@m1212e/oidc 0.0.0-stage → 0.1.0

package/out/index.cjs

@@ -0,0 +1,1017 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let jose = require("jose");
+let openid_client = require("openid-client");
+let typebox = require("typebox");
+let typebox_compile = require("typebox/compile");
+let typebox_value = require("typebox/value");
+// lib/errors.ts
+var OidcError = class extends Error {
+	refreshedTokens;
+	constructor(message, options) {
+		super(message, options);
+		this.name = "OidcError";
+	}
+};
+var OidcInputError = class extends OidcError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "OidcInputError";
+	}
+};
+var OidcTokenError = class extends OidcError {
+	tokenKind;
+	claim;
+	constructor(tokenKind, claim, message) {
+		super(message);
+		this.name = "OidcTokenError";
+		this.tokenKind = tokenKind;
+		this.claim = claim;
+	}
+};
+function describe(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+var OidcTokenValidationError = class extends OidcError {
+	tokenKinds;
+	failures;
+	constructor(tokenKinds, failures) {
+		const relevant = failures.filter((failure) => tokenKinds.includes(failure.tokenKind));
+		const detail = relevant.length ? relevant.map((failure) => `${failure.tokenKind} token ${failure.stage} failed (${describe(failure.error)})`).join("; ") : "no validation strategy was available for it";
+		super(`could not validate the ${tokenKinds.join(" and ")} token${tokenKinds.length > 1 ? "s" : ""}: ${detail}`, { cause: relevant[0]?.error });
+		this.name = "OidcTokenValidationError";
+		this.tokenKinds = tokenKinds;
+		this.failures = relevant;
+	}
+};
+var OidcSubjectError = class extends OidcError {
+	expected;
+	actual;
+	constructor(message, expected, actual) {
+		super(message);
+		this.name = "OidcSubjectError";
+		this.expected = expected;
+		this.actual = actual;
+	}
+};
+var OidcGrantError = class extends OidcError {
+	grant;
+	constructor(grant, message, options) {
+		super(message, options);
+		this.name = "OidcGrantError";
+		this.grant = grant;
+	}
+};
+var OidcStateError = class extends OidcError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "OidcStateError";
+	}
+};
+var OidcClaimsError = class extends OidcError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "OidcClaimsError";
+	}
+};
+var OidcUserInfoError = class extends OidcError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "OidcUserInfoError";
+	}
+};
+var OidcLogoutError = class extends OidcError {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "OidcLogoutError";
+	}
+};
+function attachRefreshedTokens(error, refreshedTokens) {
+	if (refreshedTokens && error instanceof OidcError && !(error instanceof OidcSubjectError)) error.refreshedTokens = refreshedTokens;
+	return error;
+}
+// lib/audience.ts
+const DEFAULT_AUTHORIZED_PARTY_CLAIMS = [
+	"azp",
+	"client_id",
+	"cid",
+	"appid"
+];
+var OidcAudienceError = class extends OidcTokenError {
+	constructor(tokenKind, claim, message) {
+		super(tokenKind, claim, message);
+		this.name = "OidcAudienceError";
+	}
+};
+function toAudienceList(aud) {
+	if (typeof aud === "string") return [aud];
+	if (Array.isArray(aud)) return aud.filter((entry) => typeof entry === "string");
+	return [];
+}
+function findAuthorizedParty(claims, claimNames) {
+	for (const claim of claimNames) {
+		const value = claims[claim];
+		if (value === void 0 || value === null) continue;
+		return {
+			claim,
+			value
+		};
+	}
+}
+function audienceVerifyOption(policy, tokenKind) {
+	if (policy.verifyAudience) return void 0;
+	return tokenKind === "id" ? policy.clientId : policy.expectedAudience;
+}
+function assertAudienceClaim(claims, tokenKind, policy) {
+	const expected = tokenKind === "id" ? [policy.clientId] : policy.expectedAudience;
+	if (!expected?.length) return;
+	const aud = toAudienceList(claims.aud);
+	if (!aud.some((entry) => expected.includes(entry))) throw new OidcAudienceError(tokenKind, "aud", `${tokenKind} token "aud" (${aud.length ? aud.join(", ") : "absent"}) does not include any expected audience (${expected.join(", ")})`);
+}
+function assertAuthorizedParty(claims, tokenKind, policy) {
+	const { clientId, expectedAudience, authorizedPartyClaims } = policy;
+	if (tokenKind === "id") {
+		const azp = claims.azp;
+		if (azp !== void 0 && azp !== null) {
+			if (azp !== clientId) throw new OidcAudienceError("id", "azp", `id token "azp" (${String(azp)}) is not this client id (${clientId})`);
+			return;
+		}
+		const aud = toAudienceList(claims.aud);
+		if (aud.length > 1) throw new OidcAudienceError("id", "azp", `id token "aud" names multiple parties (${aud.join(", ")}) but carries no "azp" claim identifying the authorized one`);
+		return;
+	}
+	if (expectedAudience?.length) {
+		assertAudienceClaim(claims, "access", policy);
+		return;
+	}
+	const party = findAuthorizedParty(claims, authorizedPartyClaims);
+	if (party) {
+		if (typeof party.value !== "string" || party.value !== clientId) throw new OidcAudienceError("access", party.claim, `access token "${party.claim}" (${typeof party.value === "string" ? party.value : JSON.stringify(party.value)}) is not this client id (${clientId})`);
+		return;
+	}
+	throw new OidcAudienceError("access", "aud", `access token cannot be bound to this client: it carries none of the authorized-party claims (${authorizedPartyClaims.join(", ")}) and no "expectedAudience" is configured. Set "expectedAudience" to the value this resource server expects in "aud", extend "authorizedPartyClaims" with the claim your provider uses, or supply "verifyAudience".`);
+}
+function assertAudienceAfterJwtVerify(claims, tokenKind, policy) {
+	if (policy.verifyAudience) {
+		if (!policy.verifyAudience(claims, tokenKind)) throw new OidcAudienceError(tokenKind, "aud", `verifyAudience rejected the ${tokenKind} token`);
+		return;
+	}
+	assertAuthorizedParty(claims, tokenKind, policy);
+}
+function assertTokenAudience(claims, tokenKind, policy) {
+	if (!policy.verifyAudience) assertAudienceClaim(claims, tokenKind, policy);
