@dotdo/oauth 0.1.4 → 0.1.6

package/dist/dev.d.ts

@@ -28,9 +28,18 @@ export interface DevUser {
 }
 /**
  * Development mode configuration
+ *
+ * @warning SECURITY: devMode should NEVER be enabled in production environments.
+ * It bypasses upstream OAuth providers and uses simple password authentication,
+ * which is insecure for production use. Only use for local development and testing.
  */
 export interface DevModeConfig {
-    /** Enable dev mode (disables upstream OAuth) */
+    /**
+     * Enable dev mode (disables upstream OAuth)
+     *
+     * @warning SECURITY: Never enable in production! This bypasses all upstream
+     * OAuth security and allows simple password-based authentication.
+     */
     enabled: boolean;
     /** Pre-configured test users */
     users?: DevUser[];

package/dist/dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../src/dev.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAuC,MAAM,YAAY,CAAA;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGhD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,cAAc;IACd,EAAE,EAAE,MAAM,CAAA;IACV,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sBAAsB;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAA;IAChB,gCAAgC;IAChC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAA;IACjB,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,6BAA6B;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAEvF;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACxE,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAEF;;OAEG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/C,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;KACrC,CAAC,CAAC,CAAA;IAEH;;OAEG;IACH,uBAAuB,CAAC,MAAM,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,WAAW,EAAE,MAAM,CAAA;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEnB;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;CAC9E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE;IACP,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,GACA,WAAW,CAsHb;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAoKT"}
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../src/dev.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAuC,MAAM,YAAY,CAAA;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGhD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,cAAc;IACd,EAAE,EAAE,MAAM,CAAA;IACV,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,sBAAsB;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,gCAAgC;IAChC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAA;IACjB,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,6BAA6B;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAEvF;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACxE,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAEF;;OAEG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/C,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;KACrC,CAAC,CAAC,CAAA;IAEH;;OAEG;IACH,uBAAuB,CAAC,MAAM,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,WAAW,EAAE,MAAM,CAAA;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEnB;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;CAC9E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE;IACP,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,GACA,WAAW,CAuHb;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAoKT"}

package/dist/dev.js

@@ -18,9 +18,9 @@ export function createTestHelpers(storage, devUsers, options) {
             const user = {
                 id: userData.id,
                 email: userData.email,
-                name: userData.name,
-                organizationId: userData.organizationId,
-                roles: userData.roles,
+                ...(userData.name !== undefined && { name: userData.name }),
+                ...(userData.organizationId !== undefined && { organizationId: userData.organizationId }),
+                ...(userData.roles !== undefined && { roles: userData.roles }),
                 createdAt: Date.now(),
                 updatedAt: Date.now(),
             };
@@ -85,7 +85,7 @@ export function createTestHelpers(storage, devUsers, options) {
                 clientId: params.clientId,
                 userId: params.userId,
                 redirectUri: params.redirectUri,
-                scope: params.scope,
+                ...(params.scope !== undefined && { scope: params.scope }),
                 codeChallenge: params.codeChallenge,
                 codeChallengeMethod: 'S256',
                 issuedAt: Date.now(),
@@ -100,11 +100,12 @@ export function createTestHelpers(storage, devUsers, options) {
             }
             // If allowAnyCredentials is enabled, create a new user
