@atlasauth/backend 0.14.0 → 0.15.0

package/dist/logout-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout-token.js","sourceRoot":"","sources":["../src/logout-token.ts"],"names":[],"mappings":";;;AAmEA,0DAWC;AAiFD,8CAKC;AAGD,4CAoGC;AA3QD,+BAA2E;AAC3E,6CAA6D;AAC7D,2CAA0E;AAE1E;;;;;;;;GAQG;AAEH,qEAAqE;AACxD,QAAA,wBAAwB,GAAG,oDAAoD,CAAC;AAE7F,wDAAwD;AAC3C,QAAA,+BAA+B,GAAG,CAAC,CAAC;AAEjD,wGAAwG;AAC3F,QAAA,4BAA4B,GAAG,GAAG,CAAC;AA6ChD,yFAAyF;AACzF,SAAgB,uBAAuB,CAAC,MAAoB,IAAI,CAAC,GAAG;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,QAAQ,CAAC,GAAG,EAAE,WAAW;YACvB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAgCD;;;GAGG;AACH,MAAa,mBAAmB;IAGD;IAFZ,KAAK,CAAY;IAElC,YAA6B,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;QAC9D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAS,CAAC;YACzB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAvCD,kDAuCC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,KAAa,EACb,OAAmC;IAEnC,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,KAAgB,EAChB,OAAgC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,uBAAuB,GAC3B,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,SAAS;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;YAC5E,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;YACxE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ;YACR,cAAc,EAAE,uCAA+B;YAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,IAAI,KAAK,iBAAiB;gBACxB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,KAAK,iCAAiC;oBAC1C,CAAC,CAAC,uBAAwB,KAA4B,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC3E,CAAC,CAAC,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9G,IAAI,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,oCAA4B,CAAC;IACrE,IAAI,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEtH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAE,MAAkC,CAAC,gCAAwB,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEnH,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,uCAA+B,CAAC,GAAG,IAAI,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAsB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC/C,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"logout-token.js","sourceRoot":"","sources":["../src/logout-token.ts"],"names":[],"mappings":";;;AAoEA,0DAWC;AAiFD,8CAKC;AAGD,4CAoGC;AA5QD,+BAA2E;AAC3E,6CAA6D;AAC7D,2CAA0E;AAC1E,iCAA4C;AAE5C;;;;;;;;GAQG;AAEH,qEAAqE;AACxD,QAAA,wBAAwB,GAAG,oDAAoD,CAAC;AAE7F,wDAAwD;AAC3C,QAAA,+BAA+B,GAAG,CAAC,CAAC;AAEjD,wGAAwG;AAC3F,QAAA,4BAA4B,GAAG,GAAG,CAAC;AA6ChD,yFAAyF;AACzF,SAAgB,uBAAuB,CAAC,MAAoB,IAAI,CAAC,GAAG;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,QAAQ,CAAC,GAAG,EAAE,WAAW;YACvB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAgCD;;;GAGG;AACH,MAAa,mBAAmB;IAGD;IAFZ,KAAK,CAAY;IAElC,YAA6B,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;QAC9D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAS,CAAC;YACzB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAvCD,kDAuCC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,KAAa,EACb,OAAmC;IAEnC,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,KAAgB,EAChB,OAAgC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,uBAAuB,GAC3B,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,SAAS;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;YAC5E,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;YACxE,UAAU,EAAE,yBAAkB;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ;YACR,cAAc,EAAE,uCAA+B;YAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,IAAI,KAAK,iBAAiB;gBACxB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,KAAK,iCAAiC;oBAC1C,CAAC,CAAC,uBAAwB,KAA4B,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC3E,CAAC,CAAC,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9G,IAAI,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,oCAA4B,CAAC;IACrE,IAAI,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEtH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAE,MAAkC,CAAC,gCAAwB,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEnH,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,uCAA+B,CAAC,GAAG,IAAI,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAsB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC/C,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/oauth-resource.d.ts

