iterate 0.2.7 → 0.3.0

package/dist/next/app-server.mjs

@@ -0,0 +1,479 @@
+import { isSameOriginBrowserRequest, sameOriginPath } from "./lib.mjs";
+import { cookieValueOf } from "./principal.mjs";
+import { OAuthScopes } from "./oauth-scopes.mjs";
+import { t as _usingCtx } from "../usingCtx-inzbY1Qz.mjs";
+import { newHttpBatchRpcSession } from "capnweb";
+//#region src/next/app-server.ts
+/** The port separates local apps sharing localhost's cookie jar. */
+function sessionCookieName(url) {
+	return `__Host-itx-session${url.port ? `-${url.port}` : ""}`;
+}
+function appSession(namespace, request) {
+	const url = new URL(request.url);
+	const id = cookieValueOf(request.headers.get("cookie"), sessionCookieName(url));
+	return id && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/.test(id) ? namespace.getByName(`${url.origin}:${id}`) : null;
+}
+/** Start one ordinary app session; the caller publishes its cookie after its own
+* sign-in step succeeds. The issuer uses this same code/PKCE flow internally. */
+async function startAppSession(sessions, host, next) {
+	const id = crypto.randomUUID();
+	const session = sessions.getByName(`${host.origin}:${id}`);
+	return {
+		session,
+		location: await session.begin(host, next),
+		setCookie: `${sessionCookieName(new URL(host.origin))}=${id}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=2592000`
+	};
+}
+/** What an issuer a person names must be: an https ORIGIN (a path or query is dropped, not refused),
+*  not an IP literal, not loopback, and not under one of this deployment's own zones (`denyZones` —
+*  a project host on our wildcard is userspace and could serve a look-alike issuer) — unless it IS
+*  the deployment's default issuer, which is always allowed as it is. Pure: the discovery check that
+*  the origin really answers as that issuer is `issuerAnswersAt`. */
+function issuerOriginOf(candidate, options) {
+	let url;
+	try {
+		url = new URL(candidate.trim());
+	} catch {
+		return { error: "Enter the issuer's address, like https://iterate.example.workers.dev." };
+	}
+	const origin = url.origin;
+	if (origin === options.defaultIssuer) return { origin };
+	if (url.protocol !== "https:") return { error: "The issuer must be served over https." };
+	const host = url.hostname;
+	if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(host) || host.startsWith("[") || host === "localhost" || host.endsWith(".localhost")) return { error: "The issuer must have a public hostname." };
+	for (const zone of options.denyZones || []) {
+		const denied = zone.toLowerCase().replace(/^\.+/, "");
+		if (denied && (host === denied || host.endsWith(`.${denied}`))) return { error: `${host} is not an issuer this app can be connected to.` };
+	}
+	return { origin };
+}
+/** The issuer must say it is the issuer: its discovery document's `issuer` equals the origin
+*  exactly. NOTHING else is read from the document — the endpoints stay hand-built from the origin
+*  (app-session.ts: `/oauth2/token`, and `/api` as the resource), so a document can steer nothing.
+*  Null when it answers as expected, else the reason. */
+async function issuerAnswersAt(origin) {
+	try {
+		const response = await fetch(`${origin}/.well-known/oauth-authorization-server`, {
+			headers: { accept: "application/json" },
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!response.ok) return `${new URL(origin).host} does not answer as an iterate platform.`;
+		const document = await response.json();
+		const issuer = typeof document === "object" && document ? document.issuer : null;
+		if (issuer !== origin) return `${new URL(origin).host} does not answer as an iterate platform (its issuer is ${typeof issuer === "string" ? issuer : "missing"}).`;
+		return null;
+	} catch {
+		return `${new URL(origin).host} could not be reached.`;
+	}
+}
+/** `next` as a same-origin path with any `issuer` query parameter removed — an issuer rides in
+*  through `/.auth/connect` and nowhere else, so a `next` can never carry one back into a login
+*  (the Sign-in-again form returns to the very login URL that showed it). Untouched when there is
+*  none to remove, so what a page sent stays byte for byte. */
+function nextPathOf(next, origin) {
+	const path = sameOriginPath(next || "/", origin);
+	const url = new URL(path, origin);
+	if (!url.searchParams.has("issuer")) return path;
+	url.searchParams.delete("issuer");
+	return url.pathname + url.search;
+}
+/** What the app's own sign-in currently is, for the Sign-in-again page to show: who it is signed in
+*  as, and the projects it reaches — its grant, the thing that turned out not to include the project
+*  the page named. One bounded HTTP-batch read of the platform (the logout path's shape), best
+*  effort: a slow or failed read simply leaves those lines off, the page still works. */
+async function grantSummary(resource, bearer) {
+	try {
+		var _usingCtx$1 = _usingCtx();
+		const api = _usingCtx$1.u(newHttpBatchRpcSession(new Request(resource, {
+			headers: { Authorization: `Bearer ${bearer}` },
+			signal: AbortSignal.timeout(5e3)
+		})));
+		const session = _usingCtx$1.u(api.authenticate({ type: "from-server-cookie" }));
+		const info = session.info();
+		const projects = session.projects.list();
+		const [{ principal }, list] = await Promise.all([info, projects]);
+		return {
+			email: principal.email,
+			projects: list.map((project) => project.slug)
+		};
+	} catch (_) {
+		_usingCtx$1.e = _;
+	} finally {
+		_usingCtx$1.d();
+	}
+}
+/** What each scope is, to the person, in one or two words — the Sign-in-again page's permissions
+*  line. The consent page (public/authorize.js) spells the same three at sentence length. */
+const scopeLabels = {
+	iterate: "your projects",
+	account: "your account",
+	"organizations:write": "your organizations"
+};
+const text = (value) => value.replace(/[&<>"]/g, (c) => `&#${c.charCodeAt(0)};`);
+/** The gate's own pages, dressed without asking anyone: the issuer's stylesheet is loaded only when
+*  the issuer is the deployment's own (a stylesheet is a document's dress, and an issuer a person
+*  typed does not get to dress a page on this origin). */
+const inlinePageCss = `body{margin:0;min-height:100svh;display:grid;place-items:center;font:15px/1.5 ui-sans-serif,system-ui,sans-serif;color:#18181b;background:#fafafa}main{width:min(28rem,calc(100% - 2rem));padding:2rem;background:#fff;border:1px solid #e4e4e7;border-radius:12px}h1{font-size:1.25rem;margin:0 0 .75rem}p{margin:0 0 .75rem}.muted{color:#71717a}code{font:.9em ui-monospace,SFMono-Regular,Menlo,monospace}button,.button{display:inline-block;padding:.55rem 1rem;border:0;border-radius:8px;background:#18181b;color:#fff;font:inherit;cursor:pointer;text-decoration:none}a.quiet{color:#71717a;margin-left:1rem}`;
+/** A page of the gate's own: `head` is what the head carries beyond the title, `body` the card. */
+function gatePage(input) {
+	return new Response(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${text(input.title)}</title>${input.head}</head><body><main class="issuer-card">${input.body}</main></body></html>`, {
+		status: input.status ?? 200,
+		headers: {
+			"Content-Type": "text/html; charset=utf-8",
+			"Cache-Control": "no-store",
+			"Content-Security-Policy": input.csp,
+			"X-Frame-Options": "DENY"
+		}
+	});
+}
+/** The head and the CSP of a gate page: the deployment's own issuer dresses it (its stylesheet, its
+*  logo); any other issuer gets the inline dress and nothing of its own on this origin. */
+function dressOf(issuer, defaultIssuer) {
+	if (issuer === defaultIssuer) return {
+		head: `<link rel="stylesheet" href="${issuer}/issuer.css"><link rel="icon" href="${issuer}/iterate-logo.svg" type="image/svg+xml">`,
+		csp: `default-src 'none'; style-src ${issuer}; img-src ${issuer}; form-action 'self'; frame-ancestors 'none'`,
+		mark: `<img class="issuer-mark" src="${issuer}/iterate-logo.svg" alt="" width="56" height="56">`
+	};
+	return {
+		head: `<style>${inlinePageCss}</style>`,
+		csp: "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'",
