@keycardai/oauth 0.16.0 → 0.18.0

package/dist/cjs/challenge.d.ts

@@ -0,0 +1,41 @@
+import { type AuthenticateOptions } from "./pkce.js";
+import type { TokenResponse } from "./tokenExchange.js";
+export interface ResolveIssuerFromChallengeOptions {
+    signal?: AbortSignal;
+}
+export interface ResolvedChallenge {
+    /** The authorization server issuer URL (first entry of `authorization_servers`). */
+    issuer: string;
+    /** The protected resource identifier from the metadata document, when present. */
+    resource?: string;
+}
+/**
+ * Resolve the authorization server issuer from a `WWW-Authenticate` challenge
+ * (RFC 9728).
+ *
+ * Parses the `resource_metadata` URL out of the header, fetches the protected
+ * resource metadata document, and returns the first entry of its
+ * `authorization_servers` array as the issuer, along with the document's
+ * `resource` identifier when present.
+ *
+ * Throws an `Error` when the header has no `resource_metadata` parameter, the
+ * metadata fetch fails, or the document is missing a valid
+ * `authorization_servers` array.
+ */
+export declare function resolveIssuerFromChallenge(wwwAuthenticateHeader: string, options?: ResolveIssuerFromChallengeOptions): Promise<ResolvedChallenge>;
+/**
+ * Full authorization-code-with-PKCE flow driven by a `WWW-Authenticate`
+ * challenge from a protected resource.
+ *
+ * Resolves the authorization server issuer from the challenge's
+ * `resource_metadata` document (RFC 9728) via `resolveIssuerFromChallenge`,
+ * then runs `authenticate()` against it. When the caller does not set
+ * `options.resource`, it defaults to the `resource` identifier from the
+ * metadata document, scoping the issued token's audience to that resource.
+ *
+ * **Requires Node.js.** Uses `node:http` and `node:child_process` via
+ * dynamic import. Importing this module is safe in any runtime; only
+ * *calling* `authenticateFromChallenge()` requires Node.js.
+ */
+export declare function authenticateFromChallenge(wwwAuthenticateHeader: string, options: AuthenticateOptions): Promise<TokenResponse>;
+//# sourceMappingURL=challenge.d.ts.map

package/dist/cjs/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,MAAM,WAAW,iCAAiC;IAChD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,qBAAqB,EAAE,MAAM,EAC7B,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,iBAAiB,CAAC,CA6C5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,qBAAqB,EAAE,MAAM,EAC7B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAMxB"}

package/dist/cjs/challenge.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveIssuerFromChallenge = resolveIssuerFromChallenge;
+exports.authenticateFromChallenge = authenticateFromChallenge;
+const pkce_js_1 = require("./pkce.js");
+/**
+ * Extract the `resource_metadata` parameter value from a `WWW-Authenticate`
+ * header (RFC 9728 §5.1). Handles quoted values alongside other challenge
+ * parameters (e.g. `realm`, `error`). Returns undefined when absent.
+ */
+function extractResourceMetadataUrl(wwwAuthenticateHeader) {
+    // Quoted form: resource_metadata="https://..."
+    const quoted = /resource_metadata\s*=\s*"([^"]+)"/.exec(wwwAuthenticateHeader);
+    if (quoted) {
+        return quoted[1];
+    }
+    // Unquoted token form: resource_metadata=https://... (terminated by comma,
+    // whitespace, or end of header).
+    const unquoted = /resource_metadata\s*=\s*([^",\s]+)/.exec(wwwAuthenticateHeader);
+    return unquoted ? unquoted[1] : undefined;
+}
+/**
+ * Resolve the authorization server issuer from a `WWW-Authenticate` challenge
+ * (RFC 9728).
+ *
+ * Parses the `resource_metadata` URL out of the header, fetches the protected
+ * resource metadata document, and returns the first entry of its
+ * `authorization_servers` array as the issuer, along with the document's
+ * `resource` identifier when present.
+ *
+ * Throws an `Error` when the header has no `resource_metadata` parameter, the
+ * metadata fetch fails, or the document is missing a valid
+ * `authorization_servers` array.
+ */
+async function resolveIssuerFromChallenge(wwwAuthenticateHeader, options = {}) {
+    const metadataUrl = extractResourceMetadataUrl(wwwAuthenticateHeader);
+    if (!metadataUrl) {
+        throw new Error("WWW-Authenticate header does not contain a resource_metadata parameter (RFC 9728)");
+    }
+    const response = await fetch(metadataUrl, { signal: options.signal });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch protected resource metadata from "${metadataUrl}" (HTTP ${response.status})`);
+    }
+    let json;
+    try {
+        json = await response.json();
+    }
+    catch {
+        throw new Error(`Protected resource metadata at "${metadataUrl}" is not valid JSON`);
+    }
+    if (!json || typeof json !== "object" || Array.isArray(json)) {
+        throw new Error(`Protected resource metadata at "${metadataUrl}" is not a JSON object`);
+    }
+    const document = json;
+    const authorizationServers = document.authorization_servers;
+    if (!Array.isArray(authorizationServers) ||
+        authorizationServers.length === 0 ||
+        !authorizationServers.every((entry) => typeof entry === "string")) {
+        throw new Error(`Protected resource metadata at "${metadataUrl}" does not contain a non-empty authorization_servers array`);
+    }
+    return {
+        issuer: authorizationServers[0],
+        resource: typeof document.resource === "string" ? document.resource : undefined,
+    };
+}
+/**
+ * Full authorization-code-with-PKCE flow driven by a `WWW-Authenticate`
+ * challenge from a protected resource.
+ *
+ * Resolves the authorization server issuer from the challenge's
+ * `resource_metadata` document (RFC 9728) via `resolveIssuerFromChallenge`,
+ * then runs `authenticate()` against it. When the caller does not set
+ * `options.resource`, it defaults to the `resource` identifier from the
+ * metadata document, scoping the issued token's audience to that resource.
+ *
+ * **Requires Node.js.** Uses `node:http` and `node:child_process` via
+ * dynamic import. Importing this module is safe in any runtime; only
+ * *calling* `authenticateFromChallenge()` requires Node.js.
+ */
+async function authenticateFromChallenge(wwwAuthenticateHeader, options) {
+    const { issuer, resource } = await resolveIssuerFromChallenge(wwwAuthenticateHeader);
+    return (0, pkce_js_1.authenticate)(issuer, {
+        ...options,
+        resource: options.resource ?? resource,
+    });
+}
+//# sourceMappingURL=challenge.js.map

