@atlasauth/backend 0.7.3 → 0.9.0

package/dist/index.d.ts

@@ -4,12 +4,14 @@ export * from './verify';
 export * from './handshake';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
+export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidcCallback, oidcClearCookie, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches, } from './oidc';
+export type { AtlasOidc, AtlasOidcErrorCode, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
 export * from './webhooks';
 export { createAtlasClient } from './client';
 export type { AtlasClient } from './client';
 export * from './client';
-export { createTestIssuer } from './testing';
-export type { TestIssuer, CreateTestIssuerOptions } from './testing';
+export { createTestIssuer, TEST_TOKEN_TAMPERS } from './testing';
+export type { TestIssuer, CreateTestIssuerOptions, MintIdTokenOptions, TestAuthorizeOptions, TestAuthorizeResult, TestTokenTamper, } from './testing';
 export { verifyPCActn } from './pca/verify';
 export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
 export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.createTestIssuer = exports.createAtlasClient = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -33,6 +33,19 @@ Object.defineProperty(exports, "LOGOUT_TOKEN_MAX_AGE_SECONDS", { enumerable: tru
 Object.defineProperty(exports, "LogoutTokenVerifier", { enumerable: true, get: function () { return logout_token_1.LogoutTokenVerifier; } });
 Object.defineProperty(exports, "memoryLogoutReplayStore", { enumerable: true, get: function () { return logout_token_1.memoryLogoutReplayStore; } });
 Object.defineProperty(exports, "verifyLogoutToken", { enumerable: true, get: function () { return logout_token_1.verifyLogoutToken; } });
+// Server-side OIDC relying party for the hosted-redirect integration:
+// state + nonce + PKCE flow cookie, code exchange, RS256-pinned ID-token checks.
+var oidc_1 = require("./oidc");
+Object.defineProperty(exports, "AtlasOidcError", { enumerable: true, get: function () { return oidc_1.AtlasOidcError; } });
+Object.defineProperty(exports, "OIDC_FLOW_COOKIE", { enumerable: true, get: function () { return oidc_1.OIDC_FLOW_COOKIE; } });
+Object.defineProperty(exports, "OIDC_FLOW_MAX_AGE_SECONDS", { enumerable: true, get: function () { return oidc_1.OIDC_FLOW_MAX_AGE_SECONDS; } });
+Object.defineProperty(exports, "oidc", { enumerable: true, get: function () { return oidc_1.oidc; } });
+Object.defineProperty(exports, "oidcCallback", { enumerable: true, get: function () { return oidc_1.oidcCallback; } });
+Object.defineProperty(exports, "oidcClearCookie", { enumerable: true, get: function () { return oidc_1.oidcClearCookie; } });
+Object.defineProperty(exports, "oidcLogoutUrl", { enumerable: true, get: function () { return oidc_1.oidcLogoutUrl; } });
+Object.defineProperty(exports, "oidcStart", { enumerable: true, get: function () { return oidc_1.oidcStart; } });
+Object.defineProperty(exports, "oidcVerifyIdToken", { enumerable: true, get: function () { return oidc_1.oidcVerifyIdToken; } });
+Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: function () { return oidc_1.resetOidcCaches; } });
 // §12.2 inbound webhook verification for consumers.
 __exportStar(require("./webhooks"), exports);
 // The typed management client for the secret-key Backend API.
@@ -44,6 +57,7 @@ __exportStar(require("./client"), exports);
 // Its own module, so it never sits on the hot verification path.
 var testing_1 = require("./testing");
 Object.defineProperty(exports, "createTestIssuer", { enumerable: true, get: function () { return testing_1.createTestIssuer; } });
+Object.defineProperty(exports, "TEST_TOKEN_TAMPERS", { enumerable: true, get: function () { return testing_1.TEST_TOKEN_TAMPERS; } });
 // Proof-Carrying Authority (agentic auth): offline verifier + framework-agnostic guard,
 // beside the session-token verifier above.
 var verify_1 = require("./pca/verify");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA;AAGzB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAU7C,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}

package/dist/logout-token.d.ts

@@ -37,6 +37,14 @@ export type LogoutTokenResult = {
      */
     reason: 'malformed' | 'no_keys' | 'invalid' | 'replayed';
     detail?: string;
+    /**
+     * True when the failure is on YOUR side and temporary (`no_keys`: the
+     * issuer's keys could not be fetched, e.g. a network error or a JWKS
+     * outage). Answer `503` with `Retry-After` so Atlas retries the delivery.
