@maronn-openid-connect/cli 0.7.1 → 0.8.0

package/dist/frameworks/nextjs/interaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction.js","sourceRoot":"","sources":["../../../src/frameworks/nextjs/interaction.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGlF,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,QAAQ,GAAsB,gBAAgB;IAE9C,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW;QACvC,CAAC,CAAC;;uCAEiC;QACnC,CAAC,CAAC;;8EAEwE,CAAC;IAC7E,OAAO;0EACiE,YAAY;;;8DAGxB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CpE,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAQ,GAAsB,gBAAgB;IAE9C,MAAM,OAAO,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IAC5C,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC;wCACkC;QACpC,CAAC,CAAC,6CAA6C,CAAC;IAClD,MAAM,WAAW,GAAG;QAClB,sBAAsB;QACtB,oBAAoB;QACpB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,sBAAsB;KACvB,CAAC;IACF,MAAM,cAAc,GAAG,OAAO;QAC5B,CAAC,CAAC;;6DAEuD;QACzD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC;;;;;;2DAMqD;QACvD,CAAC,CAAC,EAAE,CAAC;IAGP,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC;;;;;;;;;;;;;;;;;sBAiBgB;QAClB,CAAC,CAAC;;;;;IAKF,CAAC;IACH,OAAO;;;EAGP,gBAAgB;;EAEhB,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;UAC1C,OAAO;sCACqB,cAAc;;;;;;;iBAOnC,UAAU;;;EAGzB,IAAI;;CAEL,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,uBAAuB;IACrC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BR,CAAC;AACF,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE;IACpD,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE;CAClD,CAAC;AAGX,MAAM,UAAU,sBAAsB,CAAC,IAAyB;IAC9D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO;;;6BAGoB,IAAI;aACpB,MAAM;;;;;0BAKO,SAAS;;;;;;;;CAQlC,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,2BAA2B,CAAC,IAAyB;IACnE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO;;;;;2BAKkB,IAAI;mEACoC,MAAM;;;;;;;;0BAQ/C,SAAS;;;;;;;;;;;;;;;CAelC,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,uBAAuB,CAAC,QAAQ,GAAsB,gBAAgB;IACpF,MAAM,OAAO,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC;IACpC,MAAM,aAAa,GAAG,MAAM;QAC1B,CAAC,CAAC;;yCAEmC,oBAAoB;;;;UAInD,oBAAoB;6DAC+B;QACzD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC;iFAC2E;QAC7E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,MAAM;QACzB,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;CAuBL;QACG,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,eAAe,GAAG,MAAM;QAC5B,CAAC,CAAC;;;;;;;;;;;;;;gBAcU;QACZ,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,8CAA8C,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;4DAyBR,UAAU;;;;;;EAMpE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAkCC,eAAe;;;;CAI7B,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO;;;;;;;;UAQC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDhB,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC5D,OAAO;;;;;;;;;;;;;;;;;;4DAkBmD,OAAO;;;;;;;;;UASzD,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiE7B,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,yBAAyB,CACvC,QAAQ,GAAsB,gBAAgB,EAC9C,MAAM,GAAa,EAAE;IAErB,MAAM,OAAO,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IAC5C,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,oBAAoB;QACvC,CAAC,CAAC;;mEAE6D;QAC/D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC;iFAC2E;QAC7E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,eAAe,GAAG,oBAAoB;QAC1C,CAAC,CAAC;;;;;;;;;;CAUL;QACG,CAAC,CAAC;;CAEL,CAAC;IACA,OAAO,8CAA8C,YAAY;;;;;;;;;;;;;;;;;4DAiBP,UAAU;;;;;;EAMpE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgChB,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,QAAQ,GAAsB,gBAAgB,EAC9C,MAAM,GAAa,EAAE;IAErB,MAAM,OAAO,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG;QAClB,sBAAsB;QACtB,yBAAyB;QACzB,yBAAyB;QACzB,mBAAmB;QACnB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,sBAAsB;QACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrC,CAAC;IACF,MAAM,WAAW,GAAG,OAAO;QACzB,CAAC,CAAC;4CACsC;QACxC,CAAC,CAAC,6CAA6C,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI;QACtB,CAAC,CAAC;;;;;UAKI,oBAAoB,SAAS;QACnC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,cAAc,GAAG,IAAI;QACzB,CAAC,CAAC;yFACmF;QACrF,CAAC,CAAC;wEACkE,CAAC;IACvE,MAAM,kBAAkB,GAAG,OAAO;QAChC,CAAC,CAAC;6EACuE;QACzE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,IAAI;QAC3B,CAAC,CAAC;qDAC+C;QACjD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,iBAAiB,GAAG,oBAAoB;QAC5C,CAAC,CAAC;mEAC6D;QAC/D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,EAAE,CACtC,OAAO;QACL,CAAC,CAAC,GAAG,MAAM;EACf,MAAM;CACP;QACK,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,YAAY,GAAG,oBAAoB;QACvC,CAAC,CAAC;;;;;;;KAOD;QACD,CAAC,CAAC;;;qEAG+D,CAAC;IACpE,MAAM,iBAAiB,GAAG,IAAI;QAC5B,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CJ;QACE,CAAC,CAAC;;;;;;;;;;;;;;EAcJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI;QACtB,CAAC,CAAC;;;;;;;;;;CAUL;QACG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;;EAEP,WAAW;;EAEX,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;UAC1C,OAAO,KAAK,WAAW;EAC/B,cAAc,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,iBAAiB;;;;;;;;;;;qBAWvD,IAAI,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;EAW9E,WAAW;;;;EAIX,YAAY,CAAC,MAAM,CAAC,gBAAgB,aAAa;;;OAG5C,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCpB,YAAY;;;;;;;;;;;;;;;;;;;;;;EAsBZ,YAAY,CAAC,IAAI,CAAC,cAAc,aAAa;;;KAG1C,eAAe;;;EAGlB,iBAAiB;CAClB,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,uBAAuB;IACrC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCR,CAAC;AACF,CAAC"}

