@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/esm/domain/method-dispatch.js

@@ -13,7 +13,8 @@ async function dispatchMethod(input) {
     flow: input.flow,
     methodState: input.flow?.methodState ?? null,
     cookies: input.cookies,
-    dispatch: input.dispatch
+    dispatch: input.dispatch,
+    methodScratch: buildMethodScratch(input.sessionStore, input.tenant.id, input.method.id)
   };
   let result;
   try {
@@ -31,6 +32,31 @@ async function dispatchMethod(input) {
   }
   return ok(result);
 }
+function buildMethodScratch(store, tenantId, methodId) {
+  const prefix = `scratch:${tenantId}:${methodId}:`;
+  const scope = (key) => `${prefix}${key}`;
+  const unsupported = (op) => authError.internalError(`SessionStore does not implement ${op}; methodScratch is unavailable on this adapter`);
+  return {
+    put: async (key, value, ttlMs) => {
+      if (!store.saveScratch)
+        return err(unsupported("saveScratch"));
+      if (ttlMs <= 0) {
+        return err(authError.internalError(`methodScratch.put: ttlMs must be positive, got ${ttlMs}`));
+      }
+      return store.saveScratch(scope(key), value, ttlMs);
+    },
+    get: async (key) => {
+      if (!store.readScratch)
+        return err(unsupported("readScratch"));
+      return store.readScratch(scope(key));
+    },
+    delete: async (key) => {
+      if (!store.deleteScratch)
+        return err(unsupported("deleteScratch"));
+      return store.deleteScratch(scope(key));
+    }
+  };
+}
 export {
   dispatchMethod
 };

package/dist/esm/domain/method-route.js

@@ -5,6 +5,7 @@ import { safeAudit } from "./audit";
 import { AUTH_CODE_TTL_MS } from "./authorize";
 import { randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
+import { revokeAllForSubject } from "./revoke";
 import { saveEncryptedCode } from "./token";
 async function handleMethodRoute(input, deps) {
   const flowRes = await deps.sessionStore.readFlow(input.flowId);
@@ -65,6 +66,9 @@ async function translate(result, flow, deps) {
         context: final.context ?? null,
         providerSubject: result.providerSubject,
         properties: result.properties,
+        ...final.appNonce !== undefined ? { appNonce: final.appNonce } : {},
+        ...final.claimsRequest !== undefined ? { claimsRequest: final.claimsRequest } : {},
+        authTime: Math.floor(now / 1000),
         expiresAt: now + AUTH_CODE_TTL_MS
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))
@@ -103,6 +107,84 @@ async function translate(result, flow, deps) {
       return err(result.error);
   }
 }
+async function handlePublicMethodRoute(input, deps) {
+  if (!input.method.publicRoutes?.includes(input.route)) {
+    return err(authError.invalidRequest(`route "${input.route}" is not public on method "${input.method.id}"`, "path"));
+  }
+  const dispatched = await dispatchMethod({
+    method: input.method,
+    route: input.route,
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: input.subPath,
+    flow: null,
+    cookies: new Map,
+    sessionStore: deps.sessionStore,
+    dispatch: input.dispatch
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  const r = dispatched.value;
+  switch (r.kind) {
+    case "challenge": {
+      if (r.logout) {
+        const sideEffect = await runUpstreamLogout(input, deps, r.logout);
+        if (isErr(sideEffect))
+          return err(sideEffect.error);
+      }
+      return ok({
+        kind: "challenge",
+        response: r.response,
+        ...r.cache !== undefined ? { cache: r.cache } : {}
+      });
+    }
+    case "denied":
+      return ok({ kind: "denied", reason: r.reason });
+    case "success":
+      return err(authError.internalError(`public route "${input.route}" on method "${input.method.id}" ` + `returned success — a flowless route cannot authenticate`));
+    case "error":
+      return err(r.error);
+  }
+}
+async function runUpstreamLogout(input, deps, logout) {
+  let hookResult = undefined;
+  if (deps.onLogout) {
+    const evt = {
+      tenant: input.tenant,
+      methodId: input.method.id,
+      methodKind: input.method.kind,
+      reason: "upstream_slo",
+      ...logout.nameId !== undefined ? { nameId: logout.nameId } : {},
+      ...logout.sessionIndex !== undefined ? { sessionIndex: logout.sessionIndex } : {}
+    };
+    try {
+      hookResult = await deps.onLogout(evt);
+    } catch (e) {
+      return err(authError.internalError(`onLogout hook threw during upstream Single Logout for method ` + `"${input.method.id}"`, e));
+    }
+  }
+  const revokeSubject = hookResult && typeof hookResult === "object" ? hookResult.revokeSubject : undefined;
+  if (revokeSubject) {
+    const revoked = await revokeAllForSubject(input.tenant.id, revokeSubject, {
+      tokenStore: deps.tokenStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(revoked))
+      return err(revoked.error);
+  }
+  await safeAudit(deps, {
+    kind: "session_logout",
+    tenantId: input.tenant.id,
+    via: "upstream_slo",
+    methodId: input.method.id,
+    methodKind: input.method.kind,
+    ...revokeSubject ? { subjectId: revokeSubject } : {},
+    timestamp: deps.clock()
+  });
+  return ok(undefined);
+}
 export {
-  handleMethodRoute
+  handleMethodRoute,
+  handlePublicMethodRoute
 };

