@dnsid-ai/oidc 0.20.1

package/dist/index.js

@@ -0,0 +1,884 @@
+// src/index.ts
+import * as dnsPromises from "dns/promises";
+import * as net from "net";
+import { createSsrfSafeFetch, isUnsafeIp } from "@dnsid-ai/transport";
+import { decodeJwt, importJWK, compactVerify } from "jose";
+import { requireLocalDomain } from "@dnsid-ai/protocol";
+import {
+  ArgumentError,
+  VerificationCode,
+  VerificationError,
+  SIGNING_ALGS,
+  fromBase64Url,
+  jwkThumbprint,
+  jwkSignatureAlg,
+  normalizeFQDN,
+  toArrayBuffer,
+  toBase64Url,
+  verifyWithKey,
+  parseCompactJose,
+  parseJoseObject,
+  withVerificationBudget,
+  waitForVerification
+} from "@dnsid-ai/protocol";
+var OAuthError = class extends Error {
+  /** The RFC 6749 error code, when the endpoint provided one. */
+  error;
+  /** Human-readable error description, when the endpoint provided one. */
+  errorDescription;
+  constructor(error, errorDescription) {
+    super(errorDescription ? `${error}: ${errorDescription}` : error ?? "OIDC token exchange failed");
+    this.name = "OAuthError";
+    this.error = error;
+    this.errorDescription = errorDescription;
+  }
+};
+function validateOidcTimes(config) {
+  const lifetime = config.assertionLifetime === void 0 ? 300 : config.assertionLifetime;
+  const maximum = config.maxAssertionLifetime === void 0 ? 900 : config.maxAssertionLifetime;
+  const skew = config.clockSkew === void 0 ? 30 : config.clockSkew;
+  if (!Number.isFinite(lifetime) || lifetime <= 0 || !Number.isFinite(maximum) || maximum <= 0 || !Number.isFinite(skew) || skew < 0) throw new ArgumentError("invalid OIDC lifetime or clock skew");
+}
+function validateTokenTimes(claims, skew) {
+  const now = Date.now() / 1e3;
+  const fail = (message) => {
+    throw new VerificationError(message, { code: VerificationCode.RecordInvalid });
+  };
+  if (typeof claims.exp !== "number" || !Number.isFinite(claims.exp)) fail("OIDC token missing exp");
+  if (typeof claims.iat !== "number" || !Number.isFinite(claims.iat)) fail("OIDC token missing iat");
+  if (claims.nbf !== void 0 && (typeof claims.nbf !== "number" || !Number.isFinite(claims.nbf))) fail("OIDC token invalid nbf");
+  if (claims.exp <= claims.iat) fail("OIDC token exp must be after iat");
+  if (now >= claims.exp) fail("OIDC token is expired");
+  if (claims.iat > now + skew || claims.nbf !== void 0 && claims.nbf > now + skew) fail("OIDC token not yet valid");
+}
+var DEFAULT_SCOPE = "openid";
+var DEFAULT_ASSERTION_LIFETIME_SECONDS = 300;
+var DEFAULT_MAX_ASSERTION_LIFETIME_SECONDS = 900;
+var DEFAULT_CLOCK_SKEW_SECONDS = 30;
+var DEFAULT_TOKEN_ALGS = ["RS256"];
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+var MAX_OIDC_JSON_BYTES = 1048576;
+var RESERVED_ASSERTION_CLAIMS = /* @__PURE__ */ new Set(["iss", "sub", "aud", "iat", "exp", "jti", "fqdn"]);
+var OIDCTokenMinter = class {
+  domain;
+  keyProvider;
+  fetch;
+  defaultEndpointOptions;
+  defaultScope;
+  assertionLifetime;
+  maxAssertionLifetime;
+  timeoutMs;
+  allowHttpLoopbackIssuer;
+  /**
+   * @throws ArgumentError if domain is not a valid agent FQDN, the endpoint
+   *   options mix modes (see {@link OIDCTokenEndpointOptions}), or timeoutMs
+   *   is not a positive number.
+   */
+  constructor(opts) {
+    try {
+      this.domain = normalizeFQDN(opts.domain, true);
+    } catch (e) {
+      throw new ArgumentError(`domain is not a valid agent FQDN: ${e.message}`);
+    }
+    this.keyProvider = opts.keyProvider;
+    this.fetch = opts.fetch ?? createSsrfSafeFetch();
+    this.defaultEndpointOptions = validateEndpointMode({
+      issuer: opts.issuer,
+      serverUrl: opts.serverUrl,
+      discoveryUrl: opts.discoveryUrl,
+      tokenEndpoint: opts.tokenEndpoint
+    });
+    this.defaultScope = opts.defaultScope;
+    validateOidcTimes(opts);
+    this.assertionLifetime = opts.assertionLifetime;
+    this.maxAssertionLifetime = opts.maxAssertionLifetime;
+    this.timeoutMs = validateTimeoutMs(opts.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS);
+    this.allowHttpLoopbackIssuer = opts.allowHttpLoopbackIssuer ?? false;
+  }
+  /**
+   * Mints a signed JWT bearer client assertion for the given issuer
+   * (iss/sub/fqdn = agent domain, aud = issuer, fresh jti).
+   *
+   * @throws ArgumentError if the issuer URL is invalid, the expiry is not
+   *   positive or exceeds the maximum lifetime, or additionalClaims override
+   *   a reserved claim.
+   * @throws ValidationError if the operational signing key is unsupported for JWS.
+   * @throws VerificationError (SignatureInvalid) if the produced signature does
+   *   not verify against the active operational key.
