@boopkit/cap-oauth-server 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @boopkit/cap-oauth-server — an OAuth 2.1 authorization server and resource
+ * server for a boop application.
+ *
+ * Slice 1 shipped the parts every later slice speaks in terms of: the client
+ * registry that knows who is asking, and the discovery documents that tell a
+ * client what we are. Slice 2 adds the grant itself — the consent screen, the
+ * authorization code, `POST /oauth/token`, and enough of a resource-server
+ * guard to make an authenticated call real. Slice 3 makes that guard something
+ * a route can defend itself with — `requireOAuth(...scopes)` and its RFC 6750
+ * refusals — adds soft revocation, and gives a person the two screens where
+ * they see and disconnect what they have connected.
+ *
+ * **The identity boundary.** Nothing in this package reaches a user, an
+ * account, or an identity except through `@boopkit/cap-users`' public surface.
+ * The one table it owns is `oauth_clients`, which describes software rather
+ * than people. `tests/packages/cap-oauth-server-import-audit.test.ts` enforces
+ * that mechanically.
+ */
+import './express.js';
+export { classifyRedirectUri, matchRedirectUri, matchesAnyRedirectUri, isLoopbackHost, } from './redirect-uri.js';
+export type { RedirectUriClassification, RedirectUriShape } from './redirect-uri.js';
+export { generateClientPublicId, isValidClientPublicId, CLIENT_PUBLIC_ID_ALPHABET, CLIENT_PUBLIC_ID_LENGTH, } from './public-id.js';
+export { ClientRegistryError, isClientRegistryError } from './errors.js';
+export type { ClientRegistryErrorCode } from './errors.js';
+export { createClientRegistryService, validateRedirectUris, DEFAULT_GRANT_TYPES, DEFAULT_RESPONSE_TYPES, DEFAULT_METADATA_MAX_AGE_MS, DEFAULT_ABANDONED_CLIENT_TTL_MS, DEFAULT_MAX_REGISTERED_CLIENTS, } from './client-registry-service.js';
+export type { ClientRegistryService, ClientRegistryServiceOptions, PruneOptions, } from './client-registry-service.js';
+export { fetchMetadataDocument, isValidMetadataUri, DEFAULT_METADATA_TIMEOUT_MS, DEFAULT_METADATA_MAX_BYTES, DEFAULT_METADATA_MAX_REDIRECTS, } from './metadata-document.js';
+export type { FetchLike, FetchLikeResponse, MetadataFetchOptions, } from './metadata-document.js';
+export { buildAuthorizationServerMetadata, buildProtectedResourceMetadata, CODE_CHALLENGE_METHODS_SUPPORTED, DEVICE_CODE_GRANT_TYPE, DEFAULT_SCOPES_SUPPORTED, DISCOVERY_MAX_AGE_SECONDS, } from './discovery.js';
+export type { DiscoveryConfig, AuthorizationServerMetadata, ProtectedResourceMetadata, } from './discovery.js';
+export { readServerConfig, clampTtlSeconds, OauthServerConfigError, DEFAULT_ACCESS_TOKEN_TTL_SECONDS, DEFAULT_REFRESH_TOKEN_TTL_SECONDS, ACCESS_TOKEN_TTL_BOUNDS, REFRESH_TOKEN_TTL_BOUNDS, } from './config.js';
+export type { ServerConfig, ReadConfigOptions } from './config.js';
+export { createDiscoveryHandlers, createDiscoveryRouter } from './discovery-controller.js';
+export type { DiscoveryHandlers } from './discovery-controller.js';
+export { createRegistrationHandlers, createRegistrationRouter, toRegistrationResponse, } from './registration-controller.js';
+export type { RegistrationHandlerDeps, RegistrationRouterOptions, } from './registration-controller.js';
+export { createRegistrationRateLimiter, DEFAULT_REGISTRATION_RATE_LIMIT, DEFAULT_REGISTRATION_RATE_WINDOW_MS, } from './rate-limit.js';
+export type { RateLimiterOptions, RegistrationRateLimiter } from './rate-limit.js';
+export { CLIENT_MODES } from './types.js';
+export type { ClientMode, ClientStatus, OauthClient, OauthClientDelegate, ClientMetadataInput, ClientIdMetadataDocument, StaticClientInput, } from './types.js';
+export { createTokenService, buildIdentityKey, AUTHORIZATION_CODE_TTL_SECONDS, OAUTH_CODE_DOMAIN, OAUTH_ACCESS_DOMAIN, OAUTH_REFRESH_DOMAIN, } from './token-service.js';
+export type { TokenService, TokenServiceOptions, OAuthTokenDomain, MintedToken, ResolvedToken, } from './token-service.js';
+export { createGrantService, isGrantActive, OAUTH_GRANTS_PROPERTY, OAUTH_GRANTS_INFO_SCHEMA, } from './grant-service.js';
+export type { GrantService, GrantServiceOptions, GrantsSnapshot, OAuthGrantRecord, ApproveGrantInput, } from './grant-service.js';
+export { createAuthorizationCodeService, OAUTH_CODES_PROPERTY, OAUTH_CODES_INFO_SCHEMA, } from './authorization-code-service.js';
+export type { AuthorizationCodeService, AuthorizationCodeServiceOptions, AuthorizationCodeRecord, IssueCodeInput, RedeemCodeInput, RedeemFailure, RedeemResult, } from './authorization-code-service.js';
+export { CODE_CHALLENGE_METHOD, deriveCodeChallenge, isValidCodeChallenge, isValidCodeVerifier, verifyCodeChallenge, } from './pkce.js';
+export { OAuthError, isOAuthError } from './oauth-error.js';
+export type { OAuthErrorCode } from './oauth-error.js';
+export { isStaleWriteError } from './user-store.js';
+export type { IdentityStore, PropertyStore, PropertyWriteOptions, StoredIdentity, StoredProperty, } from './user-store.js';
+export { readArray, writeArray } from './property-array.js';
+export type { ArraySnapshot } from './property-array.js';
+export { createConsentHandlers, createConsentRouter, monogramFor, provenanceFor, safeLogoUri, scopeDescriptionsFrom, toScopeViews, warnUndescribedScopes, SCOPE_DESCRIPTIONS_LOCAL, } from './consent-controller.js';
+export type { AuthorizationRequest, ConsentCredentials, ConsentHandlers, ConsentHandlerDeps, ConsentRegister, ConsentRegistration, ConsentRouterOptions, ConsentScopeView, ConsentSession, ConsentSignIn, ConsentVariant, ScopeDescriptions, } from './consent-controller.js';
+export { createTokenHandlers, createTokenRouter, parseScopes, OFFLINE_ACCESS_SCOPE, } from './token-controller.js';
+export type { TokenHandlerDeps, TokenRouterOptions, TokenResponse, } from './token-controller.js';
+export { createOAuthBearerMiddleware, createOAuthResourceServer, createOAuthTokenResolver, missingScopes, requireOAuth, DEFAULT_BEARER_CHALLENGE, } from './bearer.js';
+export type { OAuthBearerOptions, OAuthResourceServer, ResolvedOAuthPrincipal, } from './bearer.js';
+export { createRevocationService, REVOKED_BY_CLIENT, REVOKED_BY_USER, REVOKED_CLIENT_WIDE, } from './revocation-service.js';
+export type { RevocationService, RevocationServiceOptions, RevokedGrant, } from './revocation-service.js';
+export { createRevocationHandlers, createRevocationRouter, } from './revocation-controller.js';
+export type { RevocationHandlerDeps, RevocationHandlers, RevocationRouterOptions, } from './revocation-controller.js';
+export { createConnectionsHandlers, createConnectionsRouter, ACCOUNT_COVERAGE_STATEMENT, } from './connections-controller.js';
+export type { ConnectionView, ConnectionsHandlers, ConnectionsHandlerDeps, ConnectionsRouterOptions, } from './connections-controller.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzE,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,YAAY,GACb,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,gCAAgC,EAChC,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAEnF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GACb,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,cAAc,EACd,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -0,0 +1,148 @@
+"use strict";
+/**
+ * @boopkit/cap-oauth-server — an OAuth 2.1 authorization server and resource
+ * server for a boop application.