@@ -0,0 +1,145 @@
+import { type Jwks } from './jwks-cache';
+/**
+ * Protecting YOUR API — or your own MCP server — with access tokens Atlas
+ * issues to OAuth clients (authorization code, device, client credentials,
+ * token exchange). Atlas is the authorization server; your API is the
+ * resource server. This module:
+ *  - verifies the access token locally against the instance JWKS (cached;
+ *    no call to Atlas on the hot path): signature, `iss`, `exp`/`nbf`, that it
+ *    IS an access token, and that its `aud` names your API (RFC 8707);
+ *  - enforces required scopes;
+ *  - enforces sender constraint: a DPoP-bound token (`cnf.jkt`) must arrive
+ *    with a valid DPoP proof for the same key (RFC 9449), and is never accepted
+ *    as a plain Bearer token;
+ *  - answers failures with the RFC 6750 / RFC 9728 `WWW-Authenticate`
+ *    challenge (`resource_metadata`, `insufficient_scope` + the scopes needed),
+ *    which is exactly what an MCP client needs to discover how to sign in;
+ *  - builds the RFC 9728 protected-resource metadata document to serve at
+ *    `/.well-known/oauth-protected-resource` on your API's host.
+ * Framework-agnostic: hand it any request with `method`, `url` and `headers`.
+ */
+/** Clock skew tolerated on `exp`/`nbf` and on DPoP proof `iat`. */
+export declare const ACCESS_TOKEN_CLOCK_SKEW_SECONDS = 5;
+/** How old a DPoP proof may be. */
+export declare const DPOP_PROOF_MAX_AGE_SECONDS = 300;
+export interface AccessTokenClaims {
+    iss: string;
+    sub: string;
+    aud?: string | string[];
+    exp: number;
+    iat?: number;
+    scope?: string;
+    client_id?: string;
+    azp?: string;
+    permissions?: string[];
+    cnf?: {
+        jkt?: string;
+        'x5t#S256'?: string;
+    };
+    token_use?: string;
+    [claim: string]: unknown;
+}
+export interface ResourceRequestLike {
+    method?: string;
+    /** Absolute URL, or a path (combined with `resource` origin for the DPoP `htu` check). */
+    url?: string;
+    headers: Record<string, string | string[] | undefined> | {
+        get(name: string): string | null;
+    };
+}
+/** Replay guard for DPoP proof `jti`s. The in-memory one is for a single process. */
+export interface DpopReplayStore {
+    /** Record `jti` until `expiresAt` (ms); return false when it was already seen. */
+    claim(jti: string, expiresAt: number): Promise<boolean> | boolean;
+}
+export declare function memoryDpopReplayStore(max?: number): DpopReplayStore;
+export interface AccessTokenVerifierOptions {
+    /** Your Atlas instance's issuer (frontend API origin), e.g. https://clerk.example.com. */
+    issuer: string;
+    /**
+     * Your API's identifier (the Resource Server identifier registered in Atlas,
+     * RFC 8707 `resource`). The token's `aud` must contain one of these. Pass
+     * `false` only to accept tokens with no audience (userinfo-style tokens).
+     */
+    audience: string | readonly string[] | false;
+    /** Scopes every request must carry (all of them). */
+    requiredScopes?: readonly string[];
+    /** The JWKS URL; default `${issuer}/.well-known/jwks.json`. */
+    jwksUrl?: string;
+    /** A static key set (tests / offline). Mutually exclusive with `jwksUrl`. */
+    jwks?: Jwks;
+    /**
+     * Where your protected-resource metadata lives, advertised in every 401 as
+     * `resource_metadata` so an MCP / OAuth client can discover Atlas. Typically
+     * `https://api.example.com/.well-known/oauth-protected-resource`.
