@maronn-openid-connect/core 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 maronnjapan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,145 @@
+# @maronn-openid-connect/core
+
+OpenID Connect Core 1.0 / OAuth 2.1 に準拠した OpenID Provider のコアロジックを提供するパッケージ。
+
+「最新の OIDC/OAuth 仕様を素早く・忠実に・どこでも動く形で検証する」ための PoC 向けライブラリであり、Keycloak のような構築コストや IdaaS の契約なしに、自分の要件が仕様で実現できるかを検証するブリッジとして使う。検証後は本格的な IdaaS / OSS への移行を想定している。
+
+## 特徴
+
+- **外部依存ゼロ**: production の依存関係（dependencies）は空。内部実装のみで完結する
+- **Web 標準 API のみ**: Web Crypto API / Fetch API 等の Web 標準のみを使用し、Node.js / エッジランタイム等 JavaScript が動く環境で動作する
+- **純関数ベース**: HTTP の配線（ルーティング・リクエスト解析・レスポンス生成）は呼び出し側の責務。core はバリデーション・トークン生成などのロジックだけを提供する
+- **ストレージ非依存**: クライアント情報・認可コード・トークン等の永続化は resolver / store インターフェースとして注入する。DB / KV / インメモリなど任意の実装を差し込める
+
+## インストール
+
+```bash
+pnpm add @maronn-openid-connect/core
+```
+
+HTTP 配線込みの OP を手早く立てたい場合は、[`@maronn-openid-connect/cli`](../cli) で Hono / Express / Fastify / Next.js 向けの実装コードを生成できる。core を直接使うのは、生成コードでは表現できない高度な組み込みユースケース向け。
+
+## 準拠仕様
+
+- OpenID Connect Core 1.0（Authorization Code Flow）
+- OpenID Connect Discovery 1.0
+- OAuth 2.1（PKCE S256 必須、refresh token は absolute lifetime で失効）
+- RFC 7662 Token Introspection
+- RFC 7009 Token Revocation
+- RFC 9068 JWT Access Token（`jwt` 形式選択時）
+- OIDC Core 1.0 §6.1 Request Object（by value・署名付き JWS。`request_uri` は非対応として仕様通り `request_uri_not_supported` を返す）
+
+## 提供機能（API 概要）
+
+すべて `@maronn-openid-connect/core` からエクスポートされる。
+
+### 認可エンドポイント
+
+| API | 役割 |
+|---|---|
+| `validateAuthorizationRequest` | 認可リクエストの検証（OIDC Core 1.0 §3.1.2 / OAuth 2.1）。`response_type=code`、PKCE（S256）、`scope` / `state` / `nonce` / `prompt` / `display` / `max_age` / `ui_locales` / `acr_values` / `login_hint` / `id_token_hint` / `claims` / `request` パラメータを処理する。下記ステップ関数を同じ順序で呼び出す合成関数 |
+| 認可リクエスト検証のステップ関数 | `resolveClientForAuthorization` / `resolveRequestObjectParams` / `resolveAuthorizationRedirectUri` / `rejectUnsupportedRequestParams` / `validateRequestObjectConsistency` / `validateResponseType` / `validateAuthorizationScope` / `validateAuthorizationCodePkce` / `validatePromptParameter` / `applyOfflineAccessPolicy` / `validateDisplayParameter` / `resolveMaxAge` / `parseAudienceParameter` / `parseClaimsRequestParameter`。機能単位に分割されており、CLI 生成コードはこれらを個別に呼び出す。検証ステップを消したり独自処理を足したりできる |
+| `validateRegisteredRedirectUris` | 登録 redirect_uri の妥当性検証（完全一致・fragment 拒否） |
+| `parseRequestObject` | Request Object（署名付き JWS）のパースと署名検証（OIDC Core 1.0 §6.1） |
+| `createAuthorizationCode` | 認可コードデータの生成（保存は呼び出し側の責務。OAuth 2.1 §4.1.2） |
+| `AuthorizationError` / `AuthorizationErrorCode` | 認可エンドポイントのエラー表現 |
+
+### 認証トランザクション（ログイン・同意画面）
+
+| API | 役割 |
+|---|---|
+| `createAuthTransaction` / `getAuthTransaction` | 認可リクエスト受信〜認可コード発行までのコンテキストを KV ストアに保存・復元する（Auth Transaction ID 方式） |
+| `validateCsrfToken` | ログイン / 同意フォームの CSRF トークン検証 |
+| `handleLoginFailure` / `completeAuthTransaction` | ログイン失敗処理・トランザクション完了（認可レスポンス生成） |
+| `checkPromptNone` | `prompt=none` の検証（`login_required` / `consent_required` / `interaction_required`。OIDC Core 1.0 §3.1.2.1）。下記ステップ関数を同じ順序で呼び出す合成関数 |
+| `prompt=none` のステップ関数 | `resolvePromptNoneSession`（アクティブセッションの解決） / `validatePromptNoneIdTokenHint`（`id_token_hint` の subject 一致） / `validatePromptNoneConsent`（同意済みスコープの確認）。CLI 生成コードはこれらを個別に呼び出す |
+| `requiresReauthentication` | `prompt=login` / `max_age` による再認証要否の判定（OIDC Core 1.0 §3.1.2.3） |
+
+`prompt` は `none` / `login` / `consent` / `select_account` を受理し、`none` と他値の併用は仕様通り拒否する。
+
+### トークンエンドポイント
+
+| API | 役割 |
+|---|---|
+| `authenticateClient` | クライアント認証（`client_secret_basic` / `client_secret_post` / public client の `none`。OAuth 2.1 §2.3）。下記ステップ関数を同じ順序で呼び出す合成関数 |
+| クライアント認証のステップ関数 | `extractClientCredentials`（提示された資格情報と使用方式の抽出） / `resolveAuthenticatedTokenClient`（登録クライアントの解決） / `validateClientAuthMethod`（登録 `token_endpoint_auth_method` との一致検証） / `verifyClientSecret`（定数時間比較）。CLI 生成コードはこれらを個別に呼び出すため、`private_key_jwt` などの独自方式へ差し替えやすい |
+| `validateTokenRequest` | grant_type 検証を含むトークンリクエストのフル検証。下記ステップ関数と grant 別関数を同じ順序で呼び出す合成関数 |
+| トークンリクエスト検証のステップ関数 | `validateGrantTypeSupported`（OP 全体での grant_type サポート判定） / `resolveAuthenticatedTokenClient`（認証済みクライアントの解決） / `validateClientGrantType`（クライアント単位の grant_type 認可）。CLI 生成コードはこれらを個別に呼び出す |
+| authorization_code のステップ関数 | `resolveAuthorizationCode` / `validateAuthorizationCodeUnused` / `validateAuthorizationCodeClient` / `validateAuthorizationCodeExpiration` / `validateAuthorizationCodeRedirectUri` / `verifyAuthorizationCodePkce` / `consumeAuthorizationCode` / `buildValidatedAuthorizationCodeRequest` |
