@elixpo/accounts 1.0.1

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## 1.0.1
+
+- Add typed OAuth/OIDC discovery.
+- Add S256 PKCE, state, nonce, and authorization callback helpers.
+- Add authorization-code exchange, refresh rotation, and revocation.
+- Add EdDSA JWKS-based access and ID token verification.
+- Add sanitized typed errors for protocol, OAuth, network, and verification failures.

package/README.md

@@ -0,0 +1,65 @@
+# `@elixpo/accounts`
+
+Edge-safe OAuth 2.0 and OpenID Connect primitives for Elixpo Accounts.
+
+The canonical SDK contract and release policy live in the
+[integration reference](https://github.com/elixpo/accounts.elixpo/blob/main/docs/README.md).
+
+Next.js and React adapters are tracked separately and are not exported yet.
+
+## Install
+
+```bash
+npm install @elixpo/accounts
+```
+
+## Start authorization
+
+```ts
+import { createAccountsClient } from "@elixpo/accounts";
+
+const accounts = createAccountsClient({
+    issuer: "https://accounts.elixpo.com",
+    clientId: process.env.ELIXPO_CLIENT_ID!,
+    redirectUri: "https://example.com/auth/callback",
+    audience: "example.com",
+});
+
+const { url, transaction } = await accounts.createAuthorizationRequest();
+// Store transaction in an encrypted, httpOnly, same-site session, then redirect.
+```
+
+## Complete authorization
+
+```ts
+import { parseAuthorizationCallback } from "@elixpo/accounts";
+
+const { code } = parseAuthorizationCallback(
+    request.url,
+    transaction.state,
+);
+const tokens = await accounts.exchangeAuthorizationCode({
+    code,
+    codeVerifier: transaction.codeVerifier,
+});
+await accounts.verifyIdToken(tokens.idToken!, transaction.nonce);
+```
+
+## Refresh and revoke
+
+```ts
+const rotated = await accounts.refresh(tokens.refreshToken);
+// Atomically replace the stored token with rotated.refreshToken.
+await accounts.revoke(rotated.refreshToken);
+```
+
+## Configuration boundaries
+
+- Browser-safe: issuer, client ID, redirect URI, audience.
+- Server-only: confidential client secret, refresh tokens, authorization
+  transactions, and all returned tokens.
+- Hosted Elixpo pages collect passwords, OTPs, passkeys, and MFA responses.
+  Third-party applications must not collect Elixpo credentials.
+
+The SDK is optional. Generic OAuth/OIDC clients can use
+`/.well-known/oauth-authorization-server` and `/.well-known/openid-configuration`.

package/dist/core/authorization.d.ts

@@ -0,0 +1,12 @@
+import type { AccountsConfiguration, AuthorizationServerMetadata, AuthorizationTransaction } from "./types.js";
+export declare function parseAuthorizationCallback(callbackUrl: string | URL, expectedState: string): {
+    code: string;
+};
+export declare function createAuthorizationRequest(metadata: AuthorizationServerMetadata, configuration: Pick<AccountsConfiguration, "clientId" | "redirectUri" | "audience">, options?: {
+    scopes?: string[];
+    prompt?: "consent" | "login" | "select_account";
+}): Promise<{
+    url: URL;
+    transaction: AuthorizationTransaction;
+}>;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/core/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/core/authorization.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,EAC3B,MAAM,YAAY,CAAC;AAgCpB,wBAAgB,0BAA0B,CACtC,WAAW,EAAE,MAAM,GAAG,GAAG,EACzB,aAAa,EAAE,MAAM,GACtB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAsBlB;AAkBD,wBAAsB,0BAA0B,CAC5C,QAAQ,EAAE,2BAA2B,EACrC,aAAa,EAAE,IAAI,CACf,qBAAqB,EACrB,UAAU,GAAG,aAAa,GAAG,UAAU,CAC1C,EACD,OAAO,GAAE;IACL,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,gBAAgB,CAAC;CAC9C,GACP,OAAO,CAAC;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,wBAAwB,CAAA;CAAE,CAAC,CAgC9D"}