+ *
+ * Slice 1 shipped the parts every later slice speaks in terms of: the client
+ * registry that knows who is asking, and the discovery documents that tell a
+ * client what we are. Slice 2 adds the grant itself — the consent screen, the
+ * authorization code, `POST /oauth/token`, and enough of a resource-server
+ * guard to make an authenticated call real. Slice 3 makes that guard something
+ * a route can defend itself with — `requireOAuth(...scopes)` and its RFC 6750
+ * refusals — adds soft revocation, and gives a person the two screens where
+ * they see and disconnect what they have connected.
+ *
+ * **The identity boundary.** Nothing in this package reaches a user, an
+ * account, or an identity except through `@boopkit/cap-users`' public surface.
+ * The one table it owns is `oauth_clients`, which describes software rather
+ * than people. `tests/packages/cap-oauth-server-import-audit.test.ts` enforces
+ * that mechanically.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_REFRESH_DOMAIN = exports.OAUTH_ACCESS_DOMAIN = exports.OAUTH_CODE_DOMAIN = exports.AUTHORIZATION_CODE_TTL_SECONDS = exports.buildIdentityKey = exports.createTokenService = exports.CLIENT_MODES = exports.DEFAULT_REGISTRATION_RATE_WINDOW_MS = exports.DEFAULT_REGISTRATION_RATE_LIMIT = exports.createRegistrationRateLimiter = exports.toRegistrationResponse = exports.createRegistrationRouter = exports.createRegistrationHandlers = exports.createDiscoveryRouter = exports.createDiscoveryHandlers = exports.REFRESH_TOKEN_TTL_BOUNDS = exports.ACCESS_TOKEN_TTL_BOUNDS = exports.DEFAULT_REFRESH_TOKEN_TTL_SECONDS = exports.DEFAULT_ACCESS_TOKEN_TTL_SECONDS = exports.OauthServerConfigError = exports.clampTtlSeconds = exports.readServerConfig = exports.DISCOVERY_MAX_AGE_SECONDS = exports.DEFAULT_SCOPES_SUPPORTED = exports.DEVICE_CODE_GRANT_TYPE = exports.CODE_CHALLENGE_METHODS_SUPPORTED = exports.buildProtectedResourceMetadata = exports.buildAuthorizationServerMetadata = exports.DEFAULT_METADATA_MAX_REDIRECTS = exports.DEFAULT_METADATA_MAX_BYTES = exports.DEFAULT_METADATA_TIMEOUT_MS = exports.isValidMetadataUri = exports.fetchMetadataDocument = exports.DEFAULT_MAX_REGISTERED_CLIENTS = exports.DEFAULT_ABANDONED_CLIENT_TTL_MS = exports.DEFAULT_METADATA_MAX_AGE_MS = exports.DEFAULT_RESPONSE_TYPES = exports.DEFAULT_GRANT_TYPES = exports.validateRedirectUris = exports.createClientRegistryService = exports.isClientRegistryError = exports.ClientRegistryError = exports.CLIENT_PUBLIC_ID_LENGTH = exports.CLIENT_PUBLIC_ID_ALPHABET = exports.isValidClientPublicId = exports.generateClientPublicId = exports.isLoopbackHost = exports.matchesAnyRedirectUri = exports.matchRedirectUri = exports.classifyRedirectUri = void 0;
+exports.ACCOUNT_COVERAGE_STATEMENT = exports.createConnectionsRouter = exports.createConnectionsHandlers = exports.createRevocationRouter = exports.createRevocationHandlers = exports.REVOKED_CLIENT_WIDE = exports.REVOKED_BY_USER = exports.REVOKED_BY_CLIENT = exports.createRevocationService = exports.DEFAULT_BEARER_CHALLENGE = exports.requireOAuth = exports.missingScopes = exports.createOAuthTokenResolver = exports.createOAuthResourceServer = exports.createOAuthBearerMiddleware = exports.OFFLINE_ACCESS_SCOPE = exports.parseScopes = exports.createTokenRouter = exports.createTokenHandlers = exports.SCOPE_DESCRIPTIONS_LOCAL = exports.warnUndescribedScopes = exports.toScopeViews = exports.scopeDescriptionsFrom = exports.safeLogoUri = exports.provenanceFor = exports.monogramFor = exports.createConsentRouter = exports.createConsentHandlers = exports.writeArray = exports.readArray = exports.isStaleWriteError = exports.isOAuthError = exports.OAuthError = exports.verifyCodeChallenge = exports.isValidCodeVerifier = exports.isValidCodeChallenge = exports.deriveCodeChallenge = exports.CODE_CHALLENGE_METHOD = exports.OAUTH_CODES_INFO_SCHEMA = exports.OAUTH_CODES_PROPERTY = exports.createAuthorizationCodeService = exports.OAUTH_GRANTS_INFO_SCHEMA = exports.OAUTH_GRANTS_PROPERTY = exports.isGrantActive = exports.createGrantService = void 0;
+// Side-effect import: the Express request augmentation this capability's
+// middleware writes (`req.oauthGrant`) and its consent controller reads
+// (`req.user`). Importing the package is what gives an application those
+// declarations. See `src/express.ts` for why they are re-declarations.
