@9in-io/sdk 0.0.0-stage → 0.1.0

package/dist/server.js

@@ -0,0 +1,490 @@
+import { NineError, decodeJwt, discover, normalizeIssuer, postForm, toHex, utf8 } from "./util.js";
+export { NineError, normalizeIssuer } from "./util.js";
+/** WebCrypto parameters for each JWS algorithm 9in signs with. */
+const ALGORITHMS = {
+    RS256: { import: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, verify: "RSASSA-PKCS1-v1_5" },
+    RS384: { import: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, verify: "RSASSA-PKCS1-v1_5" },
+    RS512: { import: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }, verify: "RSASSA-PKCS1-v1_5" },
+    PS256: { import: { name: "RSA-PSS", hash: "SHA-256" }, verify: { name: "RSA-PSS", saltLength: 32 } },
+    PS384: { import: { name: "RSA-PSS", hash: "SHA-384" }, verify: { name: "RSA-PSS", saltLength: 48 } },
+    PS512: { import: { name: "RSA-PSS", hash: "SHA-512" }, verify: { name: "RSA-PSS", saltLength: 64 } },
+    ES256: { import: { name: "ECDSA", namedCurve: "P-256" }, verify: { name: "ECDSA", hash: "SHA-256" } },
+    ES384: { import: { name: "ECDSA", namedCurve: "P-384" }, verify: { name: "ECDSA", hash: "SHA-384" } },
+    EdDSA: { import: { name: "Ed25519" }, verify: "Ed25519" },
+};
+const HMAC_HASH = { HS256: "SHA-256", HS384: "SHA-384", HS512: "SHA-512" };
+const jwksCache = new Map();
+const keyCache = new Map();
+/**
+ * kid → time it was last looked up without success. An unknown kid (e.g. right after a key
+ * rotation) triggers one JWKS refetch; junk kids are then ignored for a minute.
+ */
+const missingKids = new Map();
+async function jwks(issuer, fetcher, force = false) {
+    const hit = jwksCache.get(issuer);
+    if (hit && !force && Date.now() - hit.fetchedAt < 10 * 60_000)
+        return hit.keys;
+    const config = await discover(issuer, fetcher);
+    const res = await fetcher(config.jwks_uri);
+    if (!res.ok)
+        throw new NineError("jwks_unavailable", `HTTP ${res.status}`, res.status);
+    const body = (await res.json());
+    jwksCache.set(issuer, { keys: body.keys, fetchedAt: Date.now() });
+    return body.keys;
+}
+async function findKey(issuer, kid, fetcher) {
+    const keys = await jwks(issuer, fetcher);
+    const known = keys.find((k) => k.kid === kid);
+    if (known)
+        return known;
+    const missKey = `${issuer}|${String(kid)}`;
+    const missedAt = missingKids.get(missKey);
+    if (missedAt && Date.now() - missedAt < 60_000)
+        return undefined;
+    const refreshed = (await jwks(issuer, fetcher, true)).find((k) => k.kid === kid);
+    if (!refreshed) {
+        missingKids.set(missKey, Date.now());
+        if (missingKids.size > 1000)
+            missingKids.clear();
+    }
+    return refreshed;
+}
+async function importPublicKey(jwk, alg) {
+    const id = `${alg}:${jwk.kid}:${(jwk.n ?? jwk.x ?? "").slice(0, 32)}`;
+    let key = keyCache.get(id);
+    if (!key) {
+        const { kty, n, e, crv, x, y } = jwk;
+        const material = kty === "RSA" ? { kty, n, e } : kty === "EC" ? { kty, crv, x, y } : { kty, crv, x };
+        key = await crypto.subtle.importKey("jwk", material, ALGORITHMS[alg].import, false, ["verify"]);
+        if (keyCache.size > 200)
+            keyCache.clear();
+        keyCache.set(id, key);
+    }
+    return key;
+}
+const ACCESS_TOKEN_TYPES = new Set(["at+jwt", "application/at+jwt"]);
+/**
+ * Verifies a 9in JWT access token locally: signature (against your tenant's JWKS, or your
+ * API's shared secret for HMAC keys), token type, issuer, audience, expiry and required
+ * scopes. Keys are cached and refetched once when a new key appears.
