@fluixi/oauth2 1.0.0-alpha.1 → 1.0.0-alpha.100

package/dist/backchannel.mjs

@@ -0,0 +1,307 @@
+import {
+  OAuthError
+} from "./chunk-OGSFNTKA.mjs";
+import "./chunk-7P6ASYW6.mjs";
+
+// src/discovery.ts
+var cache = /* @__PURE__ */ new Map();
+function documentUrl(issuer) {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+async function discover(issuer, fetcher = fetch) {
+  const cached = cache.get(issuer);
+  if (cached) return cached;
+  const pending = (async () => {
+    let response;
+    try {
+      response = await fetcher(documentUrl(issuer));
+    } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
+      throw new OAuthError(
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
+        "discovery_unreachable"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthError(
+        `Discovery failed for ${issuer}: ${response.status}`,
+        "discovery_failed"
+      );
+    }
+    const doc = await response.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new OAuthError(
+        `${issuer} published a discovery document with no authorization or token endpoint.`,
+        "discovery_incomplete"
+      );
+    }
+    return {
+      authorization: doc.authorization_endpoint,
+      token: doc.token_endpoint,
+      userinfo: doc.userinfo_endpoint,
+      endSession: doc.end_session_endpoint,
+      jwks: doc.jwks_uri,
+      introspection: doc.introspection_endpoint,
+      revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
+      issuer: doc.issuer ?? issuer
+    };
+  })();
+  cache.set(issuer, pending);
+  pending.catch(() => cache.delete(issuer));
+  return pending;
+}
+
+// src/verify.ts
+var TokenError = class extends OAuthError {
+  constructor(message, code = "invalid_token") {
+    super(message, code);
+    this.name = "TokenError";
+  }
+};
+function bearerOf(request) {
+  const header = request.headers.get("authorization");
+  if (!header) return null;
+  const match = header.match(/^(?:Bearer|DPoP)\s+(.+)$/i);
+  return match ? match[1].trim() : null;
+}
+async function loadJose() {
+  try {
+    return await import("./browser-FDUOEUM2.mjs");
+  } catch {
+    throw new OAuthError(
+      "Token verification needs `jose`. Install it: npm i jose. It is an optional peer so an app that does not verify does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+function createTokenVerifier(options) {
+  const issuers = (Array.isArray(options.issuer) ? options.issuer : [options.issuer]).filter(Boolean);
+  if (!issuers.length) {
+    throw new Error("[fluixi/oauth2] createTokenVerifier needs an issuer to accept tokens from.");
+  }
+  const discoveryIssuer = issuers[0];
+  if (options.audience === void 0) {
+    throw new Error(
+      "[fluixi/oauth2] createTokenVerifier needs an audience, or `audience: false` to say this service really does accept a token minted for any client of the issuer."
+    );
+  }
+  if (options.audience === false && options.authorizedParty === void 0) {
+    console.warn(
+      "[fluixi/oauth2] This verifier checks neither `aud` nor `azp`, so a token minted for any client of the issuer is accepted. Set `authorizedParty` if that is not what you meant."
+    );
+  }
+  const algorithms = options.algorithms ?? ["RS256"];
+  if (algorithms.some((alg) => !alg || alg.toLowerCase() === "none")) {
+    throw new Error("[fluixi/oauth2] `none` is not a signing algorithm and cannot be accepted.");
+  }
+  let keys = null;
+  async function keySet() {
+    if (keys) return keys;
+    const jose = await loadJose();
+    if (options.jwks) {
+      keys = jose.createLocalJWKSet(options.jwks);
+      return keys;
+    }
+    let uri = options.jwksUri;
+    if (!uri) {