+require("./express.js");
+var redirect_uri_js_1 = require("./redirect-uri.js");
+Object.defineProperty(exports, "classifyRedirectUri", { enumerable: true, get: function () { return redirect_uri_js_1.classifyRedirectUri; } });
+Object.defineProperty(exports, "matchRedirectUri", { enumerable: true, get: function () { return redirect_uri_js_1.matchRedirectUri; } });
+Object.defineProperty(exports, "matchesAnyRedirectUri", { enumerable: true, get: function () { return redirect_uri_js_1.matchesAnyRedirectUri; } });
+Object.defineProperty(exports, "isLoopbackHost", { enumerable: true, get: function () { return redirect_uri_js_1.isLoopbackHost; } });
+var public_id_js_1 = require("./public-id.js");
+Object.defineProperty(exports, "generateClientPublicId", { enumerable: true, get: function () { return public_id_js_1.generateClientPublicId; } });
+Object.defineProperty(exports, "isValidClientPublicId", { enumerable: true, get: function () { return public_id_js_1.isValidClientPublicId; } });
+Object.defineProperty(exports, "CLIENT_PUBLIC_ID_ALPHABET", { enumerable: true, get: function () { return public_id_js_1.CLIENT_PUBLIC_ID_ALPHABET; } });
+Object.defineProperty(exports, "CLIENT_PUBLIC_ID_LENGTH", { enumerable: true, get: function () { return public_id_js_1.CLIENT_PUBLIC_ID_LENGTH; } });
+var errors_js_1 = require("./errors.js");
+Object.defineProperty(exports, "ClientRegistryError", { enumerable: true, get: function () { return errors_js_1.ClientRegistryError; } });
+Object.defineProperty(exports, "isClientRegistryError", { enumerable: true, get: function () { return errors_js_1.isClientRegistryError; } });
+var client_registry_service_js_1 = require("./client-registry-service.js");
+Object.defineProperty(exports, "createClientRegistryService", { enumerable: true, get: function () { return client_registry_service_js_1.createClientRegistryService; } });
+Object.defineProperty(exports, "validateRedirectUris", { enumerable: true, get: function () { return client_registry_service_js_1.validateRedirectUris; } });
+Object.defineProperty(exports, "DEFAULT_GRANT_TYPES", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_GRANT_TYPES; } });
+Object.defineProperty(exports, "DEFAULT_RESPONSE_TYPES", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_RESPONSE_TYPES; } });
+Object.defineProperty(exports, "DEFAULT_METADATA_MAX_AGE_MS", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_METADATA_MAX_AGE_MS; } });
+Object.defineProperty(exports, "DEFAULT_ABANDONED_CLIENT_TTL_MS", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_ABANDONED_CLIENT_TTL_MS; } });
+Object.defineProperty(exports, "DEFAULT_MAX_REGISTERED_CLIENTS", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_MAX_REGISTERED_CLIENTS; } });
+var metadata_document_js_1 = require("./metadata-document.js");
+Object.defineProperty(exports, "fetchMetadataDocument", { enumerable: true, get: function () { return metadata_document_js_1.fetchMetadataDocument; } });
+Object.defineProperty(exports, "isValidMetadataUri", { enumerable: true, get: function () { return metadata_document_js_1.isValidMetadataUri; } });
+Object.defineProperty(exports, "DEFAULT_METADATA_TIMEOUT_MS", { enumerable: true, get: function () { return metadata_document_js_1.DEFAULT_METADATA_TIMEOUT_MS; } });
+Object.defineProperty(exports, "DEFAULT_METADATA_MAX_BYTES", { enumerable: true, get: function () { return metadata_document_js_1.DEFAULT_METADATA_MAX_BYTES; } });
+Object.defineProperty(exports, "DEFAULT_METADATA_MAX_REDIRECTS", { enumerable: true, get: function () { return metadata_document_js_1.DEFAULT_METADATA_MAX_REDIRECTS; } });
+var discovery_js_1 = require("./discovery.js");
+Object.defineProperty(exports, "buildAuthorizationServerMetadata", { enumerable: true, get: function () { return discovery_js_1.buildAuthorizationServerMetadata; } });
+Object.defineProperty(exports, "buildProtectedResourceMetadata", { enumerable: true, get: function () { return discovery_js_1.buildProtectedResourceMetadata; } });
+Object.defineProperty(exports, "CODE_CHALLENGE_METHODS_SUPPORTED", { enumerable: true, get: function () { return discovery_js_1.CODE_CHALLENGE_METHODS_SUPPORTED; } });
+Object.defineProperty(exports, "DEVICE_CODE_GRANT_TYPE", { enumerable: true, get: function () { return discovery_js_1.DEVICE_CODE_GRANT_TYPE; } });
+Object.defineProperty(exports, "DEFAULT_SCOPES_SUPPORTED", { enumerable: true, get: function () { return discovery_js_1.DEFAULT_SCOPES_SUPPORTED; } });
+Object.defineProperty(exports, "DISCOVERY_MAX_AGE_SECONDS", { enumerable: true, get: function () { return discovery_js_1.DISCOVERY_MAX_AGE_SECONDS; } });
+var config_js_1 = require("./config.js");
+Object.defineProperty(exports, "readServerConfig", { enumerable: true, get: function () { return config_js_1.readServerConfig; } });
+Object.defineProperty(exports, "clampTtlSeconds", { enumerable: true, get: function () { return config_js_1.clampTtlSeconds; } });
+Object.defineProperty(exports, "OauthServerConfigError", { enumerable: true, get: function () { return config_js_1.OauthServerConfigError; } });
+Object.defineProperty(exports, "DEFAULT_ACCESS_TOKEN_TTL_SECONDS", { enumerable: true, get: function () { return config_js_1.DEFAULT_ACCESS_TOKEN_TTL_SECONDS; } });
+Object.defineProperty(exports, "DEFAULT_REFRESH_TOKEN_TTL_SECONDS", { enumerable: true, get: function () { return config_js_1.DEFAULT_REFRESH_TOKEN_TTL_SECONDS; } });
+Object.defineProperty(exports, "ACCESS_TOKEN_TTL_BOUNDS", { enumerable: true, get: function () { return config_js_1.ACCESS_TOKEN_TTL_BOUNDS; } });
+Object.defineProperty(exports, "REFRESH_TOKEN_TTL_BOUNDS", { enumerable: true, get: function () { return config_js_1.REFRESH_TOKEN_TTL_BOUNDS; } });
+var discovery_controller_js_1 = require("./discovery-controller.js");