package/dist/core/authorization.js

@@ -0,0 +1,75 @@
+import { assertState, generateNonce, generatePkce, generateState, } from "./crypto.js";
+import { AccountsError } from "./errors.js";
+function validateRedirectUri(value) {
+    let redirect;
+    try {
+        redirect = new URL(value);
+    }
+    catch {
+        throw new AccountsError("configuration_error", "redirectUri must be an absolute URL");
+    }
+    const local = redirect.hostname === "localhost" || redirect.hostname === "127.0.0.1";
+    if (redirect.protocol !== "https:" &&
+        !(local && redirect.protocol === "http:")) {
+        throw new AccountsError("configuration_error", "redirectUri must use HTTPS outside localhost");
+    }
+    if (redirect.username || redirect.password || redirect.hash) {
+        throw new AccountsError("configuration_error", "redirectUri cannot contain credentials or a fragment");
+    }
+    return redirect.toString();
+}
+export function parseAuthorizationCallback(callbackUrl, expectedState) {
+    const url = callbackUrl instanceof URL ? callbackUrl : new URL(callbackUrl);
+    const returnedState = url.searchParams.get("state") || "";
+    assertState(expectedState, returnedState);
+    const error = url.searchParams.get("error");
+    if (error) {
+        throw new AccountsError("oauth_error", "Authorization request was rejected", {
+            oauthCode: error,
+        });
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+        throw new AccountsError("protocol_error", "Authorization callback did not include a code");
+    }
+    return { code };
+}
+function validateScopes(scopes) {
+    const normalized = [
+        ...new Set(scopes.map((scope) => scope.trim()).filter(Boolean)),
+    ];
+    if (normalized.length === 0 ||
+        normalized.some((scope) => /\s/.test(scope))) {
+        throw new AccountsError("configuration_error", "At least one valid OAuth scope is required");
+    }
+    return normalized;
+}
+export async function createAuthorizationRequest(metadata, configuration, options = {}) {
+    if (!configuration.clientId.trim()) {
+        throw new AccountsError("configuration_error", "clientId is required");
+    }
+    const scopes = validateScopes(options.scopes ?? ["openid", "profile", "email"]);
+    const [{ codeVerifier, codeChallenge }, state, nonce] = await Promise.all([
+        generatePkce(),
+        Promise.resolve(generateState()),
+        Promise.resolve(generateNonce()),
+    ]);
+    const url = new URL(metadata.authorization_endpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", configuration.clientId);
+    url.searchParams.set("redirect_uri", validateRedirectUri(configuration.redirectUri));
+    url.searchParams.set("scope", scopes.join(" "));
+    url.searchParams.set("state", state);
+    url.searchParams.set("nonce", nonce);
+    url.searchParams.set("code_challenge", codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    if (configuration.audience)
+        url.searchParams.set("audience", configuration.audience);
+    if (options.prompt)
+        url.searchParams.set("prompt", options.prompt);
+    return {
+        url,
+        transaction: { state, nonce, codeVerifier, createdAt: Date.now() },
+    };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/core/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/core/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,aAAa,EACb,YAAY,EACZ,aAAa,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5C,SAAS,mBAAmB,CAAC,KAAa;IACtC,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACD,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,qCAAqC,CACxC,CAAC;IACN,CAAC;IACD,MAAM,KAAK,GACP,QAAQ,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC3E,IACI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,EAC3C,CAAC;QACC,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,8CAA8C,CACjD,CAAC;IACN,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,sDAAsD,CACzD,CAAC;IACN,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,0BAA0B,CACtC,WAAyB,EACzB,aAAqB;IAErB,MAAM,GAAG,GAAG,WAAW,YAAY,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1D,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,EAAE,CAAC;QACR,MAAM,IAAI,aAAa,CACnB,aAAa,EACb,oCAAoC,EACpC;YACI,SAAS,EAAE,KAA4C;SAC1D,CACJ,CAAC;IACN,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,aAAa,CACnB,gBAAgB,EAChB,+CAA+C,CAClD,CAAC;IACN,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,MAAgB;IACpC,MAAM,UAAU,GAAG;QACf,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAClE,CAAC;IACF,IACI,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9C,CAAC;QACC,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,4CAA4C,CAC/C,CAAC;IACN,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAqC,EACrC,aAGC,EACD,UAGI,EAAE;IAEN,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CACzB,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CACnD,CAAC;IACF,MAAM,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtE,YAAY,EAAE;QACd,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAChB,cAAc,EACd,mBAAmB,CAAC,aAAa,CAAC,WAAW,CAAC,CACjD,CAAC;IACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,aAAa,CAAC,QAAQ;QACtB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnE,OAAO;QACH,GAAG;QACH,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;KACrE,CAAC;AACN,CAAC"}

package/dist/core/client.d.ts

@@ -0,0 +1,20 @@
+import type { AccountsConfiguration, AuthorizationServerMetadata } from "./types.js";
+export declare function createAccountsClient(configuration: AccountsConfiguration): {
+    metadata: () => Promise<AuthorizationServerMetadata>;
+    createAuthorizationRequest(options?: {
+        scopes?: string[];
+        prompt?: "consent" | "login" | "select_account";
+    }): Promise<{
+        url: URL;
+        transaction: import("./types.js").AuthorizationTransaction;
+    }>;
+    exchangeAuthorizationCode(input: {
+        code: string;
+        codeVerifier: string;
+    }): Promise<import("./types.js").TokenSet>;
+    refresh(refreshToken: string, scopes?: string[]): Promise<import("./types.js").TokenSet>;
+    revoke(token: string, tokenTypeHint?: "access_token" | "refresh_token"): Promise<void>;
+    verifyAccessToken(token: string): Promise<import("./types.js").VerifiedAccessToken>;
+    verifyIdToken(token: string, nonce?: string): Promise<import("./types.js").VerifiedIdToken>;
+};
+//# sourceMappingURL=client.d.ts.map

package/dist/core/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/core/client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,qBAAqB,EACrB,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAGpB,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,qBAAqB;;yCAStB;QACvC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,gBAAgB,CAAC;KACnD;;;;qCAOsC;QACnC,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACxB;0BAO2B,MAAM,WAAW,MAAM,EAAE;kBAS1C,MAAM,kBACE,cAAc,GAAG,eAAe;6BASpB,MAAM;yBAcV,MAAM,UAAU,MAAM;EASxD"}