             if (allowAnyCredentials) {
+                const namePart = email.split('@')[0];
                 const newUser = {
                     id: `dev_${generateToken(12)}`,
                     email,
                     password,
-                    name: email.split('@')[0],
+                    ...(namePart && { name: namePart }),
                 };
                 devUsers.set(email.toLowerCase(), newUser);
                 return newUser;

package/dist/dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev.js","sourceRoot":"","sources":["../src/dev.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAmFpE;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,QAA8B,EAC9B,OAKC;IAED,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAA;IAErF,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,QAAQ;YACvB,MAAM,IAAI,GAAc;gBACtB,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAA;YAED,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAE5B,iDAAiD;YACjD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;oBACzC,GAAG,QAAQ;oBACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBACjB,CAAC,CAAA;YACf,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG,sBAAsB;YACnE,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,CAAC,CAAA;YACrC,MAAM,YAAY,GAAG,aAAa,CAAC,EAAE,CAAC,CAAA;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAEtB,MAAM,cAAc,GAAqB;gBACvC,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;gBACnB,MAAM;gBACN,QAAQ;gBACR,KAAK;gBACL,QAAQ,EAAE,GAAG;gBACb,SAAS,EAAE,GAAG,GAAG,cAAc,GAAG,IAAI;aACvC,CAAA;YAED,MAAM,eAAe,GAAsB;gBACzC,KAAK,EAAE,YAAY;gBACnB,MAAM;gBACN,QAAQ;gBACR,KAAK;gBACL,QAAQ,EAAE,GAAG;gBACb,SAAS,EAAE,GAAG,GAAG,eAAe,GAAG,IAAI;aACxC,CAAA;YAED,MAAM,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAA;YAC7C,MAAM,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAA;YAE/C,OAAO;gBACL,WAAW;gBACX,YAAY;gBACZ,SAAS,EAAE,cAAc;aAC1B,CAAA;QACH,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM;YAC5B,mDAAmD;YACnD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YAExE,OAAO;gBACL;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,KAAc;oBACxB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,cAAc;iBAC5C;aACF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,MAAM;YAClC,MAAM,IAAI,GAAG,yBAAyB,EAAE,CAAA;YAExC,MAAM,OAAO,CAAC,qBAAqB,CAAC;gBAClC,IAAI;gBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,mBAAmB,EAAE,MAAM;gBAC3B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI;aAC3C,CAAC,CAAA;YAEF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ;YACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;YAC9C,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAA;YACb,CAAC;YAED,uDAAuD;YACvD,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAY;oBACvB,EAAE,EAAE,OAAO,aAAa,CAAC,EAAE,CAAC,EAAE;oBAC9B,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBAC1B,CAAA;gBACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC1C,OAAO,OAAO,CAAA;YAChB,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OASrC;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IAE1G,OAAO;;;;;qBAKY,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsHhB,MAAM;;;;MAIX,KAAK,CAAC,CAAC,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE;;;8BAGxB,QAAQ;;;;qDAIe,QAAQ;wDACL,WAAW;iDAClB,KAAK,IAAI,EAAE;iDACX,KAAK,IAAI,EAAE;0DACF,aAAa;iEACN,mBAAmB;;;;;;;;;;;;;;;;;;;;;QAqB5E,CAAA;AACR,CAAC"}
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../src/dev.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AA4FpE;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,QAA8B,EAC9B,OAKC;IAED,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAA;IAErF,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,QAAQ;YACvB,MAAM,IAAI,GAAc;gBACtB,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3D,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;gBACzF,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC9D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAA;YAED,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAE5B,iDAAiD;YACjD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;oBACzC,GAAG,QAAQ;oBACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBACjB,CAAC,CAAA;YACf,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG,sBAAsB;YACnE,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,CAAC,CAAA;YACrC,MAAM,YAAY,GAAG,aAAa,CAAC,EAAE,CAAC,CAAA;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAEtB,MAAM,cAAc,GAAqB;gBACvC,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,QAAQ;gBACnB,MAAM;gBACN,QAAQ;gBACR,KAAK;gBACL,QAAQ,EAAE,GAAG;gBACb,SAAS,EAAE,GAAG,GAAG,cAAc,GAAG,IAAI;aACvC,CAAA;YAED,MAAM,eAAe,GAAsB;gBACzC,KAAK,EAAE,YAAY;gBACnB,MAAM;gBACN,QAAQ;gBACR,KAAK;gBACL,QAAQ,EAAE,GAAG;gBACb,SAAS,EAAE,GAAG,GAAG,eAAe,GAAG,IAAI;aACxC,CAAA;YAED,MAAM,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAA;YAC7C,MAAM,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAA;YAE/C,OAAO;gBACL,WAAW;gBACX,YAAY;gBACZ,SAAS,EAAE,cAAc;aAC1B,CAAA;QACH,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM;YAC5B,mDAAmD;YACnD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YAExE,OAAO;gBACL;oBACE,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,KAAc;oBACxB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,cAAc;iBAC5C;aACF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,MAAM;YAClC,MAAM,IAAI,GAAG,yBAAyB,EAAE,CAAA;YAExC,MAAM,OAAO,CAAC,qBAAqB,CAAC;gBAClC,IAAI;gBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC1D,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,mBAAmB,EAAE,MAAM;gBAC3B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI;aAC3C,CAAC,CAAA;YAEF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ;YACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;YAC9C,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAA;YACb,CAAC;YAED,uDAAuD;YACvD,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpC,MAAM,OAAO,GAAY;oBACvB,EAAE,EAAE,OAAO,aAAa,CAAC,EAAE,CAAC,EAAE;oBAC9B,KAAK;oBACL,QAAQ;oBACR,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;iBACpC,CAAA;gBACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAA;gBAC1C,OAAO,OAAO,CAAA;YAChB,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OASrC;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IAE1G,OAAO;;;;;qBAKY,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAsHhB,MAAM;;;;MAIX,KAAK,CAAC,CAAC,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE;;;8BAGxB,QAAQ;;;;qDAIe,QAAQ;wDACL,WAAW;iDAClB,KAAK,IAAI,EAAE;iDACX,KAAK,IAAI,EAAE;0DACF,aAAa;iEACN,mBAAmB;;;;;;;;;;;;;;;;;;;;;QAqB5E,CAAA;AACR,CAAC"}

package/dist/index.d.ts

@@ -46,5 +46,7 @@ export type { DevModeConfig, DevUser, TestHelpers } from './dev.js';
 export { MemoryOAuthStorage } from './storage.js';
 export type { OAuthStorage, ListOptions } from './storage.js';
 export { generateCodeVerifier, generateCodeChallenge, verifyCodeChallenge, generatePkce, generateState, generateToken, generateAuthorizationCode, hashClientSecret, verifyClientSecret, base64UrlEncode, base64UrlDecode, constantTimeEqual, } from './pkce.js';
+export { verifyJWT, decodeJWT, isJWTExpired, clearJWKSCache } from './jwt.js';
+export type { JWTVerifyResult, JWTVerifyOptions, JWTHeader, JWTPayload } from './jwt.js';
 export type { OAuthUser, OAuthOrganization, OAuthClient, OAuthAuthorizationCode, OAuthAccessToken, OAuthRefreshToken, OAuthGrant, OAuthServerMetadata, OAuthResourceMetadata, TokenResponse, OAuthError, UpstreamOAuthConfig, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAGrE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AACnE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAGnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAGlB,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAGrE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AACnE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAGnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAGlB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAGxF,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -47,4 +47,6 @@ export { createTestHelpers, generateLoginFormHtml } from './dev.js';
 export { MemoryOAuthStorage } from './storage.js';
 // PKCE
 export { generateCodeVerifier, generateCodeChallenge, verifyCodeChallenge, generatePkce, generateState, generateToken, generateAuthorizationCode, hashClientSecret, verifyClientSecret, base64UrlEncode, base64UrlDecode, constantTimeEqual, } from './pkce.js';
+// JWT Verification
+export { verifyJWT, decodeJWT, isJWTExpired, clearJWKSCache } from './jwt.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,SAAS;AACT,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAGjD,0BAA0B;AAC1B,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAGnE,UAAU;AACV,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGjD,OAAO;AACP,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,SAAS;AACT,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAGjD,0BAA0B;AAC1B,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAGnE,UAAU;AACV,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGjD,OAAO;AACP,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAElB,mBAAmB;AACnB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA"}

package/dist/jwt.d.ts

@@ -0,0 +1,130 @@
+/**
+ * @dotdo/oauth - JWT Verification
+ *
+ * Server-side JWT token validation with JWKS support.