+Object.defineProperty(exports, "createDiscoveryHandlers", { enumerable: true, get: function () { return discovery_controller_js_1.createDiscoveryHandlers; } });
+Object.defineProperty(exports, "createDiscoveryRouter", { enumerable: true, get: function () { return discovery_controller_js_1.createDiscoveryRouter; } });
+var registration_controller_js_1 = require("./registration-controller.js");
+Object.defineProperty(exports, "createRegistrationHandlers", { enumerable: true, get: function () { return registration_controller_js_1.createRegistrationHandlers; } });
+Object.defineProperty(exports, "createRegistrationRouter", { enumerable: true, get: function () { return registration_controller_js_1.createRegistrationRouter; } });
+Object.defineProperty(exports, "toRegistrationResponse", { enumerable: true, get: function () { return registration_controller_js_1.toRegistrationResponse; } });
+var rate_limit_js_1 = require("./rate-limit.js");
+Object.defineProperty(exports, "createRegistrationRateLimiter", { enumerable: true, get: function () { return rate_limit_js_1.createRegistrationRateLimiter; } });
+Object.defineProperty(exports, "DEFAULT_REGISTRATION_RATE_LIMIT", { enumerable: true, get: function () { return rate_limit_js_1.DEFAULT_REGISTRATION_RATE_LIMIT; } });
+Object.defineProperty(exports, "DEFAULT_REGISTRATION_RATE_WINDOW_MS", { enumerable: true, get: function () { return rate_limit_js_1.DEFAULT_REGISTRATION_RATE_WINDOW_MS; } });
+var types_js_1 = require("./types.js");
+Object.defineProperty(exports, "CLIENT_MODES", { enumerable: true, get: function () { return types_js_1.CLIENT_MODES; } });
+var token_service_js_1 = require("./token-service.js");
+Object.defineProperty(exports, "createTokenService", { enumerable: true, get: function () { return token_service_js_1.createTokenService; } });
+Object.defineProperty(exports, "buildIdentityKey", { enumerable: true, get: function () { return token_service_js_1.buildIdentityKey; } });
+Object.defineProperty(exports, "AUTHORIZATION_CODE_TTL_SECONDS", { enumerable: true, get: function () { return token_service_js_1.AUTHORIZATION_CODE_TTL_SECONDS; } });
+Object.defineProperty(exports, "OAUTH_CODE_DOMAIN", { enumerable: true, get: function () { return token_service_js_1.OAUTH_CODE_DOMAIN; } });
+Object.defineProperty(exports, "OAUTH_ACCESS_DOMAIN", { enumerable: true, get: function () { return token_service_js_1.OAUTH_ACCESS_DOMAIN; } });
+Object.defineProperty(exports, "OAUTH_REFRESH_DOMAIN", { enumerable: true, get: function () { return token_service_js_1.OAUTH_REFRESH_DOMAIN; } });
+var grant_service_js_1 = require("./grant-service.js");
+Object.defineProperty(exports, "createGrantService", { enumerable: true, get: function () { return grant_service_js_1.createGrantService; } });
+Object.defineProperty(exports, "isGrantActive", { enumerable: true, get: function () { return grant_service_js_1.isGrantActive; } });
+Object.defineProperty(exports, "OAUTH_GRANTS_PROPERTY", { enumerable: true, get: function () { return grant_service_js_1.OAUTH_GRANTS_PROPERTY; } });
+Object.defineProperty(exports, "OAUTH_GRANTS_INFO_SCHEMA", { enumerable: true, get: function () { return grant_service_js_1.OAUTH_GRANTS_INFO_SCHEMA; } });
+var authorization_code_service_js_1 = require("./authorization-code-service.js");
+Object.defineProperty(exports, "createAuthorizationCodeService", { enumerable: true, get: function () { return authorization_code_service_js_1.createAuthorizationCodeService; } });
+Object.defineProperty(exports, "OAUTH_CODES_PROPERTY", { enumerable: true, get: function () { return authorization_code_service_js_1.OAUTH_CODES_PROPERTY; } });
+Object.defineProperty(exports, "OAUTH_CODES_INFO_SCHEMA", { enumerable: true, get: function () { return authorization_code_service_js_1.OAUTH_CODES_INFO_SCHEMA; } });
+var pkce_js_1 = require("./pkce.js");
+Object.defineProperty(exports, "CODE_CHALLENGE_METHOD", { enumerable: true, get: function () { return pkce_js_1.CODE_CHALLENGE_METHOD; } });
+Object.defineProperty(exports, "deriveCodeChallenge", { enumerable: true, get: function () { return pkce_js_1.deriveCodeChallenge; } });
+Object.defineProperty(exports, "isValidCodeChallenge", { enumerable: true, get: function () { return pkce_js_1.isValidCodeChallenge; } });
+Object.defineProperty(exports, "isValidCodeVerifier", { enumerable: true, get: function () { return pkce_js_1.isValidCodeVerifier; } });
+Object.defineProperty(exports, "verifyCodeChallenge", { enumerable: true, get: function () { return pkce_js_1.verifyCodeChallenge; } });
+var oauth_error_js_1 = require("./oauth-error.js");
+Object.defineProperty(exports, "OAuthError", { enumerable: true, get: function () { return oauth_error_js_1.OAuthError; } });
+Object.defineProperty(exports, "isOAuthError", { enumerable: true, get: function () { return oauth_error_js_1.isOAuthError; } });
+var user_store_js_1 = require("./user-store.js");
+Object.defineProperty(exports, "isStaleWriteError", { enumerable: true, get: function () { return user_store_js_1.isStaleWriteError; } });
+var property_array_js_1 = require("./property-array.js");
+Object.defineProperty(exports, "readArray", { enumerable: true, get: function () { return property_array_js_1.readArray; } });
+Object.defineProperty(exports, "writeArray", { enumerable: true, get: function () { return property_array_js_1.writeArray; } });
+var consent_controller_js_1 = require("./consent-controller.js");
+Object.defineProperty(exports, "createConsentHandlers", { enumerable: true, get: function () { return consent_controller_js_1.createConsentHandlers; } });
+Object.defineProperty(exports, "createConsentRouter", { enumerable: true, get: function () { return consent_controller_js_1.createConsentRouter; } });
+Object.defineProperty(exports, "monogramFor", { enumerable: true, get: function () { return consent_controller_js_1.monogramFor; } });
