stitchkit 0.90.5 → 0.90.6

package/CHANGELOG.md

@@ -15,6 +15,40 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.90.6] — 2026-09-20
+
+### Added
+
+- **Browser Authorization Code + PKCE transactions in `stitchkit/oauth`.** The new
+  browser-safe entrypoint creates authorization URLs, stores one-time state and
+  verifier records, and consumes callbacks with bounded expiry, replay protection,
+  safe return paths and provider errors that do not expose credentials.
+- **A Google OpenID Connect server adapter in `stitchkit/google`.** It exchanges an
+  authorization code through the official optional `google-auth-library` peer,
+  requires an exact redirect allowlist, validates issuer, audience, expiry and nonce,
+  and returns a small stable identity without leaking tokens into application state.
+
+### Fixed
+
+- **Unix-socket servers no longer forward Bun's TCP-only `http2` option.** The Unix
+  variant now strips it beside the other transport-specific settings.
+- **grammY startup accepts the native application abort signal on its Node typing
+  boundary.** Runtime cancellation was already compatible; the adapter now makes that
+  compatibility explicit instead of failing consumer type-checks.
+- **The lane temporary-directory test is isolated from concurrent lanes.** Its real
+  default-path proof runs in a child process with a private system temp root, removing
+  the full-suite timeout caused by scanning unrelated live descriptors.
+- **Concurrent packed lanes serialize the shared core build.** Two release lanes can no
+  longer clean `dist` underneath each other's `prepack`, which previously produced a
+  JavaScript-only tarball during a parallel full gate.
+
+### Changed
+
+- **Supported dependencies and consumer fixtures track current stable releases.** The
+  MCP Apps peer accepts both the existing 1.x line and current 2.x, while development
+  and optional-peer lanes exercise 2.x; the `srvx` peer likewise keeps its supported
+  0.12 line while adding 1.x.
+
 ## [0.90.5] — 2026-09-16
 
 Three gaps a consuming project found on the first live surface after adopting

package/README.md

@@ -78,6 +78,7 @@ import { createSocketIOClient } from 'stitchkit'
 import { createCursorQuery, createCacheBridge } from 'stitchkit/react'
 import { AgentRunSchema, AgentRuntimeEventSchema } from 'stitchkit/agent-runtime/browser'
 import { parseSSE } from 'stitchkit'
+import { createAuthorizationCodeClient } from 'stitchkit/oauth'
 ```
 
 Server code imports server entrypoints:
@@ -90,6 +91,7 @@ import { createAgentRuntime, defineAgentProtocol } from 'stitchkit/agent-runtime
 import { createBunSqliteAgentRuntimeStore } from 'stitchkit/agent-runtime/sqlite/bun'
 import { createApplication, defineManagedResource } from 'stitchkit/application'
 import { implementRemote } from 'stitchkit/remote'
+import { createGoogleOidcClient } from 'stitchkit/google'
 ```
 
 The root `stitchkit` entrypoint is browser-safe. Server, tool, optional managed

package/dist/agent-runtime-coding-tools.js

@@ -6,7 +6,8 @@ import {
 } from "./index-3yqgj323.js";
 import"./index-bn2cjajt.js";
 import"./index-gte38nbm.js";
-import"./index-kazec06k.js";
+import"./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
 import"./index-8z9we758.js";
 import"./index-fenaekmk.js";

package/dist/agent-runtime-harness.js

@@ -23,7 +23,8 @@ import"./index-8pjqv3zh.js";
 import"./index-vsbzgd7b.js";
 import"./index-f9mb610r.js";
 import"./index-2hryh65w.js";
-import"./index-kazec06k.js";
+import"./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
 import"./index-zcgf3gqf.js";
 import"./index-7zbps32p.js";

package/dist/agent-runtime-sandbox.js

@@ -7,7 +7,8 @@ import {
   missingSandboxRestrictions,
   probeAgentProcessSandbox
 } from "./index-gte38nbm.js";
-import"./index-kazec06k.js";
+import"./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
 import"./index-8z9we758.js";
 import"./index-fenaekmk.js";

package/dist/agent-runtime.js

@@ -177,7 +177,8 @@ import"./index-8pjqv3zh.js";
 import"./index-vsbzgd7b.js";
 import"./index-f9mb610r.js";
 import"./index-2hryh65w.js";
-import"./index-kazec06k.js";
+import"./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
 import {
   childSpan,

