError,O as accountsEndpoint,u as cacheCookieBase,G as createAccountsAuth,W as createMemorySessionStore,A as fetchUserInfo,r as forwardCookies,y as isAccessDenied,a as requestOrigin,e as sanitizeRedirectPath};

package/dist/next.d.ts

@@ -1,5 +1,5 @@
-import { c as AccountsSession } from "./types-Cx223pmJ.js";
-import { t as AccountsAuth } from "./index-Bte2SoPM.js";
+import { s as AccountsSession } from "./types-B13HPcs5.js";
+import { t as AccountsAuth } from "./index-DdBQue0N.js";
 import { NextRequest, NextResponse } from "next/server";
 //#region src/next/index.d.ts
 /**

package/dist/next.js

@@ -1 +1 @@
-import{d as e,n as t,s as n}from"./cache-m-qvewq5.js";import{cookies as r}from"next/headers";import{NextResponse as i,connection as a}from"next/server";function o(t,n=[]){e(t.headers,n);let r=i.next({request:{headers:t.headers}});for(let e of n)r.headers.append(`set-cookie`,e);return r}async function s(e){await a();let i=await r(),o=e=>i.get(n(e,!0))?.value||i.get(n(e,!1))?.value||null;return{session:o(e),cache:o(t(e))}}async function c(e){let i=await r(),a=t(e);for(let e of[n(a,!0),n(a,!1)])try{i.delete(e)}catch{}}function l(e){let t=e.cookieName;return{async getSession(){return e.sessionFromCookies(await s(t))},async getAccessToken(){return e.accessTokenFromCookies(await s(t))},async updateSessionData(n){let r=await e.updateSessionData(await s(t),n);return r&&await c(t),r}}}export{o as continueRequest,l as withNextRequestScope};
+import{d as e,n as t,p as n,s as r}from"./cache-iIzAusyV.js";import{io as i}from"next/cache.js";import{cookies as a}from"next/headers";import{NextResponse as o}from"next/server";function s(t,n=[]){e(t.headers,n);let r=o.next({request:{headers:t.headers}});for(let e of n)r.headers.append(`set-cookie`,e);return r}async function c(e){await i();let n=await a(),o=e=>n.get(r(e,!0))?.value||n.get(r(e,!1))?.value||null;return{session:o(e),cache:o(t(e))}}async function l(e){let t=await a();for(let r of e){let e=n(r);if(e)try{t.set(e.name,e.value,e.options)}catch{}}}function u(e){let t=e.cookieName;return{async getSession(){return e.sessionFromCookies(await c(t))},async getAccessToken(){return e.accessTokenFromCookies(await c(t))},async updateSessionData(n){let r=await e.updateSessionData(await c(t),n);return await l(r.cookies),r.session}}}export{s as continueRequest,u as withNextRequestScope};

package/dist/oidc-qInr-2mE.js

@@ -0,0 +1 @@
+import{n as e,t}from"./encoding-BhmNmloC.js";import{n,t as r}from"./errors-C7IxbL16.js";import{i,n as a,t as o}from"./fetch-CM1mVzPm.js";async function s(n,r){let i=t(24),a=t(32),s=new URL(o(n.issuer,`/api/auth/oauth2/authorize`));return s.searchParams.set(`client_id`,n.clientId),s.searchParams.set(`redirect_uri`,new URL(n.paths.callback,r.origin).toString()),s.searchParams.set(`response_type`,`code`),s.searchParams.set(`scope`,n.scope),s.searchParams.set(`state`,i),s.searchParams.set(`code_challenge`,await e(a)),s.searchParams.set(`code_challenge_method`,`S256`),r.silent&&s.searchParams.set(`prompt`,`none`),{url:s.toString(),state:i,verifier:a}}function c(e,t){let n=new URL(o(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}function l(e){return{...i(e),clientId:e.clientId,clientSecret:e.clientSecret,audience:e.audience}}async function u(e){let t=await e.text().catch(()=>``),r=`unknown_error`,i=t;try{let e=JSON.parse(t);r=e.error??r,i=e.error_description??i}catch{}return new n(e.status,r,i)}function d(e){return e.code===`invalid_target`||e.code===`invalid_request`&&/resource/i.test(e.description)}async function f(e,t,n,r=!0){let i=new URLSearchParams({client_id:e.clientId,...t});e.clientSecret&&i.set(`client_secret`,e.clientSecret),e.audience&&r&&i.set(`resource`,e.audience);let o=await a(e,`/api/auth/oauth2/token`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i},n);if(!o.ok){let i=await u(o);if(r&&e.audience&&d(i))return f(e,t,n,!1);throw i}return await o.json()}function p(e,t){return f(l(e),{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function m(e,t,n){return f(l(e),{grant_type:`refresh_token`,refresh_token:t},n===void 0?void 0:Date.now()+n)}async function h(e,t){let n=await a(e,`/api/auth/oauth2/userinfo`,{headers:{Authorization:`Bearer ${t}`}});if(!n.ok)throw new r(`Failed to load user info: ${n.status}`,n.status);let i=await n.json();return{id:i.sub,email:i.email??``,name:i.name??i.email??i.sub,image:i.picture??null}}function g(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}export{m as a,u as c,h as i,g as l,c as n,d as o,p as r,f as s,s as t};