package/dist/core/client.js

@@ -0,0 +1,47 @@
+import { createAuthorizationRequest } from "./authorization.js";
+import { discoverAccounts } from "./discovery.js";
+import { AccountsError } from "./errors.js";
+import { exchangeAuthorizationCode, refreshTokens, revokeToken, } from "./tokens.js";
+import { verifyAccessToken, verifyIdToken } from "./verify.js";
+export function createAccountsClient(configuration) {
+    let metadataPromise;
+    const metadata = () => {
+        metadataPromise ??= discoverAccounts(configuration);
+        return metadataPromise;
+    };
+    return {
+        metadata,
+        async createAuthorizationRequest(options) {
+            return createAuthorizationRequest(await metadata(), configuration, options);
+        },
+        async exchangeAuthorizationCode(input) {
+            return exchangeAuthorizationCode(await metadata(), configuration, input);
+        },
+        async refresh(refreshToken, scopes) {
+            return refreshTokens(await metadata(), configuration, refreshToken, scopes);
+        },
+        async revoke(token, tokenTypeHint = "refresh_token") {
+            return revokeToken(await metadata(), configuration, token, tokenTypeHint);
+        },
+        async verifyAccessToken(token) {
+            if (!configuration.audience) {
+                throw new AccountsError("configuration_error", "audience is required to verify an access token");
+            }
+            return verifyAccessToken(token, await metadata(), {
+                audience: configuration.audience,
+                clientId: configuration.clientId,
+                fetch: configuration.fetch,
+                timeoutMs: configuration.timeoutMs,
+            });
+        },
+        async verifyIdToken(token, nonce) {
+            return verifyIdToken(token, await metadata(), {
+                clientId: configuration.clientId,
+                nonce,
+                fetch: configuration.fetch,
+                timeoutMs: configuration.timeoutMs,
+            });
+        },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/core/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/core/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACH,yBAAyB,EACzB,aAAa,EACb,WAAW,GACd,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,UAAU,oBAAoB,CAAC,aAAoC;IACrE,IAAI,eAAiE,CAAC;IACtE,MAAM,QAAQ,GAAG,GAAG,EAAE;QAClB,eAAe,KAAK,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACpD,OAAO,eAAe,CAAC;IAC3B,CAAC,CAAC;IAEF,OAAO;QACH,QAAQ;QACR,KAAK,CAAC,0BAA0B,CAAC,OAGhC;YACG,OAAO,0BAA0B,CAC7B,MAAM,QAAQ,EAAE,EAChB,aAAa,EACb,OAAO,CACV,CAAC;QACN,CAAC;QACD,KAAK,CAAC,yBAAyB,CAAC,KAG/B;YACG,OAAO,yBAAyB,CAC5B,MAAM,QAAQ,EAAE,EAChB,aAAa,EACb,KAAK,CACR,CAAC;QACN,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,MAAiB;YACjD,OAAO,aAAa,CAChB,MAAM,QAAQ,EAAE,EAChB,aAAa,EACb,YAAY,EACZ,MAAM,CACT,CAAC;QACN,CAAC;QACD,KAAK,CAAC,MAAM,CACR,KAAa,EACb,gBAAkD,eAAe;YAEjE,OAAO,WAAW,CACd,MAAM,QAAQ,EAAE,EAChB,aAAa,EACb,KAAK,EACL,aAAa,CAChB,CAAC;QACN,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,KAAa;YACjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,gDAAgD,CACnD,CAAC;YACN,CAAC;YACD,OAAO,iBAAiB,CAAC,KAAK,EAAE,MAAM,QAAQ,EAAE,EAAE;gBAC9C,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,SAAS,EAAE,aAAa,CAAC,SAAS;aACrC,CAAC,CAAC;QACP,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAc;YAC7C,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,QAAQ,EAAE,EAAE;gBAC1C,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,KAAK;gBACL,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,SAAS,EAAE,aAAa,CAAC,SAAS;aACrC,CAAC,CAAC;QACP,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/core/crypto.d.ts

@@ -0,0 +1,14 @@
+export declare function randomValue(byteLength?: number): string;
+export declare function generateState(): string;
+export declare function generateNonce(): string;
+export declare function generateCodeVerifier(): string;
+export declare function deriveCodeChallenge(verifier: string): Promise<string>;
+export declare function generatePkce(): Promise<{
+    codeVerifier: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+}>;
+export declare function timingSafeEqual(left: string, right: string): boolean;
+export declare function assertState(expected: string, actual: string): void;
+export declare function assertNonce(expected: string, actual?: string): void;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/core/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/core/crypto.ts"],"names":[],"mappings":"AAWA,wBAAgB,WAAW,CAAC,UAAU,SAAK,GAAG,MAAM,CAQnD;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3E;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC/B,CAAC,CAOD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQpE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAIlE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAOnE"}

package/dist/core/crypto.js

@@ -0,0 +1,58 @@
+import { AccountsError } from "./errors.js";
+const PKCE_VALUE = /^[A-Za-z0-9._~-]{43,128}$/;
+function base64Url(bytes) {
+    return btoa(String.fromCharCode(...bytes))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+export function randomValue(byteLength = 32) {
+    if (!Number.isInteger(byteLength) || byteLength < 16 || byteLength > 96) {
+        throw new AccountsError("configuration_error", "Random value length must be between 16 and 96 bytes");
+    }
+    return base64Url(crypto.getRandomValues(new Uint8Array(byteLength)));
+}
+export function generateState() {
+    return randomValue(32);
+}
+export function generateNonce() {
+    return randomValue(32);
+}
+export function generateCodeVerifier() {
+    return randomValue(32);
+}
+export async function deriveCodeChallenge(verifier) {
+    if (!PKCE_VALUE.test(verifier)) {
+        throw new AccountsError("configuration_error", "PKCE verifier must contain 43 to 128 unreserved characters");
+    }
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return base64Url(new Uint8Array(digest));
+}
+export async function generatePkce() {
+    const codeVerifier = generateCodeVerifier();
+    return {
+        codeVerifier,
+        codeChallenge: await deriveCodeChallenge(codeVerifier),
+        codeChallengeMethod: "S256",
+    };
+}
+export function timingSafeEqual(left, right) {
+    const maxLength = Math.max(left.length, right.length);
+    let difference = left.length ^ right.length;
+    for (let index = 0; index < maxLength; index += 1) {
+        difference |=
+            (left.charCodeAt(index) || 0) ^ (right.charCodeAt(index) || 0);
+    }
+    return difference === 0;
+}
+export function assertState(expected, actual) {
+    if (!timingSafeEqual(expected, actual)) {
+        throw new AccountsError("state_mismatch", "OAuth state did not match");
+    }
+}
+export function assertNonce(expected, actual) {
+    if (!actual || !timingSafeEqual(expected, actual)) {
+        throw new AccountsError("nonce_mismatch", "ID token nonce did not match");
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/core/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/core/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C,SAAS,SAAS,CAAC,KAAiB;IAChC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACrC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAAU,GAAG,EAAE;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,EAAE,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,qDAAqD,CACxD,CAAC;IACN,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,aAAa;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,4DAA4D,CAC/D,CAAC;IACN,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACrC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CACrC,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAK9B,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,OAAO;QACH,YAAY;QACZ,aAAa,EAAE,MAAM,mBAAmB,CAAC,YAAY,CAAC;QACtD,mBAAmB,EAAE,MAAM;KAC9B,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAChD,UAAU;YACN,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAc;IACxD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IAC3E,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAe;IACzD,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CACnB,gBAAgB,EAChB,8BAA8B,CACjC,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/core/discovery.d.ts

