@maronn-openid-connect/core 0.0.1

package/dist/crypto-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.d.ts","sourceRoot":"","sources":["../src/crypto-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB/E;AASD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBpG;AASD,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAI/D;AAeD,wBAAsB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqB5E;AAOD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1D;AAOD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAiBlE;AAOD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAYrE;AAcD,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAQ3E;AAOD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAE5D;AAgBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQxD;AAgDD,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,SAAS,CAAC,qBAAqB,GAAG,SAAS,CAAC,iBAGtD,EACD,SAAS,CAAC,EAAE,SAAS,CAAC,QAAQ,EAAE,GAC/B,OAAO,CAAC,SAAS,CAAC,CAGpB;AAgBD,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,SAAS,CAAC,qBAAqB,GAAG,SAAS,CAAC,iBAGtD,EACD,SAAS,CAAC,EAAE,SAAS,CAAC,QAAQ,EAAE,GAC/B,OAAO,CAAC,SAAS,CAAC,CAEpB;AAeD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,CAAC,qBAAqB,GAAG,SAAS,CAAC,iBAAiB,CA2BpH;AAaD,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,SAAS,CAAC,UAAU,GACxB,SAAS,CAAC,qBAAqB,GAAG,SAAS,CAAC,iBAAiB,CA0B/D;AAcD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAK5E;AAKD,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CActD"}

