@dereekb/util 13.23.0 → 13.25.0

package/oidc/index.esm.js

@@ -0,0 +1,1057 @@
+import { OidcRelyingPartyError, buildOidcDiscoveryCandidates, expirationDetails, inMemoryAsyncValueCache, calculateExpirationDate, MS_IN_SECOND } from '@dereekb/util';
+
+function asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator$1(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _define_property$1(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof$1(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _object_spread$1(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$1(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _ts_generator$1(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+// MARK: Discovery
+/**
+ * Fetches the OIDC discovery document for the given issuer, trying the candidates returned by
+ * {@link buildOidcDiscoveryCandidates} in order.
+ *
+ * @param input - The discovery request plus the injected fetch transport.
+ * @param input.issuer - The OIDC issuer URL whose `.well-known/openid-configuration` is fetched first.
+ * @param input.fallbackBaseUrl - Optional sibling base URL tried after the issuer-prefixed and origin-rooted candidates.
+ * @param input.fetch - The plain fetch transport.
+ * @returns The parsed {@link OidcDiscoveryMetadata}. Throws an {@link OidcRelyingPartyError} (`DISCOVERY_FAILED`) when every candidate fails.
+ */ function discoverOidcMetadata(input) {
+    return _async_to_generator$1(function() {
+        var candidates, lastError, result, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, url, res, e, err, _ref;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    candidates = buildOidcDiscoveryCandidates(input);
+                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        10,
+                        11,
+                        12
+                    ]);
+                    _iterator = candidates[Symbol.iterator]();
+                    _state.label = 2;
+                case 2:
+                    if (!!(_iteratorNormalCompletion = (_step = _iterator.next()).done)) return [
+                        3,
+                        9
+                    ];
+                    url = _step.value;
+                    _state.label = 3;
+                case 3:
+                    _state.trys.push([
+                        3,
+                        7,
+                        ,
+                        8
+                    ]);
+                    return [
+                        4,
+                        input.fetch(url, {
+                            headers: {
+                                Accept: 'application/json'
+                            }
+                        })
+                    ];
+                case 4:
+                    res = _state.sent();
+                    if (!res.ok) return [
+                        3,
+                        6
+                    ];
+                    return [
+                        4,
+                        res.json()
+                    ];
+                case 5:
+                    result = _state.sent();
+                    return [
+                        3,
+                        9
+                    ];
+                case 6:
+                    lastError = new Error("OIDC discovery failed at ".concat(url, ": ").concat(res.status, " ").concat(res.statusText));
+                    return [
+                        3,
+                        8
+                    ];
+                case 7:
+                    e = _state.sent();
+                    lastError = new Error("OIDC discovery failed at ".concat(url, ": ").concat(_instanceof$1(e, Error) ? e.message : String(e)));
+                    return [
+                        3,
+                        8
+                    ];
+                case 8:
+                    _iteratorNormalCompletion = true;
+                    return [
+                        3,
+                        2
+                    ];
+                case 9:
+                    return [
+                        3,
+                        12
+                    ];
+                case 10:
+                    err = _state.sent();
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                    return [
+                        3,
+                        12
+                    ];
+                case 11:
+                    try {
+                        if (!_iteratorNormalCompletion && _iterator.return != null) {
+                            _iterator.return();
+                        }
+                    } finally{
+                        if (_didIteratorError) {
+                            throw _iteratorError;
+                        }
+                    }
+                    return [
+                        7
+                    ];
+                case 12:
+                    if (result == null) {
+                        throw new OidcRelyingPartyError({
+                            message: (_ref = lastError === null || lastError === void 0 ? void 0 : lastError.message) !== null && _ref !== void 0 ? _ref : "OIDC discovery failed for all candidates: ".concat(candidates.join(', ')),
+                            code: 'DISCOVERY_FAILED',
+                            _error: lastError
+                        });
+                    }
+                    return [
+                        2,
+                        result
+                    ];
+            }
+        });
+    })();
+}
+// MARK: Token Endpoint
+/**
+ * Exchanges an authorization code (from the redirect) for an access token + refresh token.