package/dist/cjs/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../src/challenge.ts"],"names":[],"mappings":";;AAgDA,gEAgDC;AAgBD,8DASC;AAzHD,uCAAmE;AAkBnE;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,qBAA6B;IAC/D,+CAA+C;IAC/C,MAAM,MAAM,GAAG,mCAAmC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC/E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,QAAQ,GAAG,oCAAoC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,0BAA0B,CAC9C,qBAA6B,EAC7B,UAA6C,EAAE;IAE/C,MAAM,WAAW,GAAG,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qDAAqD,WAAW,WAAW,QAAQ,CAAC,MAAM,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAa,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mCAAmC,WAAW,qBAAqB,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,mCAAmC,WAAW,wBAAwB,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAA+B,CAAC;IAEjD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAC5D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACpC,oBAAoB,CAAC,MAAM,KAAK,CAAC;QACjC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAClF,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mCAAmC,WAAW,4DAA4D,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC/B,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,yBAAyB,CAC7C,qBAA6B,EAC7B,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IACrF,OAAO,IAAA,sBAAY,EAAC,MAAM,EAAE;QAC1B,GAAG,OAAO;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ;KACvC,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/index.d.ts

@@ -19,4 +19,6 @@ export { AccessContext, TokenVerifier, ClientSecret } from "./server/index.js";
 export type { ErrorDetail, AccessContextStatus, AccessToken, TokenVerifierOptions, ClientSecretCredentials, } from "./server/index.js";
 export { generateCodeVerifier, generateCodeChallenge, generatePkcePair, exchangeAuthorizationCode, buildAuthorizeUrl, authenticate, } from "./pkce.js";
 export type { Pkce, ExchangeAuthorizationCodeOptions, AuthorizeUrlParams, AuthenticateOptions, } from "./pkce.js";
+export { resolveIssuerFromChallenge, authenticateFromChallenge } from "./challenge.js";
+export type { ResolveIssuerFromChallengeOptions, ResolvedChallenge, } from "./challenge.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,EAC9B,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,IAAI,EACJ,gCAAgC,EAChC,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,EAC9B,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,IAAI,EACJ,gCAAgC,EAChC,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACvF,YAAY,EACV,iCAAiC,EACjC,iBAAiB,GAClB,MAAM,gBAAgB,CAAC"}