package/dist/crypto-utils.js

@@ -0,0 +1,197 @@
+export async function sign(data, privateKey) {
+    const dataBuffer = stringToArrayBuffer(data);
+    const algorithm = privateKey.algorithm;
+    let signParams;
+    if (algorithm.name === 'RSASSA-PKCS1-v1_5' && 'hash' in algorithm) {
+        signParams = { name: 'RSASSA-PKCS1-v1_5' };
+    }
+    else if (algorithm.name === 'ECDSA' && 'namedCurve' in algorithm) {
+        const namedCurve = algorithm.namedCurve;
+        const hash = namedCurve === 'P-256' ? 'SHA-256' : namedCurve === 'P-384' ? 'SHA-384' : 'SHA-512';
+        signParams = { name: 'ECDSA', hash };
+    }
+    else {
+        throw new Error(`Unsupported algorithm: ${algorithm.name}`);
+    }
+    const signature = await crypto.subtle.sign(signParams, privateKey, dataBuffer);
+    return arrayBufferToBase64Url(signature);
+}
+export async function verify(data, signature, publicKey) {
+    const dataBuffer = stringToArrayBuffer(data);
+    const signatureBuffer = base64UrlToArrayBuffer(signature);
+    const algorithm = publicKey.algorithm;
+    let verifyParams;
+    if (algorithm.name === 'RSASSA-PKCS1-v1_5' && 'hash' in algorithm) {
+        verifyParams = { name: 'RSASSA-PKCS1-v1_5' };
+    }
+    else if (algorithm.name === 'ECDSA' && 'namedCurve' in algorithm) {
+        const namedCurve = algorithm.namedCurve;
+        const hash = namedCurve === 'P-256' ? 'SHA-256' : namedCurve === 'P-384' ? 'SHA-384' : 'SHA-512';
+        verifyParams = { name: 'ECDSA', hash };
+    }
+    else {
+        throw new Error(`Unsupported algorithm: ${algorithm.name}`);
+    }
+    return crypto.subtle.verify(verifyParams, publicKey, signatureBuffer, dataBuffer);
+}
+export function generateRandomString(byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return arrayBufferToBase64Url(bytes.buffer);
+}
+export async function timingSafeEqual(a, b) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.generateKey({ name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const [sigA, sigB] = await Promise.all([
+        crypto.subtle.sign('HMAC', key, encoder.encode(a)),
+        crypto.subtle.sign('HMAC', key, encoder.encode(b)),
+    ]);
+    const bytesA = new Uint8Array(sigA);
+    const bytesB = new Uint8Array(sigB);
+    if (bytesA.length !== bytesB.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let i = 0; i < bytesA.length; i++) {
+        diff |= bytesA[i] ^ bytesB[i];
+    }
+    return diff === 0;
+}
+export async function sha256(data) {
+    const buffer = stringToArrayBuffer(data);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', buffer);
+    return arrayBufferToBase64Url(hashBuffer);
+}
+export function arrayBufferToBase64Url(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        const byte = bytes[i];
+        if (byte === undefined) {
+            throw new Error('Unexpected undefined byte in ArrayBuffer');
+        }
+        binary += String.fromCharCode(byte);
+    }
+    const base64 = btoa(binary);
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export function base64UrlToArrayBuffer(base64url) {
+    const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+    const paddedBase64 = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(paddedBase64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]*$/;
+export function base64UrlToArrayBufferStrict(base64url) {
+    if (!BASE64URL_PATTERN.test(base64url)) {
+        throw new Error('Invalid base64url: contains characters outside the base64url alphabet');
+    }
+    if (base64url.length % 4 === 1) {
+        throw new Error('Invalid base64url: malformed length');
+    }
+    return base64UrlToArrayBuffer(base64url);
+}
+export function stringToArrayBuffer(str) {
+    return new TextEncoder().encode(str).buffer;
+}
+export function rsaModulusBitLength(jwkN) {
+    const bytes = new Uint8Array(base64UrlToArrayBuffer(jwkN));
+    let i = 0;
+    while (i < bytes.length && bytes[i] === 0) {
+        i++;
+    }
+    return (bytes.length - i) * 8;
+}
+async function importKeyFromJwk(jwkString, algorithm = {
+    name: 'RSASSA-PKCS1-v1_5',
+    hash: 'SHA-256',
+}, extractable = true, keyUsages) {
+    const jwk = JSON.parse(jwkString);
+    const isPrivateKey = jwk.kty === 'RSA' ? 'd' in jwk : 'd' in jwk;
+    const usages = keyUsages ?? (isPrivateKey ? ['sign'] : ['verify']);
+    return crypto.subtle.importKey('jwk', jwk, algorithm, extractable, usages);
+}
+export async function importPrivateKeyFromJwk(jwkString, algorithm = {
+    name: 'RSASSA-PKCS1-v1_5',
+    hash: 'SHA-256',
+}, keyUsages) {
+    return importKeyFromJwk(jwkString, algorithm, false, keyUsages);
+}
+export async function importPublicKeyFromJwk(jwkString, algorithm = {
+    name: 'RSASSA-PKCS1-v1_5',
+    hash: 'SHA-256',
+}, keyUsages) {
+    return importKeyFromJwk(jwkString, algorithm, true, keyUsages);
+}
+export function extractAlgorithmParams(key) {
+    const algorithm = key.algorithm;
+    if (algorithm.name === 'RSASSA-PKCS1-v1_5' && 'hash' in algorithm) {
+        const rsaAlgo = algorithm;
+        const hashName = rsaAlgo.hash.name;
+        if (hashName === 'SHA-1') {
+            throw new Error('Unsupported hash algorithm: SHA-1');
+        }
+        return {
+            name: algorithm.name,
+            hash: hashName,
+        };
+    }
+    if (algorithm.name === 'ECDSA' && 'namedCurve' in algorithm) {
+        const ecAlgo = algorithm;
+        return {
+            name: 'ECDSA',
+            namedCurve: ecAlgo.namedCurve,
+        };
+    }
+    throw new Error(`Unsupported algorithm: ${algorithm.name}`);
+}
+export function extractAlgorithmParamsFromJwk(jwk) {
+    if (jwk.kty === 'RSA') {
+        const alg = jwk.alg;
+        const hash = alg === 'RS256'
+            ? 'SHA-256'
+            : alg === 'RS384'
+                ? 'SHA-384'
+                : alg === 'RS512'
+                    ? 'SHA-512'
+                    : null;
+        if (!hash) {
+            throw new Error(`Unsupported RSA alg: ${alg ?? '(missing)'}`);
+        }
+        return { name: 'RSASSA-PKCS1-v1_5', hash };
+    }
+    if (jwk.kty === 'EC') {
+        const crv = jwk.crv;
+        if (crv !== 'P-256' && crv !== 'P-384' && crv !== 'P-521') {
+            throw new Error(`Unsupported EC curve: ${crv ?? '(missing)'}`);
+        }
+        return { name: 'ECDSA', namedCurve: crv };
+    }
+    throw new Error(`Unsupported kty: ${jwk.kty ?? '(missing)'}`);
+}
+export function jwaToHashName(alg) {
+    if (alg.endsWith('256'))
+        return 'SHA-256';
+    if (alg.endsWith('384'))
+        return 'SHA-384';
+    if (alg.endsWith('512'))
+        return 'SHA-512';
+    throw new Error(`Unsupported alg for hash claim: ${alg}`);
+}
+export function getJwaAlgorithm(key) {
+    const algorithm = key.algorithm;
+    if (algorithm.name === 'RSASSA-PKCS1-v1_5' && 'hash' in algorithm) {
+        const hash = algorithm.hash.name;
+        return hash === 'SHA-256' ? 'RS256' : hash === 'SHA-384' ? 'RS384' : 'RS512';
+    }
+    if (algorithm.name === 'ECDSA' && 'namedCurve' in algorithm) {
+        const curve = algorithm.namedCurve;
+        return curve === 'P-256' ? 'ES256' : curve === 'P-384' ? 'ES384' : 'ES512';
+    }
+    throw new Error(`Unsupported algorithm: ${algorithm.name}`);
+}
+//# sourceMappingURL=crypto-utils.js.map