+		mark: ""
+	};
+}
+/** The sign-in this browser holds does not cover what the page needs: a project the page named
+*  (`?project=`, the page's own word — its `/projects/<ref>` was absent from the session's list; the
+*  page is not verified, it only offers a sign-out the person must click) or a permission the app
+*  asks for. One page for both, on the app's origin because ending its session is a same-origin
+*  POST. It shows who the app is signed in as, through which issuer, and the projects that sign-in
+*  reaches (its grant), then one button that ends this app's session and comes straight back to
+*  `/.auth/login`, which starts a fresh one — the issuer still knows the person, so they land on
+*  consent: the project to tick, or Switch account — and returns to the page that sent them. */
+async function signInAgainPage(input) {
+	const { url, issuer, resource, defaultIssuer, bearer, scopes, project } = input;
+	const lacks = project ? `does not include a project called <code>${text(project)}</code>` : "does not include a permission this app asks for";
+	const grant = await grantSummary(resource, bearer).catch(() => null);
+	const reaches = grant ? grant.projects.length ? `It reaches ${grant.projects.slice(0, 12).map((slug) => `<code>${text(slug)}</code>`).join(", ")}${grant.projects.length > 12 ? ` and ${grant.projects.length - 12} more` : ""}.` : "It reaches no projects yet." : "";
+	const permissions = `Permissions: ${scopes.map((scope) => scopeLabels[scope] || scope).join(", ")}.`;
+	const signedIn = [
+		grant?.email ? `Signed in as <strong>${text(grant.email)}</strong>` : "Signed in",
+		` through <strong>${text(new URL(issuer).host)}</strong>.`,
+		reaches,
+		permissions
+	].filter(Boolean).join(" ").replace("</strong>  through", "</strong> through");
+	const dress = dressOf(issuer, defaultIssuer);
+	const back = nextPathOf(url.pathname + url.search, url.origin);
+	return gatePage({
+		title: "Sign in again",
+		head: dress.head,
+		csp: dress.csp,
+		body: `${dress.mark}<h1>Sign in again</h1><p>Your sign-in to <strong>${text(url.host)}</strong> ${lacks}.</p><p class="muted">${signedIn}</p><p class="muted">Signing in again brings you back here. At consent, tick the project — or switch account.</p><form method="post" action="/.auth/logout?next=${encodeURIComponent(back)}"><button class="primary" type="submit">Sign in again</button></form>`
+	});
+}
+/** `/.auth/connect` — the one page that may bind this browser to an issuer other than the
+*  deployment's own: it names the issuer's host in plain text, says what it will end, and asks. The
+*  Continue button is a same-origin POST; the page loads nothing from the issuer it names. */
+function connectPage(input) {
+	const { url, origin, next, scope, held, defaultIssuer } = input;
+	const host = new URL(origin).host;
+	const ends = held && held.issuer !== origin ? `<p class="muted">This ends your current sign-in through <strong>${text(new URL(held.issuer).host)}</strong>.</p>` : "";
+	const dress = dressOf(defaultIssuer, defaultIssuer);
+	return gatePage({
+		title: `Connect to ${host}`,
+		head: dress.head,
+		csp: dress.csp,
+		body: `${dress.mark}<h1>Connect ${text(url.host)} to <code>${text(host)}</code>?</h1><p>This app will sign you in through <strong>${text(host)}</strong> and show what that platform holds. Continue only if that is your own iterate platform.</p>${ends}<form method="post" action="/.auth/connect"><input type="hidden" name="issuer" value="${text(origin)}"><input type="hidden" name="next" value="${text(next)}">${scope ? `<input type="hidden" name="scope" value="${text(scope)}">` : ""}<button class="primary" type="submit">Continue</button><a class="quiet" href="/">Cancel</a></form>`
+	});
+}
+/** A refusal of the gate's own, as a page the person can read. */
+function refusalPage(defaultIssuer, message, status = 400) {
+	const dress = dressOf(defaultIssuer, defaultIssuer);
+	return gatePage({
+		title: "Cannot connect",
+		head: dress.head,
+		csp: dress.csp,
+		status,
+		body: `${dress.mark}<h1>Cannot connect</h1><p>${text(message)}</p><p><a class="button" href="/">Back</a></p>`
+	});
+}
+/** The same OAuth client and /api proxy on a platform host or a separate app worker. */
+async function appAuth(request, config) {
+	const url = new URL(request.url);
+	const { issuer, resource, sessions } = config;
+	const client = config.client && {
+		name: config.client.name,
+		logoUri: new URL(config.client.logoUri, url.origin).href
+	};
+	const session = appSession(sessions, request);
+	const clearCookie = `${sessionCookieName(url)}=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0`;
+	/** Where THIS browser's credential goes: its session's record, else the deployment's own. A record
+	*  bound to a CONNECTED issuer whose resource is not that issuer's `/api` is not one this code
+	*  wrote — it is dropped (the deployment's own issuer may name its resource as it likes). */
+	const held = async () => {
+		const host = await session?.host();
+		if (!host) return null;
+		if (host.issuer !== issuer && host.resource !== `${host.issuer}/api`) {
+			await session.discard();
+			return null;
+		}
+		return host;
+	};
+	if (url.pathname === "/.auth/client.json") return Response.json({
+		client_id: `${url.origin}/.auth/client.json`,
+		client_name: client?.name || url.host,
+		client_uri: url.origin,
+		logo_uri: client?.logoUri,
+		redirect_uris: [`${url.origin}/.auth/callback`],
+		token_endpoint_auth_method: "none",
+		grant_types: ["authorization_code", "refresh_token"],
+		response_types: ["code"]
+	}, { headers: { "Cache-Control": "public, max-age=300" } });
+	if (url.pathname === "/.auth/session.json") {
+		if (request.method !== "GET") return new Response("Method not allowed", { status: 405 });
+		const host = await held();
+		return Response.json({
+			issuer: host?.issuer ?? null,
+			defaultIssuer: issuer
+		}, { headers: { "Cache-Control": "no-store" } });
+	}
+	if (url.pathname === "/.auth/connect") {
+		if (config.loginPage) return new Response("Not found", { status: 404 });
+		if (request.method === "GET") {
+			const named = issuerOriginOf(url.searchParams.get("issuer") ?? "", {
+				defaultIssuer: issuer,
+				denyZones: config.denyZones
+			});
+			if ("error" in named) return refusalPage(issuer, named.error);
+			const next = nextPathOf(url.searchParams.get("next"), url.origin);
+			const scope = url.searchParams.get("scope");
+			const host = await held();
+			if (named.origin === issuer && (!host || host.issuer === issuer)) return new Response(null, {
+				status: 303,
+				headers: {
+					Location: `/.auth/login?${new URLSearchParams({
+						next,
+						scope: scope || ""
+					})}`,
+					"Cache-Control": "no-store"
+				}
+			});
+			return connectPage({
+				url,
+				origin: named.origin,
+				next,
+				scope,
+				held: host,
+				defaultIssuer: issuer
+			});
+		}
+		if (request.method !== "POST") return new Response("Method not allowed", { status: 405 });
+		if (!isSameOriginBrowserRequest(request)) return new Response("Cross-site request refused", { status: 403 });
+		const form = await request.formData();
+		const named = issuerOriginOf(String(form.get("issuer") ?? ""), {
+			defaultIssuer: issuer,
+			denyZones: config.denyZones
+		});
+		if ("error" in named) return refusalPage(issuer, named.error);
+		const next = nextPathOf(String(form.get("next") ?? "/"), url.origin);
+		const parsed = OAuthScopes.safeParse(String(form.get("scope") ?? "").split(" ").filter(Boolean));
+		if (!parsed.success) return refusalPage(issuer, "Unsupported permission.");
+		if (named.origin !== issuer) {
+			const refused = await issuerAnswersAt(named.origin);
+			if (refused) return refusalPage(issuer, refused);
+		}
+		const host = await held();
+		if (host?.issuer === named.origin) return new Response(null, {
+			status: 303,
+			headers: {
+				Location: `/.auth/login?${new URLSearchParams({
+					next,
+					scope: parsed.data.join(" ")
+				})}`,
+				"Cache-Control": "no-store"