package/dist/cjs/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = exports.buildAuthorizeUrl = exports.exchangeAuthorizationCode = exports.generatePkcePair = exports.generateCodeChallenge = exports.generateCodeVerifier = exports.ClientSecret = exports.TokenVerifier = exports.AccessContext = exports.registerClient = exports.ClientCredentialsClient = exports.TokenType = exports.TokenExchangeClient = exports.buildSubstituteUserToken = exports.JWTVerifier = exports.JWTSigner = exports.JWKSKeyNotFoundError = exports.JWKSFetchError = exports.JWKSUriValidationError = exports.JWKSDiscoveryError = exports.JWKSError = exports.AuthProviderConfigurationError = exports.ResourceAccessError = exports.InsufficientScopeError = exports.InvalidTokenError = exports.OAuthError = exports.UnauthorizedError = exports.BadRequestError = exports.HTTPError = exports.fetchAuthorizationServerMetadata = exports.base64url = exports.JWKSOAuthKeyring = void 0;
+exports.authenticateFromChallenge = exports.resolveIssuerFromChallenge = exports.authenticate = exports.buildAuthorizeUrl = exports.exchangeAuthorizationCode = exports.generatePkcePair = exports.generateCodeChallenge = exports.generateCodeVerifier = exports.ClientSecret = exports.TokenVerifier = exports.AccessContext = exports.registerClient = exports.ClientCredentialsClient = exports.TokenType = exports.TokenExchangeClient = exports.buildSubstituteUserToken = exports.JWTVerifier = exports.JWTSigner = exports.JWKSKeyNotFoundError = exports.JWKSFetchError = exports.JWKSUriValidationError = exports.JWKSDiscoveryError = exports.JWKSError = exports.AuthProviderConfigurationError = exports.ResourceAccessError = exports.InsufficientScopeError = exports.InvalidTokenError = exports.OAuthError = exports.UnauthorizedError = exports.BadRequestError = exports.HTTPError = exports.fetchAuthorizationServerMetadata = exports.base64url = exports.JWKSOAuthKeyring = void 0;
 var keyring_js_1 = require("./keyring.js");
 Object.defineProperty(exports, "JWKSOAuthKeyring", { enumerable: true, get: function () { return keyring_js_1.JWKSOAuthKeyring; } });
 var base64url_js_1 = require("./base64url.js");
@@ -48,4 +48,7 @@ Object.defineProperty(exports, "generatePkcePair", { enumerable: true, get: func
 Object.defineProperty(exports, "exchangeAuthorizationCode", { enumerable: true, get: function () { return pkce_js_1.exchangeAuthorizationCode; } });
 Object.defineProperty(exports, "buildAuthorizeUrl", { enumerable: true, get: function () { return pkce_js_1.buildAuthorizeUrl; } });
 Object.defineProperty(exports, "authenticate", { enumerable: true, get: function () { return pkce_js_1.authenticate; } });
+var challenge_js_1 = require("./challenge.js");
+Object.defineProperty(exports, "resolveIssuerFromChallenge", { enumerable: true, get: function () { return challenge_js_1.resolveIssuerFromChallenge; } });
+Object.defineProperty(exports, "authenticateFromChallenge", { enumerable: true, get: function () { return challenge_js_1.authenticateFromChallenge; } });
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;AACA,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA;AACzB,+CAAsD;AAA7C,0HAAA,OAAO,OAAa;AAC7B,+CAAkE;AAAzD,gIAAA,gCAAgC,OAAA;AAEzC,yCAcqB;AAbnB,sGAAA,SAAS,OAAA;AACT,4GAAA,eAAe,OAAA;AACf,8GAAA,iBAAiB,OAAA;AACjB,uGAAA,UAAU,OAAA;AACV,8GAAA,iBAAiB,OAAA;AACjB,mHAAA,sBAAsB,OAAA;AACtB,gHAAA,mBAAmB,OAAA;AACnB,2HAAA,8BAA8B,OAAA;AAC9B,sGAAA,SAAS,OAAA;AACT,+GAAA,kBAAkB,OAAA;AAClB,mHAAA,sBAAsB,OAAA;AACtB,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AAEtB,6CAA4C;AAAnC,sGAAA,SAAS,OAAA;AAElB,iDAAgD;AAAvC,0GAAA,WAAW,OAAA;AACpB,6DAAmE;AAA1D,6HAAA,wBAAwB,OAAA;AACjC,uDAAoE;AAA3D,uHAAA,mBAAmB,OAAA;AAAE,6GAAA,SAAS,OAAA;AAQvC,+DAAiE;AAAxD,+HAAA,uBAAuB,OAAA;AAOhC,qDAAmD;AAA1C,iHAAA,cAAc,OAAA;AAMvB,8CAA+E;AAAtE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,wGAAA,YAAY,OAAA;AAQnD,qCAOmB;AANjB,+GAAA,oBAAoB,OAAA;AACpB,gHAAA,qBAAqB,OAAA;AACrB,2GAAA,gBAAgB,OAAA;AAChB,oHAAA,yBAAyB,OAAA;AACzB,4GAAA,iBAAiB,OAAA;AACjB,uGAAA,YAAY,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;AACA,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA;AACzB,+CAAsD;AAA7C,0HAAA,OAAO,OAAa;AAC7B,+CAAkE;AAAzD,gIAAA,gCAAgC,OAAA;AAEzC,yCAcqB;AAbnB,sGAAA,SAAS,OAAA;AACT,4GAAA,eAAe,OAAA;AACf,8GAAA,iBAAiB,OAAA;AACjB,uGAAA,UAAU,OAAA;AACV,8GAAA,iBAAiB,OAAA;AACjB,mHAAA,sBAAsB,OAAA;AACtB,gHAAA,mBAAmB,OAAA;AACnB,2HAAA,8BAA8B,OAAA;AAC9B,sGAAA,SAAS,OAAA;AACT,+GAAA,kBAAkB,OAAA;AAClB,mHAAA,sBAAsB,OAAA;AACtB,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AAEtB,6CAA4C;AAAnC,sGAAA,SAAS,OAAA;AAElB,iDAAgD;AAAvC,0GAAA,WAAW,OAAA;AACpB,6DAAmE;AAA1D,6HAAA,wBAAwB,OAAA;AACjC,uDAAoE;AAA3D,uHAAA,mBAAmB,OAAA;AAAE,6GAAA,SAAS,OAAA;AAQvC,+DAAiE;AAAxD,+HAAA,uBAAuB,OAAA;AAOhC,qDAAmD;AAA1C,iHAAA,cAAc,OAAA;AAMvB,8CAA+E;AAAtE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,wGAAA,YAAY,OAAA;AAQnD,qCAOmB;AANjB,+GAAA,oBAAoB,OAAA;AACpB,gHAAA,qBAAqB,OAAA;AACrB,2GAAA,gBAAgB,OAAA;AAChB,oHAAA,yBAAyB,OAAA;AACzB,4GAAA,iBAAiB,OAAA;AACjB,uGAAA,YAAY,OAAA;AAQd,+CAAuF;AAA9E,0HAAA,0BAA0B,OAAA;AAAE,yHAAA,yBAAyB,OAAA"}