+      const endpoints = await discover(discoveryIssuer);
+      uri = endpoints.jwks;
+    }
+    if (!uri) {
+      throw new OAuthError(
+        `${discoveryIssuer} published no jwks_uri. Give the verifier one directly.`,
+        "no_jwks"
+      );
+    }
+    keys = jose.createRemoteJWKSet(new URL(uri));
+    return keys;
+  }
+  const checkProof = async (claims, token, request) => {
+    const jose = await loadJose();
+    const { boundKeyOf, thumbprintOf } = await import("./dpop-YPGCGL7S.mjs");
+    const bound = boundKeyOf(claims);
+    if (!bound) {
+      throw new TokenError(
+        "This token is not bound to a key, and this service requires binding.",
+        "token_not_bound"
+      );
+    }
+    const proof = request.headers.get("dpop");
+    if (!proof) throw new TokenError("The request carried no DPoP proof.", "missing_dpop_proof");
+    let payload;
+    let header;
+    try {
+      const result = await jose.jwtVerify(proof, jose.EmbeddedJWK, { typ: "dpop+jwt" });
+      payload = result.payload;
+      header = result.protectedHeader;
+    } catch (cause) {
+      throw new TokenError(
+        `The DPoP proof did not verify: ${cause instanceof Error ? cause.message : String(cause)}`,
+        "invalid_dpop_proof"
+      );
+    }
+    const presented = await thumbprintOf(header.jwk);
+    if (presented !== bound) {
+      throw new TokenError(
+        "The DPoP proof was signed with a different key from the one this token is bound to.",
+        "dpop_key_mismatch"
+      );
+    }
+    const url = new URL(request.url);
+    url.search = "";
+    url.hash = "";
+    if (payload.htm !== request.method.toUpperCase()) {
+      throw new TokenError("The DPoP proof was made for a different method.", "invalid_dpop_proof");
+    }
+    if (payload.htu !== url.toString()) {
+      throw new TokenError("The DPoP proof was made for a different URL.", "invalid_dpop_proof");
+    }
+    if (typeof payload.ath === "string") {
+      const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+      let binary = "";
+      for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+      const expected = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+      if (payload.ath !== expected) {
+        throw new TokenError("The DPoP proof was made for a different token.", "invalid_dpop_proof");
+      }
+    }
+    const age = Math.abs(Date.now() / 1e3 - payload.iat);
+    if (!Number.isFinite(age) || age > (options.dpopProofAgeSec ?? 10)) {
+      throw new TokenError("The DPoP proof is too old to accept.", "invalid_dpop_proof");
+    }
+  };
+  const verify = async (token, request) => {
+    if (!token) throw new TokenError("No token to verify.", "no_token");
+    const jose = await loadJose();
+    let payload;
+    try {
+      ({ payload } = await jose.jwtVerify(token, await keySet(), {
+        // jose takes a list and accepts any of them, which is what a provider naming
+        // itself two ways needs.
+        issuer: issuers,
+        ...options.audience === false ? {} : { audience: options.audience },
+        algorithms,
+        clockTolerance: options.clockToleranceSec ?? 5
+      }));
+    } catch (cause) {
+      throw new TokenError(
+        `The token was not accepted: ${cause instanceof Error ? cause.message : String(cause)}`
+      );
+    }
+    if (options.authorizedParty !== void 0) {
+      const allowed = Array.isArray(options.authorizedParty) ? options.authorizedParty : [options.authorizedParty];
+      const issuedTo = payload.azp ?? payload.client_id;
+      if (typeof issuedTo !== "string" || !allowed.includes(issuedTo)) {
+        throw new TokenError("The token was issued to a different client.", "invalid_azp");