+Object.defineProperty(exports, "provenanceFor", { enumerable: true, get: function () { return consent_controller_js_1.provenanceFor; } });
+Object.defineProperty(exports, "safeLogoUri", { enumerable: true, get: function () { return consent_controller_js_1.safeLogoUri; } });
+Object.defineProperty(exports, "scopeDescriptionsFrom", { enumerable: true, get: function () { return consent_controller_js_1.scopeDescriptionsFrom; } });
+Object.defineProperty(exports, "toScopeViews", { enumerable: true, get: function () { return consent_controller_js_1.toScopeViews; } });
+Object.defineProperty(exports, "warnUndescribedScopes", { enumerable: true, get: function () { return consent_controller_js_1.warnUndescribedScopes; } });
+Object.defineProperty(exports, "SCOPE_DESCRIPTIONS_LOCAL", { enumerable: true, get: function () { return consent_controller_js_1.SCOPE_DESCRIPTIONS_LOCAL; } });
+var token_controller_js_1 = require("./token-controller.js");
+Object.defineProperty(exports, "createTokenHandlers", { enumerable: true, get: function () { return token_controller_js_1.createTokenHandlers; } });
+Object.defineProperty(exports, "createTokenRouter", { enumerable: true, get: function () { return token_controller_js_1.createTokenRouter; } });
+Object.defineProperty(exports, "parseScopes", { enumerable: true, get: function () { return token_controller_js_1.parseScopes; } });
+Object.defineProperty(exports, "OFFLINE_ACCESS_SCOPE", { enumerable: true, get: function () { return token_controller_js_1.OFFLINE_ACCESS_SCOPE; } });
+var bearer_js_1 = require("./bearer.js");
+Object.defineProperty(exports, "createOAuthBearerMiddleware", { enumerable: true, get: function () { return bearer_js_1.createOAuthBearerMiddleware; } });
+Object.defineProperty(exports, "createOAuthResourceServer", { enumerable: true, get: function () { return bearer_js_1.createOAuthResourceServer; } });
+Object.defineProperty(exports, "createOAuthTokenResolver", { enumerable: true, get: function () { return bearer_js_1.createOAuthTokenResolver; } });
+Object.defineProperty(exports, "missingScopes", { enumerable: true, get: function () { return bearer_js_1.missingScopes; } });
+Object.defineProperty(exports, "requireOAuth", { enumerable: true, get: function () { return bearer_js_1.requireOAuth; } });
+Object.defineProperty(exports, "DEFAULT_BEARER_CHALLENGE", { enumerable: true, get: function () { return bearer_js_1.DEFAULT_BEARER_CHALLENGE; } });
+var revocation_service_js_1 = require("./revocation-service.js");
+Object.defineProperty(exports, "createRevocationService", { enumerable: true, get: function () { return revocation_service_js_1.createRevocationService; } });
+Object.defineProperty(exports, "REVOKED_BY_CLIENT", { enumerable: true, get: function () { return revocation_service_js_1.REVOKED_BY_CLIENT; } });
+Object.defineProperty(exports, "REVOKED_BY_USER", { enumerable: true, get: function () { return revocation_service_js_1.REVOKED_BY_USER; } });
+Object.defineProperty(exports, "REVOKED_CLIENT_WIDE", { enumerable: true, get: function () { return revocation_service_js_1.REVOKED_CLIENT_WIDE; } });
+var revocation_controller_js_1 = require("./revocation-controller.js");
+Object.defineProperty(exports, "createRevocationHandlers", { enumerable: true, get: function () { return revocation_controller_js_1.createRevocationHandlers; } });
+Object.defineProperty(exports, "createRevocationRouter", { enumerable: true, get: function () { return revocation_controller_js_1.createRevocationRouter; } });
+var connections_controller_js_1 = require("./connections-controller.js");
+Object.defineProperty(exports, "createConnectionsHandlers", { enumerable: true, get: function () { return connections_controller_js_1.createConnectionsHandlers; } });
+Object.defineProperty(exports, "createConnectionsRouter", { enumerable: true, get: function () { return connections_controller_js_1.createConnectionsRouter; } });
+Object.defineProperty(exports, "ACCOUNT_COVERAGE_STATEMENT", { enumerable: true, get: function () { return connections_controller_js_1.ACCOUNT_COVERAGE_STATEMENT; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;AAEH,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,wBAAsB;AAEtB,qDAK2B;AAJzB,sHAAA,mBAAmB,OAAA;AACnB,mHAAA,gBAAgB,OAAA;AAChB,wHAAA,qBAAqB,OAAA;AACrB,iHAAA,cAAc,OAAA;AAIhB,+CAKwB;AAJtB,sHAAA,sBAAsB,OAAA;AACtB,qHAAA,qBAAqB,OAAA;AACrB,yHAAA,yBAAyB,OAAA;AACzB,uHAAA,uBAAuB,OAAA;AAGzB,yCAAyE;AAAhE,gHAAA,mBAAmB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAGnD,2EAQsC;AAPpC,yIAAA,2BAA2B,OAAA;AAC3B,kIAAA,oBAAoB,OAAA;AACpB,iIAAA,mBAAmB,OAAA;AACnB,oIAAA,sBAAsB,OAAA;AACtB,yIAAA,2BAA2B,OAAA;AAC3B,6IAAA,+BAA+B,OAAA;AAC/B,4IAAA,8BAA8B,OAAA;AAQhC,+DAMgC;AAL9B,6HAAA,qBAAqB,OAAA;AACrB,0HAAA,kBAAkB,OAAA;AAClB,mIAAA,2BAA2B,OAAA;AAC3B,kIAAA,0BAA0B,OAAA;AAC1B,sIAAA,8BAA8B,OAAA;AAQhC,+CAOwB;AANtB,gIAAA,gCAAgC,OAAA;AAChC,8HAAA,8BAA8B,OAAA;AAC9B,gIAAA,gCAAgC,OAAA;AAChC,sHAAA,sBAAsB,OAAA;AACtB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AAQ3B,yCAQqB;AAPnB,6GAAA,gBAAgB,OAAA;AAChB,4GAAA,eAAe,OAAA;AACf,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAChC,8HAAA,iCAAiC,OAAA;AACjC,oHAAA,uBAAuB,OAAA;AACvB,qHAAA,wBAAwB,OAAA;AAI1B,qEAA2F;AAAlF,kIAAA,uBAAuB,OAAA;AAAE,gIAAA,qBAAqB,OAAA;AAGvD,2EAIsC;AAHpC,wIAAA,0BAA0B,OAAA;AAC1B,sIAAA,wBAAwB,OAAA;AACxB,oIAAA,sBAAsB,OAAA;AAOxB,iDAIyB;AAHvB,8HAAA,6BAA6B,OAAA;AAC7B,gIAAA,+BAA+B,OAAA;AAC/B,oIAAA,mCAAmC,OAAA;AAIrC,uCAA0C;AAAjC,wGAAA,YAAY,OAAA;AAWrB,uDAO4B;AAN1B,sHAAA,kBAAkB,OAAA;AAClB,oHAAA,gBAAgB,OAAA;AAChB,kIAAA,8BAA8B,OAAA;AAC9B,qHAAA,iBAAiB,OAAA;AACjB,uHAAA,mBAAmB,OAAA;AACnB,wHAAA,oBAAoB,OAAA;AAUtB,uDAK4B;AAJ1B,sHAAA,kBAAkB,OAAA;AAClB,iHAAA,aAAa,OAAA;AACb,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA;AAU1B,iFAIyC;AAHvC,+IAAA,8BAA8B,OAAA;AAC9B,qIAAA,oBAAoB,OAAA;AACpB,wIAAA,uBAAuB,OAAA;AAYzB,qCAMmB;AALjB,gHAAA,qBAAqB,OAAA;AACrB,8GAAA,mBAAmB,OAAA;AACnB,+GAAA,oBAAoB,OAAA;AACpB,8GAAA,mBAAmB,OAAA;AACnB,8GAAA,mBAAmB,OAAA;AAGrB,mDAA4D;AAAnD,4GAAA,UAAU,OAAA;AAAE,8GAAA,YAAY,OAAA;AAGjC,iDAAoD;AAA3C,kHAAA,iBAAiB,OAAA;AAS1B,yDAA4D;AAAnD,8GAAA,SAAS,OAAA;AAAE,+GAAA,UAAU,OAAA;AAG9B,iEAUiC;AAT/B,8HAAA,qBAAqB,OAAA;AACrB,4HAAA,mBAAmB,OAAA;AACnB,oHAAA,WAAW,OAAA;AACX,sHAAA,aAAa,OAAA;AACb,oHAAA,WAAW,OAAA;AACX,8HAAA,qBAAqB,OAAA;AACrB,qHAAA,YAAY,OAAA;AACZ,8HAAA,qBAAqB,OAAA;AACrB,iIAAA,wBAAwB,OAAA;AAiB1B,6DAK+B;AAJ7B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,kHAAA,WAAW,OAAA;AACX,2HAAA,oBAAoB,OAAA;AAQtB,yCAOqB;AANnB,wHAAA,2BAA2B,OAAA;AAC3B,sHAAA,yBAAyB,OAAA;AACzB,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,yGAAA,YAAY,OAAA;AACZ,qHAAA,wBAAwB,OAAA;AAQ1B,iEAKiC;AAJ/B,gIAAA,uBAAuB,OAAA;AACvB,0HAAA,iBAAiB,OAAA;AACjB,wHAAA,eAAe,OAAA;AACf,4HAAA,mBAAmB,OAAA;AAQrB,uEAGoC;AAFlC,oIAAA,wBAAwB,OAAA;AACxB,kIAAA,sBAAsB,OAAA;AAQxB,yEAIqC;AAHnC,sIAAA,yBAAyB,OAAA;AACzB,oIAAA,uBAAuB,OAAA;AACvB,uIAAA,0BAA0B,OAAA"}

package/dist/metadata-document.d.ts

@@ -0,0 +1,60 @@
+import type { ClientIdMetadataDocument } from './types.js';
+/**
+ * Fetching a Client ID Metadata Document.
+ *
+ * A CIMD client's `client_id` *is* an `https` URL, and the document at that URL
+ * is the client's metadata. So this function reaches out to a host we do not
+ * control, on a path a stranger chose, during an authorization request a user
+ * is waiting on. Everything here is a bound on what that can cost or claim.
+ *
+ * The HTTP boundary is injected rather than imported, so the component tests
+ * drive it directly: what a failing fetch, an oversized body or a lying
+ * document do is behaviour worth pinning, and none of it is reachable through a
+ * real network in a test suite.
+ */
+/** The `fetch` shape this module needs. Narrower than the global on purpose. */
+export type FetchLike = (url: string, init: {
+    method: string;
+    redirect: 'manual';
+    signal: AbortSignal;
+    headers: Record<string, string>;
+}) => Promise<FetchLikeResponse>;
+export interface FetchLikeResponse {
+    status: number;
+    headers: {
+        get(name: string): string | null;
+    };
+    text(): Promise<string>;
+}
+export interface MetadataFetchOptions {
+    /**
+     * Three seconds, well inside Claude's ten-second budget for the whole
+     * authorization step. The user is on the consent redirect while this runs.
+     */
+    timeoutMs?: number;
+    /** Bytes. A metadata document is a few hundred; 64 KiB is generous. */
+    maxBytes?: number;
+    /** How many `https`→`https` hops to follow before giving up. */
+    maxRedirects?: number;
+}
+export declare const DEFAULT_METADATA_TIMEOUT_MS = 3000;
+export declare const DEFAULT_METADATA_MAX_BYTES: number;
+export declare const DEFAULT_METADATA_MAX_REDIRECTS = 3;
+/**
+ * Is this a URL we are willing to treat as a `client_id`?
+ *
+ * `https` only, no credentials, no fragment. The fragment rule matters because
+ * `client_id` is compared for equality against the document's own `client_id`,
+ * and two URLs differing only in fragment address the same document while
+ * comparing unequal — an ambiguity a registry key cannot afford.
+ */
+export declare function isValidMetadataUri(value: string): boolean;
+/**
+ * Fetch and parse the document at `clientId`.
+ *
+ * Throws `ClientRegistryError('boop_metadata_document_unusable')` for every
+ * failure, so the caller has one thing to catch and one decision to make: fall
+ * back to a cached copy, or fail the request.
+ */
+export declare function fetchMetadataDocument(clientId: string, fetchImpl: FetchLike, options?: MetadataFetchOptions): Promise<ClientIdMetadataDocument>;
+//# sourceMappingURL=metadata-document.d.ts.map

package/dist/metadata-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-document.d.ts","sourceRoot":"","sources":["../src/metadata-document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,KACE,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,0BAA0B,QAAY,CAAC;AACpD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAKhD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAczD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,EACpB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CA+CnC"}

package/dist/metadata-document.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_METADATA_MAX_REDIRECTS = exports.DEFAULT_METADATA_MAX_BYTES = exports.DEFAULT_METADATA_TIMEOUT_MS = void 0;
+exports.isValidMetadataUri = isValidMetadataUri;
+exports.fetchMetadataDocument = fetchMetadataDocument;
+const errors_js_1 = require("./errors.js");
+exports.DEFAULT_METADATA_TIMEOUT_MS = 3000;
+exports.DEFAULT_METADATA_MAX_BYTES = 64 * 1024;
+exports.DEFAULT_METADATA_MAX_REDIRECTS = 3;
+const unusable = (message) => new errors_js_1.ClientRegistryError('boop_metadata_document_unusable', message);
+/**
+ * Is this a URL we are willing to treat as a `client_id`?
+ *
+ * `https` only, no credentials, no fragment. The fragment rule matters because
+ * `client_id` is compared for equality against the document's own `client_id`,
+ * and two URLs differing only in fragment address the same document while
+ * comparing unequal — an ambiguity a registry key cannot afford.
+ */
+function isValidMetadataUri(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    return (url.protocol === 'https:' &&
+        url.hostname !== '' &&
+        url.username === '' &&
+        url.password === '' &&
+        url.hash === '');
+}
+/**
+ * Fetch and parse the document at `clientId`.
+ *
+ * Throws `ClientRegistryError('boop_metadata_document_unusable')` for every
+ * failure, so the caller has one thing to catch and one decision to make: fall
+ * back to a cached copy, or fail the request.