package/dist/cjs/server/accessContext.d.ts

@@ -9,6 +9,14 @@ export declare class AccessContext {
     setBulkTokens(tokens: Record<string, TokenResponse>): void;
     setResourceError(resource: string, error: ErrorDetail): void;
     setError(error: ErrorDetail): void;
+    /**
+     * Merge another context's tokens and errors into this one. Used when
+     * multiple grants stack on the same request: later results accumulate
+     * alongside earlier ones instead of replacing them. Per-resource entries
+     * from `other` win on conflict; a global error on `other` overwrites
+     * this context's global error.
+     */
+    merge(other: AccessContext): void;
     access(resource: string): TokenResponse;
     hasError(): boolean;
     hasResourceError(resource: string): boolean;

package/dist/cjs/server/accessContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accessContext.d.ts","sourceRoot":"","sources":["../../../src/server/accessContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,eAAe,GAAG,OAAO,CAAC;AAExE,qBAAa,aAAa;;gBAKZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;IAMxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IAKtD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI;IAM1D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI;IAK5D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAIlC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IA2BvC,QAAQ,IAAI,OAAO;IAInB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI3C,SAAS,IAAI,OAAO;IAIpB,QAAQ,IAAI,WAAW,GAAG,IAAI;IAI9B,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAItD,SAAS,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE;IAOlF,SAAS,IAAI,mBAAmB;IAMhC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,kBAAkB,IAAI,MAAM,EAAE;CAG/B"}
+{"version":3,"file":"accessContext.d.ts","sourceRoot":"","sources":["../../../src/server/accessContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,eAAe,GAAG,OAAO,CAAC;AAExE,qBAAa,aAAa;;gBAKZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;IAMxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IAKtD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI;IAM1D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI;IAK5D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAIlC;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IAYjC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IA2BvC,QAAQ,IAAI,OAAO;IAInB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI3C,SAAS,IAAI,OAAO;IAIpB,QAAQ,IAAI,WAAW,GAAG,IAAI;IAI9B,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAItD,SAAS,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE;IAOlF,SAAS,IAAI,mBAAmB;IAMhC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,kBAAkB,IAAI,MAAM,EAAE;CAG/B"}

package/dist/cjs/server/accessContext.js

@@ -39,6 +39,24 @@ class AccessContext {
     setError(error) {
         __classPrivateFieldSet(this, _AccessContext_error, error, "f");
     }
+    /**
+     * Merge another context's tokens and errors into this one. Used when
+     * multiple grants stack on the same request: later results accumulate
+     * alongside earlier ones instead of replacing them. Per-resource entries
+     * from `other` win on conflict; a global error on `other` overwrites
+     * this context's global error.
+     */
+    merge(other) {
+        for (const [resource, token] of __classPrivateFieldGet(other, _AccessContext_accessTokens, "f")) {
+            this.setToken(resource, token);
+        }
+        for (const [resource, error] of __classPrivateFieldGet(other, _AccessContext_resourceErrors, "f")) {
+            this.setResourceError(resource, error);
+        }
+        if (__classPrivateFieldGet(other, _AccessContext_error, "f")) {
+            __classPrivateFieldSet(this, _AccessContext_error, __classPrivateFieldGet(other, _AccessContext_error, "f"), "f");
+        }
+    }
     access(resource) {
         if (__classPrivateFieldGet(this, _AccessContext_error, "f")) {
             throw new errors_js_1.ResourceAccessError(undefined, {