+     */
+    resourceMetadataUrl?: string;
+    /** Require a DPoP-bound token on every request (never accept plain Bearer). */
+    requireDpop?: boolean;
+    /** The public origin of this API, for DPoP `htu` when `request.url` is a path. */
+    publicOrigin?: string;
+    dpopReplayStore?: DpopReplayStore;
+    /** `WWW-Authenticate` realm. */
+    realm?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}
+export type AccessTokenErrorCode = 'invalid_request' | 'invalid_token' | 'insufficient_scope' | 'invalid_dpop_proof';
+export type AccessTokenResult = {
+    ok: true;
+    claims: AccessTokenClaims;
+    scopes: string[];
+    subject: string;
+    clientId: string | null;
+    dpopBound: boolean;
+} | {
+    ok: false;
+    status: 400 | 401 | 403;
+    error: AccessTokenErrorCode | null;
+    description: string;
+    /** Set this response header verbatim. */
+    wwwAuthenticate: string;
+};
+/**
+ * Build an RFC 6750 / RFC 9449 / RFC 9728 `WWW-Authenticate` challenge.
+ * Without an `error`, it is the bare "authentication required" challenge
+ * (no token was sent), as RFC 6750 §3.1 asks.
+ */
+export declare function buildWwwAuthenticate(opts: {
+    scheme?: 'Bearer' | 'DPoP';
+    realm?: string;
+    error?: AccessTokenErrorCode | null;
+    description?: string;
+    scope?: readonly string[];
+    resourceMetadataUrl?: string;
+    dpopAlgs?: readonly string[];
+}): string;
+/**
+ * A reusable verifier (one JWKS cache for the life of the process). Call it per
+ * request; it never throws for a bad token — it returns the status + challenge.
+ */
+export declare function createAccessTokenVerifier(options: AccessTokenVerifierOptions): (request: ResourceRequestLike, extra?: {
+    requiredScopes?: readonly string[];
+}) => Promise<AccessTokenResult>;
+/** One-shot form of {@link createAccessTokenVerifier} (builds a fresh JWKS cache each call — prefer the factory). */
+export declare function verifyAccessToken(request: ResourceRequestLike, options: AccessTokenVerifierOptions): Promise<AccessTokenResult>;
+/**
+ * The RFC 9728 protected-resource metadata document for your API. Serve it as
+ * JSON at `https://<your api host>/.well-known/oauth-protected-resource` (and,
+ * for a resource with a path, at `/.well-known/oauth-protected-resource<path>`),
+ * and point `resourceMetadataUrl` at it. Atlas can also serve this document for
+ * you when the API is registered with metadata publishing turned on.
+ */
+export declare function protectedResourceMetadata(opts: {
+    /** Your API's identifier (the same value as the verifier's `audience`). */
+    resource: string;
+    /** Your Atlas instance issuer. */
+    issuer: string;
+    scopesSupported?: readonly string[];
+    resourceName?: string;
+    resourceDocumentation?: string;
+    /** Advertise that tokens must be DPoP-bound. */
+    dpopBoundAccessTokensRequired?: boolean;
+}): Record<string, unknown>;
+/** The RFC 9728 well-known path for a resource identifier (path-inserted form). */
+export declare function protectedResourceMetadataPath(resource: string): string;

package/dist/oauth-resource.js

@@ -0,0 +1,294 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = void 0;
+exports.memoryDpopReplayStore = memoryDpopReplayStore;
+exports.buildWwwAuthenticate = buildWwwAuthenticate;
+exports.createAccessTokenVerifier = createAccessTokenVerifier;
+exports.verifyAccessToken = verifyAccessToken;
+exports.protectedResourceMetadata = protectedResourceMetadata;
+exports.protectedResourceMetadataPath = protectedResourceMetadataPath;
+const jose_1 = require("jose");
+const jwks_cache_1 = require("./jwks-cache");
+const algs_1 = require("./algs");
+/**
+ * Protecting YOUR API — or your own MCP server — with access tokens Atlas
+ * issues to OAuth clients (authorization code, device, client credentials,
+ * token exchange). Atlas is the authorization server; your API is the
+ * resource server. This module:
+ *  - verifies the access token locally against the instance JWKS (cached;
+ *    no call to Atlas on the hot path): signature, `iss`, `exp`/`nbf`, that it
+ *    IS an access token, and that its `aud` names your API (RFC 8707);
+ *  - enforces required scopes;
+ *  - enforces sender constraint: a DPoP-bound token (`cnf.jkt`) must arrive
+ *    with a valid DPoP proof for the same key (RFC 9449), and is never accepted
+ *    as a plain Bearer token;
+ *  - answers failures with the RFC 6750 / RFC 9728 `WWW-Authenticate`
+ *    challenge (`resource_metadata`, `insufficient_scope` + the scopes needed),
+ *    which is exactly what an MCP client needs to discover how to sign in;
+ *  - builds the RFC 9728 protected-resource metadata document to serve at
+ *    `/.well-known/oauth-protected-resource` on your API's host.
