nodestack-client 2.0.0 → 2.1.0

package/README.md

@@ -68,6 +68,58 @@ console.log('JWT Token:', client.authStore.token);
 console.log('Is valid:', client.authStore.isValid);
 ```
 
+### Authenticate via OAuth2 / Social Login (PKCE)
+NodeStack supports native PKCE code exchange for Google, GitHub, Apple, Discord, and Microsoft:
+
+```typescript
+// 1. Fetch available providers and precomputed PKCE challenge & state
+const { authProviders } = await client.collection('users').listAuthMethods('http://localhost:3000/callback');
+const google = authProviders.find((p) => p.name === 'google');
+
+// 2. Redirect user or open popup with google.authUrl
+// window.location.href = google.authUrl;
+
+// 3. On your callback page (/callback), exchange code and codeVerifier
+const urlParams = new URLSearchParams(window.location.search);
+const code = urlParams.get('code');
+
+const authData = await client.collection('users').authWithOAuth2({
+  provider: 'google',
+  code: code!,
+  codeVerifier: google.codeVerifier,
+  state: google.state,
+  redirectUrl: 'http://localhost:3000/callback',
+});
+
+console.log('Logged in via Google:', authData.record);
+console.log('Is newly registered user:', authData.meta.isNew);
+```
+
+#### One-Step Popup Authentication (Single-Page Apps)
+```typescript
+// nodestack-client verifies popup origin, window source, and binds CSRF state automatically:
+const authData = await client.collection('users').authWithOAuth2({
+  provider: 'google',
+  urlCallback: (url) => window.open(url, '_blank', 'width=500,height=650'),
+  redirectUrl: 'http://localhost:3000/callback',
+});
+```
+
+### Machine-to-Machine (M2M) Authentication with API Keys
+For background workers, cron daemons, serverless scripts, and CI/CD pipelines:
+
+```typescript
+import { NodeStackClient } from 'nodestack-client';
+
+// Initialized with a scoped API key (e.g. "orders:*", "products:read")
+const client = new NodeStackClient('https://api.yourdomain.com', {
+  apiKey: process.env.NODESTACK_API_KEY, // 'nsk_live_...'
+});
+
+// Requests automatically inject Authorization: Bearer nsk_...
+const orders = await client.collection('orders').getList(1, 20);
+```
+
 ### Authenticate as a Superuser / Admin
 ```typescript
 const adminAuth = await client.admins.authWithPassword('admin@nodestack.io', 'MySecretAdminPassword');

package/dist/Client.d.ts

@@ -15,6 +15,7 @@ import type { ClientOptions, SendOptions, RecordModel, ChaosOptions } from './ty
 export declare class NodeStackClient<TCollections extends Record<string, any> = Record<string, RecordModel>> {
     readonly baseUrl: string;
     readonly authStore: BaseAuthStore;
+    apiKey?: string;
     readonly files: FileService;
     readonly realtime: RealtimeService;
     readonly admins: AdminService;