+| refresh_token のステップ関数 | `resolveRefreshToken` / `validateRefreshTokenUnused` / `validateRefreshTokenClient` / `validateRefreshTokenExpiration` / `validateRefreshTokenIdleTimeout` / `validateRefreshTokenScope` / `buildValidatedRefreshTokenRequest` |
+| `validateAuthorizationCodeGrant` / `validateRefreshTokenGrant` | 上記 grant 別ステップを安全な順序で呼ぶ後方互換の合成関数。CLI 生成コードは合成関数ではなく各ステップを明示的に呼び出す |
+| `generateTokenResponse` | トークンレスポンス生成（アクセストークン・ID トークン・リフレッシュトークン）。下記ステップ関数を同じ順序で呼び出す合成関数 |
+| トークンレスポンス生成のステップ関数 | `buildAccessTokenPayload`（RFC 9068 の payload 構築） / `computeAtHash`（OIDC Core 1.0 §3.1.3.6） / `resolveAcrAmr`（`acr` / `amr` の解決） / `buildIdTokenPayload`（ID Token クレームの構築） / `generateIdToken`（署名）。CLI 生成コードはこれらを個別に呼び出すため、ID Token へ独自クレームを足す・発行処理を差し替えるといった改造がしやすい |
+| `buildAccessTokenAudience` / `buildIdTokenAudience` | audience の構築 |
+| `TokenError` / `TokenErrorCode` | トークンエンドポイントのエラー表現（OAuth 2.1 §3.2.3） |
+
+- ID トークンは RS256 で署名され、`iss` / `sub` / `aud` / `exp` / `iat` に加え、条件に応じて `auth_time` / `nonce` / `at_hash` / `acr` / `amr` を含む。`acr` / `amr` は `AcrResolver` を注入して決定する
+- アクセストークンは `createJwtAccessTokenIssuer`（RFC 9068 準拠 JWT）と `createOpaqueAccessTokenIssuer`（不透明文字列。ストア検証前提で Introspection / Revocation と相性が良い）を切り替えられる
+- リフレッシュトークンは rotation 前提で、absolute lifetime（初回発行時刻起点）でのみ失効する（OAuth 2.1 §6.1）
+
+### UserInfo エンドポイント
+
+| API | 役割 |
+|---|---|
+| `handleUserInfoRequest` | アクセストークン検証とクレーム応答（OIDC Core 1.0 §5.3）。下記ステップ関数を同じ順序で呼び出す合成関数 |
+| UserInfo のステップ関数 | `resolveUserInfoAccessToken` / `validateUserInfoTokenExpiration` / `validateUserInfoScope` / `validateUserInfoAudience` / `resolveUserInfoClaims` / `filterClaimsByScope` / `applyRequestedClaims`。CLI 生成コードはこれらを個別に呼び出す |
+| `filterClaimsByScope` / `SCOPE_CLAIMS_MAP` | scope（`profile` / `email` / `address` / `phone`）に応じた標準クレームのフィルタリング（OIDC Core 1.0 §5.4） |
+| `generateUserInfoJwt` | 署名付き UserInfo レスポンス（JWT）の生成 |
+| `UserInfoError` / `UserInfoErrorCode` | `invalid_token` / `insufficient_scope` エラー表現 |
+
+`claims` リクエストパラメータ（OIDC Core 1.0 §5.5）による個別クレーム要求にも対応する。
+
+### Discovery / JWKS
+
+| API | 役割 |
+|---|---|
+| `buildProviderMetadata` | OpenID Provider Metadata の生成（OpenID Connect Discovery 1.0） |
+| `exportPublicJwk` / `exportJwks` / `signingKeysToJwkSet` | 公開鍵の JWK / JWK Set 化（秘密鍵パラメータは型レベルで排除） |
+
+### 署名鍵管理
+
+| API | 役割 |
+|---|---|
+| `createCachedSigningKeyProvider` | 署名鍵プロバイダーのキャッシュラッパー（TTL 付きで鍵ローテーションに追随） |
+| `getRegisteredSigningKeys` / `selectSigningKeyByAlg` | 登録済み鍵一覧の取得・アルゴリズム別の鍵選択 |
+| `assertHasRs256Key` / `assertKeyStrength` / `assertKidStrategyConsistent` | RS256 鍵の存在・鍵強度・kid 戦略の整合性チェック |
+
+鍵は `SigningKeyProvider` インターフェース（`getSigningKey` / 任意の `getSigningKeys`）として注入し、ローテーション済み鍵や複数アルゴリズムの鍵も JWKS で広告できる。
+
+### Introspection / Revocation
+
+| API | 役割 |
+|---|---|
+| `handleIntrospectionRequest` | RFC 7662 準拠のトークン照会（クライアント認証必須、`active: false` 応答は最小限）。下記ステップ関数を同じ順序で呼び出す合成関数 |
+| Introspection のステップ関数 | `requireIntrospectionToken` / `requireIntrospectionClient` / `resolveIntrospectionToken` / `isIntrospectionTokenActive` / `buildIntrospectionResponse` / `INACTIVE_INTROSPECTION_RESPONSE` |
+| `handleRevocationRequest` | RFC 7009 準拠のトークン失効（他クライアントのトークン指定は `invalid_grant`、refresh 失効時は同一 grant のアクセストークンも cascade 失効）。下記ステップ関数を同じ順序で呼び出す合成関数 |
+| Revocation のステップ関数 | `requireRevocationToken` / `requireRevocationClient` / `resolveRevocationTarget` / `validateRevocationTokenClient` / `revokeResolvedToken` / `revokeGrantAccessTokens` |
+
+### ユーティリティ
+
+| API | 役割 |
+|---|---|
+| `generateRandomString` | CSPRNG ベースのランダム文字列生成 |
+| `validateIdTokenHint` | `id_token_hint` の署名・クレーム検証（OIDC Core 1.0 §3.1.2.2） |
+| `sanitizeErrorDescription` | `error_description` の RFC 6749 §5.2 準拠サニタイズ |
+| `extractAlgorithmParamsFromJwk` / `getJwaAlgorithm` | JWK ⇔ Web Crypto アルゴリズムパラメータの変換 |
+
+## 設計方針
+
+core は「検証・生成ロジック」と「HTTP / ストレージ」を分離している。
+
+```
+HTTP リクエスト解析      ← 利用者（または CLI 生成コード）
+  ↓ パラメータ（Record<string, string>）
+core の純関数            ← このパッケージ
+  ↓ resolver / store 呼び出し
+永続化・クライアント管理  ← 利用者が注入（DB / KV / インメモリ）
+```
+
+注入インターフェースの例: `ClientResolver`（クライアント情報）、`AuthorizationCodeResolver` / `RefreshTokenResolver` / `AccessTokenResolver`（トークン引き当て）、`SessionResolver` / `ConsentResolver`（セッション・同意状態）、`AuthTransactionStore`（認証トランザクション）、`SigningKeyProvider`（署名鍵）。
+
+実際の配線例は [`@maronn-openid-connect/cli`](../cli) が生成するコード、および本リポジトリの `samples/*` を参照。
+
+## ライセンス
+
+MIT