package/dist/crypto-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.js","sourceRoot":"","sources":["../src/crypto-utils.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,UAAqB;IAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IAEvC,IAAI,UAAiE,CAAC;IAEtE,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QAClE,UAAU,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC7C,CAAC;SAAM,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;QACnE,MAAM,UAAU,GAAI,SAAsC,CAAC,UAAU,CAAC;QAEtE,MAAM,IAAI,GAAG,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC/E,OAAO,sBAAsB,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAoB;IAChF,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAEtC,IAAI,YAAmE,CAAC;IAExE,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QAClE,YAAY,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC/C,CAAC;SAAM,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;QACnE,MAAM,UAAU,GAAI,SAAsC,CAAC,UAAU,CAAC;QAEtE,MAAM,IAAI,GAAG,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AACpF,CAAC;AASD,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAE,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACjE,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAOD,MAAM,UAAU,sBAAsB,CAAC,MAAmB;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAGtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAE5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAOD,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IAEtD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAE/D,MAAM,YAAY,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAEvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAOD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAO7C,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,sBAAsB,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAgBD,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAeD,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,YAA2E;IACzE,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,SAAS;CAChB,EACD,WAAW,GAAG,IAAI,EAClB,SAAgC;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAyB,CAAC;IAG1D,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;IAGjE,MAAM,MAAM,GAAG,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,YAA2E;IACzE,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,SAAS;CAChB,EACD,SAAgC;IAGhC,OAAO,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,YAA2E;IACzE,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,SAAS;CAChB,EACD,SAAgC;IAEhC,OAAO,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AACjE,CAAC;AAeD,MAAM,UAAU,sBAAsB,CAAC,GAAc;IACnD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAEhC,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QAClE,MAAM,OAAO,GAAG,SAA4C,CAAC;QAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAGnC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,OAAO;YACL,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,QAA6C;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,SAAqC,CAAC;QACrD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,MAAM,CAAC,UAAyC;SAC7D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAaD,MAAM,UAAU,6BAA6B,CAC3C,GAAyB;IAEzB,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,MAAM,IAAI,GACR,GAAG,KAAK,OAAO;YACb,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,GAAG,KAAK,OAAO;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,GAAG,KAAK,OAAO;oBACf,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,IAAI,CAAC;QACf,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;AAChE,CAAC;AAcD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;AAC5D,CAAC;AAKD,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAEhC,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,GAAI,SAA6C,CAAC,IAAI,CAAC,IAAI,CAAC;QACtE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/E,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAI,SAAsC,CAAC,UAAU,CAAC;QACjE,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/dist/discovery.d.ts