package/dist/application/grammy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grammy.d.ts","sourceRoot":"","sources":["../../src/application/grammy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAMzE,MAAM,WAAW,2BAA2B,CAAC,CAAC,SAAS,OAAO;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAcD,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,OAAO,EACrD,MAAM,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACrC,eAAe,CAiEjB;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,WAAW,2BAA2B,CAAC,CAAC,SAAS,OAAO;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,OAAO;IACtD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,YAAY,CACV,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,oBAAoB,CAAC,EAAE,oBAAoB,GAC1C,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,SAAQ,QAAQ,CAAC,8BAA8B,CAAC;IACzF,cAOC;CACF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,OAAO,EAC3D,MAAM,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACrC,qBAAqB,CAAC,CAAC,CAAC,CAiE1B"}
+{"version":3,"file":"grammy.d.ts","sourceRoot":"","sources":["../../src/application/grammy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAMzE,MAAM,WAAW,2BAA2B,CAAC,CAAC,SAAS,OAAO;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAcD,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,OAAO,EACrD,MAAM,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACrC,eAAe,CAiEjB;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9F,MAAM,WAAW,2BAA2B,CAAC,CAAC,SAAS,OAAO;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,OAAO;IACtD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,YAAY,CACV,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,oBAAoB,CAAC,EAAE,oBAAoB,GAC1C,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAaD;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,SAAQ,QAAQ,CAAC,8BAA8B,CAAC;IACzF,cAOC;CACF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,OAAO,EAC3D,MAAM,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACrC,qBAAqB,CAAC,CAAC,CAAC,CAiE1B"}

package/dist/application-grammy.js

@@ -86,6 +86,9 @@ function grammyPollingResource(config) {
     }
   });
 }
+function grammyNodeSignal(signal) {
+  return signal;
+}
 
 class GrammyWebhookUnavailableError extends AppError {
   constructor() {
@@ -115,7 +118,7 @@ function createGrammyWebhookResource(config) {
     ...config.dependsOn && { dependsOn: config.dependsOn },
     ...config.required !== undefined && { required: config.required },
     async start(context) {
-      await config.bot.init(context.signal);
+      await config.bot.init(grammyNodeSignal(context.signal));
     },
     activate() {
       accepting = true;

package/dist/cli.js

@@ -19,7 +19,8 @@ import"./index-8pjqv3zh.js";
 import"./index-vsbzgd7b.js";
 import"./index-f9mb610r.js";
 import"./index-2hryh65w.js";
-import"./index-kazec06k.js";
+import"./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
 import"./index-zcgf3gqf.js";
 import {

package/dist/contract/index.js

@@ -8,7 +8,8 @@ import {
   defineErrors,
   encodeCursor,
   paginatedSchema
-} from "../index-kazec06k.js";
+} from "../index-nrqg8tks.js";
+import"../index-rxfy4cq7.js";
 import {
   ManagedFilePathSchema,
   ManagedFileRefSchema

package/dist/google.d.ts

@@ -0,0 +1,56 @@
+export type GoogleOidcErrorCode = 'MISCONFIGURED' | 'INVALID_CREDENTIAL' | 'UPSTREAM_UNAVAILABLE';
+export declare class GoogleOidcError extends Error {
+    readonly code: GoogleOidcErrorCode;
+    readonly retryable: boolean;
+    constructor(code: GoogleOidcErrorCode, options?: ErrorOptions);
+}
+export interface GoogleOidcIdentity {
+    subject: string;
+    email: string;
+    name?: string;
+    picture?: string;
+}
+export interface GoogleOidcClaims {
+    sub?: string;
+    email?: string;
+    emailVerified?: boolean;
+    nonce?: string;
+    name?: string;
+    picture?: string;
+}
+export interface GoogleOidcExchangeInput {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    clientId: string;
+    clientSecret: string;
+    tokenEndpoint: string;
+    signal: AbortSignal;
+}
+export type GoogleOidcTokenTransport = (input: GoogleOidcExchangeInput) => Promise<{
+    idToken: string;
+}>;
+export type GoogleOidcIdTokenVerifier = (input: {
+    idToken: string;
+    audience: string;
+}) => Promise<GoogleOidcClaims>;
+export interface GoogleOidcClientConfig {
+    clientId: string;
+    clientSecret: string;
+    allowedRedirectUris: readonly string[];
+    timeoutMs?: number;
+    fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+    tokenTransport?: GoogleOidcTokenTransport;
+    idTokenVerifier?: GoogleOidcIdTokenVerifier;
+}
+export interface ExchangeGoogleAuthorizationCodeInput {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    nonce: string;
+}
+export interface GoogleOidcClient {
+    exchangeAuthorizationCode(input: ExchangeGoogleAuthorizationCodeInput): Promise<GoogleOidcIdentity>;
+}
+export declare function createGoogleOidcClient(config: GoogleOidcClientConfig): GoogleOidcClient;
+//# sourceMappingURL=google.d.ts.map

