@maronn-openid-connect/core 0.0.1

package/dist/id-token.js

@@ -0,0 +1,193 @@
+import { sign, verify, arrayBufferToBase64Url, base64UrlToArrayBufferStrict, stringToArrayBuffer, getJwaAlgorithm, extractAlgorithmParamsFromJwk, } from './crypto-utils.js';
+import { isLoopbackHostname } from './loopback.js';
+function validateIssuer(iss) {
+    let url;
+    try {
+        url = new URL(iss);
+    }
+    catch {
+        throw new Error('Issuer must be a valid URL');
+    }
+    if (url.protocol !== 'https:' && !isLoopbackHostname(url.hostname)) {
+        throw new Error('Issuer must use https scheme (except for loopback hosts)');
+    }
+    if (url.search) {
+        throw new Error('Issuer must not contain query parameters');
+    }
+    if (url.hash) {
+        throw new Error('Issuer must not contain fragment');
+    }
+}
+export const DEFAULT_CLOCK_SKEW_TOLERANCE_SEC = 60;
+export function validatePayload(payload, options) {
+    if (!payload.iss) {
+        throw new Error('Missing required claim: iss');
+    }
+    validateIssuer(payload.iss);
+    if (!payload.sub) {
+        throw new Error('Missing required claim: sub');
+    }
+    if (payload.sub.length > 255) {
+        throw new Error('Subject identifier must not exceed 255 ASCII characters');
+    }
+    if (payload.aud === undefined || payload.aud === null) {
+        throw new Error('Missing required claim: aud');
+    }
+    if (Array.isArray(payload.aud) && payload.aud.length === 0) {
+        throw new Error('Audience must not be an empty array');
+    }
+    if (Array.isArray(payload.aud)) {
+        for (const a of payload.aud) {
+            if (typeof a !== 'string' || a.length === 0) {
+                throw new Error('Audience array must contain only non-empty strings');
+            }
+        }
+    }
+    if (payload.exp === undefined || payload.exp === null) {
+        throw new Error('Missing required claim: exp');
+    }
+    if (typeof payload.exp !== 'number') {
+        throw new Error('exp must be a number (NumericDate)');
+    }
+    const leeway = options?.clockSkewToleranceSec ?? DEFAULT_CLOCK_SKEW_TOLERANCE_SEC;
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.exp < now - leeway) {
+        throw new Error('Token expiration time is in the past');
+    }
+    if (payload.iat === undefined || payload.iat === null) {
+        throw new Error('Missing required claim: iat');
+    }
+    if (typeof payload.iat !== 'number') {
+        throw new Error('iat must be a number (NumericDate)');
+    }
+    if (Array.isArray(payload.aud) && payload.aud.length > 1) {
+        if (!payload.azp) {
+            throw new Error('azp is required when aud contains multiple values');
+        }
+        if (!payload.aud.includes(payload.azp)) {
+            throw new Error('azp must be one of the audience values');
+        }
+    }
+}
+function base64UrlEncode(str) {
+    return arrayBufferToBase64Url(stringToArrayBuffer(str));
+}
+export async function generateIdToken(options) {
+    const { payload, privateKey, keyId } = options;
+    validatePayload(payload);
+    const header = {
+        alg: getJwaAlgorithm(privateKey),
+        typ: 'JWT',
+    };
+    if (keyId) {
+        header.kid = keyId;
+    }
+    const headerB64 = base64UrlEncode(JSON.stringify(header));
+    const payloadB64 = base64UrlEncode(JSON.stringify(payload));
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const signature = await sign(signingInput, privateKey);
+    return `${signingInput}.${signature}`;
+}
+export class IdTokenHintError extends Error {
+    error;
+    constructor(message) {
+        super(message);
+        this.name = 'IdTokenHintError';
+        this.error = 'login_required';
+    }
+}
+const FORBIDDEN_KEY_HEADERS = ['jku', 'x5u', 'jwk', 'x5c'];
+function assertNoExternalKeyHeaders(header) {
+    for (const field of FORBIDDEN_KEY_HEADERS) {
+        if (field in header) {
+            throw new IdTokenHintError(`id_token_hint JOSE header contains unsupported field: ${field}`);
+        }
+    }
+}
+export async function validateIdTokenHint(hint, options, verifyOptions) {
+    const { expectedIss, expectedAud, jwks } = options;
+    const leeway = verifyOptions?.clockSkewToleranceSec ?? DEFAULT_CLOCK_SKEW_TOLERANCE_SEC;
+    if (typeof hint !== 'string' || hint.length === 0) {
+        throw new IdTokenHintError('id_token_hint is empty');
+    }
+    const parts = hint.split('.');
+    if (parts.length !== 3) {
+        throw new IdTokenHintError('id_token_hint is not a valid JWS compact serialization');
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(new TextDecoder().decode(base64UrlToArrayBufferStrict(headerB64)));
+        payload = JSON.parse(new TextDecoder().decode(base64UrlToArrayBufferStrict(payloadB64)));
+    }
+    catch {
+        throw new IdTokenHintError('id_token_hint header or payload is not valid base64url JSON');
+    }
+    const headerAlg = typeof header['alg'] === 'string' ? header['alg'] : undefined;
+    if (!headerAlg || headerAlg === 'none') {
+        throw new IdTokenHintError('id_token_hint alg is missing or "none"');
+    }
+    assertNoExternalKeyHeaders(header);
+    const headerKid = typeof header['kid'] === 'string' ? header['kid'] : undefined;
+    const candidates = headerKid
+        ? jwks.keys.filter((k) => k.kid === headerKid)
+        : jwks.keys.filter((k) => k.alg === headerAlg);
+    if (candidates.length === 0) {
+        throw new IdTokenHintError('No JWK matched the id_token_hint header');
+    }
+    const signingInput = `${headerB64}.${payloadB64}`;
+    let signatureValid = false;
+    for (const jwk of candidates) {
+        if (jwk.alg !== headerAlg) {
+            continue;
+        }
+        let publicKey;
+        try {
+            const algParams = extractAlgorithmParamsFromJwk(jwk);
+            publicKey = await crypto.subtle.importKey('jwk', jwk, algParams, false, ['verify']);
+        }
+        catch {
+            continue;
+        }
+        try {
+            if (await verify(signingInput, signatureB64, publicKey)) {
+                signatureValid = true;
+                break;
+            }
+        }
+        catch {
+        }
+    }
+    if (!signatureValid) {
+        throw new IdTokenHintError('id_token_hint signature verification failed');
+    }
+    if (payload['iss'] !== expectedIss) {
+        throw new IdTokenHintError('id_token_hint iss does not match expected issuer');
+    }
+    const aud = payload['aud'];
+    const audMatches = aud === expectedAud || (Array.isArray(aud) && aud.includes(expectedAud));
+    if (!audMatches) {
+        throw new IdTokenHintError('id_token_hint aud does not match expected audience');
+    }
+    const exp = payload['exp'];
+    if (typeof exp !== 'number') {
+        throw new IdTokenHintError('id_token_hint is missing exp claim');
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (exp + leeway < now) {
+        throw new IdTokenHintError('id_token_hint has expired');
+    }
+    const iat = payload['iat'];
+    if (typeof iat !== 'number') {
+        throw new IdTokenHintError('id_token_hint is missing iat claim');
+    }
+    if (iat > now + leeway) {
+        throw new IdTokenHintError('id_token_hint iat is in the future');
+    }
+    if (typeof payload['sub'] !== 'string' || payload['sub'].length === 0) {
+        throw new IdTokenHintError('id_token_hint is missing sub claim');
+    }
+    return payload;
+}
+//# sourceMappingURL=id-token.js.map