package/dist/frameworks/nextjs/logout.d.ts

@@ -0,0 +1,5 @@
+export declare function nextJsLogoutConfigTemplate(): string;
+export declare function nextJsLogoutScreensTemplate(): string;
+export declare function nextJsLogoutRouteTemplate(corePkg: string): string;
+export declare function nextJsLogoutApproveRouteTemplate(): string;
+//# sourceMappingURL=logout.d.ts.map

package/dist/frameworks/nextjs/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/frameworks/nextjs/logout.ts"],"names":[],"mappings":"AAUA,wBAAgB,0BAA0B,IAAI,MAAM,CAenD;AAGD,wBAAgB,2BAA2B,IAAI,MAAM,CAuDpD;AAGD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA4IjE;AAGD,wBAAgB,gCAAgC,IAAI,MAAM,CAsDzD"}

package/dist/frameworks/nextjs/logout.js

@@ -0,0 +1,271 @@
+import { EXPERIMENTAL_PACKAGE } from '../hono/templates.js';
+const LOGOUT_PACKAGE = `${EXPERIMENTAL_PACKAGE}/rp-initiated-logout`;
+export function nextJsLogoutConfigTemplate() {
+    return `/**
+ * EXPERIMENTAL — RP-Initiated Logout settings.
+ *
+ * postLogoutRedirectUris is the registry §3 checks against: client_id → the
+ * exact post_logout_redirect_uri values that client registered (a registry of
+ * its own — the authorize redirect_uris are NOT reused). A requested URI is used
+ * only on an exact string match for the client the id_token_hint verified for;
+ * everything else falls back to the logged-out screen (fail-closed). The
+ * default is empty, so no logout redirect happens until you register one here.
+ */
+export const rpInitiatedLogoutConfig = {
+  postLogoutRedirectUris: {} as Record<string, string[]>,
+};
+`;
+}
+export function nextJsLogoutScreensTemplate() {
+    return `/**
+ * EXPERIMENTAL — the RP-Initiated Logout screens (RP-Initiated Logout 1.0 §2).
+ *
+ * Restyle the UI here. The confirmation form must keep posting csrf_token to
+ * /logout/approve: it is paired with the HttpOnly cookie the end_session
+ * endpoint mints.
+ */
+import { escapeHtml, htmlResponse } from '../_oidc-provider/html';
+
+/**
+ * The logout confirmation screen (§2 MUST when no valid id_token_hint is
+ * presented). The wording is the same on every path into it — no hint, an
+ * invalid or expired hint, another user's session, no session at all — so the
+ * page is no oracle for session state or for why the hint failed.
+ */
+export function confirmationScreen(csrfToken: string, cookies: readonly string[]): Response {
+  return htmlResponse(
+    \`<!DOCTYPE html>
+<html>
+<head><title>Log out</title></head>
+<body>
+  <h1>Log out</h1>
+  <p>Do you want to log out of the OpenID Provider?</p>
+  <p>If you did not request this, close this page.</p>
+  <form method="POST" action="/logout/approve">
+    <input type="hidden" name="csrf_token" value="\${escapeHtml(csrfToken)}" />
+    <button type="submit">Log out</button>
+  </form>
+</body>
+</html>\`,
+    { cookies },
+  );
+}
+
+/**
+ * The logged-out screen. It shows no End-User or client identifier, and its
+ * wording never depends on whether anything was actually deleted — varying it
+ * would make the page a session-existence oracle.
+ */
+export function completedScreen(cookies: readonly string[]): Response {
+  return htmlResponse(
+    \`<!DOCTYPE html>
+<html>
+<head><title>Logged out</title></head>
+<body>
+  <h1>Logged out</h1>
+  <p>You have been logged out.</p>
+  <p>You can close this page.</p>
+</body>
+</html>\`,
+    { cookies },
+  );
+}
+`;
+}
+export function nextJsLogoutRouteTemplate(corePkg) {
+    return `/**
+ * EXPERIMENTAL — end_session_endpoint (OpenID Connect RP-Initiated Logout 1.0).
+ *
+ * Generated because the OP was created with \`--enable rp-initiated-logout\`.
+ * Backed by ${EXPERIMENTAL_PACKAGE}, whose API is NOT stable: it may change in a
+ * breaking way between releases. Do not build production code on it without
+ * pinning the version.
+ *
+ * The RP sends the user agent here (GET or POST, §2 MUST) to end the OP browser
+ * session. A request whose id_token_hint verifies against this OP's keys AND
+ * matches the current session's End-User logs out immediately; every other
+ * request — no hint, an invalid or expired hint, a client_id that mismatches the
+ * hint audience, no session, another user's session — falls to one shared
+ * confirmation screen (§2 MUST; §7: an unauthenticated logout link would
+ * otherwise be a denial-of-service primitive). The failure reason is never
+ * disclosed: it would turn this endpoint into an oracle for session state.
+ *
+ * ## Why the confirmation needs a cookie + token pair
+ *
+ * Approving the confirmation ends a session, so a forged cross-site POST must
+ * not drive it. The confirmation screen hands this browser a fresh secret
+ * twice: in an HttpOnly cookie and in the form's hidden csrf_token, and
+ * /logout/approve runs only when both come back equal. The cookie also carries
+ * the OP-computed post-logout redirect, so the id_token_hint is never
+ * round-tripped through the HTML page.
+ */
+import { NextResponse, type NextRequest } from 'next/server';
+import {
+  decideLogoutFlow,
+  extractIdTokenHintAudience,
+  parseEndSessionRequest,
+  resolvePostLogoutRedirect,
+} from '${LOGOUT_PACKAGE}';
+import { IdTokenHintError, generateRandomString, validateIdTokenHint } from '${corePkg}';
+import { readFormFields } from '../_oidc-provider/http';
+import { config, idTokenHintJwks, loadSigningKeys, stores } from '../_oidc-provider/provider';
+import {
+  buildClearedSessionCookie,
+  buildLogoutConfirmationCookie,
+  parseSessionId,
+} from '../_oidc-provider/store';
+import { rpInitiatedLogoutConfig } from './config';
+import { completedScreen, confirmationScreen } from './screens';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function GET(request: NextRequest): Promise<Response> {
+  return endSession(request, request.nextUrl.searchParams);
+}
+
+/** §2: POST carries the same parameters in an application/x-www-form-urlencoded body. */
+export async function POST(request: Request): Promise<Response> {
+  const params = new URLSearchParams();
+  for (const [name, value] of await readFormFields(request)) {