package/dist/Client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Client.d.ts","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACb,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,qBAAa,eAAe,CAAC,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IACjG,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,SAAS,EAAE,aAAa,CAAC;IACzC,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,QAAQ,EAAE,eAAe,CAAC;IAC1C,SAAgB,MAAM,EAAE,YAAY,CAAC;IACrC,SAAgB,WAAW,EAAE,iBAAiB,CAAC;IAC/C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,IAAI,EAAE,WAAW,CAAC;IAClC,SAAgB,QAAQ,EAAE,cAAc,CAAC;IACzC,SAAgB,IAAI,EAAE,UAAU,CAAC;IACjC,SAAgB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjC,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,cAAc,CAA8C;IAEpE,YAAY,OAAO,GAAE,MAAY,EAAE,OAAO,GAAE,aAAkB,EAiB7D;IAED;;;OAGG;IACI,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAElD;IAED;;OAEG;IACI,QAAQ,IAAI,YAAY,GAAG,IAAI,CAErC;IAED;;;;OAIG;IACI,UAAU,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAWnE;;;OAGG;IACU,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,CAwJ9E;IAED;;OAEG;IACU,MAAM,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC,CAErE;IAED;;OAEG;IACU,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAEpC;IAED;;OAEG;IACU,IAAI,CAAC,IAAI,SAAI,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAKtD;IAED;;OAEG;IACU,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAEnC;IAED;;;OAGG;IACI,GAAG,CAAC,eAAe,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAClF,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,CAAC,aAAa,CAAM,GACnC,eAAe,CAAC,eAAe,CAAC,CAUlC;CACF"}
+{"version":3,"file":"Client.d.ts","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACb,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,qBAAa,eAAe,CAAC,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IACjG,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,SAAS,EAAE,aAAa,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IACvB,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,QAAQ,EAAE,eAAe,CAAC;IAC1C,SAAgB,MAAM,EAAE,YAAY,CAAC;IACrC,SAAgB,WAAW,EAAE,iBAAiB,CAAC;IAC/C,SAAgB,SAAS,EAAE,eAAe,CAAC;IAC3C,SAAgB,IAAI,EAAE,WAAW,CAAC;IAClC,SAAgB,QAAQ,EAAE,cAAc,CAAC;IACzC,SAAgB,IAAI,EAAE,UAAU,CAAC;IACjC,SAAgB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjC,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,cAAc,CAA8C;IAEpE,YAAY,OAAO,GAAE,MAAY,EAAE,OAAO,GAAE,aAAkB,EAkB7D;IAED;;;OAGG;IACI,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAElD;IAED;;OAEG;IACI,QAAQ,IAAI,YAAY,GAAG,IAAI,CAErC;IAED;;;;OAIG;IACI,UAAU,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAWnE;;;OAGG;IACU,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,CA0J9E;IAED;;OAEG;IACU,MAAM,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC,CAErE;IAED;;OAEG;IACU,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAEpC;IAED;;OAEG;IACU,IAAI,CAAC,IAAI,SAAI,EAAE,OAAO,SAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAKtD;IAED;;OAEG;IACU,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAEnC;IAED;;;OAGG;IACI,GAAG,CAAC,eAAe,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAClF,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,OAAO,CAAC,aAAa,CAAM,GACnC,eAAe,CAAC,eAAe,CAAC,CAUlC;CACF"}

package/dist/auth/PkceUtil.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Lightweight, zero-dependency PKCE helper for browsers and Node.js environments.
+ */
+export declare class PkceUtil {
+    static generateVerifier(length?: number): string;
+    static generateChallenge(verifier: string): Promise<string>;
+    static base64UrlEncode(bytes: Uint8Array): string;
+}
+//# sourceMappingURL=PkceUtil.d.ts.map

package/dist/auth/PkceUtil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PkceUtil.d.ts","sourceRoot":"","sources":["../../src/auth/PkceUtil.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAc,gBAAgB,CAAC,MAAM,SAAK,GAAG,MAAM,CAgClD;IAED,OAAoB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBvE;IAED,OAAc,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAiCvD;CACF"}