+ * Validates standard JWT claims (exp, iat, iss, aud) and
+ * fetches public keys from JWKS endpoints.
+ */
+/**
+ * Result of JWT verification - discriminated union based on validity
+ */
+export type JWTVerifyResult = {
+    valid: true;
+    payload: JWTPayload;
+    header: JWTHeader;
+    error?: undefined;
+} | {
+    valid: false;
+    error: string;
+    payload?: undefined;
+    header?: undefined;
+} | {
+    valid: false;
+    error: string;
+    payload: JWTPayload;
+    header: JWTHeader;
+};
+/**
+ * JWT Header
+ */
+export interface JWTHeader {
+    /** Algorithm used for signing */
+    alg: string;
+    /** Token type (typically 'JWT') */
+    typ?: string;
+    /** Key ID for JWKS lookup */
+    kid?: string;
+}
+/**
+ * Standard JWT Payload claims
+ */
+export interface JWTPayload {
+    /** Issuer */
+    iss?: string;
+    /** Subject */
+    sub?: string;
+    /** Audience (can be string or array) */
+    aud?: string | string[];
+    /** Expiration time (Unix timestamp) */
+    exp?: number;
+    /** Not before (Unix timestamp) */
+    nbf?: number;
+    /** Issued at (Unix timestamp) */
+    iat?: number;
+    /** JWT ID */
+    jti?: string;
+    /** Additional claims */
+    [key: string]: unknown;
+}
+/**
+ * Options for JWT verification
+ */
+export interface JWTVerifyOptions {
+    /** JWKS URL for fetching public keys */
+    jwksUrl?: string;
+    /** Expected issuer */
+    issuer?: string;
+    /** Expected audience (can be string or array) */
+    audience?: string | string[];
+    /** Pre-loaded public key (alternative to jwksUrl) */
+    publicKey?: CryptoKey;
+    /** Clock tolerance in seconds for exp/nbf/iat checks (default: 60) */
+    clockTolerance?: number;
+    /** Skip expiration check */
+    ignoreExpiration?: boolean;
+}
+/**
+ * Verify a JWT token
+ *
+ * @param token - The JWT token to verify
+ * @param options - Verification options
+ * @returns Verification result with payload if valid
+ *
+ * @example With JWKS URL
+ * ```typescript
+ * const result = await verifyJWT(token, {
+ *   jwksUrl: 'https://issuer.com/.well-known/jwks.json',
+ *   issuer: 'https://issuer.com',
+ *   audience: 'my-api'
+ * })
+ *
+ * if (result.valid) {
+ *   console.log('User ID:', result.payload?.sub)
+ * } else {
+ *   console.error('Invalid token:', result.error)
+ * }
+ * ```
+ *
+ * @example With pre-loaded public key
+ * ```typescript
+ * const result = await verifyJWT(token, {
+ *   publicKey: await crypto.subtle.importKey(...),
+ *   issuer: 'https://issuer.com'
+ * })
+ * ```
+ */
+export declare function verifyJWT(token: string, options?: JWTVerifyOptions): Promise<JWTVerifyResult>;
+/**
+ * Decode a JWT without verifying the signature
+ * Useful for inspecting tokens before verification
+ *
+ * @param token - The JWT token to decode
+ * @returns Decoded header and payload, or null if invalid format
+ */
+export declare function decodeJWT(token: string): {
+    header: JWTHeader;
+    payload: JWTPayload;
+} | null;
+/**
+ * Check if a JWT is expired (without full verification)
+ *
+ * @param token - The JWT token to check
+ * @param clockTolerance - Tolerance in seconds (default: 0)
+ * @returns true if expired, false if valid or no exp claim
+ */
+export declare function isJWTExpired(token: string, clockTolerance?: number): boolean;
+/**
+ * Clear the JWKS cache (useful for testing)
+ */
+export declare function clearJWKSCache(): void;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1E;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GACxE;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAA;AAE3E;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,cAAc;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wBAAwB;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sBAAsB;IACtB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC5B,qDAAqD;IACrD,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,4BAA4B;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAiH1B;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAc1F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,GAAE,MAAU,GAAG,OAAO,CAQ/E;AA4MD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/jwt.js

@@ -0,0 +1,337 @@
+/**
+ * @dotdo/oauth - JWT Verification
+ *
+ * Server-side JWT token validation with JWKS support.