+ *
+ * Sends `client_secret` only when provided — public PKCE clients (`token_endpoint_auth_method: 'none'`)
+ * authenticate via the `code_verifier` alone.
+ *
+ * @param input - The token exchange parameters plus the injected fetch transport.
+ * @param input.tokenEndpoint - The OIDC token endpoint URL discovered from the issuer.
+ * @param input.clientId - The OAuth client ID.
+ * @param input.clientSecret - Optional client secret for `client_secret_post` auth; omit for public clients.
+ * @param input.redirectUri - The redirect URI registered with the OAuth client.
+ * @param input.code - The authorization code returned to the redirect URI.
+ * @param input.codeVerifier - The PKCE code verifier originally paired with the code challenge.
+ * @param input.fetch - The plain fetch transport.
+ * @returns The parsed {@link OidcTokenResponse} with access/refresh tokens.
+ */ function exchangeAuthorizationCode(input) {
+    return _async_to_generator$1(function() {
+        var params;
+        return _ts_generator$1(this, function(_state) {
+            params = new URLSearchParams({
+                grant_type: 'authorization_code',
+                client_id: input.clientId,
+                redirect_uri: input.redirectUri,
+                code: input.code,
+                code_verifier: input.codeVerifier
+            });
+            if (input.clientSecret) {
+                params.set('client_secret', input.clientSecret);
+            }
+            return [
+                2,
+                postTokenEndpoint({
+                    tokenEndpoint: input.tokenEndpoint,
+                    body: params,
+                    fetch: input.fetch
+                })
+            ];
+        });
+    })();
+}
+/**
+ * Exchanges a refresh token for a new access token (and possibly a rotated refresh token).
+ *
+ * @param input - The refresh request plus the injected fetch transport.
+ * @param input.tokenEndpoint - The OIDC token endpoint URL discovered from the issuer.
+ * @param input.clientId - The OAuth client ID.
+ * @param input.clientSecret - Optional client secret; omit for public clients.
+ * @param input.refreshToken - The cached refresh token to redeem.
+ * @param input.fetch - The plain fetch transport.
+ * @returns The parsed {@link OidcTokenResponse} with the refreshed access token.
+ */ function refreshAccessToken(input) {
+    return _async_to_generator$1(function() {
+        var params;
+        return _ts_generator$1(this, function(_state) {
+            params = new URLSearchParams({
+                grant_type: 'refresh_token',
+                client_id: input.clientId,
+                refresh_token: input.refreshToken
+            });
+            if (input.clientSecret) {
+                params.set('client_secret', input.clientSecret);
+            }
+            return [
+                2,
+                postTokenEndpoint({
+                    tokenEndpoint: input.tokenEndpoint,
+                    body: params,
+                    fetch: input.fetch
+                })
+            ];
+        });
+    })();
+}
+/**
+ * Revokes an access or refresh token at the OIDC revocation endpoint.
+ *
+ * @param input - The revocation request plus the injected fetch transport.
+ * @param input.revocationEndpoint - The OIDC revocation endpoint URL.
+ * @param input.clientId - The OAuth client ID.
+ * @param input.clientSecret - Optional client secret; omit for public clients.
+ * @param input.token - The access or refresh token to revoke.
+ * @param input.tokenTypeHint - Optional hint passed as `token_type_hint` (`access_token` or `refresh_token`).
+ * @param input.fetch - The plain fetch transport.
+ * @returns Resolves when the server returns a non-error status. Throws an {@link OidcRelyingPartyError} (`TOKEN_REVOCATION_FAILED`) on error.