+     * False for a token that is itself bad: answer `400`, which Atlas never
+     * retries.
+     */
+    retryable: boolean;
 };
 /**
  * Remembers logout_token `jti`s so a captured token cannot be replayed. Return

package/dist/logout-token.js

@@ -92,26 +92,30 @@ function verifyLogoutToken(token, options) {
 /** Shared by {@link LogoutTokenVerifier} and `AtlasBackend.verifyLogoutToken`. */
 async function checkLogoutToken(token, cache, options) {
     if (typeof token !== 'string' || token.split('.').length !== 3) {
-        return { ok: false, reason: 'malformed' };
+        return { ok: false, reason: 'malformed', retryable: false };
     }
     let header;
     try {
         header = (0, jose_1.decodeProtectedHeader)(token);
     }
     catch {
-        return { ok: false, reason: 'malformed' };
+        return { ok: false, reason: 'malformed', retryable: false };
     }
     if (header.typ !== undefined) {
         const typ = String(header.typ).toLowerCase();
         if (typ !== 'logout+jwt' && typ !== 'application/logout+jwt') {
-            return { ok: false, reason: 'invalid', detail: 'typ is not logout+jwt' };
+            return { ok: false, reason: 'invalid', detail: 'typ is not logout+jwt', retryable: false };
         }
     }
-    const keys = await cache.get((0, jwks_cache_1.readKid)(token));
-    if (!keys || keys.keys.length === 0) {
+    const kid = (0, jwks_cache_1.readKid)(token);
+    const keys = await cache.get(kid);
+    // No keys at all, or a key Atlas has just rotated to that could not be fetched
+    // because the refetch failed: both are temporary, on the receiver's side.
+    const missingAfterFailedFetch = kid !== undefined && cache.lastOutcome === 'failed' && !keys?.keys.some((k) => k.kid === kid);
+    if (!keys || keys.keys.length === 0 || missingAfterFailedFetch) {
         return cache.lastError
-            ? { ok: false, reason: 'no_keys', detail: cache.lastError }
-            : { ok: false, reason: 'no_keys' };
+            ? { ok: false, reason: 'no_keys', detail: cache.lastError, retryable: true }
+            : { ok: false, reason: 'no_keys', retryable: true };
     }
     const nowMs = options.now ? options.now() : Date.now();
     const audience = typeof options.clientId === 'string' ? options.clientId : [...options.clientId];
@@ -131,6 +135,7 @@ async function checkLogoutToken(token, cache, options) {
         return {
             ok: false,
             reason: 'invalid',
+            retryable: false,
             detail: code === 'ERR_JWT_EXPIRED'
                 ? 'expired'
                 : code === 'ERR_JWT_CLAIM_VALIDATION_FAILED'
@@ -141,36 +146,36 @@ async function checkLogoutToken(token, cache, options) {
     const nowSec = Math.floor(nowMs / 1000);
     const iat = payload.iat;
     if (typeof iat !== 'number')
-        return { ok: false, reason: 'invalid', detail: 'iat missing' };
+        return { ok: false, reason: 'invalid', detail: 'iat missing', retryable: false };
     if (iat > nowSec + exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS) {
-        return { ok: false, reason: 'invalid', detail: 'iat is in the future' };
+        return { ok: false, reason: 'invalid', detail: 'iat is in the future', retryable: false };
     }
     const maxAge = options.maxAgeSeconds ?? exports.LOGOUT_TOKEN_MAX_AGE_SECONDS;
     if (nowSec - iat > maxAge + exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS) {
-        return { ok: false, reason: 'invalid', detail: 'iat is too old' };
+        return { ok: false, reason: 'invalid', detail: 'iat is too old', retryable: false };
     }
     const jti = payload.jti;
     if (typeof jti !== 'string' || !jti)
-        return { ok: false, reason: 'invalid', detail: 'jti missing' };
+        return { ok: false, reason: 'invalid', detail: 'jti missing', retryable: false };
     const events = payload.events;