+ * Validates standard JWT claims (exp, iat, iss, aud) and
+ * fetches public keys from JWKS endpoints.
+ */
+import { base64UrlDecode } from './pkce.js';
+// Cache for JWKS to avoid repeated fetches
+const jwksCache = new Map();
+const JWKS_CACHE_TTL = 5 * 60 * 1000; // 5 minutes
+/**
+ * Verify a JWT token
+ *
+ * @param token - The JWT token to verify
+ * @param options - Verification options
+ * @returns Verification result with payload if valid
+ *
+ * @example With JWKS URL
+ * ```typescript
+ * const result = await verifyJWT(token, {
+ *   jwksUrl: 'https://issuer.com/.well-known/jwks.json',
+ *   issuer: 'https://issuer.com',
+ *   audience: 'my-api'
+ * })
+ *
+ * if (result.valid) {
+ *   console.log('User ID:', result.payload?.sub)
+ * } else {
+ *   console.error('Invalid token:', result.error)
+ * }
+ * ```
+ *
+ * @example With pre-loaded public key
+ * ```typescript
+ * const result = await verifyJWT(token, {
+ *   publicKey: await crypto.subtle.importKey(...),
+ *   issuer: 'https://issuer.com'
+ * })
+ * ```
+ */
+export async function verifyJWT(token, options = {}) {
+    const { jwksUrl, issuer, audience, publicKey, clockTolerance = 60, ignoreExpiration = false } = options;
+    try {
+        // Parse the JWT
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return { valid: false, error: 'Invalid JWT format: expected 3 parts' };
+        }
+        const [headerB64, payloadB64, signatureB64] = parts;
+        // Decode header
+        let header;
+        try {
+            header = JSON.parse(decodeBase64Url(headerB64));
+        }
+        catch {
+            return { valid: false, error: 'Invalid JWT header: failed to decode' };
+        }
+        // Decode payload
+        let payload;
+        try {
+            payload = JSON.parse(decodeBase64Url(payloadB64));
+        }
+        catch {
+            return { valid: false, error: 'Invalid JWT payload: failed to decode' };
+        }
+        // Validate algorithm
+        if (!isSupportedAlgorithm(header.alg)) {
+            return { valid: false, error: `Unsupported algorithm: ${header.alg}`, header, payload };
+        }
+        // Get the public key
+        let key;
+        if (publicKey) {
+            key = publicKey;
+        }
+        else if (jwksUrl) {
+            const fetchedKey = await getKeyFromJWKS(jwksUrl, header.kid, header.alg);
+            if (!fetchedKey) {
+                return { valid: false, error: 'No matching key found in JWKS', header, payload };
+            }
+            key = fetchedKey;
+        }
+        else {
+            return { valid: false, error: 'Either jwksUrl or publicKey must be provided', header, payload };
+        }
+        // Verify signature
+        const signatureValid = await verifySignature(`${headerB64}.${payloadB64}`, signatureB64, key, header.alg);
+        if (!signatureValid) {
+            return { valid: false, error: 'Invalid signature', header, payload };
+        }
+        // Validate claims
+        const now = Math.floor(Date.now() / 1000);
+        // Check expiration
+        if (!ignoreExpiration && payload.exp !== undefined) {
+            if (now > payload.exp + clockTolerance) {
+                return { valid: false, error: 'Token has expired', header, payload };
+            }
+        }
+        // Check not before
+        if (payload.nbf !== undefined) {
+            if (now < payload.nbf - clockTolerance) {
+                return { valid: false, error: 'Token not yet valid (nbf)', header, payload };
+            }
+        }
+        // Check issued at (prevent tokens issued in the future)
+        if (payload.iat !== undefined) {
+            if (payload.iat > now + clockTolerance) {
+                return { valid: false, error: 'Token issued in the future (iat)', header, payload };
+            }
+        }
+        // Check issuer
+        if (issuer !== undefined) {
+            if (payload.iss !== issuer) {
+                return { valid: false, error: `Invalid issuer: expected ${issuer}, got ${payload.iss}`, header, payload };
+            }
+        }
+        // Check audience
+        if (audience !== undefined) {
+            const tokenAud = Array.isArray(payload.aud) ? payload.aud : payload.aud ? [payload.aud] : [];
+            const expectedAud = Array.isArray(audience) ? audience : [audience];
+            const hasValidAudience = expectedAud.some((aud) => tokenAud.includes(aud));
+            if (!hasValidAudience) {
+                return {