package/dist/id-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token.js","sourceRoot":"","sources":["../src/id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,MAAM,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,EACnB,eAAe,EACf,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAiCnD,SAAS,cAAc,CAAC,GAAW;IAGjC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAGD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAGD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAGD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AASD,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAUnD,MAAM,UAAU,eAAe,CAC7B,OAAuB,EACvB,OAA4C;IAG5C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAGD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAGD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAKD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAID,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAGD,MAAM,MAAM,GAAG,OAAO,EAAE,qBAAqB,IAAI,gCAAgC,CAAC;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAGD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAQD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAGD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC;AAKD,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,sBAAsB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAG/C,eAAe,CAAC,OAAO,CAAC,CAAC;IAGzB,MAAM,MAAM,GAA2B;QACrC,GAAG,EAAE,eAAe,CAAC,UAAU,CAAC;QAChC,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;IACrB,CAAC;IAGD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAG5D,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAGlD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAEvD,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AASD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzB,KAAK,CAAmB;IAExC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC;IAChC,CAAC;CACF;AAQD,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAOpE,SAAS,0BAA0B,CAAC,MAA+B;IACjE,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,gBAAgB,CACxB,yDAAyD,KAAK,EAAE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,OAIC,EACD,aAAkD;IAElD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACnD,MAAM,MAAM,GAAG,aAAa,EAAE,qBAAqB,IAAI,gCAAgC,CAAC;IAExF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CAAC,wDAAwD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAC;IAEhF,IAAI,MAA+B,CAAC;IACpC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACvF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,6DAA6D,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,KAAK,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;IACvE,CAAC;IAED,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,KAAK,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAI5F,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAEjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAG1B,SAAS;QACX,CAAC;QACD,IAAI,SAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;YACrD,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;gBACxD,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,gBAAgB,CAAC,kDAAkD,CAAC,CAAC;IACjF,CAAC;IAGD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GACd,GAAG,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,gBAAgB,CAAC,oDAAoD,CAAC,CAAC;IACnF,CAAC;IAGD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC;IAKD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,OAAkD,CAAC;AAC5D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,34 @@
+export declare const version = "0.0.1";
+export { validateAuthorizationRequest, resolveClientForAuthorization, validateRegisteredRedirectUris, resolveRequestObjectParams, resolveAuthorizationRedirectUri, rejectUnsupportedRequestParams, validateRequestObjectConsistency, validateResponseType, validateAuthorizationScope, validateAuthorizationCodePkce, validatePromptParameter, applyOfflineAccessPolicy, validateDisplayParameter, resolveMaxAge, parseAudienceParameter, parseClaimsRequestParameter, defaultIsOfflineAccessGranted, AuthorizationError, AuthorizationErrorCode, DEFAULT_MAX_CLAIMS_PARAMETER_LENGTH, DEFAULT_REQUEST_OBJECT_SIGNING_ALGS, } from './authorization-request.js';
+export { parseRequestObject, RequestObjectError, } from './request-object.js';
+export type { ParseRequestObjectOptions, } from './request-object.js';
+export type { AuthorizationRequestParams, ClientInfo, ClientResolver, ResolvedRequestObjectParams, ValidatedAuthorizationRequest, ValidateAuthorizationRequestOptions, OfflineAccessGrantedCallback, } from './authorization-request.js';
+export { validateTokenRequest, validateGrantTypeSupported, resolveAuthenticatedTokenClient, validateClientGrantType, resolveAuthorizationCode, validateAuthorizationCodeUnused, validateAuthorizationCodeClient, validateAuthorizationCodeExpiration, validateAuthorizationCodeRedirectUri, verifyAuthorizationCodePkce, consumeAuthorizationCode, buildValidatedAuthorizationCodeRequest, validateAuthorizationCodeGrant, resolveRefreshToken, validateRefreshTokenUnused, validateRefreshTokenClient, validateRefreshTokenExpiration, validateRefreshTokenIdleTimeout, validateRefreshTokenScope, buildValidatedRefreshTokenRequest, validateRefreshTokenGrant, TokenError, TokenErrorCode, } from './token-request.js';