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { u as AccountsSessionStore } from "./types-Cx223pmJ.js";
+import { l as AccountsSessionStore } from "./types-B13HPcs5.js";
 //#region src/testing/index.d.ts
 /**
  * A behavioural conformance suite for the session store contract.

package/dist/{types-Cx223pmJ.d.ts → types-B13HPcs5.d.ts}

@@ -161,33 +161,5 @@ type AccountsCacheConfig = {
   secret: string;
   maxAgeMs?: number;
 };
-declare const DEFAULT_LIFETIMES: AccountsLifetimes;
-declare class AccountsRequestError extends Error {
-  readonly status: number;
-  constructor(message: string, status: number);
-}
-/**
- * A stored session that cannot be turned back into one: a token the codec
- * cannot decrypt because another key wrote it, a column that does not hold
- * what it should. The session manager reads it as the session being over,
- * removes the row and sends the user back to sign in, so a store that decodes
- * what it stored raises this rather than the failure underneath; every other
- * store failure is a fault and propagates.
- */
-declare class SessionDecodeError extends Error {
-  constructor(cause: unknown);
-}
-declare class OAuthTokenError extends AccountsRequestError {
-  readonly code: string;
-  readonly description: string;
-  constructor(status: number, code: string, description: string);
-}
-/**
- * Whether accounts rejected the token, the client, or the user, which ends
- * the session, as opposed to failing to answer, which keeps it. Any 4xx but a
- * timeout or a rate limit counts: the provider answers a revoked token or a
- * disabled client with 400 as readily as with 401.
- */
-declare function isAccessDenied(error: unknown): boolean;
 //#endregion
-export { SessionSweepCutoffs as _, AccountsLifetimes as a, AccountsSession as c, AccountsTokens as d, AccountsUser as f, SessionDecodeError as g, RevalidateInput as h, AccountsErrorPhase as i, AccountsSessionPatch as l, OAuthTokenError as m, AccountsCacheConfig as n, AccountsPaths as o, DEFAULT_LIFETIMES as p, AccountsErrorEvent as r, AccountsRequestError as s, AccountsAuthConfig as t, AccountsSessionStore as u, SignInInput as v, isAccessDenied as y };
+export { AccountsLifetimes as a, AccountsSessionPatch as c, AccountsUser as d, RevalidateInput as f, AccountsErrorPhase as i, AccountsSessionStore as l, SignInInput as m, AccountsCacheConfig as n, AccountsPaths as o, SessionSweepCutoffs as p, AccountsErrorEvent as r, AccountsSession as s, AccountsAuthConfig as t, AccountsTokens as u };

