@axa-fr/oidc-client-service-worker 7.29.7 → 7.30.0

package/dist/protocol.js

@@ -1,3 +1,51 @@
+//#region src/resource.ts
+/** Worker-only resource refresh routing hint, removed before the provider request. */
+var RESOURCE_TOKEN_REQUEST_HEADER = "x-oidc-resource";
+/** Builds an isolated storage/worker context without creating another OIDC client. */
+var getResourceContextName = (configurationName, resource) => `${configurationName}#resource=${encodeURIComponent(resource)}`;
+/** Reads the exact resource identifier from an isolated context name. */
+var getContextResource = (configurationName) => {
+	const index = configurationName.indexOf("#resource=");
+	return index < 0 ? void 0 : decodeURIComponent(configurationName.slice(index + 10));
+};
+/** Validates RFC 8707 identifiers without treating them as API URLs or scopes. */
+var validateResourceIdentifier = (resource) => {
+	if (typeof resource !== "string" || !/^[a-z][a-z\d+.-]*:/i.test(resource) || resource.includes("#") || /\s/.test(resource)) throw new Error("A resource must be an absolute URI without whitespace or a fragment.");
+	new URL(resource);
+};
+var getApiUrl = (value) => {
+	const url = new URL(value);
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || url.hash || /%2f|%5c/i.test(url.pathname)) throw new Error("API destinations must be HTTP(S) URLs without credentials, fragments, or encoded separators.");
+	return url;
+};
+var getApiPrefixUrl = (value) => {
+	const prefix = getApiUrl(value);
+	if (prefix.search) throw new Error("An API URL prefix must not contain a query.");
+	return prefix;
+};
+/** Prevents default-token fallback anywhere on an explicitly managed API origin. */
+var isResourceOriginManaged = (configurations, destination) => {
+	const origin = getApiUrl(destination).origin;
+	return configurations?.some((configuration) => configuration.allowedUrlPrefixes.some((value) => getApiPrefixUrl(value).origin === origin)) ?? false;
+};
+/** Matches API mappings by parsed origin and path boundaries, never by host suffix. */
+var isResourceUrlAllowed = (configuration, destination) => {
+	const url = getApiUrl(destination);
+	return configuration.allowedUrlPrefixes.some((value) => {
+		const prefix = getApiPrefixUrl(value);
+		const path = prefix.pathname.replace(/\/+$/, "");
+		return url.origin === prefix.origin && (path === "" || url.pathname === path || url.pathname.startsWith(`${path}/`));
+	});
+};
+/** Validates and retrieves an explicitly registered resource. */
+var getResourceConfiguration = (configurations, resource) => {
+	validateResourceIdentifier(resource);
+	const matches = configurations?.filter((configuration) => configuration.resource === resource) ?? [];
+	if (matches.length !== 1 || matches[0].allowedUrlPrefixes.length === 0) throw new Error("The resource must be registered exactly once with permitted API URL prefixes.");
+	for (const prefix of matches[0].allowedUrlPrefixes) isResourceUrlAllowed(matches[0], prefix);
+	return matches[0];
+};
+//#endregion
 //#region src/protocol.ts
 /**
 * Semver-protected version of the service worker `postMessage` protocol.
@@ -9,7 +57,7 @@
 * - The `PATCH` component changes for documentation or non-behavioural
 *   tweaks.
 */
-var PROTOCOL_VERSION = "1.0.0";
+var PROTOCOL_VERSION = "1.1.0";
 /**
 * Every supported service worker message type.
 *
@@ -99,6 +147,6 @@ var isServiceWorkerMessageType = (value) => {
 	return Object.values(ServiceWorkerMessageType).includes(value);
 };
 //#endregion
-export { DPOP_TOKEN_PLACEHOLDER_PREFIX, PROTOCOL_VERSION, STORAGE_KEY_PREFIX, SW_CONTROLLER_CHANGE_RELOAD_COUNT_KEY, ServiceWorkerMessageType, TOKEN_PLACEHOLDERS, buildDpopSecuredPlaceholder, buildSecuredTokenPlaceholder, buildStorageKey, isServiceWorkerMessageType };
+export { DPOP_TOKEN_PLACEHOLDER_PREFIX, PROTOCOL_VERSION, RESOURCE_TOKEN_REQUEST_HEADER, STORAGE_KEY_PREFIX, SW_CONTROLLER_CHANGE_RELOAD_COUNT_KEY, ServiceWorkerMessageType, TOKEN_PLACEHOLDERS, buildDpopSecuredPlaceholder, buildSecuredTokenPlaceholder, buildStorageKey, getContextResource, getResourceConfiguration, getResourceContextName, isResourceOriginManaged, isResourceUrlAllowed, isServiceWorkerMessageType, validateResourceIdentifier };
 
