@krantho/api 0.0.0-stage → 1.0.1

package/dist/media-references.d.ts

@@ -0,0 +1,14 @@
+import type { ApiContext } from './types.js';
+/** A document field, or its markdown body, that names a media file */
+export interface MediaReference {
+    collection: string;
+    slug: string;
+    field: string;
+}
+/**
+ * Where each of the media files is used: every collection is read once, in one
+ * query, whatever the number of files asked about. A read that fails fails the
+ * answer — an answer of no references is never a guess.
+ */
+export declare function mediaReferences(ctx: ApiContext, ids: readonly string[]): Promise<Map<string, MediaReference[]>>;
+//# sourceMappingURL=media-references.d.ts.map

package/dist/media-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-references.d.ts","sourceRoot":"","sources":["../src/media-references.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAWD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,MAAM,EAAE,GACrB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CASxC"}

package/dist/media-references.js

@@ -0,0 +1,25 @@
+import { canQuery } from '@krantho/persistence';
+/** The places in one document that name the file: its text fields, then its body */
+function referencesIn(doc, id) {
+    const { collection, slug } = doc.meta;
+    const fields = Object.entries(doc.fields).flatMap(([field, value]) => typeof value === 'string' && value.includes(id) ? [{ collection, slug, field }] : []);
+    return doc.body.includes(id) ? [...fields, { collection, slug, field: 'body' }] : fields;
+}
+/**
+ * Where each of the media files is used: every collection is read once, in one
+ * query, whatever the number of files asked about. A read that fails fails the
+ * answer — an answer of no references is never a guess.
+ */
+export async function mediaReferences(ctx, ids) {
+    const found = new Map(ids.map((id) => [id, []]));
+    const collections = [...ctx.contentConfig.collections.keys()];
+    if (ids.length === 0 || collections.length === 0 || !canQuery(ctx.adapter))
+        return found;
+    const { items } = await ctx.adapter.query({ state: 'current', projection: 'full', collections });
+    for (const doc of items) {
+        for (const id of ids)
+            found.get(id)?.push(...referencesIn(doc, id));
+    }
+    return found;
+}
+//# sourceMappingURL=media-references.js.map

package/dist/media-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-references.js","sourceRoot":"","sources":["../src/media-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAUrE,oFAAoF;AACpF,SAAS,YAAY,CAAC,GAAoB,EAAE,EAAU;IACpD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CACnE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACrF,CAAA;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,GAAsB;IAEtB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAsB,CAAC,CAAC,CAAC,CAAA;IACpE,MAAM,WAAW,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACxF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IAChG,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/merged-schema.d.ts

@@ -0,0 +1,10 @@
+import { type IPersistenceAdapter } from '@krantho/persistence';
+import type { Collection } from '@krantho/schema';
+import type { ZodObject, ZodRawShape } from 'zod';
+/**
+ * Get the merged schema (code + runtime fields) for validation.
+ * Falls back to code-only schema if adapter doesn't support runtime schemas.
+ */
+export declare function getMergedSchema(collectionDef: Collection<ZodObject<ZodRawShape>>, adapter: IPersistenceAdapter): Promise<ZodObject<ZodRawShape>>;
+export declare function getActiveContract(collection: Collection, adapter: IPersistenceAdapter): Promise<import('@krantho/persistence').ContentContract>;
+//# sourceMappingURL=merged-schema.d.ts.map

package/dist/merged-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merged-schema.d.ts","sourceRoot":"","sources":["../src/merged-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,KAAK,CAAA;AAEjD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,EACjD,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAUjC;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,OAAO,sBAAsB,EAAE,eAAe,CAAC,CAGzD"}

package/dist/merged-schema.js

@@ -0,0 +1,21 @@
+import { hasRuntimeSchema } from '@krantho/persistence';
+import { mergeSchemas, resolveCollectionContract } from '@krantho/schema';
+/**
+ * Get the merged schema (code + runtime fields) for validation.
+ * Falls back to code-only schema if adapter doesn't support runtime schemas.
+ */
+export async function getMergedSchema(collectionDef, adapter) {
+    if (!hasRuntimeSchema(adapter))
+        return collectionDef.schema;
+    const runtimeSchema = await adapter.getRuntimeSchema(collectionDef.name);
+    if (!runtimeSchema || runtimeSchema.fields.length === 0) {
+        return collectionDef.schema;
+    }
+    const merged = mergeSchemas(collectionDef.schema, runtimeSchema.fields);
+    return merged;
+}
+export async function getActiveContract(collection, adapter) {
+    const runtime = hasRuntimeSchema(adapter) ? await adapter.getRuntimeSchema(collection.name) : null;
+    return resolveCollectionContract(collection, runtime);
+}
+//# sourceMappingURL=merged-schema.js.map