@@ -0,0 +1,8 @@
+import type { AuthorizationServerMetadata } from "./types.js";
+export declare function normalizeIssuer(issuer: string): string;
+export declare function discoverAccounts(options: {
+    issuer: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<AuthorizationServerMetadata>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/core/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/core/discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAU9D,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA4BtD;AA6ED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAoDvC"}

package/dist/core/discovery.js

@@ -0,0 +1,110 @@
+import { AccountsError } from "./errors.js";
+const REQUIRED_ENDPOINTS = [
+    "authorization_endpoint",
+    "token_endpoint",
+    "userinfo_endpoint",
+    "jwks_uri",
+    "revocation_endpoint",
+];
+export function normalizeIssuer(issuer) {
+    let parsed;
+    try {
+        parsed = new URL(issuer);
+    }
+    catch {
+        throw new AccountsError("configuration_error", "Accounts issuer must be an absolute URL");
+    }
+    const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    if (parsed.protocol !== "https:" &&
+        !(isLocalhost && parsed.protocol === "http:")) {
+        throw new AccountsError("configuration_error", "Accounts issuer must use HTTPS outside localhost");
+    }
+    if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+        throw new AccountsError("configuration_error", "Accounts issuer cannot contain credentials, query, or fragment");
+    }
+    return parsed.toString().replace(/\/$/, "");
+}
+function isStringArray(value) {
+    return (Array.isArray(value) && value.every((item) => typeof item === "string"));
+}
+function validateMetadata(value, expectedIssuer) {
+    if (!value || typeof value !== "object") {
+        throw new AccountsError("discovery_error", "Discovery response is not an object");
+    }
+    const metadata = value;
+    if (metadata.issuer !== expectedIssuer) {
+        throw new AccountsError("discovery_error", "Discovery issuer did not match configuration");
+    }
+    const issuerOrigin = new URL(expectedIssuer).origin;
+    for (const field of REQUIRED_ENDPOINTS) {
+        const endpoint = metadata[field];
+        if (typeof endpoint !== "string") {
+            throw new AccountsError("discovery_error", `Discovery metadata is missing ${field}`);
+        }
+        let parsed;
+        try {
+            parsed = new URL(endpoint);
+        }
+        catch {
+            throw new AccountsError("discovery_error", `Discovery metadata contains an invalid ${field}`);
+        }
+        if (parsed.origin !== issuerOrigin) {
+            throw new AccountsError("discovery_error", `Discovery ${field} must use the issuer origin`);
+        }
+    }
+    for (const field of [
+        "scopes_supported",
+        "grant_types_supported",
+        "response_types_supported",
+        "token_endpoint_auth_methods_supported",
+        "code_challenge_methods_supported",
+    ]) {
+        if (!isStringArray(metadata[field])) {
+            throw new AccountsError("discovery_error", `Discovery metadata contains an invalid ${field}`);
+        }
+    }
+    if (!metadata.code_challenge_methods_supported.includes("S256")) {
+        throw new AccountsError("discovery_error", "Authorization server does not support S256 PKCE");
+    }
+    return metadata;
+}
+export async function discoverAccounts(options) {
+    const issuer = normalizeIssuer(options.issuer);
+    const fetcher = options.fetch ?? globalThis.fetch;
+    if (!fetcher) {
+        throw new AccountsError("configuration_error", "No fetch implementation is available");
+    }
+    const timeoutMs = options.timeoutMs ?? 5_000;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetcher(`${issuer}/.well-known/oauth-authorization-server`, {
+            headers: { Accept: "application/json" },
+            cache: "no-store",
+            redirect: "error",
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            throw new AccountsError("discovery_error", "Accounts discovery request failed", {
+                status: response.status,
+                retryable: response.status >= 500,
+            });
+        }
+        if (new URL(response.url || issuer).origin !== new URL(issuer).origin) {
+            throw new AccountsError("discovery_error", "Accounts discovery changed origin");
+        }
+        return validateMetadata(await response.json(), issuer);
+    }
+    catch (error) {
+        if (error instanceof AccountsError)
+            throw error;
+        throw new AccountsError("network_error", "Accounts discovery was unavailable", {
+            retryable: true,
+            cause: error,
+        });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+//# sourceMappingURL=discovery.js.map