 //# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","names":[],"sources":["../src/protocol.ts"],"sourcesContent":["/**\n * Public, supported entry point for the oidc-client service worker\n * `postMessage` protocol.\n *\n * See `PROTOCOL.md` (in this package) for a full description of every\n * message type, payload, response shape, storage key convention and the\n * stability guarantees that apply to those exports.\n */\n\nimport type {\n  MessageData,\n  MessageEventData,\n  MessageEventType,\n  Nonce,\n  OidcConfiguration,\n  OidcServerConfiguration,\n  Status,\n} from './types';\n\nexport type {\n  MessageData,\n  MessageEventData,\n  MessageEventType,\n  Nonce,\n  OidcConfiguration,\n  OidcServerConfiguration,\n  Status,\n};\n\n/**\n * Semver-protected version of the service worker `postMessage` protocol.\n *\n * - The `MAJOR` component changes only on a breaking change to any of the\n *   exports in this module.\n * - The `MINOR` component changes when new (additive) message types or\n *   helpers are introduced.\n * - The `PATCH` component changes for documentation or non-behavioural\n *   tweaks.\n */\nexport const PROTOCOL_VERSION = '1.0.0' as const;\n\n/**\n * Every supported service worker message type.\n *\n * The values are also the literal string used on the wire as\n * `MessageEventData.type` and must therefore remain stable across patch and\n * minor versions of the protocol.\n */\nexport const ServiceWorkerMessageType = {\n  /** Lifecycle: tells the SW to skip the `waiting` state. */\n  SKIP_WAITING: 'SKIP_WAITING',\n  /** Lifecycle: asks the SW to claim the current page. */\n  CLAIM: 'claim',\n  /** Resets the session entry kept inside the SW for a configuration. */\n  CLEAR: 'clear',\n  /** Initialises a configuration entry inside the SW. */\n  INIT: 'init',\n  SET_STATE: 'setState',\n  GET_STATE: 'getState',\n  SET_CODE_VERIFIER: 'setCodeVerifier',\n  GET_CODE_VERIFIER: 'getCodeVerifier',\n  SET_SESSION_STATE: 'setSessionState',\n  GET_SESSION_STATE: 'getSessionState',\n  SET_NONCE: 'setNonce',\n  GET_NONCE: 'getNonce',\n  SET_DPOP_NONCE: 'setDemonstratingProofOfPossessionNonce',\n  GET_DPOP_NONCE: 'getDemonstratingProofOfPossessionNonce',\n  SET_DPOP_JWK: 'setDemonstratingProofOfPossessionJwk',\n  GET_DPOP_JWK: 'getDemonstratingProofOfPossessionJwk',\n} as const;\n\nexport type ServiceWorkerMessageTypeKey = keyof typeof ServiceWorkerMessageType;\nexport type ServiceWorkerMessageTypeValue =\n  (typeof ServiceWorkerMessageType)[ServiceWorkerMessageTypeKey];\n\n/**\n * Structural shape of a message sent to the service worker. The shape is\n * identical to {@link MessageEventData} but typed against the public\n * {@link ServiceWorkerMessageTypeValue} union and with optional fields where\n * the underlying SW tolerates them.\n */\nexport interface ServiceWorkerMessage<\n  TData extends Partial<MessageData> | null = Partial<MessageData> | null,\n> {\n  type: ServiceWorkerMessageTypeValue | 'SKIP_WAITING' | 'claim';\n  configurationName: string;\n  data: TData;\n  /**\n   * Optional tab identifier injected by the high-level helpers. Consumers\n   * sending raw messages can omit it; the SW falls back to `'default'`.\n   */\n  tabId?: string;\n}\n\n/**\n * Generic envelope used by every response. Each individual message type may\n * extend it with additional, well-known fields (see PROTOCOL.md).\n */\nexport interface ServiceWorkerResponse {\n  configurationName?: string;\n  /** Set by the SW when it cannot service the request. */\n  error?: unknown;\n  [key: string]: unknown;\n}\n\n/**\n * Stable internal token placeholders. They are returned by the service\n * worker in lieu of secret values (access/refresh tokens, nonces and code\n * verifier) so consumers never see the cleartext.\n */\nexport const TOKEN_PLACEHOLDERS = {\n  ACCESS_TOKEN: 'ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',\n  REFRESH_TOKEN: 'REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',\n  NONCE_TOKEN: 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER',\n  CODE_VERIFIER: 'CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER',\n} as const;\n\n/** Prefix used for every DPoP placeholder returned by the SW. */\nexport const DPOP_TOKEN_PLACEHOLDER_PREFIX = 'DPOP_SECURED_BY_OIDC_SERVICE_WORKER' as const;\n\n/**\n * Browser storage key conventions used by the OIDC client when no service\n * worker is available, or as a fallback alongside the SW. They are exported\n * so external integrations can read/clean up the same entries.\n */\nexport const STORAGE_KEY_PREFIX = {\n  /** sessionStorage – per-tab tab identifier (`oidc.tabId.<configurationName>`). */\n  TAB_ID: 'oidc.tabId.',\n  /** sessionStorage – `oidc.state.<configurationName>`. */\n  STATE: 'oidc.state.',\n  /** sessionStorage – `oidc.nonce.<configurationName>`. */\n  NONCE: 'oidc.nonce.',\n  /** sessionStorage – `oidc.code_verifier.<configurationName>`. */\n  CODE_VERIFIER: 'oidc.code_verifier.',\n  /** localStorage – `oidc.login.<configurationName>`. */\n  LOGIN_PARAMS: 'oidc.login.',\n  /** sessionStorage – `oidc.sw.version_mismatch_reload.<configurationName>`. */\n  SW_VERSION_MISMATCH_RELOAD: 'oidc.sw.version_mismatch_reload.',\n} as const;\n\n/** sessionStorage key tracking the SW controllerchange reload counter. */\nexport const SW_CONTROLLER_CHANGE_RELOAD_COUNT_KEY =\n  'oidc.sw.controllerchange_reload_count' as const;\n\n/**\n * Builds a typed sessionStorage / localStorage key from one of the known\n * prefixes and a configuration name. The function is intentionally\n * single-purpose so we never lose the prefix-based stability guarantee.