package/dist/cjs/server/accessContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessContext.js","sourceRoot":"","sources":["../../../src/server/accessContext.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACA,4CAAqE;AAMrE,MAAa,aAAa;IAKxB,YAAY,YAA4C;QAJxD,8CAA0C;QAC1C,gDAA0C;QAC1C,uCAA2B;QAGzB,uBAAA,IAAI,+BAAiB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAA,CAAC;QAC/E,uBAAA,IAAI,iCAAmB,IAAI,GAAG,EAAE,MAAA,CAAC;QACjC,uBAAA,IAAI,wBAAU,IAAI,MAAA,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,KAAoB;QAC7C,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxC,uBAAA,IAAI,qCAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,MAAqC;QACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,KAAkB;QACnD,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,uBAAA,IAAI,mCAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,QAAQ,CAAC,KAAkB;QACzB,uBAAA,IAAI,wBAAU,KAAK,MAAA,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,IAAI,uBAAA,IAAI,4BAAO,EAAE,CAAC;YAChB,MAAM,IAAI,+BAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,cAAc;gBACzB,YAAY,EAAE,uBAAA,IAAI,4BAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,+BAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,+BAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,eAAe;gBAC1B,kBAAkB,EAAE,CAAC,GAAG,uBAAA,IAAI,mCAAc,CAAC,IAAI,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ;QACN,OAAO,uBAAA,IAAI,4BAAO,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,uBAAA,IAAI,qCAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,QAAQ;QACN,OAAO,uBAAA,IAAI,4BAAO,CAAC;IACrB,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,SAAS;QACP,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,uBAAA,IAAI,qCAAgB,CAAC;YACnD,KAAK,EAAE,uBAAA,IAAI,4BAAO;SACnB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,IAAI,uBAAA,IAAI,4BAAO;YAAE,OAAO,OAAO,CAAC;QAChC,IAAI,uBAAA,IAAI,qCAAgB,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,eAAe,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sBAAsB;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAA,IAAI,mCAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAA,IAAI,qCAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;CACF;AAlGD,sCAkGC"}
+{"version":3,"file":"accessContext.js","sourceRoot":"","sources":["../../../src/server/accessContext.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACA,4CAAqE;AAMrE,MAAa,aAAa;IAKxB,YAAY,YAA4C;QAJxD,8CAA0C;QAC1C,gDAA0C;QAC1C,uCAA2B;QAGzB,uBAAA,IAAI,+BAAiB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAA,CAAC;QAC/E,uBAAA,IAAI,iCAAmB,IAAI,GAAG,EAAE,MAAA,CAAC;QACjC,uBAAA,IAAI,wBAAU,IAAI,MAAA,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,KAAoB;QAC7C,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxC,uBAAA,IAAI,qCAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,MAAqC;QACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,KAAkB;QACnD,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,uBAAA,IAAI,mCAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,QAAQ,CAAC,KAAkB;QACzB,uBAAA,IAAI,wBAAU,KAAK,MAAA,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAoB;QACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,uBAAA,KAAK,mCAAc,EAAE,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,uBAAA,KAAK,qCAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,uBAAA,KAAK,4BAAO,EAAE,CAAC;YACjB,uBAAA,IAAI,wBAAU,uBAAA,KAAK,4BAAO,MAAA,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,IAAI,uBAAA,IAAI,4BAAO,EAAE,CAAC;YAChB,MAAM,IAAI,+BAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,cAAc;gBACzB,YAAY,EAAE,uBAAA,IAAI,4BAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,+BAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,+BAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,eAAe;gBAC1B,kBAAkB,EAAE,CAAC,GAAG,uBAAA,IAAI,mCAAc,CAAC,IAAI,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ;QACN,OAAO,uBAAA,IAAI,4BAAO,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,uBAAA,IAAI,qCAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,QAAQ;QACN,OAAO,uBAAA,IAAI,4BAAO,CAAC;IACrB,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,SAAS;QACP,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,uBAAA,IAAI,qCAAgB,CAAC;YACnD,KAAK,EAAE,uBAAA,IAAI,4BAAO;SACnB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,IAAI,uBAAA,IAAI,4BAAO;YAAE,OAAO,OAAO,CAAC;QAChC,IAAI,uBAAA,IAAI,qCAAgB,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,eAAe,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sBAAsB;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAA,IAAI,mCAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAA,IAAI,qCAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;CACF;AArHD,sCAqHC"}

package/dist/esm/challenge.d.ts

@@ -0,0 +1,41 @@
+import { type AuthenticateOptions } from "./pkce.js";
+import type { TokenResponse } from "./tokenExchange.js";
+export interface ResolveIssuerFromChallengeOptions {
+    signal?: AbortSignal;
+}
+export interface ResolvedChallenge {
+    /** The authorization server issuer URL (first entry of `authorization_servers`). */
+    issuer: string;
+    /** The protected resource identifier from the metadata document, when present. */
+    resource?: string;
+}
+/**
+ * Resolve the authorization server issuer from a `WWW-Authenticate` challenge
+ * (RFC 9728).
+ *
+ * Parses the `resource_metadata` URL out of the header, fetches the protected
+ * resource metadata document, and returns the first entry of its
+ * `authorization_servers` array as the issuer, along with the document's
+ * `resource` identifier when present.
+ *
+ * Throws an `Error` when the header has no `resource_metadata` parameter, the
+ * metadata fetch fails, or the document is missing a valid
+ * `authorization_servers` array.
+ */
+export declare function resolveIssuerFromChallenge(wwwAuthenticateHeader: string, options?: ResolveIssuerFromChallengeOptions): Promise<ResolvedChallenge>;
+/**
+ * Full authorization-code-with-PKCE flow driven by a `WWW-Authenticate`
+ * challenge from a protected resource.
+ *
+ * Resolves the authorization server issuer from the challenge's
+ * `resource_metadata` document (RFC 9728) via `resolveIssuerFromChallenge`,
+ * then runs `authenticate()` against it. When the caller does not set
+ * `options.resource`, it defaults to the `resource` identifier from the
+ * metadata document, scoping the issued token's audience to that resource.
+ *
+ * **Requires Node.js.** Uses `node:http` and `node:child_process` via
+ * dynamic import. Importing this module is safe in any runtime; only
+ * *calling* `authenticateFromChallenge()` requires Node.js.
+ */
+export declare function authenticateFromChallenge(wwwAuthenticateHeader: string, options: AuthenticateOptions): Promise<TokenResponse>;
+//# sourceMappingURL=challenge.d.ts.map