+export type { TokenRequestParams, TokenClientInfo, TokenClientResolver, AuthorizationCodeInfo, AuthorizationCodeResolver, RefreshTokenInfo, RefreshTokenResolver, TokenRequestContext, ValidatedTokenRequest, ValidatedAuthorizationCodeRequest, ValidatedRefreshTokenRequest, ResolvedAuthorizationCode, ResolvedRefreshToken, } from './token-request.js';
+export { generateTokenResponse, buildAccessTokenAudience, buildIdTokenAudience, buildAccessTokenPayload, computeAtHash, resolveAcrAmr, buildIdTokenPayload, } from './token-response.js';
+export type { TokenResponseOptions, TokenResponse, GenerateTokenResponseResult, AccessTokenAudienceInput, IdTokenAudienceInput, IdTokenAudienceResult, AcrResolver, AccessTokenPayloadInput, IdTokenPayloadInput, ResolveAcrAmrInput, ResolvedAcrAmr, } from './token-response.js';
+export { exportPublicJwk, exportJwks, signingKeysToJwkSet, } from './jwks.js';
+export { generateIdToken, validateIdTokenHint, IdTokenHintError, } from './id-token.js';
+export type { IdTokenPayload, GenerateIdTokenOptions, } from './id-token.js';
+export type { Jwk, JwkSet, JwksKeyEntry, } from './jwks.js';
+export { generateRandomString, extractAlgorithmParamsFromJwk, getJwaAlgorithm, } from './crypto-utils.js';
+export { sanitizeErrorDescription, } from './error-utils.js';
+export { createAuthTransaction, getAuthTransaction, validateCsrfToken, handleLoginFailure, completeAuthTransaction, checkPromptNone, requiresReauthentication, AuthTransactionError, AuthTransactionErrorCode, resolvePromptNoneSession, validatePromptNoneIdTokenHint, validatePromptNoneConsent, } from './auth-transaction.js';
+export type { AuthTransaction, AuthTransactionStore, AuthorizationResponseParams, ConsentResolver, LoginFailureResult, PromptNoneOptions, SessionInfo, SessionResolver, } from './auth-transaction.js';
+export { buildProviderMetadata, } from './discovery.js';
+export type { ProviderMetadataConfig, ProviderMetadata, } from './discovery.js';
+export { handleUserInfoRequest, generateUserInfoJwt, filterClaimsByScope, UserInfoError, UserInfoErrorCode, SCOPE_CLAIMS_MAP, resolveUserInfoAccessToken, validateUserInfoTokenExpiration, validateUserInfoScope, validateUserInfoAudience, resolveUserInfoClaims, applyRequestedClaims, } from './userinfo.js';
+export type { AccessTokenInfo, AccessTokenResolver, AddressClaim, UserClaims, UserClaimsResolver, ClaimsParameter, ClaimRequestEntry, ClaimRequestValue, UserInfoRequestContext, UserInfoResponse, UserInfoJwtOptions, } from './userinfo.js';
+export { assertHasRs256Key, assertKeyStrength, assertKidStrategyConsistent, createCachedSigningKeyProvider, getRegisteredSigningKeys, selectSigningKeyByAlg, } from './signing-key.js';
+export type { SigningKey, SigningKeyProvider, KeyStrengthPolicy, } from './signing-key.js';
+export { authenticateClient, extractClientCredentials, validateClientAuthMethod, verifyClientSecret, } from './client-auth.js';
+export type { ClientAuthContext, PresentedClientCredentials, } from './client-auth.js';
+export { createAuthorizationCode, } from './authorization-code.js';
+export type { AuthorizationCodeData, CreateAuthorizationCodeOptions, } from './authorization-code.js';
+export { createJwtAccessTokenIssuer, createOpaqueAccessTokenIssuer, } from './access-token-issuer.js';
+export type { AccessTokenFormat, AccessTokenIssuer, AccessTokenIssuanceContext, } from './access-token-issuer.js';
+export { handleIntrospectionRequest, IntrospectionError, IntrospectionErrorCode, requireIntrospectionToken, requireIntrospectionClient, resolveIntrospectionToken, isIntrospectionTokenActive, buildIntrospectionResponse, INACTIVE_INTROSPECTION_RESPONSE, } from './introspection.js';
+export type { IntrospectionRequestContext, IntrospectionResponse, IntrospectionAccessTokenResolver, IntrospectionRefreshTokenResolver, ResolvedIntrospectionToken, ResolveIntrospectionTokenOptions, } from './introspection.js';
+export { handleRevocationRequest, RevocationError, RevocationErrorCode, requireRevocationToken, requireRevocationClient, resolveRevocationTarget, validateRevocationTokenClient, revokeResolvedToken, revokeGrantAccessTokens, } from './revocation.js';
+export type { RevocationRequestContext, RevocationTokenResolvers, ResolvedRevocationToken, ResolveRevocationTargetOptions, } from './revocation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EACL,4BAA4B,EAG5B,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC1B,+BAA+B,EAC/B,8BAA8B,EAC9B,gCAAgC,EAChC,oBAAoB,EACpB,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,kBAAkB,EAClB,sBAAsB,EACtB,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,0BAA0B,EAC1B,UAAU,EACV,cAAc,EACd,2BAA2B,EAC3B,6BAA6B,EAC7B,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,oBAAoB,EAEpB,0BAA0B,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,2BAA2B,EAC3B,wBAAwB,EACxB,sCAAsC,EACtC,8BAA8B,EAC9B,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,EAC/B,yBAAyB,EACzB,iCAAiC,EACjC,yBAAyB,EACzB,UAAU,EACV,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,iCAAiC,EACjC,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EAEpB,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,WAAW,EACX,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,UAAU,EACV,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,cAAc,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,GAAG,EACH,MAAM,EACN,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,0BAA0B,EAC1B,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAElB,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EAEtB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,gCAAgC,EAChC,iCAAiC,EACjC,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,mBAAmB,EAEnB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+export const version = '0.0.1';