+      }
+    }
+    if (options.dpop) {
+      if (!request) {
+        throw new Error(
+          "[fluixi/oauth2] `dpop: true` needs the request to read its proof. Use `verify.fromRequest(request)` rather than verifying a bare token."
+        );
+      }
+      await checkProof(payload, token, request);
+    }
+    if (options.require) {
+      const verdict = options.require(payload);
+      if (verdict !== true) {
+        throw new TokenError(
+          typeof verdict === "string" ? verdict : "The token did not meet this service's requirements.",
+          "insufficient_claims"
+        );
+      }
+    }
+    return payload;
+  };
+  const verifier = verify;
+  verifier.bearerOf = bearerOf;
+  verifier.fromRequest = async (request) => {
+    const token = verifier.bearerOf(request);
+    if (!token) {
+      throw new TokenError("The request carried no bearer token.", "no_token");
+    }
+    return verify(token, request);
+  };
+  return verifier;
+}
+
+// src/backchannel.ts
+var LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+function memoryLogouts(ttlMs = 14 * 24 * 36e5) {
+  const sids = /* @__PURE__ */ new Map();
+  const subs = /* @__PURE__ */ new Map();
+  const prune = (now) => {
+    for (const map of [sids, subs]) for (const [key, at] of map) if (now - at > ttlMs) map.delete(key);
+  };
+  return {
+    add(entry) {
+      prune(Date.now());
+      if (entry.sid) sids.set(entry.sid, entry.at);
+      else if (entry.sub) subs.set(entry.sub, Math.max(entry.at, subs.get(entry.sub) ?? 0));
+    },
+    ended(session) {
+      if (session.sid && sids.has(session.sid)) return true;
+      const all = session.sub ? subs.get(session.sub) : void 0;
+      return all !== void 0 && session.since <= all;
+    }
+  };
+}
+function idTokenClaims(idToken) {
+  if (!idToken) return {};
+  try {
+    const part = idToken.split(".")[1] ?? "";
+    const json = atob(part.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(part.length / 4) * 4, "="));
+    const claims = JSON.parse(json);
+    return {
+      sid: typeof claims.sid === "string" ? claims.sid : void 0,
+      sub: typeof claims.sub === "string" ? claims.sub : void 0,
+      iat: typeof claims.iat === "number" ? claims.iat : void 0
+    };
+  } catch {
+    return {};
+  }
+}
+function headerOf(token) {
+  try {
+    const part = token.split(".")[0] ?? "";
+    return JSON.parse(atob(part.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(part.length / 4) * 4, "=")));
+  } catch {
+    return {};
+  }
+}
+function logoutTokenVerifier(options) {
+  const verify = createTokenVerifier({
+    issuer: options.issuer,
+    audience: options.clientId,
+    jwksUri: options.jwksUri,
+    jwks: options.jwks,
+    require: (claims) => {
+      const events = claims.events;
+      if (!events || typeof events !== "object" || !(LOGOUT_EVENT in events)) return "no logout event";
+      if ("nonce" in claims) return "a logout token has no nonce";
+      if (typeof claims.sid !== "string" && typeof claims.sub !== "string") return "names no session and no subject";
+      return true;
+    }
+  });
+  return async (token) => {
+    const typ = headerOf(token).typ;
+    if (typ !== void 0 && typ !== "logout+jwt") throw new Error("not a logout token");
+    const claims = await verify(token);
+    return {
+      sid: typeof claims.sid === "string" ? claims.sid : void 0,
+      sub: typeof claims.sub === "string" ? claims.sub : void 0,
+      at: (typeof claims.iat === "number" ? claims.iat : Math.floor(Date.now() / 1e3)) * 1e3
+    };
+  };
+}
+export {
+  LOGOUT_EVENT,
+  idTokenClaims,
+  logoutTokenVerifier,
+  memoryLogouts
+};