+	assertAudienceAfterJwtVerify(claims, tokenKind, policy);
+}
+function assertIntrospectedIdTokenAudience(claims, policy) {
+	if (policy.verifyAudience) {
+		if (!policy.verifyAudience(claims, "id")) throw new OidcAudienceError("id", "aud", "verifyAudience rejected the id token");
+		return;
+	}
+	const aud = toAudienceList(claims.aud);
+	if (aud.length && !aud.includes(policy.clientId)) throw new OidcAudienceError("id", "aud", `id token introspection response reports "aud" (${aud.join(", ")}), which does not include this client id (${policy.clientId})`);
+	const claimNames = policy.authorizedPartyClaims.includes("azp") ? policy.authorizedPartyClaims : ["azp", ...policy.authorizedPartyClaims];
+	const party = findAuthorizedParty(claims, claimNames);
+	if (party) {
+		if (typeof party.value !== "string" || party.value !== policy.clientId) throw new OidcAudienceError("id", party.claim, `id token introspection response reports "${party.claim}" (${typeof party.value === "string" ? party.value : JSON.stringify(party.value)}), which is not this client id (${policy.clientId})`);
+		return;
+	}
+	if (aud.length > 1) throw new OidcAudienceError("id", "azp", `id token introspection response reports an "aud" naming multiple parties (${aud.join(", ")}) but nothing identifying the authorized one`);
+	if (aud.length) return;
+	throw new OidcAudienceError("id", "aud", `id token introspection response cannot be bound to this client: it reports no "aud" and carries none of the authorized-party claims (${claimNames.join(", ")}). Extend "authorizedPartyClaims" with the claim your provider reports, or supply "verifyAudience".`);
+}
+function buildAudiencePolicy(opts) {
+	const supplied = typeof opts.expectedAudience === "string" ? [opts.expectedAudience] : opts.expectedAudience ?? [];
+	const invalid = supplied.filter((entry) => typeof entry !== "string" || entry.length === 0);
+	if (invalid.length) throw new TypeError(`invalid expectedAudience: every entry must be a non-empty string, and ${invalid.length} of ${supplied.length} ${invalid.length === 1 ? "is" : "are"} not. An empty audience matches nothing, so it cannot be dropped without silently replacing the resource-audience binding with the authorized-party one. Omit "expectedAudience" entirely to use that binding on purpose.`);
+	const expected = supplied;
+	return {
+		clientId: opts.clientId,
+		expectedAudience: expected.length ? expected : void 0,
+		authorizedPartyClaims: opts.authorizedPartyClaims ?? DEFAULT_AUTHORIZED_PARTY_CLAIMS,
+		verifyAudience: opts.verifyAudience
+	};
+}
+// lib/discovery.ts
+function resolveDevelopment(development) {
+	if (development !== void 0) return development;
+	if (typeof process === "undefined") return false;
+	return process.env?.NODE_ENV === "development";
+}
+const DEFAULT_SIGNING_ALGORITHMS = [
+	"RS256",
+	"RS384",
+	"RS512",
+	"PS256",
+	"PS384",
+	"PS512",
+	"ES256",
+	"ES256K",
+	"ES384",
+	"ES512",
+	"EdDSA",
+	"Ed25519"
+];
+function isAsymmetricAlgorithm(alg) {
+	return /^(RS|PS|ES|Ed)/.test(alg);
+}
+function resolveJwksUri(jwksUri, development) {
+	let url;
+	try {
+		url = new URL(jwksUri);
+	} catch {
+		throw new TypeError(`the issuer advertises a jwks_uri that is not a URL ("${jwksUri}")`);
+	}
+	if (url.protocol === "https:") return url;
+	if (development && url.protocol === "http:") return url;
+	throw new TypeError(`refusing the issuer's jwks_uri ("${jwksUri}"): signing keys must be fetched over https, and this is ${url.protocol.replace(":", "")}. Every token signature is checked against those keys, so anyone on the network could substitute their own and mint tokens for any user. Set "development: true" only if this is a local IdP.`);
+}
+function issuerMatchExempt(url) {
+	return url.origin === "https://login.microsoftonline.com" || url.hostname.endsWith(".b2clogin.com");
+}
+const WELL_KNOWN = "/.well-known/";
+const withoutTrailingSlash = (value) => value.replace(/\/+$/, "");
+function assertDiscoveredIssuer(configured, discovered) {
+	let configuredUrl;
+	try {
+		configuredUrl = new URL(configured);
+	} catch {
+		return;
+	}
+	const path = configuredUrl.origin + configuredUrl.pathname;
+	const wellKnownAt = path.indexOf(WELL_KNOWN);
+	if (wellKnownAt === -1) return;
+	if (!withoutTrailingSlash(path.slice(wellKnownAt + 13)).includes("/") && !issuerMatchExempt(configuredUrl)) {
+		const expected = withoutTrailingSlash(path.slice(0, wellKnownAt));
+		if (withoutTrailingSlash(discovered) === expected) return;
+		throw new TypeError(`the metadata document at "${configured}" names a different issuer ("${discovered}") than the "${expected}" it was fetched for. Every token is verified against the issuer the document declares, and its keys and endpoints come from the same document, so this is not a mismatch that can be accepted. Configure "issuer" as the issuer identifier itself rather than its .well-known URL, or point it at the provider that really serves "${discovered}".`);
+	}
+	let discoveredUrl;
+	try {
+		discoveredUrl = new URL(discovered);
+	} catch {
+		throw new TypeError(`the metadata document at "${configured}" names an issuer that is not a URL ("${discovered}"), so it cannot be checked against the provider it was fetched from. Every token is verified against the issuer the document declares, and its keys and endpoints come from the same document, so an issuer that cannot be compared cannot be accepted. Configure "issuer" as the issuer identifier itself rather than its .well-known URL.`);
+	}
+	if (discoveredUrl.origin === configuredUrl.origin) return;
+	throw new TypeError(`the metadata document at "${configured}" names an issuer on a different origin ("${discovered}"). Every token is verified against the issuer the document declares, and its keys and endpoints come from the same document, so a document that hands off to another host cannot be accepted. Configure "issuer" as the issuer identifier itself rather than its .well-known URL.`);
+}
+function assertPkceSupported(methods, clientSecret, log) {
+	if (methods?.includes("S256")) return;