+   */
+  async createAssertion(opts) {
+    return createOIDCAssertionJWT(this.domain, this.keyProvider, opts, {
+      assertionLifetime: this.assertionLifetime,
+      maxAssertionLifetime: this.maxAssertionLifetime,
+      allowHttpLoopbackIssuer: this.allowHttpLoopbackIssuer
+    });
+  }
+  /**
+   * Resolves the token endpoint (per the configured or per-call endpoint mode),
+   * mints a fresh assertion, and performs the JWT bearer token exchange.
+   *
+   * @returns The normalized token response.
+   * @throws ArgumentError if audience is missing or the options are inconsistent.
+   * @throws VerificationError if discovery or transport fails, the target
+   *   resolves to an unsafe address, or the response is malformed.
+   * @throws OAuthError if the token endpoint returns an OAuth error response.
+   */
+  async mintToken(opts) {
+    if (!opts.audience) throw new ArgumentError("audience is required");
+    const endpoint = await resolveOIDCTokenEndpoint(this.fetch, endpointOptionsForCall(this.defaultEndpointOptions, opts), {
+      allowHttpLoopbackIssuer: this.allowHttpLoopbackIssuer,
+      timeoutMs: this.timeoutMs
+    });
+    const assertion = await this.createAssertion({
+      issuer: endpoint.issuer,
+      additionalClaims: opts.additionalAssertionClaims
+    });
+    return exchangeOIDCTokenAt(this.fetch, {
+      issuer: endpoint.issuer,
+      tokenEndpoint: endpoint.tokenEndpoint,
+      assertion,
+      audience: opts.audience,
+      scope: resolveScope(opts.scope, opts.scopes, this.defaultScope),
+      allowHttpLoopbackIssuer: this.allowHttpLoopbackIssuer,
+      timeoutMs: this.timeoutMs
+    });
+  }
+};
+async function createOIDCTokenMinter(opts) {
+  return new OIDCTokenMinter({
+    ...opts,
+    keyProvider: await resolveOIDCKeyProvider(opts)
+  });
+}
+async function mintOIDCToken(opts) {
+  const minter = await createOIDCTokenMinter(opts);
+  return minter.mintToken(opts);
+}
+async function createOIDCKeyProviderFromJWK(privateJwk) {
+  return PrivateJWKKeyProvider.fromJWK(privateJwk);
+}
+var OIDCProfile = class _OIDCProfile {
+  /** Builds a profile sharing an identity manager's domain, operational key provider, and identity resolver. */
+  static fromIdentityManager(identityManager, oidc) {
+    return new _OIDCProfile({
+      domain: requireLocalDomain(identityManager),
+      keyProvider: identityManager.getKeyProvider(),
+      identityResolver: identityManager,
+      oidc
+    });
+  }
+  domain;
+  keyProvider;
+  identityResolver;
+  fetch;
+  config;
+  /** @throws ArgumentError if domain is not a valid agent FQDN. */
+  constructor(opts) {
+    try {
+      this.domain = normalizeFQDN(opts.domain, true);
+    } catch (e) {
+      throw new ArgumentError(`domain is not a valid agent FQDN: ${e.message}`);
+    }
+    this.keyProvider = opts.keyProvider ?? null;
+    this.identityResolver = opts.identityResolver;
+    this.fetch = opts.fetch ?? createSsrfSafeFetch();
+    this.config = Object.freeze({ ...opts.oidc });
+    validateOidcTimes(this.config);
+  }
+  /**
+   * Mints a signed JWT bearer client assertion for the given issuer
+   * (iss/sub/fqdn = agent domain, aud = issuer, fresh jti).
+   *
+   * @throws ArgumentError if the issuer URL is invalid, the expiry is not
+   *   positive or exceeds the maximum lifetime, or additionalClaims override
+   *   a reserved claim.
+   * @throws ValidationError if the operational signing key is unsupported for JWS.
+   * @throws VerificationError (SignatureInvalid) if the produced signature does
+   *   not verify against the active operational key.
+   */
+  async createOIDCAssertion(opts) {
+    if (!this.keyProvider) throw new ArgumentError("OIDC assertion signing requires a keyProvider");
+    return createOIDCAssertionJWT(this.domain, this.keyProvider, opts, {
+      assertionLifetime: this.config.assertionLifetime,
+      maxAssertionLifetime: this.config.maxAssertionLifetime,
+      allowHttpLoopbackIssuer: this.config.allowHttpLoopbackIssuer
+    });
+  }
+  /**
+   * Fetches and validates the issuer's discovery document. The document's
+   * issuer must match exactly, and token_endpoint/jwks_uri must share the
+   * issuer's origin.
+   *
+   * @throws ArgumentError if the issuer is not an exact HTTPS URL.
+   * @throws VerificationError if the fetch fails, redirects, or the document is invalid.
+   */
+  async discoverOIDCIssuer(issuer, options = {}) {
+    return withVerificationBudget((signal) => discoverExplicitOIDCIssuer(this.fetch, issuer, void 0, {
+      allowHttpLoopbackIssuer: this.config.allowHttpLoopbackIssuer,
+      timeoutMs: this.config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS,
+      signal
+    }), options);
+  }
+  /**
+   * Discovers the issuer and performs the RFC 7523 JWT bearer exchange. When
+   * `assertion` is supplied it is presented as-is (its aud must exactly match
+   * the discovered issuer); otherwise a fresh assertion is minted.
+   *
+   * @returns The normalized token response.