package/dist/core/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/core/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,kBAAkB,GAAG;IACvB,wBAAwB;IACxB,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV,qBAAqB;CACf,CAAC;AAEX,MAAM,UAAU,eAAe,CAAC,MAAc;IAC1C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,yCAAyC,CAC5C,CAAC;IACN,CAAC;IACD,MAAM,WAAW,GACb,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;IACvE,IACI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,EAC/C,CAAC;QACC,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,kDAAkD,CACrD,CAAC;IACN,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,gEAAgE,CACnE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,CACH,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC1E,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CACrB,KAAc,EACd,cAAsB;IAEtB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,qCAAqC,CACxC,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,8CAA8C,CACjD,CAAC;IACN,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,iCAAiC,KAAK,EAAE,CAC3C,CAAC;QACN,CAAC;QACD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,0CAA0C,KAAK,EAAE,CACpD,CAAC;QACN,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,aAAa,KAAK,6BAA6B,CAClD,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI;QAChB,kBAAkB;QAClB,uBAAuB;QACvB,0BAA0B;QAC1B,uCAAuC;QACvC,kCAAkC;KACrC,EAAE,CAAC;QACA,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,0CAA0C,KAAK,EAAE,CACpD,CAAC;QACN,CAAC;IACL,CAAC;IACD,IACI,CAAE,QAAQ,CAAC,gCAA6C,CAAC,QAAQ,CAC7D,MAAM,CACT,EACH,CAAC;QACC,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,iDAAiD,CACpD,CAAC;IACN,CAAC;IACD,OAAO,QAAkD,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAItC;IACG,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,sCAAsC,CACzC,CAAC;IACN,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC1B,GAAG,MAAM,yCAAyC,EAClD;YACI,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC5B,CACJ,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,mCAAmC,EACnC;gBACI,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;aACpC,CACJ,CAAC;QACN,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACpE,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,mCAAmC,CACtC,CAAC;QACN,CAAC;QACD,OAAO,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,oCAAoC,EACpC;YACI,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,KAAK;SACf,CACJ,CAAC;IACN,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthErrorCode } from "./types.js";
+export type AccountsErrorCode = "configuration_error" | "discovery_error" | "network_error" | "oauth_error" | "protocol_error" | "state_mismatch" | "nonce_mismatch" | "token_verification_error";
+export declare class AccountsError extends Error {
+    readonly code: AccountsErrorCode;
+    readonly oauthCode?: OAuthErrorCode;
+    readonly retryable: boolean;
+    readonly status?: number;
+    constructor(code: AccountsErrorCode, message: string, options?: {
+        oauthCode?: OAuthErrorCode;
+        retryable?: boolean;
+        status?: number;
+        cause?: unknown;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACvB,qBAAqB,GACrB,iBAAiB,GACjB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,0BAA0B,CAAC;AAEjC,qBAAa,aAAc,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAGrB,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QACL,SAAS,CAAC,EAAE,cAAc,CAAC;QAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;KACd;CASb"}

package/dist/core/errors.js

@@ -0,0 +1,15 @@
+export class AccountsError extends Error {
+    code;
+    oauthCode;
+    retryable;
+    status;
+    constructor(code, message, options = {}) {
+        super(message, { cause: options.cause });
+        this.name = "AccountsError";
+        this.code = code;
+        this.oauthCode = options.oauthCode;
+        this.retryable = options.retryable ?? false;
+        this.status = options.status;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC3B,IAAI,CAAoB;IACxB,SAAS,CAAkB;IAC3B,SAAS,CAAU;IACnB,MAAM,CAAU;IAEzB,YACI,IAAuB,EACvB,OAAe,EACf,UAKI,EAAE;QAEN,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACjC,CAAC;CACJ"}

package/dist/core/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./authorization.js";
+export * from "./client.js";
+export * from "./crypto.js";
+export * from "./discovery.js";
+export * from "./errors.js";
+export * from "./tokens.js";
+export * from "./types.js";
+export * from "./verify.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,9 @@
+export * from "./authorization.js";
+export * from "./client.js";
+export * from "./crypto.js";
+export * from "./discovery.js";
+export * from "./errors.js";
+export * from "./tokens.js";
+export * from "./types.js";
+export * from "./verify.js";
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/tokens.d.ts

@@ -0,0 +1,8 @@
+import type { AccountsConfiguration, AuthorizationServerMetadata, TokenSet } from "./types.js";
+export declare function exchangeAuthorizationCode(metadata: AuthorizationServerMetadata, configuration: AccountsConfiguration, input: {
+    code: string;
+    codeVerifier: string;
+}): Promise<TokenSet>;
+export declare function refreshTokens(metadata: AuthorizationServerMetadata, configuration: AccountsConfiguration, refreshToken: string, scopes?: string[]): Promise<TokenSet>;
+export declare function revokeToken(metadata: AuthorizationServerMetadata, configuration: AccountsConfiguration, token: string, tokenTypeHint?: "access_token" | "refresh_token"): Promise<void>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/core/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/core/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACR,qBAAqB,EACrB,2BAA2B,EAE3B,QAAQ,EACX,MAAM,YAAY,CAAC;AA2GpB,wBAAsB,yBAAyB,CAC3C,QAAQ,EAAE,2BAA2B,EACrC,aAAa,EAAE,qBAAqB,EACpC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9C,OAAO,CAAC,QAAQ,CAAC,CAenB;AAED,wBAAsB,aAAa,CAC/B,QAAQ,EAAE,2BAA2B,EACrC,aAAa,EAAE,qBAAqB,EACpC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,QAAQ,CAAC,CAcnB;AAED,wBAAsB,WAAW,CAC7B,QAAQ,EAAE,2BAA2B,EACrC,aAAa,EAAE,qBAAqB,EACpC,KAAK,EAAE,MAAM,EACb,aAAa,GAAE,cAAc,GAAG,eAAiC,GAClE,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/core/tokens.js