+ * Framework-agnostic: hand it any request with `method`, `url` and `headers`.
+ */
+/** Clock skew tolerated on `exp`/`nbf` and on DPoP proof `iat`. */
+exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = 5;
+/** How old a DPoP proof may be. */
+exports.DPOP_PROOF_MAX_AGE_SECONDS = 300;
+const DPOP_ALGS = ['ES256', 'ES384', 'ES512', 'RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'EdDSA'];
+function memoryDpopReplayStore(max = 10_000) {
+    const seen = new Map();
+    return {
+        claim(jti, expiresAt) {
+            const now = Date.now();
+            if ((seen.get(jti) ?? 0) > now)
+                return false;
+            seen.set(jti, expiresAt);
+            if (seen.size > max) {
+                for (const [k, v] of seen)
+                    if (v <= now)
+                        seen.delete(k);
+                while (seen.size > max)
+                    seen.delete(seen.keys().next().value);
+            }
+            return true;
+        },
+    };
+}
+function header(req, name) {
+    const h = req.headers;
+    if (typeof h.get === 'function')
+        return h.get(name) ?? undefined;
+    const v = h[name] ?? h[name.toLowerCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+const quote = (v) => `"${v.replace(/["\\]/g, '\\$&')}"`;
+/**
+ * Build an RFC 6750 / RFC 9449 / RFC 9728 `WWW-Authenticate` challenge.
+ * Without an `error`, it is the bare "authentication required" challenge
+ * (no token was sent), as RFC 6750 §3.1 asks.
+ */
+function buildWwwAuthenticate(opts) {
+    const parts = [];
+    if (opts.realm)
+        parts.push(`realm=${quote(opts.realm)}`);
+    if (opts.error)
+        parts.push(`error=${quote(opts.error)}`);
+    if (opts.error && opts.description)
+        parts.push(`error_description=${quote(opts.description)}`);
+    if (opts.scope && opts.scope.length > 0)
+        parts.push(`scope=${quote(opts.scope.join(' '))}`);
+    if (opts.resourceMetadataUrl)
+        parts.push(`resource_metadata=${quote(opts.resourceMetadataUrl)}`);
+    if (opts.scheme === 'DPoP' && opts.dpopAlgs)
+        parts.push(`algs=${quote(opts.dpopAlgs.join(' '))}`);
+    return `${opts.scheme ?? 'Bearer'}${parts.length ? ` ${parts.join(', ')}` : ''}`;
+}
+async function sha256b64u(input) {
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input)));
+    let bin = '';
+    for (const b of digest)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Strip query + fragment (RFC 9449 §4.3 `htu` comparison). */
+function htuOf(url) {
+    try {
+        const u = new URL(url);
+        return `${u.protocol}//${u.host}${u.pathname}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A reusable verifier (one JWKS cache for the life of the process). Call it per
+ * request; it never throws for a bad token — it returns the status + challenge.