+   * @throws ArgumentError if audience is missing or a supplied assertion is
+   *   not a valid JWT addressed to the issuer.
+   * @throws VerificationError if discovery or transport fails, or the response is malformed.
+   * @throws OAuthError if the token endpoint returns an OAuth error response.
+   */
+  async exchangeOIDCToken(opts) {
+    if (!opts.assertion && !this.keyProvider) {
+      throw new ArgumentError("OIDC assertion signing requires a keyProvider");
+    }
+    if (!opts.audience) throw new ArgumentError("audience is required");
+    const doc = await this.discoverOIDCIssuer(opts.issuer);
+    const assertion = opts.assertion ?? await this.createOIDCAssertion({ issuer: doc.issuer });
+    if (opts.assertion) {
+      let assertionClaims;
+      try {
+        assertionClaims = decodeJwt(opts.assertion);
+      } catch {
+        throw new ArgumentError("OIDC assertion must be a valid JWT");
+      }
+      if (!audienceExactlyMatches(assertionClaims.aud, doc.issuer)) {
+        throw new ArgumentError("OIDC assertion audience must exactly match issuer");
+      }
+    }
+    return exchangeOIDCTokenAt(this.fetch, {
+      issuer: doc.issuer,
+      tokenEndpoint: doc.token_endpoint,
+      assertion,
+      audience: opts.audience,
+      scope: resolveScope(opts.scope, void 0, this.config.defaultScope),
+      allowHttpLoopbackIssuer: this.config.allowHttpLoopbackIssuer,
+      timeoutMs: this.config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS
+    });
+  }
+  /** Like {@link OIDCProfile.exchangeOIDCToken} but always mints a fresh assertion, ignoring any supplied one. */
+  getOIDCToken(opts) {
+    const { assertion: _assertion, ...fresh } = opts;
+    return this.exchangeOIDCToken(fresh);
+  }
+  /**
+   * Verifies an OIDC token end-to-end: issuer allow-list, exact audience
+   * match, header and claim hygiene, signature against the issuer's published
+   * JWKS (restricted to allowedTokenAlgorithms), and timestamp checks with the
+   * configured clock skew. Unless `verifyDnsidSubject` is false, the token
+   * subject is then verified as a DNSid identity record via the profile's
+   * identityResolver.
+   *
+   * @returns The verified subject, claims, and (unless skipped) the DNSid
+   *   verification result for the subject domain.
+   * @throws ArgumentError if the issuer URL is invalid or audience is missing.
+   * @throws VerificationError with a VerificationCode (RecordInvalid,
+   *   SignatureInvalid, or TLSError) identifying the first check that failed —
+   *   including when the issuer is not in allowedIssuers, or when subject
+   *   verification is requested without an identityResolver.
+   */
+  async verifyOIDCToken(token, opts) {
+    return withVerificationBudget((signal) => this.verifyTokenWithinBudget(token, { ...opts, signal }), opts);
+  }
+  async verifyTokenWithinBudget(token, opts) {
+    const issuer = validateExactOIDCIssuer(opts.issuer, this.config.allowHttpLoopbackIssuer);
+    if (!(this.config.allowedIssuers ?? []).includes(issuer)) {
+      throw new VerificationError("OIDC issuer is not allowed", { code: VerificationCode.RecordInvalid });
+    }
+    if (typeof opts.audience !== "string" || !opts.audience) throw new ArgumentError("audience is required");
+    let header;
+    let claims;
+    try {
+      const compact = parseCompactJose(token);
+      header = compact.header;
+      claims = parseJoseObject(compact.payload);
+    } catch {
+      throw new VerificationError("malformed JWT", { code: VerificationCode.RecordInvalid });
+    }
+    if (claims.iss !== issuer) throw new VerificationError("OIDC issuer mismatch", { code: VerificationCode.RecordInvalid });
+    if (Object.keys(header).some((k) => !["alg", "kid", "typ"].includes(k))) {
+      throw new VerificationError("unsupported OIDC token header", { code: VerificationCode.RecordInvalid });
+    }
+    if (!audienceExactlyMatches(claims.aud, opts.audience)) {
+      throw new VerificationError("OIDC audience mismatch", { code: VerificationCode.RecordInvalid });
+    }
+    const allowedAlgs = validateAllowedTokenAlgorithms(this.config.allowedTokenAlgorithms ?? DEFAULT_TOKEN_ALGS);
+    if (!allowedAlgs.includes(header.alg)) throw new VerificationError("OIDC token algorithm is not allowed", { code: VerificationCode.SignatureInvalid });
+    validateTokenTimes(claims, this.config.clockSkew ?? DEFAULT_CLOCK_SKEW_SECONDS);
+    const doc = await this.discoverOIDCIssuer(issuer, { signal: opts.signal });
+    const jwksResponse = await fetchOIDC(this.fetch, doc.jwks_uri, { redirect: "manual" }, {
+      signal: opts.signal,
+      allowHttpLoopbackIssuer: this.config.allowHttpLoopbackIssuer,
+      timeoutMs: this.config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS
+    });
+    if (jwksResponse.status !== 200) throw new VerificationError("OIDC JWKS fetch failed", { code: VerificationCode.TLSError });
+    const jwks = requireRecord(await waitForVerification(() => readLimitedJson(jwksResponse), opts.signal), "OIDC JWKS must be a JSON object");