@@ -0,0 +1,102 @@
+import { AccountsError } from "./errors.js";
+function parseTokenSet(value) {
+    if (typeof value.access_token !== "string" ||
+        typeof value.refresh_token !== "string" ||
+        value.token_type !== "Bearer" ||
+        typeof value.expires_in !== "number" ||
+        typeof value.scope !== "string") {
+        throw new AccountsError("protocol_error", "Token endpoint returned an invalid response");
+    }
+    return {
+        accessToken: value.access_token,
+        refreshToken: value.refresh_token,
+        ...(typeof value.id_token === "string"
+            ? { idToken: value.id_token }
+            : {}),
+        tokenType: "Bearer",
+        expiresIn: value.expires_in,
+        scope: value.scope.split(/\s+/).filter(Boolean),
+    };
+}
+async function postForm(endpoint, values, options) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 5_000);
+    try {
+        const body = new URLSearchParams();
+        for (const [key, value] of Object.entries(values)) {
+            if (value !== undefined)
+                body.set(key, value);
+        }
+        const response = await fetcher(endpoint, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body,
+            cache: "no-store",
+            redirect: "error",
+            signal: controller.signal,
+        });
+        let payload;
+        try {
+            payload = (await response.json());
+        }
+        catch (error) {
+            throw new AccountsError("protocol_error", "OAuth endpoint returned invalid JSON", {
+                status: response.status,
+                cause: error,
+            });
+        }
+        if (!response.ok || typeof payload.error === "string") {
+            throw new AccountsError("oauth_error", "OAuth request was rejected", {
+                oauthCode: typeof payload.error === "string"
+                    ? payload.error
+                    : "server_error",
+                retryable: response.status >= 500,
+                status: response.status,
+            });
+        }
+        return payload;
+    }
+    catch (error) {
+        if (error instanceof AccountsError)
+            throw error;
+        throw new AccountsError("network_error", "OAuth endpoint was unavailable", {
+            retryable: true,
+            cause: error,
+        });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export async function exchangeAuthorizationCode(metadata, configuration, input) {
+    return parseTokenSet(await postForm(metadata.token_endpoint, {
+        grant_type: "authorization_code",
+        code: input.code,
+        code_verifier: input.codeVerifier,
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        redirect_uri: configuration.redirectUri,
+    }, configuration));
+}
+export async function refreshTokens(metadata, configuration, refreshToken, scopes) {
+    return parseTokenSet(await postForm(metadata.token_endpoint, {
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+        scope: scopes?.join(" "),
+    }, configuration));
+}
+export async function revokeToken(metadata, configuration, token, tokenTypeHint = "refresh_token") {
+    await postForm(metadata.revocation_endpoint, {
+        token,
+        token_type_hint: tokenTypeHint,
+        client_id: configuration.clientId,
+        client_secret: configuration.clientSecret,
+    }, configuration);
+}
+//# sourceMappingURL=tokens.js.map

package/dist/core/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/core/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAkB5C,SAAS,aAAa,CAAC,KAAuB;IAC1C,IACI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,KAAK,CAAC,UAAU,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EACjC,CAAC;QACC,MAAM,IAAI,aAAa,CACnB,gBAAgB,EAChB,6CAA6C,CAChD,CAAC;IACN,CAAC;IACD,OAAO;QACH,WAAW,EAAE,KAAK,CAAC,YAAY;QAC/B,YAAY,EAAE,KAAK,CAAC,aAAa;QACjC,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAClC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;YAC7B,CAAC,CAAC,EAAE,CAAC;QACT,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;KAClD,CAAC;AACN,CAAC;AAED,KAAK,UAAU,QAAQ,CACnB,QAAgB,EAChB,MAA0C,EAC1C,OAAqD;IAErD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC7B,CAAC;IACF,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,IAAI,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACtD;YACD,IAAI;YACJ,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACnB,gBAAgB,EAChB,sCAAsC,EACtC;gBACI,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,KAAK;aACf,CACJ,CAAC;QACN,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,aAAa,CACnB,aAAa,EACb,4BAA4B,EAC5B;gBACI,SAAS,EACL,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;oBAC7B,CAAC,CAAE,OAAO,CAAC,KAAwB;oBACnC,CAAC,CAAC,cAAc;gBACxB,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;aAC1B,CACJ,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,gCAAgC,EAChC;YACI,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,KAAK;SACf,CACJ,CAAC;IACN,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,QAAqC,EACrC,aAAoC,EACpC,KAA6C;IAE7C,OAAO,aAAa,CAChB,MAAM,QAAQ,CACV,QAAQ,CAAC,cAAc,EACvB;QACI,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,SAAS,EAAE,aAAa,CAAC,QAAQ;QACjC,aAAa,EAAE,aAAa,CAAC,YAAY;QACzC,YAAY,EAAE,aAAa,CAAC,WAAW;KAC1C,EACD,aAAa,CAChB,CACJ,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,QAAqC,EACrC,aAAoC,EACpC,YAAoB,EACpB,MAAiB;IAEjB,OAAO,aAAa,CAChB,MAAM,QAAQ,CACV,QAAQ,CAAC,cAAc,EACvB;QACI,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,aAAa,CAAC,QAAQ;QACjC,aAAa,EAAE,aAAa,CAAC,YAAY;QACzC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC;KAC3B,EACD,aAAa,CAChB,CACJ,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,QAAqC,EACrC,aAAoC,EACpC,KAAa,EACb,gBAAkD,eAAe;IAEjE,MAAM,QAAQ,CACV,QAAQ,CAAC,mBAAmB,EAC5B;QACI,KAAK;QACL,eAAe,EAAE,aAAa;QAC9B,SAAS,EAAE,aAAa,CAAC,QAAQ;QACjC,aAAa,EAAE,aAAa,CAAC,YAAY;KAC5C,EACD,aAAa,CAChB,CAAC;AACN,CAAC"}

package/dist/core/types.d.ts

@@ -0,0 +1,70 @@
+export type OAuthErrorCode = "access_denied" | "authorization_pending" | "expired_token" | "invalid_client" | "invalid_grant" | "invalid_request" | "invalid_scope" | "server_error" | "slow_down" | "temporarily_unavailable" | "unsupported_grant_type" | "unsupported_response_type";
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    device_authorization_endpoint?: string;
+    revocation_endpoint: string;
+    scopes_supported: string[];
+    grant_types_supported: string[];
+    response_types_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    revocation_endpoint_auth_methods_supported?: string[];
+    code_challenge_methods_supported: string[];
+    subject_types_supported?: string[];
+    id_token_signing_alg_values_supported?: string[];
+    claims_supported?: string[];
+    elixpo_contract_version?: string;
+    elixpo_min_compatible_sdk_version?: string;
+}
+export interface AccountsConfiguration {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    audience?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+export interface AuthorizationTransaction {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    createdAt: number;
+}
+export interface TokenSet {
+    accessToken: string;
+    refreshToken: string;
+    idToken?: string;
+    tokenType: "Bearer";
+    expiresIn: number;
+    scope: string[];
+}
+export interface VerifiedAccessToken {
+    tokenType: "access";
+    subject: string;
+    issuer: string;
+    audience: string[];
+    clientId: string;
+    expiresAt: number;
+    issuedAt: number;
+    scopes: string[];
+    sessionId?: string;
+    email?: string;
+}
+export interface VerifiedIdToken {
+    tokenType: "id";
+    subject: string;
+    issuer: string;
+    audience: string[];
+    expiresAt: number;
+    issuedAt: number;
+    nonce?: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    preferredUsername?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACpB,eAAe,GACf,uBAAuB,GACvB,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,cAAc,GACd,WAAW,GACX,yBAAyB,GACzB,wBAAwB,GACxB,2BAA2B,CAAC;AAElC,MAAM,WAAW,2BAA2B;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,0CAA0C,CAAC,EAAE,MAAM,EAAE,CAAC;IACtD,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iCAAiC,CAAC,EAAE,MAAM,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,QAAQ,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/core/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":""}