+ *
+ * This is a local check: a token revoked before it expires still passes. Use
+ * `createTokenVerifier` (hybrid mode) when revocation must take effect at once.
+ */
+export async function verifyAccessToken(token, options) {
+    if (!token)
+        throw new NineError("invalid_token", "missing token", 401);
+    const fetcher = options.fetch ?? fetch.bind(globalThis);
+    const issuer = normalizeIssuer(options.issuer, options.allowInsecureIssuer);
+    let parts;
+    try {
+        parts = decodeJwt(token);
+    }
+    catch {
+        throw new NineError("invalid_token", "malformed token", 401);
+    }
+    const { header, payload, signingInput, signature } = parts;
+    const alg = String(header.alg);
+    if (!ACCESS_TOKEN_TYPES.has(String(header.typ).toLowerCase()))
+        throw new NineError("invalid_token", "not an access token", 401);
+    let valid;
+    if (HMAC_HASH[alg]) {
+        if (!options.secret)
+            throw new NineError("invalid_token", "HMAC-signed token: pass the API's secret", 401);
+        const key = await crypto.subtle.importKey("raw", utf8(options.secret), { name: "HMAC", hash: HMAC_HASH[alg] }, false, ["verify"]);
+        valid = await crypto.subtle.verify("HMAC", key, signature, utf8(signingInput));
+    }
+    else if (ALGORITHMS[alg]) {
+        const jwk = await findKey(issuer, header.kid, fetcher);
+        if (!jwk)
+            throw new NineError("invalid_token", "unknown signing key", 401);
+        // The key decides the algorithm, never the token alone (no algorithm confusion).
+        if (jwk.alg && jwk.alg !== alg)
+            throw new NineError("invalid_token", "algorithm does not match the key", 401);
+        valid = await crypto.subtle.verify(ALGORITHMS[alg].verify, await importPublicKey(jwk, alg), signature, utf8(signingInput));
+    }
+    else {
+        throw new NineError("invalid_token", "unsupported algorithm", 401);
+    }
+    if (!valid)
+        throw new NineError("invalid_token", "bad signature", 401);
+    checkClaims(payload, issuer, options);
+    return payload;
+}
+function checkClaims(payload, issuer, options) {
+    const now = Math.floor(Date.now() / 1000);
+    const skew = options.clockTolerance ?? 30;
+    if (String(payload.iss).replace(/\/$/, "") !== issuer)
+        throw new NineError("invalid_token", "issuer mismatch", 401);
+    if (typeof payload.exp !== "number" || payload.exp + skew < now)
+        throw new NineError("invalid_token", "token expired", 401);
+    if (typeof payload.nbf === "number" && payload.nbf - skew > now)
+        throw new NineError("invalid_token", "token not yet valid", 401);
+    if (options.audience) {
+        const wanted = Array.isArray(options.audience) ? options.audience : [options.audience];
+        const aud = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+        if (!wanted.some((a) => aud.includes(a)))
+            throw new NineError("invalid_token", "audience mismatch", 401);
+    }
+    checkScope(payload, options.scope);
+}
+function checkScope(payload, scope) {
+    if (!scope)
+        return;
+    const required = Array.isArray(scope) ? scope : scope.split(" ").filter(Boolean);
+    const granted = new Set(String(payload.scope ?? "").split(" "));
+    const missing = required.filter((s) => !granted.has(s));
+    if (missing.length)
+        throw new NineError("insufficient_scope", `missing ${missing.join(", ")}`, 403);
+}
+const OPAQUE_PREFIX = "9in_at_";
+async function cacheKey(token) {
+    return toHex(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8(token))));
+}
+/**
+ * Token verification with a choice of trade-off between speed and revocation (SSOfy's
+ * "hybrid" validation, kept): see `mode`.