package/dist/merged-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merged-schema.js","sourceRoot":"","sources":["../src/merged-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA4B,MAAM,sBAAsB,CAAA;AAEjF,OAAO,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAGzE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAiD,EACjD,OAA4B;IAE5B,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,aAAa,CAAC,MAAM,CAAA;IAE3D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACxE,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,aAAa,CAAC,MAAM,CAAA;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACvE,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAsB,EACtB,OAA4B;IAE5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClG,OAAO,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;AACvD,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,21 @@
+import type { AuthSection } from '@krantho/config';
+import type { ApiRequest, ApiResponse, AuthenticatedUser } from '../types.js';
+/** Result of auth check */
+export type AuthResult = {
+    isAuthenticated: true;
+    user: AuthenticatedUser;
+} | {
+    isAuthenticated: false;
+    response: ApiResponse;
+};
+/** The token of an `Authorization: Bearer <token>` header, when the request carries one */
+export declare function bearerToken(req: ApiRequest): string | undefined;
+/**
+ * Check authentication for a request.
+ *
+ * In none mode: always passes with anonymous identity.
+ * In token/oidc mode: extracts JWT from cookie or Bearer header,
+ * verifies signature, checks expiry, and returns user with roles.
+ */
+export declare function checkAuth(req: ApiRequest, config: AuthSection): AuthResult;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAIlD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAG7E,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAClB;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAClD;IAAE,eAAe,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,CAAA;AAIrD,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAK/D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,CAoE1E"}

package/dist/middleware/auth.js

@@ -0,0 +1,82 @@
+import { accessCookieName } from '../cookies.js';
+import { verifyJwt } from '../jwt.js';
+import { parseCookie } from '../validators.js';
+const WRITE_METHODS = new Set(['POST', 'PUT', 'DELETE', 'PATCH']);
+/** The token of an `Authorization: Bearer <token>` header, when the request carries one */
+export function bearerToken(req) {
+    const authHeader = req.headers?.['authorization'] ?? req.headers?.['Authorization'];
+    if (!authHeader)
+        return undefined;
+    const parts = authHeader.split(' ');
+    return parts.length === 2 && parts[0] === 'Bearer' ? parts[1] : undefined;
+}
+/**
+ * Check authentication for a request.
+ *
+ * In none mode: always passes with anonymous identity.
+ * In token/oidc mode: extracts JWT from cookie or Bearer header,
+ * verifies signature, checks expiry, and returns user with roles.
+ */
+export function checkAuth(req, config) {
+    // No-auth mode: always pass through
+    if (config.mode === 'none') {
+        return {
+            isAuthenticated: true,
+            user: {
+                id: 'anonymous',
+                email: 'anonymous',
+                name: 'Anonymous',
+                roles: ['admin'],
+                mode: 'none',
+            },
+        };
+    }
+    // Extract token: cookie first (browser sessions), then Bearer header (API clients)
+    let token = parseCookie(req.headers?.['cookie'], accessCookieName(config.session));
+    token ||= bearerToken(req);
+    const isWrite = WRITE_METHODS.has(req.method.toUpperCase());
+    // No token present: reads may be public, writes require auth
+    if (!token) {
+        if (!isWrite && !config.requireAuthForReads) {
+            return {
+                isAuthenticated: true,
+                user: {
+                    id: 'anonymous',
+                    email: 'anonymous',
+                    name: 'Anonymous',
+                    roles: ['viewer'],
+                    mode: config.mode,
+                },
+            };
+        }
+        return {
+            isAuthenticated: false,
+            response: { status: 401, body: { error: 'Authentication required' } },
+        };
+    }
+    // Verify JWT
+    if (!config.jwtSecret) {
+        return {
+            isAuthenticated: false,
+            response: { status: 500, body: { error: 'JWT secret not configured' } },
+        };
+    }
+    const result = verifyJwt(token, config.jwtSecret);
+    if (!result.valid) {
+        return {
+            isAuthenticated: false,
+            response: { status: 401, body: { error: result.error } },
+        };
+    }
+    return {
+        isAuthenticated: true,
+        user: {
+            id: result.claims.sub,
+            email: result.claims.email,
+            name: result.claims.name,
+            roles: result.claims.roles,
+            mode: config.mode,
+        },
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAO9C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;AAEjE,2FAA2F;AAC3F,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAA;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,MAAmB;IAC5D,oCAAoC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO;YACL,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE;gBACJ,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,CAAC,OAAO,CAAW;gBAC1B,IAAI,EAAE,MAAM;aACb;SACF,CAAA;IACH,CAAC;IAED,mFAAmF;IACnF,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAElF,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAA;IAE1B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAE3D,6DAA6D;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC5C,OAAO;gBACL,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE;oBACJ,EAAE,EAAE,WAAW;oBACf,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,WAAW;oBACjB,KAAK,EAAE,CAAC,QAAQ,CAAW;oBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB;aACF,CAAA;QACH,CAAC;QACD,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE;SACtE,CAAA;IACH,CAAC;IAED,aAAa;IACb,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE;SACxE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE;SACzD,CAAA;IACH,CAAC;IAED,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;YACrB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;YACxB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB;KACF,CAAA;AACH,CAAC"}