package/dist/core/verify.d.ts

@@ -0,0 +1,17 @@
+import type { AuthorizationServerMetadata, VerifiedAccessToken, VerifiedIdToken } from "./types.js";
+export declare function verifyAccessToken(token: string, metadata: AuthorizationServerMetadata, options: {
+    audience: string;
+    clientId?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    clockTolerance?: number;
+}): Promise<VerifiedAccessToken>;
+export declare function verifyIdToken(token: string, metadata: AuthorizationServerMetadata, options: {
+    clientId: string;
+    nonce?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    clockTolerance?: number;
+}): Promise<VerifiedIdToken>;
+export declare function clearJwksCache(): void;
+//# sourceMappingURL=verify.d.ts.map

package/dist/core/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/core/verify.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACR,2BAA2B,EAC3B,mBAAmB,EACnB,eAAe,EAClB,MAAM,YAAY,CAAC;AAgJpB,wBAAsB,iBAAiB,CACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,GACF,OAAO,CAAC,mBAAmB,CAAC,CA8B9B;AAED,wBAAsB,aAAa,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,2BAA2B,EACrC,OAAO,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,GACF,OAAO,CAAC,eAAe,CAAC,CAiC1B;AAED,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/core/verify.js

@@ -0,0 +1,157 @@
+import { createLocalJWKSet, decodeProtectedHeader, errors as joseErrors, jwtVerify, } from "jose";
+import { assertNonce } from "./crypto.js";
+import { AccountsError } from "./errors.js";
+const jwksCache = new Map();
+function audiences(payload) {
+    if (typeof payload.aud === "string")
+        return [payload.aud];
+    if (Array.isArray(payload.aud))
+        return payload.aud;
+    return [];
+}
+async function loadJwks(metadata, options, force = false) {
+    const cached = jwksCache.get(metadata.jwks_uri);
+    if (!force && cached && cached.expiresAt > Date.now())
+        return cached.jwks;
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 5_000);
+    try {
+        const response = await fetcher(metadata.jwks_uri, {
+            headers: { Accept: "application/json" },
+            cache: "no-store",
+            redirect: "error",
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            throw new AccountsError("token_verification_error", "JWKS request failed", {
+                status: response.status,
+                retryable: response.status >= 500,
+            });
+        }
+        const value = (await response.json());
+        if (!Array.isArray(value.keys) || value.keys.length === 0) {
+            throw new AccountsError("token_verification_error", "JWKS response did not contain signing keys");
+        }
+        const valid = value.keys.every((key) => key &&
+            typeof key === "object" &&
+            key.kty === "OKP" &&
+            key.crv === "Ed25519" &&
+            key.alg === "EdDSA" &&
+            typeof key.kid === "string" &&
+            !key.d);
+        if (!valid) {
+            throw new AccountsError("token_verification_error", "JWKS response contained an unsupported key");
+        }
+        const jwks = value;
+        jwksCache.set(metadata.jwks_uri, {
+            jwks,
+            expiresAt: Date.now() + 5 * 60_000,
+        });
+        return jwks;
+    }
+    catch (error) {
+        if (error instanceof AccountsError)
+            throw error;
+        throw new AccountsError("network_error", "JWKS endpoint was unavailable", {
+            retryable: true,
+            cause: error,
+        });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function verify(token, metadata, audience, options) {
+    let header;
+    try {
+        header = decodeProtectedHeader(token);
+    }
+    catch (error) {
+        throw new AccountsError("token_verification_error", "Token header is invalid", { cause: error });
+    }
+    if (header.alg !== "EdDSA" || typeof header.kid !== "string") {
+        throw new AccountsError("token_verification_error", "Token uses an unsupported signing key or algorithm");
+    }
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const jwks = await loadJwks(metadata, options, attempt === 1);
+            const result = await jwtVerify(token, createLocalJWKSet(jwks), {
+                algorithms: ["EdDSA"],
+                audience,
+                issuer: metadata.issuer,
+                clockTolerance: options.clockTolerance ?? 5,
+            });
+            return result.payload;
+        }
+        catch (error) {
+            if (attempt === 0 &&
+                error instanceof joseErrors.JWKSNoMatchingKey) {
+                continue;
+            }
+            if (error instanceof AccountsError)
+                throw error;
+            throw new AccountsError("token_verification_error", "Token verification failed", { cause: error });
+        }
+    }
+    throw new AccountsError("token_verification_error", "Token signing key was not found");
+}
+export async function verifyAccessToken(token, metadata, options) {
+    const payload = await verify(token, metadata, options.audience, options);
+    if (payload.type !== "access" ||
+        typeof payload.sub !== "string" ||
+        typeof payload.iss !== "string" ||
+        typeof payload.exp !== "number" ||
+        typeof payload.iat !== "number" ||
+        typeof payload.client_id !== "string" ||
+        !Array.isArray(payload.scopes) ||
+        !payload.scopes.every((scope) => typeof scope === "string") ||
+        (options.clientId && payload.client_id !== options.clientId)) {
+        throw new AccountsError("token_verification_error", "Access token claims are invalid");
+    }
+    return {
+        tokenType: "access",
+        subject: payload.sub,
+        issuer: payload.iss,
+        audience: audiences(payload),
+        clientId: payload.client_id,
+        expiresAt: payload.exp,
+        issuedAt: payload.iat,
+        scopes: payload.scopes,
+        ...(typeof payload.sid === "string" ? { sessionId: payload.sid } : {}),
+        ...(typeof payload.email === "string" ? { email: payload.email } : {}),
+    };
+}
+export async function verifyIdToken(token, metadata, options) {
+    const payload = await verify(token, metadata, options.clientId, options);
+    if (payload.type !== "id" ||
+        typeof payload.sub !== "string" ||
+        typeof payload.iss !== "string" ||
+        typeof payload.exp !== "number" ||
+        typeof payload.iat !== "number") {
+        throw new AccountsError("token_verification_error", "ID token claims are invalid");
+    }
+    if (options.nonce)
+        assertNonce(options.nonce, payload.nonce);
+    return {
+        tokenType: "id",
+        subject: payload.sub,
+        issuer: payload.iss,
+        audience: audiences(payload),
+        expiresAt: payload.exp,
+        issuedAt: payload.iat,
+        ...(typeof payload.nonce === "string" ? { nonce: payload.nonce } : {}),
+        ...(typeof payload.email === "string" ? { email: payload.email } : {}),
+        ...(typeof payload.email_verified === "boolean"
+            ? { emailVerified: payload.email_verified }
+            : {}),
+        ...(typeof payload.name === "string" ? { name: payload.name } : {}),
+        ...(typeof payload.preferred_username === "string"
+            ? { preferredUsername: payload.preferred_username }
+            : {}),
+    };
+}
+export function clearJwksCache() {
+    jwksCache.clear();
+}
+//# sourceMappingURL=verify.js.map