+ *
+ *   const verifier = createTokenVerifier({ issuer, audience: "https://api.acme.com", clientId, clientSecret });
+ *   const claims = await verifier.verify(bearer, { scope: "orders:read" });
+ *
+ *   // webhook endpoint (token.revoked, session.revoked, user.* events)
+ *   verifier.handleEvent(await verifyWebhook(secret, request));
+ */
+export function createTokenVerifier(options) {
+    const mode = options.mode ?? "hybrid";
+    const fetcher = options.fetch ?? fetch.bind(globalThis);
+    const issuer = normalizeIssuer(options.issuer, options.allowInsecureIssuer);
+    const ttl = (options.cacheTtl ?? 300) * 1000;
+    const size = options.cacheSize ?? 10_000;
+    const cache = new Map();
+    const inflight = new Map();
+    if (mode !== "local" && (!options.clientId || !options.clientSecret)) {
+        throw new NineError("invalid_options", `${mode} mode needs clientId and clientSecret (a confidential application) for introspection`);
+    }
+    async function introspect(token) {
+        const config = await discover(issuer, fetcher);
+        const endpoint = config.introspection_endpoint ?? `${issuer}/oauth/introspect`;
+        const body = await postForm(endpoint, { token }, { Authorization: `Basic ${btoa(`${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`)}` }, fetcher);
+        if (body.active !== true || body.token_type === "refresh_token")
+            return null;
+        return body;
+    }
+    function remember(key, entry) {
+        cache.delete(key);
+        cache.set(key, entry);
+        while (cache.size > size)
+            cache.delete(cache.keys().next().value);
+    }
+    /** The live claims (`local` for a JWT, once 9in confirms it is active), or null when revoked. */
+    async function lookup(token, local) {
+        const key = await cacheKey(token);
+        if (mode === "hybrid") {
+            const hit = cache.get(key);
+            if (hit && hit.until > Date.now()) {
+                remember(key, hit); // most recently used
+                return hit.claims;
+            }
+        }
+        let pending = inflight.get(key);
+        if (!pending) {
+            pending = introspect(token).finally(() => inflight.delete(key));
+            inflight.set(key, pending);
+        }
+        const answer = await pending;
+        const claims = answer && local ? local : answer;
+        if (mode === "hybrid") {
+            const expiry = (claims?.exp ?? local?.exp ?? 0) * 1000;
+            // A revoked token never comes back: remember the refusal until it expires.
+            const until = claims ? Math.min(Date.now() + ttl, expiry) : expiry ? expiry : Date.now() + 60_000;
+            if (until > Date.now())
+                remember(key, { claims, until });
+        }
+        return claims;
+    }
+    return {
+        async verify(token, extra = {}) {
+            if (!token)
+                throw new NineError("invalid_token", "missing token", 401);
+            const opaque = token.startsWith(OPAQUE_PREFIX);
+            if (opaque && mode === "local")
+                throw new NineError("invalid_token", "opaque tokens need hybrid or introspect mode", 401);
+            const local = opaque ? null : await verifyAccessToken(token, { ...options, scope: extra.scope });
+            if (mode === "local")
+                return local;
+            const claims = await lookup(token, local);
+            if (!claims)
+                throw new NineError("invalid_token", "token revoked", 401);
+            if (!local)
+                checkClaims(claims, issuer, { ...options, scope: extra.scope });
+            return claims;
+        },
+        handleEvent(event) {
+            const data = event.data ?? {};
+            let match = null;
+            if (event.type === "token.revoked" && data.type === "access_token" && data.jti)
+                match = (c) => c.jti === data.jti;
+            else if (event.type === "session.revoked" && data.sid)