package/dist/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../src/google.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,oBAAoB,GACpB,sBAAsB,CAAC;AAQ3B,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B,YAAY,IAAI,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,YAAY,EAK5D;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,MAAM,wBAAwB,GAAG,CACrC,KAAK,EAAE,uBAAuB,KAC3B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAElC,MAAM,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEhC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjF,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,eAAe,CAAC,EAAE,yBAAyB,CAAC;CAC7C;AAED,MAAM,WAAW,oCAAoC;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB,CACvB,KAAK,EAAE,oCAAoC,GAC1C,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAqGD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,gBAAgB,CAmFvF"}

package/dist/google.js

@@ -0,0 +1,175 @@
+// src/google.ts
+import { OAuth2Client } from "google-auth-library";
+import { z } from "zod";
+var DEFAULT_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var ERROR_MESSAGES = {
+  MISCONFIGURED: "Google OIDC is not configured correctly.",
+  INVALID_CREDENTIAL: "The Google credential is invalid.",
+  UPSTREAM_UNAVAILABLE: "Google identity verification is temporarily unavailable."
+};
+
+class GoogleOidcError extends Error {
+  code;
+  retryable;
+  constructor(code, options) {
+    super(ERROR_MESSAGES[code], options);
+    this.name = "GoogleOidcError";
+    this.code = code;
+    this.retryable = code === "UPSTREAM_UNAVAILABLE";
+  }
+}
+function recordOf(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : null;
+}
+function statusOf(error) {
+  const record = recordOf(error);
+  const response = recordOf(record?.response);
+  return typeof response?.status === "number" ? response.status : null;
+}
+function codeOf(error) {
+  const record = recordOf(error);
+  return typeof record?.code === "string" ? record.code : null;
+}
+function upstreamVerifierFailure(error) {
+  const status = statusOf(error);
+  if (status !== null && (status === 429 || status >= 500))
+    return true;
+  return ["ECONNRESET", "ECONNREFUSED", "ETIMEDOUT", "ENOTFOUND", "EAI_AGAIN"].includes(codeOf(error) ?? "");
+}
+function constantTimeEqual(left, right) {
+  const leftBytes = new TextEncoder().encode(left);
+  const rightBytes = new TextEncoder().encode(right);
+  if (leftBytes.length !== rightBytes.length)
+    return false;
+  let difference = 0;
+  for (let index = 0;index < leftBytes.length; index += 1) {
+    difference |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
+  }
+  return difference === 0;
+}
+function defaultTokenTransport(fetcher) {
+  return async (input) => {
+    let response;
+    try {
+      response = await fetcher(input.tokenEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code: input.code,
+          code_verifier: input.codeVerifier,
+          redirect_uri: input.redirectUri,
+          client_id: input.clientId,
+          client_secret: input.clientSecret
+        }),
+        signal: input.signal
+      });
+    } catch {
+      throw new GoogleOidcError("UPSTREAM_UNAVAILABLE");
+    }
+    if (!response.ok) {
+      throw new GoogleOidcError(response.status === 429 || response.status >= 500 ? "UPSTREAM_UNAVAILABLE" : "INVALID_CREDENTIAL");
+    }
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new GoogleOidcError("UPSTREAM_UNAVAILABLE");
+    }
+    const idToken = recordOf(body)?.id_token;
+    if (typeof idToken !== "string" || !idToken) {
+      throw new GoogleOidcError("INVALID_CREDENTIAL");
+    }
+    return { idToken };
+  };
+}
+function defaultIdTokenVerifier(clientId, clientSecret) {
+  const client = new OAuth2Client(clientId, clientSecret);
+  return async ({ idToken, audience }) => {
+    const ticket = await client.verifyIdToken({ idToken, audience });
+    const payload = ticket.getPayload();
+    if (!payload)
+      throw new GoogleOidcError("INVALID_CREDENTIAL");
+    return {
+      sub: payload.sub,
+      email: payload.email,
+      emailVerified: payload.email_verified,
+      nonce: payload.nonce,
+      name: payload.name,
+      picture: payload.picture
+    };
+  };
+}
+function createGoogleOidcClient(config) {
+  const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (!config.clientId || !config.clientSecret || config.allowedRedirectUris.length === 0 || config.allowedRedirectUris.some((uri) => !uri) || !Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new GoogleOidcError("MISCONFIGURED");
+  }
+  const allowedRedirectUris = new Set(config.allowedRedirectUris);
+  const transport = config.tokenTransport ?? defaultTokenTransport(config.fetch ?? globalThis.fetch);
+  const verify = config.idTokenVerifier ?? defaultIdTokenVerifier(config.clientId, config.clientSecret);
+  return {
+    async exchangeAuthorizationCode(input) {
+      if (!allowedRedirectUris.has(input.redirectUri)) {
+        throw new GoogleOidcError("INVALID_CREDENTIAL");
+      }
+      if (!input.code || !input.codeVerifier || !input.nonce) {
+        throw new GoogleOidcError("INVALID_CREDENTIAL");
+      }
+      const controller = new AbortController;
+      let timer;
+      const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new GoogleOidcError("UPSTREAM_UNAVAILABLE"));
+        }, timeoutMs);
+      });
+      let exchanged;
+      try {
+        exchanged = await Promise.race([
+          transport({
+            code: input.code,
+            codeVerifier: input.codeVerifier,
+            redirectUri: input.redirectUri,
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            tokenEndpoint: DEFAULT_TOKEN_ENDPOINT,
+            signal: controller.signal
+          }),
+          deadline
+        ]);
+      } catch (cause) {
+        if (cause instanceof GoogleOidcError)
+          throw cause;
+        throw new GoogleOidcError("UPSTREAM_UNAVAILABLE");
+      } finally {
+        if (timer)
+          clearTimeout(timer);
+      }
+      if (!exchanged.idToken)
+        throw new GoogleOidcError("INVALID_CREDENTIAL");
+      let claims;
+      try {
+        claims = await verify({ idToken: exchanged.idToken, audience: config.clientId });
+      } catch (cause) {
+        if (cause instanceof GoogleOidcError)
+          throw cause;
+        throw new GoogleOidcError(upstreamVerifierFailure(cause) ? "UPSTREAM_UNAVAILABLE" : "INVALID_CREDENTIAL");
+      }
+      if (!claims.sub || !claims.email || claims.emailVerified !== true || !claims.nonce || !constantTimeEqual(claims.nonce, input.nonce) || !z.email().safeParse(claims.email).success) {
+        throw new GoogleOidcError("INVALID_CREDENTIAL");
+      }
+      return {
+        subject: claims.sub,
+        email: claims.email,
+        ...claims.name ? { name: claims.name } : {},
+        ...claims.picture ? { picture: claims.picture } : {}
+      };
+    }
+  };
+}
+export {
+  createGoogleOidcClient,
+  GoogleOidcError
+};