\n */\nexport const buildStorageKey = (\n  prefix: (typeof STORAGE_KEY_PREFIX)[keyof typeof STORAGE_KEY_PREFIX],\n  configurationName: string,\n): string => `${prefix}${configurationName}`;\n\n/**\n * Builds the stable placeholder string the SW returns instead of an\n * access/refresh/nonce/code-verifier secret. Useful for consumers that need\n * to detect whether a value comes from the SW.\n */\nexport const buildSecuredTokenPlaceholder = (\n  placeholder: (typeof TOKEN_PLACEHOLDERS)[keyof typeof TOKEN_PLACEHOLDERS],\n  configurationName: string,\n  tabId: string = 'default',\n): string => `${placeholder}_${configurationName}#tabId=${tabId}`;\n\n/**\n * Builds the placeholder returned for DPoP-secured access tokens\n * (`DPOP_SECURED_BY_OIDC_SERVICE_WORKER_<config>#tabId=<tabId>`).\n */\nexport const buildDpopSecuredPlaceholder = (\n  configurationName: string,\n  tabId: string = 'default',\n): string => `${DPOP_TOKEN_PLACEHOLDER_PREFIX}_${configurationName}#tabId=${tabId}`;\n\n/**\n * Type guard returning `true` when the provided value is one of the\n * supported, public service worker message types.\n */\nexport const isServiceWorkerMessageType = (\n  value: unknown,\n): value is ServiceWorkerMessageTypeValue => {\n  if (typeof value !== 'string') {\n    return false;\n  }\n  return Object.values(ServiceWorkerMessageType).includes(value as ServiceWorkerMessageTypeValue);\n};\n\n/**\n * Internal wire-level type, re-exported for legacy parity. New code should\n * prefer {@link ServiceWorkerMessageTypeValue}.\n *\n * @internal\n */\nexport type ServiceWorkerMessageEventType = MessageEventType;\n"],"mappings":";;;;;;;;;;;AAuCA,IAAa,mBAAmB;;;;;;;;AAShC,IAAa,2BAA2B;;CAEtC,cAAc;;CAEd,OAAO;;CAEP,OAAO;;CAEP,MAAM;CACN,WAAW;CACX,WAAW;CACX,mBAAmB;CACnB,mBAAmB;CACnB,mBAAmB;CACnB,mBAAmB;CACnB,WAAW;CACX,WAAW;CACX,gBAAgB;CAChB,gBAAgB;CAChB,cAAc;CACd,cAAc;AAChB;;;;;;AAyCA,IAAa,qBAAqB;CAChC,cAAc;CACd,eAAe;CACf,aAAa;CACb,eAAe;AACjB;;AAGA,IAAa,gCAAgC;;;;;;AAO7C,IAAa,qBAAqB;;CAEhC,QAAQ;;CAER,OAAO;;CAEP,OAAO;;CAEP,eAAe;;CAEf,cAAc;;CAEd,4BAA4B;AAC9B;;AAGA,IAAa,wCACX;;;;;;AAOF,IAAa,mBACX,QACA,sBACW,GAAG,SAAS;;;;;;AAOzB,IAAa,gCACX,aACA,mBACA,QAAgB,cACL,GAAG,YAAY,GAAG,kBAAkB,SAAS;;;;;AAM1D,IAAa,+BACX,mBACA,QAAgB,cACL,GAAG,8BAA8B,GAAG,kBAAkB,SAAS;;;;;AAM5E,IAAa,8BACX,UAC2C;CAC3C,IAAI,OAAO,UAAU,UACnB,OAAO;CAET,OAAO,OAAO,OAAO,wBAAwB,CAAC,CAAC,SAAS,KAAsC;AAChG"}
+{"version":3,"file":"protocol.js","names":[],"sources":["../src/resource.ts","../src/protocol.ts"],"sourcesContent":["/** An explicitly permitted OAuth resource and its API destinations. */\nexport interface OidcResourceConfiguration {\n  resource: string;\n  allowedUrlPrefixes: readonly string[];\n  scope?: string;\n  audiences?: readonly string[];\n}\n\n/** Worker-only resource refresh routing hint, removed before the provider request. */\nexport const RESOURCE_TOKEN_REQUEST_HEADER = 'x-oidc-resource';\n\n/** Builds an isolated storage/worker context without creating another OIDC client. */\nexport const getResourceContextName = (configurationName: string, resource: string): string =>\n  `${configurationName}#resource=${encodeURIComponent(resource)}`;\n\n/** Reads the exact resource identifier from an isolated context name. */\nexport const getContextResource = (configurationName: string): string | undefined => {\n  const marker = '#resource=';\n  const index = configurationName.indexOf(marker);\n  return index < 0 ? undefined : decodeURIComponent(configurationName.slice(index + marker.length));\n};\n\n/** Validates RFC 8707 identifiers without treating them as API URLs or scopes. */\nexport const validateResourceIdentifier = (resource: string): void => {\n  if (\n    typeof resource !== 'string' ||\n    !/^[a-z][a-z\\d+.-]*:/i.test(resource) ||\n    resource.includes('#') ||\n    /\\s/.test(resource)\n  ) {\n    throw new Error('A resource must be an absolute URI without whitespace or a fragment.');\n  }\n  new URL(resource);\n};\n\nconst getApiUrl = (value: string): URL => {\n  const url = new URL(value);\n  if (\n    (url.protocol !== 'https:' && url.protocol !== 'http:') ||\n    url.username ||\n    url.password ||\n    url.hash ||\n    /%2f|%5c/i.test(url.pathname)\n  ) {\n    throw new Error(\n      'API destinations must be HTTP(S) URLs without credentials, fragments, or encoded separators.',\n    );\n  }\n  return url;\n};\n\nconst getApiPrefixUrl = (value: string): URL => {\n  const prefix = getApiUrl(value);\n  if (prefix.search) throw new Error('An API URL prefix must not contain a query.');\n  return prefix;\n};\n\n/** Prevents default-token fallback anywhere on an explicitly managed API origin. */\nexport const isResourceOriginManaged = (\n  configurations: readonly OidcResourceConfiguration[] | undefined,\n  destination: string,\n): boolean => {\n  const origin = getApiUrl(destination).origin;\n  return (\n    configurations?.some(configuration =>\n      configuration.allowedUrlPrefixes.some(value => getApiPrefixUrl(value).origin === origin),\n    ) ?? false\n  );\n};\n\n/** Matches API mappings by parsed origin and path boundaries, never by host suffix. */\nexport const isResourceUrlAllowed = (\n  configuration: OidcResourceConfiguration,\n  destination: string,\n): boolean => {\n  const url = getApiUrl(destination);\n  return configuration.allowedUrlPrefixes.some(value => {\n    const prefix = getApiPrefixUrl(value);\n    const path = prefix.pathname.replace(/\\/+$/, '');\n    return (\n      url.origin === prefix.origin &&\n      (path === '' || url.pathname === path || url.pathname.startsWith(`${path}/`))\n    );\n  });\n};\n\n/** Validates and retrieves an explicitly registered resource. */\nexport const getResourceConfiguration = (\n  configurations: readonly OidcResourceConfiguration[] | undefined,\n  resource: string,\n): OidcResourceConfiguration => {\n  validateResourceIdentifier(resource);\n  const matches =\n    configurations?.filter(configuration => configuration.resource === resource) ?? [];\n  if (matches.length !