package/dist/esm/domain/par.js

@@ -0,0 +1,51 @@
+// src/domain/par.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { verifyClientCredentials } from "./client-auth";
+import { randomToken } from "./crypto";
+var PAR_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+var DEFAULT_PAR_TTL_MS = 60 * 1000;
+async function pushAuthorizationRequest(req, tenant, deps) {
+  if (!deps.sessionStore.savePar || !deps.sessionStore.consumePar) {
+    return err(authError.invalidRequest("session adapter does not implement PAR storage"));
+  }
+  const client = tenant.config.clients.find((c) => c.id === req.clientId);
+  if (!client) {
+    return err(authError.invalidClient(`unknown client "${req.clientId}"`));
+  }
+  if (client.type === "confidential") {
+    const authErr = await verifyClientCredentials(client, req.clientSecret);
+    if (authErr)
+      return err(authErr);
+  } else if (req.clientSecret !== undefined) {
+    return err(authError.invalidClient("public client must not present client_secret"));
+  }
+  if (req.params.client_id && req.params.client_id !== req.clientId) {
+    return err(authError.invalidRequest("client_id in body conflicts with authenticated client", "client_id"));
+  }
+  if ("request_uri" in req.params) {
+    return err(authError.invalidRequest("request_uri MUST NOT be present in a PAR request", "request_uri"));
+  }
+  const suffix = (deps.newRequestUriSuffix ?? randomToken)();
+  const requestUri = PAR_URI_PREFIX + suffix;
+  const ttl = deps.ttlMs ?? DEFAULT_PAR_TTL_MS;
+  const now = deps.clock();
+  const saved = await deps.sessionStore.savePar(requestUri, {
+    requestUri,
+    params: { ...req.params, client_id: req.clientId },
+    clientId: req.clientId,
+    issuedAt: now,
+    expiresAt: now + ttl
+  }, ttl);
+  if (isErr(saved))
+    return err(saved.error);
+  return ok({
+    request_uri: requestUri,
+    expires_in: Math.floor(ttl / 1000)
+  });
+}
+export {
+  DEFAULT_PAR_TTL_MS,
+  PAR_URI_PREFIX,
+  pushAuthorizationRequest
+};

package/dist/esm/domain/pkce.js

@@ -11,6 +11,6 @@ async function validatePkce(verifier, challenge) {
   return timingSafeEqualStr(computed, challenge);
 }
 export {
-  validatePkce,
-  s256Challenge
+  s256Challenge,
+  validatePkce
 };