+export { validateAuthorizationRequest, resolveClientForAuthorization, validateRegisteredRedirectUris, resolveRequestObjectParams, resolveAuthorizationRedirectUri, rejectUnsupportedRequestParams, validateRequestObjectConsistency, validateResponseType, validateAuthorizationScope, validateAuthorizationCodePkce, validatePromptParameter, applyOfflineAccessPolicy, validateDisplayParameter, resolveMaxAge, parseAudienceParameter, parseClaimsRequestParameter, defaultIsOfflineAccessGranted, AuthorizationError, AuthorizationErrorCode, DEFAULT_MAX_CLAIMS_PARAMETER_LENGTH, DEFAULT_REQUEST_OBJECT_SIGNING_ALGS, } from './authorization-request.js';
+export { parseRequestObject, RequestObjectError, } from './request-object.js';
+export { validateTokenRequest, validateGrantTypeSupported, resolveAuthenticatedTokenClient, validateClientGrantType, resolveAuthorizationCode, validateAuthorizationCodeUnused, validateAuthorizationCodeClient, validateAuthorizationCodeExpiration, validateAuthorizationCodeRedirectUri, verifyAuthorizationCodePkce, consumeAuthorizationCode, buildValidatedAuthorizationCodeRequest, validateAuthorizationCodeGrant, resolveRefreshToken, validateRefreshTokenUnused, validateRefreshTokenClient, validateRefreshTokenExpiration, validateRefreshTokenIdleTimeout, validateRefreshTokenScope, buildValidatedRefreshTokenRequest, validateRefreshTokenGrant, TokenError, TokenErrorCode, } from './token-request.js';
+export { generateTokenResponse, buildAccessTokenAudience, buildIdTokenAudience, buildAccessTokenPayload, computeAtHash, resolveAcrAmr, buildIdTokenPayload, } from './token-response.js';
+export { exportPublicJwk, exportJwks, signingKeysToJwkSet, } from './jwks.js';
+export { generateIdToken, validateIdTokenHint, IdTokenHintError, } from './id-token.js';
+export { generateRandomString, extractAlgorithmParamsFromJwk, getJwaAlgorithm, } from './crypto-utils.js';
+export { sanitizeErrorDescription, } from './error-utils.js';
+export { createAuthTransaction, getAuthTransaction, validateCsrfToken, handleLoginFailure, completeAuthTransaction, checkPromptNone, requiresReauthentication, AuthTransactionError, AuthTransactionErrorCode, resolvePromptNoneSession, validatePromptNoneIdTokenHint, validatePromptNoneConsent, } from './auth-transaction.js';
+export { buildProviderMetadata, } from './discovery.js';
+export { handleUserInfoRequest, generateUserInfoJwt, filterClaimsByScope, UserInfoError, UserInfoErrorCode, SCOPE_CLAIMS_MAP, resolveUserInfoAccessToken, validateUserInfoTokenExpiration, validateUserInfoScope, validateUserInfoAudience, resolveUserInfoClaims, applyRequestedClaims, } from './userinfo.js';
+export { assertHasRs256Key, assertKeyStrength, assertKidStrategyConsistent, createCachedSigningKeyProvider, getRegisteredSigningKeys, selectSigningKeyByAlg, } from './signing-key.js';
+export { authenticateClient, extractClientCredentials, validateClientAuthMethod, verifyClientSecret, } from './client-auth.js';
+export { createAuthorizationCode, } from './authorization-code.js';
+export { createJwtAccessTokenIssuer, createOpaqueAccessTokenIssuer, } from './access-token-issuer.js';
+export { handleIntrospectionRequest, IntrospectionError, IntrospectionErrorCode, requireIntrospectionToken, requireIntrospectionClient, resolveIntrospectionToken, isIntrospectionTokenActive, buildIntrospectionResponse, INACTIVE_INTROSPECTION_RESPONSE, } from './introspection.js';
+export { handleRevocationRequest, RevocationError, RevocationErrorCode, requireRevocationToken, requireRevocationClient, resolveRevocationTarget, validateRevocationTokenClient, revokeResolvedToken, revokeGrantAccessTokens, } from './revocation.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EACL,4BAA4B,EAG5B,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC1B,+BAA+B,EAC/B,8BAA8B,EAC9B,gCAAgC,EAChC,oBAAoB,EACpB,0BAA0B,EAC1B,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,kBAAkB,EAClB,sBAAsB,EACtB,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAgB7B,OAAO,EACL,oBAAoB,EAEpB,0BAA0B,EAC1B,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,2BAA2B,EAC3B,wBAAwB,EACxB,sCAAsC,EACtC,8BAA8B,EAC9B,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,EAC/B,yBAAyB,EACzB,iCAAiC,EACjC,yBAAyB,EACzB,UAAU,EACV,cAAc,GACf,MAAM,oBAAoB,CAAC;AAkB5B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EAEpB,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAgB7B,OAAO,EACL,eAAe,EACf,UAAU,EACV,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAavB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAa/B,OAAO,EACL,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,0BAA0B,EAC1B,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAgBvB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EACL,kBAAkB,EAElB,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EACL,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EAEtB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAW5B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,mBAAmB,EAEnB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC"}