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { s as AccountsRequestError } from "./types-Cx223pmJ.js";
+import { t as AccountsRequestError } from "./errors-DpQsDn4O.js";
 //#region src/verify/index.d.ts
 type AccountsTokenClaims = {
   iss: string;

package/dist/verify.js

@@ -1 +1 @@
-import{t as e}from"./types-B_7rFOLg.js";import{n as t,r as n}from"./oidc-0pw9wXd4.js";function r(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=atob(t+`=`.repeat((4-t.length%4)%4)),r=new Uint8Array(n.length);for(let e=0;e<n.length;e++)r[e]=n.charCodeAt(e);return r}function i(e){try{let t=JSON.parse(new TextDecoder().decode(r(e)));return typeof t==`object`&&t&&!Array.isArray(t)?t:null}catch{return null}}async function a(e){let t=typeof e==`object`&&e&&Array.isArray(e.keys)?e.keys:null;if(t===null)throw Error(`The key set has no keys array`);let n=new Map;for(let[e,r]of t.entries())if(!(typeof r!=`object`||!r||r.kty!==`OKP`||r.crv!==`Ed25519`||typeof r.x!=`string`))try{let t=await crypto.subtle.importKey(`jwk`,{kty:r.kty,crv:r.crv,x:r.x},{name:`Ed25519`},!1,[`verify`]);n.set(typeof r.kid==`string`?r.kid:`#${e}`,t)}catch{}return n}function o(o){let s=o.now??Date.now,c=n(o.issuer),l=new Set(Array.isArray(o.audience)?o.audience:[o.audience]),u=o.keysMaxAgeMs??6e5,d=o.keysRetryMs??3e4,f=o.clockSkewMs??3e4,p={issuer:o.issuer,fetch:o.fetch,timeoutMs:o.requestTimeoutMs},m=null,h=null;function g(){return h??=(async()=>{try{let n=await t(p,`/api/auth/jwks`);if(!n.ok)throw new e(`Failed to load the accounts key set: ${n.status}`,n.status);let r;try{r=await a(await n.json())}catch(t){throw new e(`Failed to read the accounts key set: ${t instanceof Error?t.message:String(t)}`,n.status)}return m={keys:r,loadedAt:s()},m}finally{h=null}})(),h}async function _(){try{return await g()}catch(e){if(m)return m;throw e}}let v=-1/0;async function y(e){let t=m&&s()-m.loadedAt<u?m:await _();if(e!==null&&!t.keys.has(e)&&s()-v>=d&&(v=s(),t=await _()),e===null)return[...t.keys.values()];let n=t.keys.get(e);return n?[n]:[]}return{async verify(e,t={}){let n=e.split(`.`);if(n.length!==3)return null;let a=i(n[0]),o=i(n[1]);if(!a||!o||a.alg!==`EdDSA`)return null;let u;try{u=r(n[2])}catch{return null}let d=new TextEncoder().encode(`${n[0]}.${n[1]}`),p=!1;for(let e of await y(typeof a.kid==`string`?a.kid:null))if(await crypto.subtle.verify(`Ed25519`,e,u,d)){p=!0;break}if(!p||o.iss!==c||!(Array.isArray(o.aud)?o.aud:typeof o.aud==`string`?[o.aud]:[]).some(e=>typeof e==`string`&&l.has(e)))return null;let m=s()/1e3,h=f/1e3;if(typeof o.exp!=`number`||o.exp+h<=m||typeof o.nbf==`number`&&o.nbf-h>m||typeof o.sub!=`string`||o.sub===``)return null;if(t.scopes?.length){let e=new Set(typeof o.scope==`string`?o.scope.split(` `):[]);if(!t.scopes.every(t=>e.has(t)))return null}return o}}}export{e as AccountsRequestError,o as createTokenVerifier};