package/dist/esm/domain/refresh.js

@@ -31,6 +31,14 @@ async function refreshTokens(req, deps) {
   } else if (client.type === "confidential") {
     return err(authError.invalidGrant(INVALID_REFRESH_DESC));
   }
+  if (peekedPayload.dpopJkt !== undefined) {
+    if (req.dpopJkt === undefined) {
+      return err(authError.invalidDpopProof("refresh token is DPoP-bound; request is missing a DPoP proof"));
+    }
+    if (req.dpopJkt !== peekedPayload.dpopJkt) {
+      return err(authError.invalidDpopProof("refresh token DPoP jkt does not match the original binding"));
+    }
+  }
   const consumed = await deps.tokenStore.consumeRefresh(req.refreshToken, {
     reuseWindowMs: deps.reuseWindowMs
   });
@@ -68,7 +76,10 @@ async function refreshTokens(req, deps) {
       methodId: payload.methodId,
       methodKind: payload.methodKind,
       scopes: requestedScopes,
-      audience: payload.audience
+      audience: payload.audience,
+      authTime: payload.authTime,
+      ...payload.dpopJkt !== undefined ? { dpopJkt: payload.dpopJkt } : {},
+      ...payload.claimsRequest !== undefined ? { claimsRequest: payload.claimsRequest } : {}
     },
     family: payload.family,
     deps

package/dist/esm/domain/register.js

@@ -0,0 +1,74 @@
+// src/domain/register.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { randomId, randomToken } from "./crypto";
+import { hashClientSecret } from "./token";
+async function registerNewClient(request, tenant, deps) {
+  if (!deps.registerClient) {
+    return err(authError.invalidRequest("dynamic client registration is not enabled on this deployment"));
+  }
+  if (!Array.isArray(request.redirect_uris) || request.redirect_uris.length === 0) {
+    return err(authError.invalidRequest("redirect_uris must be a non-empty array", "redirect_uris"));
+  }
+  for (const uri of request.redirect_uris) {
+    try {
+      new URL(uri);
+    } catch {
+      return err(authError.invalidRequest(`redirect_uri "${uri}" is not a valid absolute URI`, "redirect_uris"));
+    }
+  }
+  const authMethod = request.token_endpoint_auth_method ?? "client_secret_basic";
+  const isPublic = authMethod === "none";
+  const clientId = (deps.newClientId ?? randomId)();
+  const grantTypes = request.grant_types ?? ["authorization_code"];
+  const responseTypes = request.response_types ?? ["code"];
+  const scopes = request.scope ? request.scope.split(/\s+/).filter(Boolean) : ["openid"];
+  let secret;
+  let secretHash;
+  if (!isPublic) {
+    secret = (deps.newClientSecret ?? randomToken)();
+    secretHash = await hashClientSecret(secret);
+  }
+  const clientPartial = {
+    id: clientId,
+    name: request.client_name ?? clientId,
+    redirectUris: request.redirect_uris,
+    scopes,
+    grantTypes: grantTypes.filter((g) => g === "authorization_code" || g === "refresh_token" || g === "client_credentials"),
+    ...request.post_logout_redirect_uris !== undefined ? { postLogoutRedirectUris: request.post_logout_redirect_uris } : {},
+    ...request.sector_identifier_uri !== undefined ? { sectorIdentifier: request.sector_identifier_uri } : {}
+  };
+  const clientConfig = isPublic ? {
+    ...clientPartial,
+    type: "public",
+    pkceRequired: true
+  } : {
+    ...clientPartial,
+    type: "confidential",
+    secretHash,
+    pkceRequired: true
+  };
+  const hookResult = await deps.registerClient({
+    tenant,
+    request
+  });
+  if (isErr(hookResult))
+    return err(hookResult.error);
+  const persisted = hookResult.value.client;
+  const persistedSecret = hookResult.value.secret;
+  const issuedAt = Math.floor(deps.clock() / 1000);
+  return ok({
+    client_id: persisted.id,
+    ...persistedSecret !== undefined ? { client_secret: persistedSecret } : {},
+    client_id_issued_at: issuedAt,
+    client_secret_expires_at: 0,
+    redirect_uris: persisted.redirectUris,
+    grant_types: persisted.grantTypes,
+    response_types: responseTypes,
+    token_endpoint_auth_method: authMethod,
+    ...request.client_name !== undefined ? { client_name: request.client_name } : {}
+  });
+}
+export {
+  registerNewClient
+};

package/dist/esm/domain/revoke.js

@@ -76,6 +76,6 @@ async function revokeAllForSubject(tenantId, subjectId, deps) {
   return ok(undefined);
 }
 export {
-  revokeToken,
-  revokeAllForSubject
+  revokeAllForSubject,
+  revokeToken
 };