+ */
+async function fetchMetadataDocument(clientId, fetchImpl, options = {}) {
+    const timeoutMs = options.timeoutMs ?? exports.DEFAULT_METADATA_TIMEOUT_MS;
+    const maxBytes = options.maxBytes ?? exports.DEFAULT_METADATA_MAX_BYTES;
+    const maxRedirects = options.maxRedirects ?? exports.DEFAULT_METADATA_MAX_REDIRECTS;
+    if (!isValidMetadataUri(clientId)) {
+        throw unusable(`client_id is not a usable https metadata document URL: ${clientId}`);
+    }
+    const body = await readDocument(clientId, fetchImpl, { timeoutMs, maxBytes, maxRedirects });
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        throw unusable(`metadata document at ${clientId} is not JSON`);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw unusable(`metadata document at ${clientId} is not a JSON object`);
+    }
+    const doc = parsed;
+    /**
+     * **The check that stops one document claiming another's identity.**
+     *
+     * Without it, anyone who can publish a redirect — or simply a document — can
+     * assert someone else's `client_id`, and the consent screen then shows a name
+     * and logo belonging to a client the user trusts while the redirect goes
+     * somewhere else entirely.
+     *
+     * It is deliberately compared against the URL we were *asked* for rather than
+     * the URL we ended up at. That is the stricter reading: if `a.example`
+     * redirects to a document whose `client_id` is `b.example`, then following
+     * the redirect and accepting `b.example`'s claim would let the owner of
+     * `a.example` register under `b.example`'s identity. Requiring the document
+     * to name the URL the client presented closes that, and costs a CIMD
+     * publisher nothing — the specification already requires the document's
+     * `client_id` to be its own URL.
+     */
+    if (doc.client_id !== clientId) {
+        throw unusable(`metadata document at ${clientId} claims a different client_id (${String(doc.client_id)})`);
+    }
+    return doc;
+}
+/** The transport half: redirects, timeout, size cap. */
+async function readDocument(startUrl, fetchImpl, limits) {
+    let url = startUrl;
+    for (let hop = 0; hop <= limits.maxRedirects; hop += 1) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), limits.timeoutMs);
+        let response;
+        try {
+            response = await fetchImpl(url, {
+                method: 'GET',
+                // Manual, so a redirect is a decision this code makes rather than one
+                // the HTTP client makes for it. `fetch`'s own redirect following would
+                // happily walk `https` → `http`, which is the hop this refuses.
+                redirect: 'manual',
+                signal: controller.signal,
+                headers: { accept: 'application/json' },
+            });
+        }
+        catch (err) {
+            throw unusable(`metadata document at ${url} could not be fetched: ${describe(err)}`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (response.status >= 300 && response.status < 400) {
+            const location = response.headers.get('location');
+            if (!location)
+                throw unusable(`metadata document at ${url} redirected with no Location`);
+            let next;
+            try {
+                next = new URL(location, url);
+            }
+            catch {
+                throw unusable(`metadata document at ${url} redirected to an unparseable ${location}`);
+            }
+            if (next.protocol !== 'https:') {
+                throw unusable(`metadata document at ${url} redirected to a non-https origin (${next.protocol}//${next.host})`);
+            }
+            url = next.toString();
+            continue;
+        }
+        if (response.status !== 200) {
+            throw unusable(`metadata document at ${url} answered ${response.status}`);
+        }
+        // Two size checks, because either alone has a hole. A declared
+        // `content-length` refuses a large body before it is read; measuring the
+        // body afterwards catches a chunked response that declared nothing. Neither
+        // caps the bytes actually pulled over the wire — that would need a stream,
+        // and `fetch`'s body is one, but the injected boundary these tests drive is
+        // not. The timeout is what bounds the pathological case in the meantime.
+        const declared = Number(response.headers.get('content-length'));
+        if (Number.isFinite(declared) && declared > limits.maxBytes) {
+            throw unusable(`metadata document at ${url} declares ${declared} bytes, over the ${limits.maxBytes} cap`);
+        }
+        const text = await response.text();
+        if (Buffer.byteLength(text, 'utf8') > limits.maxBytes) {
+            throw unusable(`metadata document at ${url} is over the ${limits.maxBytes}-byte cap`);
+        }
+        return text;
+    }
+    throw unusable(`metadata document at ${startUrl} redirected more than ${limits.maxRedirects} times`);
+}
+function describe(err) {
+    if (err instanceof Error)
+        return err.message;
+    return String(err);
+}
+//# sourceMappingURL=metadata-document.js.map

package/dist/metadata-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-document.js","sourceRoot":"","sources":["../src/metadata-document.ts"],"names":[],"mappings":";;;AA6DA,gDAcC;AASD,sDAmDC;AAvID,2CAAkD;AA8CrC,QAAA,2BAA2B,GAAG,IAAK,CAAC;AACpC,QAAA,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,QAAA,8BAA8B,GAAG,CAAC,CAAC;AAEhD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,IAAI,+BAAmB,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,IAAI,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,SAAoB,EACpB,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mCAA2B,CAAC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kCAA0B,CAAC;IAChE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sCAA8B,CAAC;IAE5E,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,0DAA0D,QAAQ,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAE5F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,cAAc,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,GAAG,GAAG,MAAkC,CAAC;IAE/C;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,CACZ,wBAAwB,QAAQ,kCAAkC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,SAAoB,EACpB,MAAqE;IAErE,IAAI,GAAG,GAAG,QAAQ,CAAC;IAEnB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAErE,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBAC9B,MAAM,EAAE,KAAK;gBACb,sEAAsE;gBACtE,uEAAuE;gBACvE,gEAAgE;gBAChE,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,wBAAwB,GAAG,0BAA0B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,MAAM,QAAQ,CAAC,wBAAwB,GAAG,8BAA8B,CAAC,CAAC;YAEzF,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,wBAAwB,GAAG,iCAAiC,QAAQ,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,CACZ,wBAAwB,GAAG,sCAAsC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,wBAAwB,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,+DAA+D;QAC/D,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5D,MAAM,QAAQ,CACZ,wBAAwB,GAAG,aAAa,QAAQ,oBAAoB,MAAM,CAAC,QAAQ,MAAM,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,QAAQ,CAAC,wBAAwB,GAAG,gBAAgB,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,yBAAyB,MAAM,CAAC,YAAY,QAAQ,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/dist/oauth-error.d.ts

@@ -0,0 +1,45 @@
+/**
+ * RFC 6749 error responses, as a typed refusal the controllers translate once.
+ *
+ * ## Why this is separate from `ClientRegistryError`
+ *
+ * `errors.ts` carries registration's vocabulary — RFC 7591 §3.2.2 plus a few
+ * `boop_` codes for things the specification has no word for. This carries the
+ * *grant* vocabulary: RFC 6749 §5.2's five codes, which a client library parses
+ * and branches on. They are different registries with different consumers, and
+ * a single enum spanning both would let a registration code reach a token
+ * response, which no client knows how to read.