== 1 || matches[0].allowedUrlPrefixes.length === 0) {\n    throw new Error(\n      'The resource must be registered exactly once with permitted API URL prefixes.',\n    );\n  }\n  for (const prefix of matches[0].allowedUrlPrefixes) {\n    isResourceUrlAllowed(matches[0], prefix);\n  }\n  return matches[0];\n};\n","/**\n * Public, supported entry point for the oidc-client service worker\n * `postMessage` protocol.\n *\n * See `PROTOCOL.md` (in this package) for a full description of every\n * message type, payload, response shape, storage key convention and the\n * stability guarantees that apply to those exports.\n */\n\nimport type {\n  MessageData,\n  MessageEventData,\n  MessageEventType,\n  Nonce,\n  OidcConfiguration,\n  OidcServerConfiguration,\n  Status,\n} from './types';\n\nexport type {\n  MessageData,\n  MessageEventData,\n  MessageEventType,\n  Nonce,\n  OidcConfiguration,\n  OidcServerConfiguration,\n  Status,\n};\n\n/**\n * Semver-protected version of the service worker `postMessage` protocol.\n *\n * - The `MAJOR` component changes only on a breaking change to any of the\n *   exports in this module.\n * - The `MINOR` component changes when new (additive) message types or\n *   helpers are introduced.\n * - The `PATCH` component changes for documentation or non-behavioural\n *   tweaks.\n */\nexport const PROTOCOL_VERSION = '1.1.0' as const;\n\nexport type { OidcResourceConfiguration } from './resource';\nexport {\n  getContextResource,\n  getResourceConfiguration,\n  getResourceContextName,\n  isResourceOriginManaged,\n  isResourceUrlAllowed,\n  RESOURCE_TOKEN_REQUEST_HEADER,\n  validateResourceIdentifier,\n} from './resource';\n\n/**\n * Every supported service worker message type.\n *\n * The values are also the literal string used on the wire as\n * `MessageEventData.type` and must therefore remain stable across patch and\n * minor versions of the protocol.\n */\nexport const ServiceWorkerMessageType = {\n  /** Lifecycle: tells the SW to skip the `waiting` state. */\n  SKIP_WAITING: 'SKIP_WAITING',\n  /** Lifecycle: asks the SW to claim the current page. */\n  CLAIM: 'claim',\n  /** Resets the session entry kept inside the SW for a configuration. */\n  CLEAR: 'clear',\n  /** Initialises a configuration entry inside the SW. */\n  INIT: 'init',\n  SET_STATE: 'setState',\n  GET_STATE: 'getState',\n  SET_CODE_VERIFIER: 'setCodeVerifier',\n  GET_CODE_VERIFIER: 'getCodeVerifier',\n  SET_SESSION_STATE: 'setSessionState',\n  GET_SESSION_STATE: 'getSessionState',\n  SET_NONCE: 'setNonce',\n  GET_NONCE: 'getNonce',\n  SET_DPOP_NONCE: 'setDemonstratingProofOfPossessionNonce',\n  GET_DPOP_NONCE: 'getDemonstratingProofOfPossessionNonce',\n  SET_DPOP_JWK: 'setDemonstratingProofOfPossessionJwk',\n  GET_DPOP_JWK: 'getDemonstratingProofOfPossessionJwk',\n} as const;\n\nexport type ServiceWorkerMessageTypeKey = keyof typeof ServiceWorkerMessageType;\nexport type ServiceWorkerMessageTypeValue =\n  (typeof ServiceWorkerMessageType)[ServiceWorkerMessageTypeKey];\n\n/**\n * Structural shape of a message sent to the service worker. The shape is\n * identical to {@link MessageEventData} but typed against the public\n * {@link ServiceWorkerMessageTypeValue} union and with optional fields where\n * the underlying SW tolerates them.\n */\nexport interface ServiceWorkerMessage<\n  TData extends Partial<MessageData> | null = Partial<MessageData> | null,\n> {\n  type: ServiceWorkerMessageTypeValue | 'SKIP_WAITING' | 'claim';\n  configurationName: string;\n  data: TData;\n  /**\n   * Optional tab identifier injected by the high-level helpers. Consumers\n   * sending raw messages can omit it; the SW falls back to `'default'`.\n   */\n  tabId?: string;\n}\n\n/**\n * Generic envelope used by every response. Each individual message type may\n * extend it with additional, well-known fields (see PROTOCOL.md).\n */\nexport interface ServiceWorkerResponse {\n  /** Resource isolation capability provided by protocol 1.1 workers. */\n  resourceTokenManagement?: boolean;\n  /** Worker-owned context names, without token or key material. */\n  resourceContexts?: string[];\n  configurationName?: string;\n  /** Set by the SW when it cannot service the request. */\n  error?: unknown;\n  [key: string]: unknown;\n}\n\n/**\n * Stable internal token placeholders. They are returned by the service\n * worker in lieu of secret values (access/refresh tokens, nonces and code\n * verifier) so consumers never see the cleartext.