+    if (typeof value === 'string') params.append(name, value);
+  }
+  return endSession(request, params);
+}
+
+async function endSession(request: Request, params: URLSearchParams): Promise<Response> {
+  const endSessionRequest = parseEndSessionRequest(params);
+  // logout_hint and ui_locales are accepted but unused (OPTIONAL, §2). The hint
+  // is never logged — it can identify the End-User — and neither is the
+  // id_token_hint value itself.
+
+  // §2: verify the hint (signature / iss / aud / exp) against the keys
+  // id_token_hint is verified with elsewhere. The expected audience is the
+  // client_id parameter when present, otherwise it is read — unverified — from
+  // the hint payload; trust comes from validateIdTokenHint afterwards.
+  let verifiedHint: { sub: string; [key: string]: unknown } | null = null;
+  let expectedAudience: string | null = null;
+  if (endSessionRequest.idTokenHint !== undefined) {
+    expectedAudience =
+      endSessionRequest.clientId ?? extractIdTokenHintAudience(endSessionRequest.idTokenHint);
+    if (expectedAudience !== null) {
+      try {
+        verifiedHint = await validateIdTokenHint(endSessionRequest.idTokenHint, {
+          expectedIss: config.issuer,
+          expectedAud: expectedAudience,
+          jwks: await idTokenHintJwks(await loadSigningKeys()),
+        });
+      } catch (error) {
+        // An expired, tampered or foreign hint just fails to prove logout
+        // authority, so the request falls to the confirmation path (§2 MUST)
+        // with no reason disclosed. Anything else (the keys failing to load)
+        // is rethrown: masking an outage as "invalid hint" would silently turn
+        // every logout into a confirmation.
+        if (!(error instanceof IdTokenHintError)) throw error;
+        verifiedHint = null;
+      }
+    }
+  }
+
+  const sessionId = parseSessionId(request.headers.get('Cookie'));
+  const session = sessionId ? await stores.browserSessionStore.get(sessionId) : undefined;
+
+  const decision = decideLogoutFlow({
+    verifiedHint,
+    expectedAudience,
+    clientIdParam: endSessionRequest.clientId,
+    sessionSubject: session ? session.subject : null,
+  });
+
+  // §3: redirect only to the verified client's exactly-matching registered URI,
+  // with state appended. Resolved before the branch because the confirmation
+  // flow honors the same result after approval.
+  const redirectTo = resolvePostLogoutRedirect({
+    postLogoutRedirectUri: endSessionRequest.postLogoutRedirectUri,
+    state: endSessionRequest.state,
+    verifiedClientId: decision.verifiedClientId,
+    registeredUris:
+      decision.verifiedClientId === null
+        ? []
+        : rpInitiatedLogoutConfig.postLogoutRedirectUris[decision.verifiedClientId] ?? [],
+  });
+
+  if (decision.requiresConfirmation) {
+    // §2 MUST: ask first. Nothing is deleted yet. The minted secret pairs the
+    // HttpOnly cookie with the form's hidden csrf_token; the redirect target
+    // rides inside the cookie.
+    const csrfSecret = generateRandomString(32);
+    return confirmationScreen(csrfSecret, [buildLogoutConfirmationCookie({ csrfSecret, redirectTo })]);
+  }
+
+  // Immediate logout: a valid hint for the current session's End-User (§2).
+  // Delete the store entry and expire the cookie together.
+  if (sessionId) {
+    await stores.browserSessionStore.delete(sessionId);
+  }
+  const cookies = [buildClearedSessionCookie()];
+  if (redirectTo !== null) {
+    const response = NextResponse.redirect(redirectTo, 302);
+    for (const cookie of cookies) response.headers.append('Set-Cookie', cookie);
+    return response;
+  }
+  return completedScreen(cookies);
+}
+`;
+}
+export function nextJsLogoutApproveRouteTemplate() {
+    return `/**
+ * EXPERIMENTAL — RP-Initiated Logout confirmation approve.
+ *
+ * Runs only for the browser that saw the confirmation screen: the HttpOnly
+ * cookie and the hidden csrf_token must present the same secret (neither alone
+ * is accepted). On success the session is deleted and the redirect decided when
+ * the screen was shown — carried in the cookie, never in the form — is honored
+ * (§3).
+ *
+ * Backed by ${EXPERIMENTAL_PACKAGE}, whose API is NOT stable.
+ */
+import { NextResponse } from 'next/server';
+import { errorPage } from '../../_oidc-provider/html';
+import { readFormFields } from '../../_oidc-provider/http';
+import { stores } from '../../_oidc-provider/provider';
+import {
+  buildClearedLogoutConfirmationCookie,
+  buildClearedSessionCookie,
+  parseLogoutConfirmation,
+  parseSessionId,
+} from '../../_oidc-provider/store';
+import { completedScreen } from '../screens';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function POST(request: Request): Promise<Response> {
+  const csrfToken = String((await readFormFields(request)).get('csrf_token') ?? '');
+  const cookieHeader = request.headers.get('Cookie');
+
+  const confirmation = parseLogoutConfirmation(cookieHeader);
+  if (confirmation === null || csrfToken === '' || confirmation.csrfSecret !== csrfToken) {
+    // Forged, replayed or expired confirmation: nothing is deleted. This is a
+    // browser surface, so the answer is the error page, not OAuth error JSON.
+    return errorPage('Invalid logout confirmation', 400);
+  }
+
+  // The End-User explicitly approved (§2). When the session is already gone
+  // there is nothing to delete and the answer is the same either way — the
+  // confirmation flow is no oracle for whether a session existed.
+  const sessionId = parseSessionId(cookieHeader);
+  if (sessionId) {
+    await stores.browserSessionStore.delete(sessionId);
+  }
+  const cookies = [buildClearedSessionCookie(), buildClearedLogoutConfirmationCookie()];
+  if (confirmation.redirectTo !== null) {
+    const response = NextResponse.redirect(confirmation.redirectTo, 302);
+    for (const cookie of cookies) response.headers.append('Set-Cookie', cookie);
+    return response;
+  }
+  return completedScreen(cookies);
+}
+`;
+}
+//# sourceMappingURL=logout.js.map