+ */
+function createAccessTokenVerifier(options) {
+    if (!options.issuer)
+        throw new Error('createAccessTokenVerifier needs `issuer`.');
+    if (options.jwks && options.jwksUrl)
+        throw new Error('Pass `jwks` or `jwksUrl`, not both.');
+    const issuer = options.issuer.replace(/\/+$/, '');
+    const now = () => (options.now ?? Date.now)();
+    const jwks = new jwks_cache_1.JwksCache({
+        url: options.jwks ? undefined : (options.jwksUrl ?? `${issuer}/.well-known/jwks.json`),
+        staticJwks: options.jwks,
+        fetchImpl: options.fetchImpl,
+        now: options.now,
+    });
+    const audiences = options.audience === false ? null : typeof options.audience === 'string' ? [options.audience] : [...options.audience];
+    const replay = options.dpopReplayStore ?? memoryDpopReplayStore();
+    return async (request, extra) => {
+        const required = [...(options.requiredScopes ?? []), ...(extra?.requiredScopes ?? [])];
+        const scheme = options.requireDpop ? 'DPoP' : 'Bearer';
+        const fail = (status, error, description, challengeScheme = scheme) => ({
+            ok: false,
+            status,
+            error,
+            description,
+            wwwAuthenticate: buildWwwAuthenticate({
+                scheme: challengeScheme,
+                realm: options.realm,
+                error,
+                description,
+                scope: error === 'insufficient_scope' || error === null ? required : undefined,
+                resourceMetadataUrl: options.resourceMetadataUrl,
+                dpopAlgs: DPOP_ALGS,
+            }),
+        });
+        const authz = header(request, 'authorization');
+        if (!authz)
+            return fail(401, null, 'Authentication required.');
+        const m = /^(Bearer|DPoP)\s+([A-Za-z0-9\-._~+/]+=*)$/i.exec(authz.trim());
+        if (!m)
+            return fail(400, 'invalid_request', 'Malformed Authorization header.');
+        const presentedScheme = m[1].toLowerCase() === 'dpop' ? 'DPoP' : 'Bearer';
+        const token = m[2];
+        if (token.split('.').length !== 3)
+            return fail(401, 'invalid_token', 'The access token is malformed.');
+        const keys = await jwks.get((0, jwks_cache_1.readKid)(token));
+        if (!keys || keys.keys.length === 0)
+            return fail(401, 'invalid_token', 'No signing keys are available to verify the token.');
+        let claims;
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
+                issuer,
+                algorithms: algs_1.ATLAS_SIGNING_ALGS,
+                clockTolerance: exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS,
+                currentDate: new Date(now()),
+            });
+            claims = payload;
+        }
+        catch {
+            return fail(401, 'invalid_token', 'The access token is invalid or expired.');
+        }
+        if (claims.token_use !== undefined && claims.token_use !== 'access_token') {
+            return fail(401, 'invalid_token', 'The token is not an access token.');
+        }
+        if (audiences) {
+            const aud = claims.aud === undefined ? [] : Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+            if (!aud.some((a) => audiences.includes(a))) {
+                return fail(401, 'invalid_token', 'The access token was not issued for this resource.');
+            }
+        }
+        // Sender constraint (RFC 9449). A bound token is only ever a DPoP token.