+import{t as e}from"./errors-C7IxbL16.js";import{n as t,r as n}from"./fetch-CM1mVzPm.js";function r(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=atob(t+`=`.repeat((4-t.length%4)%4)),r=new Uint8Array(n.length);for(let e=0;e<n.length;e++)r[e]=n.charCodeAt(e);return r}function i(e){try{let t=JSON.parse(new TextDecoder().decode(r(e)));return typeof t==`object`&&t&&!Array.isArray(t)?t:null}catch{return null}}async function a(e){let t=typeof e==`object`&&e&&Array.isArray(e.keys)?e.keys:null;if(t===null)throw Error(`The key set has no keys array`);let n=new Map;for(let[e,r]of t.entries())if(!(typeof r!=`object`||!r||r.kty!==`OKP`||r.crv!==`Ed25519`||typeof r.x!=`string`))try{let t=await crypto.subtle.importKey(`jwk`,{kty:r.kty,crv:r.crv,x:r.x},{name:`Ed25519`},!1,[`verify`]);n.set(typeof r.kid==`string`?r.kid:`#${e}`,t)}catch{}return n}function o(o){let s=o.now??Date.now,c=n(o.issuer),l=new Set(Array.isArray(o.audience)?o.audience:[o.audience]),u=o.keysMaxAgeMs??6e5,d=o.keysRetryMs??3e4,f=o.clockSkewMs??3e4,p={issuer:o.issuer,fetch:o.fetch,timeoutMs:o.requestTimeoutMs},m=null,h=null;function g(){return h??=(async()=>{try{let n=await t(p,`/api/auth/jwks`);if(!n.ok)throw new e(`Failed to load the accounts key set: ${n.status}`,n.status);let r;try{r=await a(await n.json())}catch(t){throw new e(`Failed to read the accounts key set: ${t instanceof Error?t.message:String(t)}`,n.status)}return m={keys:r,loadedAt:s()},m}finally{h=null}})(),h}async function _(){try{return await g()}catch(e){if(m)return m;throw e}}let v=-1/0;async function y(e){let t=m&&s()-m.loadedAt<u?m:await _();if(e!==null&&!t.keys.has(e)&&s()-v>=d&&(v=s(),t=await _()),e===null)return[...t.keys.values()];let n=t.keys.get(e);return n?[n]:[]}return{async verify(e,t={}){let n=e.split(`.`);if(n.length!==3)return null;let a=i(n[0]),o=i(n[1]);if(!a||!o||a.alg!==`EdDSA`)return null;let u;try{u=r(n[2])}catch{return null}let d=new TextEncoder().encode(`${n[0]}.${n[1]}`),p=!1;for(let e of await y(typeof a.kid==`string`?a.kid:null))if(await crypto.subtle.verify(`Ed25519`,e,u,d)){p=!0;break}if(!p||o.iss!==c||!(Array.isArray(o.aud)?o.aud:typeof o.aud==`string`?[o.aud]:[]).some(e=>typeof e==`string`&&l.has(e)))return null;let m=s()/1e3,h=f/1e3;if(typeof o.exp!=`number`||o.exp+h<=m||typeof o.nbf==`number`&&o.nbf-h>m||typeof o.sub!=`string`||o.sub===``)return null;if(t.scopes?.length){let e=new Set(typeof o.scope==`string`?o.scope.split(` `):[]);if(!t.scopes.every(t=>e.has(t)))return null}return o}}}export{e as AccountsRequestError,o as createTokenVerifier};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aui-auth",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Sign in through assistant-ui accounts: server side sessions for web apps (OIDC code flow with PKCE, tokens kept in the app's store, single flight refresh), the device grant for CLIs, and token verification for resource servers",
   "license": "MIT",
   "type": "module",
@@ -47,7 +47,7 @@
     }
   },
   "peerDependencies": {
-    "next": ">=15"
+    "next": ">=16.3"
   },
   "peerDependenciesMeta": {
     "next": {