+			}
+		});
+		if (host) try {
+			await session.end();
+		} catch {
+			await session.discard();
+		}
+		const { location, setCookie } = await startAppSession(sessions, {
+			origin: url.origin,
+			client,
+			issuer: named.origin,
+			resource: `${named.origin}/api`,
+			scopes: parsed.data
+		}, next);
+		return new Response(null, {
+			status: 302,
+			headers: {
+				Location: location,
+				"Set-Cookie": setCookie,
+				"Cache-Control": "no-store",
+				"Referrer-Policy": "no-referrer"
+			}
+		});
+	}
+	if (url.pathname === "/.auth/login") {
+		if (request.method !== "GET") return new Response("Method not allowed", { status: 405 });
+		const next = nextPathOf(url.searchParams.get("next"), url.origin);
+		const scope = url.searchParams.get("scope");
+		const parsed = OAuthScopes.safeParse(scope ? scope.split(" ").filter(Boolean) : []);
+		if (!parsed.success) return new Response("Unsupported permission", { status: 400 });
+		const scopes = parsed.data;
+		const requested = url.searchParams.get("issuer");
+		if (requested && !config.loginPage) {
+			const named = issuerOriginOf(requested, {
+				defaultIssuer: issuer,
+				denyZones: config.denyZones
+			});
+			if ("error" in named || named.origin !== issuer) return new Response(null, {
+				status: 303,
+				headers: {
+					Location: `/.auth/connect?${new URLSearchParams({
+						issuer: requested,
+						next,
+						scope: scope || ""
+					})}`,
+					"Cache-Control": "no-store"
+				}
+			});
+		}
+		const target = await held() || {
+			issuer,
+			resource
+		};
+		const bearer = await session?.bearer();
+		if (bearer) {
+			const probe = await config.api(new Request(target.resource, {
+				method: "POST",
+				body: "",
+				headers: { Authorization: `Bearer ${bearer}` }
+			}));
+			await probe.body?.cancel();
+			if (probe.status !== 401) {
+				if (!probe.ok) throw new Error(`iterate API check failed (${probe.status})`);
+				const heldScopes = await session.scopes();
+				const project = url.searchParams.get("project");
+				if (!project && scopes.every((scope) => heldScopes.includes(scope))) return new Response(null, {
+					status: 303,
+					headers: {
+						Location: next,
+						"Cache-Control": "no-store"
+					}
+				});
+				return signInAgainPage({
+					url,
+					issuer: target.issuer,
+					resource: target.resource,
+					defaultIssuer: issuer,
+					bearer,
+					scopes: heldScopes,
+					project
+				});
+			}
+			await session.discard();
+		}
+		if (config.loginPage) return new Response(null, {
+			status: 303,
+			headers: {
+				Location: `${config.loginPage}?${new URLSearchParams({ next })}`,
+				"Cache-Control": "no-store"
+			}
+		});
+		const { location, setCookie } = await startAppSession(sessions, {
+			origin: url.origin,
+			issuer: target.issuer,
+			resource: target.resource,
+			scopes,
+			client
+		}, next);
+		return new Response(null, {
+			status: 302,
+			headers: {
+				Location: location,
+				"Set-Cookie": setCookie,
+				"Cache-Control": "no-store",
+				"Referrer-Policy": "no-referrer"
+			}
+		});
+	}
+	if (url.pathname === "/.auth/callback") {
+		if (request.method !== "GET") return new Response("Method not allowed", { status: 405 });
+		const result = await session?.complete(url.search);
+		if (!result || result.error) return new Response(result?.error || "Sign-in does not match this browser.", {
+			status: 400,
+			headers: {
+				"Cache-Control": "no-store",
+				"Referrer-Policy": "no-referrer"
+			}
+		});
+		return new Response(null, {
+			status: 303,
+			headers: {
+				Location: result.next,
+				"Cache-Control": "no-store",
+				"Referrer-Policy": "no-referrer"
+			}
+		});
+	}
+	if (url.pathname === "/.auth/logout") {
+		if (request.method !== "POST") return new Response("Method not allowed", { status: 405 });
+		if (!isSameOriginBrowserRequest(request)) return new Response("Cross-site request refused", { status: 403 });
+		const ended = await held();
+		try {
+			await session?.end();
+		} catch {
+			console.error("oauth.app_logout_failed", { origin: url.origin });
+			return new Response("Sign-out could not complete. Your session is still present; go back and try again.", { status: 503 });
+		}
+		const next = nextPathOf(url.searchParams.get("next"), url.origin);
+		const nextUrl = new URL(next, url.origin);
+		const scope = nextUrl.pathname === "/.auth/login" ? nextUrl.searchParams.get("scope") || "" : "";
+		const headers = new Headers({
+			Location: ended && ended.issuer !== issuer && !config.loginPage ? `/.auth/connect?${new URLSearchParams({
+				issuer: ended.issuer,
+				next,
+				scope
+			})}` : next,
+			"Set-Cookie": clearCookie,
+			"Cache-Control": "no-store"
+		});
+		return new Response(null, {
+			status: 303,
+			headers
+		});
+	}
+	if (url.pathname === "/api") {
+		let token = request.headers.get("authorization");
+		let cookieAuth = false;
+		if (!token && request.method !== "OPTIONS") {
+			const bearer = session && request.headers.get("origin") === url.origin ? await session.bearer() : null;
+			if (bearer) {
+				token = `Bearer ${bearer}`;
+				cookieAuth = true;
+			}
+		}
+		const target = await held() ?? {
+			issuer,
+			resource
+		};
+		const headers = new Headers(request.headers);
+		headers.delete("cookie");
+		if (request.headers.get("upgrade")?.toLowerCase() === "websocket") headers.delete("origin");
+		if (token) headers.set("authorization", token);
+		const response = await config.api(new Request(target.resource, new Request(request, { headers })));
+		if (cookieAuth && response.status === 401) {
+			await session.discard();
+			const denied = new Response(response.body, response);
+			denied.headers.append("Set-Cookie", clearCookie);
+			return denied;
+		}
+		return response;
+	}
+	if (url.pathname.startsWith("/.auth/")) return new Response("Not found", { status: 404 });
+	return null;
+}
+//#endregion
+export { appAuth, appSession, issuerOriginOf, startAppSession };
+
+//# sourceMappingURL=app-server.mjs.map

package/dist/next/app-server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-server.mjs","names":[],"sources":["../../src/next/app-server.ts"],"sourcesContent":["// app-server.ts — THE BROWSER-AUTH GATE every app worker runs first: the OAuth client (one CIMD\n// client id per app origin, PKCE, the `__Host-` cookie), the `/api` proxy, and the few pages the gate\n// serves itself. A browser session is an ordinary OAuth client of ONE issuer — by default the\n// deployment's own (`config.issuer`), or any os-next issuer a person CONNECTS the app to on purpose (a\n// self-hosted platform). Connecting is deliberate: a same-origin POST from `/.auth/connect`, a page\n// that names the issuer and asks — never a link, because a link would be a forced login: it could\n// bind a browser to an issuer of the linker's choosing, and the app would then show that issuer's\n// world as the person's. Once a session exists, its record is the ONLY source of where the credential\n// goes (`BrowserSession.host()`): the login probe, the `/api` proxy and logout all read it there.\n// eslint-disable-next-line iterate/no-capnweb-http-batch -- One bounded read for the Sign-in-again page, no live capabilities.