+                match = (c) => c.sid === data.sid;
+            else if (["user.sessions_revoked", "user.deleted", "user.updated", "user.password_changed"].includes(event.type) && data.userId) {
+                match = (c) => c.sub === data.userId;
+            }
+            if (!match)
+                return 0;
+            let evicted = 0;
+            for (const [key, entry] of cache) {
+                if (entry.claims && match(entry.claims)) {
+                    cache.delete(key);
+                    evicted++;
+                }
+            }
+            return evicted;
+        },
+        clear() {
+            cache.clear();
+        },
+    };
+}
+export class ManagementClient {
+    options;
+    /** One token per scope: each call asks only for what it needs, so an app granted some scopes works. */
+    tokens = new Map();
+    fetcher;
+    issuer;
+    constructor(options) {
+        this.options = options;
+        this.fetcher = options.fetch ?? fetch.bind(globalThis);
+        this.issuer = normalizeIssuer(options.issuer, options.allowInsecureIssuer);
+    }
+    async accessToken(scope) {
+        const cached = this.tokens.get(scope);
+        if (cached && cached.expiresAt - 30_000 > Date.now())
+            return cached.value;
+        const config = await discover(this.issuer, this.fetcher);
+        const result = await postForm(config.token_endpoint, { grant_type: "client_credentials", scope }, { Authorization: `Basic ${btoa(`${encodeURIComponent(this.options.clientId)}:${encodeURIComponent(this.options.clientSecret)}`)}` }, this.fetcher);
+        this.tokens.set(scope, { value: result.access_token, expiresAt: Date.now() + result.expires_in * 1000 });
+        return result.access_token;
+    }
+    async request(method, path, body) {
+        const scope = method === "GET" ? "management:users:read" : path.includes("/sessions") ? "management:sessions:write" : "management:users:write";
+        const res = await this.fetcher(`${this.issuer}/api/v1${path}`, {
+            method,
+            headers: { Authorization: `Bearer ${await this.accessToken(scope)}`, Accept: "application/json", ...(body !== undefined ? { "Content-Type": "application/json" } : {}) },
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+        });
+        if (res.status === 204)
+            return undefined;
+        const json = (await res.json().catch(() => ({})));
+        if (!res.ok)
+            throw new NineError(String(json.error ?? "request_failed"), json.error_description ? String(json.error_description) : `HTTP ${res.status}`, res.status);
+        return json;
+    }
+    listUsers(options = {}) {
+        const params = new URLSearchParams();
+        if (options.query)
+            params.set("q", options.query);
+        if (options.cursor)
+            params.set("cursor", options.cursor);
+        if (options.limit)
+            params.set("limit", String(options.limit));
+        return this.request("GET", `/users?${params}`);
+    }
+    getUser(id) {
+        return this.request("GET", `/users/${encodeURIComponent(id)}`);
+    }
+    findUserByEmail(email) {
+        return this.request("GET", `/users/lookup?email=${encodeURIComponent(email)}`);
+    }
+    createUser(input) {
+        return this.request("POST", "/users", input);
+    }
+    updateUser(id, input) {
+        return this.request("PATCH", `/users/${encodeURIComponent(id)}`, input);
+    }
+    deleteUser(id) {
+        return this.request("DELETE", `/users/${encodeURIComponent(id)}`);
+    }
+    blockUser(id, blocked = true) {
+        return this.updateUser(id, { blocked });
+    }
+    /**
+     * Single-use URL that signs the user in (magic links, handing a user over from your app).
+     * `returnTo` must be a registered redirect URL of one of your applications or a path on
+     * the login domain. Two-factor authentication still applies.