package/dist/core/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/core/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,iBAAiB,EACjB,qBAAqB,EAGrB,MAAM,IAAI,UAAU,EACpB,SAAS,GACZ,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQ5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEhD,SAAS,SAAS,CAAC,OAAmB;IAClC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACnD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CACnB,QAAqC,EACrC,OAAqD,EACrD,KAAK,GAAG,KAAK;IAEb,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAE1E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC7B,CAAC;IACF,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE;YAC9C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,qBAAqB,EACrB;gBACI,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;aACpC,CACJ,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,4CAA4C,CAC/C,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAC1B,CAAC,GAAG,EAAE,EAAE,CACJ,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACtB,GAA+B,CAAC,GAAG,KAAK,KAAK;YAC7C,GAA+B,CAAC,GAAG,KAAK,SAAS;YACjD,GAA+B,CAAC,GAAG,KAAK,OAAO;YAChD,OAAQ,GAA+B,CAAC,GAAG,KAAK,QAAQ;YACxD,CAAE,GAA+B,CAAC,CAAC,CAC1C,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,4CAA4C,CAC/C,CAAC;QACN,CAAC;QACD,MAAM,IAAI,GAAG,KAAsB,CAAC;QACpC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE;YAC7B,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM;SACrC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,aAAa;YAAE,MAAM,KAAK,CAAC;QAChD,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,+BAA+B,EAC/B;YACI,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,KAAK;SACf,CACJ,CAAC;IACN,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC;AAED,KAAK,UAAU,MAAM,CACjB,KAAa,EACb,QAAqC,EACrC,QAAgB,EAChB,OAIC;IAED,IAAI,MAAgD,CAAC;IACrD,IAAI,CAAC;QACD,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,yBAAyB,EACzB,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;IACN,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,oDAAoD,CACvD,CAAC;IACN,CAAC;IAED,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE;gBAC3D,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ;gBACR,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;aAC9C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IACI,OAAO,KAAK,CAAC;gBACb,KAAK,YAAY,UAAU,CAAC,iBAAiB,EAC/C,CAAC;gBACC,SAAS;YACb,CAAC;YACD,IAAI,KAAK,YAAY,aAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;IACL,CAAC;IACD,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,iCAAiC,CACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,KAAa,EACb,QAAqC,EACrC,OAMC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzE,IACI,OAAO,CAAC,IAAI,KAAK,QAAQ;QACzB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC3D,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC9D,CAAC;QACC,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,iCAAiC,CACpC,CAAC;IACN,CAAC;IACD,OAAO;QACH,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,SAAS;QAC3B,SAAS,EAAE,OAAO,CAAC,GAAG;QACtB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,KAAa,EACb,QAAqC,EACrC,OAMC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzE,IACI,OAAO,CAAC,IAAI,KAAK,IAAI;QACrB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EACjC,CAAC;QACC,MAAM,IAAI,aAAa,CACnB,0BAA0B,EAC1B,6BAA6B,CAChC,CAAC;IACN,CAAC;IACD,IAAI,OAAO,CAAC,KAAK;QACb,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAA2B,CAAC,CAAC;IACpE,OAAO;QACH,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC;QAC5B,SAAS,EAAE,OAAO,CAAC,GAAG;QACtB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,cAAc,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,kBAAkB,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;AACN,CAAC;AAED,MAAM,UAAU,cAAc;IAC1B,SAAS,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@elixpo/accounts",
+  "version": "1.0.1",
+  "description": "Standards-first OAuth and OpenID Connect SDK for Elixpo Accounts",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/elixpo/accounts.elixpo.git",
+    "directory": "packages/accounts"
+  },
+  "homepage": "https://accounts.elixpo.com/docs/lixaccounts",
+  "bugs": "https://github.com/elixpo/accounts.elixpo/issues",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js",
+      "default": "./dist/core/index.js"
+    },
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js",
+      "default": "./dist/core/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/core/index.js",
+  "types": "./dist/core/index.d.ts",
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "clean": "rm -rf dist",
+    "pack:check": "npm run build && npm pack --dry-run"
+  },
+  "dependencies": {
+    "jose": "^5.9.6"
+  },
+  "devDependencies": {
+    "typescript": "^5"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}