package/dist/esm/domain/state-envelope.js

@@ -75,6 +75,6 @@ function isEnvelopeShape(value) {
   return typeof v.tenantId === "string" && typeof v.flowId === "string" && typeof v.nonce === "string" && typeof v.kid === "string";
 }
 export {
-  verifyStateEnvelope,
-  mintStateEnvelope
+  mintStateEnvelope,
+  verifyStateEnvelope
 };

package/dist/esm/domain/token-exchange.js

@@ -75,6 +75,7 @@ async function exchangeToken(req, deps) {
       methodId: subjectClaims.mid ?? "token_exchange",
       methodKind: subjectClaims.mkind ?? "token_exchange",
       scopes: requestedScopes,
+      ...subjectClaims.auth_time !== undefined ? { authTime: subjectClaims.auth_time } : {},
       ...subjectClaims.aud !== undefined && subjectClaims.aud !== callerClient.id ? { audience: subjectClaims.aud } : {}
     },
     family: (deps.newRefreshFamily ?? randomId)(),

package/dist/esm/domain/token.js

@@ -12,7 +12,8 @@ import {
   sha256,
   utf8
 } from "./crypto";
-import { signAccessToken } from "./jwt";
+import { buildIdTokenClaims, shouldIssueIdToken } from "./id-token";
+import { signAccessToken, signIdToken } from "./jwt";
 import { validatePkce } from "./pkce";
 async function saveEncryptedCode(code, payload, ttl, deps) {
   const keyResult = await deps.keyStore.currentEncryptionKey();
@@ -57,6 +58,9 @@ async function exchangeCode(req, deps) {
   const authResult = await verifyClientCredentials(client, req.clientSecret);
   if (authResult)
     return err(authResult);
+  if (client.dpopRequired && req.dpopJkt === undefined) {
+    return err(authError.invalidDpopProof(`client "${client.id}" requires DPoP-bound tokens`));
+  }
   if (payload.appRedirectUri !== req.redirectUri) {
     return err(authError.invalidGrant("redirect_uri mismatch with auth code"));
   }
@@ -104,7 +108,10 @@ async function exchangeCode(req, deps) {
   const minted = await mintTokens({
     tenant,
     claim,
-    payload,
+    payload: {
+      ...payload,
+      ...req.dpopJkt !== undefined ? { dpopJkt: req.dpopJkt } : {}
+    },
     deps,
     family: (deps.newRefreshFamily ?? randomId)()
   });
@@ -115,11 +122,13 @@ async function mintTokens(args) {
   const accessTtl = tenant.config.accessTtl !== undefined ? tenant.config.accessTtl * 1000 : DEFAULT_ACCESS_TTL_MS;
   const refreshTtl = tenant.config.refreshTtl !== undefined ? tenant.config.refreshTtl * 1000 : DEFAULT_REFRESH_TTL_MS;
   const now = deps.clock();
-  const subjectId = await deriveSubjectId(claim);
+  const receivingClient = tenant.config.clients.find((c) => c.id === payload.clientId);
+  const subjectId = await deriveSubjectId(claim, receivingClient?.sectorIdentifier);
   const keyRes = await deps.keyStore.currentSigningKey();
   if (isErr(keyRes))
     return err(keyRes.error);
   const signingKey = keyRes.value;
+  const userinfoClaimNames = Object.keys(payload.claimsRequest?.userinfo ?? {});
   const claims = {
     iss: deps.issuerUrl,
     sub: subjectId,
@@ -130,7 +139,10 @@ async function mintTokens(args) {
     mid: payload.methodId,
     mkind: payload.methodKind,
     scope: payload.scopes.join(" "),
-    claim
+    claim,
+    ...payload.authTime !== undefined ? { auth_time: payload.authTime } : {},
+    ...payload.dpopJkt !== undefined ? { cnf: { jkt: payload.dpopJkt } } : {},