package/dist/cache-m-qvewq5.js

@@ -1 +0,0 @@
-import{o as e}from"./types-B_7rFOLg.js";import{p as t}from"./oidc-0pw9wXd4.js";function n(e){if(!e)return;let t=e.split(`,`);return t[t.length-1].trim()||void 0}function r(e){let t=new URL(e.url);return`${n(e.headers.get(`x-forwarded-proto`))||t.protocol.replace(`:`,``)}://${n(e.headers.get(`x-forwarded-host`))||e.headers.get(`host`)||t.host}`}function i(e){return new URL(e).protocol===`https:`}function a(e,t){return t?`__Secure-${e}`:e}function o(e){let t=new Map;if(!e)return t;for(let n of e.split(`;`)){let e=n.indexOf(`=`);if(e===-1)continue;let r=n.slice(0,e).trim();!r||t.has(r)||t.set(r,n.slice(e+1).trim())}return t}function s(e,t){let n=o(e.headers.get(`cookie`));return n.get(a(t,!0))||n.get(a(t,!1))||null}function c(e,t,n,r){let i=[`${e}=${t}`,`Path=/`,`HttpOnly`,`SameSite=Lax`,`Max-Age=${r}`];return n&&i.push(`Secure`),i.join(`; `)}function l(e,t,n,r,o){let s=i(r);e.append(`set-cookie`,c(a(t,s),n,s,Math.floor(o/1e3)))}function u(e,t){if(t.length===0)return;let n=o(e.get(`cookie`));for(let e of t){let t=e.split(`;`)[0],r=t.indexOf(`=`);if(r<1)continue;let i=t.slice(0,r).trim(),a=t.slice(r+1).trim();a?n.set(i,a):n.delete(i)}e.set(`cookie`,[...n].map(([e,t])=>`${e}=${t}`).join(`; `))}function d(e,t){let n=i(t);return[n,!n].map(t=>c(a(e,t),``,t,0))}function f(e,t,n){for(let r of d(t,n))e.append(`set-cookie`,r)}function p(e,t=307){return new Response(null,{status:t,headers:{location:e.toString()}})}function m(e,t){return`${e}_flow_${t}`}function h(e){return btoa(JSON.stringify(e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function g(e){if(!e)return null;try{let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=JSON.parse(atob(t));return typeof n.verifier==`string`?{verifier:n.verifier,redirectPath:typeof n.redirectPath==`string`?n.redirectPath:`/`,silent:n.silent===!0}:null}catch{return null}}function _(e,t){if(!e)return`/`;let n;try{n=new URL(e,t)}catch{return`/`}return n.origin!==t||n.pathname.startsWith(`//`)?`/`:`${n.pathname}${n.search}${n.hash}`}const v=4096;function y(e){return`${e}_cache`}function b(e,t,n){if(!e.cache)return 0;let{lifetimes:r}=e,i=Math.min(t.lastValidatedAt+r.revalidateIntervalMs,t.tokens.accessTokenExpiresAt-r.refreshBeforeExpiryMs);return Math.min(e.cache.maxAgeMs,(i>n?i:n+r.retryIntervalMs)-n,t.createdAt+r.absoluteMaxAgeMs-n,t.lastValidatedAt+r.idleMaxAgeMs-n)}async function x(e,t,n){if(!e.cache)return null;let r=b(e,t,n);if(r<1e3)return null;let i={v:1,id:t.id,u:t.user,d:t.data,at:t.tokens.accessToken,ate:t.tokens.accessTokenExpiresAt,ca:t.createdAt,lv:t.lastValidatedAt,exp:n+r};return{value:await(await e.cache.codec()).encrypt(JSON.stringify(i)),maxAgeMs:r}}async function S(e,n,r,i){if(!e.cache||!n||!r)return null;let a;try{let t=await e.cache.codec();a=JSON.parse(await t.decrypt(n))}catch{return null}return a.v!==1||typeof a.exp!=`number`||a.exp<=i||a.id!==await t(r)?null:{id:a.id,user:a.u,tokens:{accessToken:a.at,refreshToken:null,idToken:null,accessTokenExpiresAt:a.ate},data:a.d,createdAt:a.ca,lastValidatedAt:a.lv,refreshLeaseUntil:null}}async function C(t,n,r,o){try{let e=await x(t,n,o);if(!e)return null;let s=i(r),l=c(a(y(t.cookieName),s),e.value,s,Math.floor(e.maxAgeMs/1e3));if(l.length>v)throw Error(`Cache cookie is ${l.length} bytes and browsers drop cookies over ${v}; the session data is too large to cache`);return l}catch(n){return e(t,`cache_cookie`,n),null}}function w(e,t){return e.cache?d(y(e.cookieName),t):[]}export{c as _,f as a,g as c,u as d,o as f,_ as g,r as h,S as i,h as l,p as m,y as n,d as o,s as p,C as r,a as s,w as t,m as u,l as v};