package/dist/access-token-issuer.d.ts

@@ -0,0 +1,14 @@
+import type { AccessTokenPayload } from './access-token.js';
+export type AccessTokenFormat = 'jwt' | 'opaque';
+export interface AccessTokenIssuanceContext {
+    payload: AccessTokenPayload;
+    privateKey?: CryptoKey;
+    keyId?: string;
+}
+export interface AccessTokenIssuer {
+    readonly format: AccessTokenFormat;
+    issue(ctx: AccessTokenIssuanceContext): Promise<string>;
+}
+export declare function createJwtAccessTokenIssuer(): AccessTokenIssuer;
+export declare function createOpaqueAccessTokenIssuer(byteLength?: number): AccessTokenIssuer;
+//# sourceMappingURL=access-token-issuer.d.ts.map

package/dist/access-token-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-issuer.d.ts","sourceRoot":"","sources":["../src/access-token-issuer.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAOjD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAqBnC,KAAK,CAAC,GAAG,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzD;AAGD,wBAAgB,0BAA0B,IAAI,iBAAiB,CAqB9D;AAcD,wBAAgB,6BAA6B,CAAC,UAAU,SAAK,GAAG,iBAAiB,CAUhF"}

package/dist/access-token-issuer.js

@@ -0,0 +1,32 @@
+import { generateAccessToken } from './access-token.js';
+import { generateRandomString } from './crypto-utils.js';
+export function createJwtAccessTokenIssuer() {
+    return {
+        format: 'jwt',
+        async issue(ctx) {
+            if (!ctx.privateKey) {
+                throw new Error('JWT access token issuer requires a privateKey');
+            }
+            const payload = ctx.payload.nbf === undefined
+                ? { ...ctx.payload, nbf: ctx.payload.iat }
+                : ctx.payload;
+            return generateAccessToken({
+                payload,
+                privateKey: ctx.privateKey,
+                keyId: ctx.keyId,
+            });
+        },
+    };
+}
+export function createOpaqueAccessTokenIssuer(byteLength = 32) {
+    if (!Number.isInteger(byteLength) || byteLength <= 0) {
+        throw new Error(`Opaque access token byteLength must be a positive integer: got ${byteLength}`);
+    }
+    return {
+        format: 'opaque',
+        async issue() {
+            return generateRandomString(byteLength);
+        },
+    };
+}
+//# sourceMappingURL=access-token-issuer.js.map

package/dist/access-token-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-issuer.js","sourceRoot":"","sources":["../src/access-token-issuer.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAyCzD,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,MAAM,EAAE,KAAK;QACb,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YAID,MAAM,OAAO,GACX,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS;gBAC3B,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YAClB,OAAO,mBAAmB,CAAC;gBACzB,OAAO;gBACP,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAcD,MAAM,UAAU,6BAA6B,CAAC,UAAU,GAAG,EAAE;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,kEAAkE,UAAU,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,KAAK,CAAC,KAAK;YACT,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/access-token.d.ts