+    ...userinfoClaimNames.length > 0 ? { uic: userinfoClaimNames } : {}
   };
   let accessToken;
   try {
@@ -151,6 +163,9 @@ async function mintTokens(args) {
       family,
       methodId: payload.methodId,
       methodKind: payload.methodKind,
+      authTime: payload.authTime ?? Math.floor(now / 1000),
+      ...payload.dpopJkt !== undefined ? { dpopJkt: payload.dpopJkt } : {},
+      ...payload.claimsRequest !== undefined ? { claimsRequest: payload.claimsRequest } : {},
       issuedAt: now,
       expiresAt: now + refreshTtl
     };
@@ -158,6 +173,28 @@ async function mintTokens(args) {
     if (isErr(saved))
       return err(saved.error);
   }
+  let idToken;
+  if (payload.authTime !== undefined && shouldIssueIdToken(payload.scopes)) {
+    const idClaims = await buildIdTokenClaims({
+      issuerUrl: deps.issuerUrl,
+      audience: payload.clientId,
+      subjectId,
+      claim,
+      scopes: payload.scopes,
+      authTime: payload.authTime,
+      ...payload.appNonce !== undefined ? { appNonce: payload.appNonce } : {},
+      now,
+      methodKind: payload.methodKind,
+      accessToken,
+      ...payload.claimsRequest !== undefined ? { claimsRequest: payload.claimsRequest } : {},
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+    });
+    try {
+      idToken = await signIdToken(idClaims, signingKey.privateKeyRef, signingKey.alg, signingKey.kid);
+    } catch (e) {
+      return err(authError.serverError("id_token sign failed", e));
+    }
+  }
   await safeAudit(deps, {
     kind: "token_issued",
     tenantId: payload.tenantId,
@@ -166,23 +203,27 @@ async function mintTokens(args) {
     methodKind: payload.methodKind,
     subjectId,
     refreshTokenIdHash: refresh ? await hashTokenForAudit(refresh) : "",
+    ...idToken !== undefined ? { idTokenIssued: true } : {},
+    ...payload.dpopJkt !== undefined ? { dpopBound: true } : {},
     timestamp: now
   });
   return ok({
     access_token: accessToken,
-    token_type: "Bearer",
+    token_type: payload.dpopJkt !== undefined ? "DPoP" : "Bearer",
     expires_in: Math.floor(accessTtl / 1000),
     ...refresh !== undefined ? { refresh_token: refresh } : {},
+    ...idToken !== undefined ? { id_token: idToken } : {},
     scope: payload.scopes.join(" ")
   });
 }
 async function hashClientSecret(plain) {
   return base64url.encode(await sha256(utf8.encode(plain)));
 }
-async function deriveSubjectId(claim) {
+async function deriveSubjectId(claim, sectorIdentifier) {
   const c = claim;
   const ordered = canonicalize(c.properties);
-  return base64url.encode(await sha256(`${c.type}\x00${ordered}`)).slice(0, 22);
+  const seed = sectorIdentifier !== undefined ? `${sectorIdentifier}\x00${c.type}\x00${ordered}` : `${c.type}\x00${ordered}`;
+  return base64url.encode(await sha256(seed)).slice(0, 22);
 }
 function canonicalize(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -196,10 +237,10 @@ async function hashTokenForAudit(token) {
   return base64url.encode(await sha256(utf8.encode(token))).slice(0, 16);
 }
 export {
-  saveEncryptedCode,
-  mintTokens,
-  hashClientSecret,
-  exchangeCode,
+  DEFAULT_ACCESS_TTL_MS,
   DEFAULT_REFRESH_TTL_MS,
-  DEFAULT_ACCESS_TTL_MS
+  exchangeCode,
+  hashClientSecret,
+  mintTokens,
+  saveEncryptedCode
 };