+        const jkt = claims.cnf?.jkt;
+        if (jkt || options.requireDpop || presentedScheme === 'DPoP') {
+            if (!jkt)
+                return fail(401, 'invalid_token', 'This resource requires a DPoP-bound access token.', 'DPoP');
+            if (presentedScheme !== 'DPoP') {
+                return fail(401, 'invalid_token', 'A DPoP-bound access token must be sent with the DPoP scheme.', 'DPoP');
+            }
+            const proof = header(request, 'dpop');
+            if (!proof)
+                return fail(401, 'invalid_dpop_proof', 'A DPoP proof is required.', 'DPoP');
+            const proofError = await checkDpopProof(proof, {
+                token,
+                jkt,
+                method: (request.method ?? 'GET').toUpperCase(),
+                url: request.url ?? '',
+                publicOrigin: options.publicOrigin,
+                now: now(),
+                replay,
+            });
+            if (proofError)
+                return fail(401, 'invalid_dpop_proof', proofError, 'DPoP');
+        }
+        const scopes = (claims.scope ?? '').split(' ').filter(Boolean);
+        const granted = new Set([...scopes, ...(claims.permissions ?? [])]);
+        const missing = required.filter((s) => !granted.has(s));
+        if (missing.length > 0) {
+            return fail(403, 'insufficient_scope', `The access token is missing the required scope(s): ${missing.join(' ')}.`);
+        }
+        return {
+            ok: true,
+            claims,
+            scopes,
+            subject: claims.sub,
+            clientId: (claims.client_id ?? claims.azp ?? null),
+            dpopBound: !!jkt,
+        };
+    };
+}
+async function checkDpopProof(proof, ctx) {
+    let jwk;
+    let alg;
+    try {
+        const h = (0, jose_1.decodeProtectedHeader)(proof);
+        if (h.typ !== 'dpop+jwt')
+            return 'The DPoP proof must have typ dpop+jwt.';
+        if (!h.alg || !DPOP_ALGS.includes(h.alg))
+            return 'The DPoP proof uses an unsupported algorithm.';
+        if (!h.jwk || typeof h.jwk !== 'object')
+            return 'The DPoP proof must carry its public key.';
+        jwk = h.jwk;
+        if ('d' in jwk || 'k' in jwk)
+            return 'The DPoP proof key must be a public key.';
+        alg = h.alg;
+    }
+    catch {
+        return 'The DPoP proof is malformed.';
+    }
+    let payload;
+    try {
+        const key = await (0, jose_1.importJWK)(jwk, alg);
+        ({ payload } = await (0, jose_1.jwtVerify)(proof, key, { algorithms: [alg], typ: 'dpop+jwt', currentDate: new Date(ctx.now) }));
+    }
+    catch {
+        return 'The DPoP proof signature is invalid.';
+    }
+    if ((await (0, jose_1.calculateJwkThumbprint)(jwk, 'sha256')) !== ctx.jkt) {
+        return 'The DPoP proof key does not match the token binding.';
+    }
+    if (payload.htm !== ctx.method)
+        return 'The DPoP proof htm does not match the request method.';
+    const absolute = /^https?:\/\//i.test(ctx.url) ? ctx.url : ctx.publicOrigin ? new URL(ctx.url, ctx.publicOrigin).toString() : null;
+    const expected = absolute ? htuOf(absolute) : null;
+    if (!expected || typeof payload.htu !== 'string' || htuOf(payload.htu) !== expected) {
+        return 'The DPoP proof htu does not match the request URL.';
+    }
+    const iat = typeof payload.iat === 'number' ? payload.iat * 1000 : NaN;
+    if (!Number.isFinite(iat) ||
+        iat > ctx.now + exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS * 1000 ||
+        ctx.now - iat > exports.DPOP_PROOF_MAX_AGE_SECONDS * 1000) {
+        return 'The DPoP proof is too old or from the future.';
+    }
+    if (payload.ath !== (await sha256b64u(ctx.token)))
+        return 'The DPoP proof ath does not match the access token.';
+    if (typeof payload.jti !== 'string' || !payload.jti)
+        return 'The DPoP proof needs a jti.';
+    if (!(await ctx.replay.claim(`${ctx.jkt}:${payload.jti}`, iat + exports.DPOP_PROOF_MAX_AGE_SECONDS * 1000))) {
+        return 'The DPoP proof has already been used.';
+    }
+    return null;
+}
+/** One-shot form of {@link createAccessTokenVerifier} (builds a fresh JWKS cache each call — prefer the factory). */
+function verifyAccessToken(request, options) {
+    return createAccessTokenVerifier(options)(request);
+}
+/**
+ * The RFC 9728 protected-resource metadata document for your API. Serve it as
+ * JSON at `https://<your api host>/.well-known/oauth-protected-resource` (and,
+ * for a resource with a path, at `/.well-known/oauth-protected-resource<path>`),
+ * and point `resourceMetadataUrl` at it. Atlas can also serve this document for
+ * you when the API is registered with metadata publishing turned on.