package/dist/introspection.d.ts

@@ -0,0 +1,66 @@
+import type { AccessTokenInfo } from './userinfo.js';
+import type { RefreshTokenInfo } from './token-request.js';
+export declare enum IntrospectionErrorCode {
+    InvalidRequest = "invalid_request",
+    InvalidClient = "invalid_client"
+}
+export declare class IntrospectionError extends Error {
+    readonly error: IntrospectionErrorCode;
+    readonly errorDescription: string;
+    constructor(error: IntrospectionErrorCode, errorDescription: string);
+    get statusCode(): number;
+    get wwwAuthenticate(): string | undefined;
+}
+export interface IntrospectionAccessTokenResolver {
+    findAccessToken(token: string): Promise<AccessTokenInfo | null>;
+}
+export interface IntrospectionRefreshTokenResolver {
+    resolve(token: string): Promise<RefreshTokenInfo | null>;
+}
+export interface IntrospectionRequestContext {
+    params: {
+        token?: string;
+        token_type_hint?: string;
+    };
+    authenticatedClientId: string;
+    accessTokenResolver: IntrospectionAccessTokenResolver;
+    refreshTokenResolver?: IntrospectionRefreshTokenResolver;
+}
+export type IntrospectionResponse = {
+    active: false;
+} | {
+    active: true;
+    scope?: string;
+    client_id?: string;
+    token_type?: 'Bearer' | 'refresh_token';
+    exp?: number;
+    iat?: number;
+    nbf?: number;
+    sub?: string;
+    aud?: string | string[];
+    iss?: string;
+    jti?: string;
+};
+export declare const INACTIVE_INTROSPECTION_RESPONSE: IntrospectionResponse;
+export type ResolvedIntrospectionToken = {
+    tokenType: 'access_token';
+    accessToken: AccessTokenInfo;
+} | {
+    tokenType: 'refresh_token';
+    refreshToken: RefreshTokenInfo;
+};
+export interface ResolveIntrospectionTokenOptions {
+    token: string;
+    tokenTypeHint?: string;
+    accessTokenResolver: IntrospectionAccessTokenResolver;
+    refreshTokenResolver?: IntrospectionRefreshTokenResolver;
+}
+export declare function requireIntrospectionToken(params: {
+    token?: string;
+}): string;
+export declare function requireIntrospectionClient(authenticatedClientId: string): string;
+export declare function resolveIntrospectionToken(options: ResolveIntrospectionTokenOptions): Promise<ResolvedIntrospectionToken | null>;
+export declare function isIntrospectionTokenActive(resolved: ResolvedIntrospectionToken, now?: number): boolean;
+export declare function buildIntrospectionResponse(resolved: ResolvedIntrospectionToken): IntrospectionResponse;
+export declare function handleIntrospectionRequest(ctx: IntrospectionRequestContext): Promise<IntrospectionResponse>;
+//# sourceMappingURL=introspection.d.ts.map