@@ -0,0 +1,19 @@
+export interface AccessTokenPayload {
+    iss: string;
+    sub: string;
+    aud: string[];
+    exp: number;
+    iat: number;
+    nbf?: number;
+    jti?: string;
+    scope?: string;
+    client_id?: string;
+    [key: string]: unknown;
+}
+export interface GenerateAccessTokenOptions {
+    payload: AccessTokenPayload;
+    privateKey: CryptoKey;
+    keyId?: string;
+}
+export declare function generateAccessToken(options: GenerateAccessTokenOptions): Promise<string>;
+//# sourceMappingURL=access-token.d.ts.map

package/dist/access-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../src/access-token.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IAKZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAeb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAKD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,EAAE,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA2DD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B9F"}

package/dist/access-token.js

@@ -0,0 +1,46 @@
+import { sign, arrayBufferToBase64Url, stringToArrayBuffer, getJwaAlgorithm } from './crypto-utils.js';
+function validatePayload(payload) {
+    if (!payload.iss) {
+        throw new Error('Missing required claim: iss');
+    }
+    if (!payload.sub) {
+        throw new Error('Missing required claim: sub');
+    }
+    if (payload.aud === undefined || payload.aud === null) {
+        throw new Error('Missing required claim: aud');
+    }
+    if (!Array.isArray(payload.aud) || payload.aud.length === 0) {
+        throw new Error('Invalid aud claim: must be a non-empty array');
+    }
+    if (payload.exp === undefined || payload.exp === null) {
+        throw new Error('Missing required claim: exp');
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const clockSkewTolerance = 60;
+    if (payload.exp < now - clockSkewTolerance) {
+        throw new Error('Token expiration time is in the past');
+    }
+    if (payload.iat === undefined || payload.iat === null) {
+        throw new Error('Missing required claim: iat');
+    }
+}
+function base64UrlEncode(str) {
+    return arrayBufferToBase64Url(stringToArrayBuffer(str));
+}
+export async function generateAccessToken(options) {
+    const { payload, privateKey, keyId } = options;
+    validatePayload(payload);
+    const header = {
+        alg: getJwaAlgorithm(privateKey),
+        typ: 'at+jwt',
+    };
+    if (keyId) {
+        header.kid = keyId;
+    }
+    const headerB64 = base64UrlEncode(JSON.stringify(header));
+    const payloadB64 = base64UrlEncode(JSON.stringify(payload));
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const signature = await sign(signingInput, privateKey);
+    return `${signingInput}.${signature}`;
+}
+//# sourceMappingURL=access-token.js.map

package/dist/access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../src/access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAiDvG,SAAS,eAAe,CAAC,OAA2B;IAElD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAID,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAGD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,kBAAkB,GAAG,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,kBAAkB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAKD,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,sBAAsB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAmC;IAC3E,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAG/C,eAAe,CAAC,OAAO,CAAC,CAAC;IAKzB,MAAM,MAAM,GAA2B;QACrC,GAAG,EAAE,eAAe,CAAC,UAAU,CAAC;QAChC,GAAG,EAAE,QAAQ;KACd,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;IACrB,CAAC;IAGD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAG5D,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAGlD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAEvD,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC"}