@@ -0,0 +1,56 @@
+export interface ProviderMetadataConfig {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri: string;
+    responseTypesSupported: string[];
+    subjectTypesSupported: string[];
+    idTokenSigningKeys: CryptoKey[];
+    userinfoEndpoint?: string;
+    registrationEndpoint?: string;
+    scopesSupported?: string[];
+    claimsSupported?: string[];
+    claimTypesSupported?: string[];
+    userinfoSigningAlgValuesSupported?: string[];
+    grantTypesSupported?: string[];
+    tokenEndpointAuthMethodsSupported?: string[];
+    responseModesSupported?: string[];
+    claimsParameterSupported?: boolean;
+    requestParameterSupported?: boolean;
+    requestUriParameterSupported?: boolean;
+    requestObjectSigningAlgValuesSupported?: string[];
+    authorizationResponseIssParameterSupported?: boolean;
+    introspectionEndpoint?: string;
+    introspectionEndpointAuthMethodsSupported?: string[];
+    revocationEndpoint?: string;
+    revocationEndpointAuthMethodsSupported?: string[];
+}
+export interface ProviderMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    response_types_supported: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    userinfo_endpoint?: string;
+    registration_endpoint?: string;
+    scopes_supported?: string[];
+    claims_supported?: string[];
+    claim_types_supported?: string[];
+    userinfo_signing_alg_values_supported?: string[];
+    grant_types_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    response_modes_supported?: string[];
+    claims_parameter_supported?: boolean;
+    request_parameter_supported?: boolean;
+    request_uri_parameter_supported?: boolean;
+    request_object_signing_alg_values_supported?: string[];
+    authorization_response_iss_parameter_supported?: boolean;
+    introspection_endpoint?: string;
+    introspection_endpoint_auth_methods_supported?: string[];
+    revocation_endpoint?: string;
+    revocation_endpoint_auth_methods_supported?: string[];
+}
+export declare function buildProviderMetadata(config: ProviderMetadataConfig): ProviderMetadata;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,sBAAsB;IAErC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAWhC,kBAAkB,EAAE,SAAS,EAAE,CAAC;IAGhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAO3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAM/B,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAC;IAG7C,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7C,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAMvC,sCAAsC,CAAC,EAAE,MAAM,EAAE,CAAC;IAIlD,0CAA0C,CAAC,EAAE,OAAO,CAAC;IAKrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yCAAyC,CAAC,EAAE,MAAM,EAAE,CAAC;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sCAAsC,CAAC,EAAE,MAAM,EAAE,CAAC;CACnD;AAKD,MAAM,WAAW,gBAAgB;IAE/B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAGhD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IAGjD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,+BAA+B,CAAC,EAAE,OAAO,CAAC;IAC1C,2CAA2C,CAAC,EAAE,MAAM,EAAE,CAAC;IAGvD,8CAA8C,CAAC,EAAE,OAAO,CAAC;IAGzD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6CAA6C,CAAC,EAAE,MAAM,EAAE,CAAC;IACzD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0CAA0C,CAAC,EAAE,MAAM,EAAE,CAAC;CACvD;AAqCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,gBAAgB,CAyItF"}