     const event = events && typeof events === 'object' && !Array.isArray(events)
         ? events[exports.BACKCHANNEL_LOGOUT_EVENT]
         : undefined;
     if (!event || typeof event !== 'object' || Array.isArray(event)) {
-        return { ok: false, reason: 'invalid', detail: 'back-channel logout event missing' };
+        return { ok: false, reason: 'invalid', detail: 'back-channel logout event missing', retryable: false };
     }
     if ('nonce' in payload) {
-        return { ok: false, reason: 'invalid', detail: 'nonce must not be present' };
+        return { ok: false, reason: 'invalid', detail: 'nonce must not be present', retryable: false };
     }
     const sub = typeof payload.sub === 'string' && payload.sub ? payload.sub : undefined;
     const sid = typeof payload.sid === 'string' && payload.sid ? payload.sid : undefined;
     if (!sub && !sid)
-        return { ok: false, reason: 'invalid', detail: 'neither sid nor sub present' };
+        return { ok: false, reason: 'invalid', detail: 'neither sid nor sub present', retryable: false };
     if (options.replayStore) {
         const expiresAtMs = (iat + maxAge + exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS) * 1000;
         const fresh = await options.replayStore.remember(jti, expiresAtMs);
         if (!fresh)
-            return { ok: false, reason: 'replayed' };
+            return { ok: false, reason: 'replayed', retryable: false };
     }
     const claims = { jti, iat };
     if (sub)

package/dist/logout-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout-token.js","sourceRoot":"","sources":["../src/logout-token.ts"],"names":[],"mappings":";;;AA2DA,0DAWC;AAiFD,8CAKC;AAGD,4CA8FC;AA7PD,+BAA2E;AAC3E,6CAA6D;AAC7D,2CAA0E;AAE1E;;;;;;;;GAQG;AAEH,qEAAqE;AACxD,QAAA,wBAAwB,GAAG,oDAAoD,CAAC;AAE7F,wDAAwD;AAC3C,QAAA,+BAA+B,GAAG,CAAC,CAAC;AAEjD,wGAAwG;AAC3F,QAAA,4BAA4B,GAAG,GAAG,CAAC;AAqChD,yFAAyF;AACzF,SAAgB,uBAAuB,CAAC,MAAoB,IAAI,CAAC,GAAG;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,QAAQ,CAAC,GAAG,EAAE,WAAW;YACvB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAgCD;;;GAGG;AACH,MAAa,mBAAmB;IAGD;IAFZ,KAAK,CAAY;IAElC,YAA6B,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;QAC9D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAS,CAAC;YACzB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAvCD,kDAuCC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,KAAa,EACb,OAAmC;IAEnC,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,KAAgB,EAChB,OAAgC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,SAAS;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE;YAC3D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;YACxE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ;YACR,cAAc,EAAE,uCAA+B;YAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EACJ,IAAI,KAAK,iBAAiB;gBACxB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,KAAK,iCAAiC;oBAC1C,CAAC,CAAC,uBAAwB,KAA4B,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC3E,CAAC,CAAC,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5F,IAAI,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,oCAA4B,CAAC;IACrE,IAAI,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEpG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAE,MAAkC,CAAC,gCAAwB,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAEjG,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,uCAA+B,CAAC,GAAG,IAAI,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAsB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC/C,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"logout-token.js","sourceRoot":"","sources":["../src/logout-token.ts"],"names":[],"mappings":";;;AAmEA,0DAWC;AAiFD,8CAKC;AAGD,4CAoGC;AA3QD,+BAA2E;AAC3E,6CAA6D;AAC7D,2CAA0E;AAE1E;;;;;;;;GAQG;AAEH,qEAAqE;AACxD,QAAA,wBAAwB,GAAG,oDAAoD,CAAC;AAE7F,wDAAwD;AAC3C,QAAA,+BAA+B,GAAG,CAAC,CAAC;AAEjD,wGAAwG;AAC3F,QAAA,4BAA4B,GAAG,GAAG,CAAC;AA6ChD,yFAAyF;AACzF,SAAgB,uBAAuB,CAAC,MAAoB,IAAI,CAAC,GAAG;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,QAAQ,CAAC,GAAG,EAAE,WAAW;YACvB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAgCD;;;GAGG;AACH,MAAa,mBAAmB;IAGD;IAFZ,KAAK,CAAY;IAElC,YAA6B,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;QAC9D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAS,CAAC;YACzB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAvCD,kDAuCC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,KAAa,EACb,OAAmC;IAEnC,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,KAAgB,EAChB,OAAgC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,uBAAuB,GAC3B,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,SAAS;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;YAC5E,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;YACxE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ;YACR,cAAc,EAAE,uCAA+B;YAC/C,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,IAAI,KAAK,iBAAiB;gBACxB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,KAAK,iCAAiC;oBAC1C,CAAC,CAAC,uBAAwB,KAA4B,CAAC,KAAK,IAAI,SAAS,EAAE;oBAC3E,CAAC,CAAC,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9G,IAAI,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,oCAA4B,CAAC;IACrE,IAAI,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,uCAA+B,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEtH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,KAAK,GACT,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAE,MAAkC,CAAC,gCAAwB,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEnH,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,uCAA+B,CAAC,GAAG,IAAI,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAsB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC/C,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,225 @@
+import { type JWTPayload } from 'jose';
+/**
+ * Server-side OpenID Connect relying party for the hosted-redirect integration.
+ *
+ * The three calls an app needs, in order:
+ *
+ *   const { url, cookie } = await oidc.start({ issuer, clientId, redirectUri, secret });
+ *   // → Set-Cookie: cookie, 302 to url
+ *   const identity = await oidc.callback({ issuer, clientId, clientSecret, redirectUri, query, cookie, secret });
+ *   // → Set-Cookie: identity.clearCookie, start your own session for identity.namespacedSub
+ *   const logout = await oidc.logoutUrl({ issuer, clientId, postLogoutRedirectUri, idTokenHint });
+ *
+ * What it does so the integrator does not have to:
+ *  - state, nonce and a PKCE (S256) pair per sign-in, carried to the callback in
+ *    ONE short-lived httpOnly flow cookie scoped to the callback path. With a
+ *    `secret` the cookie is sealed (AES-256-GCM, key derived with HKDF), so it
+ *    can be neither read nor forged; the verifier never reaches page JavaScript
+ *    either way.
+ *  - discovery (cached per issuer for an hour; a failure is remembered for a
+ *    minute so a burst of callbacks cannot become an outbound request flood),
+ *    the code exchange with the client's authentication method, and the JWKS
+ *    (the package's rate-limited kid-miss cache).
+ *  - ID-token verification with the algorithm PINNED to RS256 (so `alg: none`
+ *    and HS* confusion are refused), `iss` exact, `aud` containing the client id
+ *    (and `azp` equal to it when there are several audiences or an `azp` at all),
+ *    `nonce` equal to the cookie's, `exp`/`iat` with a small tolerance, and
+ *    `at_hash` when the token carries one.
+ *
+ * Every failure is an {@link AtlasOidcError} with a stable `code`. Only Web
+ * standard globals are used (fetch, crypto.subtle, TextEncoder, atob/btoa), so
+ * this runs unchanged on Node 18+, Bun, Deno and edge runtimes.
+ */
+/**
+ * Stable failure codes. `access_denied` also stands for the OAuth `error` the
+ * authorization server redirected back with; that exact value is in
+ * {@link AtlasOidcError.oauthError}.