package/dist/auth-transaction.d.ts

@@ -0,0 +1,86 @@
+import type { ValidatedAuthorizationRequest } from './authorization-request.js';
+import type { ClaimsParameter } from './userinfo.js';
+export interface SessionInfo {
+    subject: string;
+    authTime: number;
+}
+export interface SessionResolver {
+    resolve(request: Request): Promise<SessionInfo | null>;
+}
+export interface ConsentResolver {
+    hasConsent(subject: string, clientId: string, scopes: string[]): Promise<boolean>;
+    recordConsent?(subject: string, clientId: string, scopes: string[]): Promise<void>;
+    revokeConsent?(subject: string, clientId: string): Promise<void>;
+}
+export declare enum AuthTransactionErrorCode {
+    TransactionNotFound = "transaction_not_found",
+    TransactionExpired = "transaction_expired",
+    InvalidCsrfToken = "invalid_csrf_token",
+    MaxAttemptsExceeded = "max_attempts_exceeded"
+}
+export declare class AuthTransactionError extends Error {
+    readonly code: AuthTransactionErrorCode;
+    constructor(code: AuthTransactionErrorCode, message: string);
+    get httpStatusCode(): number;
+}
+export interface AuthTransaction {
+    clientId: string;
+    redirectUri: string;
+    redirectUriExplicit: boolean;
+    responseType: string;
+    scope: string;
+    state?: string;
+    nonce?: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: 'S256';
+    prompt?: string;
+    maxAge?: number;
+    acrValues?: string;
+    loginHint?: string;
+    uiLocales?: string;
+    claimsLocales?: string;
+    idTokenHint?: string;
+    audience?: string[];
+    claims?: ClaimsParameter;
+    csrfToken: string;
+    createdAt: number;
+    expiresAt: number;
+    failedAttempts: number;
+}
+export interface AuthTransactionStore {
+    get(key: string): Promise<AuthTransaction | null>;
+    put(key: string, transaction: AuthTransaction, ttlSeconds: number): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+export interface AuthorizationResponseParams {
+    redirectUri: string;
+    redirectUriExplicit: boolean;
+    state?: string;
+    clientId: string;
+    scope: string[];
+    nonce?: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: 'S256';
+    audience?: string[];
+    acrValues?: string;
+    claims?: ClaimsParameter;
+}
+export interface LoginFailureResult {
+    canRetry: boolean;
+    failedAttempts: number;
+    maxAttempts: number;
+}
+export declare function createAuthTransaction(validatedRequest: ValidatedAuthorizationRequest, csrfToken: string, ttlMs?: number): AuthTransaction;
+export declare function getAuthTransaction(txnId: string, store: AuthTransactionStore): Promise<AuthTransaction>;
+export declare function validateCsrfToken(transaction: AuthTransaction, csrfToken: string): void;
+export declare function handleLoginFailure(txnId: string, transaction: AuthTransaction, store: AuthTransactionStore, maxAttempts?: number): Promise<LoginFailureResult>;
+export interface PromptNoneOptions {
+    verifiedHintSubject?: string;
+}
+export declare function resolvePromptNoneSession(transaction: AuthTransaction, sessionResolver: SessionResolver, request: Request): Promise<SessionInfo>;
+export declare function validatePromptNoneIdTokenHint(transaction: AuthTransaction, session: SessionInfo, verifiedHintSubject: string | undefined): void;
+export declare function validatePromptNoneConsent(transaction: AuthTransaction, session: SessionInfo, consentResolver?: ConsentResolver): Promise<void>;
+export declare function checkPromptNone(transaction: AuthTransaction, sessionResolver: SessionResolver, request: Request, consentResolver?: ConsentResolver, options?: PromptNoneOptions): Promise<SessionInfo>;
+export declare function requiresReauthentication(maxAge: number, authTime: number): boolean;
+export declare function completeAuthTransaction(txnId: string, transaction: AuthTransaction, store: AuthTransactionStore): Promise<AuthorizationResponseParams>;
+//# sourceMappingURL=auth-transaction.d.ts.map

package/dist/auth-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-transaction.d.ts","sourceRoot":"","sources":["../src/auth-transaction.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACxD;AAOD,MAAM,WAAW,eAAe;IAM9B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAMlF,aAAa,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAInF,aAAa,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAOD,oBAAY,wBAAwB;IAClC,mBAAmB,0BAA0B;IAC7C,kBAAkB,wBAAwB;IAC1C,gBAAgB,uBAAuB;IACvC,mBAAmB,0BAA0B;CAC9C;AAKD,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAgB,IAAI,EAAE,wBAAwB,CAAC;gBAEnC,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM;IAS3D,IAAI,cAAc,IAAI,MAAM,CAW3B;CACF;AAQD,MAAM,WAAW,eAAe;IAE9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IAKpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,MAAM,CAAC,EAAE,eAAe,CAAC;IAGzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAMD,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAClD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAKD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IAEpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAMpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAKD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAuBD,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,6BAA6B,EAC/C,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAuB,GAC7B,eAAe,CA2DjB;AAWD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAmB1B;AASD,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAC5B,SAAS,EAAE,MAAM,GAChB,IAAI,CAON;AAYD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,eAAe,EAC5B,KAAK,EAAE,oBAAoB,EAC3B,WAAW,GAAE,MAA6B,GACzC,OAAO,CAAC,kBAAkB,CAAC,CAsB7B;AAKD,MAAM,WAAW,iBAAiB;IAShC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAeD,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,eAAe,EAC5B,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CAWtB;AAkBD,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,eAAe,EAC5B,OAAO,EAAE,WAAW,EACpB,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,IAAI,CASN;AAcD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,eAAe,EAC5B,OAAO,EAAE,WAAW,EACpB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,IAAI,CAAC,CAiBf;AAuBD,wBAAsB,eAAe,CACnC,WAAW,EAAE,eAAe,EAC5B,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,OAAO,EAChB,eAAe,CAAC,EAAE,eAAe,EACjC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAKtB;AAeD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKlF;AAaD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,eAAe,EAC5B,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,2BAA2B,CAAC,CAoCtC"}