package/dist/esm/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,MAAM,WAAW,iCAAiC;IAChD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,qBAAqB,EAAE,MAAM,EAC7B,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,iBAAiB,CAAC,CA6C5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAC7C,qBAAqB,EAAE,MAAM,EAC7B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAMxB"}

package/dist/esm/challenge.js

@@ -0,0 +1,83 @@
+import { authenticate } from "./pkce.js";
+/**
+ * Extract the `resource_metadata` parameter value from a `WWW-Authenticate`
+ * header (RFC 9728 §5.1). Handles quoted values alongside other challenge
+ * parameters (e.g. `realm`, `error`). Returns undefined when absent.
+ */
+function extractResourceMetadataUrl(wwwAuthenticateHeader) {
+    // Quoted form: resource_metadata="https://..."
+    const quoted = /resource_metadata\s*=\s*"([^"]+)"/.exec(wwwAuthenticateHeader);
+    if (quoted) {
+        return quoted[1];
+    }
+    // Unquoted token form: resource_metadata=https://... (terminated by comma,
+    // whitespace, or end of header).
+    const unquoted = /resource_metadata\s*=\s*([^",\s]+)/.exec(wwwAuthenticateHeader);
+    return unquoted ? unquoted[1] : undefined;
+}
+/**
+ * Resolve the authorization server issuer from a `WWW-Authenticate` challenge
+ * (RFC 9728).
+ *
+ * Parses the `resource_metadata` URL out of the header, fetches the protected
+ * resource metadata document, and returns the first entry of its
+ * `authorization_servers` array as the issuer, along with the document's
+ * `resource` identifier when present.
+ *
+ * Throws an `Error` when the header has no `resource_metadata` parameter, the
+ * metadata fetch fails, or the document is missing a valid
+ * `authorization_servers` array.
+ */
+export async function resolveIssuerFromChallenge(wwwAuthenticateHeader, options = {}) {
+    const metadataUrl = extractResourceMetadataUrl(wwwAuthenticateHeader);
+    if (!metadataUrl) {
+        throw new Error("WWW-Authenticate header does not contain a resource_metadata parameter (RFC 9728)");
+    }
+    const response = await fetch(metadataUrl, { signal: options.signal });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch protected resource metadata from "${metadataUrl}" (HTTP ${response.status})`);
+    }
+    let json;
+    try {
+        json = await response.json();
+    }
+    catch {
+        throw new Error(`Protected resource metadata at "${metadataUrl}" is not valid JSON`);
+    }
+    if (!json || typeof json !== "object" || Array.isArray(json)) {
+        throw new Error(`Protected resource metadata at "${metadataUrl}" is not a JSON object`);
+    }
+    const document = json;
+    const authorizationServers = document.authorization_servers;
+    if (!Array.isArray(authorizationServers) ||
+        authorizationServers.length === 0 ||
+        !authorizationServers.every((entry) => typeof entry === "string")) {
+        throw new Error(`Protected resource metadata at "${metadataUrl}" does not contain a non-empty authorization_servers array`);
+    }
+    return {
+        issuer: authorizationServers[0],
+        resource: typeof document.resource === "string" ? document.resource : undefined,
+    };
+}
+/**
+ * Full authorization-code-with-PKCE flow driven by a `WWW-Authenticate`
+ * challenge from a protected resource.
+ *
+ * Resolves the authorization server issuer from the challenge's
+ * `resource_metadata` document (RFC 9728) via `resolveIssuerFromChallenge`,
+ * then runs `authenticate()` against it. When the caller does not set
+ * `options.resource`, it defaults to the `resource` identifier from the
+ * metadata document, scoping the issued token's audience to that resource.
+ *
+ * **Requires Node.js.** Uses `node:http` and `node:child_process` via
+ * dynamic import. Importing this module is safe in any runtime; only
+ * *calling* `authenticateFromChallenge()` requires Node.js.
+ */
+export async function authenticateFromChallenge(wwwAuthenticateHeader, options) {
+    const { issuer, resource } = await resolveIssuerFromChallenge(wwwAuthenticateHeader);
+    return authenticate(issuer, {
+        ...options,
+        resource: options.resource ?? resource,
+    });
+}
+//# sourceMappingURL=challenge.js.map

package/dist/esm/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../src/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4B,MAAM,WAAW,CAAC;AAkBnE;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,qBAA6B;IAC/D,+CAA+C;IAC/C,MAAM,MAAM,GAAG,mCAAmC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC/E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,QAAQ,GAAG,oCAAoC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,qBAA6B,EAC7B,UAA6C,EAAE;IAE/C,MAAM,WAAW,GAAG,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qDAAqD,WAAW,WAAW,QAAQ,CAAC,MAAM,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAa,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mCAAmC,WAAW,qBAAqB,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,mCAAmC,WAAW,wBAAwB,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAA+B,CAAC;IAEjD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAC5D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACpC,oBAAoB,CAAC,MAAM,KAAK,CAAC;QACjC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAClF,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mCAAmC,WAAW,4DAA4D,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC/B,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,qBAA6B,EAC7B,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IACrF,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,GAAG,OAAO;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ;KACvC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/index.d.ts