+	if (methods?.length) throw new TypeError(`the issuer does not support the S256 PKCE challenge method (it advertises: ${methods.join(", ")}). This library sends S256 on every authorization request, and without it an authorization code isn't bound to the login that requested it. An issuer that ignores it would leave the code redeemable by anyone who obtained it.`);
+	log.warn(`[oidc] the issuer advertises no "code_challenge_methods_supported", so it cannot be confirmed that the PKCE challenge this library sends is honoured${clientSecret ? "" : ". This is a public client, where PKCE is the only thing protecting the token endpoint"}. Verify that PKCE is enforced for this client at the IdP.`);
+}
+const DURATION_MULTIPLIERS = {
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 86400,
+	w: 604800,
+	y: 31557600
+};
+const DURATION = /^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i;
+function resolveClockTolerance(clockTolerance) {
+	if (clockTolerance === void 0) return 30;
+	if (typeof clockTolerance === "number") {
+		if (!Number.isFinite(clockTolerance) || clockTolerance < 0) throw new TypeError(`invalid clockTolerance (${clockTolerance}): expected a non-negative number of seconds`);
+		return clockTolerance;
+	}
+	const matched = DURATION.exec(clockTolerance.trim());
+	if (!matched) throw new TypeError(`invalid clockTolerance ("${clockTolerance}"): expected seconds as a number, or a duration such as "30 seconds" or "5m"`);
+	const unit = matched[2][0]?.toLowerCase();
+	return Math.round(Number.parseFloat(matched[1]) * DURATION_MULTIPLIERS[unit]);
+}
+function resolveSigningAlgorithms(config, signingAlgorithms, log) {
+	const advertised = config.serverMetadata().id_token_signing_alg_values_supported ?? [];
+	const advertisedAlgorithms = advertised.filter(isAsymmetricAlgorithm);
+	if (advertised.length !== advertisedAlgorithms.length) log.debug(`[oidc] ignoring advertised signing algorithms that no JWKS key can verify: ${advertised.filter((alg) => !isAsymmetricAlgorithm(alg)).join(", ")}`);
+	return signingAlgorithms ?? (advertisedAlgorithms.length ? advertisedAlgorithms : [...DEFAULT_SIGNING_ALGORITHMS]);
+}
+// lib/logger.ts
+const LEVELS = {
+	silent: 0,
+	error: 1,
+	warn: 2,
+	info: 3,
+	debug: 4
+};
+const noop = () => {};
+function buildLogger(logger, logLevel) {
+	if (logger) return logger;
+	const threshold = LEVELS[logLevel ?? "warn"];
+	return {
+		error: threshold >= LEVELS.error ? (...args) => console.error(...args) : noop,
+		warn: threshold >= LEVELS.warn ? (...args) => console.warn(...args) : noop,
+		info: threshold >= LEVELS.info ? (...args) => console.info(...args) : noop,
+		debug: threshold >= LEVELS.debug ? (...args) => console.debug(...args) : noop
+	};
+}
+// lib/returnTo.ts
+const PROBE_ORIGIN = "https://return-to.invalid";
+const FORBIDDEN_CHARACTERS = /[\u0000-\u0020\u007f\\]/;
+var OidcReturnToError = class extends OidcError {
+	returnTo;
+	constructor(returnTo, message) {
+		super(message);
+		this.name = "OidcReturnToError";
+		this.returnTo = returnTo;
+	}
+};
+function buildReturnToPolicy(opts) {
+	return { allowedOrigins: (opts.allowedReturnToOrigins ?? []).map((entry) => {
+		let origin;
+		try {
+			origin = new URL(entry).origin;
+		} catch {
+			throw new TypeError(`invalid allowedReturnToOrigins entry ("${entry}"): expected an absolute URL such as "https://app.example.com"`);
+		}
+		if (origin === "null") throw new TypeError(`invalid allowedReturnToOrigins entry ("${entry}"): this URL has no origin to compare against`);
+		return origin;
+	}) };
+}
+function assertNoForbiddenCharacters(value) {
+	const forbidden = FORBIDDEN_CHARACTERS.exec(value);
+	if (!forbidden) return;
+	throw new OidcReturnToError(value, `invalid returnTo ("${value}"): contains ${forbidden[0] === "\\" ? "a backslash, which a URL parser reads as a slash" : `the character U+${value.codePointAt(forbidden.index)?.toString(16).padStart(4, "0").toUpperCase()}, which a browser would strip or refuse`}`);
+}
+function assertSafeRelativeReturnTo(returnTo) {
+	let resolved;
+	try {
+		resolved = new URL(returnTo, PROBE_ORIGIN);
+	} catch {
+		throw new OidcReturnToError(returnTo, `invalid returnTo ("${returnTo}"): not a usable path`);
+	}
+	if (resolved.origin !== PROBE_ORIGIN) throw new OidcReturnToError(returnTo, `refusing returnTo ("${returnTo}"): it looks relative but navigates to ${resolved.origin}. Only same-site paths are allowed unless the origin is listed in "allowedReturnToOrigins".`);
+}
+function assertSafeAbsoluteReturnTo(returnTo, policy) {
+	let absolute;
+	try {
+		absolute = new URL(returnTo);
+	} catch {
+		throw new OidcReturnToError(returnTo, `invalid returnTo ("${returnTo}"): expected a path beginning with "/", or an absolute URL on an allowed origin`);
+	}
+	if (absolute.protocol !== "https:" && absolute.protocol !== "http:") throw new OidcReturnToError(returnTo, `refusing returnTo ("${returnTo}"): only http and https URLs may be redirected to`);
+	if (!policy.allowedOrigins.includes(absolute.origin)) throw new OidcReturnToError(returnTo, policy.allowedOrigins.length ? `refusing returnTo ("${returnTo}"): ${absolute.origin} is not one of the allowed origins (${policy.allowedOrigins.join(", ")})` : `refusing returnTo ("${returnTo}"): absolute redirect targets need their origin listed in "allowedReturnToOrigins". A same-site path such as "/dashboard" needs no configuration.`);
+	if (absolute.username || absolute.password) throw new OidcReturnToError(returnTo, `refusing returnTo ("${returnTo}"): it embeds credentials, which disguise the origin it actually points at (${absolute.origin})`);
+}
+function assertSafeReturnTo(returnTo, policy) {
+	if (typeof returnTo !== "string" || returnTo.length === 0) throw new OidcReturnToError(String(returnTo), "invalid returnTo: expected a non-empty path such as \"/dashboard\"");
+	assertNoForbiddenCharacters(returnTo);
+	if (returnTo.startsWith("/")) {
+		assertSafeRelativeReturnTo(returnTo);
+		return returnTo;
+	}
+	assertSafeAbsoluteReturnTo(returnTo, policy);