\n */\nexport const TOKEN_PLACEHOLDERS = {\n  ACCESS_TOKEN: 'ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',\n  REFRESH_TOKEN: 'REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',\n  NONCE_TOKEN: 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER',\n  CODE_VERIFIER: 'CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER',\n} as const;\n\n/** Prefix used for every DPoP placeholder returned by the SW. */\nexport const DPOP_TOKEN_PLACEHOLDER_PREFIX = 'DPOP_SECURED_BY_OIDC_SERVICE_WORKER' as const;\n\n/**\n * Browser storage key conventions used by the OIDC client when no service\n * worker is available, or as a fallback alongside the SW. They are exported\n * so external integrations can read/clean up the same entries.\n */\nexport const STORAGE_KEY_PREFIX = {\n  /** sessionStorage – per-tab tab identifier (`oidc.tabId.<configurationName>`). */\n  TAB_ID: 'oidc.tabId.',\n  /** sessionStorage – `oidc.state.<configurationName>`. */\n  STATE: 'oidc.state.',\n  /** sessionStorage – `oidc.nonce.<configurationName>`. */\n  NONCE: 'oidc.nonce.',\n  /** sessionStorage – `oidc.code_verifier.<configurationName>`. */\n  CODE_VERIFIER: 'oidc.code_verifier.',\n  /** localStorage – `oidc.login.<configurationName>`. */\n  LOGIN_PARAMS: 'oidc.login.',\n  /** sessionStorage – `oidc.sw.version_mismatch_reload.<configurationName>`. */\n  SW_VERSION_MISMATCH_RELOAD: 'oidc.sw.version_mismatch_reload.',\n} as const;\n\n/** sessionStorage key tracking the SW controllerchange reload counter. */\nexport const SW_CONTROLLER_CHANGE_RELOAD_COUNT_KEY =\n  'oidc.sw.controllerchange_reload_count' as const;\n\n/**\n * Builds a typed sessionStorage / localStorage key from one of the known\n * prefixes and a configuration name. The function is intentionally\n * single-purpose so we never lose the prefix-based stability guarantee.\n */\nexport const buildStorageKey = (\n  prefix: (typeof STORAGE_KEY_PREFIX)[keyof typeof STORAGE_KEY_PREFIX],\n  configurationName: string,\n): string => `${prefix}${configurationName}`;\n\n/**\n * Builds the stable placeholder string the SW returns instead of an\n * access/refresh/nonce/code-verifier secret. Useful for consumers that need\n * to detect whether a value comes from the SW.\n */\nexport const buildSecuredTokenPlaceholder = (\n  placeholder: (typeof TOKEN_PLACEHOLDERS)[keyof typeof TOKEN_PLACEHOLDERS],\n  configurationName: string,\n  tabId: string = 'default',\n): string => `${placeholder}_${configurationName}#tabId=${tabId}`;\n\n/**\n * Builds the placeholder returned for DPoP-secured access tokens\n * (`DPOP_SECURED_BY_OIDC_SERVICE_WORKER_<config>#tabId=<tabId>`).\n */\nexport const buildDpopSecuredPlaceholder = (\n  configurationName: string,\n  tabId: string = 'default',\n): string => `${DPOP_TOKEN_PLACEHOLDER_PREFIX}_${configurationName}#tabId=${tabId}`;\n\n/**\n * Type guard returning `true` when the provided value is one of the\n * supported, public service worker message types.\n */\nexport const isServiceWorkerMessageType = (\n  value: unknown,\n): value is ServiceWorkerMessageTypeValue => {\n  if (typeof value !== 'string') {\n    return false;\n  }\n  return Object.values(ServiceWorkerMessageType).includes(value as ServiceWorkerMessageTypeValue);\n};\n\n/**\n * Internal wire-level type, re-exported for legacy parity. New code should\n * prefer {@link ServiceWorkerMessageTypeValue}.\n *\n * @internal\n */\nexport type ServiceWorkerMessageEventType = MessageEventType;\n"],"mappings":";;AASA,IAAa,gCAAgC;;AAG7C,IAAa,0BAA0B,mBAA2B,aAChE,GAAG,kBAAkB,YAAY,mBAAmB,QAAQ;;AAG9D,IAAa,sBAAsB,sBAAkD;CAEnF,MAAM,QAAQ,kBAAkB,QAAQ,YAAM;CAC9C,OAAO,QAAQ,IAAI,KAAA,IAAY,mBAAmB,kBAAkB,MAAM,QAAQ,EAAa,CAAC;AAClG;;AAGA,IAAa,8BAA8B,aAA2B;CACpE,IACE,OAAO,aAAa,YACpB,CAAC,sBAAsB,KAAK,QAAQ,KACpC,SAAS,SAAS,GAAG,KACrB,KAAK,KAAK,QAAQ,GAElB,MAAM,IAAI,MAAM,sEAAsE;CAExF,IAAI,IAAI,QAAQ;AAClB;AAEA,IAAM,aAAa,UAAuB;CACxC,MAAM,MAAM,IAAI,IAAI,KAAK;CACzB,IACG,IAAI,aAAa,YAAY,IAAI,aAAa,WAC/C,IAAI,YACJ,IAAI,YACJ,IAAI,QACJ,WAAW,KAAK,IAAI,QAAQ,GAE5B,MAAM,IAAI,MACR,8FACF;CAEF,OAAO;AACT;AAEA,IAAM,mBAAmB,UAAuB;CAC9C,MAAM,SAAS,UAAU,KAAK;CAC9B,IAAI,OAAO,QAAQ,MAAM,IAAI,MAAM,6CAA6C;CAChF,OAAO;AACT;;AAGA,IAAa,2BACX,gBACA,gBACY;CACZ,MAAM,SAAS,UAAU,WAAW,CAAC,CAAC;CACtC,OACE,gBAAgB,MAAK,kBACnB,cAAc,mBAAmB,MAAK,UAAS,gBAAgB,KAAK,CAAC,CAAC,WAAW,MAAM,CACzF,KAAK;AAET;;AAGA,IAAa,wBACX,eACA,gBACY;CACZ,MAAM,MAAM,UAAU,WAAW;CACjC,OAAO,cAAc,mBAAmB,MAAK,UAAS;EACpD,MAAM,SAAS,gBAAgB,KAAK;EACpC,MAAM,OAAO,OAAO,SAAS,QAAQ,QAAQ,EAAE;EAC/C,OACE,IAAI,WAAW,OAAO,WACrB,SAAS,MAAM,IAAI,aAAa,QAAQ,IAAI,SAAS,WAAW,GAAG,KAAK,EAAE;CAE/E,CAAC;AACH;;AAGA,IAAa,4BACX,gBACA,aAC8B;CAC9B,2BAA2B,QAAQ;CACnC,MAAM,UACJ,gBAAgB,QAAO,kBAAiB,cAAc,aAAa,QAAQ,KAAK,CAAC;CACnF,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,CAAC,mBAAmB,WAAW,GACnE,MAAM,IAAI,MACR,+EACF;CAEF,KAAK,MAAM,UAAU,QAAQ,EAAE,CAAC,oBAC9B,qBAAqB,QAAQ,IAAI,MAAM;CAEzC,OAAO,QAAQ;AACjB;;;;;;;;;;;;;AChEA,IAAa,mBAAmB;;;;;;;;AAoBhC,IAAa,2BAA2B;;CAEtC,cAAc;;CAEd,OAAO;;CAEP,OAAO;;CAEP,MAAM;CACN,WAAW;CACX,WAAW;CACX,mBAAmB;CACnB,mBAAmB;CACnB,mBAAmB;CACnB,mBAAmB;CACnB,WAAW;CACX,WAAW;CACX,gBAAgB;CAChB,gBAAgB;CAChB,cAAc;CACd,cAAc;AAChB;;;;;;AA6CA,IAAa,qBAAqB;CAChC,cAAc;CACd,eAAe;CACf,aAAa;CACb,eAAe;AACjB;;AAGA,IAAa,gCAAgC;;;;;;AAO7C,IAAa,qBAAqB;;CAEhC,QAAQ;;CAER,OAAO;;CAEP,OAAO;;CAEP,eAAe;;CAEf,cAAc;;CAEd,4BAA4B;AAC9B;;AAGA,IAAa,wCACX;;;;;;AAOF,IAAa,mBACX,QACA,sBACW,GAAG,SAAS;;;;;;AAOzB,IAAa,gCACX,aACA,mBACA,QAAgB,cACL,GAAG,YAAY,GAAG,kBAAkB,SAAS;;;;;AAM1D,IAAa,+BACX,mBACA,QAAgB,cACL,GAAG,8BAA8B,GAAG,kBAAkB,SAAS;;;;;AAM5E,IAAa,8BACX,UAC2C;CAC3C,IAAI,OAAO,UAAU,UACnB,OAAO;CAET,OAAO,OAAO,OAAO,wBAAwB,CAAC,CAAC,SAAS,KAAsC;AAChG"}