package/dist/auth-transaction.js

@@ -0,0 +1,187 @@
+import { AuthorizationError, AuthorizationErrorCode } from './authorization-request.js';
+export var AuthTransactionErrorCode;
+(function (AuthTransactionErrorCode) {
+    AuthTransactionErrorCode["TransactionNotFound"] = "transaction_not_found";
+    AuthTransactionErrorCode["TransactionExpired"] = "transaction_expired";
+    AuthTransactionErrorCode["InvalidCsrfToken"] = "invalid_csrf_token";
+    AuthTransactionErrorCode["MaxAttemptsExceeded"] = "max_attempts_exceeded";
+})(AuthTransactionErrorCode || (AuthTransactionErrorCode = {}));
+export class AuthTransactionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AuthTransactionError';
+        this.code = code;
+    }
+    get httpStatusCode() {
+        switch (this.code) {
+            case AuthTransactionErrorCode.TransactionNotFound:
+                return 400;
+            case AuthTransactionErrorCode.TransactionExpired:
+                return 400;
+            case AuthTransactionErrorCode.InvalidCsrfToken:
+                return 403;
+            case AuthTransactionErrorCode.MaxAttemptsExceeded:
+                return 429;
+        }
+    }
+}
+const DEFAULT_TTL_MS = 600_000;
+const DEFAULT_MAX_ATTEMPTS = 5;
+const STORE_KEY_PREFIX = 'auth_txn:';
+export function createAuthTransaction(validatedRequest, csrfToken, ttlMs = DEFAULT_TTL_MS) {
+    const now = Date.now();
+    const transaction = {
+        clientId: validatedRequest.clientId,
+        redirectUri: validatedRequest.redirectUri,
+        redirectUriExplicit: validatedRequest.redirectUriExplicit,
+        responseType: validatedRequest.responseType,
+        scope: validatedRequest.scope.join(' '),
+        csrfToken,
+        createdAt: now,
+        expiresAt: now + ttlMs,
+        failedAttempts: 0,
+    };
+    if (validatedRequest.state !== undefined) {
+        transaction.state = validatedRequest.state;
+    }
+    if (validatedRequest.nonce !== undefined) {
+        transaction.nonce = validatedRequest.nonce;
+    }
+    if (validatedRequest.codeChallenge !== undefined) {
+        transaction.codeChallenge = validatedRequest.codeChallenge;
+    }
+    if (validatedRequest.codeChallengeMethod !== undefined) {
+        transaction.codeChallengeMethod = validatedRequest.codeChallengeMethod;
+    }
+    if (validatedRequest.prompt !== undefined) {
+        transaction.prompt = validatedRequest.prompt.join(' ');
+    }
+    if (validatedRequest.maxAge !== undefined) {
+        transaction.maxAge = validatedRequest.maxAge;
+    }
+    if (validatedRequest.acrValues !== undefined) {
+        transaction.acrValues = validatedRequest.acrValues;
+    }
+    if (validatedRequest.loginHint !== undefined) {
+        transaction.loginHint = validatedRequest.loginHint;
+    }
+    if (validatedRequest.uiLocales !== undefined) {
+        transaction.uiLocales = validatedRequest.uiLocales;
+    }
+    if (validatedRequest.claimsLocales !== undefined) {
+        transaction.claimsLocales = validatedRequest.claimsLocales;
+    }
+    if (validatedRequest.idTokenHint !== undefined) {
+        transaction.idTokenHint = validatedRequest.idTokenHint;
+    }
+    if (validatedRequest.audience !== undefined) {
+        transaction.audience = validatedRequest.audience;
+    }
+    if (validatedRequest.claims !== undefined) {
+        transaction.claims = validatedRequest.claims;
+    }
+    return transaction;
+}
+export async function getAuthTransaction(txnId, store) {
+    const key = `${STORE_KEY_PREFIX}${txnId}`;
+    const transaction = await store.get(key);
+    if (!transaction) {
+        throw new AuthTransactionError(AuthTransactionErrorCode.TransactionNotFound, 'Auth transaction not found. The session may have expired.');
+    }
+    if (transaction.expiresAt <= Date.now()) {
+        throw new AuthTransactionError(AuthTransactionErrorCode.TransactionExpired, 'Auth transaction has expired. Please start the authorization flow again.');
+    }
+    return transaction;
+}
+export function validateCsrfToken(transaction, csrfToken) {
+    if (!csrfToken || csrfToken !== transaction.csrfToken) {
+        throw new AuthTransactionError(AuthTransactionErrorCode.InvalidCsrfToken, 'Invalid CSRF token.');
+    }
+}
+export async function handleLoginFailure(txnId, transaction, store, maxAttempts = DEFAULT_MAX_ATTEMPTS) {
+    const key = `${STORE_KEY_PREFIX}${txnId}`;
+    transaction.failedAttempts++;
+    if (transaction.failedAttempts >= maxAttempts) {
+        await store.delete(key);
+        return {
+            canRetry: false,
+            failedAttempts: transaction.failedAttempts,
+            maxAttempts,
+        };
+    }
+    const remainingTtlMs = transaction.expiresAt - Date.now();
+    const remainingTtlSeconds = Math.max(1, Math.ceil(remainingTtlMs / 1000));
+    await store.put(key, transaction, remainingTtlSeconds);
+    return {
+        canRetry: true,
+        failedAttempts: transaction.failedAttempts,
+        maxAttempts,
+    };
+}
+export async function resolvePromptNoneSession(transaction, sessionResolver, request) {
+    const session = await sessionResolver.resolve(request);
+    if (!session) {
+        throw new AuthorizationError(AuthorizationErrorCode.LoginRequired, 'No active session found. Silent authentication failed.', transaction.redirectUri, transaction.state);
+    }
+    return session;
+}
+export function validatePromptNoneIdTokenHint(transaction, session, verifiedHintSubject) {
+    if (verifiedHintSubject !== undefined && verifiedHintSubject !== session.subject) {
+        throw new AuthorizationError(AuthorizationErrorCode.LoginRequired, 'id_token_hint subject does not match the active session.', transaction.redirectUri, transaction.state);
+    }
+}
+export async function validatePromptNoneConsent(transaction, session, consentResolver) {
+    if (!consentResolver)
+        return;
+    const scopes = transaction.scope.split(' ').filter(Boolean);
+    const hasConsent = await consentResolver.hasConsent(session.subject, transaction.clientId, scopes);
+    if (!hasConsent) {
+        throw new AuthorizationError(AuthorizationErrorCode.ConsentRequired, 'Consent has not been granted. Silent authentication cannot show consent UI.', transaction.redirectUri, transaction.state);
+    }
+}
+export async function checkPromptNone(transaction, sessionResolver, request, consentResolver, options) {
+    const session = await resolvePromptNoneSession(transaction, sessionResolver, request);
+    validatePromptNoneIdTokenHint(transaction, session, options?.verifiedHintSubject);
+    await validatePromptNoneConsent(transaction, session, consentResolver);
+    return session;
+}
+export function requiresReauthentication(maxAge, authTime) {
+    if (maxAge <= 0)
+        return true;
+    const now = Math.floor(Date.now() / 1000);
+    return now - authTime > maxAge;
+}
+export async function completeAuthTransaction(txnId, transaction, store) {
+    const key = `${STORE_KEY_PREFIX}${txnId}`;
+    await store.delete(key);
+    const result = {
+        redirectUri: transaction.redirectUri,
+        redirectUriExplicit: transaction.redirectUriExplicit,
+        clientId: transaction.clientId,
+        scope: transaction.scope.split(' '),
+    };
+    if (transaction.state !== undefined) {
+        result.state = transaction.state;
+    }
+    if (transaction.codeChallenge !== undefined) {
+        result.codeChallenge = transaction.codeChallenge;
+    }
+    if (transaction.codeChallengeMethod !== undefined) {
+        result.codeChallengeMethod = transaction.codeChallengeMethod;
+    }
+    if (transaction.nonce !== undefined) {
+        result.nonce = transaction.nonce;
+    }
+    if (transaction.audience !== undefined) {
+        result.audience = transaction.audience;
+    }
+    if (transaction.acrValues !== undefined) {
+        result.acrValues = transaction.acrValues;
+    }
+    if (transaction.claims !== undefined) {
+        result.claims = transaction.claims;
+    }
+    return result;
+}
+//# sourceMappingURL=auth-transaction.js.map