package/dist/introspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.d.ts","sourceRoot":"","sources":["../src/introspection.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAM3D,oBAAY,sBAAsB;IAChC,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;CACjC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAgB,KAAK,EAAE,sBAAsB,CAAC;IAC9C,SAAgB,gBAAgB,EAAE,MAAM,CAAC;gBAE7B,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM;IASnE,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,eAAe,IAAI,MAAM,GAAG,SAAS,CAKxC;CACF;AAED,MAAM,WAAW,gCAAgC;IAC/C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAErD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,gCAAgC,CAAC;IACtD,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;CAC1D;AAMD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IACE,MAAM,EAAE,IAAI,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAMN,eAAO,MAAM,+BAA+B,EAAE,qBAAyC,CAAC;AAQxF,MAAM,MAAM,0BAA0B,GAClC;IAAE,SAAS,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,eAAe,CAAA;CAAE,GAC3D;IAAE,SAAS,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,CAAC;IAEd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,gCAAgC,CAAC;IACtD,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;CAC1D;AA2DD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQ5E;AAUD,wBAAgB,0BAA0B,CAAC,qBAAqB,EAAE,MAAM,GAAG,MAAM,CAQhF;AAWD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAmB5C;AAYD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,0BAA0B,EACpC,GAAG,GAAE,MAAsC,GAC1C,OAAO,CAIT;AAQD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,0BAA0B,GACnC,qBAAqB,CAIvB;AAkBD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,2BAA2B,GAC/B,OAAO,CAAC,qBAAqB,CAAC,CAkBhC"}

package/dist/introspection.js

@@ -0,0 +1,139 @@
+import { sanitizeErrorDescription } from './error-utils.js';
+export var IntrospectionErrorCode;
+(function (IntrospectionErrorCode) {
+    IntrospectionErrorCode["InvalidRequest"] = "invalid_request";
+    IntrospectionErrorCode["InvalidClient"] = "invalid_client";
+})(IntrospectionErrorCode || (IntrospectionErrorCode = {}));
+export class IntrospectionError extends Error {
+    error;
+    errorDescription;
+    constructor(error, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'IntrospectionError';
+        this.error = error;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return this.error === IntrospectionErrorCode.InvalidClient ? 401 : 400;
+    }
+    get wwwAuthenticate() {
+        if (this.error === IntrospectionErrorCode.InvalidClient) {
+            return 'Basic realm="Client Authentication"';
+        }
+        return undefined;
+    }
+}
+export const INACTIVE_INTROSPECTION_RESPONSE = { active: false };
+const INACTIVE = INACTIVE_INTROSPECTION_RESPONSE;
+function isAccessTokenActive(info, now) {
+    if (info.expiresAt <= now)
+        return false;
+    if (info.nbf !== undefined && info.nbf > now)
+        return false;
+    return true;
+}
+function isRefreshTokenActive(info, now) {
+    if (info.used)
+        return false;
+    if (info.expiresAt <= now)
+        return false;
+    return true;
+}
+function buildAccessTokenResponse(info) {
+    const res = {
+        active: true,
+        scope: info.scope.join(' '),
+        client_id: info.clientId,
+        token_type: 'Bearer',
+        sub: info.sub,
+        exp: info.expiresAt,
+    };
+    if (info.iat !== undefined)
+        res.iat = info.iat;
+    if (info.nbf !== undefined)
+        res.nbf = info.nbf;
+    if (info.audience !== undefined && info.audience.length > 0) {
+        res.aud = info.audience;
+    }
+    if (info.issuer !== undefined)
+        res.iss = info.issuer;
+    if (info.jti !== undefined)
+        res.jti = info.jti;
+    return res;
+}
+function buildRefreshTokenResponse(info) {
+    const res = {
+        active: true,
+        scope: info.scope.join(' '),
+        client_id: info.clientId,
+        token_type: 'refresh_token',
+        sub: info.subject,
+        exp: info.expiresAt,
+    };
+    if (info.iat !== undefined)
+        res.iat = info.iat;
+    if (info.issuer !== undefined)
+        res.iss = info.issuer;
+    return res;
+}
+export function requireIntrospectionToken(params) {
+    if (!params.token) {
+        throw new IntrospectionError(IntrospectionErrorCode.InvalidRequest, 'Missing required parameter: token');
+    }
+    return params.token;
+}
+export function requireIntrospectionClient(authenticatedClientId) {
+    if (!authenticatedClientId) {
+        throw new IntrospectionError(IntrospectionErrorCode.InvalidClient, 'Client authentication required');
+    }
+    return authenticatedClientId;
+}
+export async function resolveIntrospectionToken(options) {
+    const { token, tokenTypeHint, accessTokenResolver, refreshTokenResolver } = options;
+    const refreshFirst = tokenTypeHint === 'refresh_token';
+    if (refreshFirst && refreshTokenResolver) {
+        const rt = await refreshTokenResolver.resolve(token);
+        if (rt)
+            return { tokenType: 'refresh_token', refreshToken: rt };
+        const at = await accessTokenResolver.findAccessToken(token);
+        if (at)
+            return { tokenType: 'access_token', accessToken: at };
+        return null;
+    }
+    const at = await accessTokenResolver.findAccessToken(token);
+    if (at)
+        return { tokenType: 'access_token', accessToken: at };
+    if (refreshTokenResolver) {
+        const rt = await refreshTokenResolver.resolve(token);
+        if (rt)
+            return { tokenType: 'refresh_token', refreshToken: rt };
+    }
+    return null;
+}
+export function isIntrospectionTokenActive(resolved, now = Math.floor(Date.now() / 1000)) {
+    return resolved.tokenType === 'access_token'
+        ? isAccessTokenActive(resolved.accessToken, now)
+        : isRefreshTokenActive(resolved.refreshToken, now);
+}
+export function buildIntrospectionResponse(resolved) {
+    return resolved.tokenType === 'access_token'
+        ? buildAccessTokenResponse(resolved.accessToken)
+        : buildRefreshTokenResponse(resolved.refreshToken);
+}
+export async function handleIntrospectionRequest(ctx) {
+    const { params, authenticatedClientId, accessTokenResolver, refreshTokenResolver } = ctx;
+    const token = requireIntrospectionToken(params);
+    requireIntrospectionClient(authenticatedClientId);
+    const resolved = await resolveIntrospectionToken({
+        token,
+        tokenTypeHint: params.token_type_hint,
+        accessTokenResolver,
+        refreshTokenResolver,
+    });
+    if (resolved === null || !isIntrospectionTokenActive(resolved)) {
+        return INACTIVE;
+    }
+    return buildIntrospectionResponse(resolved);
+}
+//# sourceMappingURL=introspection.js.map