+ */ function revokeToken(input) {
+    return _async_to_generator$1(function() {
+        var params, res;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    params = new URLSearchParams(_object_spread$1({
+                        client_id: input.clientId,
+                        token: input.token
+                    }, input.tokenTypeHint ? {
+                        token_type_hint: input.tokenTypeHint
+                    } : {}));
+                    if (input.clientSecret) {
+                        params.set('client_secret', input.clientSecret);
+                    }
+                    return [
+                        4,
+                        input.fetch(input.revocationEndpoint, {
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/x-www-form-urlencoded',
+                                Accept: 'application/json'
+                            },
+                            body: params.toString()
+                        })
+                    ];
+                case 1:
+                    res = _state.sent();
+                    if (!res.ok) {
+                        throw new OidcRelyingPartyError({
+                            message: "Token revocation failed: ".concat(res.status, " ").concat(res.statusText),
+                            code: 'TOKEN_REVOCATION_FAILED'
+                        });
+                    }
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+// MARK: Userinfo + Session
+/**
+ * Fetches the OIDC `userinfo` endpoint and returns the parsed claims object.
+ *
+ * @param input - The userinfo request plus the injected fetch transport.
+ * @param input.userinfoEndpoint - The OIDC userinfo endpoint URL discovered from the issuer.
+ * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
+ * @param input.fetch - The fetch transport.
+ * @returns The parsed userinfo claims. Throws an {@link OidcRelyingPartyError} (`USERINFO_FAILED`) on a non-OK response.
+ */ function fetchUserInfo(input) {
+    return _async_to_generator$1(function() {
+        var res;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        input.fetch(input.userinfoEndpoint, {
+                            headers: {
+                                Authorization: "Bearer ".concat(input.accessToken),
+                                Accept: 'application/json'
+                            }
+                        })
+                    ];
+                case 1:
+                    res = _state.sent();
+                    if (!res.ok) {
+                        throw new OidcRelyingPartyError({
+                            message: "Userinfo request failed: ".concat(res.status, " ").concat(res.statusText),
+                            code: 'USERINFO_FAILED'
+                        });
+                    }
+                    return [
+                        4,
+                        res.json()
+                    ];
+                case 2:
+                    return [
+                        2,
+                        _state.sent()
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Fetches the dbx-components `GET /oidc/session` route and returns the parsed session lifetime metadata.
+ *
+ * Mirrors {@link fetchUserInfo}, but reads the access token's baked-in session-lifetime claims
+ * (`dbx_session_expires_at` / `dbx_rotation_disabled`) which userinfo does not echo.
+ *
+ * @param input - The session request plus the injected fetch transport.
+ * @param input.sessionEndpoint - The `GET /oidc/session` endpoint URL.
+ * @param input.accessToken - The Bearer access token sent in the `Authorization` header.
+ * @param input.fetch - The fetch transport.
+ * @returns The parsed {@link OidcSessionInfo}. Throws an {@link OidcRelyingPartyError} (`SESSION_INFO_FAILED`) on a non-OK response.
+ */ function fetchSessionInfo(input) {
+    return _async_to_generator$1(function() {
+        var res;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        input.fetch(input.sessionEndpoint, {
+                            headers: {
+                                Authorization: "Bearer ".concat(input.accessToken),
+                                Accept: 'application/json'
+                            }
+                        })
+                    ];
+                case 1:
+                    res = _state.sent();
+                    if (!res.ok) {
+                        throw new OidcRelyingPartyError({
+                            message: "Session info request failed: ".concat(res.status, " ").concat(res.statusText),
+                            code: 'SESSION_INFO_FAILED'
+                        });
+                    }
+                    return [
+                        4,
+                        res.json()
+                    ];
+                case 2:
+                    return [
+                        2,
+                        _state.sent()
+                    ];
+            }
+        });
+    })();
+}
+function postTokenEndpoint(input) {
+    return _async_to_generator$1(function() {
+        var res, body, _ref, _body_error_description, message;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        input.fetch(input.tokenEndpoint, {
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/x-www-form-urlencoded',
+                                Accept: 'application/json'
+                            },
+                            body: input.body.toString()
+                        })
+                    ];
+                case 1:
+                    res = _state.sent();
+                    return [
+                        4,
+                        res.json().catch(function() {
+                            return {};
+                        })
+                    ];
+                case 2:
+                    body = _state.sent();
+                    if (!res.ok || body.error) {
+                        message = (_ref = (_body_error_description = body.error_description) !== null && _body_error_description !== void 0 ? _body_error_description : body.error) !== null && _ref !== void 0 ? _ref : "".concat(res.status, " ").concat(res.statusText);
+                        throw new OidcRelyingPartyError({
+                            message: "OIDC token endpoint error: ".concat(message),
+                            code: body.error === 'invalid_grant' ? 'TOKEN_INVALID_GRANT' : 'TOKEN_EXCHANGE_FAILED'
+                        });
+                    }
+                    if (!body.access_token) {
+                        throw new OidcRelyingPartyError({
+                            message: 'OIDC token endpoint returned no access_token.',
+                            code: 'TOKEN_EXCHANGE_FAILED'
+                        });
+                    }
+                    return [
+                        2,
+                        body
+                    ];
+            }
+        });
+    })();
+}
+
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+// MARK: Constants
+/**
+ * Default pre-emptive refresh buffer in milliseconds.