+     */
+    createLoginLink(id, options = {}) {
+        return this.request("POST", `/users/${encodeURIComponent(id)}/login-link`, {
+            ...(options.returnTo ? { return_to: options.returnTo } : {}),
+            ...(options.ttlSeconds ? { ttl_seconds: options.ttlSeconds } : {}),
+        });
+    }
+    revokeUserSessions(id) {
+        return this.request("DELETE", `/users/${encodeURIComponent(id)}/sessions`);
+    }
+}
+const SIGNATURE_HEADER = "9in-signature";
+async function hmac(secret, payload) {
+    const key = await crypto.subtle.importKey("raw", utf8(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return toHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, utf8(payload))));
+}
+function safeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/** Verifies a `9in-signature` header: t=<unix>,v1=<hex HMAC(t.METHOD.path.body)>. */
+export async function verifySignature(secret, header, method, path, body, toleranceSeconds = 300) {
+    if (!header)
+        return false;
+    const parts = header.split(",").map((p) => p.trim());
+    const t = Number(parts.find((p) => p.startsWith("t="))?.slice(2));
+    const signatures = parts.filter((p) => p.startsWith("v1=")).map((p) => p.slice(3));
+    if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > toleranceSeconds || !signatures.length)
+        return false;
+    for (const s of Array.isArray(secret) ? secret : [secret]) {
+        const expected = await hmac(s, `${t}.${method.toUpperCase()}.${path}.${body}`);
+        if (signatures.some((sig) => safeEqual(sig, expected)))
+            return true;
+    }
+    return false;
+}
+export async function signPayload(secret, method, path, body) {
+    const t = Math.floor(Date.now() / 1000);
+    return `t=${t},v1=${await hmac(secret, `${t}.${method.toUpperCase()}.${path}.${body}`)}`;
+}
+/**
+ * Verifies a webhook request from 9in (the `9in-signature` header over the raw body) and
+ * returns the parsed event. Throws `NineError` (`invalid_signature`, 401) otherwise. Reads
+ * the body, so pass `request.clone()` if you need it afterwards.
+ *
+ *   const event = await verifyWebhook(env.NINE_WEBHOOK_SECRET, request);
+ *   if (event.type === "user.created") …
+ */
+export async function verifyWebhook(secret, request, options = {}) {
+    const body = await request.text();
+    const path = options.path ?? new URL(request.url).pathname;
+    const valid = request.method.toUpperCase() === "POST" &&
+        (await verifySignature(secret, request.headers.get(SIGNATURE_HEADER), "POST", path, body, options.toleranceSeconds));
+    if (!valid)
+        throw new NineError("invalid_signature", "webhook signature verification failed", 401);
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new NineError("invalid_payload", "webhook body is not JSON", 400);
+    }
+}
+/** In-memory EventStore: one process only (tests, single-instance servers). */
+export class MemoryEventStore {
+    items = new Map();
+    live(key) {
+        const item = this.items.get(key);
+        if (item && item.expiresAt <= Date.now()) {
+            this.items.delete(key);
+            return undefined;
+        }
+        return item;
+    }
+    async add(key, value, ttlSeconds) {
+        if (this.live(key))
+            return false;
+        this.items.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 });
+        if (this.items.size > 10_000)
+            for (const k of this.items.keys())
+                this.live(k);
+        return true;
+    }
+    async get(key) {
+        return this.live(key)?.value ?? null;
+    }
+    async set(key, value, ttlSeconds) {
+        this.items.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 });
+    }
+    async delete(key) {
+        this.items.delete(key);
+    }
+}
+/**
+ * Runs `handler` at most once per event id. 9in keeps the id on every retry and redelivery.
+ *
+ * - `processed`: first delivery, handler succeeded → answer 2xx.
+ * - `duplicate`: already processed → answer 2xx so 9in stops retrying.
+ * - `in_progress`: another delivery of the same event is still running → answer 409 so
+ *   9in tries again later.
+ * - The handler threw: the id is released and the error rethrown → answer 5xx so 9in retries.
+ *
+ *   const event = await verifyWebhook(secret, request);
+ *   const outcome = await processEventOnce(store, event.id, () => handle(event));
+ *   return new Response(null, { status: outcome.status === "in_progress" ? 409 : 204 });
+ */
+export async function processEventOnce(store, eventId, handler, options = {}) {
+    if (!eventId)
+        throw new NineError("invalid_event", "event id required");
+    const key = `${options.prefix ?? "9in:event:"}${eventId}`;
+    if (!(await store.add(key, "processing", options.lockSeconds ?? 300))) {
+        return (await store.get(key)) === "done" ? { status: "duplicate" } : { status: "in_progress" };
+    }
+    let result;
+    try {
+        result = await handler();
+    }
+    catch (error) {
+        await store.delete(key);
+        throw error;
+    }
+    await store.set(key, "done", options.ttlSeconds ?? 3 * 24 * 3600);
+    return { status: "processed", result };
+}
+/**
+ * Fetch-API handler for the adapter protocol. Mount it at your adapter base URL (it serves
+ * `…/authenticate`, `…/user` and `…/event`) in Cloudflare Workers, Deno, Bun, Hono, or Node
+ * with any Request/Response bridge (Express: `@whatwg-node/server`, Next.js route handlers…).