package/dist/introspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.js","sourceRoot":"","sources":["../src/introspection.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAK5D,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,4DAAkC,CAAA;IAClC,0DAAgC,CAAA;AAClC,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3B,KAAK,CAAyB;IAC9B,gBAAgB,CAAS;IAEzC,YAAY,KAA6B,EAAE,gBAAwB;QAEjE,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,KAAK,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACzE,CAAC;IAED,IAAI,eAAe;QACjB,IAAI,IAAI,CAAC,KAAK,KAAK,sBAAsB,CAAC,aAAa,EAAE,CAAC;YACxD,OAAO,qCAAqC,CAAC;QAC/C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA0CD,MAAM,CAAC,MAAM,+BAA+B,GAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAExF,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAkBjD,SAAS,mBAAmB,CAAC,IAAqB,EAAE,GAAW;IAC7D,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAIxC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAsB,EAAE,GAAW;IAC/D,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAqB;IACrD,MAAM,GAAG,GAAqD;QAC5D,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,UAAU,EAAE,QAAQ;QACpB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,SAAS;KACpB,CAAC;IACF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAE/C,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAC/C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACrD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAsB;IACvD,MAAM,GAAG,GAAqD;QAC5D,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,UAAU,EAAE,eAAe;QAC3B,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,SAAS;KACpB,CAAC;IACF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,MAAM,UAAU,yBAAyB,CAAC,MAA0B;IAClE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,cAAc,EACrC,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAUD,MAAM,UAAU,0BAA0B,CAAC,qBAA6B;IACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,CAAC,aAAa,EACpC,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAyC;IAEzC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC;IACpF,MAAM,YAAY,GAAG,aAAa,KAAK,eAAe,CAAC;IAEvD,IAAI,YAAY,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC9D,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,MAAM,UAAU,0BAA0B,CACxC,QAAoC,EACpC,MAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAE3C,OAAO,QAAQ,CAAC,SAAS,KAAK,cAAc;QAC1C,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;QAChD,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAQD,MAAM,UAAU,0BAA0B,CACxC,QAAoC;IAEpC,OAAO,QAAQ,CAAC,SAAS,KAAK,cAAc;QAC1C,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,GAAG,CAAC;IAEzF,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChD,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;QAC/C,KAAK;QACL,aAAa,EAAE,MAAM,CAAC,eAAe;QACrC,mBAAmB;QACnB,oBAAoB;KACrB,CAAC,CAAC;IAEH,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,0BAA0B,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC"}

package/dist/jwks.d.ts

@@ -0,0 +1,29 @@
+import type { SigningKey } from './signing-key.js';
+export interface Jwk {
+    kty: string;
+    use: string;
+    alg: string;
+    kid?: string;
+    n?: string;
+    e?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+    d?: undefined;
+    p?: undefined;
+    q?: undefined;
+    dp?: undefined;
+    dq?: undefined;
+    qi?: undefined;
+}
+export interface JwkSet {
+    keys: Jwk[];
+}
+export interface JwksKeyEntry {
+    publicKey: CryptoKey;
+    keyId?: string;
+}
+export declare function exportPublicJwk(key: CryptoKey, keyId?: string): Promise<Jwk>;
+export declare function exportJwks(keys: JwksKeyEntry[]): Promise<JwkSet>;
+export declare function signingKeysToJwkSet(keys: SigningKey[]): Promise<JwkSet>;
+//# sourceMappingURL=jwks.d.ts.map

package/dist/jwks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IAEX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IAEX,CAAC,CAAC,EAAE,SAAS,CAAC;IACd,CAAC,CAAC,EAAE,SAAS,CAAC;IACd,CAAC,CAAC,EAAE,SAAS,CAAC;IACd,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,EAAE,CAAC,EAAE,SAAS,CAAC;CAChB;AAKD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AAKD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAcD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAyBlF;AAUD,wBAAsB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtE;AAgBD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB7E"}