package/dist/resource.d.ts

@@ -0,0 +1,22 @@
+/** An explicitly permitted OAuth resource and its API destinations. */
+export interface OidcResourceConfiguration {
+    resource: string;
+    allowedUrlPrefixes: readonly string[];
+    scope?: string;
+    audiences?: readonly string[];
+}
+/** Worker-only resource refresh routing hint, removed before the provider request. */
+export declare const RESOURCE_TOKEN_REQUEST_HEADER = "x-oidc-resource";
+/** Builds an isolated storage/worker context without creating another OIDC client. */
+export declare const getResourceContextName: (configurationName: string, resource: string) => string;
+/** Reads the exact resource identifier from an isolated context name. */
+export declare const getContextResource: (configurationName: string) => string | undefined;
+/** Validates RFC 8707 identifiers without treating them as API URLs or scopes. */
+export declare const validateResourceIdentifier: (resource: string) => void;
+/** Prevents default-token fallback anywhere on an explicitly managed API origin. */
+export declare const isResourceOriginManaged: (configurations: readonly OidcResourceConfiguration[] | undefined, destination: string) => boolean;
+/** Matches API mappings by parsed origin and path boundaries, never by host suffix. */
+export declare const isResourceUrlAllowed: (configuration: OidcResourceConfiguration, destination: string) => boolean;
+/** Validates and retrieves an explicitly registered resource. */
+export declare const getResourceConfiguration: (configurations: readonly OidcResourceConfiguration[] | undefined, resource: string) => OidcResourceConfiguration;
+//# sourceMappingURL=resource.d.ts.map

package/dist/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAE/D,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,GAAI,mBAAmB,MAAM,EAAE,UAAU,MAAM,KAAG,MACpB,CAAC;AAElE,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,GAAI,mBAAmB,MAAM,KAAG,MAAM,GAAG,SAIvE,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,GAAI,UAAU,MAAM,KAAG,IAU7D,CAAC;AAwBF,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,GAClC,gBAAgB,SAAS,yBAAyB,EAAE,GAAG,SAAS,EAChE,aAAa,MAAM,KAClB,OAOF,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,GAC/B,eAAe,yBAAyB,EACxC,aAAa,MAAM,KAClB,OAUF,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,GACnC,gBAAgB,SAAS,yBAAyB,EAAE,GAAG,SAAS,EAChE,UAAU,MAAM,KACf,yBAaF,CAAC"}

package/dist/tokenContexts.d.ts

@@ -0,0 +1,5 @@
+import { Database, OidcConfig } from './types';
+export declare const getTokenContextEntries: (database: Database) => Array<[string, OidcConfig]>;
+export declare const getTokenContexts: (database: Database) => OidcConfig[];
+export declare const getOrCreateResourceContext: (configuration: OidcConfig, resource: string) => OidcConfig;
+//# sourceMappingURL=tokenContexts.d.ts.map

package/dist/tokenContexts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenContexts.d.ts","sourceRoot":"","sources":["../src/tokenContexts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEpD,eAAO,MAAM,sBAAsB,GAAI,UAAU,QAAQ,KAAG,KAAK,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAIlF,CAAC;AAEL,eAAO,MAAM,gBAAgB,GAAI,UAAU,QAAQ,KAAG,UAAU,EACY,CAAC;AAE7E,eAAO,MAAM,0BAA0B,GACrC,eAAe,UAAU,EACzB,UAAU,MAAM,KACf,UAuBF,CAAC"}