@@ -19,4 +19,6 @@ export { AccessContext, TokenVerifier, ClientSecret } from "./server/index.js";
 export type { ErrorDetail, AccessContextStatus, AccessToken, TokenVerifierOptions, ClientSecretCredentials, } from "./server/index.js";
 export { generateCodeVerifier, generateCodeChallenge, generatePkcePair, exchangeAuthorizationCode, buildAuthorizeUrl, authenticate, } from "./pkce.js";
 export type { Pkce, ExchangeAuthorizationCodeOptions, AuthorizeUrlParams, AuthenticateOptions, } from "./pkce.js";
+export { resolveIssuerFromChallenge, authenticateFromChallenge } from "./challenge.js";
+export type { ResolveIssuerFromChallengeOptions, ResolvedChallenge, } from "./challenge.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,EAC9B,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,IAAI,EACJ,gCAAgC,EAChC,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,EAC9B,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,IAAI,EACJ,gCAAgC,EAChC,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACvF,YAAY,EACV,iCAAiC,EACjC,iBAAiB,GAClB,MAAM,gBAAgB,CAAC"}

package/dist/esm/index.js

@@ -10,4 +10,5 @@ export { ClientCredentialsClient } from "./clientCredentials.js";
 export { registerClient } from "./registration.js";
 export { AccessContext, TokenVerifier, ClientSecret } from "./server/index.js";
 export { generateCodeVerifier, generateCodeChallenge, generatePkcePair, exchangeAuthorizationCode, buildAuthorizeUrl, authenticate, } from "./pkce.js";
+export { resolveIssuerFromChallenge, authenticateFromChallenge } from "./challenge.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,EAC9B,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAQpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAMnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQ/E,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,GACb,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,EAC9B,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAQpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAMnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQ/E,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,YAAY,GACb,MAAM,WAAW,CAAC;AAOnB,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/esm/server/accessContext.d.ts

@@ -9,6 +9,14 @@ export declare class AccessContext {
     setBulkTokens(tokens: Record<string, TokenResponse>): void;
     setResourceError(resource: string, error: ErrorDetail): void;
     setError(error: ErrorDetail): void;
+    /**
+     * Merge another context's tokens and errors into this one. Used when
+     * multiple grants stack on the same request: later results accumulate
+     * alongside earlier ones instead of replacing them. Per-resource entries
+     * from `other` win on conflict; a global error on `other` overwrites
+     * this context's global error.
+     */
+    merge(other: AccessContext): void;
     access(resource: string): TokenResponse;
     hasError(): boolean;
     hasResourceError(resource: string): boolean;

package/dist/esm/server/accessContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accessContext.d.ts","sourceRoot":"","sources":["../../../src/server/accessContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,eAAe,GAAG,OAAO,CAAC;AAExE,qBAAa,aAAa;;gBAKZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;IAMxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IAKtD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI;IAM1D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI;IAK5D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAIlC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IA2BvC,QAAQ,IAAI,OAAO;IAInB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI3C,SAAS,IAAI,OAAO;IAIpB,QAAQ,IAAI,WAAW,GAAG,IAAI;IAI9B,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAItD,SAAS,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE;IAOlF,SAAS,IAAI,mBAAmB;IAMhC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,kBAAkB,IAAI,MAAM,EAAE;CAG/B"}
+{"version":3,"file":"accessContext.d.ts","sourceRoot":"","sources":["../../../src/server/accessContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,eAAe,GAAG,OAAO,CAAC;AAExE,qBAAa,aAAa;;gBAKZ,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;IAMxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IAKtD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI;IAM1D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI;IAK5D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAIlC;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IAYjC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IA2BvC,QAAQ,IAAI,OAAO;IAInB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI3C,SAAS,IAAI,OAAO;IAIpB,QAAQ,IAAI,WAAW,GAAG,IAAI;IAI9B,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAItD,SAAS,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE;IAOlF,SAAS,IAAI,mBAAmB;IAMhC,sBAAsB,IAAI,MAAM,EAAE;IAIlC,kBAAkB,IAAI,MAAM,EAAE;CAG/B"}

package/dist/esm/server/accessContext.js

@@ -36,6 +36,24 @@ export class AccessContext {
     setError(error) {
         __classPrivateFieldSet(this, _AccessContext_error, error, "f");
     }
+    /**
+     * Merge another context's tokens and errors into this one. Used when
+     * multiple grants stack on the same request: later results accumulate
+     * alongside earlier ones instead of replacing them. Per-resource entries
+     * from `other` win on conflict; a global error on `other` overwrites
+     * this context's global error.
+     */
+    merge(other) {
+        for (const [resource, token] of __classPrivateFieldGet(other, _AccessContext_accessTokens, "f")) {
+            this.setToken(resource, token);
+        }
+        for (const [resource, error] of __classPrivateFieldGet(other, _AccessContext_resourceErrors, "f")) {
+            this.setResourceError(resource, error);
+        }
+        if (__classPrivateFieldGet(other, _AccessContext_error, "f")) {
+            __classPrivateFieldSet(this, _AccessContext_error, __classPrivateFieldGet(other, _AccessContext_error, "f"), "f");
+        }
+    }
     access(resource) {
         if (__classPrivateFieldGet(this, _AccessContext_error, "f")) {
             throw new ResourceAccessError(undefined, {