package/dist/{index-ra6txecz.js → index-640tz39q.js}

@@ -22,7 +22,7 @@ import {
   isOriginAllowed,
   mediaTypeEssence,
   reportSignalError
-} from "./index-z78bjcxj.js";
+} from "./index-aj9geeez.js";
 import {
   getRequestContext,
   runWithRequestContext,
@@ -46,7 +46,7 @@ import {
   DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
   joinRoutePath,
   parseTrailingWildcard
-} from "./index-kazec06k.js";
+} from "./index-nrqg8tks.js";
 import {
   resolveTraceContext
 } from "./index-zcgf3gqf.js";

package/dist/{index-z78bjcxj.js → index-aj9geeez.js}

@@ -1,7 +1,7 @@
 import {
   mergeMeta,
   resolveRouteParamsSchema
-} from "./index-kazec06k.js";
+} from "./index-nrqg8tks.js";
 import {
   isUnsafeKey
 } from "./index-kzfs85xp.js";

package/dist/{index-bg8ypxzn.js → index-bva395we.js}

@@ -1,12 +1,15 @@
+import {
+  deriveCodeChallenge
+} from "./index-hr4tzbwq.js";
 import {
   contextContributionDelta,
   mergeContextContribution,
   prepareContextContribution
-} from "./index-z78bjcxj.js";
+} from "./index-aj9geeez.js";
 import {
   base64UrlToBytes,
   bytesToBase64Url
-} from "./index-kazec06k.js";
+} from "./index-rxfy4cq7.js";
 import {
   forbidden,
   unauthorized
@@ -312,10 +315,6 @@ function createBearerResolver(config) {
 }
 