package/dist/oidc-state.d.ts

@@ -0,0 +1,42 @@
+import type { AuthSection } from '@krantho/config';
+/**
+ * A pending OIDC sign-in, carried by the browser between the redirect to the
+ * provider and the callback.
+ *
+ * It lives in a short-lived cookie rather than server memory, so the callback
+ * succeeds on whichever instance it lands — serverless functions and
+ * horizontally scaled servers share nothing between requests. The cookie is
+ * encrypted and authenticated (AES-256-GCM, keyed from the resolved signing
+ * secret): the browser can neither read the PKCE verifier nor forge a state.
+ */
+/** How long a sign-in may take between the redirect and the callback */
+export declare const OIDC_STATE_TTL_SEC = 600;
+/** What the login redirect hands the callback */
+export interface OidcPendingLogin {
+    /** CSRF token echoed back by the provider */
+    state: string;
+    /** PKCE verifier for the token exchange */
+    codeVerifier: string;
+    /** Must match the `nonce` claim of the ID token */
+    nonce: string;
+    /** Same-origin path the browser lands on after a successful sign-in */
+    returnTo: string;
+}
+/** Encrypt a pending sign-in into a cookie-safe value */
+export declare function sealOidcState(login: OidcPendingLogin, secret: string, now?: number): string;
+/**
+ * Decrypt a sealed pending sign-in. Returns null when the value is missing,
+ * tampered with, sealed under another secret, or expired.
+ */
+export declare function openOidcState(sealed: string | undefined, secret: string, now?: number): OidcPendingLogin | null;
+/** Name of the cookie carrying the pending sign-in */
+export declare function oidcStateCookieName(session: AuthSection['session']): string;
+/**
+ * Set-Cookie value for a pending sign-in. Always `SameSite=Lax`, whatever the
+ * session cookies use: the callback is a top-level cross-site navigation from
+ * the provider, which Lax admits and Strict would drop.
+ */
+export declare function oidcStateCookie(sealed: string, auth: AuthSection, headers: Record<string, string> | undefined): string;
+/** Set-Cookie value that clears the pending sign-in */
+export declare function clearOidcStateCookie(auth: AuthSection, headers: Record<string, string> | undefined): string;
+//# sourceMappingURL=oidc-state.d.ts.map

package/dist/oidc-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-state.d.ts","sourceRoot":"","sources":["../src/oidc-state.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAGlD;;;;;;;;;GASG;AAEH,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,MAAM,CAAA;AAErC,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAA;IACb,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAA;IACpB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAaD,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAmB,GACvB,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAmB,GACvB,gBAAgB,GAAG,IAAI,CAsBzB;AAED,sDAAsD;AACtD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,MAAM,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,MAAM,CAQR;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,MAAM,CAQR"}