+	return returnTo;
+}
+function assertSafeRedirectUri(uri, label) {
+	if (typeof uri !== "string" || uri.length === 0) throw new OidcReturnToError(String(uri), `invalid ${label}: expected an absolute URL such as "https://app.example.com/callback"`);
+	if (FORBIDDEN_CHARACTERS.test(uri)) throw new OidcReturnToError(uri, `invalid ${label} ("${uri}"): contains a control character, a space or a backslash`);
+	let parsed;
+	try {
+		parsed = new URL(uri);
+	} catch {
+		throw new OidcReturnToError(uri, `invalid ${label} ("${uri}"): expected an absolute URL such as "https://app.example.com/callback"`);
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new OidcReturnToError(uri, `refusing ${label} ("${uri}"): only http and https URLs may be redirected to`);
+	if (parsed.username || parsed.password) throw new OidcReturnToError(uri, `refusing ${label} ("${uri}"): it embeds credentials, which disguise the origin it actually points at (${parsed.origin})`);
+	return uri;
+}
+// lib/tokenType.ts
+const DEFAULT_ID_TOKEN_ONLY_CLAIMS = [
+	"nonce",
+	"at_hash",
+	"c_hash",
+	"s_hash"
+];
+const ACCESS_TOKEN_TYP = "application/at+jwt";
+const NAMED_TOKEN_KINDS = /* @__PURE__ */ new Map([
+	["access", "access"],
+	["access_token", "access"],
+	["bearer", "access"],
+	["dpop", "access"],
+	["mac", "access"],
+	["n_a", "access"],
+	["at+jwt", "access"],
+	["id", "id"],
+	["id_token", "id"],
+	["id+jwt", "id"],
+	["logout", "other"],
+	["logout+jwt", "other"],
+	["offline", "other"],
+	["refresh", "other"],
+	["refresh_token", "other"],
+	["refresh+jwt", "other"],
+	["secevent+jwt", "other"],
+	["serialized-id", "other"]
+]);
+function namedKind(value) {
+	if (typeof value !== "string" || value.length === 0) return void 0;
+	const bare = value.trim().toLowerCase().replace(/^application\//, "");
+	return NAMED_TOKEN_KINDS.get(bare);
+}
+function normalizeTyp(typ) {
+	if (typeof typ !== "string" || typ.length === 0) return void 0;
+	const lower = typ.toLowerCase();
+	return lower.includes("/") ? lower : `application/${lower}`;
+}
+var OidcTokenTypeError = class extends OidcTokenError {
+	constructor(tokenKind, claim, message) {
+		super(tokenKind, claim, message);
+		this.name = "OidcTokenTypeError";
+	}
+};
+function buildTokenTypePolicy(opts) {
+	return {
+		idTokenOnlyClaims: opts.idTokenOnlyClaims ?? DEFAULT_ID_TOKEN_ONLY_CLAIMS,
+		accessTokenTyp: normalizeTyp(opts.accessTokenTyp),
+		requireIntrospectedTokenType: opts.requireIntrospectedTokenType ?? true
+	};
+}
+function assertTokenTypeFromClaims(claims, tokenKind, policy) {
+	if (tokenKind === "access") for (const claim of policy.idTokenOnlyClaims) {
+		if (claims[claim] === void 0) continue;
+		throw new OidcTokenTypeError("access", claim, `access token carries "${claim}", a claim defined for ID tokens only. An ID token must never be accepted as an access token.`);
+	}
+	for (const claim of [
+		"token_use",
+		"typ",
+		"token_type"
+	]) {
+		const kind = namedKind(claims[claim]);
+		if (kind === void 0 || kind === tokenKind) continue;
+		throw new OidcTokenTypeError(tokenKind, claim, `${tokenKind} token has "${claim}" (${String(claims[claim])}), naming ${kind === "other" ? "neither an access token nor an ID token" : `an ${kind} token`}. A token must be the kind it was presented as.`);
+	}
+	if (claims.events !== void 0) throw new OidcTokenTypeError(tokenKind, "events", `${tokenKind} token carries "events", making it a back-channel logout token rather than ${tokenKind === "id" ? "an ID" : "an access"} token`);
+}
+function assertTokenTypeAfterJwtVerify(claims, header, tokenKind, policy) {
+	assertTokenTypeFromClaims(claims, tokenKind, policy);
+	const typ = normalizeTyp(header.typ);
+	if (tokenKind === "access" && policy.accessTokenTyp) {
+		if (typ !== policy.accessTokenTyp) throw new OidcTokenTypeError("access", "typ", `access token "typ" header (${typ ?? "absent"}) is not the required ${policy.accessTokenTyp}`);
+		return;
+	}
+	const named = namedKind(header.typ);
+	if (named !== void 0 && named !== tokenKind) throw new OidcTokenTypeError(tokenKind, "typ", `${tokenKind} token "typ" header (${typ}) names ${named === "other" ? "neither an access token nor an ID token" : `an ${named} token`}${typ === ACCESS_TOKEN_TYP ? " (the RFC 9068 access token type)" : ""}. A token must be the kind it was presented as.`);
+}
+function assertIntrospectedAccessToken(claims, policy) {
+	assertTokenTypeFromClaims(claims, "access", policy);
+	if (introspectedKind(claims) === "access") return;
+	if (!policy.requireIntrospectedTokenType) return;
+	throw new OidcTokenTypeError("access", "token_type", `introspection response does not name an access token: it carries no recognized "token_type", "typ" or "token_use". RFC 7662 reports a "token_type" only for tokens that have one, so a response without it is as consistent with a refresh token as with an access token, and a refresh token must never be accepted as one. Set "requireIntrospectedTokenType: false" only if your provider omits the type on genuine access tokens.`);
+}
+function assertIntrospectedIdToken(claims, policy) {
+	assertTokenTypeFromClaims(claims, "id", policy);
+	if (introspectedKind(claims) === "id") return;
+	if (!policy.requireIntrospectedTokenType) return;
+	throw new OidcTokenTypeError("id", "token_type", `introspection response does not name an ID token: it carries no recognized "token_type", "typ" or "token_use". One introspection endpoint answers for every token type an AS issues, so a response that does not say what it describes is as consistent with an access or refresh token as with an ID token, and neither may be accepted as one. Set "requireIntrospectedTokenType: false" only if your provider omits the type on genuine ID tokens.`);
+}
+function introspectedKind(claims) {
+	return [
+		"token_type",
+		"typ",
+		"token_use"
+	].map((claim) => namedKind(claims[claim])).find((kind) => kind !== void 0);
+}
+// lib/core/logout.ts
+function createLogout(ctx) {
+	/**
+	* Builds the provider's RP-initiated logout URL.