package/dist/discovery.js

@@ -0,0 +1,133 @@
+import { getJwaAlgorithm } from './crypto-utils.js';
+import { isLoopbackHostname } from './loopback.js';
+import { assertHasRs256Key } from './signing-key.js';
+function validateIssuer(issuer) {
+    if (!issuer) {
+        throw new Error('issuer is required');
+    }
+    let url;
+    try {
+        url = new URL(issuer);
+    }
+    catch {
+        throw new Error(`issuer must be a valid URL: ${issuer}`);
+    }
+    if (url.protocol !== 'https:' && !isLoopbackHostname(url.hostname)) {
+        throw new Error('issuer must use https scheme (except loopback hosts)');
+    }
+    if (url.search) {
+        throw new Error('issuer must not contain query parameters');
+    }
+    if (url.hash) {
+        throw new Error('issuer must not contain a fragment');
+    }
+}
+export function buildProviderMetadata(config) {
+    validateIssuer(config.issuer);
+    if (!config.authorizationEndpoint) {
+        throw new Error('authorizationEndpoint is required');
+    }
+    if (!config.tokenEndpoint) {
+        throw new Error('tokenEndpoint is required');
+    }
+    if (!config.jwksUri) {
+        throw new Error('jwksUri is required');
+    }
+    if (!config.responseTypesSupported || config.responseTypesSupported.length === 0) {
+        throw new Error('responseTypesSupported must not be empty');
+    }
+    if (!config.subjectTypesSupported || config.subjectTypesSupported.length === 0) {
+        throw new Error('subjectTypesSupported must not be empty');
+    }
+    if (!config.idTokenSigningKeys || config.idTokenSigningKeys.length === 0) {
+        throw new Error('idTokenSigningKeys must not be empty');
+    }
+    assertHasRs256Key(config.idTokenSigningKeys);
+    const idTokenAlgs = [];
+    const seenAlgs = new Set();
+    for (const key of config.idTokenSigningKeys) {
+        const alg = getJwaAlgorithm(key);
+        if (!seenAlgs.has(alg)) {
+            seenAlgs.add(alg);
+            idTokenAlgs.push(alg);
+        }
+    }
+    const metadata = {
+        issuer: config.issuer,
+        authorization_endpoint: config.authorizationEndpoint,
+        token_endpoint: config.tokenEndpoint,
+        jwks_uri: config.jwksUri,
+        response_types_supported: config.responseTypesSupported,
+        subject_types_supported: config.subjectTypesSupported,
+        id_token_signing_alg_values_supported: idTokenAlgs,
+    };
+    if (config.userinfoEndpoint) {
+        metadata.userinfo_endpoint = config.userinfoEndpoint;
+    }
+    if (config.registrationEndpoint) {
+        metadata.registration_endpoint = config.registrationEndpoint;
+    }
+    if (config.scopesSupported && config.scopesSupported.length > 0) {
+        metadata.scopes_supported = config.scopesSupported;
+    }
+    if (config.claimsSupported && config.claimsSupported.length > 0) {
+        metadata.claims_supported = config.claimsSupported;
+    }
+    if (config.claimTypesSupported && config.claimTypesSupported.length > 0) {
+        const invalid = config.claimTypesSupported.filter((t) => t !== 'normal');
+        if (invalid.length > 0) {
+            throw new Error(`Unsupported claim_types_supported value(s): ${invalid.join(', ')}. Only 'normal' is supported.`);
+        }
+        metadata.claim_types_supported = config.claimTypesSupported;
+    }
+    if (config.userinfoSigningAlgValuesSupported &&
+        config.userinfoSigningAlgValuesSupported.length > 0) {
+        metadata.userinfo_signing_alg_values_supported =
+            config.userinfoSigningAlgValuesSupported;
+    }
+    if (config.grantTypesSupported && config.grantTypesSupported.length > 0) {
+        metadata.grant_types_supported = config.grantTypesSupported;
+    }
+    if (config.tokenEndpointAuthMethodsSupported && config.tokenEndpointAuthMethodsSupported.length > 0) {
+        metadata.token_endpoint_auth_methods_supported = config.tokenEndpointAuthMethodsSupported;
+    }
+    if (config.responseModesSupported && config.responseModesSupported.length > 0) {
+        metadata.response_modes_supported = config.responseModesSupported;
+    }
+    if (config.claimsParameterSupported !== undefined) {