package/dist/esm/domain/userinfo.js

@@ -1,25 +1,60 @@
 // src/domain/userinfo.ts
 import { authError } from "../types/error";
 import { err, isErr, ok } from "../types/result";
+import { computeAth, verifyDpopProof } from "./dpop";
+import { pickScopedClaims } from "./id-token";
 import { verifyAccessToken } from "./jwt";
-async function userinfo(bearerToken, deps) {
+async function userinfo(input, deps) {
   const keysRes = await deps.keyStore.signingKeys();
   if (isErr(keysRes))
     return err(keysRes.error);
   let claims;
   try {
-    claims = await verifyAccessToken(bearerToken, keysRes.value, {
+    claims = await verifyAccessToken(input.accessToken, keysRes.value, {
       ...deps.issuerUrl ? { issuer: deps.issuerUrl } : {}
     });
   } catch {
     return err(authError.invalidGrant("access token invalid or expired"));
   }
+  const boundJkt = claims.cnf?.jkt;
+  if (boundJkt !== undefined) {
+    if (input.scheme !== "DPoP") {
+      return err(authError.invalidDpopProof('access token is DPoP-bound; Authorization scheme must be "DPoP"'));
+    }
+    if (!input.dpopProof) {
+      return err(authError.invalidDpopProof("access token is DPoP-bound; request is missing a DPoP proof"));
+    }
+    if (!input.htu || !input.htm || input.nowSec === undefined) {
+      return err(authError.invalidDpopProof("userinfo dpop verification requires htu, htm, and nowSec"));
+    }
+    if (!deps.tokenStore) {
+      return err(authError.invalidDpopProof("userinfo dpop verification requires a token-store (jti replay protection)"));
+    }
+    const expectedAth = await computeAth(input.accessToken);
+    const dpopRes = await verifyDpopProof({
+      proofJwt: input.dpopProof,
+      htu: input.htu,
+      htm: input.htm,
+      nowSec: input.nowSec,
+      expectedAth
+    }, { tokenStore: deps.tokenStore });
+    if (isErr(dpopRes))
+      return err(dpopRes.error);
+    if (dpopRes.value.jkt !== boundJkt) {
+      return err(authError.invalidDpopProof("dpop proof key does not match access token cnf.jkt"));
+    }
+  } else if (input.scheme === "DPoP") {
+    return err(authError.invalidGrant("access token is not DPoP-bound; use Authorization: Bearer"));
+  }
   const claim = claims.claim;
+  const scopes = claims.scope ? claims.scope.split(" ").filter(Boolean) : [];
+  const scopedClaims = pickScopedClaims(claim, scopes, claims.uic ?? [], deps.customScopeClaims ?? {});
   return ok({
     sub: claims.sub,
     subject_type: claim.type,
     properties: claim.properties,
-    scope: claims.scope
+    scope: claims.scope,
+    ...scopedClaims
   });
 }
 export {

package/dist/esm/error.js

@@ -61,13 +61,13 @@ class InvalidAuthorizationCodeError extends Error {
   }
 }
 export {
-  UnknownStateError,
-  UnauthorizedClientError,
-  OauthError,
-  MissingProviderError,
-  MissingParameterError,
-  InvalidSubjectError,
-  InvalidRefreshTokenError,
+  InvalidAccessTokenError,
   InvalidAuthorizationCodeError,
-  InvalidAccessTokenError
+  InvalidRefreshTokenError,
+  InvalidSubjectError,
+  MissingParameterError,
+  MissingProviderError,
+  OauthError,
+  UnauthorizedClientError,
+  UnknownStateError
 };

package/dist/esm/http/cookies.js

@@ -67,6 +67,22 @@ var STRIPPED_HEADERS = [
   "permissions-policy",
   "cache-control"
 ];
+function cacheControlHeader(cache) {
+  if (!cache)
+    return "no-store";
+  if ((cache.maxAge ?? -1) === 0)
+    return "no-store";
+  const parts = [];
+  if (cache.isPrivate)
+    parts.push("private");
+  if (cache.maxAge !== undefined)
+    parts.push(`max-age=${cache.maxAge}`);
+  if (cache.sMaxAge !== undefined)
+    parts.push(`s-maxage=${cache.sMaxAge}`);
+  if (cache.immutable)
+    parts.push("immutable");
+  return parts.length ? parts.join(", ") : "no-store";
+}
 function applyResponsePolicy(response, opts = {}) {
   const headers = new Headers(response.headers);
   const stripped = [];
@@ -92,7 +108,8 @@ function applyResponsePolicy(response, opts = {}) {
   });
 }
 export {
-  serializeSetCookie,
+  applyResponsePolicy,
+  cacheControlHeader,
   parseCookieHeader,
-  applyResponsePolicy
+  serializeSetCookie
 };

package/dist/esm/http/errors.js

@@ -63,9 +63,9 @@ function isNonRecoverable(error) {
   return false;
 }
 export {
-  tokenEndpointErrorResponse,
-  publicErrorCode,
-  isNonRecoverable,
+  authorizeDirectErrorResponse,
   authorizeRedirectErrorResponse,
-  authorizeDirectErrorResponse
+  isNonRecoverable,
+  publicErrorCode,
+  tokenEndpointErrorResponse
 };