package/dist/auth-transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-transaction.js","sourceRoot":"","sources":["../src/auth-transaction.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AA4CxF,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,yEAA6C,CAAA;IAC7C,sEAA0C,CAAA;IAC1C,mEAAuC,CAAA;IACvC,yEAA6C,CAAA;AAC/C,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAKD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7B,IAAI,CAA2B;IAE/C,YAAY,IAA8B,EAAE,OAAe;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAKD,IAAI,cAAc;QAChB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,wBAAwB,CAAC,mBAAmB;gBAC/C,OAAO,GAAG,CAAC;YACb,KAAK,wBAAwB,CAAC,kBAAkB;gBAC9C,OAAO,GAAG,CAAC;YACb,KAAK,wBAAwB,CAAC,gBAAgB;gBAC5C,OAAO,GAAG,CAAC;YACb,KAAK,wBAAwB,CAAC,mBAAmB;gBAC/C,OAAO,GAAG,CAAC;QACf,CAAC;IACH,CAAC;CACF;AA2FD,MAAM,cAAc,GAAG,OAAO,CAAC;AAG/B,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAG/B,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAYrC,MAAM,UAAU,qBAAqB,CACnC,gBAA+C,EAC/C,SAAiB,EACjB,QAAgB,cAAc;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,WAAW,GAAoB;QACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;QACnC,WAAW,EAAE,gBAAgB,CAAC,WAAW;QACzC,mBAAmB,EAAE,gBAAgB,CAAC,mBAAmB;QACzD,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACvC,SAAS;QACT,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,KAAK;QACtB,cAAc,EAAE,CAAC;KAClB,CAAC;IAGF,IAAI,gBAAgB,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACzC,WAAW,CAAC,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAC7C,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACzC,WAAW,CAAC,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAC7C,CAAC;IACD,IAAI,gBAAgB,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACjD,WAAW,CAAC,aAAa,GAAG,gBAAgB,CAAC,aAAa,CAAC;IAC7D,CAAC;IACD,IAAI,gBAAgB,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACvD,WAAW,CAAC,mBAAmB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC;IACzE,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1C,WAAW,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1C,WAAW,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC/C,CAAC;IACD,IAAI,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,WAAW,CAAC,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,IAAI,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,WAAW,CAAC,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC;IACrD,CAAC;IAGD,IAAI,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,WAAW,CAAC,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC;IACrD,CAAC;IACD,IAAI,gBAAgB,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACjD,WAAW,CAAC,aAAa,GAAG,gBAAgB,CAAC,aAAa,CAAC;IAC7D,CAAC;IACD,IAAI,gBAAgB,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/C,WAAW,CAAC,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC;IACzD,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5C,WAAW,CAAC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC;IACnD,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1C,WAAW,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC/C,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,KAA2B;IAE3B,MAAM,GAAG,GAAG,GAAG,gBAAgB,GAAG,KAAK,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEzC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,CAC5B,wBAAwB,CAAC,mBAAmB,EAC5C,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,oBAAoB,CAC5B,wBAAwB,CAAC,kBAAkB,EAC3C,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AASD,MAAM,UAAU,iBAAiB,CAC/B,WAA4B,EAC5B,SAAiB;IAEjB,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,WAAW,CAAC,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,oBAAoB,CAC5B,wBAAwB,CAAC,gBAAgB,EACzC,qBAAqB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,WAA4B,EAC5B,KAA2B,EAC3B,cAAsB,oBAAoB;IAE1C,MAAM,GAAG,GAAG,GAAG,gBAAgB,GAAG,KAAK,EAAE,CAAC;IAC1C,WAAW,CAAC,cAAc,EAAE,CAAC;IAE7B,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1D,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAEvD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,WAAW;KACZ,CAAC;AACJ,CAAC;AA8BD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAA4B,EAC5B,eAAgC,EAChC,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,aAAa,EACpC,wDAAwD,EACxD,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,KAAK,CAClB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD,MAAM,UAAU,6BAA6B,CAC3C,WAA4B,EAC5B,OAAoB,EACpB,mBAAuC;IAEvC,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QACjF,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,aAAa,EACpC,0DAA0D,EAC1D,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,KAAK,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAA4B,EAC5B,OAAoB,EACpB,eAAiC;IAEjC,IAAI,CAAC,eAAe;QAAE,OAAO;IAE7B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,UAAU,CACjD,OAAO,CAAC,OAAO,EACf,WAAW,CAAC,QAAQ,EACpB,MAAM,CACP,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,eAAe,EACtC,6EAA6E,EAC7E,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,KAAK,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAA4B,EAC5B,eAAgC,EAChC,OAAgB,EAChB,eAAiC,EACjC,OAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACtF,6BAA6B,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAClF,MAAM,yBAAyB,CAAC,WAAW,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,QAAgB;IAEvE,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,GAAG,GAAG,QAAQ,GAAG,MAAM,CAAC;AACjC,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,WAA4B,EAC5B,KAA2B;IAE3B,MAAM,GAAG,GAAG,GAAG,gBAAgB,GAAG,KAAK,EAAE,CAAC;IAG1C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAgC;QAC1C,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;QACpD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;KACpC,CAAC;IAEF,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IACnC,CAAC;IACD,IAAI,WAAW,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,CAAC,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;IACnD,CAAC;IACD,IAAI,WAAW,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,CAAC,mBAAmB,GAAG,WAAW,CAAC,mBAAmB,CAAC;IAC/D,CAAC;IACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IACnC,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACzC,CAAC;IACD,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/authorization-code-grant.d.ts