+ */
+export function adapterHandler(handlers) {
+    const signingSecret = Array.isArray(handlers.secret) ? handlers.secret[0] : handlers.secret;
+    return async (request) => {
+        const url = new URL(request.url);
+        const body = await request.text();
+        const requestId = request.headers.get("9in-request-id") ?? "";
+        const respond = async (status, payload) => {
+            const text = payload === null ? "" : JSON.stringify(payload);
+            const headers = new Headers({ [SIGNATURE_HEADER]: await signPayload(signingSecret, "POST", `${url.pathname}#${requestId}`, text) });
+            if (text)
+                headers.set("Content-Type", "application/json");
+            return new Response(status === 204 ? null : text, { status, headers });
+        };
+        if (request.method !== "POST")
+            return new Response("Method not allowed", { status: 405 });
+        if (!(await verifySignature(handlers.secret, request.headers.get(SIGNATURE_HEADER), "POST", url.pathname, body, handlers.toleranceSeconds))) {
+            return new Response(JSON.stringify({ error: "invalid_signature" }), { status: 401, headers: { "Content-Type": "application/json" } });
+        }
+        let input;
+        try {
+            input = JSON.parse(body || "{}");
+        }
+        catch {
+            return respond(400, { error: "invalid_json" });
+        }
+        const route = url.pathname.split("/").pop();
+        if (route === "authenticate") {
+            const result = await handlers.authenticate(input.identifier, String(input.password ?? ""));
+            if (result === "invalid")
+                return respond(401, { error: "invalid_credentials" });
+            if (result === "blocked")
+                return respond(403, { error: "blocked" });
+            return respond(200, { user: result });
+        }
+        if (route === "user") {
+            const user = await handlers.findUser(input.id ? { id: String(input.id) } : { identifier: input.identifier });
+            return user ? respond(200, { user }) : respond(404, { error: "not_found" });
+        }
+        if (route === "event") {
+            await handlers.onEvent?.(input);
+            return respond(204, null);
+        }
+        return respond(404, { error: "not_found" });
+    };
+}

package/dist/util.d.ts

@@ -0,0 +1,39 @@
+/** Small, dependency-free helpers shared by the browser and server entry points. */
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlDecode(value: string): Uint8Array<ArrayBuffer>;
+export declare function randomString(bytes?: number): string;
+export declare function sha256(value: string): Promise<Uint8Array<ArrayBuffer>>;
+export declare function toHex(bytes: Uint8Array): string;
+export declare function utf8(value: string): Uint8Array<ArrayBuffer>;
+export interface JwtParts {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+    signingInput: string;
+    signature: Uint8Array<ArrayBuffer>;
+}
+export declare function decodeJwt(token: string): JwtParts;
+export declare class NineError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    constructor(code: string, message?: string, status?: number | undefined);
+}
+/**
+ * Validates an issuer URL and drops a trailing slash. Issuers must use https; plain http
+ * is accepted only for localhost, *.localhost and loopback addresses (development), or
+ * when `allowInsecure` is set. Query strings, fragments and credentials are rejected.
+ * Throws `NineError` (`invalid_issuer` / `insecure_issuer`).