package/dist/frameworks/nextjs/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/frameworks/nextjs/logout.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,cAAc,GAAG,GAAG,oBAAoB,sBAAsB,CAAC;AAGrE,MAAM,UAAU,0BAA0B;IACxC,OAAO;;;;;;;;;;;;;CAaR,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,2BAA2B;IACzC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDR,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO;;;;eAIM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BzB,cAAc;+EACuD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyGrF,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,gCAAgC;IAC9C,OAAO;;;;;;;;;eASM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2ClC,CAAC;AACF,CAAC"}

package/dist/frameworks/nextjs/metadata.d.ts

@@ -0,0 +1,6 @@
+import type { OidcFeatureConfig } from '../../features.js';
+export declare function nextJsSupportedGrantTypes(features: OidcFeatureConfig): string[];
+export declare function nextJsSupportedScopes(features: OidcFeatureConfig, scopes: string[]): string[];
+export declare function nextJsDiscoveryRouteTemplate(corePkg: string, features?: OidcFeatureConfig, scopes?: string[]): string;
+export declare function nextJsJwksRouteTemplate(corePkg: string): string;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/frameworks/nextjs/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../src/frameworks/nextjs/metadata.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAQ3D,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAiB/E;AAMD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAU7F;AAGD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,iBAAoC,EAC9C,MAAM,GAAE,MAAM,EAAO,GACpB,MAAM,CAmPR;AAGD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0E/D"}