package/dist/esm/server/accessContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessContext.js","sourceRoot":"","sources":["../../../src/server/accessContext.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,OAAO,EAAE,mBAAmB,EAAoB,MAAM,cAAc,CAAC;AAMrE,MAAM,OAAO,aAAa;IAKxB,YAAY,YAA4C;QAJxD,8CAA0C;QAC1C,gDAA0C;QAC1C,uCAA2B;QAGzB,uBAAA,IAAI,+BAAiB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAA,CAAC;QAC/E,uBAAA,IAAI,iCAAmB,IAAI,GAAG,EAAE,MAAA,CAAC;QACjC,uBAAA,IAAI,wBAAU,IAAI,MAAA,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,KAAoB;QAC7C,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxC,uBAAA,IAAI,qCAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,MAAqC;QACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,KAAkB;QACnD,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,uBAAA,IAAI,mCAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,QAAQ,CAAC,KAAkB;QACzB,uBAAA,IAAI,wBAAU,KAAK,MAAA,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,IAAI,uBAAA,IAAI,4BAAO,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,cAAc;gBACzB,YAAY,EAAE,uBAAA,IAAI,4BAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,eAAe;gBAC1B,kBAAkB,EAAE,CAAC,GAAG,uBAAA,IAAI,mCAAc,CAAC,IAAI,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ;QACN,OAAO,uBAAA,IAAI,4BAAO,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,uBAAA,IAAI,qCAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,QAAQ;QACN,OAAO,uBAAA,IAAI,4BAAO,CAAC;IACrB,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,SAAS;QACP,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,uBAAA,IAAI,qCAAgB,CAAC;YACnD,KAAK,EAAE,uBAAA,IAAI,4BAAO;SACnB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,IAAI,uBAAA,IAAI,4BAAO;YAAE,OAAO,OAAO,CAAC;QAChC,IAAI,uBAAA,IAAI,qCAAgB,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,eAAe,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sBAAsB;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAA,IAAI,mCAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAA,IAAI,qCAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;CACF"}
+{"version":3,"file":"accessContext.js","sourceRoot":"","sources":["../../../src/server/accessContext.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,OAAO,EAAE,mBAAmB,EAAoB,MAAM,cAAc,CAAC;AAMrE,MAAM,OAAO,aAAa;IAKxB,YAAY,YAA4C;QAJxD,8CAA0C;QAC1C,gDAA0C;QAC1C,uCAA2B;QAGzB,uBAAA,IAAI,+BAAiB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAA,CAAC;QAC/E,uBAAA,IAAI,iCAAmB,IAAI,GAAG,EAAE,MAAA,CAAC;QACjC,uBAAA,IAAI,wBAAU,IAAI,MAAA,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,KAAoB;QAC7C,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxC,uBAAA,IAAI,qCAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,MAAqC;QACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,KAAkB;QACnD,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,uBAAA,IAAI,mCAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,QAAQ,CAAC,KAAkB;QACzB,uBAAA,IAAI,wBAAU,KAAK,MAAA,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAoB;QACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,uBAAA,KAAK,mCAAc,EAAE,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,uBAAA,KAAK,qCAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,uBAAA,KAAK,4BAAO,EAAE,CAAC;YACjB,uBAAA,IAAI,wBAAU,uBAAA,KAAK,4BAAO,MAAA,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,IAAI,uBAAA,IAAI,4BAAO,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,cAAc;gBACzB,YAAY,EAAE,uBAAA,IAAI,4BAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,aAAa,GAAG,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,gBAAgB;gBAC3B,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,uBAAA,IAAI,mCAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE;gBACvC,QAAQ;gBACR,SAAS,EAAE,eAAe;gBAC1B,kBAAkB,EAAE,CAAC,GAAG,uBAAA,IAAI,mCAAc,CAAC,IAAI,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ;QACN,OAAO,uBAAA,IAAI,4BAAO,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,uBAAA,IAAI,qCAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,QAAQ;QACN,OAAO,uBAAA,IAAI,4BAAO,CAAC;IACrB,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,uBAAA,IAAI,qCAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,SAAS;QACP,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,uBAAA,IAAI,qCAAgB,CAAC;YACnD,KAAK,EAAE,uBAAA,IAAI,4BAAO;SACnB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,IAAI,uBAAA,IAAI,4BAAO;YAAE,OAAO,OAAO,CAAC;QAChC,IAAI,uBAAA,IAAI,qCAAgB,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,eAAe,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sBAAsB;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAA,IAAI,mCAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,kBAAkB;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAA,IAAI,qCAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keycardai/oauth",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "[Preview] OAuth 2.0 primitives for Keycard: JWKS keyring, JWT signing/verification, server-tier token verifier, AccessContext, ClientSecret credentials, and impersonation via RFC 8693 token exchange",
   "license": "MIT",
   "repository": {