+ *
+ * ## Status codes are not free choices
+ *
+ * §5.2 fixes them. `invalid_client` is 401 (with a `WWW-Authenticate` header
+ * when the client tried to authenticate); everything else is 400. Answering
+ * `invalid_grant` with a 401 makes a well-written client discard its refresh
+ * token *and* its access token and start a whole new authorization, which is a
+ * user-visible re-consent for what may be a transient server fault.
+ */
+/**
+ * RFC 6749 §5.2, plus §4.1.2.1's `access_denied` for the authorize redirect and
+ * RFC 7009 §2.2.1's `unsupported_token_type` for the revocation endpoint.
+ *
+ * `unsupported_token_type` belongs here rather than in `errors.ts` for the same
+ * reason the rest of this list does: RFC 7009 registers it in the OAuth
+ * Extensions Error Registry the token endpoint draws from, and a client library
+ * parses it off a body of exactly this shape. Its status is the default 400, so
+ * `STATUS_BY_CODE` needs no entry for it.
+ */
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_token_type' | 'invalid_scope' | 'access_denied' | 'server_error' | 'temporarily_unavailable' | 'unsupported_response_type';
+export declare class OAuthError extends Error {
+    readonly error: OAuthErrorCode;
+    readonly status: number;
+    readonly description: string;
+    constructor(error: OAuthErrorCode, description: string, status?: number);
+    /** The response body, exactly as §5.2 shapes it. */
+    toBody(): {
+        error: OAuthErrorCode;
+        error_description: string;
+    };
+}
+/** Narrower than `instanceof`, which is a false negative across module copies. */
+export declare function isOAuthError(err: unknown): err is OAuthError;
+//# sourceMappingURL=oauth-error.d.ts.map

package/dist/oauth-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-error.d.ts","sourceRoot":"","sources":["../src/oauth-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,wBAAwB,GACxB,eAAe,GACf,eAAe,GACf,cAAc,GACd,yBAAyB,GACzB,2BAA2B,CAAC;AAQhC,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAQvE,oDAAoD;IACpD,MAAM,IAAI;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;CAG/D;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,UAAU,CAO5D"}

package/dist/oauth-error.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * RFC 6749 error responses, as a typed refusal the controllers translate once.
+ *
+ * ## Why this is separate from `ClientRegistryError`
+ *
+ * `errors.ts` carries registration's vocabulary — RFC 7591 §3.2.2 plus a few
+ * `boop_` codes for things the specification has no word for. This carries the
+ * *grant* vocabulary: RFC 6749 §5.2's five codes, which a client library parses
+ * and branches on. They are different registries with different consumers, and
+ * a single enum spanning both would let a registration code reach a token
+ * response, which no client knows how to read.
+ *
+ * ## Status codes are not free choices
+ *
+ * §5.2 fixes them. `invalid_client` is 401 (with a `WWW-Authenticate` header
+ * when the client tried to authenticate); everything else is 400. Answering
+ * `invalid_grant` with a 401 makes a well-written client discard its refresh
+ * token *and* its access token and start a whole new authorization, which is a
+ * user-visible re-consent for what may be a transient server fault.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthError = void 0;
+exports.isOAuthError = isOAuthError;
+const STATUS_BY_CODE = {
+    invalid_client: 401,
+    server_error: 500,
+    temporarily_unavailable: 503,
+};
+class OAuthError extends Error {
+    constructor(error, description, status) {
+        super(`${error}: ${description}`);
+        this.name = 'OAuthError';
+        this.error = error;
+        this.description = description;
+        this.status = status ?? STATUS_BY_CODE[error] ?? 400;
+    }
+    /** The response body, exactly as §5.2 shapes it. */
+    toBody() {
+        return { error: this.error, error_description: this.description };
+    }
+}
+exports.OAuthError = OAuthError;
+/** Narrower than `instanceof`, which is a false negative across module copies. */
+function isOAuthError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        err.name === 'OAuthError' &&
+        typeof err.error === 'string');
+}
+//# sourceMappingURL=oauth-error.js.map

package/dist/oauth-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-error.js","sourceRoot":"","sources":["../src/oauth-error.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAmDH,oCAOC;AAjCD,MAAM,cAAc,GAA4C;IAC9D,cAAc,EAAE,GAAG;IACnB,YAAY,EAAE,GAAG;IACjB,uBAAuB,EAAE,GAAG;CAC7B,CAAC;AAEF,MAAa,UAAW,SAAQ,KAAK;IAKnC,YAAY,KAAqB,EAAE,WAAmB,EAAE,MAAe;QACrE,KAAK,CAAC,GAAG,KAAK,KAAK,WAAW,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;IACvD,CAAC;IAED,oDAAoD;IACpD,MAAM;QACJ,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC;CACF;AAjBD,gCAiBC;AAED,kFAAkF;AAClF,SAAgB,YAAY,CAAC,GAAY;IACvC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACX,GAA0B,CAAC,IAAI,KAAK,YAAY;QACjD,OAAQ,GAA2B,CAAC,KAAK,KAAK,QAAQ,CACvD,CAAC;AACJ,CAAC"}

package/dist/pkce.d.ts

@@ -0,0 +1,29 @@
+/**
+ * PKCE, RFC 7636 — and only `S256`.
+ *
+ * `plain` is not a weaker method, it is the absence of one: the "challenge" is
+ * the verifier, so an attacker who intercepted the authorization response has
+ * everything needed to redeem the code. The discovery document advertises
+ * `["S256"]` and this module is the other half of that promise — a request
+ * carrying `code_challenge_method=plain` is refused rather than downgraded to.
+ *
+ * OAuth 2.1 requires PKCE for public clients, and every client this server will
+ * ever see is public, so the challenge is **required** rather than optional.
+ */
+/** The only method this server accepts. Matches the discovery document. */
+export declare const CODE_CHALLENGE_METHOD = "S256";
+export declare function isValidCodeVerifier(value: unknown): value is string;
+export declare function isValidCodeChallenge(value: unknown): value is string;
+/** BASE64URL-ENCODE(SHA256(ASCII(verifier))), per RFC 7636 §4.6. */
+export declare function deriveCodeChallenge(verifier: string): string;
+/**
+ * Does `verifier` satisfy the `challenge` the authorization request carried?
+ *
+ * Compared with `timingSafeEqual` rather than `===`. The challenge is not a
+ * secret — it travelled in a query string — but the comparison is on the
+ * redemption path next to comparisons that are, and a codebase where one string
+ * equality is constant-time and its neighbour is not teaches the wrong habit to
+ * whoever writes the third one.
+ */
+export declare function verifyCodeChallenge(verifier: unknown, challenge: unknown, method?: unknown): boolean;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAc5C,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEnE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,OAAO,EAClB,MAAM,GAAE,OAA+B,GACtC,OAAO,CAST"}