package/dist/index.cjs

@@ -31,6 +31,7 @@ __export(index_exports, {
   LocalAuthStore: () => LocalAuthStore,
   MemoryAuthStore: () => MemoryAuthStore,
   NodeStackClient: () => NodeStackClient,
+  PkceUtil: () => PkceUtil,
   RealtimeService: () => RealtimeService,
   RecordService: () => RecordService,
   SnapshotService: () => SnapshotService,
@@ -377,6 +378,175 @@ var RecordService = class extends BaseService {
     }
     return result;
   }
+  /**
+   * Returns a list of configured and enabled OAuth2 authentication providers.
+   */
+  async listAuthMethods(redirectUri) {
+    return this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/auth-methods`,
+      {
+        method: "GET",
+        query: redirectUri ? { redirectUri } : void 0
+      }
+    );
+  }
+  /**
+   * Authenticates against an auth collection using OAuth2 with PKCE code exchange.
+   * On success, automatically persists the token and record to authStore.
+   */
+  async authWithOAuth2(options) {
+    let code = options.code;
+    let codeVerifier = options.codeVerifier;
+    if ((options.urlCallback || options.popup || typeof window !== "undefined" && !code && !codeVerifier) && (!code || !codeVerifier)) {
+      const authMethods = await this.listAuthMethods(options.redirectUrl);
+      const provider = authMethods.authProviders.find(
+        (p) => p.name.toLowerCase() === options.provider.toLowerCase()
+      );
+      if (!provider) {
+        throw new Error(`OAuth provider '${options.provider}' is not enabled or configured.`);
+      }
+      codeVerifier = provider.codeVerifier;
+      const expectedState = provider.state;
+      let expectedOrigin = null;
+      if (typeof window !== "undefined" && window.location) {
+        if (options.redirectUrl) {
+          try {
+            expectedOrigin = new URL(options.redirectUrl, window.location.href).origin;
+          } catch {
+            expectedOrigin = window.location.origin;
+          }
+        } else {
+          expectedOrigin = window.location.origin;
+        }
+      }
+      let popup = options.popup || null;
+      if (options.urlCallback) {
+        const cbResult = options.urlCallback(provider.authUrl);
+        if (!popup && cbResult && typeof cbResult.postMessage === "function") {
+          popup = cbResult;
+        }
+      } else if (typeof window !== "undefined" && typeof window.open === "function") {
+        popup = window.open(provider.authUrl, "_blank", "width=600,height=700");
+        if (!popup) {
+          throw new Error("Failed to open OAuth popup window. It may have been blocked by the browser.");
+        }
+      }
+      return new Promise((resolve, reject) => {
+        if (typeof window !== "undefined" && window.addEventListener) {
+          let pollTimer = null;
+          const cleanup = () => {
+            if (pollTimer) {
+              clearInterval(pollTimer);
+              pollTimer = null;
+            }
+            if (typeof window !== "undefined" && window.removeEventListener) {
+              window.removeEventListener("message", handler);
+            }
+          };
+          const handler = async (event) => {
+            if (!event.data || typeof event.data !== "object" || event.data.type !== "nodestack_oauth_callback") {
+              return;
+            }
+            if (expectedOrigin && event.origin !== expectedOrigin) {
+              return;
+            }
+            if (popup) {
+              if (event.source !== popup) {
+                return;
+              }
+            } else if (event.source === window) {
+              return;
+            }
+            if (expectedState && event.data.state !== expectedState) {
+              return;
+            }
+            cleanup();
+            if (popup && typeof popup.close === "function") {
+              try {
+                popup.close();
+              } catch {
+              }
+            }
+            if (event.data.error) {
+              const errMsg = typeof event.data.error === "string" ? event.data.error : event.data.error.message || event.data.error_description || JSON.stringify(event.data.error);
+              return reject(new Error(errMsg));
+            }
+            if (!event.data.code) {
+              return reject(new Error("OAuth callback message is missing authorization code."));
+            }
+            try {
+              const res = await this.authWithOAuth2({
+                provider: options.provider,
+                code: event.data.code,
+                codeVerifier,
+                redirectUrl: options.redirectUrl,
+                createData: options.createData,
+                state: expectedState
+              });
+              resolve(res);
+            } catch (err) {
+              reject(err);
+            }
+          };
+          window.addEventListener("message", handler);
+          if (popup) {
+            pollTimer = setInterval(() => {
+              if (popup && popup.closed) {
+                cleanup();
+                reject(new Error("The OAuth popup window was closed before completing authentication."));
+              }
+            }, 500);
+          }
+        } else {
+          reject(new Error("urlCallback requires code and codeVerifier in non-browser environments."));
+        }
+      });
+    }
+    if (!code || !codeVerifier) {
+      throw new Error("Both code and codeVerifier are required for OAuth2 authentication");
+    }
+    const result = await this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/auth-with-oauth2`,
+      {
+        method: "POST",
+        body: {
+          provider: options.provider,
+          code,