+    if (!Array.isArray(jwks.keys)) {
+      throw new VerificationError("OIDC JWKS keys must be an array", { code: VerificationCode.RecordInvalid });
+    }
+    if (typeof header.alg !== "string") {
+      throw new VerificationError("OIDC token missing signing algorithm", { code: VerificationCode.SignatureInvalid });
+    }
+    if (!allowedAlgs.includes(header.alg)) {
+      throw new VerificationError(`OIDC token algorithm is not allowed: ${header.alg}`, { code: VerificationCode.SignatureInvalid });
+    }
+    const signingKey = jwks.keys.find((k) => typeof k === "object" && k !== null && k.kid === header.kid);
+    if (!signingKey || !oidcKeySupportsAlg(signingKey, header.alg)) {
+      throw new VerificationError("OIDC signing key mismatch", { code: VerificationCode.SignatureInvalid });
+    }
+    const clockSkew = this.config.clockSkew ?? DEFAULT_CLOCK_SKEW_SECONDS;
+    validateTokenTimes(claims, clockSkew);
+    let verifiedClaims;
+    try {
+      await compactVerify(token, await importJWK(signingKey, header.alg), { algorithms: allowedAlgs });
+      verifiedClaims = claims;
+    } catch (e) {
+      throw new VerificationError(`OIDC token verification failed: ${e.message}`, { code: VerificationCode.SignatureInvalid });
+    }
+    if (typeof verifiedClaims.sub !== "string" || !verifiedClaims.sub) {
+      throw new VerificationError("OIDC token missing sub", { code: VerificationCode.RecordInvalid });
+    }
+    if (opts.verifyDnsidSubject !== false && !this.identityResolver) {
+      throw new VerificationError("OIDC token subject verification requires an identityResolver", { code: VerificationCode.RecordInvalid });
+    }
+    const verifiedDomain = opts.verifyDnsidSubject === false ? void 0 : await waitForVerification(() => this.identityResolver.verifyDomain(verifiedClaims.sub, opts.peerCert, { signal: opts.signal }), opts.signal);
+    validateTokenTimes(verifiedClaims, clockSkew);
+    return { issuer, subject: verifiedClaims.sub, audience: opts.audience, verifiedDomain, claims: verifiedClaims };
+  }
+};
+function createOIDCProfile(opts) {
+  return new OIDCProfile(opts);
+}
+async function resolveOIDCKeyProvider(opts) {
+  if (opts.keyProvider && opts.privateJwk) {
+    throw new ArgumentError("provide either keyProvider or privateJwk, not both");
+  }
+  if (opts.keyProvider) return opts.keyProvider;
+  if (opts.privateJwk) return createOIDCKeyProviderFromJWK(opts.privateJwk);
+  throw new ArgumentError("keyProvider or privateJwk is required");
+}
+var PrivateJWKKeyProvider = class _PrivateJWKKeyProvider {
+  constructor(publicJwk, privateKey) {
+    this.publicJwk = publicJwk;
+    this.privateKey = privateKey;
+  }
+  publicJwk;
+  privateKey;
+  static async fromJWK(privateJwk) {
+    if (!privateJwk || typeof privateJwk !== "object" || typeof privateJwk.d !== "string" || privateJwk.d === "") {
+      throw new ArgumentError("privateJwk must be a private JWK with a d member");
+    }
+    const publicJwk = publicJwkFromPrivateJWK(privateJwk);
+    if (!publicJwk.kid) publicJwk.kid = await jwkThumbprint(publicJwk);
+    if (!publicJwk.alg) publicJwk.alg = jwkSignatureAlg(publicJwk);
+    if (!publicJwk.use) publicJwk.use = "sig";
+    const alg = jwkSignatureAlg(publicJwk);
+    const privateKey = await crypto.subtle.importKey(
+      "jwk",
+      privateJwk,
+      importAlgorithmForSigningAlg(alg, publicJwk),
+      false,
+      ["sign"]
+    );
+    return new _PrivateJWKKeyProvider(publicJwk, privateKey);
+  }
+  async signingKey() {
+    return { ...this.publicJwk };
+  }
+  async jwk(kid) {
+    if (kid !== this.publicJwk.kid) throw new ArgumentError(`key not found: ${kid}`);
+    return this.signingKey();
+  }
+  async listKeyIds() {
+    return [this.publicJwk.kid];
+  }
+  async sign(payload) {
+    const sig = await crypto.subtle.sign(
+      signAlgorithmForSigningAlg(jwkSignatureAlg(this.publicJwk)),
+      this.privateKey,
+      toArrayBuffer(payload)
+    );
+    return new Uint8Array(sig);
+  }
+  async signKey(kid, payload) {
+    if (kid !== this.publicJwk.kid) throw new ArgumentError(`key not found: ${kid}`);
+    return this.sign(payload);
+  }
+  async generateKey() {
+    throw new ArgumentError("private JWK key provider does not support key generation");
+  }
+  async activate(_kid) {
+    throw new ArgumentError("private JWK key provider does not support key activation");
+  }
+  async supersede(_kid) {
+    throw new ArgumentError("private JWK key provider does not support key purging");
+  }
+  /** @deprecated Use supersede(). */
+  async purge(kid) {
+    await this.supersede(kid);
+  }
+};
+function publicJwkFromPrivateJWK(privateJwk) {
+  const publicJwk = { kty: privateJwk.kty, kid: privateJwk.kid ?? "" };
+  copyStringMember(privateJwk, publicJwk, "alg");
+  copyStringMember(privateJwk, publicJwk, "use");
+  copyStringMember(privateJwk, publicJwk, "crv");
+  copyStringMember(privateJwk, publicJwk, "x");
+  copyStringMember(privateJwk, publicJwk, "y");