+                    valid: false,
+                    error: `Invalid audience: expected one of ${expectedAud.join(', ')}, got ${tokenAud.join(', ')}`,
+                    header,
+                    payload,
+                };
+            }
+        }
+        return { valid: true, payload, header };
+    }
+    catch (err) {
+        return {
+            valid: false,
+            error: err instanceof Error ? err.message : 'Unknown error during verification',
+        };
+    }
+}
+/**
+ * Decode a JWT without verifying the signature
+ * Useful for inspecting tokens before verification
+ *
+ * @param token - The JWT token to decode
+ * @returns Decoded header and payload, or null if invalid format
+ */
+export function decodeJWT(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return null;
+        }
+        const header = JSON.parse(decodeBase64Url(parts[0]));
+        const payload = JSON.parse(decodeBase64Url(parts[1]));
+        return { header, payload };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check if a JWT is expired (without full verification)
+ *
+ * @param token - The JWT token to check
+ * @param clockTolerance - Tolerance in seconds (default: 0)
+ * @returns true if expired, false if valid or no exp claim
+ */
+export function isJWTExpired(token, clockTolerance = 0) {
+    const decoded = decodeJWT(token);
+    if (!decoded || decoded.payload.exp === undefined) {
+        return false;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    return now > decoded.payload.exp + clockTolerance;
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// Internal Helper Functions
+// ═══════════════════════════════════════════════════════════════════════════
+/**
+ * Decode a base64url-encoded string to a regular string
+ */
+function decodeBase64Url(str) {
+    const buffer = base64UrlDecode(str);
+    return new TextDecoder().decode(buffer);
+}
+/**
+ * Check if an algorithm is supported
+ */
+function isSupportedAlgorithm(alg) {
+    return ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'].includes(alg);
+}
+/**
+ * Get algorithm parameters for Web Crypto API
+ */
+function getAlgorithmParams(alg) {
+    switch (alg) {
+        case 'RS256':
+            return { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' };
+        case 'RS384':
+            return { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-384' };
+        case 'RS512':
+            return { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-512' };
+        case 'ES256':
+            return { name: 'ECDSA', hash: 'SHA-256', namedCurve: 'P-256' };
+        case 'ES384':
+            return { name: 'ECDSA', hash: 'SHA-384', namedCurve: 'P-384' };
+        case 'ES512':
+            return { name: 'ECDSA', hash: 'SHA-512', namedCurve: 'P-521' };
+        default:
+            throw new Error(`Unsupported algorithm: ${alg}`);
+    }
+}
+/**
+ * Verify JWT signature
+ */
+async function verifySignature(data, signature, key, alg) {
+    const encoder = new TextEncoder();
+    const dataBytes = encoder.encode(data);
+    let signatureBytes = new Uint8Array(base64UrlDecode(signature));
+    const params = getAlgorithmParams(alg);
+    // For ECDSA, the signature needs to be in the correct format
+    if (params.name === 'ECDSA') {
+        signatureBytes = convertJWTSignatureToWebCrypto(signatureBytes, alg);
+    }
+    const algorithm = params.name === 'ECDSA' ? { name: 'ECDSA', hash: params.hash } : { name: params.name };
+    return crypto.subtle.verify(algorithm, key, signatureBytes, dataBytes);
+}
+/**
+ * Convert JWT ECDSA signature (r||s concatenation) to WebCrypto format
+ * JWT uses IEEE P1363 format, WebCrypto uses the same for ECDSA
+ */
+function convertJWTSignatureToWebCrypto(signature, alg) {
+    // JWT signatures for ECDSA are already in the r||s format that WebCrypto expects
+    // Just need to verify the length is correct
+    const expectedLength = alg === 'ES256' ? 64 : alg === 'ES384' ? 96 : 132;
+    if (signature.length !== expectedLength) {
+        // If signature is DER encoded, we might need to convert it
+        // For now, return as-is and let verification fail if format is wrong
+    }
+    return signature;
+}
+/**
+ * Fetch and cache JWKS from a URL
+ */
+async function getKeyFromJWKS(jwksUrl, kid, alg) {
+    // Check cache
+    const cached = jwksCache.get(jwksUrl);
+    if (cached && cached.expiresAt > Date.now()) {
+        if (kid && cached.keys.has(kid)) {