package/dist/oidc-state.js

@@ -0,0 +1,72 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from 'node:crypto';
+import { buildCookie, isSecureRequest } from './cookies.js';
+/**
+ * A pending OIDC sign-in, carried by the browser between the redirect to the
+ * provider and the callback.
+ *
+ * It lives in a short-lived cookie rather than server memory, so the callback
+ * succeeds on whichever instance it lands — serverless functions and
+ * horizontally scaled servers share nothing between requests. The cookie is
+ * encrypted and authenticated (AES-256-GCM, keyed from the resolved signing
+ * secret): the browser can neither read the PKCE verifier nor forge a state.
+ */
+/** How long a sign-in may take between the redirect and the callback */
+export const OIDC_STATE_TTL_SEC = 600;
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+function stateKey(secret) {
+    return Buffer.from(hkdfSync('sha256', secret, '', 'krantho oidc state', 32));
+}
+/** Encrypt a pending sign-in into a cookie-safe value */
+export function sealOidcState(login, secret, now = Date.now()) {
+    const payload = { ...login, expiresAt: now + OIDC_STATE_TTL_SEC * 1000 };
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv('aes-256-gcm', stateKey(secret), iv);
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(payload), 'utf8'), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString('base64url');
+}
+/**
+ * Decrypt a sealed pending sign-in. Returns null when the value is missing,
+ * tampered with, sealed under another secret, or expired.
+ */
+export function openOidcState(sealed, secret, now = Date.now()) {
+    if (!sealed)
+        return null;
+    const raw = Buffer.from(sealed, 'base64url');
+    if (raw.length <= IV_BYTES + TAG_BYTES)
+        return null;
+    let payload;
+    try {
+        const decipher = createDecipheriv('aes-256-gcm', stateKey(secret), raw.subarray(0, IV_BYTES));
+        decipher.setAuthTag(raw.subarray(IV_BYTES, IV_BYTES + TAG_BYTES));
+        const plaintext = Buffer.concat([
+            decipher.update(raw.subarray(IV_BYTES + TAG_BYTES)),
+            decipher.final(),
+        ]);
+        payload = JSON.parse(plaintext.toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (typeof payload.expiresAt !== 'number' || payload.expiresAt <= now)
+        return null;
+    const { state, codeVerifier, nonce, returnTo } = payload;
+    return { state, codeVerifier, nonce, returnTo };
+}
+/** Name of the cookie carrying the pending sign-in */
+export function oidcStateCookieName(session) {
+    return `${session.cookiePrefix}_oidc`;
+}
+/**
+ * Set-Cookie value for a pending sign-in. Always `SameSite=Lax`, whatever the
+ * session cookies use: the callback is a top-level cross-site navigation from
+ * the provider, which Lax admits and Strict would drop.
+ */
+export function oidcStateCookie(sealed, auth, headers) {
+    return buildCookie(oidcStateCookieName(auth.session), sealed, OIDC_STATE_TTL_SEC, isSecureRequest(headers, auth), 'lax');
+}
+/** Set-Cookie value that clears the pending sign-in */
+export function clearOidcStateCookie(auth, headers) {
+    return buildCookie(oidcStateCookieName(auth.session), '', 0, isSecureRequest(headers, auth), 'lax');
+}
+//# sourceMappingURL=oidc-state.js.map