package/dist/{browser-ONMHX3Z3.mjs → browser-TV25RBLT.mjs}

@@ -1,7 +1,7 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.100 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 import {
   __export
-} from "./chunk-25WE6UWI.mjs";
+} from "./chunk-KTGVSZE6.mjs";
 
 // ../../node_modules/.pnpm/jose@5.10.0/node_modules/jose/dist/browser/runtime/webcrypto.js
 var webcrypto_default = crypto;

package/dist/browser.cjs

@@ -165,9 +165,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -305,8 +307,12 @@ async function discover(issuer, fetcher = fetch) {
     try {
       response = await fetcher(documentUrl(issuer));
     } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
       throw new OAuthError(
-        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
         "discovery_unreachable"
       );
     }
@@ -331,6 +337,7 @@ async function discover(issuer, fetcher = fetch) {
       jwks: doc.jwks_uri,
       introspection: doc.introspection_endpoint,
       revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
       issuer: doc.issuer ?? issuer
     };
   })();

package/dist/browser.mjs

@@ -131,9 +131,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -271,8 +273,12 @@ async function discover(issuer, fetcher = fetch) {
     try {
       response = await fetcher(documentUrl(issuer));
     } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
       throw new OAuthError(
-        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
         "discovery_unreachable"
       );
     }
@@ -297,6 +303,7 @@ async function discover(issuer, fetcher = fetch) {
       jwks: doc.jwks_uri,
       introspection: doc.introspection_endpoint,
       revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
       issuer: doc.issuer ?? issuer
     };
   })();

package/dist/callback.cjs

@@ -25,15 +25,16 @@ __export(callback_exports, {
 });
 module.exports = __toCommonJS(callback_exports);
 var import_core = require("@fluixi/core");
-var import_signal = require("@fluixi/reactive/signal");
-var import_di2 = require("@fluixi/start/di");
+var import_signal2 = require("@fluixi/reactive/signal");
+var import_di2 = require("@fluixi/di");
 
 // src/tokens.ts
-var import_di = require("@fluixi/start/di");
+var import_di = require("@fluixi/di");
 var AuthServiceToken = (0, import_di.injectionToken)("AuthService");
 var AuthClientToken = (0, import_di.injectionToken)("AuthClient");
 
 // src/service.ts
+var import_signal = require("@fluixi/reactive/signal");
 var import_session = require("@fluixi/session");
 var import_client = require("@fluixi/auth/client");
 function paramsFromUrl(url) {
@@ -55,10 +56,10 @@ function reasonFor(cause) {
 }
 var spent = /* @__PURE__ */ new Set();
 function useOAuthCallback(options = {}) {
-  const stage = (0, import_signal.signal)("waiting");
-  const error = (0, import_signal.signal)(null);
-  const destination = (0, import_signal.signal)(null);
-  const params = (0, import_signal.signal)({});
+  const stage = (0, import_signal2.signal)("waiting");
+  const error = (0, import_signal2.signal)(null);
+  const destination = (0, import_signal2.signal)(null);
+  const params = (0, import_signal2.signal)({});
   let lastQuery = null;
   let injected = null;
   let injectionError = null;

package/dist/callback.js

@@ -23,7 +23,7 @@
  */
 import { onMount } from '@fluixi/core';
 import { signal } from '@fluixi/reactive/signal';
-import { inject } from '@fluixi/start/di';
+import { inject } from '@fluixi/di';
 import { AuthServiceToken } from './tokens.js';
 import { paramsFromUrl } from './service.js';
 /** The message for a failure, preferring the provider's own words. */

package/dist/callback.mjs

@@ -3,14 +3,15 @@ import "./chunk-7P6ASYW6.mjs";
 // src/callback.ts
 import { onMount } from "@fluixi/core";
 import { signal } from "@fluixi/reactive/signal";
-import { inject } from "@fluixi/start/di";
+import { inject } from "@fluixi/di";
 
 // src/tokens.ts
-import { injectionToken } from "@fluixi/start/di";
+import { injectionToken } from "@fluixi/di";
 var AuthServiceToken = injectionToken("AuthService");
 var AuthClientToken = injectionToken("AuthClient");
 
 // src/service.ts
+import { createSignal, markReactiveScope, openReactiveScope, withReactiveScope } from "@fluixi/reactive/signal";
 import { createSession } from "@fluixi/session";
 import { createAuthHooks } from "@fluixi/auth/client";
 function paramsFromUrl(url) {

package/dist/{chunk-4NSOGPLM.mjs → chunk-2B3I72DV.mjs}

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.100 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 
 // src/types.ts
 var OAuthError = class extends Error {