+        metadata.claims_parameter_supported = config.claimsParameterSupported;
+    }
+    if (config.requestParameterSupported !== undefined) {
+        metadata.request_parameter_supported = config.requestParameterSupported;
+    }
+    if (config.requestUriParameterSupported !== undefined) {
+        metadata.request_uri_parameter_supported = config.requestUriParameterSupported;
+    }
+    if (config.requestObjectSigningAlgValuesSupported &&
+        config.requestObjectSigningAlgValuesSupported.length > 0) {
+        metadata.request_object_signing_alg_values_supported =
+            config.requestObjectSigningAlgValuesSupported;
+    }
+    if (config.authorizationResponseIssParameterSupported !== undefined) {
+        metadata.authorization_response_iss_parameter_supported =
+            config.authorizationResponseIssParameterSupported;
+    }
+    if (config.introspectionEndpoint) {
+        metadata.introspection_endpoint = config.introspectionEndpoint;
+    }
+    if (config.introspectionEndpointAuthMethodsSupported &&
+        config.introspectionEndpointAuthMethodsSupported.length > 0) {
+        metadata.introspection_endpoint_auth_methods_supported =
+            config.introspectionEndpointAuthMethodsSupported;
+    }
+    if (config.revocationEndpoint) {
+        metadata.revocation_endpoint = config.revocationEndpoint;
+    }
+    if (config.revocationEndpointAuthMethodsSupported &&
+        config.revocationEndpointAuthMethodsSupported.length > 0) {
+        metadata.revocation_endpoint_auth_methods_supported =
+            config.revocationEndpointAuthMethodsSupported;
+    }
+    return metadata;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAsHrD,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE9B,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAI7C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAqB;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,sBAAsB,EAAE,MAAM,CAAC,qBAAqB;QACpD,cAAc,EAAE,MAAM,CAAC,aAAa;QACpC,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,wBAAwB,EAAE,MAAM,CAAC,sBAAsB;QACvD,uBAAuB,EAAE,MAAM,CAAC,qBAAqB;QACrD,qCAAqC,EAAE,WAAW;KACnD,CAAC;IAGF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,QAAQ,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAC/D,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAIxE,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CACjG,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAC9D,CAAC;IACD,IACE,MAAM,CAAC,iCAAiC;QACxC,MAAM,CAAC,iCAAiC,CAAC,MAAM,GAAG,CAAC,EACnD,CAAC;QACD,QAAQ,CAAC,qCAAqC;YAC5C,MAAM,CAAC,iCAAiC,CAAC;IAC7C,CAAC;IAGD,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,iCAAiC,IAAI,MAAM,CAAC,iCAAiC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpG,QAAQ,CAAC,qCAAqC,GAAG,MAAM,CAAC,iCAAiC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,QAAQ,CAAC,wBAAwB,GAAG,MAAM,CAAC,sBAAsB,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAClD,QAAQ,CAAC,0BAA0B,GAAG,MAAM,CAAC,wBAAwB,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;QACnD,QAAQ,CAAC,2BAA2B,GAAG,MAAM,CAAC,yBAAyB,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,4BAA4B,KAAK,SAAS,EAAE,CAAC;QACtD,QAAQ,CAAC,+BAA+B,GAAG,MAAM,CAAC,4BAA4B,CAAC;IACjF,CAAC;IACD,IACE,MAAM,CAAC,sCAAsC;QAC7C,MAAM,CAAC,sCAAsC,CAAC,MAAM,GAAG,CAAC,EACxD,CAAC;QACD,QAAQ,CAAC,2CAA2C;YAClD,MAAM,CAAC,sCAAsC,CAAC;IAClD,CAAC;IAGD,IAAI,MAAM,CAAC,0CAA0C,KAAK,SAAS,EAAE,CAAC;QACpE,QAAQ,CAAC,8CAA8C;YACrD,MAAM,CAAC,0CAA0C,CAAC;IACtD,CAAC;IAID,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,QAAQ,CAAC,sBAAsB,GAAG,MAAM,CAAC,qBAAqB,CAAC;IACjE,CAAC;IACD,IACE,MAAM,CAAC,yCAAyC;QAChD,MAAM,CAAC,yCAAyC,CAAC,MAAM,GAAG,CAAC,EAC3D,CAAC;QACD,QAAQ,CAAC,6CAA6C;YACpD,MAAM,CAAC,yCAAyC,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,QAAQ,CAAC,mBAAmB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAC3D,CAAC;IACD,IACE,MAAM,CAAC,sCAAsC;QAC7C,MAAM,CAAC,sCAAsC,CAAC,MAAM,GAAG,CAAC,EACxD,CAAC;QACD,QAAQ,CAAC,0CAA0C;YACjD,MAAM,CAAC,sCAAsC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/error-utils.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeErrorDescription(value: string): string;
+//# sourceMappingURL=error-utils.d.ts.map