package/dist/frameworks/nextjs/metadata.js

@@ -0,0 +1,339 @@
+import { DEFAULT_FEATURES } from '../../features.js';
+export function nextJsSupportedGrantTypes(features) {
+    return [
+        'authorization_code',
+        ...(features.refreshToken ? ['refresh_token'] : []),
+        ...(features.tokenExchange || features.idJag
+            ? ['urn:ietf:params:oauth:grant-type:token-exchange']
+            : []),
+        ...(features.idJag ? ['urn:ietf:params:oauth:grant-type:jwt-bearer'] : []),
+        ...(features.deviceAuthorizationGrant
+            ? ['urn:ietf:params:oauth:grant-type:device_code']
+            : []),
+        ...(features.ciba ? ['urn:openid:params:grant-type:ciba'] : []),
+    ];
+}
+export function nextJsSupportedScopes(features, scopes) {
+    return [
+        'openid',
+        'profile',
+        'email',
+        'address',
+        'phone',
+        ...(features.refreshToken ? ['offline_access'] : []),
+        ...scopes,
+    ];
+}
+export function nextJsDiscoveryRouteTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
+    const customScopesDeclared = scopes.length > 0;
+    const customScopeImport = customScopesDeclared
+        ? `
+import { SUPPORTED_SCOPES } from '../../_oidc-provider/scopes';`
+        : '';
+    const scopesSupportedEntry = customScopesDeclared
+        ? `    // OIDC Discovery 1.0 §3: scopes_supported is this OP's scope allow list —
+    // the standard scopes plus the custom ones declared with --scope (see
+    // scopes.ts). It lists what the provider accepts, not what a particular
+    // End-User is granted (resolveGrantableScopes decides that).
+    scopesSupported: [...SUPPORTED_SCOPES],
+`
+        : features.refreshToken
+            ? `    // OIDC Core 1.0 §11: offline_access is advertised so relying parties (and the
+    // OIDF Conformance Suite's oidcc-refresh-token module) know they may request
+    // refresh tokens via 'scope=openid offline_access' with prompt=consent.
+    // It is a refresh-token request scope, not a claim scope, so no matching
+    // entry is added to claimsSupported.
+    scopesSupported: ['openid', 'profile', 'email', 'address', 'phone', 'offline_access'],
+`
+            : `    // The refresh_token feature is disabled, so offline_access is not advertised
+    // (OIDC Core 1.0 §11: it would never be granted by this provider).
+    scopesSupported: ['openid', 'profile', 'email', 'address', 'phone'],
+`;
+    const supportedGrantTypes = nextJsSupportedGrantTypes(features).map((grantType) => `'${grantType}'`);
+    const requestObjectMetadata = features.requestObject
+        ? `    // OIDC Core 1.0 §6.1 / OIDC Discovery 1.0 §3: a signed Request Object by value
+    // is supported (verified against the client's registered JWKS). request_uri
+    // (§6.2) is not, so it is advertised as false explicitly — Discovery defaults
+    // request_uri_parameter_supported to true when omitted. 'none' is added only
+    // when unsigned objects are accepted for Basic OP conformance compatibility.
+    requestParameterSupported: true,
+    requestUriParameterSupported: false,
+    requestObjectSigningAlgValuesSupported: config.allowUnsignedRequestObject
+      ? ['RS256', 'none']
+      : ['RS256'],
+`
+        : `    // OIDC Core 1.0 §6.3: the request parameter (Request Object) is disabled in
+    // this generated provider, so request_parameter_supported is advertised as
+    // false. request_uri (§6.2) remains unsupported as well.
+    requestParameterSupported: false,
+    requestUriParameterSupported: false,
+`;
+    const rfc8414Comment = features.introspection && features.revocation
+        ? `    // RFC 8414 — both endpoints require client authentication.
+`
+        : features.introspection || features.revocation
+            ? `    // RFC 8414 — the endpoint requires client authentication.
+`
+            : '';
+    const introspectionMetadata = features.introspection
+        ? `    introspectionEndpoint: \`\${issuer}/introspect\`,
+    introspectionEndpointAuthMethodsSupported: [
+      'client_secret_basic',
+      'client_secret_post',
+    ],
+`
+        : '';
+    const revocationMetadata = features.revocation
+        ? `    revocationEndpoint: \`\${issuer}/revoke\`,
+    revocationEndpointAuthMethodsSupported: [
+      'client_secret_basic',
+      'client_secret_post',
+    ],
+`
+        : '';
+    const responseModesSupportedEntry = features.jarm
+        ? `    // OAuth 2.0 Multiple Response Type Encoding Practices §2 / OIDC Discovery 1.0
+    // §3: the code flow answers via query. EXPERIMENTAL (JARM §4): this provider