+ *
+ * An access token is treated as needing a refresh this far ahead of its real expiry to absorb
+ * clock skew and request latency.
+ */ var DEFAULT_OIDC_TOKEN_REFRESH_BUFFER_MS = 60000;
+/**
+ * Normalizes an {@link OidcTokenResponse} into an {@link OidcTokenState}, converting the relative
+ * `expires_in` (seconds) into an absolute `expiresAt` (epoch ms) anchored at `config.now`.
+ *
+ * @param response - The token endpoint response to normalize.
+ * @param config - Optional anchoring time and pre-decoded claims.
+ * @returns The normalized {@link OidcTokenState}.
+ */ function oidcTokenStateFromResponse(response, config) {
+    var _ref, _ref1;
+    var _calculateExpirationDate;
+    var nowMs = resolveNowMs(config === null || config === void 0 ? void 0 : config.now);
+    var expiresAt = response.expires_in == null ? undefined : (_ref = (_calculateExpirationDate = calculateExpirationDate({
+        expiresFromDate: nowMs,
+        expiresIn: response.expires_in * MS_IN_SECOND
+    })) === null || _calculateExpirationDate === void 0 ? void 0 : _calculateExpirationDate.getTime()) !== null && _ref !== void 0 ? _ref : undefined;
+    return {
+        accessToken: response.access_token,
+        refreshToken: response.refresh_token,
+        idToken: response.id_token,
+        tokenType: response.token_type,
+        scope: response.scope,
+        expiresAt: expiresAt,
+        claims: (_ref1 = config === null || config === void 0 ? void 0 : config.claims) !== null && _ref1 !== void 0 ? _ref1 : decodeJwtClaims(response.id_token)
+    };
+}
+// MARK: Expiry
+/**
+ * Returns true when the access token's real expiry has already passed (no buffer applied), or when
+ * the state / its `expiresAt` is missing.
+ *
+ * @param state - The token state to inspect.
+ * @param now - Optional current time override.
+ * @returns Whether the access token has expired.
+ */ function isAccessTokenExpired(state, now) {
+    return accessTokenNeedsRefresh(state, now, 0);
+}
+/**
+ * Returns true when the access token is expired or within `bufferMs` of expiry (pre-emptive
+ * refresh), or when the state / its `expiresAt` is missing.
+ *
+ * @param state - The token state to inspect.
+ * @param now - Optional current time override.
+ * @param bufferMs - Pre-emptive refresh buffer in milliseconds. Defaults to {@link DEFAULT_OIDC_TOKEN_REFRESH_BUFFER_MS}.
+ * @returns Whether the access token should be refreshed.
+ */ function accessTokenNeedsRefresh(state, now) {
+    var bufferMs = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : DEFAULT_OIDC_TOKEN_REFRESH_BUFFER_MS;
+    var result = true;
+    if ((state === null || state === void 0 ? void 0 : state.expiresAt) != null) {
+        result = expirationDetails({
+            expiresFromDate: state.expiresAt,
+            expiresIn: -bufferMs,
+            now: new Date(resolveNowMs(now))
+        }).hasExpired();
+    }
+    return result;
+}
+/**
+ * Returns the milliseconds remaining until the access token should be pre-emptively refreshed
+ * (its real expiry minus `bufferMs`), clamped to a minimum of `0`.