package/dist/{src/types.d.ts → types.d.ts}

@@ -1,3 +1,4 @@
+import { OidcResourceConfiguration } from './resource';
 export type DomainDetails = {
     domains?: Domain[];
     oidcDomains?: Domain[];
@@ -32,6 +33,10 @@ export type OidcServerConfiguration = {
 export type OidcConfiguration = {
     token_renew_mode: string;
     demonstrating_proof_of_possession: boolean;
+    client_id?: string;
+    scope?: string;
+    resource?: string | readonly string[];
+    resources?: readonly OidcResourceConfiguration[];
 };
 export type Status = 'LOGGED' | 'LOGGED_IN' | 'LOGGED_OUT' | 'NOT_CONNECTED' | 'LOGOUT_FROM_ANOTHER_TAB' | 'SESSION_LOST' | 'REQUIRE_SYNC_TOKENS' | 'FORCE_REFRESH' | null;
 export type MessageEventType = 'clear' | 'init' | 'setState' | 'getState' | 'setCodeVerifier' | 'getCodeVerifier' | 'setSessionState' | 'getSessionState' | 'setNonce' | 'getNonce' | 'setDemonstratingProofOfPossessionNonce' | 'getDemonstratingProofOfPossessionNonce' | 'setDemonstratingProofOfPossessionJwk' | 'getDemonstratingProofOfPossessionJwk';
@@ -57,6 +62,14 @@ export type Nonce = {
     nonce: string;
 } | null;
 export type OidcConfig = {
+    authorizationScope?: string;
+    requestedScope?: string;
+    demonstratingProofOfPossessionApiNonce?: string | null;
+    parentConfiguration?: OidcConfig;
+    resource?: string;
+    resourceEntries?: Record<string, OidcConfig>;
+    refreshGrant?: OidcConfig;
+    generation?: number;
     demonstratingProofOfPossessionConfiguration: DemonstratingProofOfPossessionConfiguration | null;
     configurationName: string;
     tokens: Tokens | null;
@@ -78,6 +91,7 @@ export type OidcConfig = {
     bypassAllNonOidcRequests: boolean;
 };
 export type IdTokenPayload = {
+    sub?: string;
     iss: string;
     /**
      * (Expiration Time) Claim
@@ -90,16 +104,27 @@ export type IdTokenPayload = {
     nonce: string | null;
 };
 export type AccessTokenPayload = {
+    aud?: string | string[];
+    iss?: string;
     exp: number;
     sub: string;
     iat: number;
 };
 export type Tokens = {
+    scope?: string;
+    resourceContext?: {
+        resource: string;
+        issuer: string;
+        clientId: string;
+        configurationName: string;
+        subject: string;
+        grantResource: string | null;
+    };
     issued_at: number | string;
     access_token: string;
     accessTokenPayload: AccessTokenPayload | null;
     id_token: null | string;
-    idTokenPayload: IdTokenPayload;
+    idTokenPayload?: IdTokenPayload | null;
     refresh_token?: string;
     expiresAt: number;
     expires_in: number | string;

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,sCAAsC,CAAC,EAAE,OAAO,CAAC;IACjD,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC,uDAAuD,CAAC,EAAE,OAAO,CAAC;IAClE,2CAA2C,CAAC,EAAE,2CAA2C,CAAC;IAC1F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,WAAW,2CAA2C;IAC1D,oBAAoB,EAAE,qBAAqB,GAAG,cAAc,CAAC;IAC7D,eAAe,EAAE,mBAAmB,CAAC;IACrC,kBAAkB,EACd,mBAAmB,GACnB,qBAAqB,GACrB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,CAAC;IACpB,aAAa,EAAE,mBAAmB,GAAG,YAAY,GAAG,WAAW,CAAC;IAChE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;CACzC,GAAG,IAAI,CAAC;AAET,MAAM,MAAM,uBAAuB,GAAG;IACpC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iCAAiC,EAAE,OAAO,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACtC,SAAS,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,QAAQ,GACR,WAAW,GACX,YAAY,GACZ,eAAe,GACf,yBAAyB,GACzB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,IAAI,CAAC;AACT,MAAM,MAAM,gBAAgB,GACxB,OAAO,GACP,MAAM,GACN,UAAU,GACV,UAAU,GACV,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,iBAAiB,GACjB,UAAU,GACV,UAAU,GACV,wCAAwC,GACxC,wCAAwC,GACxC,sCAAsC,GACtC,sCAAsC,CAAC;AAE3C,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB,EAAE,uBAAuB,CAAC;IACjD,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC,EAAE,MAAM,CAAC;IAC5C,qCAAqC,EAAE,MAAM,CAAC;IAC9C,KAAK,EAAE,KAAK,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,IAAI,CAAC;AAET,MAAM,MAAM,UAAU,GAAG;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sCAAsC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C,EAAE,2CAA2C,GAAG,IAAI,CAAC;IAChG,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,sCAAsC,EAAE,OAAO,CAAC;IAChD,gCAAgC,EAAE,OAAO,CAAC;IAC1C,mCAAmC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,qCAAqC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrD,uDAAuD,EAAE,OAAO,CAAC;IACjE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,wBAAwB,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;IACF,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC9C,QAAQ,EAAE,IAAI,GAAG,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;CAC3B,CAAC"}

package/dist/utils/codeVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeVerifier.d.ts","sourceRoot":"","sources":["../../src/utils/codeVerifier.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAGzF;AAED,eAAO,MAAM,wCAAwC,GAAI,MAAM,MAAM,KAAG,MAKvE,CAAC"}

package/dist/{src/utils → utils}/domains.d.ts

@@ -1,5 +1,5 @@
-import { Database, Domain, DomainDetails, OidcConfig, TrustedDomains } from '../types';
+import { Database, Domain, DomainDetails, TrustedDomains } from '../types';
 export declare function checkDomain(domains: Domain[], endpoint: string): void;
 export declare const getDomains: (trustedDomain: Domain[] | DomainDetails, type: "oidc" | "accessToken") => Domain[];
-export declare const getCurrentDatabaseDomain: (database: Database, url: string, trustedDomains: TrustedDomains) => OidcConfig[] | null;
+export declare const getCurrentDatabaseDomain: (database: Database, url: string, trustedDomains: TrustedDomains) => import('../types').OidcConfig[] | null;
 //# sourceMappingURL=domains.d.ts.map