+  copyStringMember(privateJwk, publicJwk, "n");
+  copyStringMember(privateJwk, publicJwk, "e");
+  return publicJwk;
+}
+function copyStringMember(source, target, key) {
+  if (typeof source[key] === "string") target[key] = source[key];
+}
+async function createOIDCAssertionJWT(domain, keyProvider, opts, config) {
+  const issuer = validateExactOIDCIssuer(opts.issuer, config.allowHttpLoopbackIssuer);
+  validateOidcTimes(config);
+  const expiry = opts.expiry === void 0 ? config.assertionLifetime ?? DEFAULT_ASSERTION_LIFETIME_SECONDS : opts.expiry;
+  const maxLifetime = config.maxAssertionLifetime ?? DEFAULT_MAX_ASSERTION_LIFETIME_SECONDS;
+  if (!Number.isFinite(expiry) || expiry <= 0) throw new ArgumentError("OIDC assertion expiry must be positive");
+  if (expiry > maxLifetime) throw new ArgumentError("OIDC assertion expiry exceeds maximum lifetime");
+  const now = Math.floor(Date.now() / 1e3);
+  if (now + expiry <= now) throw new ArgumentError("OIDC assertion expiry is below timestamp resolution");
+  const claims = {
+    iss: domain,
+    sub: domain,
+    aud: [issuer],
+    iat: now,
+    exp: now + expiry,
+    jti: crypto.randomUUID(),
+    fqdn: domain
+  };
+  for (const [k, v] of Object.entries(opts.additionalClaims ?? {})) {
+    if (RESERVED_ASSERTION_CLAIMS.has(k)) {
+      throw new ArgumentError(`additionalClaims must not override reserved claim: ${k}`);
+    }
+    claims[k] = v;
+  }
+  const signingKey = await keyProvider.signingKey();
+  const alg = jwkSignatureAlg(signingKey);
+  return signCompact({ alg, kid: signingKey.kid, typ: "JWT" }, claims, keyProvider, signingKey, alg);
+}
+function endpointOptionsForCall(defaults, overrides) {
+  if (overrides.tokenEndpoint !== void 0) {
+    return validateEndpointMode({
+      issuer: overrides.issuer ?? (overrides.serverUrl === void 0 ? defaults.issuer : void 0),
+      serverUrl: overrides.serverUrl,
+      discoveryUrl: overrides.discoveryUrl,
+      tokenEndpoint: overrides.tokenEndpoint
+    });
+  }
+  if (overrides.issuer !== void 0 || overrides.serverUrl !== void 0) {
+    return validateEndpointMode({
+      issuer: overrides.issuer,
+      serverUrl: overrides.serverUrl,
+      discoveryUrl: overrides.discoveryUrl
+    });
+  }
+  return validateEndpointMode({ ...defaults, discoveryUrl: overrides.discoveryUrl ?? defaults.discoveryUrl });
+}
+function validateEndpointMode(opts) {
+  if (opts.tokenEndpoint !== void 0) {
+    if (opts.tokenEndpoint === "") throw new ArgumentError("tokenEndpoint must not be empty");
+    if (opts.issuer === void 0) throw new ArgumentError("issuer is required when tokenEndpoint is configured");
+    if (opts.issuer === "") throw new ArgumentError("issuer must not be empty when tokenEndpoint is configured");
+    if (opts.serverUrl !== void 0 || opts.discoveryUrl !== void 0) {
+      throw new ArgumentError("tokenEndpoint mode supports issuer and tokenEndpoint only");
+    }
+  } else if (opts.issuer !== void 0) {
+    if (opts.issuer === "") throw new ArgumentError("issuer must not be empty");
+    if (opts.serverUrl !== void 0) throw new ArgumentError("provide either issuer or serverUrl, not both");
+  } else if (opts.serverUrl !== void 0) {
+    if (opts.serverUrl === "") throw new ArgumentError("serverUrl must not be empty");
+  } else if (opts.discoveryUrl !== void 0) {
+    throw new ArgumentError("discoveryUrl requires issuer or serverUrl");
+  }
+  return opts;
+}
+async function resolveOIDCTokenEndpoint(fetch, opts, fetchOptions) {
+  if (opts.tokenEndpoint) {
+    if (!opts.issuer) throw new ArgumentError("issuer is required when tokenEndpoint is configured");
+    const issuer = validateOIDCMintIssuerRoot(opts.issuer, fetchOptions.allowHttpLoopbackIssuer);
+    validateSameOriginEndpoint(opts.tokenEndpoint, issuer, "token_endpoint");
+    return { issuer, tokenEndpoint: opts.tokenEndpoint };
+  }
+  if (opts.issuer) {
+    const doc = await discoverMintOIDCIssuer(fetch, opts.issuer, opts.discoveryUrl, fetchOptions);
+    return { issuer: doc.issuer, tokenEndpoint: doc.token_endpoint, discoveryDocument: doc };
+  }
+  if (opts.serverUrl) {
+    const serverUrl = validateBaseUrl(opts.serverUrl, "serverUrl", fetchOptions.allowHttpLoopbackIssuer);
+    const doc = await discoverServerOIDCIssuer(fetch, serverUrl, opts.discoveryUrl, fetchOptions);
+    return { issuer: doc.issuer, tokenEndpoint: `${serverUrl}/token`, discoveryDocument: doc };
+  }
+  throw new ArgumentError("issuer, serverUrl, or tokenEndpoint is required");
+}
+async function discoverExplicitOIDCIssuer(fetch, issuer, discoveryUrl, fetchOptions) {
+  issuer = validateExactOIDCIssuer(issuer, fetchOptions.allowHttpLoopbackIssuer);
+  const doc = await fetchOIDCDiscovery(fetch, discoveryUrl ?? `${issuer}/.well-known/openid-configuration`, fetchOptions);
+  if (doc.issuer !== issuer) throw new VerificationError("OIDC discovery issuer mismatch", { code: VerificationCode.RecordInvalid });
+  validateSameOriginEndpoint(doc.token_endpoint, issuer, "token_endpoint");