+	* @example const url = await oidc.getLogoutUrl({ postLogoutRedirectUri: "https://app.example.com/", idTokenHint: id_token });
+	*/
+	return async function getLogoutUrl({ postLogoutRedirectUri, idTokenHint, state }) {
+		assertSafeRedirectUri(postLogoutRedirectUri, "postLogoutRedirectUri");
+		try {
+			return (0, openid_client.buildEndSessionUrl)(ctx.config, {
+				post_logout_redirect_uri: postLogoutRedirectUri,
+				...idTokenHint ? { id_token_hint: idTokenHint } : {},
+				...state ? { state } : {}
+			});
+		} catch (err) {
+			throw new OidcLogoutError(`could not build a logout URL for ${ctx.issuer}: ${err instanceof Error ? err.message : String(err)}. If the issuer advertises no "end_session_endpoint" it does not support RP-initiated logout, so you need its own logout URL instead. Destroying your session locally is all this library can do for you.`, { cause: err });
+		}
+	};
+}
+// lib/tokenValidation.ts
+const JWS_COMPACT = /^[\w-]+\.[\w-]*\.[\w-]+$/;
+function looksLikeJwt(token) {
+	if (!JWS_COMPACT.test(token)) return false;
+	try {
+		return typeof (0, jose.decodeProtectedHeader)(token).alg === "string";
+	} catch {
+		return false;
+	}
+}
+function subjectOf(claims) {
+	const sub = claims?.sub;
+	return typeof sub === "string" && sub.length > 0 ? sub : void 0;
+}
+function unverifiedSubject(token) {
+	if (!token || !looksLikeJwt(token)) return void 0;
+	try {
+		return subjectOf((0, jose.decodeJwt)(token));
+	} catch {
+		return;
+	}
+}
+var StrategyOutcome = class {
+	log;
+	accessTokenValue;
+	idTokenValue;
+	failures = [];
+	expired = false;
+	fatal;
+	constructor(log) {
+		this.log = log;
+	}
+	onError(kind, stage) {
+		return (err) => {
+			if (err instanceof OidcTokenError) {
+				this.fatal ??= err;
+				return;
+			}
+			if (err instanceof jose.errors.JWTClaimValidationFailed && err.claim === "aud") {
+				this.fatal ??= new OidcAudienceError(kind, "aud", err.message);
+				return;
+			}
+			if (err instanceof jose.errors.JWTExpired) this.expired = true;
+			this.failures.push({
+				tokenKind: kind,
+				stage,
+				error: err
+			});
+			this.log.debug(`[oidc] ${kind} token ${stage} failed:`, err.message);
+		};
+	}
+};
+async function verifyTokensLocally(jwks, tokens, jwtVerifyOptionsFor, tokenTypePolicy, audiencePolicy, log) {
+	const outcome = new StrategyOutcome(log);
+	const promises = [];
+	if (tokens.access) promises.push((0, jose.jwtVerify)(tokens.access, jwks, jwtVerifyOptionsFor("access")).then((result) => {
+		assertTokenTypeAfterJwtVerify(result.payload, result.protectedHeader, "access", tokenTypePolicy);
+		assertAudienceAfterJwtVerify(result.payload, "access", audiencePolicy);
+		outcome.accessTokenValue = result.payload;
+	}).catch(outcome.onError("access", "JWT verification")));
+	if (tokens.id) promises.push((0, jose.jwtVerify)(tokens.id, jwks, jwtVerifyOptionsFor("id")).then((result) => {
+		assertTokenTypeAfterJwtVerify(result.payload, result.protectedHeader, "id", tokenTypePolicy);
+		assertAudienceAfterJwtVerify(result.payload, "id", audiencePolicy);
+		outcome.idTokenValue = result.payload;
+	}).catch(outcome.onError("id", "JWT verification")));
+	await Promise.allSettled(promises);
+	if (outcome.fatal) throw outcome.fatal;
+	return outcome;
+}
+async function introspectTokens(config, tokens, which, tokenTypePolicy, audiencePolicy, log) {
+	const outcome = new StrategyOutcome(log);
+	const promises = [];
+	if (which.access && tokens.access) promises.push((0, openid_client.tokenIntrospection)(config, tokens.access).then((result) => {
+		if (!result.active) throw new Error("access token is not active");
+		assertIntrospectedAccessToken(result, tokenTypePolicy);
+		assertTokenAudience(result, "access", audiencePolicy);
+		outcome.accessTokenValue = result;
+	}).catch(outcome.onError("access", "introspection")));
+	if (which.id && tokens.id) promises.push((0, openid_client.tokenIntrospection)(config, tokens.id).then((result) => {
+		if (!result.active) throw new Error("id token is not active");
+		assertIntrospectedIdToken(result, tokenTypePolicy);
+		assertIntrospectedIdTokenAudience(result, audiencePolicy);
+		outcome.idTokenValue = result;
+	}).catch(outcome.onError("id", "introspection")));
+	await Promise.allSettled(promises);
+	if (outcome.fatal) throw outcome.fatal;
+	return outcome;
+}
+// lib/types.ts
+const nullable = (t) => typebox.Type.Optional(typebox.Type.Union([typebox.Type.Null(), t]));
+const LowercaseEmail = (0, typebox.Decode)(typebox.Type.String(), (s) => s.toLowerCase());
+const VerifiedFlag = (0, typebox.Decode)(typebox.Type.Union([
+	typebox.Type.Boolean(),
+	typebox.Type.String(),
+	typebox.Type.Number()
+]), (value) => {
+	if (typeof value === "boolean") return value;
+	if (typeof value === "number") return value === 1;
+	return value.trim().toLowerCase() === "true";
+});
+const OIDCUserSchema = typebox.Type.Object({
+	iss: typebox.Type.Optional(typebox.Type.String({ minLength: 1 })),
+	sub: typebox.Type.String({ minLength: 1 }),
+	email: nullable(LowercaseEmail),
+	email_verified: nullable(VerifiedFlag),
+	name: nullable(typebox.Type.String()),
+	given_name: nullable(typebox.Type.String()),
+	family_name: nullable(typebox.Type.String()),
+	middle_name: nullable(typebox.Type.String()),
+	nickname: nullable(typebox.Type.String()),
+	preferred_username: nullable(typebox.Type.String()),
+	profile: nullable(typebox.Type.String()),
+	picture: nullable(typebox.Type.String()),
+	website: nullable(typebox.Type.String()),
+	gender: nullable(typebox.Type.String()),
+	birthdate: nullable(typebox.Type.String()),
+	zoneinfo: nullable(typebox.Type.String()),
+	locale: nullable(typebox.Type.String()),
+	phone_number: nullable(typebox.Type.String()),
+	phone_number_verified: nullable(VerifiedFlag),
+	address: nullable(typebox.Type.Object({
+		formatted: typebox.Type.Optional(typebox.Type.String()),
+		street_address: typebox.Type.Optional(typebox.Type.String()),
+		locality: typebox.Type.Optional(typebox.Type.String()),
+		region: typebox.Type.Optional(typebox.Type.String()),
+		postal_code: typebox.Type.Optional(typebox.Type.String()),
+		country: typebox.Type.Optional(typebox.Type.String())
+	})),
+	updated_at: nullable(typebox.Type.Number())
+});
+const CompiledOIDCUser = (0, typebox_compile.Compile)(OIDCUserSchema);
+const USER_CLAIM_SCHEMAS = OIDCUserSchema.properties;
+const OPTIONAL_USER_CLAIMS = Object.keys(USER_CLAIM_SCHEMAS).filter((claim) => claim !== "sub");
+function parseOIDCUser(value) {
+	const claims = typeof value === "object" && value !== null ? value : {};
+	const candidate = { sub: claims.sub };
+	for (const claim of OPTIONAL_USER_CLAIMS) {
+		const supplied = claims[claim];
+		if (supplied === void 0) continue;
+		const schema = USER_CLAIM_SCHEMAS[claim];