package/dist/error-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-utils.d.ts","sourceRoot":"","sources":["../src/error-utils.ts"],"names":[],"mappings":"AAaA,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAY9D"}

package/dist/error-utils.js

@@ -0,0 +1,13 @@
+export function sanitizeErrorDescription(value) {
+    let result = '';
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        const allowed = code === 0x20 ||
+            code === 0x21 ||
+            (code >= 0x23 && code <= 0x5b) ||
+            (code >= 0x5d && code <= 0x7e);
+        result += allowed ? value[i] : '?';
+    }
+    return result;
+}
+//# sourceMappingURL=error-utils.js.map

package/dist/error-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-utils.js","sourceRoot":"","sources":["../src/error-utils.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GACX,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,IAAI;YACb,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;YAC9B,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/id-token.d.ts

@@ -0,0 +1,39 @@
+import type { JwkSet } from './jwks.js';
+export interface IdTokenPayload {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    auth_time?: number;
+    nonce?: string;
+    acr?: string;
+    amr?: string[];
+    azp?: string;
+    [key: string]: unknown;
+}
+export interface GenerateIdTokenOptions {
+    payload: IdTokenPayload;
+    privateKey: CryptoKey;
+    keyId?: string;
+}
+export declare const DEFAULT_CLOCK_SKEW_TOLERANCE_SEC = 60;
+export declare function validatePayload(payload: IdTokenPayload, options?: {
+    clockSkewToleranceSec?: number;
+}): void;
+export declare function generateIdToken(options: GenerateIdTokenOptions): Promise<string>;
+export declare class IdTokenHintError extends Error {
+    readonly error: 'login_required';
+    constructor(message: string);
+}
+export declare function validateIdTokenHint(hint: string, options: {
+    expectedIss: string;
+    expectedAud: string;
+    jwks: JwkSet;
+}, verifyOptions?: {
+    clockSkewToleranceSec?: number;
+}): Promise<{
+    sub: string;
+    [key: string]: unknown;
+}>;
+//# sourceMappingURL=id-token.d.ts.map

package/dist/id-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token.d.ts","sourceRoot":"","sources":["../src/id-token.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAMxC,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAKD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAwCD,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAUnD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE;IAAE,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C,IAAI,CA8EN;AAmBD,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BtF;AASD,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,KAAK,EAAE,gBAAgB,CAAC;gBAE5B,OAAO,EAAE,MAAM;CAK5B;AA6CD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,EACD,aAAa,CAAC,EAAE;IAAE,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC,CA2GlD"}