package/dist/utils/domains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/utils/domains.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG3E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,QAqB9D;AAED,eAAO,MAAM,UAAU,GACrB,eAAe,MAAM,EAAE,GAAG,aAAa,EACvC,MAAM,MAAM,GAAG,aAAa,aAO7B,CAAC;AAEF,eAAO,MAAM,wBAAwB,GACnC,UAAU,QAAQ,EAClB,KAAK,MAAM,EACX,gBAAgB,cAAc,2CAqE/B,CAAC"}

package/dist/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC"}

package/dist/utils/normalizeUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizeUrl.d.ts","sourceRoot":"","sources":["../../src/utils/normalizeUrl.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,UAOvC"}

package/dist/utils/serializeHeaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializeHeaders.d.ts","sourceRoot":"","sources":["../../src/utils/serializeHeaders.ts"],"names":[],"mappings":"AAAA,iBAAS,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASlE;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/utils/shouldBypassDestination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shouldBypassDestination.d.ts","sourceRoot":"","sources":["../../src/utils/shouldBypassDestination.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,aAAa,MAAM,EAAE,MAAM,MAAM,KAAG,OAE3E,CAAC"}

package/dist/utils/sleep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sleep.d.ts","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,KAAK,GAAI,IAAI,MAAM,qBAAoD,CAAC;AAC9E,OAAO,EAAE,KAAK,EAAE,CAAC"}

package/dist/utils/strings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strings.d.ts","sourceRoot":"","sources":["../../src/utils/strings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAEpD"}

package/dist/{src/utils → utils}/tokens.d.ts

@@ -8,16 +8,25 @@ declare const isTokensOidcValid: (tokens: Tokens, nonce: string | null, oidcServ
     isValid: boolean;
     reason: string;
 };
-declare function _hideTokens(tokens: Tokens, currentDatabaseElement: OidcConfig, configurationName: string): {
+declare function _hideTokens(tokens: Tokens, currentDatabaseElement: OidcConfig, configurationName: string, isAuthorizationCode?: boolean): {
     accessTokenPayload: any;
+    scope?: string;
+    resourceContext?: {
+        resource: string;
+        issuer: string;
+        clientId: string;
+        configurationName: string;
+        subject: string;
+        grantResource: string | null;
+    };
     issued_at: number | string;
     access_token: string;
     id_token: null | string;
-    idTokenPayload: IdTokenPayload;
+    idTokenPayload?: IdTokenPayload | null;
     refresh_token?: string;
     expiresAt: number;
     expires_in: number | string;
 };
-declare function hideTokens(currentDatabaseElement: OidcConfig): (response: Response) => Response | Promise<Response>;
+declare function hideTokens(currentDatabaseElement: OidcConfig, isCurrent?: () => boolean, isGrantCurrent?: () => boolean, isAuthorizationCode?: boolean): (response: Response) => Response | Promise<Response>;
 export { b64DecodeUnicode, computeTimeLeft, isTokensValid, extractTokenPayload, isTokensOidcValid, hideTokens, _hideTokens, };
 //# sourceMappingURL=tokens.d.ts.map

package/dist/utils/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,cAAc,EACd,UAAU,EAEV,uBAAuB,EACvB,MAAM,EACP,MAAM,UAAU,CAAC;AAElB,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,QAEvC,CAAC;AACF,iBAAS,gBAAgB,CAAC,GAAG,EAAE,MAAM,UAMpC;AAED,iBAAS,eAAe,CAAC,yCAAyC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,UAG5F;AAED,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,WAK3C;AAED,QAAA,MAAM,mBAAmB,GAAI,QAAQ,MAAM,QAW1C,CAAC;AAIF,QAAA,MAAM,iBAAiB,GACrB,QAAQ,MAAM,EACd,OAAO,MAAM,GAAG,IAAI,EACpB,yBAAyB,uBAAuB,KAC/C;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CA2CpC,CAAC;AAsBF,iBAAS,WAAW,CAClB,MAAM,EAAE,MAAM,EACd,sBAAsB,EAAE,UAAU,EAClC,iBAAiB,EAAE,MAAM,EACzB,mBAAmB,UAAQ;;;;;;;;;;;;;;;;;;EAwM5B;AAGD,iBAAS,UAAU,CACjB,sBAAsB,EAAE,UAAU,EAClC,SAAS,GAAE,MAAM,OAAoB,EACrC,cAAc,GAAE,MAAM,OAAmB,EACzC,mBAAmB,UAAQ,IAGnB,UAAU,QAAQ,kCAsD3B;AAED,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,WAAW,GACZ,CAAC"}

package/dist/utils/waitForValidTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitForValidTokens.d.ts","sourceRoot":"","sources":["../../src/utils/waitForValidTokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAItC,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,UAAU,EAClB,SAAS,SAA2B,EACpC,cAAc,SAAiC,GAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB1B"}

package/dist/version.d.ts

@@ -0,0 +1,3 @@
+declare const _default: "7.30.0";
+export default _default;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"wBAAe,QAAQ;AAAvB,wBAAwB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axa-fr/oidc-client-service-worker",
-  "version": "7.29.7",
+  "version": "7.30.0",
   "type": "module",
   "private": false,
   "main": "dist/OidcServiceWorker.js",
@@ -38,7 +38,7 @@
   },
   "scripts": {
     "copy": "cpy --flat ./src/OidcTrustedDomains.js ./dist/",
-    "build": "tsc && vite build && pnpm run copy",
+    "build": "tsc && vite build && vite build --mode protocol && pnpm run copy",
     "test": "vitest run",
     "test:watch": "vitest --coverage",
     "coverage": "vitest run --coverage",
@@ -46,6 +46,7 @@
     "lint": "eslint src"
   },
   "devDependencies": {
+    "@types/node": "^26.6.5",
     "@vitest/coverage-v8": "5.0.3",
     "cpy": "13.2.3",
     "cpy-cli": "^7.0.0",