+ */
+function protectedResourceMetadata(opts) {
+    return {
+        resource: opts.resource,
+        authorization_servers: [opts.issuer.replace(/\/+$/, '')],
+        bearer_methods_supported: ['header'],
+        ...(opts.scopesSupported ? { scopes_supported: [...opts.scopesSupported] } : {}),
+        ...(opts.resourceName ? { resource_name: opts.resourceName } : {}),
+        ...(opts.resourceDocumentation ? { resource_documentation: opts.resourceDocumentation } : {}),
+        dpop_signing_alg_values_supported: DPOP_ALGS,
+        ...(opts.dpopBoundAccessTokensRequired ? { dpop_bound_access_tokens_required: true } : {}),
+    };
+}
+/** The RFC 9728 well-known path for a resource identifier (path-inserted form). */
+function protectedResourceMetadataPath(resource) {
+    const u = new URL(resource);
+    const path = u.pathname === '/' ? '' : u.pathname.replace(/\/+$/, '');
+    return `/.well-known/oauth-protected-resource${path}`;
+}
+//# sourceMappingURL=oauth-resource.js.map

package/dist/oauth-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-resource.js","sourceRoot":"","sources":["../src/oauth-resource.ts"],"names":[],"mappings":";;;AAiEA,sDAcC;AA6DD,oDAiBC;AAuBD,8DA6GC;AA4DD,8CAKC;AASD,8DAqBC;AAGD,sEAIC;AAvYD,+BAOc;AACd,6CAA6D;AAC7D,iCAA4C;AAE5C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,mEAAmE;AACtD,QAAA,+BAA+B,GAAG,CAAC,CAAC;AACjD,mCAAmC;AACtB,QAAA,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AA8B7G,SAAgB,qBAAqB,CAAC,GAAG,GAAG,MAAM;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,GAAG,EAAE,SAAS;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG;wBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxD,OAAO,IAAI,CAAC,IAAI,GAAG,GAAG;oBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AA+CD,SAAS,MAAM,CAAC,GAAwB,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAiG,CAAC;IAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAEhE;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAQpC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,mBAAmB;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+DAA+D;AAC/D,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,OAAmC;IAEnC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,sBAAS,CAAC;QACzB,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,MAAM,wBAAwB,CAAC;QACtF,UAAU,EAAE,OAAO,CAAC,IAAI;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,EAAE,CAAC;IAElE,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAsB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,IAAI,GAAG,CACX,MAAuB,EACvB,KAAkC,EAClC,WAAmB,EACnB,kBAAqC,MAAM,EACxB,EAAE,CAAC,CAAC;YACvB,EAAE,EAAE,KAAK;YACT,MAAM;YACN,KAAK;YACL,WAAW;YACX,eAAe,EAAE,oBAAoB,CAAC;gBACpC,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK;gBACL,WAAW;gBACX,KAAK,EAAE,KAAK,KAAK,oBAAoB,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC9E,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,QAAQ,EAAE,SAAS;aACpB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;QAEvG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;QAC7H,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBAC3E,MAAM;gBACN,UAAU,EAAE,yBAAkB;gBAC9B,cAAc,EAAE,uCAA+B;gBAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7B,CAAC,CAAC;YACH,MAAM,GAAG,OAA4B,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,yCAAyC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;QAC5B,IAAI,GAAG,IAAI,OAAO,CAAC,WAAW,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,mDAAmD,EAAE,MAAM,CAAC,CAAC;YACzG,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,8DAA8D,EAAE,MAAM,CAAC,CAAC;YAC5G,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;YACxF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE;gBAC7C,KAAK;gBACL,GAAG;gBACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;gBAC/C,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,GAAG,EAAE,GAAG,EAAE;gBACV,MAAM;aACP,CAAC,CAAC;YACH,IAAI,UAAU;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,sDAAsD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM;YACN,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,QAAQ,