package/dist/chunk-KOP5Z4LB.mjs

@@ -0,0 +1,108 @@
+/*! @fluixi/oauth2 v1.0.0-alpha.100 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/dpop.ts
+async function loadJose() {
+  try {
+    return await import("./browser-TV25RBLT.mjs");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256", options = {}) {
+  const jose = await loadJose();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function exportDpopKey(key) {
+  const jose = await loadJose();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+async function importDpopKey(stored) {
+  const jose = await loadJose();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
+async function thumbprintOf(jwk) {
+  const jose = await loadJose();
+  return jose.calculateJwkThumbprint(jwk, "sha256");
+}
+async function proofFor(key, options) {
+  const jose = await loadJose();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+function wantsNonce(error, response) {
+  const code = typeof error === "string" ? error : error?.error;
+  return code === "use_dpop_nonce" || !!response && !!nonceFrom(response);
+}
+function boundKeyOf(claims) {
+  const cnf = claims.cnf;
+  return typeof cnf?.jkt === "string" ? cnf.jkt : null;
+}
+
+export {
+  OAuthError,
+  createDpopKey,
+  exportDpopKey,
+  importDpopKey,
+  thumbprintOf,
+  proofFor,
+  nonceFrom,
+  wantsNonce,
+  boundKeyOf
+};

package/dist/{chunk-25WE6UWI.mjs → chunk-KTGVSZE6.mjs}

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.100 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)

package/dist/discovery.cjs

@@ -48,8 +48,12 @@ async function discover(issuer, fetcher = fetch) {
     try {
       response = await fetcher(documentUrl(issuer));
     } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
       throw new OAuthError(
-        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
         "discovery_unreachable"
       );
     }
@@ -74,6 +78,7 @@ async function discover(issuer, fetcher = fetch) {
       jwks: doc.jwks_uri,
       introspection: doc.introspection_endpoint,
       revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
       issuer: doc.issuer ?? issuer
     };
   })();

package/dist/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAsB5C,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAkDhG;AAED,2CAA2C;AAC3C,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAuB5C,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAuDhG;AAED,2CAA2C;AAC3C,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/dist/discovery.js

@@ -18,7 +18,11 @@ export async function discover(issuer, fetcher = fetch) {
             // `fetch` reports only "Failed to fetch". Not every provider allows a page to read
             // its discovery document: Keycloak does once an origin is configured, Dex and
             // Google do not. Naming the cause saves a long hunt for a network fault.
-            throw new OAuthError(`Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`, 'discovery_unreachable');
+            const why = cause instanceof Error ? cause.message : String(cause);
+            throw new OAuthError(typeof window === 'undefined'
+                ? // On a server nothing blocks the read: the provider is down, or the address is wrong.
+                    `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+                : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`, 'discovery_unreachable');
         }
         if (!response.ok) {
             throw new OAuthError(`Discovery failed for ${issuer}: ${response.status}`, 'discovery_failed');
@@ -35,6 +39,7 @@ export async function discover(issuer, fetcher = fetch) {
             jwks: doc.jwks_uri,
             introspection: doc.introspection_endpoint,
             revocation: doc.revocation_endpoint,
+            checkSession: doc.check_session_iframe,
             issuer: doc.issuer ?? issuer,
         };
     })();

package/dist/discovery.mjs

@@ -21,8 +21,12 @@ async function discover(issuer, fetcher = fetch) {
     try {
       response = await fetcher(documentUrl(issuer));
     } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
       throw new OAuthError(
-        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
         "discovery_unreachable"
       );
     }
@@ -47,6 +51,7 @@ async function discover(issuer, fetcher = fetch) {
       jwks: doc.jwks_uri,
       introspection: doc.introspection_endpoint,
       revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
       issuer: doc.issuer ?? issuer
     };
   })();

package/dist/dpop-O3HWR7AH.mjs

@@ -0,0 +1,22 @@
+/*! @fluixi/oauth2 v1.0.0-alpha.100 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import {
+  boundKeyOf,
+  createDpopKey,
+  exportDpopKey,
+  importDpopKey,
+  nonceFrom,
+  proofFor,
+  thumbprintOf,
+  wantsNonce
+} from "./chunk-KOP5Z4LB.mjs";
+import "./chunk-KTGVSZE6.mjs";
+export {
+  boundKeyOf,
+  createDpopKey,
+  exportDpopKey,
+  importDpopKey,
+  nonceFrom,
+  proofFor,
+  thumbprintOf,
+  wantsNonce
+};