+  validateSameOriginEndpoint(doc.jwks_uri, issuer, "jwks_uri");
+  return doc;
+}
+async function discoverMintOIDCIssuer(fetch, issuer, discoveryUrl, fetchOptions) {
+  issuer = validateOIDCMintIssuerRoot(issuer, fetchOptions.allowHttpLoopbackIssuer);
+  const doc = await fetchOIDCDiscovery(fetch, discoveryUrl ?? `${issuer}/.well-known/openid-configuration`, fetchOptions);
+  if (doc.issuer !== issuer) throw new VerificationError("OIDC discovery issuer mismatch", { code: VerificationCode.RecordInvalid });
+  validateSameOriginEndpoint(doc.token_endpoint, issuer, "token_endpoint");
+  return doc;
+}
+async function discoverServerOIDCIssuer(fetch, serverUrl, discoveryUrl, fetchOptions) {
+  const doc = await fetchOIDCDiscovery(fetch, discoveryUrl ?? `${serverUrl}/.well-known/openid-configuration`, fetchOptions);
+  if (typeof doc.issuer !== "string" || doc.issuer === "") {
+    throw new VerificationError("OIDC discovery document missing issuer", { code: VerificationCode.RecordInvalid });
+  }
+  const issuer = validateExactOIDCIssuer(doc.issuer, fetchOptions.allowHttpLoopbackIssuer);
+  return { ...doc, issuer };
+}
+async function fetchOIDCDiscovery(fetch, discoveryUrl, fetchOptions) {
+  validateAbsoluteUrl(discoveryUrl, "discoveryUrl", fetchOptions.allowHttpLoopbackIssuer);
+  const response = await fetchOIDC(fetch, discoveryUrl, { redirect: "manual" }, fetchOptions);
+  if (response.status >= 300 && response.status < 400) throw new VerificationError("OIDC discovery redirects are not allowed", { code: VerificationCode.TLSError });
+  if (response.status !== 200) throw new VerificationError("OIDC discovery failed", { code: VerificationCode.TLSError });
+  const doc = requireRecord(await readLimitedJson(response), "OIDC discovery document must be a JSON object");
+  if (typeof doc.issuer !== "string" || doc.issuer === "") {
+    throw new VerificationError("OIDC discovery document missing issuer", { code: VerificationCode.RecordInvalid });
+  }
+  return doc;
+}
+async function exchangeOIDCTokenAt(fetch, opts) {
+  const form = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    assertion: opts.assertion,
+    audience: opts.audience
+  });
+  if (opts.scope !== void 0) form.set("scope", opts.scope);
+  const response = await fetchOIDC(fetch, opts.tokenEndpoint, {
+    method: "POST",
+    redirect: "manual",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: form
+  }, {
+    allowHttpLoopbackIssuer: opts.allowHttpLoopbackIssuer,
+    timeoutMs: opts.timeoutMs
+  });
+  if (response.status >= 300 && response.status < 400) throw new VerificationError("OIDC token endpoint redirects are not allowed", { code: VerificationCode.TLSError });
+  if (response.status !== 200) {
+    const body = await readLimitedJson(response).catch(() => ({}));
+    if (response.status >= 200 && response.status < 300) {
+      throw new VerificationError(`OIDC token endpoint returned unexpected successful status ${response.status}`, { code: VerificationCode.RecordInvalid });
+    }
+    const raw2 = requireRecord(body, "OIDC token response must be a JSON object");
+    throw new OAuthError(asString(raw2.error), asString(raw2.error_description));
+  }
+  const raw = requireRecord(await readLimitedJson(response), "OIDC token response must be a JSON object");
+  if (typeof raw.access_token !== "string" || !raw.access_token) {
+    throw new VerificationError("OIDC token response missing access_token", { code: VerificationCode.RecordInvalid });
+  }
+  if (typeof raw.token_type !== "string" || raw.token_type.toLowerCase() !== "bearer") {
+    throw new VerificationError("OIDC token response token_type must be Bearer", { code: VerificationCode.RecordInvalid });
+  }
+  return {
+    accessToken: raw.access_token,
+    idToken: asString(raw.id_token),
+    tokenType: raw.token_type,
+    expiresIn: typeof raw.expires_in === "number" ? raw.expires_in : void 0,
+    scope: asString(raw.scope),
+    issuer: opts.issuer,
+    tokenEndpoint: opts.tokenEndpoint,
+    raw
+  };
+}
+function resolveScope(scope, scopes, defaultScope) {
+  if (scope !== void 0 && scopes !== void 0) {
+    throw new ArgumentError("provide either scope or scopes, not both");
+  }
+  const value = scopes !== void 0 ? scopes.join(" ") : scope ?? defaultScope ?? DEFAULT_SCOPE;
+  return value === "" ? void 0 : value;
+}
+function validateExactOIDCIssuer(issuer, allowHttpLoopbackIssuer = false) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new ArgumentError("invalid OIDC issuer URL");
+  }
+  const path = url.pathname === "/" ? "" : url.pathname;
+  if (issuer !== `${url.protocol}//${url.host}${path}` || issuer.endsWith("/")) {
+    throw new ArgumentError("OIDC issuer must be an exact URL without query, fragment, or trailing slash");
+  }
+  if (url.protocol !== "https:" && !(allowHttpLoopbackIssuer && url.protocol === "http:" && isLocalhost(url.hostname))) {
+    throw new ArgumentError("OIDC issuer must use HTTPS");
+  }
+  return issuer;
+}