+		if (typebox_value.Value.Check(schema, supplied)) candidate[claim] = supplied;
+	}
+	if (!CompiledOIDCUser.Check(candidate)) {
+		const [first] = [...CompiledOIDCUser.Errors(candidate)];
+		throw new OidcClaimsError(`could not read the validated claims as a user: ${first ? `${first.instancePath || "/"} ${first.message}` : "unknown claim shape"}`);
+	}
+	return CompiledOIDCUser.Decode(candidate);
+}
+const OIDCFlowStateSchema = typebox.Type.Object({
+	visitedUrl: typebox.Type.String(),
+	random: typebox.Type.String(),
+	nonce: typebox.Type.Optional(typebox.Type.String())
+});
+const CompiledOIDCFlowState = (0, typebox_compile.Compile)(OIDCFlowStateSchema);
+function parseOIDCFlowState(value) {
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch (err) {
+		throw new OidcStateError("could not read the stored OAuth state: it is not the value startSignin returned. Hand it back exactly as it was stored, unmodified.", { cause: err });
+	}
+	try {
+		return CompiledOIDCFlowState.Decode(CompiledOIDCFlowState.Clean(parsed));
+	} catch (err) {
+		const [first] = [...CompiledOIDCFlowState.Errors(parsed)];
+		throw new OidcStateError(`the stored OAuth state is not the shape startSignin produces: ${first ? `${first.instancePath || "/"} ${first.message}` : "unknown state shape"}`, { cause: err });
+	}
+}
+const VOUCHED_CLAIMS = [["email", "email_verified"], ["phone_number", "phone_number_verified"]];
+function mergeTokenClaims(accessTokenClaims, idTokenClaims, onConflict) {
+	const access = accessTokenClaims ?? {};
+	const id = idTokenClaims ?? {};
+	const merged = {
+		...access,
+		...id
+	};
+	for (const [value, flag] of VOUCHED_CLAIMS) {
+		if (onConflict && access[value] !== void 0 && id[value] !== void 0 && access[value] !== id[value]) onConflict(value);
+		const source = id[value] !== void 0 ? id : access[value] !== void 0 ? access : void 0;
+		if (source?.[flag] === void 0) delete merged[flag];
+		else merged[flag] = source[flag];
+	}
+	return merged;
+}
+// lib/core/grant.ts
+function jwtVerifyOptions(ctx, tokenKind) {
+	return {
+		issuer: ctx.issuer,
+		audience: audienceVerifyOption(ctx.audiencePolicy, tokenKind),
+		clockTolerance: ctx.clockTolerance,
+		algorithms: ctx.signingAlgorithms,
+		requiredClaims: tokenKind === "id" ? [
+			"iss",
+			"sub",
+			"aud",
+			"exp",
+			"iat"
+		] : [
+			"iss",
+			"sub",
+			"exp"
+		]
+	};
+}
+function assertGrantedIdToken(ctx, tokens) {
+	const claims = tokens.claims();
+	if (claims) assertTokenAudience(claims, "id", ctx.audiencePolicy);
+}
+// lib/core/processTokens.ts
+function assertOptionalToken(value, label) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || value.length === 0) throw new OidcInputError(`processTokens was given a malformed \`${label}\`: expected a non-empty string, or \`undefined\` to omit it, got ${value === null ? "null" : JSON.stringify(value)}. Pass \`undefined\`, not \`null\`/\`""\`, when you don't have this token.`);
+	return value;
+}
+function createSenderConstrainedWarning(log) {
+	let warned = false;
+	return (claims) => {
+		if (warned) return;
+		const cnf = claims?.cnf;
+		if (cnf === void 0 || cnf === null) return;
+		warned = true;
+		log.warn("[oidc] this access token carries a \"cnf\" claim: the issuer bound it to a key (DPoP or mTLS), and that binding is not being checked. Validating it needs the proof that travels with the HTTP request, which this library never sees. The token is accepted as an ordinary bearer token, so a stolen one is usable by anyone. Verify the proof at your edge if you accept tokens from callers you do not control.");
+	};
+}
+function createProcessTokens(ctx, refresh) {
+	const warnIfSenderConstrained = createSenderConstrainedWarning(ctx.log);
+	function worthIntrospecting(token) {
+		return ctx.introspectionMode !== "never" && (ctx.introspectionMode === "auto" || !ctx.jwks || !looksLikeJwt(token));
+	}
+	/**
+	* Validates the tokens and returns the user, refreshing once if a `refresh_token` is given and validation fails.
+	* @example const { user, refreshed, refreshedTokens } = await oidc.processTokens({ access_token, id_token, refresh_token });
+	*/
+	return async function processTokens(input) {
+		const access_token = assertOptionalToken(input.access_token, "access_token");
+		const id_token = assertOptionalToken(input.id_token, "id_token");
+		const refresh_token = assertOptionalToken(input.refresh_token, "refresh_token");
+		const { subject } = input;
+		if (!access_token && !id_token) throw new OidcInputError("processTokens needs an access token, an id token, or both. Validating neither is meaningless");
+		if (subject !== void 0 && (typeof subject !== "string" || !subject)) throw new OidcInputError("processTokens was given a `subject` that is not a non-empty string");
+		let currentAccessToken = access_token;
+		let currentIdToken = id_token;
+		let newTokens;
+		let accessTokenValue;
+		let idTokenValue;
+		let failures = [];
+		let boundSubject = subject ?? unverifiedSubject(id_token) ?? unverifiedSubject(access_token);
+		try {
+			for (let attempt = 0; attempt < 2; attempt++) {
+				accessTokenValue = void 0;
+				idTokenValue = void 0;
+				failures = [];
+				let expired = false;
+				if (ctx.jwks) {
+					const local = await verifyTokensLocally(ctx.jwks, {
+						access: currentAccessToken,
+						id: currentIdToken
+					}, (tokenKind) => jwtVerifyOptions(ctx, tokenKind), ctx.tokenTypePolicy, ctx.audiencePolicy, ctx.log);
+					accessTokenValue = local.accessTokenValue;
+					idTokenValue = local.idTokenValue;
+					failures = local.failures;
+					expired = local.expired;
+				}
+				if (!(expired && !!refresh_token)) {
+					const introspectAccess = !accessTokenValue && !!currentAccessToken && worthIntrospecting(currentAccessToken);
+					const introspectId = !idTokenValue && !!currentIdToken && worthIntrospecting(currentIdToken);
+					if (introspectAccess || introspectId) {
+						ctx.log.debug("[oidc] could not verify tokens locally, trying introspection...");
+						const introspected = await introspectTokens(ctx.config, {
+							access: currentAccessToken,
+							id: currentIdToken
+						}, {
+							access: introspectAccess,
+							id: introspectId
+						}, ctx.tokenTypePolicy, ctx.audiencePolicy, ctx.log);
+						accessTokenValue ??= introspected.accessTokenValue;
+						idTokenValue ??= introspected.idTokenValue;
+						failures = failures.concat(introspected.failures);
+					}
+				}
+				if (!newTokens && !subject) boundSubject = subjectOf(accessTokenValue) ?? subjectOf(idTokenValue) ?? boundSubject;
+				if (!(!newTokens && !!refresh_token && !((!currentAccessToken || !!accessTokenValue) && (!currentIdToken || !!idTokenValue)))) break;