+ *
+ * @param state - The token state to inspect.
+ * @param now - Optional current time override.
+ * @param bufferMs - Pre-emptive refresh buffer in milliseconds. Defaults to {@link DEFAULT_OIDC_TOKEN_REFRESH_BUFFER_MS}.
+ * @returns The delay in milliseconds, or `0` when already due / unknown.
+ */ function nextRefreshDelay(state, now) {
+    var bufferMs = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : DEFAULT_OIDC_TOKEN_REFRESH_BUFFER_MS;
+    var result = 0;
+    if ((state === null || state === void 0 ? void 0 : state.expiresAt) != null) {
+        result = Math.max(0, state.expiresAt - bufferMs - resolveNowMs(now));
+    }
+    return result;
+}
+/**
+ * Creates an {@link OidcTokenManager} over the given storage + refresh function.
+ *
+ * - **Lazy** — refreshes only on demand (no timer), so it works unchanged in a CLI or browser.
+ * - **Single-flight** — concurrent `getValidAccessToken()` / `refreshNow()` calls share one
+ *   in-flight refresh, so N callers trigger at most one network exchange.
+ * - **Rotation-safe** — a rotated `refresh_token` replaces the old one; when the response omits it,
+ *   the prior refresh token is kept. The `id_token`/`claims` are likewise carried forward when a
+ *   refresh response omits them.
+ * - **invalid_grant → logout** — a refresh that fails with `TOKEN_INVALID_GRANT` clears the store
+ *   and surfaces as "no token" (`undefined`); other errors propagate.
+ *
+ * @param config - The manager configuration.
+ * @returns The configured {@link OidcTokenManager}.
+ */ function oidcTokenManager(config) {
+    var _config_storage, _config_now, _config_refreshBufferMs;
+    var storage = (_config_storage = config.storage) !== null && _config_storage !== void 0 ? _config_storage : inMemoryAsyncValueCache();
+    var now = (_config_now = config.now) !== null && _config_now !== void 0 ? _config_now : function() {
+        return Date.now();
+    };
+    var refreshBufferMs = (_config_refreshBufferMs = config.refreshBufferMs) !== null && _config_refreshBufferMs !== void 0 ? _config_refreshBufferMs : DEFAULT_OIDC_TOKEN_REFRESH_BUFFER_MS;
+    var inFlight;
+    function performRefresh(state) {
+        return _async_to_generator(function() {
+            var result, _next_refreshToken, _next_idToken, _next_claims, response, next, merged, e;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        if (!state.refreshToken) return [
+                            3,
+                            8
+                        ];
+                        _state.label = 1;
+                    case 1:
+                        _state.trys.push([
+                            1,
+                            4,
+                            ,
+                            8
+                        ]);
+                        return [
+                            4,
+                            config.refresh({
+                                state: state,
+                                refreshToken: state.refreshToken
+                            })
+                        ];
+                    case 2:
+                        response = _state.sent();
+                        next = oidcTokenStateFromResponse(response, {
+                            now: now()
+                        });
+                        merged = _object_spread_props(_object_spread({}, next), {
+                            refreshToken: (_next_refreshToken = next.refreshToken) !== null && _next_refreshToken !== void 0 ? _next_refreshToken : state.refreshToken,
+                            idToken: (_next_idToken = next.idToken) !== null && _next_idToken !== void 0 ? _next_idToken : state.idToken,
+                            claims: (_next_claims = next.claims) !== null && _next_claims !== void 0 ? _next_claims : state.claims
+                        });
+                        return [
+                            4,
+                            storage.update(merged)
+                        ];
+                    case 3:
+                        _state.sent();
+                        result = merged;
+                        return [
+                            3,
+                            8
+                        ];
+                    case 4:
+                        e = _state.sent();
+                        if (!(_instanceof(e, OidcRelyingPartyError) && e.code === 'TOKEN_INVALID_GRANT')) return [
+                            3,
+                            6
+                        ];
+                        return [
+                            4,
+                            storage.clear()
+                        ];
+                    case 5:
+                        _state.sent();
+                        result = undefined;
+                        return [
+                            3,
+                            7
+                        ];
+                    case 6:
+                        throw e;
+                    case 7:
+                        return [
+                            3,
+                            8
+                        ];
+                    case 8:
+                        return [
+                            2,
+                            result
+                        ];
+                }
+            });
+        })();
+    }
+    function refreshSingleFlight(state) {
+        if (inFlight == null) {
+            // Cache the in-flight refresh so concurrent callers share one network exchange. Cleared on
+            // settle so a failed refresh doesn't permanently block subsequent attempts.