\nimport { newHttpBatchRpcSession } from \"capnweb\";\nimport type { BrowserHost, BrowserSession } from \"./app-session.ts\";\nimport type { IterateApi } from \"./api.ts\";\nimport { cookieValueOf } from \"./principal.ts\";\nimport { isSameOriginBrowserRequest, sameOriginPath } from \"./lib.ts\";\nimport { OAuthScopes } from \"./oauth-scopes.ts\";\n\n/** The port separates local apps sharing localhost's cookie jar. */\nfunction sessionCookieName(url: URL) {\n  return `__Host-itx-session${url.port ? `-${url.port}` : \"\"}`;\n}\nexport function appSession(namespace: DurableObjectNamespace<BrowserSession>, request: Request) {\n  const url = new URL(request.url);\n  const id = cookieValueOf(request.headers.get(\"cookie\"), sessionCookieName(url));\n  return id && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/.test(id)\n    ? namespace.getByName(`${url.origin}:${id}`)\n    : null;\n}\n\n/** Start one ordinary app session; the caller publishes its cookie after its own\n * sign-in step succeeds. The issuer uses this same code/PKCE flow internally. */\nexport async function startAppSession(\n  sessions: DurableObjectNamespace<BrowserSession>,\n  host: BrowserHost,\n  next: string,\n) {\n  const id = crypto.randomUUID();\n  const session = sessions.getByName(`${host.origin}:${id}`);\n  const location = await session.begin(host, next);\n  const setCookie = `${sessionCookieName(new URL(host.origin))}=${id}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=2592000`;\n  return { session, location, setCookie };\n}\n\n/** What an issuer a person names must be: an https ORIGIN (a path or query is dropped, not refused),\n *  not an IP literal, not loopback, and not under one of this deployment's own zones (`denyZones` —\n *  a project host on our wildcard is userspace and could serve a look-alike issuer) — unless it IS\n *  the deployment's default issuer, which is always allowed as it is. Pure: the discovery check that\n *  the origin really answers as that issuer is `issuerAnswersAt`. */\nexport function issuerOriginOf(\n  candidate: string,\n  options: { defaultIssuer: string; denyZones?: readonly string[] },\n): { origin: string } | { error: string } {\n  let url: URL;\n  try {\n    url = new URL(candidate.trim());\n  } catch {\n    return { error: \"Enter the issuer's address, like https://iterate.example.workers.dev.\" };\n  }\n  const origin = url.origin;\n  if (origin === options.defaultIssuer) return { origin };\n  if (url.protocol !== \"https:\") return { error: \"The issuer must be served over https.\" };\n  const host = url.hostname;\n  if (\n    /^\\d{1,3}(?:\\.\\d{1,3}){3}$/.test(host) ||\n    host.startsWith(\"[\") ||\n    host === \"localhost\" ||\n    host.endsWith(\".localhost\")\n  )\n    return { error: \"The issuer must have a public hostname.\" };\n  for (const zone of options.denyZones || []) {\n    const denied = zone.toLowerCase().replace(/^\\.+/, \"\");\n    if (denied && (host === denied || host.endsWith(`.${denied}`)))\n      return { error: `${host} is not an issuer this app can be connected to.` };\n  }\n  return { origin };\n}\n\n/** The issuer must say it is the issuer: its discovery document's `issuer` equals the origin\n *  exactly. NOTHING else is read from the document — the endpoints stay hand-built from the origin\n *  (app-session.ts: `/oauth2/token`, and `/api` as the resource), so a document can steer nothing.\n *  Null when it answers as expected, else the reason. */\nasync function issuerAnswersAt(origin: string): Promise<string | null> {\n  try {\n    const response = await fetch(`${origin}/.well-known/oauth-authorization-server`, {\n      headers: { accept: \"application/json\" },\n      signal: AbortSignal.timeout(10_000),\n    });\n    if (!response.ok) return `${new URL(origin).host} does not answer as an iterate platform.`;\n    const document: unknown = await response.json();\n    const issuer =\n      typeof document === \"object\" && document ? (document as { issuer?: unknown }).issuer : null;\n    if (issuer !== origin)\n      return `${new URL(origin).host} does not answer as an iterate platform (its issuer is ${typeof issuer === \"string\" ? issuer : \"missing\"}).`;\n    return null;\n  } catch {\n    return `${new URL(origin).host} could not be reached.`;\n  }\n}\n\n/** `next` as a same-origin path with any `issuer` query parameter removed — an issuer rides in\n *  through `/.auth/connect` and nowhere else, so a `next` can never carry one back into a login\n *  (the Sign-in-again form returns to the very login URL that showed it). Untouched when there is\n *  none to remove, so what a page sent stays byte for byte. */\nfunction nextPathOf(next: string | null, origin: string): string {\n  const path = sameOriginPath(next || \"/\", origin);\n  const url = new URL(path, origin);\n  if (!url.searchParams.has(\"issuer\")) return path;\n  url.searchParams.delete(\"issuer\");\n  return url.pathname + url.search;\n}\n\n/** What the app's own sign-in currently is, for the Sign-in-again page to show: who it is signed in\n *  as, and the projects it reaches — its grant, the thing that turned out not to include the project\n *  the page named. One bounded HTTP-batch read of the platform (the logout path's shape), best\n *  effort: a slow or failed read simply leaves those lines off, the page still works. */\nasync function grantSummary(resource: string, bearer: string) {\n  // eslint-disable-next-line iterate/no-capnweb-http-batch -- One bounded read, no live capabilities.\n  using api = newHttpBatchRpcSession<IterateApi>(\n    new Request(resource, {\n      headers: { Authorization: `Bearer ${bearer}` },\n      signal: AbortSignal.timeout(5_000),\n    }),\n  );\n  using session = api.authenticate({ type: \"from-server-cookie\" });\n  const info = session.info();\n  const projects = session.projects.list();\n  const [{ principal }, list] = await Promise.all([info, projects]);\n  return { email: principal.email, projects: list.map((project) => project.slug) };\n}\n\n/** What each scope is, to the person, in one or two words — the Sign-in-again page's permissions\n *  line. The consent page (public/authorize.js) spells the same three at sentence length. */\nconst scopeLabels: Record<string, string> = {\n  iterate: \"your projects\",\n  account: \"your account\",\n  \"organizations:write\": \"your organizations\",\n};\n\nconst text = (value: string) => value.replace(/[&<>\"]/g, (c) => `&#${c.charCodeAt(0)};`);\n\n/** The gate's own pages, dressed without asking anyone: the issuer's stylesheet is loaded only when\n *  the issuer is the deployment's own (a stylesheet is a document's dress, and an issuer a person\n *  typed does not get to dress a page on this origin). */\nconst inlinePageCss = `body{margin:0;min-height:100svh;display:grid;place-items:center;font:15px/1.5 ui-sans-serif,system-ui,sans-serif;color:#18181b;background:#fafafa}main{width:min(28rem,calc(100% - 2rem));padding:2rem;background:#fff;border:1px solid #e4e4e7;border-radius:12px}h1{font-size:1.25rem;margin:0 0 .75rem}p{margin:0 0 .75rem}.muted{color:#71717a}code{font:.9em ui-monospace,SFMono-Regular,Menlo,monospace}button,.button{display:inline-block;padding:.55rem 1rem;border:0;border-radius:8px;background:#18181b;color:#fff;font:inherit;cursor:pointer;text-decoration:none}a.quiet{color:#71717a;margin-left:1rem}`;\n\n/** A page of the gate's own: `head` is what the head carries beyond the title, `body` the card. */\nfunction gatePage(input: {\n  title: string;\n  head: string;\n  body: string;\n  csp: string;\n  status?: number;\n}): Response {\n  return new Response(\n    `<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>${text(input.title)}</title>${input.head}</head><body><main class=\"issuer-card\">${input.body}</main></body></html>`,\n    {\n      status: input.status ?? 