+				ctx.log.debug(expired ? "[oidc] token expired, refreshing directly..." : "[oidc] a token could not be validated, refreshing as a last resort...");
+				newTokens = await refresh({ refreshToken: refresh_token });
+				currentAccessToken = newTokens.access_token;
+				currentIdToken = newTokens.id_token;
+			}
+			return finalizeProcessTokens({
+				currentAccessToken,
+				currentIdToken,
+				accessTokenValue,
+				idTokenValue,
+				failures,
+				newTokens,
+				boundSubject,
+				subject,
+				issuer: ctx.issuer,
+				log: ctx.log,
+				warnIfSenderConstrained
+			});
+		} catch (err) {
+			throw attachRefreshedTokens(err, newTokens);
+		}
+	};
+}
+function finalizeProcessTokens({ currentAccessToken, currentIdToken, accessTokenValue, idTokenValue, failures, newTokens, boundSubject, subject, issuer, log, warnIfSenderConstrained }) {
+	const unvalidated = [];
+	if (currentAccessToken && !accessTokenValue) unvalidated.push("access");
+	if (currentIdToken && !idTokenValue) unvalidated.push("id");
+	if (unvalidated.length) throw new OidcTokenValidationError(unvalidated, failures);
+	const accessSub = subjectOf(accessTokenValue);
+	const idSub = subjectOf(idTokenValue);
+	if (accessSub && idSub && accessSub !== idSub) throw new OidcSubjectError(`subject in access token and id token do not match (${accessSub} vs ${idSub})`, accessSub, idSub);
+	const finalSubject = accessSub ?? idSub;
+	if (newTokens && boundSubject && finalSubject && finalSubject !== boundSubject) throw new OidcSubjectError(`refresh returned a token set for a different subject (${finalSubject}) than the tokens it replaced (${boundSubject}). The refresh token does not belong to this session`, boundSubject, finalSubject);
+	if (subject && finalSubject && finalSubject !== subject) throw new OidcSubjectError(`the tokens describe subject ${finalSubject}, not the ${subject} they were presented for`, subject, finalSubject);
+	if (newTokens && !boundSubject) log.warn("[oidc] refreshed a token set whose original subject could not be determined. The supplied tokens were opaque or unreadable, so the refreshed set could not be checked against them. Pass `subject` to processTokens to enforce it.");
+	warnIfSenderConstrained(accessTokenValue);
+	const base = {
+		user: parseOIDCUser({
+			...mergeTokenClaims(accessTokenValue, idTokenValue, (claim) => log.warn(`[oidc] the access token and the id token disagree on "${claim}" for subject ${finalSubject ?? "(unknown)"}. Using the id token's value, and dropping any verification flag that did not come with it. One of the two is stale.`)),
+			iss: issuer
+		}),
+		accessTokenClaims: accessTokenValue,
+		idTokenClaims: idTokenValue
+	};
+	if (newTokens) return {
+		...base,
+		refreshed: true,
+		refreshedTokens: newTokens
+	};
+	return {
+		...base,
+		refreshed: false
+	};
+}
+// lib/core/refresh.ts
+function createRefresh(ctx) {
+	/**
+	* Exchanges a refresh token for a new token set.
+	* @example const tokens = await oidc.refresh({ refreshToken, expectedSubject: user.sub });
+	*/
+	return async function refresh({ refreshToken, expectedSubject }) {
+		if (expectedSubject !== void 0 && (typeof expectedSubject !== "string" || !expectedSubject)) throw new OidcInputError("refresh was given an `expectedSubject` that is not a non-empty string");
+		let tokens;
+		try {
+			tokens = await (0, openid_client.refreshTokenGrant)(ctx.config, refreshToken);
+		} catch (err) {
+			throw new OidcGrantError("refresh_token", `could not exchange the refresh token: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+		}
+		assertGrantedIdToken(ctx, tokens);
+		if (expectedSubject) {
+			const actual = subjectOf(tokens.claims());
+			if (!actual) ctx.log.warn("[oidc] refresh could not be checked against the expected subject: the provider returned no id token to read one from. The new token set is returned unchecked.");
+			else if (actual !== expectedSubject) throw new OidcSubjectError(`refresh returned a token set for a different subject (${actual}) than the ${expectedSubject} it was asked for. The refresh token does not belong to this session`, expectedSubject, actual);
+		}
+		return tokens;
+	};
+}
+// lib/core/signin.ts
+function createSignin(ctx) {
+	/**
+	* Builds the authorization URL. Store `codeVerifier` and `state` until the callback.
+	* @example const { authorizationUrl, codeVerifier, state } = await oidc.startSignin({ redirectUri, returnTo: "/" });
+	*/
+	async function startSignin({ redirectUri, returnTo, scope = "openid profile email offline_access" }) {
+		assertSafeReturnTo(returnTo, ctx.returnToPolicy);
+		assertSafeRedirectUri(redirectUri, "redirectUri");
+		if (!scope.split(/\s+/).includes("openid")) throw new OidcInputError(`invalid scope ("${scope}"): it must include "openid"`);
+		const codeVerifier = (0, openid_client.randomPKCECodeVerifier)();
+		const codeChallenge = await (0, openid_client.calculatePKCECodeChallenge)(codeVerifier);
+		const nonce = (0, openid_client.randomNonce)();
+		const state = JSON.stringify({
+			visitedUrl: returnTo,
+			random: (0, openid_client.randomState)(),
+			nonce
+		});
+		return {
+			codeVerifier,
+			authorizationUrl: (0, openid_client.buildAuthorizationUrl)(ctx.config, {
+				redirect_uri: redirectUri,
+				scope,
+				code_challenge: codeChallenge,
+				code_challenge_method: "S256",
+				state,
+				nonce
+			}),
+			state
+		};
+	}
+	/**
+	* Exchanges the callback's code for tokens and returns the `returnTo` passed to `startSignin`.
+	* @example const { tokens, returnTo } = await oidc.resolveSignin({ callbackUrl: new URL(req.url), codeVerifier, expectedState: state });
+	*/
+	async function resolveSignin({ callbackUrl, codeVerifier, expectedState }) {
+		if (typeof codeVerifier !== "string" || codeVerifier.length === 0) throw new OidcInputError("resolveSignin was given no PKCE code verifier. Pass the `codeVerifier` startSignin returned, exactly as it was stored.");
+		const parsedState = parseOIDCFlowState(expectedState);
+		const returnTo = assertSafeReturnTo(parsedState.visitedUrl, ctx.returnToPolicy);
+		let tokens;
+		try {
+			tokens = await (0, openid_client.authorizationCodeGrant)(ctx.config, callbackUrl, {
+				pkceCodeVerifier: codeVerifier,
+				expectedState,
+				expectedNonce: parsedState.nonce,
+				idTokenExpected: true
+			});
+		} catch (err) {
+			throw new OidcGrantError("authorization_code", `could not complete the login: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+		}
+		assertGrantedIdToken(ctx, tokens);
+		return {
+			tokens,
+			returnTo
+		};
+	}
+	return {
+		startSignin,
+		resolveSignin
+	};
+}
+// lib/core/userInfo.ts
+function createUserInfoFetcher(ctx) {
+	/**
+	* Fetches the UserInfo endpoint, checking the response is for `expectedSubject`.