package/dist/oidc-0pw9wXd4.js

@@ -1 +0,0 @@
-import{n as e,r as t,t as n}from"./types-B_7rFOLg.js";function r(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function i(e){return r(crypto.getRandomValues(new Uint8Array(e)))}async function a(e){let t=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e));return r(new Uint8Array(t))}function o(e,t){return new URL(t,e).toString()}function s(e){return o(e,`/api/auth`)}function c(e){return{issuer:e.issuer,fetch:e.fetch,timeoutMs:e.lifetimes.requestTimeoutMs}}async function l(t,r,i={},a){let s=t.fetch??globalThis.fetch.bind(globalThis),c=t.timeoutMs??e.requestTimeoutMs,l=a===void 0?c:Math.min(c,a-Date.now());if(l<=0)throw new n(`Accounts request deadline passed`,0);return s(o(t.issuer,r),{...i,cache:`no-store`,signal:AbortSignal.timeout(l)})}async function u(e,t){let n=i(24),r=i(32),s=new URL(o(e.issuer,`/api/auth/oauth2/authorize`));return s.searchParams.set(`client_id`,e.clientId),s.searchParams.set(`redirect_uri`,new URL(e.paths.callback,t.origin).toString()),s.searchParams.set(`response_type`,`code`),s.searchParams.set(`scope`,e.scope),s.searchParams.set(`state`,n),s.searchParams.set(`code_challenge`,await a(r)),s.searchParams.set(`code_challenge_method`,`S256`),t.silent&&s.searchParams.set(`prompt`,`none`),{url:s.toString(),state:n,verifier:r}}function d(e,t){let n=new URL(o(e.issuer,`/api/auth/oauth2/end-session`));return n.searchParams.set(`id_token_hint`,t.idToken),n.searchParams.set(`client_id`,e.clientId),n.searchParams.set(`post_logout_redirect_uri`,new URL(e.paths.logoutComplete,t.origin).toString()),n.toString()}function f(e){return{...c(e),clientId:e.clientId,clientSecret:e.clientSecret,audience:e.audience}}async function p(e){let n=await e.text().catch(()=>``),r=`unknown_error`,i=n;try{let e=JSON.parse(n);r=e.error??r,i=e.error_description??i}catch{}return new t(e.status,r,i)}function m(e){return e.code===`invalid_target`||e.code===`invalid_request`&&/resource/i.test(e.description)}async function h(e,t,n,r=!0){let i=new URLSearchParams({client_id:e.clientId,...t});e.clientSecret&&i.set(`client_secret`,e.clientSecret),e.audience&&r&&i.set(`resource`,e.audience);let a=await l(e,`/api/auth/oauth2/token`,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i},n);if(!a.ok){let i=await p(a);if(r&&e.audience&&m(i))return h(e,t,n,!1);throw i}return await a.json()}function g(e,t){return h(f(e),{grant_type:`authorization_code`,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri})}function _(e,t,n){return h(f(e),{grant_type:`refresh_token`,refresh_token:t},n===void 0?void 0:Date.now()+n)}async function v(e,t){let r=await l(e,`/api/auth/oauth2/userinfo`,{headers:{Authorization:`Bearer ${t}`}});if(!r.ok)throw new n(`Failed to load user info: ${r.status}`,r.status);let i=await r.json();return{id:i.sub,email:i.email??``,name:i.name??i.email??i.sub,image:i.picture??null}}function y(e,t,n){return{accessToken:e.access_token,refreshToken:e.refresh_token??t?.refreshToken??null,idToken:e.id_token??t?.idToken??null,accessTokenExpiresAt:typeof e.expires_at==`number`?e.expires_at*1e3:n+(e.expires_in??3600)*1e3}}export{d as a,v as c,m as d,h as f,y as h,u as i,i as l,p as m,l as n,g as o,a as p,s as r,c as s,o as t,_ as u};