200,\n      headers: {\n        \"Content-Type\": \"text/html; charset=utf-8\",\n        \"Cache-Control\": \"no-store\",\n        \"Content-Security-Policy\": input.csp,\n        \"X-Frame-Options\": \"DENY\",\n      },\n    },\n  );\n}\n\n/** The head and the CSP of a gate page: the deployment's own issuer dresses it (its stylesheet, its\n *  logo); any other issuer gets the inline dress and nothing of its own on this origin. */\nfunction dressOf(\n  issuer: string,\n  defaultIssuer: string,\n): { head: string; csp: string; mark: string } {\n  if (issuer === defaultIssuer)\n    return {\n      head: `<link rel=\"stylesheet\" href=\"${issuer}/issuer.css\"><link rel=\"icon\" href=\"${issuer}/iterate-logo.svg\" type=\"image/svg+xml\">`,\n      csp: `default-src 'none'; style-src ${issuer}; img-src ${issuer}; form-action 'self'; frame-ancestors 'none'`,\n      mark: `<img class=\"issuer-mark\" src=\"${issuer}/iterate-logo.svg\" alt=\"\" width=\"56\" height=\"56\">`,\n    };\n  return {\n    head: `<style>${inlinePageCss}</style>`,\n    csp: \"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'\",\n    mark: \"\",\n  };\n}\n\n/** The sign-in this browser holds does not cover what the page needs: a project the page named\n *  (`?project=`, the page's own word — its `/projects/<ref>` was absent from the session's list; the\n *  page is not verified, it only offers a sign-out the person must click) or a permission the app\n *  asks for. One page for both, on the app's origin because ending its session is a same-origin\n *  POST. It shows who the app is signed in as, through which issuer, and the projects that sign-in\n *  reaches (its grant), then one button that ends this app's session and comes straight back to\n *  `/.auth/login`, which starts a fresh one — the issuer still knows the person, so they land on\n *  consent: the project to tick, or Switch account — and returns to the page that sent them. */\nasync function signInAgainPage(input: {\n  url: URL;\n  issuer: string;\n  resource: string;\n  defaultIssuer: string;\n  bearer: string;\n  scopes: string[];\n  project: string | null;\n}) {\n  const { url, issuer, resource, defaultIssuer, bearer, scopes, project } = input;\n  const lacks = project\n    ? `does not include a project called <code>${text(project)}</code>`\n    : \"does not include a permission this app asks for\";\n  const grant = await grantSummary(resource, bearer).catch(() => null);\n  const reaches = grant\n    ? grant.projects.length\n      ? `It reaches ${grant.projects\n          .slice(0, 12)\n          .map((slug) => `<code>${text(slug)}</code>`)\n          .join(\n            \", \",\n          )}${grant.projects.length > 12 ? ` and ${grant.projects.length - 12} more` : \"\"}.`\n      : \"It reaches no projects yet.\"\n    : \"\";\n  const permissions = `Permissions: ${scopes.map((scope) => scopeLabels[scope] || scope).join(\", \")}.`;\n  const signedIn = [\n    grant?.email ? `Signed in as <strong>${text(grant.email)}</strong>` : \"Signed in\",\n    ` through <strong>${text(new URL(issuer).host)}</strong>.`,\n    reaches,\n    permissions,\n  ]\n    .filter(Boolean)\n    .join(\" \")\n    .replace(\"</strong>  through\", \"</strong> through\");\n  const dress = dressOf(issuer, defaultIssuer);\n  const back = nextPathOf(url.pathname + url.search, url.origin);\n  return gatePage({\n    title: \"Sign in again\",\n    head: dress.head,\n    csp: dress.csp,\n    body: `${dress.mark}<h1>Sign in again</h1><p>Your sign-in to <strong>${text(url.host)}</strong> ${lacks}.</p><p class=\"muted\">${signedIn}</p><p class=\"muted\">Signing in again brings you back here. At consent, tick the project — or switch account.</p><form method=\"post\" action=\"/.auth/logout?next=${encodeURIComponent(back)}\"><button class=\"primary\" type=\"submit\">Sign in again</button></form>`,\n  });\n}\n\n/** `/.auth/connect` — the one page that may bind this browser to an issuer other than the\n *  deployment's own: it names the issuer's host in plain text, says what it will end, and asks. The\n *  Continue button is a same-origin POST; the page loads nothing from the issuer it names. */\nfunction connectPage(input: {\n  url: URL;\n  origin: string;\n  next: string;\n  scope: string | null;\n  held: { issuer: string } | null;\n  defaultIssuer: string;\n}): Response {\n  const { url, origin, next, scope, held, defaultIssuer } = input;\n  const host = new URL(origin).host;\n  const ends =\n    held && held.issuer !== origin\n      ? `<p class=\"muted\">This ends your current sign-in through <strong>${text(new URL(held.issuer).host)}</strong>.</p>`\n      : \"\";\n  const dress = dressOf(defaultIssuer, defaultIssuer);\n  return gatePage({\n    title: `Connect to ${host}`,\n    head: dress.head,\n    csp: dress.csp,\n    body: `${dress.mark}<h1>Connect ${text(url.host)} to <code>${text(host)}</code>?</h1><p>This app will sign you in through <strong>${text(host)}</strong> and show what that platform holds. Continue only if that is your own iterate platform.</p>${ends}<form method=\"post\" action=\"/.auth/connect\"><input type=\"hidden\" name=\"issuer\" value=\"${text(origin)}\"><input type=\"hidden\" name=\"next\" value=\"${text(next)}\">${scope ? `<input type=\"hidden\" name=\"scope\" value=\"${text(scope)}\">` : \"\"}<button class=\"primary\" type=\"submit\">Continue</button><a class=\"quiet\" href=\"/\">Cancel</a></form>`,\n  });\n}\n\n/** A refusal of the gate's own, as a page the person can read. */\nfunction refusalPage(defaultIssuer: string, message: string, status = 400): Response {\n  const dress = dressOf(defaultIssuer, defaultIssuer);\n  return gatePage({\n    title: \"Cannot connect\",\n    head: dress.head,\n    csp: dress.csp,\n    status,\n    body: `${dress.mark}<h1>Cannot connect</h1><p>${text(message)}</p><p><a class=\"button\" href=\"/\">Back</a></p>`,\n  });\n}\n\ntype AppAuth = {\n  /** Public app branding; relative logo paths resolve against this app's origin. */\n  client?: { name: string; logoUri: string };\n  sessions: DurableObjectNamespace<BrowserSession>;\n  /** The deployment's own issuer — where a browser with no session signs in. */\n  issuer: string;\n  /** Its `/api`. */\n  resource: string;\n  /** Platform dispatches in process to avoid /api recursion; other apps pass fetch. */\n  api: (request: Request) => Promise<Response> | Response;\n  /** The issuer proves identity before establishing its own ordinary app session. */\n  loginPage?: string;\n  /** Zones no connectable issuer may live under (`issuerOriginOf`): this deployment's own, whose\n   *  project hosts are userspace. The default issuer is exempt. */\n  denyZones?: readonly string[];\n};\n\n/** The same OAuth client and /api proxy on a platform host or a separate app worker. */\nexport async function appAuth(request: Request, config: AppAuth): Promise<Response | null> {\n  const url = new URL(request.url);\n  const { issuer, resource, sessions } = config;\n  const client = config.client && {\n    name: config.client.name,\n    logoUri: new URL(config.client.logoUri, url.origin).href,\n  };\n  const session = appSession(sessions, request);\n  const clearCookie = `${sessionCookieName(url)}=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0`;\n  /** Where THIS browser's credential goes: its session's record, else the deployment's own. A record\n   *  bound to a CONNECTED issuer whose resource is not that issuer's `/api` is not one this code\n   *  wrote — it is dropped (the deployment's own issuer may name its resource as it likes). */\n  const held = async (): Promise<{ issuer: string; resource: string } | null> => {\n    const host = await session?.host();\n    if (!host) return null;\n    if (host.issuer !== issuer && host.resource !== `${host.issuer}/api`) {\n      await session!.discard();\n      return null;\n    }\n    return host;\n  };\n  if (url.pathname === \"/.auth/client.json\")\n    return Response.json(\n      {\n        client_id: `${url.origin}/.auth/client.json`,\n        client_name: client?.name || url.host,\n        client_uri: url.origin,\n        logo_uri: client?.logoUri,\n        redirect_uris: [`${url.origin}/.auth/callback`],\n        token_endpoint_auth_method: \"none\",\n        grant_types: [\"authorization_code\", \"refresh_token\"],\n        response_types: [\"code\"],\n      },\n      { headers: { \"Cache-Control\": \"public, max-age=300\" } },\n    );\n\n  if (url.pathname === \"/.auth/session.json\") {\n    // which issuer this browser is connected to — the app's shell says so when it is not the\n    // deployment's own; no credential, no identity, nothing a page on another origin could use\n    if (request.method !