+function validateOIDCMintIssuerRoot(issuer, allowHttpLoopbackIssuer = false) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new ArgumentError("invalid OIDC issuer URL");
+  }
+  if (issuer !== `${url.protocol}//${url.host}`) {
+    throw new ArgumentError("OIDC issuer must be an exact issuer root with no path, query, fragment, or trailing slash");
+  }
+  const host = unbracketHost(url.hostname).toLowerCase().replace(/\.$/, "");
+  if (host === "api.dnsid.dev" || host === "api.dnsid.ai") {
+    throw new ArgumentError(`API host ${host} is not a valid OIDC issuer`);
+  }
+  if (url.protocol !== "https:" && !(allowHttpLoopbackIssuer && url.protocol === "http:" && isLocalhost(url.hostname))) {
+    throw new ArgumentError("OIDC issuer must use HTTPS");
+  }
+  return issuer;
+}
+function validateBaseUrl(raw, name, allowHttpLoopbackIssuer = false) {
+  const url = validateAbsoluteUrl(raw, name, allowHttpLoopbackIssuer);
+  if (url.search || url.hash) throw new ArgumentError(`${name} must not include query or fragment`);
+  const path = url.pathname === "/" ? "" : url.pathname.replace(/\/+$/, "");
+  return `${url.protocol}//${url.host}${path}`;
+}
+function validateAbsoluteUrl(raw, name, allowHttpLoopbackIssuer = false) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new ArgumentError(`invalid OIDC ${name} URL`);
+  }
+  const loopbackHttp = allowHttpLoopbackIssuer && url.protocol === "http:" && isLocalhost(url.hostname);
+  if (url.protocol !== "https:" && !loopbackHttp) {
+    throw new ArgumentError(`OIDC ${name} must use HTTPS`);
+  }
+  if (url.hash) throw new ArgumentError(`OIDC ${name} must not include a fragment`);
+  return url;
+}
+function validateSameOriginEndpoint(endpoint, issuer, name) {
+  if (typeof endpoint !== "string") throw new VerificationError(`OIDC ${name} is required`, { code: VerificationCode.RecordInvalid });
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    throw new VerificationError(`invalid OIDC ${name}`, { code: VerificationCode.RecordInvalid });
+  }
+  const issuerURL = new URL(issuer);
+  if (url.protocol !== issuerURL.protocol || url.host !== issuerURL.host) {
+    throw new VerificationError(`OIDC ${name} must use the issuer origin`, { code: VerificationCode.RecordInvalid });
+  }
+  if (!url.pathname || url.pathname === "/" || url.search || url.hash) {
+    throw new VerificationError(`invalid OIDC ${name}`, { code: VerificationCode.RecordInvalid });
+  }
+}
+function validateTimeoutMs(timeoutMs) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new ArgumentError("OIDC fetch timeout must be a positive number of milliseconds");
+  }
+  return timeoutMs;
+}
+function isLocalhost(hostname) {
+  const host = unbracketHost(hostname);
+  const family = net.isIP(host);
+  return host === "localhost" || family === 4 && host.split(".")[0] === "127" || family === 6 && host === "::1";
+}
+function audienceExactlyMatches(value, expected) {
+  return value === expected || Array.isArray(value) && value.length === 1 && value[0] === expected;
+}
+function asString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function oidcKeySupportsAlg(key, alg) {
+  if (key.alg !== void 0 && key.alg !== alg) return false;
+  if (key.kty === "RSA") return /^RS(256|384|512)$/.test(alg) || /^PS(256|384|512)$/.test(alg);
+  try {
+    return jwkSignatureAlg({ ...key, alg }) === alg;
+  } catch {
+    return false;
+  }
+}
+function validateAllowedTokenAlgorithms(algs) {
+  for (const alg of algs) {
+    if (!SIGNING_ALGS.has(alg)) {
+      throw new VerificationError(`unsupported OIDC token algorithm: ${alg}`, { code: VerificationCode.SignatureInvalid });
+    }
+  }
+  return algs;
+}
+async function fetchOIDC(fetch, input, init, options = {}) {
+  const url = typeof input === "string" ? new URL(input) : input instanceof URL ? input : new URL(input.url);
+  const timeoutMs = validateTimeoutMs(options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS);
+  const allowHttpLoopbackIssuer = options.allowHttpLoopbackIssuer ?? false;
+  const loopbackHttp = allowHttpLoopbackIssuer && url.protocol === "http:" && isLocalhost(url.hostname);
+  if (url.protocol !== "https:" && !loopbackHttp) {
+    throw new VerificationError("OIDC request target is not allowed", { code: VerificationCode.TLSError });
+  }
+  const signal = options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs);
+  if (!loopbackHttp) await waitForVerification(() => rejectUnsafeOIDCTarget(url.hostname, timeoutMs), signal);
+  try {
+    return await waitForVerification(() => fetch(input, { ...init, signal }), signal);
+  } catch (e) {
+    throw new VerificationError(`OIDC request failed: ${e.message}`, { code: VerificationCode.TLSError });
+  }
+}
+async function rejectUnsafeOIDCTarget(hostname, timeoutMs) {
+  try {
+    const host = unbracketHost(hostname);
+    const literalFamily = net.isIP(host);
+    const addresses = literalFamily ? [{ address: host, family: literalFamily }] : await withTimeout(
+      dnsPromises.lookup(host, { all: true }),
+      timeoutMs,