package/dist/oidc-CbVNB1IR.d.ts

@@ -1,11 +0,0 @@
-import { f as AccountsUser } from "./types-Cx223pmJ.js";
-//#region src/core/oidc.d.ts
-type AccountsFetchOptions = {
-  issuer: string;
-  fetch?: typeof fetch;
-  timeoutMs?: number;
-};
-declare function accountsEndpoint(issuer: string, path: string): string;
-declare function fetchUserInfo(options: AccountsFetchOptions, accessToken: string): Promise<AccountsUser>;
-//#endregion
-export { accountsEndpoint as n, fetchUserInfo as r, AccountsFetchOptions as t };

package/dist/types-B_7rFOLg.js

@@ -1 +0,0 @@
-function e(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function t(e){let t=``;for(let n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/g,``)}function n(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4),r;try{r=atob(n)}catch{throw Error(`Malformed encrypted value`)}let i=new Uint8Array(r.length);for(let e=0;e<r.length;e++)i[e]=r.charCodeAt(e);return i}function r(e){let r=null,i=()=>r??=crypto.subtle.importKey(`raw`,e,{name:`AES-GCM`},!1,[`encrypt`,`decrypt`]);return{async encrypt(e){let n=crypto.getRandomValues(new Uint8Array(12)),r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n},await i(),new TextEncoder().encode(e))),a=new Uint8Array(12+r.length);return a.set(n),a.set(r,12),t(a)},async decrypt(e){let t=n(e);if(t.length<28)throw Error(`Malformed encrypted value`);let r;try{r=await crypto.subtle.decrypt({name:`AES-GCM`,iv:t.subarray(0,12)},await i(),t.subarray(12))}catch{throw Error(`Malformed encrypted value`)}return new TextDecoder().decode(r)}}}function i(t){if(!/^[0-9a-fA-F]{64}$/.test(t))throw Error(`AES-GCM codec key must be 64 hex characters (32 bytes)`);return r(e(t))}function a(e){let t=null;return()=>t??=crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e)).then(e=>r(new Uint8Array(e)))}const o={login:`/api/auth/login`,callback:`/api/auth/callback`,logout:`/api/auth/logout`,logoutComplete:`/api/auth/logout-complete`,error:`/auth/error`},s={absoluteMaxAgeMs:2592e6,idleMaxAgeMs:6048e5,revalidateIntervalMs:12e4,refreshBeforeExpiryMs:3e5,flowMaxAgeMs:6e5,refreshLeaseMs:2e4,leaseWaitMs:5e3,requestTimeoutMs:1e4,retryIntervalMs:1e4},c=Object.freeze({});function l({phase:e,error:t}){console.error(`[aui-auth] ${e}`,t)}function u(e,t,n){try{e.onError({phase:t,error:n})}catch{}}function d(e){return{...e,scope:e.scope??`openid profile email offline_access`,onSignIn:e.onSignIn??(async()=>c),onRevalidate:e.onRevalidate??(async()=>c),onError:e.onError??l,revalidateUser:e.revalidateUser??!1,logout:e.logout??`global`,paths:{...o,...e.paths},lifetimes:{...s,...e.lifetimes},fetch:e.fetch??globalThis.fetch.bind(globalThis),now:e.now??Date.now,cache:e.cache?{codec:a(e.cache.secret),maxAgeMs:e.cache.maxAgeMs??6e4}:null,audience:e.audience===!1?null:e.audience??new URL(`/api/auth`,e.issuer).toString()}}var f=class extends Error{status;constructor(e,t){super(e),this.name=`AccountsRequestError`,this.status=t}},p=class extends Error{constructor(e){super(`Stored session could not be decoded`,{cause:e}),this.name=`SessionDecodeError`}},m=class extends f{code;description;constructor(e,t,n){super(`Token request failed: ${e} ${t} ${n}`,e),this.name=`OAuthTokenError`,this.code=t,this.description=n}};const h=new Set([408,425,429]);function g(e){return e instanceof f&&e.status>=400&&e.status<500&&!h.has(e.status)}export{g as a,i as c,p as i,s as n,u as o,m as r,d as s,f as t};