== \"GET\") return new Response(\"Method not allowed\", { status: 405 });\n    const host = await held();\n    return Response.json(\n      { issuer: host?.issuer ?? null, defaultIssuer: issuer },\n      { headers: { \"Cache-Control\": \"no-store\" } },\n    );\n  }\n\n  if (url.pathname === \"/.auth/connect\") {\n    if (config.loginPage) return new Response(\"Not found\", { status: 404 });\n    if (request.method === \"GET\") {\n      const named = issuerOriginOf(url.searchParams.get(\"issuer\") ?? \"\", {\n        defaultIssuer: issuer,\n        denyZones: config.denyZones,\n      });\n      if (\"error\" in named) return refusalPage(issuer, named.error);\n      const next = nextPathOf(url.searchParams.get(\"next\"), url.origin);\n      const scope = url.searchParams.get(\"scope\");\n      const host = await held();\n      // the deployment's own issuer needs no asking when this browser is not bound elsewhere\n      if (named.origin === issuer && (!host || host.issuer === issuer))\n        return new Response(null, {\n          status: 303,\n          headers: {\n            Location: `/.auth/login?${new URLSearchParams({ next, scope: scope || \"\" })}`,\n            \"Cache-Control\": \"no-store\",\n          },\n        });\n      return connectPage({\n        url,\n        origin: named.origin,\n        next,\n        scope,\n        held: host,\n        defaultIssuer: issuer,\n      });\n    }\n    if (request.method !== \"POST\") return new Response(\"Method not allowed\", { status: 405 });\n    if (!isSameOriginBrowserRequest(request))\n      return new Response(\"Cross-site request refused\", { status: 403 });\n    const form = await request.formData();\n    const named = issuerOriginOf(String(form.get(\"issuer\") ?? \"\"), {\n      defaultIssuer: issuer,\n      denyZones: config.denyZones,\n    });\n    if (\"error\" in named) return refusalPage(issuer, named.error);\n    const next = nextPathOf(String(form.get(\"next\") ?? \"/\"), url.origin);\n    const parsed = OAuthScopes.safeParse(\n      String(form.get(\"scope\") ?? \"\")\n        .split(\" \")\n        .filter(Boolean),\n    );\n    if (!parsed.success) return refusalPage(issuer, \"Unsupported permission.\");\n    if (named.origin !== issuer) {\n      const refused = await issuerAnswersAt(named.origin);\n      if (refused) return refusalPage(issuer, refused);\n    }\n    const host = await held();\n    if (host?.issuer === named.origin)\n      return new Response(null, {\n        status: 303,\n        headers: {\n          Location: `/.auth/login?${new URLSearchParams({ next, scope: parsed.data.join(\" \") })}`,\n          \"Cache-Control\": \"no-store\",\n        },\n      });\n    if (host) {\n      // a deliberate switch: end the sign-in at the issuer it was with (best effort — that issuer\n      // may be gone), then forget it here either way\n      try {\n        await session!.end();\n      } catch {\n        await session!.discard();\n      }\n    }\n    const { location, setCookie } = await startAppSession(\n      sessions,\n      {\n        origin: url.origin,\n        client,\n        issuer: named.origin,\n        resource: `${named.origin}/api`,\n        scopes: parsed.data,\n      },\n      next,\n    );\n    return new Response(null, {\n      status: 302,\n      headers: {\n        Location: location,\n        \"Set-Cookie\": setCookie,\n        \"Cache-Control\": \"no-store\",\n        \"Referrer-Policy\": \"no-referrer\",\n      },\n    });\n  }\n\n  if (url.pathname === \"/.auth/login\") {\n    if (request.method !== \"GET\") return new Response(\"Method not allowed\", { status: 405 });\n    const next = nextPathOf(url.searchParams.get(\"next\"), url.origin);\n    const scope = url.searchParams.get(\"scope\");\n    const parsed = OAuthScopes.safeParse(scope ? scope.split(\" \").filter(Boolean) : []);\n    if (!parsed.success) return new Response(\"Unsupported permission\", { status: 400 });\n    const scopes = parsed.data;\n    // A link may NAME an issuer; only the connect page's POST may bind one. So a login link that\n    // names one lands on that page (which also says no to a bad one) — a click is always required.\n    const requested = url.searchParams.get(\"issuer\");\n    if (requested && !config.loginPage) {\n      const named = issuerOriginOf(requested, {\n        defaultIssuer: issuer,\n        denyZones: config.denyZones,\n      });\n      if (\"error\" in named || named.origin !== issuer)\n        return new Response(null, {\n          status: 303,\n          headers: {\n            Location: `/.auth/connect?${new URLSearchParams({ issuer: requested, next, scope: scope || \"\" })}`,\n            \"Cache-Control\": \"no-store\",\n          },\n        });\n    }\n    const host = await held();\n    const target = host || { issuer, resource };\n    const bearer = await session?.bearer();\n    if (bearer) {\n      const probe = await config.api(\n        new Request(target.resource, {\n          method: \"POST\",\n          body: \"\",\n          headers: { Authorization: `Bearer ${bearer}` },\n        }),\n      );\n      await probe.body?.cancel();\n      if (probe.status !== 401) {\n        if (!probe.ok) throw new Error(`iterate API check failed (${probe.status})`);\n        const heldScopes = await session!.scopes();\n        const project = url.searchParams.get(\"project\");\n        if (!project && scopes.every((scope) => heldScopes.includes(scope)))\n          return new Response(null, {\n            status: 303,\n            headers: { Location: next, \"Cache-Control\": \"no-store\" },\n          });\n        // Only a deliberate POST can replace a valid grant. GET never signs out.\n        return signInAgainPage({\n          url,\n          issuer: target.issuer,\n          resource: target.resource,\n          defaultIssuer: issuer,\n          bearer,\n          scopes: heldScopes,\n          project,\n        });\n      }\n      await session!.discard();\n    }\n    if (config.loginPage)\n      return new Response(null, {\n        status: 303,\n        headers: {\n          Location: `${config.loginPage}?${new URLSearchParams({ next })}`,\n          \"Cache-Control\": \"no-store\",\n        },\n      });\n    // The fresh session goes where this browser was CONNECTED (an expired grant at a self-host\n    // signs in again at that self-host, not at the deployment's own issuer); a browser with no\n    // record signs in at the default.\n    const { location, setCookie } = await startAppSession(\n      sessions,\n      { origin: url.origin, issuer: target.issuer, resource: target.resource, scopes, client },\n      next,\n    );\n    return new Response(null, {\n      status: 302,\n      headers: {\n        Location: location,\n        \"Set-Cookie\": setCookie,\n        \"Cache-Control\": \"no-store\",\n        \"Referrer-Policy\": \"no-referrer\",\n      },\n    });\n  }\n  if (url.pathname === \"/.auth/callback\") {\n    if (request.method !== \"GET\") return new Response(\"Method not allowed\", { status: 405 });\n    const result = await session?.complete(url.search);\n    if (!result || result.error)\n      return new Response(result?.error || \"Sign-in does not match this browser.\", {\n        status: 400,\n        headers: { \"Cache-Control\": \"no-store\", \"Referrer-Policy\": \"no-referrer\" },\n      });\n    return new Response(null, {\n      status: 303,\n      headers: {\n        Location: result.next!,\n        \"Cache-Control\": \"no-store\",\n        \"Referrer-Policy\": \"no-referrer\",\n      },\n    });\n  }\n  if (url.pathname === \"/.auth/logout\") {\n    if (request.method !== \"POST\") return new Response(\"Method not allowed\", { status: 405 });\n    if (!isSameOriginBrowserRequest(request))\n      return new Response(\"Cross-site request refused\", { status: 403 });\n    // Where the ended session was bound: a sign-out from a CONNECTED issuer returns through the\n    // connect page for that issuer (one click, the host named), so \"Sign in again\" at a self-host\n    // stays at the self-host instead of silently binding the browser back to the default.\n    const ended = await held();\n    try {\n      await session?.end();\n    } catch {\n      console.error(\"oauth.app_logout_failed\", { origin: url.origin });\n      return new Response(\n        \"Sign-out could not complete. Your session is still present; go back and try again.