+            return cached.keys.get(kid);
+        }
+        // If no kid specified, try to find a key by algorithm
+        if (!kid) {
+            for (const key of cached.keys.values()) {
+                return key; // Return first available key
+            }
+        }
+    }
+    // Fetch JWKS
+    const response = await fetch(jwksUrl);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch JWKS: ${response.status} ${response.statusText}`);
+    }
+    const jwks = await response.json();
+    const keys = new Map();
+    for (const jwk of jwks.keys) {
+        try {
+            const cryptoKey = await importJWK(jwk, alg);
+            if (cryptoKey) {
+                const keyId = jwk.kid || `${jwk.kty}-${jwk.alg || alg}`;
+                keys.set(keyId, cryptoKey);
+            }
+        }
+        catch {
+            // Skip keys that fail to import
+            continue;
+        }
+    }
+    // Cache the keys
+    jwksCache.set(jwksUrl, {
+        keys,
+        expiresAt: Date.now() + JWKS_CACHE_TTL,
+    });
+    // Find the right key
+    if (kid && keys.has(kid)) {
+        return keys.get(kid);
+    }
+    // If no kid, return first compatible key
+    if (!kid && keys.size > 0) {
+        return keys.values().next().value ?? null;
+    }
+    return null;
+}
+/**
+ * Import a JWK as a CryptoKey
+ */
+async function importJWK(jwk, expectedAlg) {
+    const params = getAlgorithmParams(expectedAlg);
+    if (jwk.kty === 'RSA' && params.name.startsWith('RSA')) {
+        if (!jwk.n || !jwk.e) {
+            return null;
+        }
+        return crypto.subtle.importKey('jwk', {
+            kty: 'RSA',
+            n: jwk.n,
+            e: jwk.e,
+            alg: expectedAlg,
+            use: 'sig',
+        }, {
+            name: params.name,
+            hash: params.hash,
+        }, false, ['verify']);
+    }
+    if (jwk.kty === 'EC' && params.name === 'ECDSA') {
+        if (!jwk.x || !jwk.y || !jwk.crv) {
+            return null;
+        }
+        return crypto.subtle.importKey('jwk', {
+            kty: 'EC',
+            x: jwk.x,
+            y: jwk.y,
+            crv: jwk.crv,
+            use: 'sig',
+        }, {
+            name: 'ECDSA',
+            namedCurve: jwk.crv,
+        }, false, ['verify']);
+    }
+    return null;
+}
+/**
+ * Clear the JWKS cache (useful for testing)
+ */
+export function clearJWKSCache() {
+    jwksCache.clear();
+}
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAoF3C,2CAA2C;AAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+D,CAAA;AACxF,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,YAAY;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,UAA4B,EAAE;IAE9B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,GAAG,EAAE,EAAE,gBAAgB,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IAEvG,IAAI,CAAC;QACH,gBAAgB;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAA;QACxE,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAA;QAEnD,gBAAgB;QAChB,IAAI,MAAiB,CAAA;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAU,CAAC,CAAC,CAAA;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAA;QACxE,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAmB,CAAA;QACvB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAW,CAAC,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAA;QACzE,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;QACzF,CAAC;QAED,qBAAqB;QACrB,IAAI,GAAc,CAAA;QAClB,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,GAAG,SAAS,CAAA;QACjB,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;YACxE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;YAClF,CAAC;YACD,GAAG,GAAG,UAAU,CAAA;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;QACjG,CAAC;QAED,mBAAmB;QACnB,MAAM,cAAc,GAAG,MAAM,eAAe,CAC1C,GAAG,SAAS,IAAI,UAAU,EAAE,EAC5B,YAAa,EACb,GAAG,EACH,MAAM,CAAC,GAAG,CACX,CAAA;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;QACtE,CAAC;QAED,kBAAkB;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAEzC,mBAAmB;QACnB,IAAI,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,cAAc,EAAE,CAAC;gBACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;YACtE,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,cAAc,EAAE,CAAC;gBACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;YAC9E,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,cAAc,EAAE,CAAC;gBACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;YACrF,CAAC;QACH,CAAC;QAED,eAAe;QACf,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,MAAM,SAAS,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