+    // was generated with --enable jarm, so the JWT-secured query modes are
+    // advertised alongside it.
+    responseModesSupported: ['query', 'query.jwt', 'jwt'],`
+        : `    // OAuth 2.0 Multiple Response Type Encoding Practices §2 / OIDC Discovery 1.0
+    // §3: the OP only implements the authorization code flow, whose response is
+    // returned via query, so response_modes_supported is pinned to ['query'].
+    responseModesSupported: ['query'],`;
+    const parImport = features.par
+        ? `
+import { parConfig } from '../../par/config';`
+        : '';
+    const extensionMetadata = [
+        ...(features.par
+            ? [`      // EXPERIMENTAL — RFC 9126 §5. require_pushed_authorization_requests is only
+      // advertised when PAR is actually enforced (its default is false).
+      pushed_authorization_request_endpoint: \`\${issuer}/par\`,
+      ...(parConfig.requirePushedAuthorizationRequests
+        ? { require_pushed_authorization_requests: true }
+        : {}),`]
+            : []),
+        ...(features.deviceAuthorizationGrant
+            ? [`      // EXPERIMENTAL — RFC 8628 §4.
+      device_authorization_endpoint: \`\${issuer}/device_authorization\`,`]
+            : []),
+        ...(features.ciba
+            ? [`      // EXPERIMENTAL — CIBA Core 1.0 §4. Only the poll delivery mode is offered.
+      backchannel_token_delivery_modes_supported: ['poll'],
+      backchannel_authentication_endpoint: \`\${issuer}/backchannel_authentication\`,`]
+            : []),
+        ...(features.jarm
+            ? [`      // EXPERIMENTAL — JARM §4. The response JWT is always signed with RS256 (JARM
+      // §3: the default for a client that registered no
+      // authorization_signed_response_alg).
+      authorization_signing_alg_values_supported: ['RS256'],`]
+            : []),
+        ...(features.idJag
+            ? [`      // EXPERIMENTAL — ID-JAG draft §7.1 / §7.2: this OP issues ID-JAGs via token
+      // exchange and redeems them on the jwt-bearer grant. Which issuers and
+      // audiences are trusted is local policy and is not disclosed (draft §9.4).
+      identity_chaining_requested_token_types_supported: ['urn:ietf:params:oauth:token-type:id-jag'],
+      authorization_grant_profiles_supported: ['urn:ietf:params:oauth:grant-profile:id-jag'],`]
+            : []),
+        ...(features.introspection && features.jwtIntrospectionResponse
+            ? [`      // EXPERIMENTAL — RFC 9701 §7. The introspection response JWT is always signed
+      // with RS256 (§6: the default for a client that registered no
+      // introspection_signed_response_alg).
+      introspection_signing_alg_values_supported: ['RS256'],`]
+            : []),
+        ...(features.rpInitiatedLogout
+            ? [`      // EXPERIMENTAL — RP-Initiated Logout 1.0 §2.1.
+      end_session_endpoint: \`\${issuer}/logout\`,`]
+            : []),
+    ];
+    const extensionMetadataBlock = extensionMetadata.length > 0
+        ? `\n${extensionMetadata.join('\n')}`
+        : '';
+    return `/**
+ * OpenID Provider Configuration (OIDC Discovery 1.0 §4).
+ */
+import { buildProviderMetadata, getJwaAlgorithm } from '${corePkg}';
+import { config, loadSigningKeys } from '../../_oidc-provider/provider';
+import {
+  corsPreflight,
+  publicCors,
+  signingKeysUnavailable,
+  withCors,
+} from '../../_oidc-provider/http';${parImport}${customScopeImport}
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function GET(request: Request): Promise<Response> {
+  return withCors(request, publicCors, await providerMetadata());
+}
+
+export function OPTIONS(request: Request): Response {
+  return corsPreflight(request, publicCors);
+}
+
+async function providerMetadata(): Promise<Response> {
+  const keys = await loadSigningKeys().catch(() => null);
+  if (!keys) return signingKeysUnavailable();
+
+  const issuer = config.issuer;
+  const metadata = buildProviderMetadata({
+    issuer,
+    authorizationEndpoint: \`\${issuer}/authorize\`,
+    tokenEndpoint: \`\${issuer}/token\`,
+    jwksUri: \`\${issuer}/.well-known/jwks.json\`,
+    responseTypesSupported: ['code'],
+${responseModesSupportedEntry}
+    subjectTypesSupported: ['public'],
+    // OIDC Core 1.0 §15.1: id_token_signing_alg_values_supported is derived from
+    // every registered ID Token key, so a mixed RS256 + ES256 set is advertised
+    // as such (buildProviderMetadata enforces that RS256 is present).
+    idTokenSigningKeys: keys.idToken.registered.map((key) => key.privateKey),
+    userinfoEndpoint: \`\${issuer}/userinfo\`,
+${scopesSupportedEntry}    // OIDC Discovery 1.0 §3 / Core 1.0 §5.6: this OP produces Normal Claims only