+	* @example const info = await oidc.fetchUserInfoFromIssuer({ accessToken, expectedSubject: user.sub });
+	*/
+	return async function fetchUserInfoFromIssuer({ accessToken, expectedSubject }) {
+		if (typeof expectedSubject !== "string" || !expectedSubject) throw new OidcInputError("fetchUserInfoFromIssuer needs the `sub` this token set was validated for, as a non-empty string. The response is only meaningful once it is known to describe that subject");
+		try {
+			return await (0, openid_client.fetchUserInfo)(ctx.config, accessToken, expectedSubject);
+		} catch (err) {
+			throw new OidcUserInfoError(`could not fetch UserInfo claims for subject ${expectedSubject}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+		}
+	};
+}
+// lib/core/index.ts
+/**
+* Discovers the issuer and returns the sign-in, validation, refresh and logout functions.
+* @example const oidc = await createOidcCore({ issuer: "https://auth.example.com", clientId: "my-app" });
+*/
+async function createOidcCore(opts) {
+	const log = buildLogger(opts.logger, opts.logLevel);
+	const development = resolveDevelopment(opts.development);
+	if (development) log.warn("[oidc] development mode is on: plain-HTTP requests to the IdP are allowed. Never enable this in production.");
+	if (typeof opts.clientId !== "string" || opts.clientId.length === 0) throw new TypeError("invalid clientId: expected a non-empty string. It is what every token is bound to, so there is nothing this library could check without it.");
+	if (opts.verifyAudience && opts.expectedAudience !== void 0) log.warn("[oidc] both \"verifyAudience\" and \"expectedAudience\" are set. \"verifyAudience\" replaces the audience policy entirely, so \"expectedAudience\" is not checked at all. Assert it inside your callback, or drop one of the two.");
+	const clockTolerance = resolveClockTolerance(opts.clockTolerance);
+	const config = await (0, openid_client.discovery)(new URL(opts.issuer), opts.clientId, {
+		client_secret: opts.clientSecret,
+		token_endpoint_auth_method: opts.clientSecret ? void 0 : "none",
+		[openid_client.clockTolerance]: clockTolerance
+	}, void 0, { execute: development ? [openid_client.allowInsecureRequests] : [] });
+	assertDiscoveredIssuer(opts.issuer, config.serverMetadata().issuer);
+	assertPkceSupported(config.serverMetadata().code_challenge_methods_supported, opts.clientSecret, log);
+	const jwksUri = config.serverMetadata().jwks_uri;
+	const jwks = jwksUri ? (0, jose.createRemoteJWKSet)(resolveJwksUri(jwksUri, development)) : void 0;
+	const issuer = config.serverMetadata().issuer;
+	if (!jwksUri) log.warn(`[oidc] the issuer advertises no "jwks_uri", so no token can be verified offline. Every validation will fall back to remote introspection${(opts.introspection ?? "opaque-only") === "never" ? ", which \"introspection: 'never'\" has switched off, so no token will validate at all" : ", one round trip to the IdP per request"}.`);
+	const ctx = {
+		config,
+		log,
+		issuer,
+		jwks,
+		audiencePolicy: buildAudiencePolicy(opts),
+		tokenTypePolicy: buildTokenTypePolicy(opts),
+		returnToPolicy: buildReturnToPolicy(opts),
+		introspectionMode: opts.introspection ?? "opaque-only",
+		clockTolerance,
+		signingAlgorithms: resolveSigningAlgorithms(config, opts.signingAlgorithms, log)
+	};
+	const { startSignin, resolveSignin } = createSignin(ctx);
+	const refresh = createRefresh(ctx);
+	return {
+		configuration: config,
+		startSignin,
+		resolveSignin,
+		processTokens: createProcessTokens(ctx, refresh),
+		refresh,
+		getLogoutUrl: createLogout(ctx),
+		fetchUserInfoFromIssuer: createUserInfoFetcher(ctx)
+	};
+}
+exports.DEFAULT_AUTHORIZED_PARTY_CLAIMS = DEFAULT_AUTHORIZED_PARTY_CLAIMS;
+exports.DEFAULT_ID_TOKEN_ONLY_CLAIMS = DEFAULT_ID_TOKEN_ONLY_CLAIMS;
+exports.DEFAULT_SIGNING_ALGORITHMS = DEFAULT_SIGNING_ALGORITHMS;
+exports.OidcAudienceError = OidcAudienceError;
+exports.OidcClaimsError = OidcClaimsError;
+exports.OidcError = OidcError;
+exports.OidcGrantError = OidcGrantError;
+exports.OidcInputError = OidcInputError;
+exports.OidcLogoutError = OidcLogoutError;
+exports.OidcReturnToError = OidcReturnToError;
+exports.OidcStateError = OidcStateError;
+exports.OidcSubjectError = OidcSubjectError;
+exports.OidcTokenError = OidcTokenError;
+exports.OidcTokenTypeError = OidcTokenTypeError;
+exports.OidcTokenValidationError = OidcTokenValidationError;
+exports.OidcUserInfoError = OidcUserInfoError;
+exports.assertAudienceAfterJwtVerify = assertAudienceAfterJwtVerify;
+exports.assertAudienceClaim = assertAudienceClaim;
+exports.assertAuthorizedParty = assertAuthorizedParty;
+exports.assertDiscoveredIssuer = assertDiscoveredIssuer;
+exports.assertIntrospectedAccessToken = assertIntrospectedAccessToken;
+exports.assertIntrospectedIdToken = assertIntrospectedIdToken;
+exports.assertIntrospectedIdTokenAudience = assertIntrospectedIdTokenAudience;
+exports.assertPkceSupported = assertPkceSupported;
+exports.assertSafeRedirectUri = assertSafeRedirectUri;
+exports.assertSafeReturnTo = assertSafeReturnTo;
+exports.assertTokenAudience = assertTokenAudience;
+exports.assertTokenTypeAfterJwtVerify = assertTokenTypeAfterJwtVerify;
+exports.assertTokenTypeFromClaims = assertTokenTypeFromClaims;
+exports.attachRefreshedTokens = attachRefreshedTokens;
+exports.audienceVerifyOption = audienceVerifyOption;
+exports.buildAudiencePolicy = buildAudiencePolicy;
+exports.buildLogger = buildLogger;
+exports.buildReturnToPolicy = buildReturnToPolicy;
+exports.buildTokenTypePolicy = buildTokenTypePolicy;
+exports.createOidcCore = createOidcCore;
+exports.mergeTokenClaims = mergeTokenClaims;
+exports.parseOIDCFlowState = parseOIDCFlowState;
+exports.parseOIDCUser = parseOIDCUser;
+exports.resolveClockTolerance = resolveClockTolerance;
+exports.resolveDevelopment = resolveDevelopment;
+exports.resolveJwksUri = resolveJwksUri;
+
+//# sourceMappingURL=index.cjs.map