package/dist/jwks.js

@@ -0,0 +1,36 @@
+import { getJwaAlgorithm, extractAlgorithmParamsFromJwk } from './crypto-utils.js';
+export async function exportPublicJwk(key, keyId) {
+    const alg = getJwaAlgorithm(key);
+    const exported = await crypto.subtle.exportKey('jwk', key);
+    const jwk = {
+        kty: exported.kty,
+        use: 'sig',
+        alg,
+    };
+    if (keyId) {
+        jwk.kid = keyId;
+    }
+    if (exported.kty === 'RSA') {
+        jwk.n = exported.n;
+        jwk.e = exported.e;
+    }
+    else if (exported.kty === 'EC') {
+        jwk.crv = exported.crv;
+        jwk.x = exported.x;
+        jwk.y = exported.y;
+    }
+    return jwk;
+}
+export async function exportJwks(keys) {
+    const jwks = await Promise.all(keys.map((entry) => exportPublicJwk(entry.publicKey, entry.keyId)));
+    return { keys: jwks };
+}
+export async function signingKeysToJwkSet(keys) {
+    const jwks = await Promise.all(keys.map(async (key) => {
+        const algParams = extractAlgorithmParamsFromJwk(key.publicJwk);
+        const publicKey = await crypto.subtle.importKey('jwk', key.publicJwk, algParams, true, ['verify']);
+        return exportPublicJwk(publicKey, key.keyId);
+    }));
+    return { keys: jwks };
+}
+//# sourceMappingURL=jwks.js.map

package/dist/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAsDnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc,EAAE,KAAc;IAClE,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE3D,MAAM,GAAG,GAAQ;QACf,GAAG,EAAE,QAAQ,CAAC,GAAI;QAClB,GAAG,EAAE,KAAK;QACV,GAAG;KACJ,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC3B,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;QACnB,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QACvB,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;QACnB,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CACnE,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAkB;IAC1D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,6BAA6B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAAG,CAAC,SAAS,EACb,SAAS,EACT,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/loopback.d.ts

@@ -0,0 +1,2 @@
+export declare function isLoopbackHostname(hostname: string): boolean;
+//# sourceMappingURL=loopback.d.ts.map

package/dist/loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../src/loopback.ts"],"names":[],"mappings":"AAOA,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM5D"}

package/dist/loopback.js

@@ -0,0 +1,6 @@
+export function isLoopbackHostname(hostname) {
+    return (hostname === 'localhost' ||
+        hostname === '[::1]' ||
+        /^127(?:\.\d{1,3}){3}$/.test(hostname));
+}
+//# sourceMappingURL=loopback.js.map

package/dist/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../src/loopback.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvC,CAAC;AACJ,CAAC"}

package/dist/refresh-token-grant.d.ts

@@ -0,0 +1,14 @@
+import type { RefreshTokenInfo, RefreshTokenResolver, TokenRequestContext, TokenRequestParams, ValidatedRefreshTokenRequest } from './token-request.js';
+export interface ResolvedRefreshToken {
+    refreshToken: string;
+    refreshTokenInfo: RefreshTokenInfo;
+}
+export declare function resolveRefreshToken(params: TokenRequestParams, refreshTokenResolver: RefreshTokenResolver | undefined): Promise<ResolvedRefreshToken>;
+export declare function validateRefreshTokenUnused(refreshTokenInfo: RefreshTokenInfo, refreshTokenResolver: RefreshTokenResolver): Promise<void>;
+export declare function validateRefreshTokenClient(refreshTokenInfo: RefreshTokenInfo, authenticatedClientId: string): void;
+export declare function validateRefreshTokenExpiration(refreshTokenInfo: RefreshTokenInfo, currentTime?: number): void;
+export declare function validateRefreshTokenIdleTimeout(refreshTokenInfo: RefreshTokenInfo, idleTimeoutSeconds: number | undefined, currentTime?: number): void;
+export declare function validateRefreshTokenScope(requestedScope: string | undefined, originalScope: string[]): string[];
+export declare function buildValidatedRefreshTokenRequest(refreshTokenInfo: RefreshTokenInfo, authenticatedClientId: string, effectiveScope: string[]): ValidatedRefreshTokenRequest;
+export declare function validateRefreshTokenGrant(context: TokenRequestContext): Promise<ValidatedRefreshTokenRequest>;
+//# sourceMappingURL=refresh-token-grant.d.ts.map

package/dist/refresh-token-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token-grant.d.ts","sourceRoot":"","sources":["../src/refresh-token-grant.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,EAC7B,MAAM,oBAAoB,CAAC;AAK5B,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,gBAAgB,CAAC;CACpC;AAKD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,GACrD,OAAO,CAAC,oBAAoB,CAAC,CAyB/B;AAQD,wBAAsB,0BAA0B,CAC9C,gBAAgB,EAAE,gBAAgB,EAClC,oBAAoB,EAAE,oBAAoB,GACzC,OAAO,CAAC,IAAI,CAAC,CAYf;AAKD,wBAAgB,0BAA0B,CACxC,gBAAgB,EAAE,gBAAgB,EAClC,qBAAqB,EAAE,MAAM,GAC5B,IAAI,CAON;AAOD,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,GAAE,MAAsC,GAClD,IAAI,CAON;AAQD,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,gBAAgB,EAClC,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,WAAW,GAAE,MAAsC,GAClD,IAAI,CAYN;AAQD,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,aAAa,EAAE,MAAM,EAAE,GACtB,MAAM,EAAE,CA0BV;AAKD,wBAAgB,iCAAiC,CAC/C,gBAAgB,EAAE,gBAAgB,EAClC,qBAAqB,EAAE,MAAM,EAC7B,cAAc,EAAE,MAAM,EAAE,GACvB,4BAA4B,CAkB9B;AAsBD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,4BAA4B,CAAC,CA+BvC"}