+    // (no _claim_names / _claim_sources).
+    claimTypesSupported: ['normal'],
+    claimsSupported: [
+      'sub',
+      'iss',
+      'aud',
+      'exp',
+      'iat',
+      // OIDC Core 1.0 §2 / §3.1.3.6: ID Token protocol claims the OP issues.
+      // c_hash is omitted on purpose: the Hybrid flow is not implemented.
+      'auth_time',
+      'nonce',
+      'acr',
+      'amr',
+      'azp',
+      'at_hash',
+      'name',
+      'family_name',
+      'given_name',
+      'middle_name',
+      'nickname',
+      'preferred_username',
+      'profile',
+      'picture',
+      'website',
+      'gender',
+      'birthdate',
+      'zoneinfo',
+      'locale',
+      'updated_at',
+      'email',
+      'email_verified',
+      'address',
+      'phone_number',
+      'phone_number_verified',
+    ],
+    grantTypesSupported: [${supportedGrantTypes.join(', ')}],
+    // RFC 6749 §2.1 / OAuth 2.1 §2.4: 'none' advertises that public clients
+    // (no client_secret) are accepted at the token endpoint.
+    tokenEndpointAuthMethodsSupported: [
+      'client_secret_basic',
+      'client_secret_post',
+      'none',
+    ],
+    // OIDC Core 1.0 §5.3.2: the algs the registered UserInfo keys can sign with,
+    // so clients relying on userinfo_signed_response_alg can trust the metadata.
+    userinfoSigningAlgValuesSupported: [
+      ...new Set(keys.userinfo.registered.map((key) => getJwaAlgorithm(key.privateKey))),
+    ],
+${requestObjectMetadata}    // OIDC Discovery 1.0 §3 / Core 1.0 §5.5: the claims request parameter is
+    // implemented for both the ID Token and UserInfo.
+    claimsParameterSupported: true,
+    // RFC 9207 §3: every authorization response carries iss.
+    authorizationResponseIssParameterSupported: true,
+${rfc8414Comment}${introspectionMetadata}${revocationMetadata}  });
+
+  // RFC 8414 §3.2 / RFC 9111 §5.2: discovery metadata is cacheable; 3600s, the
+  // same freshness lifetime as the JWKS endpoint.
+  return Response.json(
+    {
+      ...metadata,
+      // RFC 7636 / OAuth 2.1: not an OIDC Discovery field, so added here.
+      code_challenge_methods_supported: ['S256'],${extensionMetadataBlock}
+    },
+    { headers: { 'Cache-Control': 'public, max-age=3600' } },
+  );
+}
+`;
+}
+export function nextJsJwksRouteTemplate(corePkg) {
+    return `/**
+ * JWKS endpoint: the public keys every OP-signed token is verified with.
+ *
+ * All three key sets are published (general, ID Token, UserInfo) including
+ * rotated-out keys, so tokens signed before a rotation keep verifying until
+ * they expire. A kid appears once; of the keys without a kid only the most
+ * recently added one is published.
+ */
+import { exportJwks, extractAlgorithmParamsFromJwk, type SigningKey } from '${corePkg}';
+import { loadSigningKeys } from '../../_oidc-provider/provider';
+import {
+  corsPreflight,
+  publicCors,
+  signingKeysUnavailable,
+  withCors,
+} from '../../_oidc-provider/http';
+
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+export async function GET(request: Request): Promise<Response> {
+  return withCors(request, publicCors, await jwks());
+}
+
+export function OPTIONS(request: Request): Response {
+  return corsPreflight(request, publicCors);
+}
+
+async function jwks(): Promise<Response> {
+  const keys = await loadSigningKeys().catch(() => null);
+  if (!keys) return signingKeysUnavailable();
+
+  const published = publishedKeys([
+    ...keys.general.registered,
+    ...keys.idToken.registered,
+    ...keys.userinfo.registered,
+  ]);
+  const entries = await Promise.all(
+    published.map(async (key) => ({
+      publicKey: await crypto.subtle.importKey(
+        'jwk',
+        key.publicJwk,
+        extractAlgorithmParamsFromJwk(key.publicJwk),
+        true,
+        ['verify'],
+      ),
+      keyId: key.keyId,
+    })),
+  );
+
+  return Response.json(await exportJwks(entries), {
+    headers: { 'Cache-Control': 'public, max-age=3600' },
+  });
+}
+
+/**
+ * The first key of every kid, plus the last key that has no kid (the most
+ * recent one wins, since rotation appends).
+ */
+function publishedKeys(candidates: readonly SigningKey[]): SigningKey[] {
+  let lastWithoutKid = -1;
+  candidates.forEach((key, index) => {
+    if (key.keyId === undefined) lastWithoutKid = index;
+  });
+  const seenKids = new Set<string>();
+  return candidates.filter((key, index) => {
+    if (key.keyId === undefined) return index === lastWithoutKid;
+    if (seenKids.has(key.keyId)) return false;
+    seenKids.add(key.keyId);
+    return true;
+  });
+}
+`;
+}
+//# sourceMappingURL=metadata.js.map

