@baukit/auth-node 0.3.0

package/dist/errors.js

@@ -0,0 +1,38 @@
+const SAFE_MESSAGES = {
+    aborted: 'OIDC operation was cancelled.',
+    cache_corrupt: 'The local authentication cache is invalid.',
+    cache_lock_timeout: 'Timed out waiting for the local authentication cache lock.',
+    cache_permission: 'The local authentication cache permissions are unsafe.',
+    cache_read_failed: 'Could not read the local authentication cache.',
+    cache_symlink: 'The local authentication cache must not use symbolic links.',
+    cache_write_failed: 'Could not update the local authentication cache.',
+    device_authorization_denied: 'OIDC device authorization was denied.',
+    device_authorization_expired: 'OIDC device authorization expired.',
+    device_authorization_failed: 'OIDC device authorization failed.',
+    discovery_failed: 'OIDC provider discovery failed.',
+    endpoint_policy_violation: 'OIDC endpoint did not satisfy the configured security policy.',
+    invalid_device_response: 'OIDC provider returned an invalid device authorization response.',
+    invalid_discovery_document: 'OIDC provider returned invalid discovery metadata.',
+    invalid_token_response: 'OIDC provider returned an invalid token response.',
+    issuer_mismatch: 'OIDC provider issuer did not match an allowed issuer.',
+    login_timeout: 'OIDC device authorization timed out.',
+    no_cached_session: 'No usable OIDC session is available.',
+    refresh_failed: 'OIDC token refresh failed.',
+};
+/** An authentication failure whose message never includes tokens or provider response bodies. */
+export class AuthNodeError extends Error {
+    code;
+    retryable;
+    status;
+    constructor(code, options = {}) {
+        super(SAFE_MESSAGES[code]);
+        this.name = 'AuthNodeError';
+        this.code = code;
+        this.retryable = options.retryable ?? false;
+        this.status = options.status;
+    }
+}
+export function safeAuthNodeErrorMessage(cause) {
+    return cause instanceof AuthNodeError ? SAFE_MESSAGES[cause.code] : 'OIDC authentication failed.';
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAqBA,MAAM,aAAa,GAAG;IACpB,OAAO,EAAE,+BAA+B;IACxC,aAAa,EAAE,4CAA4C;IAC3D,kBAAkB,EAAE,4DAA4D;IAChF,gBAAgB,EAAE,wDAAwD;IAC1E,iBAAiB,EAAE,gDAAgD;IACnE,aAAa,EAAE,6DAA6D;IAC5E,kBAAkB,EAAE,kDAAkD;IACtE,2BAA2B,EAAE,uCAAuC;IACpE,4BAA4B,EAAE,oCAAoC;IAClE,2BAA2B,EAAE,mCAAmC;IAChE,gBAAgB,EAAE,iCAAiC;IACnD,yBAAyB,EAAE,+DAA+D;IAC1F,uBAAuB,EAAE,kEAAkE;IAC3F,0BAA0B,EAAE,oDAAoD;IAChF,sBAAsB,EAAE,mDAAmD;IAC3E,eAAe,EAAE,uDAAuD;IACxE,aAAa,EAAE,sCAAsC;IACrD,iBAAiB,EAAE,sCAAsC;IACzD,cAAc,EAAE,4BAA4B;CACQ,CAAC;AAEvD,iGAAiG;AACjG,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtB,IAAI,CAAoB;IACxB,SAAS,CAAU;IACnB,MAAM,CAAqB;IAE3C,YACE,IAAuB,EACvB,UAAsE,EAAE;QAExE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC;AACpG,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { defaultTokenCachePath, NodeTokenCache, type CachedTokenProfile, type NodeTokenCacheOptions, type TokenCacheTransaction, } from './cache.js';
+export { decodeDisplayOnlyClaims, DeviceFlowClient, discoverDeviceProvider, type AccessTokenOptions, type DeviceFlowClientConfig, type DeviceFlowEnvironment, type DeviceFlowPresentation, type DeviceFlowStatus, type DeviceProviderRequestOptions, type DeviceVerification, type DisplayOnlyClaims, type EndpointPolicy, type LoginOptions, type OidcDeviceMetadata, } from './device-flow.js';
+export { AuthNodeError, safeAuthNodeErrorMessage, type AuthNodeErrorCode } from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { defaultTokenCachePath, NodeTokenCache, } from './cache.js';
+export { decodeDisplayOnlyClaims, DeviceFlowClient, discoverDeviceProvider, } from './device-flow.js';
+export { AuthNodeError, safeAuthNodeErrorMessage } from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GAIf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,GAYvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAA0B,MAAM,aAAa,CAAC"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@baukit/auth-node",
+  "version": "0.3.0",
+  "description": "Node OIDC device authorization with S256 PKCE, refresh rotation, and a locked token cache.",
+  "license": "MIT",
+  "author": "Patrick Koss",
+  "homepage": "https://github.com/PatrickKoss/baukit#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PatrickKoss/baukit.git",
+    "directory": "typescript/packages/auth-node"
+  },
+  "bugs": {
+    "url": "https://github.com/PatrickKoss/baukit/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./device-flow": {
+      "types": "./dist/device-flow.d.ts",
+      "import": "./dist/device-flow.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "devDependencies": {
+    "@playwright/test": "1.62.1",
+    "@types/node": "24.10.1",
+    "typescript": "6.0.3"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run --config ../../vitest.config.ts",
+    "test:conformance": "vitest run --config ../../vitest.config.ts src/conformance.test.ts",
+    "test:conformance:keycloak": "pnpm run build && node scripts/keycloak-conformance.mjs",
+    "lint": "eslint src --max-warnings=0",
+    "format:check": "prettier --check src scripts package.json tsconfig.json tsconfig.test.json"
+  }
+}