package/dist/oidc-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-state.js","sourceRoot":"","sources":["../src/oidc-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE3D;;;;;;;;;GASG;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAkBrC,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAC3B,KAAuB,EACvB,MAAc,EACd,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,OAAO,GAAkB,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,kBAAkB,GAAG,IAAI,EAAE,CAAA;IACvF,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAClG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA0B,EAC1B,MAAc,EACd,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC5C,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ,GAAG,SAAS;QAAE,OAAO,IAAI,CAAA;IAEnD,IAAI,OAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC7F,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAA;QACjE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;YACnD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAA;QACF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAkB,CAAA;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA;IAClF,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACxD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AACjD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,mBAAmB,CAAC,OAA+B;IACjE,OAAO,GAAG,OAAO,CAAC,YAAY,OAAO,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,IAAiB,EACjB,OAA2C;IAE3C,OAAO,WAAW,CAChB,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EACjC,MAAM,EACN,kBAAkB,EAClB,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAC9B,KAAK,CACN,CAAA;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAClC,IAAiB,EACjB,OAA2C;IAE3C,OAAO,WAAW,CAChB,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EACjC,EAAE,EACF,CAAC,EACD,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAC9B,KAAK,CACN,CAAA;AACH,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,83 @@
+/**
+ * OIDC authentication module.
+ *
+ * Discovery documents and JWKS keys are cached per process — a cold instance
+ * simply fetches them again. Nothing a sign-in depends on lives here: the
+ * pending state, PKCE verifier and nonce travel in a sealed cookie
+ * (`oidc-state.ts`), so login and callback may land on different instances.
+ */
+/** OpenID Connect discovery document (subset of fields we use) */
+export interface OidcDiscovery {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    end_session_endpoint?: string | undefined;
+    userinfo_endpoint?: string | undefined;
+}
+/** Fetch and cache the OIDC discovery document */
+export declare function getDiscovery(issuerUrl: string): Promise<OidcDiscovery>;
+/** Clear the discovery cache (for testing) */
+export declare function clearDiscoveryCache(): void;
+/** Clear one key set from the JWKS cache, or all of them (for testing) */
+export declare function clearJwksCache(jwksUri?: string): void;
+/** Decoded ID token claims */
+export interface IdTokenClaims {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    nonce?: string | undefined;
+    email?: string | undefined;
+    email_verified?: boolean | undefined;
+    name?: string | undefined;
+    picture?: string | undefined;
+}
+/** What an ID token is checked against */
+export interface IdTokenExpectations {
+    issuerUrl: string;
+    clientId: string;
+    jwksUri: string;
+    /** The nonce sent on the authorize request */
+    nonce: string;
+}
+/**
+ * Verify the RS256 signature of a JWT against a JWKS and return its claims.
+ *
+ * Only RS256 is accepted, so a token signed with a symmetric algorithm (or none)
+ * never gets as far as a key. The key is picked by `kid`; an unknown `kid`
+ * refetches the key set, for key rotation, at most once a minute per key set. The caller checks the claims.
+ */
+export declare function verifySignedJwt(token: string, jwksUri: string): Promise<Record<string, unknown>>;
+/**
+ * Verify an OIDC ID token.
+ *
+ * Checks: signature (RS256 via JWKS), expiry, issuer, audience, nonce.
+ * Returns decoded claims on success.
+ */
+export declare function verifyIdToken(idToken: string, expected: IdTokenExpectations): Promise<IdTokenClaims>;
+/** Generate a PKCE code verifier (43-128 char random string) */
+export declare function generateCodeVerifier(): string;
+/** Compute S256 code challenge from verifier */
+export declare function computeCodeChallenge(verifier: string): string;
+/** Generate a random state parameter for CSRF protection */
+export declare function generateState(): string;
+/** Generate a random nonce binding the ID token to one sign-in */
+export declare function generateNonce(): string;
+/** The authorization-code grant sent to the token endpoint */
+export interface CodeExchange {
+    code: string;
+    redirectUri: string;
+    clientId: string;
+    /** Confidential clients only — sent as `client_secret_post`. Omitted for a public client. */
+    clientSecret?: string | undefined;
+    codeVerifier: string;
+}
+/** Exchange an authorization code for tokens at the provider's token endpoint */
+export declare function exchangeCode(tokenEndpoint: string, grant: CodeExchange): Promise<{
+    access_token: string;
+    id_token: string;
+    refresh_token?: string;
+}>;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAIH,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACvC;AAKD,kDAAkD;AAClD,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAiB5E;AAED,8CAA8C;AAC9C,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAyDD,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAQrD;AAID,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC7B;AAED,0CAA0C;AAC1C,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiDlC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,CA6BxB;AAID,gEAAgE;AAChE,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,kEAAkE;AAClE,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,iFAAiF;AACjF,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB7E"}