+ */
+export type AtlasOidcErrorCode = 'state_mismatch' | 'issuer_mismatch' | 'invalid_request' | 'invalid_token' | 'token_exchange_failed' | 'access_denied' | 'discovery_failed';
+export declare class AtlasOidcError extends Error {
+    readonly code: AtlasOidcErrorCode;
+    /** The OAuth `error` value from the authorization or token endpoint, when there was one. */
+    readonly oauthError?: string;
+    /** The OAuth `error_description`, when there was one. */
+    readonly description?: string;
+    /** HTTP status of the token endpoint's answer, for `token_exchange_failed`. */
+    readonly status?: number;
+    /**
+     * A `Set-Cookie` value that removes the flow cookie. Send it with your error
+     * response too, so a failed sign-in leaves nothing behind. Set on every error
+     * thrown by {@link oidcCallback}.
+     */
+    clearCookie?: string;
+    readonly cause?: unknown;
+    constructor(code: AtlasOidcErrorCode, message: string, extra?: {
+        cause?: unknown;
+        oauthError?: string;
+        description?: string;
+        status?: number;
+    });
+}
+interface OidcBaseOptions {
+    /** Your instance's issuer: `https://` + its frontend API host. */
+    issuer: string;
+    /** The OAuth client id (`client_id`). */
+    clientId: string;
+    /**
+     * Override the discovery document URL. Defaults to
+     * `${issuer}/.well-known/openid-configuration`.
+     */
+    discoveryUrl?: string;
+    fetchImpl?: typeof fetch;
+    /** A clock in epoch milliseconds, for deterministic tests. */
+    now?: () => number;
+}
+/** The default flow cookie name. */
+export declare const OIDC_FLOW_COOKIE = "atlas_oidc";
+/** How long a started sign-in stays valid, in seconds. */
+export declare const OIDC_FLOW_MAX_AGE_SECONDS = 600;
+export interface OidcStartOptions extends OidcBaseOptions {
+    /** The callback URL, registered on the client exactly. */
+    redirectUri: string;
+    /** Space-delimited scopes. Default `openid profile email`; `openid` is added if missing. */
+    scope?: string;
+    /** OIDC `prompt` (`login`, `none`, `consent`, `select_account`, `create`). */
+    prompt?: string;
+    /** OIDC `login_hint`: prefill the sign-in page with this email or identifier. */
+    loginHint?: string;
+    /** Sent as `audience_hint`. */
+    audienceHint?: string;
+    /**
+     * Any other authorize parameters. They cannot override the ones this helper
+     * owns (`response_type`, `client_id`, `redirect_uri`, `state`, `nonce`,
+     * `code_challenge`, `code_challenge_method`).
+     */
+    extraParams?: Record<string, string | undefined>;
+    /** The flow cookie name. Default `atlas_oidc`. Pass the same name to `callback`. */
+    cookieName?: string;
+    /**
+     * A server-side secret (at least 32 characters) that seals the flow cookie.
+     * Strongly recommended: without it the cookie is still httpOnly but only
+     * encoded, not encrypted or signed. Pass the same value to `callback`.
+     */
+    secret?: string;
+}
+export interface OidcStartResult {
+    /** Redirect the browser here. */
+    url: string;
+    /** A `Set-Cookie` header value for the flow cookie. Send it with the redirect. */
+    cookie: string;
+    state: string;
+    nonce: string;
+}
+/**
+ * Begin a sign-in: build the authorize URL and the flow cookie. Send `cookie`
+ * as `Set-Cookie` and redirect to `url`.
+ */
+export declare function oidcStart(options: OidcStartOptions): Promise<OidcStartResult>;
+export type OidcClientAuth = 'client_secret_basic' | 'client_secret_post' | 'none';
+export interface OidcCallbackOptions extends OidcBaseOptions {
+    /** The same callback URL `start` used. */
+    redirectUri: string;
+    /** The client secret. Omit for a public client (`clientAuth: 'none'`). */
+    clientSecret?: string;
+    /**
+     * How to authenticate at the token endpoint. Default `client_secret_basic`
+     * when `clientSecret` is set, otherwise `none`.
+     */
+    clientAuth?: OidcClientAuth;
+    /**
+     * The callback's query: a `URLSearchParams`, the request URL (or just its
+     * query string), or a framework's parsed query object.