+            inFlight = performRefresh(state).finally(function() {
+                inFlight = undefined;
+            });
+        }
+        return inFlight;
+    }
+    function getValidAccessToken() {
+        return _async_to_generator(function() {
+            var state, result, refreshed;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            storage.load()
+                        ];
+                    case 1:
+                        state = _state.sent();
+                        if (!(state != null)) return [
+                            3,
+                            4
+                        ];
+                        if (!accessTokenNeedsRefresh(state, now(), refreshBufferMs)) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            refreshSingleFlight(state)
+                        ];
+                    case 2:
+                        refreshed = _state.sent();
+                        result = refreshed === null || refreshed === void 0 ? void 0 : refreshed.accessToken;
+                        return [
+                            3,
+                            4
+                        ];
+                    case 3:
+                        result = state.accessToken;
+                        _state.label = 4;
+                    case 4:
+                        return [
+                            2,
+                            result
+                        ];
+                }
+            });
+        })();
+    }
+    function refreshNow() {
+        return _async_to_generator(function() {
+            var state;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            storage.load()
+                        ];
+                    case 1:
+                        state = _state.sent();
+                        return [
+                            2,
+                            state == null ? undefined : refreshSingleFlight(state)
+                        ];
+                }
+            });
+        })();
+    }
+    return {
+        getValidAccessToken: getValidAccessToken,
+        getState: function getState() {
+            return storage.load();
+        },
+        setState: function setState(state) {
+            return storage.update(state);
+        },
+        refreshNow: refreshNow,
+        clear: function clear() {
+            return storage.clear();
+        }
+    };
+}
+// MARK: Internal
+function resolveNowMs(now) {
+    var result;
+    if (now == null) {
+        result = Date.now();
+    } else if (_instanceof(now, Date)) {
+        result = now.getTime();
+    } else {
+        result = now;
+    }
+    return result;
+}
+/**
+ * Decodes the (unverified) payload claims from a JWT such as an `id_token`.
+ *
+ * This does NOT verify the signature — it is purely for surfacing identity claims a relying party
+ * already trusts (the token was just issued to it). Returns `undefined` when the input is missing
+ * or not a decodable JWT.
+ *
+ * @param token - The JWT string.
+ * @returns The decoded claims object, or `undefined`.
+ */ function decodeJwtClaims(token) {
+    var result;
+    if (token) {
+        var parts = token.split('.');
+        if (parts.length >= 2 && parts[1]) {
+            try {
+                result = JSON.parse(decodeBase64UrlToString(parts[1]));
+            } catch (unused) {
+                result = undefined;
+            }
+        }
+    }
+    return result;
+}
+function decodeBase64UrlToString(base64Url) {
+    var base64 = base64Url.replaceAll('-', '+').replaceAll('_', '/');
+    var padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, '=');
+    var binary = atob(padded);
+    var bytes = Uint8Array.from(binary, function(c) {
+        var _c_codePointAt;
+        return (_c_codePointAt = c.codePointAt(0)) !== null && _c_codePointAt !== void 0 ? _c_codePointAt : 0;
+    });
+    return new TextDecoder().decode(bytes);
+}
+
+export { DEFAULT_OIDC_TOKEN_REFRESH_BUFFER_MS, accessTokenNeedsRefresh, decodeJwtClaims, discoverOidcMetadata, exchangeAuthorizationCode, fetchSessionInfo, fetchUserInfo, isAccessTokenExpired, nextRefreshDelay, oidcTokenManager, oidcTokenStateFromResponse, refreshAccessToken, revokeToken };