package/dist/oidc.js

@@ -0,0 +1,226 @@
+import { createHash, randomBytes } from 'node:crypto';
+/** Cached discovery documents with expiry, one per issuer */
+const discoveryCache = new Map();
+/** Fetch and cache the OIDC discovery document */
+export async function getDiscovery(issuerUrl) {
+    const now = Date.now();
+    const cached = discoveryCache.get(issuerUrl);
+    if (cached && cached.expiresAt > now) {
+        return cached.doc;
+    }
+    const url = `${issuerUrl.replace(/\/$/, '')}/.well-known/openid-configuration`;
+    const res = await fetch(url);
+    if (!res.ok) {
+        throw new Error(`OIDC discovery failed: ${res.status} from ${url}`);
+    }
+    const doc = (await res.json());
+    // Cache for 1 hour
+    discoveryCache.set(issuerUrl, { doc, expiresAt: now + 3600_000 });
+    return doc;
+}
+/** Clear the discovery cache (for testing) */
+export function clearDiscoveryCache() {
+    discoveryCache.clear();
+}
+/** Cached JWKS with expiry, one per key set URI */
+const jwksCache = new Map();
+/** Fetch and cache JWKS public keys */
+async function getJwks(jwksUri) {
+    const now = Date.now();
+    const cached = jwksCache.get(jwksUri);
+    if (cached && cached.expiresAt > now) {
+        return cached.keys;
+    }
+    const res = await fetch(jwksUri);
+    if (!res.ok) {
+        throw new Error(`JWKS fetch failed: ${res.status} from ${jwksUri}`);
+    }
+    const data = (await res.json());
+    // Cache for 1 hour
+    jwksCache.set(jwksUri, { keys: data.keys, expiresAt: now + 3600_000 });
+    return data.keys;
+}
+/**
+ * When each key set was last refetched because a token named a key it did not hold. A token's
+ * `kid` is attacker-chosen, so an unknown one may force a refetch only once a minute per key set:
+ * rotation is picked up, and a stream of bogus tokens neither reaches the issuer nor evicts the keys.
+ */
+const forcedRefetchAt = new Map();
+const FORCED_REFETCH_COOLDOWN_MS = 60_000;
+/** Whether an unknown `kid` may force a refetch of this key set now, recording that it did */
+function mayForceRefetch(jwksUri) {
+    const now = Date.now();
+    const last = forcedRefetchAt.get(jwksUri);
+    if (last !== undefined && now - last < FORCED_REFETCH_COOLDOWN_MS)
+        return false;
+    forcedRefetchAt.set(jwksUri, now);
+    return true;
+}
+/** Clear one key set from the JWKS cache, or all of them (for testing) */
+export function clearJwksCache(jwksUri) {
+    if (jwksUri === undefined) {
+        jwksCache.clear();
+        forcedRefetchAt.clear();
+    }
+    else {
+        jwksCache.delete(jwksUri);
+        forcedRefetchAt.delete(jwksUri);
+    }
+}
+/**
+ * Verify the RS256 signature of a JWT against a JWKS and return its claims.
+ *
+ * Only RS256 is accepted, so a token signed with a symmetric algorithm (or none)
+ * never gets as far as a key. The key is picked by `kid`; an unknown `kid`
+ * refetches the key set, for key rotation, at most once a minute per key set. The caller checks the claims.
+ */
+export async function verifySignedJwt(token, jwksUri) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw new Error('Invalid JWT format');
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    // Decode header to get kid
+    const header = JSON.parse(Buffer.from(headerB64, 'base64url').toString());
+    if (header?.alg !== 'RS256') {
+        throw new Error(`Unsupported algorithm: ${header?.alg}. Only RS256 is supported.`);
+    }
+    // Fetch JWKS and find matching key
+    let keys = await getJwks(jwksUri);
+    let key = keys.find((k) => k.kid === header.kid && k.kty === 'RSA');
+    // If key not found, fetch the key set again, at most once a minute (key rotation)
+    if (!key && mayForceRefetch(jwksUri)) {
+        jwksCache.delete(jwksUri);
+        keys = await getJwks(jwksUri);
+        key = keys.find((k) => k.kid === header.kid && k.kty === 'RSA');
+    }
+    if (!key) {
+        throw new Error(`No matching RSA key found for kid: ${header.kid}`);
+    }
+    // Verify RS256 signature using Node crypto
+    const { createVerify } = await import('node:crypto');
+    const pem = jwkToPem(key);
+    const verifier = createVerify('RSA-SHA256');
+    verifier.update(`${headerB64}.${payloadB64}`);
+    const signatureBuffer = Buffer.from(signatureB64, 'base64url');
+    if (!verifier.verify(pem, signatureBuffer)) {
+        throw new Error('JWT signature verification failed');
+    }
+    const claims = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());