+          codeVerifier,
+          state: options.state,
+          redirectUrl: options.redirectUrl,
+          createData: options.createData
+        }
+      }
+    );
+    if (result && result.token) {
+      this.client.authStore.save(result.token, result.record);
+    }
+    return result;
+  }
+  /**
+   * Lists external social identities linked to a specific record.
+   */
+  async listExternalAuths(recordId) {
+    return this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/records/${encodeURIComponent(recordId)}/external-auths`,
+      {
+        method: "GET"
+      }
+    );
+  }
+  /**
+   * Unlinks an external social identity from a record.
+   */
+  async unlinkExternalAuth(recordId, provider) {
+    await this.send(
+      `/api/collections/${encodeURIComponent(this.collectionName)}/records/${encodeURIComponent(recordId)}/external-auths/${encodeURIComponent(provider)}`,
+      {
+        method: "DELETE"
+      }
+    );
+    return true;
+  }
   /**
    * Exports records from the collection as CSV or JSON.
    */
@@ -1164,6 +1334,7 @@ var AppService = class extends BaseService {
 var NodeStackClient = class _NodeStackClient {
   baseUrl;
   authStore;
+  apiKey;
   files;
   realtime;
   admins;
@@ -1181,6 +1352,7 @@ var NodeStackClient = class _NodeStackClient {
   constructor(baseUrl = "/", options = {}) {
     this.baseUrl = (baseUrl || "/").replace(/\/+$/, "");
     this.authStore = options.authStore || new LocalAuthStore();
+    this.apiKey = options.apiKey;
     this.customFetch = options.fetch;
     this.defaultHeaders = options.headers || {};
     this.defaultTimeout = options.timeout || 12e4;
@@ -1244,7 +1416,9 @@ var NodeStackClient = class _NodeStackClient {
       ...this.defaultHeaders,
       ...options.headers || {}
     };
-    if (this.authStore.token && !headers["Authorization"] && !headers["authorization"]) {
+    if (this.apiKey && !headers["Authorization"] && !headers["authorization"] && !headers["x-api-key"] && !headers["X-API-Key"]) {
+      headers["Authorization"] = `Bearer ${this.apiKey}`;
+    } else if (this.authStore.token && !headers["Authorization"] && !headers["authorization"]) {
       headers["Authorization"] = `Bearer ${this.authStore.token}`;
     }
     if (this.appSlug && !headers["x-nodestack-app"] && !headers["X-NodeStack-App"]) {
@@ -1387,4 +1561,90 @@ var NodeStackClient = class _NodeStackClient {
 var MemoryAuthStore = class extends BaseAuthStore {
   // Inherits default in-memory behavior of BaseAuthStore
 };
+
+// src/auth/PkceUtil.ts
+var PkceUtil = class _PkceUtil {
+  static generateVerifier(length = 64) {
+    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    const clampedLength = Math.max(43, Math.min(128, length));
+    const randomBytes = new Uint8Array(clampedLength);
+    const g = typeof globalThis !== "undefined" ? globalThis : {};
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      crypto.getRandomValues(randomBytes);
+    } else if (g.crypto && g.crypto.getRandomValues) {
+      g.crypto.getRandomValues(randomBytes);
+    } else {
+      let filled = false;
+      try {
+        const req = g.require;
+        if (typeof req === "function") {
+          req("crypto").randomFillSync(randomBytes);
+          filled = true;
+        }
+      } catch {
+      }
+      if (!filled) {
+        throw new Error(
+          "A cryptographically secure random number generator (crypto.getRandomValues or node:crypto) is required to generate a PKCE code_verifier."
+        );
+      }
+    }
+    let result = "";
+    for (let i = 0; i < clampedLength; i++) {
+      result += charset[randomBytes[i] % charset.length];
+    }
+    return result;
+  }
+  static async generateChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const g = typeof globalThis !== "undefined" ? globalThis : {};
+    if (typeof crypto !== "undefined" && crypto.subtle) {
+      const hash = await crypto.subtle.digest("SHA-256", data);
+      return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+    } else if (g.crypto && g.crypto.subtle) {
+      const hash = await g.crypto.subtle.digest("SHA-256", data);
+      return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+    }
+    try {
+      const req = g.require;
+      if (typeof req === "function") {
+        const hash = req("crypto").createHash("sha256").update(data).digest();
+        return _PkceUtil.base64UrlEncode(new Uint8Array(hash));
+      }
+    } catch {
+    }
+    throw new Error("Web Crypto API (crypto.subtle) is not available to compute SHA-256 code challenge.");
+  }
+  static base64UrlEncode(bytes) {
+    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let base64 = "";
+    const byteLength = bytes.byteLength;
+    const byteRemainder = byteLength % 3;
+    const mainLength = byteLength - byteRemainder;
+    let a, b, c, d;
+    let chunk;
+    for (let i = 0; i < mainLength; i += 3) {
+      chunk = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+      a = (chunk & 16515072) >> 18;
+      b = (chunk & 258048) >> 12;
+      c = (chunk & 4032) >> 6;
+      d = chunk & 63;
+      base64 += chars[a] + chars[b] + chars[c] + chars[d];
+    }
+    if (byteRemainder === 1) {
+      chunk = bytes[mainLength];
+      a = (chunk & 252) >> 2;
+      b = (chunk & 3) << 4;
+      base64 += chars[a] + chars[b] + "==";
+    } else if (byteRemainder === 2) {
+      chunk = bytes[mainLength] << 8 | bytes[mainLength + 1];
+      a = (chunk & 64512) >> 10;
+      b = (chunk & 1008) >> 4;
+      c = (chunk & 15) << 2;
+      base64 += chars[a] + chars[b] + chars[c] + "=";
+    }
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+};
 //# sourceMappingURL=index.cjs.map