\",\n        { status: 503 },\n      );\n    }\n    const next = nextPathOf(url.searchParams.get(\"next\"), url.origin);\n    // The scopes the next sign-in must hold ride along: the Sign-in-again form's `next` IS the login\n    // URL that asked for them (`/.auth/login?…&scope=…`), and the connect page starts the grant from\n    // its own `scope` — without this the reconnected grant would hold `iterate` alone and the login\n    // would send the person straight back to Sign in again.\n    const nextUrl = new URL(next, url.origin);\n    const scope =\n      nextUrl.pathname === \"/.auth/login\" ? nextUrl.searchParams.get(\"scope\") || \"\" : \"\";\n    const headers = new Headers({\n      Location:\n        ended && ended.issuer !== issuer && !config.loginPage\n          ? `/.auth/connect?${new URLSearchParams({ issuer: ended.issuer, next, scope })}`\n          : next,\n      \"Set-Cookie\": clearCookie,\n      \"Cache-Control\": \"no-store\",\n    });\n    return new Response(null, { status: 303, headers });\n  }\n  if (url.pathname === \"/api\") {\n    let token = request.headers.get(\"authorization\");\n    let cookieAuth = false;\n    if (!token && request.method !== \"OPTIONS\") {\n      // THE COOKIE'S AUTHORITY IS SAME-ORIGIN ONLY (CSRF): a page on another origin that happens to\n      // carry this app's cookie gets nothing from it — its request goes on BARE, and a WebSocket then\n      // authenticates in-band with its own token, `authenticate({ type: \"bearer\", token })` (os-next\n      // api.ts), or holds no session at all.\n      const bearer =\n        session && request.headers.get(\"origin\") === url.origin ? await session.bearer() : null;\n      if (bearer) {\n        token = `Bearer ${bearer}`;\n        cookieAuth = true;\n      }\n    }\n    // where the credential goes is the session's record, never anything on the request\n    const target = (await held()) ?? { issuer, resource };\n    const headers = new Headers(request.headers);\n    headers.delete(\"cookie\");\n    // The same-origin gate above already ran. Provider CORS reconstruction loses 101.\n    if (request.headers.get(\"upgrade\")?.toLowerCase() === \"websocket\") headers.delete(\"origin\");\n    if (token) headers.set(\"authorization\", token);\n    const response = await config.api(\n      new Request(target.resource, new Request(request, { headers })),\n    );\n    if (cookieAuth && response.status === 401) {\n      await session!.discard();\n      const denied = new Response(response.body, response);\n      denied.headers.append(\"Set-Cookie\", clearCookie);\n      return denied;\n    }\n    return response;\n  }\n  if (url.pathname.startsWith(\"/.auth/\")) return new Response(\"Not found\", { status: 404 });\n  return null;\n}\n"],"mappings":";;;;;;;AAkBA,SAAS,kBAAkB,KAAU;CACnC,OAAO,qBAAqB,IAAI,OAAO,IAAI,IAAI,SAAS;AAC1D;AACA,SAAgB,WAAW,WAAmD,SAAkB;CAC9F,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,MAAM,KAAK,cAAc,QAAQ,QAAQ,IAAI,QAAQ,GAAG,kBAAkB,GAAG,CAAC;CAC9E,OAAO,MAAM,gDAAgD,KAAK,EAAE,IAChE,UAAU,UAAU,GAAG,IAAI,OAAO,GAAG,IAAI,IACzC;AACN;;;AAIA,eAAsB,gBACpB,UACA,MACA,MACA;CACA,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,UAAU,SAAS,UAAU,GAAG,KAAK,OAAO,GAAG,IAAI;CAGzD,OAAO;EAAE;EAAS,UAAA,MAFK,QAAQ,MAAM,MAAM,IAAI;EAEnB,WAAA,GADP,kBAAkB,IAAI,IAAI,KAAK,MAAM,CAAC,EAAE,GAAG,GAAG;CAC7B;AACxC;;;;;;AAOA,SAAgB,eACd,WACA,SACwC;CACxC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,UAAU,KAAK,CAAC;CAChC,QAAQ;EACN,OAAO,EAAE,OAAO,wEAAwE;CAC1F;CACA,MAAM,SAAS,IAAI;CACnB,IAAI,WAAW,QAAQ,eAAe,OAAO,EAAE,OAAO;CACtD,IAAI,IAAI,aAAa,UAAU,OAAO,EAAE,OAAO,wCAAwC;CACvF,MAAM,OAAO,IAAI;CACjB,IACE,4BAA4B,KAAK,IAAI,KACrC,KAAK,WAAW,GAAG,KACnB,SAAS,eACT,KAAK,SAAS,YAAY,GAE1B,OAAO,EAAE,OAAO,0CAA0C;CAC5D,KAAK,MAAM,QAAQ,QAAQ,aAAa,CAAC,GAAG;EAC1C,MAAM,SAAS,KAAK,YAAY,CAAC,CAAC,QAAQ,QAAQ,EAAE;EACpD,IAAI,WAAW,SAAS,UAAU,KAAK,SAAS,IAAI,QAAQ,IAC1D,OAAO,EAAE,OAAO,GAAG,KAAK,iDAAiD;CAC7E;CACA,OAAO,EAAE,OAAO;AAClB;;;;;AAMA,eAAe,gBAAgB,QAAwC;CACrE,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,GAAG,OAAO,0CAA0C;GAC/E,SAAS,EAAE,QAAQ,mBAAmB;GACtC,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,KAAK;EACjD,MAAM,WAAoB,MAAM,SAAS,KAAK;EAC9C,MAAM,SACJ,OAAO,aAAa,YAAY,WAAY,SAAkC,SAAS;EACzF,IAAI,WAAW,QACb,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,KAAK,yDAAyD,OAAO,WAAW,WAAW,SAAS,UAAU;EAC1I,OAAO;CACT,QAAQ;EACN,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,KAAK;CACjC;AACF;;;;;AAMA,SAAS,WAAW,MAAqB,QAAwB;CAC/D,MAAM,OAAO,eAAe,QAAQ,KAAK,MAAM;CAC/C,MAAM,MAAM,IAAI,IAAI,MAAM,MAAM;CAChC,IAAI,CAAC,IAAI,aAAa,IAAI,QAAQ,GAAG,OAAO;CAC5C,IAAI,aAAa,OAAO,QAAQ;CAChC,OAAO,IAAI,WAAW,IAAI;AAC5B;;;;;AAMA,eAAe,aAAa,UAAkB,QAAgB;;;EAE5D,MAAM,MAAA,YAAA,EAAM,uBACV,IAAI,QAAQ,UAAU;GACpB,SAAS,EAAE,eAAe,UAAU,SAAS;GAC7C,QAAQ,YAAY,QAAQ,GAAK;EACnC,CAAC,CACH,CAAA;EACA,MAAM,UAAA,YAAA,EAAU,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAC,CAAA;EAC/D,MAAM,OAAO,QAAQ,KAAK;EAC1B,MAAM,WAAW,QAAQ,SAAS,KAAK;EACvC,MAAM,CAAC,EAAE,aAAa,QAAQ,MAAM,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC;EAChE,OAAO;GAAE,OAAO,UAAU;GAAO,UAAU,KAAK,KAAK,YAAY,QAAQ,IAAI;EAAE;;;;;;AACjF;;;AAIA,MAAM,cAAsC;CAC1C,SAAS;CACT,SAAS;CACT,uBAAuB;AACzB;AAEA,MAAM,QAAQ,UAAkB,MAAM,QAAQ,YAAY,MAAM,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE;;;;AAKvF,MAAM,gBAAgB;;AAGtB,SAAS,SAAS,OAML;CACX,OAAO,IAAI,SACT,yIAAyI,KAAK,MAAM,KAAK,EAAE,UAAU,MAAM,KAAK,yCAAyC,MAAM,KAAK,wBACpO;EACE,QAAQ,MAAM,UAAU;EACxB,SAAS;GACP,gBAAgB;GAChB,iBAAiB;GACjB,2BAA2B,MAAM;GACjC,mBAAmB;EACrB;CACF,CACF;AACF;;;AAIA,SAAS,QACP,QACA,eAC6C;CAC7C,IAAI,WAAW,eACb,OAAO;EACL,MAAM,gCAAgC,OAAO,sCAAsC,OAAO;EAC1F,KAAK,iCAAiC,OAAO,YAAY,OAAO;EAChE,MAAM,iCAAiC,OAAO;CAChD;CACF,OAAO;EACL,MAAM,UAAU,cAAc;EAC9B,KAAK;EACL,MAAM;CACR;AACF;;;;;;;;;AAUA,eAAe,gBAAgB,OAQ5B;CACD,MAAM,EAAE,KAAK,QAAQ,UAAU,eAAe,QAAQ,QAAQ,YAAY;CAC1E,MAAM,QAAQ,UACV,2CAA2C,KAAK,OAAO,EAAE,WACzD;CACJ,MAAM,QAAQ,MAAM,aAAa,UAAU,MAAM,CAAC,CAAC,YAAY,IAAI;CACnE,MAAM,UAAU,QACZ,MAAM,SAAS,SACb,cAAc,MAAM,SACjB,MAAM,GAAG,EAAE,CAAC,CACZ,KAAK,SAAS,SAAS,KAAK,IAAI,EAAE,QAAQ,CAAC,CAC3C,KACC,IACF,IAAI,MAAM,SAAS,SAAS,KAAK,QAAQ,MAAM,SAAS,SAAS,GAAG,SAAS,GAAG,KAClF,gCACF;CACJ,MAAM,cAAc,gBAAgB,OAAO,KAAK,UAAU,YAAY,UAAU,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE;CAClG,MAAM,WAAW;EACf,OAAO,QAAQ,wBAAwB,KAAK,MAAM,KAAK,EAAE,aAAa;EACtE,oBAAoB,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE;EAC/C;EACA;CACF,CAAC,CACE,OAAO,OAAO,CAAC,CACf,KAAK,GAAG,CAAC,CACT,QAAQ,sBAAsB,mBAAmB;CACpD,MAAM,QAAQ,QAAQ,QAAQ,aAAa;CAC3C,MAAM,OAAO,WAAW,IAAI,WAAW,IAAI,QAAQ,IAAI,MAAM;CAC7D,OAAO,SAAS;EACd,OAAO;EACP,MAAM,MAAM;EACZ,KAAK,MAAM;EACX,MAAM,GAAG,MAAM,KAAK,mDAAmD,KAAK,IAAI,IAAI,EAAE,YAAY,MAAM,wBAAwB,SAAS,kKAAkK,mBAAmB,IAAI,EAAE;CACtU,CAAC;AACH;;;;AAKA,SAAS,YAAY,OAOR;CACX,MAAM,EAAE,KAAK,QAAQ,MAAM,OAAO,MAAM,kBAAkB;CAC1D,MAAM,OAAO,IAAI,IAAI,MAAM,CAAC,CAAC;CAC7B,MAAM,OACJ,QAAQ,KAAK,WAAW,SACpB,mEAAmE,KAAK,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,IAAI,EAAE,kBACnG;CACN,MAAM,QAAQ,QAAQ,eAAe,aAAa;CAClD,OAAO,SAAS;EACd,OAAO,cAAc;EACrB,MAAM,MAAM;EACZ,KAAK,MAAM;EACX,MAAM,GAAG,MAAM,KAAK,cAAc,KAAK,IAAI,IAAI,EAAE,YAAY,KAAK,IAAI,EAAE,4DAA4D,KAAK,IAAI,EAAE,sGAAsG,KAAK,wFAAwF,KAAK,MAAM,EAAE,4CAA4C,KAAK,IAAI,EAAE,IAAI,QAAQ,4CAA4C,KAAK,KAAK,EAAE,MAAM,GAAG;CACre,CAAC;AACH;;AAGA,SAAS,YAAY,eAAuB,SAAiB,SAAS,KAAe;CACnF,MAAM,QAAQ,QAAQ,eAAe,aAAa;CAClD,OAAO,SAAS;EACd,OAAO;EACP,MAAM,MAAM;EACZ,KAAK,MAAM;EACX;EACA,MAAM,GAAG,MAAM,KAAK,4BAA4B,KAAK,OAAO,EAAE;CAChE,CAAC;AACH;;AAoBA,eAAsB,QAAQ,SAAkB,QAA2C;CACzF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,MAAM,EAAE,QAAQ,UAAU,aAAa;CACvC,MAAM,SAAS,OAAO,UAAU;EAC9B,MAAM,OAAO,OAAO;EACpB,SAAS,IAAI,IAAI,OAAO,OAAO,SAAS,IAAI,MAAM,CAAC,CAAC;CACtD;CACA,MAAM,UAAU,WAAW,UAAU,OAAO;CAC5C,MAAM,cAAc,GAAG,kBAAkB,GAAG,EAAE;;;;CAI9C,MAAM,OAAO,YAAkE;EAC7E,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,CAAC,MAAM,OAAO;EAClB,IAAI,KAAK,WAAW,UAAU,KAAK,aAAa,GAAG,KAAK,OAAO,OAAO;GACpE,MAAM,QAAS,QAAQ;GACvB,OAAO;EACT;EACA,OAAO;CACT;CACA,IAAI,IAAI,aAAa,sBACnB,OAAO,SAAS,KACd;EACE,WAAW,GAAG,IAAI,OAAO;EACzB,aAAa,QAAQ,QAAQ,IAAI;EACjC,YAAY,IAAI;EAChB,UAAU,QAAQ;EAClB,eAAe,CAAC,GAAG,IAAI,OAAO,gBAAgB;EAC9C,4BAA4B;EAC5B,aAAa,CAAC,sBAAsB,eAAe;EACnD,gBAAgB,CAAC,MAAM;CACzB,GACA,EAAE,SAAS,EAAE,iBAAiB,sBAAsB,EAAE,CACxD;CAEF,IAAI,IAAI,aAAa,uBAAuB;EAG1C,IAAI,QAAQ,WAAW,OAAO,OAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,IAAI,CAAC;EACvF,MAAM,OAAO,MAAM,KAAK;EACxB,OAAO,SAAS,KACd;GAAE,QAAQ,MAAM,UAAU;GAAM,eAAe;EAAO,GACtD,EAAE,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAC7C;CACF;CAEA,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,OAAO,WAAW,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;EACtE,IAAI,QAAQ,WAAW,OAAO;GAC5B,MAAM,QAAQ,eAAe,IAAI,aAAa,IAAI,QAAQ,KAAK,IAAI;IACjE,eAAe;IACf,WAAW,OAAO;GACpB,CAAC;GACD,IAAI,WAAW,OAAO,OAAO,YAAY,QAAQ,MAAM,KAAK;GAC5D,MAAM,OAAO,WAAW,IAAI,aAAa,IAAI,MAAM,GAAG,IAAI,MAAM;GAChE,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;GAC1C,MAAM,OAAO,MAAM,KAAK;GAExB,IAAI,MAAM,WAAW,WAAW,CAAC,QAAQ,KAAK,WAAW,SACvD,OAAO,IAAI,SAAS,MAAM;IACxB,QAAQ;IACR,SAAS;KACP,UAAU,gBAAgB,IAAI,gBAAgB;MAAE;MAAM,OAAO,SAAS;KAAG,CAAC;KAC1E,iBAAiB;IACnB;GACF,CAAC;GACH,OAAO,YAAY;IACjB;IACA,QAAQ,MAAM;IACd;IACA;IACA,MAAM;IACN,eAAe;GACjB,CAAC;EACH;EACA,IAAI,QAAQ,WAAW,QAAQ,OAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,IAAI,CAAC;EACxF,IAAI,CAAC,2BAA2B,OAAO,GACrC,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;EACnE,MAAM,OAAO,MAAM,QAAQ,SAAS;EACpC,MAAM,QAAQ,eAAe,OAAO,KAAK,IAAI,QAAQ,KAAK,EAAE,GAAG;GAC7D,eAAe;GACf,WAAW,OAAO;EACpB,CAAC;EACD,IAAI,WAAW,OAAO,OAAO,YAAY,QAAQ,MAAM,KAAK;EAC5D,MAAM,OAAO,WAAW,OAAO,KAAK,IAAI,MAAM,KAAK,GAAG,GAAG,IAAI,MAAM;EACnE,MAAM,SAAS,YAAY,UACzB,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE,CAAC,CAC5B,MAAM,GAAG,CAAC,CACV,OAAO,OAAO,CACnB;EACA,IAAI,CAAC,OAAO,SAAS,OAAO,YAAY,QAAQ,yBAAyB;EACzE,IAAI,MAAM,WAAW,QAAQ;GAC3B,MAAM,UAAU,MAAM,gBAAgB,MAAM,MAAM;GAClD,IAAI,SAAS,OAAO,YAAY,QAAQ,OAAO;EACjD;EACA,MAAM,OAAO,MAAM,KAAK;EACxB,IAAI,MAAM,WAAW,MAAM,QACzB,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,UAAU,gBAAgB,IAAI,gBAAgB;KAAE;KAAM,OAAO,OAAO,KAAK,KAAK,GAAG;IAAE,CAAC;IACpF,iBAAiB;GACnB;EACF,CAAC;EACH,IAAI,MAGF,IAAI;GACF,MAAM,QAAS,IAAI;EACrB,QAAQ;GACN,MAAM,QAAS,QAAQ;EACzB;EAEF,MAAM,EAAE,UAAU,cAAc,MAAM,gBACpC,UACA;GACE,QAAQ,IAAI;GACZ;GACA,QAAQ,MAAM;GACd,UAAU,GAAG,MAAM,OAAO;GAC1B,QAAQ,OAAO;EACjB,GACA,IACF;EACA,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,UAAU;IACV,cAAc;IACd,iBAAiB;IACjB,mBAAmB;GACrB;EACF,CAAC;CACH;CAEA,IAAI,IAAI,aAAa,gBAAgB;EACnC,IAAI,QAAQ,WAAW,OAAO,OAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,IAAI,CAAC;EACvF,MAAM,OAAO,WAAW,IAAI,aAAa,IAAI,MAAM,GAAG,IAAI,MAAM;EAChE,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;EAC1C,MAAM,SAAS,YAAY,UAAU,QAAQ,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC;EAClF,IAAI,CAAC,OAAO,SAAS,OAAO,IAAI,SAAS,0BAA0B,EAAE,QAAQ,IAAI,CAAC;EAClF,MAAM,SAAS,OAAO;EAGtB,MAAM,YAAY,IAAI,aAAa,IAAI,QAAQ;EAC/C,IAAI,aAAa,CAAC,OAAO,WAAW;GAClC,MAAM,QAAQ,eAAe,WAAW;IACtC,eAAe;IACf,WAAW,OAAO;GACpB,CAAC;GACD,IAAI,WAAW,SAAS,MAAM,WAAW,QACvC,OAAO,IAAI,SAAS,MAAM;IACxB,QAAQ;IACR,SAAS;KACP,UAAU,kBAAkB,IAAI,gBAAgB;MAAE,QAAQ;MAAW;MAAM,OAAO,SAAS;KAAG,CAAC;KAC/F,iBAAiB;IACnB;GACF,CAAC;EACL;EAEA,MAAM,SAAS,MADI,KAAK,KACD;GAAE;GAAQ;EAAS;EAC1C,MAAM,SAAS,MAAM,SAAS,OAAO;EACrC,IAAI,QAAQ;GACV,MAAM,QAAQ,MAAM,OAAO,IACzB,IAAI,QAAQ,OAAO,UAAU;IAC3B,QAAQ;IACR,MAAM;IACN,SAAS,EAAE,eAAe,UAAU,SAAS;GAC/C,CAAC,CACH;GACA,MAAM,MAAM,MAAM,OAAO;GACzB,IAAI,MAAM,WAAW,KAAK;IACxB,IAAI,CAAC,MAAM,IAAI,MAAM,IAAI,MAAM,6BAA6B,MAAM,OAAO,EAAE;IAC3E,MAAM,aAAa,MAAM,QAAS,OAAO;IACzC,MAAM,UAAU,IAAI,aAAa,IAAI,SAAS;IAC9C,IAAI,CAAC,WAAW,OAAO,OAAO,UAAU,WAAW,SAAS,KAAK,CAAC,GAChE,OAAO,IAAI,SAAS,MAAM;KACxB,QAAQ;KACR,SAAS;MAAE,UAAU;MAAM,iBAAiB;KAAW;IACzD,CAAC;IAEH,OAAO,gBAAgB;KACrB;KACA,QAAQ,OAAO;KACf,UAAU,OAAO;KACjB,eAAe;KACf;KACA,QAAQ;KACR;IACF,CAAC;GACH;GACA,MAAM,QAAS,QAAQ;EACzB;EACA,IAAI,OAAO,WACT,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,UAAU,GAAG,OAAO,UAAU,GAAG,IAAI,gBAAgB,EAAE,KAAK,CAAC;IAC7D,iBAAiB;GACnB;EACF,CAAC;EAIH,MAAM,EAAE,UAAU,cAAc,MAAM,gBACpC,UACA;GAAE,QAAQ,IAAI;GAAQ,QAAQ,OAAO;GAAQ,UAAU,OAAO;GAAU;GAAQ;EAAO,GACvF,IACF;EACA,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,UAAU;IACV,cAAc;IACd,iBAAiB;IACjB,mBAAmB;GACrB;EACF,CAAC;CACH;CACA,IAAI,IAAI,aAAa,mBAAmB;EACtC,IAAI,QAAQ,WAAW,OAAO,OAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,IAAI,CAAC;EACvF,MAAM,SAAS,MAAM,SAAS,SAAS,IAAI,MAAM;EACjD,IAAI,CAAC,UAAU,OAAO,OACpB,OAAO,IAAI,SAAS,QAAQ,SAAS,wCAAwC;GAC3E,QAAQ;GACR,SAAS;IAAE,iBAAiB;IAAY,mBAAmB;GAAc;EAC3E,CAAC;EACH,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,UAAU,OAAO;IACjB,iBAAiB;IACjB,mBAAmB;GACrB;EACF,CAAC;CACH;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,IAAI,QAAQ,WAAW,QAAQ,OAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,IAAI,CAAC;EACxF,IAAI,CAAC,2BAA2B,OAAO,GACrC,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;EAInE,MAAM,QAAQ,MAAM,KAAK;EACzB,IAAI;GACF,MAAM,SAAS,IAAI;EACrB,QAAQ;GACN,QAAQ,MAAM,2BAA2B,EAAE,QAAQ,IAAI,OAAO,CAAC;GAC/D,OAAO,IAAI,SACT,sFACA,EAAE,QAAQ,IAAI,CAChB;EACF;EACA,MAAM,OAAO,WAAW,IAAI,aAAa,IAAI,MAAM,GAAG,IAAI,MAAM;EAKhE,MAAM,UAAU,IAAI,IAAI,MAAM,IAAI,MAAM;EACxC,MAAM,QACJ,QAAQ,aAAa,iBAAiB,QAAQ,aAAa,IAAI,OAAO,KAAK,KAAK;EAClF,MAAM,UAAU,IAAI,QAAQ;GAC1B,UACE,SAAS,MAAM,WAAW,UAAU,CAAC,OAAO,YACxC,kBAAkB,IAAI,gBAAgB;IAAE,QAAQ,MAAM;IAAQ;IAAM;GAAM,CAAC,MAC3E;GACN,cAAc;GACd,iBAAiB;EACnB,CAAC;EACD,OAAO,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK;EAAQ,CAAC;CACpD;CACA,IAAI,IAAI,aAAa,QAAQ;EAC3B,IAAI,QAAQ,QAAQ,QAAQ,IAAI,eAAe;EAC/C,IAAI,aAAa;EACjB,IAAI,CAAC,SAAS,QAAQ,WAAW,WAAW;GAK1C,MAAM,SACJ,WAAW,QAAQ,QAAQ,IAAI,QAAQ,MAAM,IAAI,SAAS,MAAM,QAAQ,OAAO,IAAI;GACrF,IAAI,QAAQ;IACV,QAAQ,UAAU;IAClB,aAAa;GACf;EACF;EAEA,MAAM,SAAU,MAAM,KAAK,KAAM;GAAE;GAAQ;EAAS;EACpD,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;EAC3C,QAAQ,OAAO,QAAQ;EAEvB,IAAI,QAAQ,QAAQ,IAAI,SAAS,CAAC,EAAE,YAAY,MAAM,aAAa,QAAQ,OAAO,QAAQ;EAC1F,IAAI,OAAO,QAAQ,IAAI,iBAAiB,KAAK;EAC7C,MAAM,WAAW,MAAM,OAAO,IAC5B,IAAI,QAAQ,OAAO,UAAU,IAAI,QAAQ,SAAS,EAAE,QAAQ,CAAC,CAAC,CAChE;EACA,IAAI,cAAc,SAAS,WAAW,KAAK;GACzC,MAAM,QAAS,QAAQ;GACvB,MAAM,SAAS,IAAI,SAAS,SAAS,MAAM,QAAQ;GACnD,OAAO,QAAQ,OAAO,cAAc,WAAW;GAC/C,OAAO;EACT;EACA,OAAO;CACT;CACA,IAAI,IAAI,SAAS,WAAW,SAAS,GAAG,OAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;CACxF,OAAO;AACT"}

package/dist/next/app-session.d.ts

@@ -0,0 +1,49 @@
+import { DurableObject } from "cloudflare:workers";
+export type BrowserHost = {
+    origin: string;
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    client?: {
+        id?: string;
+        name: string;
+        logoUri: string;
+    };
+};
+/** Each app binds this same class. Token exchange and logout use the issuer's
+ * public protocol, so separately deployed apps need no platform bindings.
+ * The input gate serializes refresh and logout across tabs. */
+export declare class BrowserSession extends DurableObject {
+    #private;
+    begin(host: BrowserHost, next: string): Promise<string>;
+    /** The issuer's redirect back to `/.auth/callback`, its query string. oauth4webapi validates it
+     *  (the state matches this browser's pending flow, the `iss` matches the issuer, no `error`), then
+     *  exchanges the code for tokens. */
+    complete(callbackQuery: string): Promise<{
+        error: string;
+        next?: undefined;
+    } | {
+        next: string;
+        error?: undefined;
+    }>;
+    bearer(): Promise<string | null>;
+    /** THE ISSUER THIS SESSION IS BOUND TO and the resource its tokens are for — written once at
+     *  `begin`, never steered by a request: the app's `/api` proxy, its login probe and its logout read
+     *  them from here, so a browser connected to one issuer can only ever spend its credential there.
+     *  Null when no session was begun. */
+    host(): Promise<{
+        issuer: string;
+        resource: string;
+    } | null>;
+    scopes(): Promise<string[]>;
+    /** Public client metadata chosen by the app before consent; never a browser-supplied claim. */
+    client(): Promise<{
+        id?: string;
+        name: string;
+        logoUri: string;
+    } | undefined>;
+    /** A verified 401 means this local credential no longer grants access. */
+    discard(): Promise<void>;
+    end(): Promise<void>;
+    alarm(): Promise<void>;
+}