+ */
+export declare function normalizeIssuer(issuer: string, allowInsecure?: boolean): string;
+export interface Discovery {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    end_session_endpoint?: string;
+    revocation_endpoint?: string;
+    introspection_endpoint?: string;
+    device_authorization_endpoint?: string;
+}
+export declare function discover(issuer: string, fetcher?: typeof fetch): Promise<Discovery>;
+export declare function postForm<T>(url: string, form: Record<string, string>, headers?: Record<string, string>, fetcher?: typeof fetch): Promise<T>;

package/dist/util.js

@@ -0,0 +1,96 @@
+/** Small, dependency-free helpers shared by the browser and server entry points. */
+const enc = new TextEncoder();
+export function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function base64UrlDecode(value) {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((value.length + 3) % 4);
+    const binary = atob(padded);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+}
+export function randomString(bytes = 32) {
+    return base64UrlEncode(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+export async function sha256(value) {
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", enc.encode(value)));
+}
+export function toHex(bytes) {
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+export function utf8(value) {
+    return enc.encode(value);
+}
+export function decodeJwt(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        throw new NineError("invalid_token", "not a JWT");
+    const json = (s) => JSON.parse(new TextDecoder().decode(base64UrlDecode(s)));
+    return { header: json(parts[0]), payload: json(parts[1]), signingInput: `${parts[0]}.${parts[1]}`, signature: base64UrlDecode(parts[2]) };
+}
+export class NineError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message ? `${code}: ${message}` : code);
+        this.code = code;
+        this.status = status;
+        this.name = "NineError";
+    }
+}
+function isLocalHostname(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    return host === "localhost" || host.endsWith(".localhost") || host === "::1" || /^127(\.\d{1,3}){3}$/.test(host);
+}
+/**
+ * Validates an issuer URL and drops a trailing slash. Issuers must use https; plain http
+ * is accepted only for localhost, *.localhost and loopback addresses (development), or
+ * when `allowInsecure` is set. Query strings, fragments and credentials are rejected.
+ * Throws `NineError` (`invalid_issuer` / `insecure_issuer`).
+ */
+export function normalizeIssuer(issuer, allowInsecure = false) {
+    let url;
+    try {
+        url = new URL(issuer);
+    }
+    catch {
+        throw new NineError("invalid_issuer", `not a URL: ${issuer}`);
+    }
+    if (url.search || url.hash || url.username || url.password)
+        throw new NineError("invalid_issuer", "an issuer has no query, fragment or credentials");
+    const secure = url.protocol === "https:" || (url.protocol === "http:" && (allowInsecure || isLocalHostname(url.hostname)));
+    if (!secure)
+        throw new NineError("insecure_issuer", `issuer must use https (got ${url.protocol}//${url.host}); plain http is only accepted for localhost`);
+    return issuer.replace(/\/$/, "");
+}
+const discoveryCache = new Map();
+export function discover(issuer, fetcher = fetch) {
+    const key = issuer.replace(/\/$/, "");
+    let hit = discoveryCache.get(key);
+    if (!hit) {
+        hit = fetcher(`${key}/.well-known/openid-configuration`).then(async (res) => {
+            if (!res.ok)
+                throw new NineError("discovery_failed", `HTTP ${res.status}`, res.status);
+            return (await res.json());
+        });
+        hit.catch(() => discoveryCache.delete(key));
+        discoveryCache.set(key, hit);
+    }
+    return hit;
+}
+export async function postForm(url, form, headers = {}, fetcher = fetch) {
+    const res = await fetcher(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", ...headers },
+        body: new URLSearchParams(form),
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok)
+        throw new NineError(String(json.error ?? "request_failed"), json.error_description ? String(json.error_description) : `HTTP ${res.status}`, res.status);
+    return json;
+}

package/package.json

@@ -1,6 +1,51 @@
 {
   "name": "@9in-io/sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Official 9in SDK: browser sign-in with PKCE, token verification, Management API client and adapter handler. Zero dependencies; runs in browsers, Node 18+, Cloudflare Workers, Deno and Bun.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "@9in/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "@9in/source": "./src/server.ts",
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "keywords": [
+    "oauth",
+    "oidc",
+    "openid-connect",
+    "authentication",
+    "sso",
+    "pkce",
+    "jwt",
+    "9in"
+  ],
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json",
+    "prepack": "npm run build",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json"
+  },
+  "devDependencies": {
+    "@9in/core": "*",
+    "typescript": "^7.0.2",
+    "vitest": "^5.1.0"
+  }
+}