+      `OIDC issuer DNS lookup timed out after ${timeoutMs}ms`
+    );
+    rejectUnsafeOIDCAddresses(addresses);
+  } catch (e) {
+    if (e instanceof VerificationError) throw e;
+    throw new VerificationError(`OIDC issuer DNS lookup failed: ${e.message}`, { code: VerificationCode.TLSError });
+  }
+}
+async function withTimeout(operation, timeoutMs, message) {
+  let timeout;
+  const timeoutPromise = new Promise((_, reject) => {
+    timeout = setTimeout(() => reject(new VerificationError(message, { code: VerificationCode.TLSError })), timeoutMs);
+    timeout.unref?.();
+  });
+  try {
+    return await Promise.race([operation, timeoutPromise]);
+  } finally {
+    if (timeout) clearTimeout(timeout);
+  }
+}
+function rejectUnsafeOIDCAddresses(addresses) {
+  const unsafe = addresses.find(({ address }) => isUnsafeIp(address));
+  if (unsafe) {
+    throw new VerificationError(`OIDC request target resolves to unsafe IP address: ${unsafe.address}`, { code: VerificationCode.TLSError });
+  }
+}
+function unbracketHost(hostname) {
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function requireRecord(value, message) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new VerificationError(message, { code: VerificationCode.RecordInvalid });
+  }
+  return value;
+}
+async function readLimitedJson(response) {
+  const body = response.body;
+  if (!body) return null;
+  const reader = body.getReader();
+  try {
+    const chunks = [];
+    let size = 0;
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_OIDC_JSON_BYTES) {
+        await reader.cancel();
+        throw new VerificationError("OIDC response exceeds maximum size", { code: VerificationCode.TLSError });
+      }
+      chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    try {
+      return JSON.parse(new TextDecoder().decode(bytes));
+    } catch {
+      throw new VerificationError("OIDC response is not valid JSON", { code: VerificationCode.RecordInvalid });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+async function signCompact(header, payload, keyProvider, signingKey, alg) {
+  const headerB64 = toBase64Url(new TextEncoder().encode(JSON.stringify(header)));
+  const payloadB64 = toBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const sig = await keyProvider.sign(new TextEncoder().encode(signingInput));
+  if (!await verifyWithKey(signingInput, sig, signingKey, alg)) {
+    throw new VerificationError("OIDC assertion signature does not match active signing key", { code: VerificationCode.SignatureInvalid });
+  }
+  return `${signingInput}.${toBase64Url(sig)}`;
+}
+function importAlgorithmForSigningAlg(alg, key) {
+  switch (alg) {
+    case "EdDSA":
+      return { name: "Ed25519" };
+    case "ES256":
+      return { name: "ECDSA", namedCurve: "P-256" };
+    case "ES384":
+      return { name: "ECDSA", namedCurve: "P-384" };
+    case "ES512":
+      return { name: "ECDSA", namedCurve: "P-521" };
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      return { name: "RSASSA-PKCS1-v1_5", hash: rsaHashForAlg(alg) };
+    case "PS256":
+    case "PS384":
+    case "PS512":
+      return { name: "RSA-PSS", hash: rsaHashForAlg(alg) };
+    default:
+      throw new VerificationError(`unsupported JWK signature algorithm: ${key.kid ? `${key.kid} ` : ""}${alg}`, {
+        code: VerificationCode.SignatureInvalid
+      });
+  }
+}
+function signAlgorithmForSigningAlg(alg) {
+  switch (alg) {
+    case "EdDSA":
+      return { name: "Ed25519" };
+    case "ES256":
+      return { name: "ECDSA", hash: "SHA-256" };
+    case "ES384":
+      return { name: "ECDSA", hash: "SHA-384" };
+    case "ES512":
+      return { name: "ECDSA", hash: "SHA-512" };
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      return { name: "RSASSA-PKCS1-v1_5" };
+    case "PS256":
+      return { name: "RSA-PSS", saltLength: 32 };
+    case "PS384":
+      return { name: "RSA-PSS", saltLength: 48 };
+    case "PS512":
+      return { name: "RSA-PSS", saltLength: 64 };
+    default:
+      throw new VerificationError(`unsupported JWK signature algorithm: ${alg}`, { code: VerificationCode.SignatureInvalid });
+  }
+}
+function rsaHashForAlg(alg) {
+  if (alg.endsWith("256")) return "SHA-256";
+  if (alg.endsWith("384")) return "SHA-384";
+  return "SHA-512";
+}
+function decodeOIDCClaims(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) throw new VerificationError("malformed JWT", { code: VerificationCode.RecordInvalid });
+  try {
+    const claims = JSON.parse(new TextDecoder().decode(fromBase64Url(parts[1])));
+    if (typeof claims !== "object" || claims === null || Array.isArray(claims)) {
+      throw new Error("invalid claims");
+    }
+    return claims;
+  } catch {
+    throw new VerificationError("malformed JWT", { code: VerificationCode.RecordInvalid });
+  }
+}
+export {
+  OAuthError,
+  OIDCProfile,
+  OIDCTokenMinter,
+  createOIDCKeyProviderFromJWK,
+  createOIDCProfile,
+  createOIDCTokenMinter,
+  decodeOIDCClaims,
+  mintOIDCToken,
+  validateExactOIDCIssuer
+};