package/dist/frameworks/nextjs/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/frameworks/nextjs/metadata.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AASrD,MAAM,UAAU,yBAAyB,CAAC,QAA2B;IACnE,OAAO;QACL,oBAAoB;QACpB,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAGnD,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,KAAK;YAC1C,CAAC,CAAC,CAAC,iDAAiD,CAAC;YACrD,CAAC,CAAC,EAAE,CAAC;QAGP,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC,wBAAwB;YACnC,CAAC,CAAC,CAAC,8CAA8C,CAAC;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAMD,MAAM,UAAU,qBAAqB,CAAC,QAA2B,EAAE,MAAgB;IACjF,OAAO;QACL,QAAQ;QACR,SAAS;QACT,OAAO;QACP,SAAS;QACT,OAAO;QACP,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAGD,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,QAAQ,GAAsB,gBAAgB,EAC9C,MAAM,GAAa,EAAE;IAIrB,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/C,MAAM,iBAAiB,GAAG,oBAAoB;QAC5C,CAAC,CAAC;gEAC0D;QAC5D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,oBAAoB,GAAG,oBAAoB;QAC/C,CAAC,CAAC;;;;;CAKL;QACG,CAAC,CAAC,QAAQ,CAAC,YAAY;YACvB,CAAC,CAAC;;;;;;CAML;YACG,CAAC,CAAC;;;CAGL,CAAC;IACA,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC,GAAG,CACjE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,GAAG,CAChC,CAAC;IACF,MAAM,qBAAqB,GAAG,QAAQ,CAAC,aAAa;QAClD,CAAC,CAAC;;;;;;;;;;CAUL;QACG,CAAC,CAAC;;;;;CAKL,CAAC;IACA,MAAM,cAAc,GAClB,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,UAAU;QAC3C,CAAC,CAAC;CACP;QACK,CAAC,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,UAAU;YAC7C,CAAC,CAAC;CACT;YACO,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,qBAAqB,GAAG,QAAQ,CAAC,aAAa;QAClD,CAAC,CAAC;;;;;CAKL;QACG,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,kBAAkB,GAAG,QAAQ,CAAC,UAAU;QAC5C,CAAC,CAAC;;;;;CAKL;QACG,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI;QAC/C,CAAC,CAAC;;;;2DAIqD;QACvD,CAAC,CAAC;;;uCAGiC,CAAC;IACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG;QAC5B,CAAC,CAAC;8CACwC;QAC1C,CAAC,CAAC,EAAE,CAAC;IAGP,MAAM,iBAAiB,GAAG;QACxB,GAAG,CAAC,QAAQ,CAAC,GAAG;YACd,CAAC,CAAC,CAAC;;;;;eAKM,CAAC;YACV,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,wBAAwB;YACnC,CAAC,CAAC,CAAC;0EACiE,CAAC;YACrE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,IAAI;YACf,CAAC,CAAC,CAAC;;sFAE6E,CAAC;YACjF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,IAAI;YACf,CAAC,CAAC,CAAC;;;6DAGoD,CAAC;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,CAAC;;;;8FAIqF,CAAC;YACzF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,wBAAwB;YAC7D,CAAC,CAAC,CAAC;;;6DAGoD,CAAC;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,iBAAiB;YAC5B,CAAC,CAAC,CAAC;mDAC0C,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;;;0DAGiD,OAAO;;;;;;;qCAO5B,SAAS,GAAG,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;EAwBhE,2BAA2B;;;;;;;EAO3B,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAqCM,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;EAaxD,qBAAqB;;;;;EAKrB,cAAc,GAAG,qBAAqB,GAAG,kBAAkB;;;;;;;;mDAQV,sBAAsB;;;;;CAKxE,CAAC;AACF,CAAC;AAGD,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO;;;;;;;;8EAQqE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEpF,CAAC;AACF,CAAC"}

package/dist/frameworks/nextjs/provider.d.ts

@@ -0,0 +1,6 @@
+import type { OidcFeatureConfig } from '../../features.js';
+export declare function nextJsProviderTemplate(corePkg: string, features?: OidcFeatureConfig): string;
+export declare function nextJsStorageBackendTemplate(): string;
+export declare function nextJsHttpTemplate(): string;
+export declare function nextJsHtmlTemplate(): string;
+//# sourceMappingURL=provider.d.ts.map

package/dist/frameworks/nextjs/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/frameworks/nextjs/provider.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAO3D,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,iBAAoC,GAC7C,MAAM,CA6XR;AAMD,wBAAgB,4BAA4B,IAAI,MAAM,CA2LrD;AAQD,wBAAgB,kBAAkB,IAAI,MAAM,CA+K3C;AAOD,wBAAgB,kBAAkB,IAAI,MAAM,CAwD3C"}