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAkB;YACnE,SAAS,EAAE,CAAC,CAAC,GAAG;SACjB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,GAQC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,GAAG,KAAK,UAAU;YAAE,OAAO,wCAAwC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,+CAA+C,CAAC;QACjG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,2CAA2C,CAAC;QAC5F,GAAG,GAAG,CAAC,CAAC,GAAU,CAAC;QACnB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG;YAAE,OAAO,0CAA0C,CAAC;QAChF,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,IAAA,6BAAsB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9D,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,uDAAuD,CAAC;IAC/F,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnI,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpF,OAAO,oDAAoD,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACvE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,uCAA+B,GAAG,IAAI;QACtD,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,kCAA0B,GAAG,IAAI,EACjD,CAAC;QACD,OAAO,+CAA+C,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,qDAAqD,CAAC;IAChH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,6BAA6B,CAAC;IAC1F,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,kCAA0B,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;QACpG,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qHAAqH;AACrH,SAAgB,iBAAiB,CAC/B,OAA4B,EAC5B,OAAmC;IAEnC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,IAUzC;IACC,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,iCAAiC,EAAE,SAAS;QAC5C,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAgB,6BAA6B,CAAC,QAAgB;IAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,wCAAwC,IAAI,EAAE,CAAC;AACxD,CAAC"}

package/dist/oidc.d.ts

@@ -20,7 +20,7 @@ import { type JWTPayload } from 'jose';
  *    minute so a burst of callbacks cannot become an outbound request flood),
  *    the code exchange with the client's authentication method, and the JWKS
  *    (the package's rate-limited kid-miss cache).
- *  - ID-token verification with the algorithm PINNED to RS256 (so `alg: none`
+ *  - ID-token verification with the algorithm PINNED to RS256 or ES256 (so `alg: none`
  *    and HS* confusion are refused), `iss` exact, `aud` containing the client id
  *    (and `azp` equal to it when there are several audiences or an `azp` at all),
  *    `nonce` equal to the cookie's, `exp`/`iat` with a small tolerance, and

package/dist/oidc.js

@@ -10,6 +10,7 @@ exports.resetOidcCaches = resetOidcCaches;
 const jose_1 = require("jose");
 const handshake_1 = require("./handshake");
 const jwks_cache_1 = require("./jwks-cache");
+const algs_1 = require("./algs");
 class AtlasOidcError extends Error {
     code;
     /** The OAuth `error` value from the authorization or token endpoint, when there was one. */
@@ -247,8 +248,9 @@ async function verifyIdToken(idToken, discovery, opts) {
     if (!header)
         throw invalid('it is not a JWT');
     // Pinned before any key lookup, so `none` and HS* never get near a key.
-    if (header.alg !== 'RS256')
-        throw invalid(`its algorithm is ${String(header.alg)}, not RS256`);
+    if (typeof header.alg !== 'string' || !algs_1.ATLAS_SIGNING_ALGS.includes(header.alg)) {
+        throw invalid(`its algorithm is ${String(header.alg)}, not RS256 or ES256`);
+    }
     const keys = await jwksFor(discovery.jwks_uri, opts).get(typeof header.kid === 'string' ? header.kid : undefined);
     if (!keys || keys.keys.length === 0) {
         throw new AtlasOidcError('discovery_failed', `The issuer's signing keys could not be fetched from ${discovery.jwks_uri}.`);
@@ -256,7 +258,7 @@ async function verifyIdToken(idToken, discovery, opts) {
     let payload;
     try {
         ({ payload } = await (0, jose_1.jwtVerify)(idToken, (0, jose_1.createLocalJWKSet)(keys), {
-            algorithms: ['RS256'],
+            algorithms: algs_1.ATLAS_SIGNING_ALGS,
             issuer: discovery.issuer,
             audience: opts.clientId,
             clockTolerance: opts.clockToleranceSec,