+     */
+    query: URLSearchParams | string | Record<string, string | string[] | undefined>;
+    /** The request's `Cookie` header, or just the flow cookie's value. */
+    cookie: string | null | undefined;
+    /** The flow cookie name `start` used. Default `atlas_oidc`. */
+    cookieName?: string;
+    /** The secret `start` used. */
+    secret?: string;
+    /** Allowed clock skew for `exp`/`iat`, in seconds. Default 60. */
+    clockToleranceSec?: number;
+}
+export interface OidcIdentity {
+    /** The Atlas user id (`sub`). Unique within one issuer. */
+    sub: string;
+    /**
+     * `${issuer}#${sub}`: unique across issuers. Key your users on this when you
+     * accept more than one instance (development and production, or several
+     * tenants), so two instances' users can never collide.
+     */
+    namespacedSub: string;
+    email: string | null;
+    /** `true` only when the ID token says `email_verified: true`. */
+    emailVerified: boolean;
+    name: string | null;
+    /** The raw, verified ID token. Keep it for `logoutUrl({ idTokenHint })`. */
+    idToken: string;
+    accessToken: string;
+    /** Present when the client may use refresh tokens and the grant included one. */
+    refreshToken?: string;
+    /** When the access token expires, in epoch milliseconds. */
+    expiresAt: number;
+    /** Every verified ID-token claim. */
+    claims: JWTPayload & Record<string, unknown>;
+    /** A `Set-Cookie` value that removes the flow cookie. Send it with your response. */
+    clearCookie: string;
+}
+/**
+ * Finish a sign-in: check `state`, exchange the code (with PKCE and client
+ * authentication), verify the ID token, and return who signed in.
+ */
+export declare function oidcCallback(options: OidcCallbackOptions): Promise<OidcIdentity>;
+/** Options for {@link verifyIdToken}. */
+export interface VerifyIdTokenOptions {
+    issuer: string;
+    clientId: string;
+    /** The nonce sent on the authorize request. Required: an ID token without the right nonce is refused. */
+    nonce: string;
+    /** When given and the token has `at_hash`, the access token must match it. */
+    accessToken?: string;
+    clockToleranceSec?: number;
+    discoveryUrl?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}
+/**
+ * Verify an ID token on its own (for an app that does its own code exchange).
+ * Same checks as {@link oidcCallback}. Throws {@link AtlasOidcError}.
+ */
+export declare function oidcVerifyIdToken(idToken: string, options: VerifyIdTokenOptions): Promise<JWTPayload & Record<string, unknown>>;
+export interface OidcLogoutUrlOptions extends OidcBaseOptions {
+    /** Where Atlas sends the user afterwards. Must be registered on the client exactly. */
+    postLogoutRedirectUri?: string;
+    /** The ID token from sign-in. Lets Atlas skip asking which session to end. */
+    idTokenHint?: string;
+    /** Echoed back on the post-logout redirect. */
+    state?: string;
+}
+/**
+ * The RP-initiated logout URL (`end_session_endpoint` from discovery). End your
+ * own session first, then redirect here so the Atlas session ends too.
+ */
+export declare function oidcLogoutUrl(options: OidcLogoutUrlOptions): Promise<string>;
+/** A `Set-Cookie` value that removes the flow cookie for this callback path. */
+export declare function oidcClearCookie(options: {
+    redirectUri: string;
+    cookieName?: string;
+}): string;
+/**
+ * The relying-party helpers as one namespace: `oidc.start`, `oidc.callback`,
+ * `oidc.logoutUrl`, `oidc.verifyIdToken`, `oidc.clearCookie`. Import the
+ * standalone `oidcStart` / `oidcCallback` / … for the smallest bundle.
+ */
+export declare const oidc: {
+    readonly start: typeof oidcStart;
+    readonly callback: typeof oidcCallback;
+    readonly logoutUrl: typeof oidcLogoutUrl;
+    readonly verifyIdToken: typeof oidcVerifyIdToken;
+    readonly clearCookie: typeof oidcClearCookie;
+};
+/** The type of {@link oidc}. */
+export type AtlasOidc = typeof oidc;
+/** Clear the discovery and key caches (tests, or after an issuer change). */
+export declare function resetOidcCaches(): void;
+export {};