 // src/server/middleware/pkce.ts
-async function deriveCodeChallenge(verifier) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return bytesToBase64Url(new Uint8Array(digest));
-}
 async function verifyPkce(verifier, challenge) {
   if (!verifier || !challenge)
     return false;
@@ -323,4 +322,4 @@ async function verifyPkce(verifier, challenge) {
   return derived === challenge;
 }
 
-export { parseCookieHeader, parseCookies, serializeCookie, defineCookie, verifyJwt, signJwt, extractToken, createAuthHook, composeAuthHooks, createBearerResolver, deriveCodeChallenge, verifyPkce };
+export { parseCookieHeader, parseCookies, serializeCookie, defineCookie, verifyJwt, signJwt, extractToken, createAuthHook, composeAuthHooks, createBearerResolver, verifyPkce };

package/dist/index-hr4tzbwq.js

@@ -0,0 +1,11 @@
+import {
+  bytesToBase64Url
+} from "./index-rxfy4cq7.js";
+
+// src/internal/pkce.ts
+async function deriveCodeChallenge(verifier, subtle = globalThis.crypto.subtle) {
+  const digest = await subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return bytesToBase64Url(new Uint8Array(digest));
+}
+
+export { deriveCodeChallenge };

package/dist/{index-kazec06k.js → index-nrqg8tks.js}

@@ -1,3 +1,7 @@
+import {
+  base64UrlToBytes,
+  bytesToBase64Url
+} from "./index-rxfy4cq7.js";
 import {
   AppError,
   STITCH_ERROR_STATUS,
@@ -422,24 +426,6 @@ function createContractFactory(config) {
 }
 // src/contract/pagination.ts
 import { z as z3 } from "zod";
-
-// src/internal/base64url.ts
-function bytesToBase64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes)
-    binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64UrlToBytes(segment) {
-  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
-    throw new Error("invalid base64url segment");
-  }
-  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
-  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-}
-
-// src/contract/pagination.ts
 function paginatedSchema(itemSchema) {
   return z3.object({
     items: z3.array(itemSchema),
@@ -481,4 +467,4 @@ var ContractStreamFrameSchema = z4.discriminatedUnion("type", [
   }).strict(),
   z4.object({ type: z4.literal("end") }).strict()
 ]);
-export { joinRoutePath, resolveRouteParamsSchema, parseTrailingWildcard, ALL_TRANSPORTS, defineContract, mergeMeta, defineErrors, createContractFactory, bytesToBase64Url, base64UrlToBytes, paginatedSchema, encodeCursor, decodeCursor, DEFAULT_CONTRACT_STREAM_FRAME_BYTES, ContractStreamFrameSchema };
+export { joinRoutePath, resolveRouteParamsSchema, parseTrailingWildcard, ALL_TRANSPORTS, defineContract, mergeMeta, defineErrors, createContractFactory, paginatedSchema, encodeCursor, decodeCursor, DEFAULT_CONTRACT_STREAM_FRAME_BYTES, ContractStreamFrameSchema };

package/dist/index-rxfy4cq7.js

@@ -0,0 +1,17 @@
+// src/internal/base64url.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+
+export { bytesToBase64Url, base64UrlToBytes };

package/dist/{index-6q3zjwaz.js → index-vy2nxwg8.js}

@@ -16,7 +16,7 @@ import {
   ContractStreamFrameSchema,
   DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
   parseTrailingWildcard
-} from "./index-kazec06k.js";
+} from "./index-nrqg8tks.js";
 import {
   isRecord,
   mapObject,

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   createUrlBuilder,
   createUrlBuilders,
   parseNDJSON
-} from "./index-6q3zjwaz.js";
+} from "./index-vy2nxwg8.js";
 import {
   REALTIME_REJECTION_KEY,
   asRealtimeRejection,
@@ -60,7 +60,8 @@ import {
   defineErrors,
   encodeCursor,
   paginatedSchema
-} from "./index-kazec06k.js";
+} from "./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import {
   ManagedFilePathSchema,
   ManagedFileRefSchema

package/dist/internal/pkce.d.ts

@@ -0,0 +1,3 @@
+/** Derive the RFC 7636 S256 challenge with the caller's Web Crypto implementation. */
+export declare function deriveCodeChallenge(verifier: string, subtle?: Pick<SubtleCrypto, 'digest'>): Promise<string>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/internal/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/internal/pkce.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAA4B,GAC9D,OAAO,CAAC,MAAM,CAAC,CAGjB"}