;YAC3G,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC5F,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;YAEnE,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1E,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,qCAAqC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChG,MAAM;oBACN,OAAO;iBACR,CAAA;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC;SAChF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAc,CAAA;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAe,CAAA;QAEpE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,iBAAyB,CAAC;IACpE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,OAAO,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,cAAc,CAAA;AACnD,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACzC,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAC7E,CAAC;AASD;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QACvD,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QACvD,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QACvD,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;QAChE,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;QAChE,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;QAChE;YACE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,SAAiB,EACjB,GAAc,EACd,GAAW;IAEX,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,cAAc,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAA;IAE/D,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IAEtC,6DAA6D;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,cAAc,GAAG,8BAA8B,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IAExG,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,CAAA;AACxE,CAAC;AAED;;;GAGG;AACH,SAAS,8BAA8B,CAAC,SAAkC,EAAE,GAAW;IACrF,iFAAiF;IACjF,4CAA4C;IAC5C,MAAM,cAAc,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACxE,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACxC,2DAA2D;QAC3D,qEAAqE;IACvE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,GAAuB,EAAE,GAAW;IACjF,cAAc;IACd,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;QAC9B,CAAC;QACD,sDAAsD;QACtD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvC,OAAO,GAAG,CAAA,CAAC,6BAA6B;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,IAAI,GAAS,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAA;IAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC3C,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAA;gBACvD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;YAChC,SAAQ;QACV,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE;QACrB,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;KACvC,CAAC,CAAA;IAEF,qBAAqB;IACrB,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;IACvB,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,IAAI,CAAA;IAC3C,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,WAAmB;IACpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAE9C,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL;YACE,GAAG,EAAE,KAAK;YACV,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,GAAG,EAAE,WAAW;YAChB,GAAG,EAAE,KAAK;SACX,EACD;YACE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAK;SACnB,EACD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL;YACE,GAAG,EAAE,IAAI;YACT,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,KAAK;SACX,EACD;YACE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,GAAG,CAAC,GAAG;SACpB,EACD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,SAAS,CAAC,KAAK,EAAE,CAAA;AACnB,CAAC"}

package/dist/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAehE;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK7E;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAIxG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAU3D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAWxD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAW/D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAWzD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAWzD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKtE;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvF"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAoBhE;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK7E;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAIxG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAU3D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAWxD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAW/D;AA6BD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKtE;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvF"}