@@ -0,0 +1,15 @@
+import type { AuthorizationCodeInfo, AuthorizationCodeResolver, TokenRequestContext, TokenRequestParams, ValidatedAuthorizationCodeRequest } from './token-request.js';
+export interface ResolvedAuthorizationCode {
+    code: string;
+    authorizationCode: AuthorizationCodeInfo;
+}
+export declare function resolveAuthorizationCode(params: TokenRequestParams, authCodeResolver: AuthorizationCodeResolver): Promise<ResolvedAuthorizationCode>;
+export declare function validateAuthorizationCodeUnused(authorizationCode: AuthorizationCodeInfo, authCodeResolver: AuthorizationCodeResolver): Promise<void>;
+export declare function validateAuthorizationCodeClient(authorizationCode: AuthorizationCodeInfo, authenticatedClientId: string): void;
+export declare function validateAuthorizationCodeExpiration(authorizationCode: AuthorizationCodeInfo, currentTime?: number): void;
+export declare function validateAuthorizationCodeRedirectUri(authorizationCode: AuthorizationCodeInfo, requestRedirectUri: string | undefined): void;
+export declare function verifyAuthorizationCodePkce(authorizationCode: AuthorizationCodeInfo, codeVerifier: string | undefined): Promise<boolean>;
+export declare function consumeAuthorizationCode(code: string, authCodeResolver: AuthorizationCodeResolver): Promise<void>;
+export declare function buildValidatedAuthorizationCodeRequest(code: string, authorizationCode: AuthorizationCodeInfo, authenticatedClientId: string, codeVerified: boolean): ValidatedAuthorizationCodeRequest;
+export declare function validateAuthorizationCodeGrant(context: TokenRequestContext): Promise<ValidatedAuthorizationCodeRequest>;
+//# sourceMappingURL=authorization-code-grant.d.ts.map

package/dist/authorization-code-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-code-grant.d.ts","sourceRoot":"","sources":["../src/authorization-code-grant.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EAClB,iCAAiC,EAClC,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,qBAAqB,CAAC;CAC1C;AAqBD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,kBAAkB,EAC1B,gBAAgB,EAAE,yBAAyB,GAC1C,OAAO,CAAC,yBAAyB,CAAC,CAmBpC;AAQD,wBAAsB,+BAA+B,CACnD,iBAAiB,EAAE,qBAAqB,EACxC,gBAAgB,EAAE,yBAAyB,GAC1C,OAAO,CAAC,IAAI,CAAC,CAYf;AAKD,wBAAgB,+BAA+B,CAC7C,iBAAiB,EAAE,qBAAqB,EACxC,qBAAqB,EAAE,MAAM,GAC5B,IAAI,CAON;AAQD,wBAAgB,mCAAmC,CACjD,iBAAiB,EAAE,qBAAqB,EACxC,WAAW,GAAE,MAAsC,GAClD,IAAI,CAON;AASD,wBAAgB,oCAAoC,CAClD,iBAAiB,EAAE,qBAAqB,EACxC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,IAAI,CA0BN;AAQD,wBAAsB,2BAA2B,CAC/C,iBAAiB,EAAE,qBAAqB,EACxC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,OAAO,CAAC,CAqDlB;AAQD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,yBAAyB,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf;AAKD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,qBAAqB,EACxC,qBAAqB,EAAE,MAAM,EAC7B,YAAY,EAAE,OAAO,GACpB,iCAAiC,CAcnC;AAuBD,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,iCAAiC,CAAC,CA0B5C"}