package/dist/node.js

@@ -5,7 +5,7 @@ import {
   createHandler,
   createSocketIOServer,
   createUnixClientTransport
-} from "./index-ra6txecz.js";
+} from "./index-640tz39q.js";
 import"./index-y91ry9h2.js";
 import {
   ShutdownOptionsSchema,
@@ -24,11 +24,12 @@ import {
   createScopedImplementRegistry,
   implement,
   implementRegistry
-} from "./index-z78bjcxj.js";
+} from "./index-aj9geeez.js";
 import"./index-vsbzgd7b.js";
 import"./index-f9mb610r.js";
 import"./index-2hryh65w.js";
-import"./index-kazec06k.js";
+import"./index-nrqg8tks.js";
+import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
 import"./index-zcgf3gqf.js";
 import {

package/dist/oauth.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Browser-safe OAuth Authorization Code + PKCE mechanics.
+ *
+ * The application owns navigation, token exchange, identity, persistence,
+ * sessions, roles and account policy. This module owns one pending browser
+ * transaction and consumes it exactly once.
+ */
+import type { z } from 'zod';
+export type AuthorizationCodeClientErrorCode = 'INVALID_CONFIGURATION' | 'RESERVED_PARAMETER' | 'INVALID_CONTEXT' | 'STORAGE_FAILURE' | 'MISSING_TRANSACTION' | 'MALFORMED_TRANSACTION' | 'UNSUPPORTED_TRANSACTION_VERSION' | 'STATE_MISMATCH';
+export declare class AuthorizationCodeClientError extends Error {
+    readonly code: AuthorizationCodeClientErrorCode;
+    constructor(code: AuthorizationCodeClientErrorCode, options?: ErrorOptions);
+}
+export interface AuthorizationCodeStorage {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+export interface AuthorizationCodeCrypto {
+    getRandomValues(bytes: Uint8Array): Uint8Array;
+    subtle: Pick<SubtleCrypto, 'digest'>;
+}
+export interface AuthorizationCodeClientConfig<TContext> {
+    authorizationEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    scopes: readonly string[];
+    storage: AuthorizationCodeStorage;
+    storageKey: string;
+    contextSchema: z.ZodType<TContext>;
+    authorizationParameters?: Readonly<Record<string, string>>;
+    /** Web Crypto seam for deterministic tests. Defaults at call time, never module load. */
+    crypto?: AuthorizationCodeCrypto;
+}
+export interface BeginAuthorizationCodeInput<TContext> {
+    context: TContext;
+}
+export interface BeginAuthorizationCodeResult {
+    authorizationUrl: string;
+}
+export interface ConsumeAuthorizationCodeInput {
+    state: string;
+}
+export interface ConsumedAuthorizationCode<TContext> {
+    codeVerifier: string;
+    nonce: string;
+    redirectUri: string;
+    context: TContext;
+}
+export interface AuthorizationCodeClient<TContext> {
+    begin(input: BeginAuthorizationCodeInput<TContext>): Promise<BeginAuthorizationCodeResult>;
+    consume(input: ConsumeAuthorizationCodeInput): ConsumedAuthorizationCode<TContext>;
+}
+export declare function createAuthorizationCodeClient<TContext>(config: AuthorizationCodeClientConfig<TContext>): AuthorizationCodeClient<TContext>;
+/** Keep a return target on the current origin, or use the caller's trusted fallback. */
+export declare function safeInternalReturnPath(candidate: string | null | undefined, fallback: string): string;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgB7B,MAAM,MAAM,gCAAgC,GACxC,uBAAuB,GACvB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,uBAAuB,GACvB,iCAAiC,GACjC,gBAAgB,CAAC;AAarB,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC;IAEhD,YAAY,IAAI,EAAE,gCAAgC,EAAE,OAAO,CAAC,EAAE,YAAY,EAIzE;CACF;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IAC/C,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,6BAA6B,CAAC,QAAQ;IACrD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,wBAAwB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,uBAAuB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,yFAAyF;IACzF,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B,CAAC,QAAQ;IACnD,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB,CAAC,QAAQ;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB,CAAC,QAAQ;IAC/C,KAAK,CAAC,KAAK,EAAE,2BAA2B,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3F,OAAO,CAAC,KAAK,EAAE,6BAA6B,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;CACpF;AAmED,wBAAgB,6BAA6B,CAAC,QAAQ,EACpD,MAAM,EAAE,6BAA6B,CAAC,QAAQ,CAAC,GAC9C,uBAAuB,CAAC,QAAQ,CAAC,CAgFnC;AAED,wFAAwF;AACxF,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,GACf,MAAM,CAcR"}