+    if (claims === null || typeof claims !== 'object' || Array.isArray(claims)) {
+        throw new Error('Invalid token claims');
+    }
+    return claims;
+}
+/**
+ * Verify an OIDC ID token.
+ *
+ * Checks: signature (RS256 via JWKS), expiry, issuer, audience, nonce.
+ * Returns decoded claims on success.
+ */
+export async function verifyIdToken(idToken, expected) {
+    const { issuerUrl, clientId, jwksUri } = expected;
+    const claims = (await verifySignedJwt(idToken, jwksUri));
+    // Validate issuer
+    const normalizedIssuer = issuerUrl.replace(/\/$/, '');
+    const claimIssuer = claims.iss.replace(/\/$/, '');
+    if (claimIssuer !== normalizedIssuer) {
+        throw new Error(`Issuer mismatch: expected ${normalizedIssuer}, got ${claimIssuer}`);
+    }
+    // Validate audience
+    const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    if (!audiences.includes(clientId)) {
+        throw new Error(`Audience mismatch: ${clientId} not in ${audiences.join(', ')}`);
+    }
+    // Validate expiry
+    const now = Math.floor(Date.now() / 1000);
+    if (typeof claims.exp !== 'number' || claims.exp <= now) {
+        throw new Error('ID token expired');
+    }
+    // Validate nonce — binds the token to this browser's sign-in
+    if (claims.nonce !== expected.nonce) {
+        throw new Error('ID token nonce mismatch');
+    }
+    return claims;
+}
+// --- PKCE ---
+/** Generate a PKCE code verifier (43-128 char random string) */
+export function generateCodeVerifier() {
+    return randomBytes(32).toString('base64url');
+}
+/** Compute S256 code challenge from verifier */
+export function computeCodeChallenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+/** Generate a random state parameter for CSRF protection */
+export function generateState() {
+    return randomBytes(16).toString('hex');
+}
+/** Generate a random nonce binding the ID token to one sign-in */
+export function generateNonce() {
+    return randomBytes(16).toString('base64url');
+}
+/** Exchange an authorization code for tokens at the provider's token endpoint */
+export async function exchangeCode(tokenEndpoint, grant) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: grant.code,
+        redirect_uri: grant.redirectUri,
+        client_id: grant.clientId,
+        code_verifier: grant.codeVerifier,
+    });
+    if (grant.clientSecret)
+        body.set('client_secret', grant.clientSecret);
+    const res = await fetch(tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Token exchange failed: ${res.status} — ${text}`);
+    }
+    return res.json();
+}
+// --- Helpers ---
+/** Convert a JWK RSA public key to PEM format */
+function jwkToPem(jwk) {
+    const n = Buffer.from(jwk.n, 'base64url');
+    const e = Buffer.from(jwk.e, 'base64url');
+    // Build DER-encoded RSA public key
+    const nEncoded = encodeUnsignedInteger(n);
+    const eEncoded = encodeUnsignedInteger(e);
+    const sequenceContent = Buffer.concat([nEncoded, eEncoded]);
+    const rsaPublicKey = encodeSequence(sequenceContent);
+    // Wrap in SubjectPublicKeyInfo
+    const algorithmOid = Buffer.from([
+        0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00,
+    ]);
+    const bitString = Buffer.concat([
+        Buffer.from([0x03, ...encodeLength(rsaPublicKey.length + 1), 0x00]),
+        rsaPublicKey,
+    ]);
+    const spki = encodeSequence(Buffer.concat([algorithmOid, bitString]));
+    const base64 = spki.toString('base64');
+    const lines = base64.match(/.{1,64}/g) ?? [];
+    return `-----BEGIN PUBLIC KEY-----\n${lines.join('\n')}\n-----END PUBLIC KEY-----`;
+}
+function encodeLength(length) {
+    if (length < 128)
+        return Buffer.from([length]);
+    if (length < 256)
+        return Buffer.from([0x81, length]);
+    return Buffer.from([0x82, (length >> 8) & 0xff, length & 0xff]);
+}
+function encodeUnsignedInteger(data) {
+    if (data.length === 0)
+        throw new Error('Cannot encode empty buffer as ASN.1 integer');
+    // Add leading zero if high bit is set (to keep it positive)
+    const needsPadding = data[0] >= 0x80; // safe: length checked above
+    const payload = needsPadding ? Buffer.concat([Buffer.from([0x00]), data]) : data;
+    return Buffer.concat([Buffer.from([0x02, ...encodeLength(payload.length)]), payload]);
+}
+function encodeSequence(content) {
+    return Buffer.concat([Buffer.from([0x30, ...encodeLength(content.length)]), content]);
+}
+//# sourceMappingURL=oidc.js.map