@maronn-openid-connect/core 0.0.1

package/dist/refresh-token-grant.js

@@ -0,0 +1,87 @@
+import { TokenError, TokenErrorCode } from './token-error.js';
+export async function resolveRefreshToken(params, refreshTokenResolver) {
+    const refreshToken = params.refresh_token;
+    if (!refreshToken) {
+        throw new TokenError(TokenErrorCode.InvalidRequest, 'Missing required parameter: refresh_token');
+    }
+    if (!refreshTokenResolver) {
+        throw new TokenError(TokenErrorCode.InvalidRequest, 'Refresh token resolver not provided');
+    }
+    const refreshTokenInfo = await refreshTokenResolver.resolve(refreshToken);
+    if (!refreshTokenInfo) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Refresh token not found');
+    }
+    return { refreshToken, refreshTokenInfo };
+}
+export async function validateRefreshTokenUnused(refreshTokenInfo, refreshTokenResolver) {
+    if (!refreshTokenInfo.used) {
+        return;
+    }
+    if (refreshTokenResolver.revokeTokensByGrantId) {
+        await refreshTokenResolver.revokeTokensByGrantId(refreshTokenInfo.grantId);
+    }
+    throw new TokenError(TokenErrorCode.InvalidGrant, 'Refresh token has already been used');
+}
+export function validateRefreshTokenClient(refreshTokenInfo, authenticatedClientId) {
+    if (refreshTokenInfo.clientId !== authenticatedClientId) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Refresh token was issued to a different client');
+    }
+}
+export function validateRefreshTokenExpiration(refreshTokenInfo, currentTime = Math.floor(Date.now() / 1000)) {
+    if (refreshTokenInfo.expiresAt <= currentTime) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Refresh token has expired');
+    }
+}
+export function validateRefreshTokenIdleTimeout(refreshTokenInfo, idleTimeoutSeconds, currentTime = Math.floor(Date.now() / 1000)) {
+    if (idleTimeoutSeconds !== undefined &&
+        idleTimeoutSeconds > 0 &&
+        refreshTokenInfo.lastUsedAt !== undefined &&
+        currentTime - refreshTokenInfo.lastUsedAt > idleTimeoutSeconds) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Refresh token expired due to inactivity');
+    }
+}
+export function validateRefreshTokenScope(requestedScope, originalScope) {
+    if (requestedScope === undefined) {
+        return originalScope;
+    }
+    const requestedScopes = requestedScope.split(' ').filter((scope) => scope.length > 0);
+    if (requestedScopes.length === 0) {
+        throw new TokenError(TokenErrorCode.InvalidScope, 'Requested scope must not be empty');
+    }
+    const uniqueRequestedScopes = [...new Set(requestedScopes)];
+    const originalScopeSet = new Set(originalScope);
+    const invalidScopes = uniqueRequestedScopes.filter((scope) => !originalScopeSet.has(scope));
+    if (invalidScopes.length > 0) {
+        throw new TokenError(TokenErrorCode.InvalidScope, `Requested scope exceeds original grant: ${invalidScopes.join(' ')}`);
+    }
+    return uniqueRequestedScopes;
+}
+export function buildValidatedRefreshTokenRequest(refreshTokenInfo, authenticatedClientId, effectiveScope) {
+    return {
+        grantType: 'refresh_token',
+        clientId: authenticatedClientId,
+        subject: refreshTokenInfo.subject,
+        scope: effectiveScope,
+        grantId: refreshTokenInfo.grantId,
+        audience: refreshTokenInfo.audience,
+        authTime: refreshTokenInfo.authTime,
+        nonce: refreshTokenInfo.nonce,
+        acr: refreshTokenInfo.acr,
+        amr: refreshTokenInfo.amr,
+        azp: refreshTokenInfo.azp,
+        originalIssuedAt: refreshTokenInfo.originalIssuedAt,
+        hadOfflineAccess: refreshTokenInfo.scope.includes('offline_access'),
+    };
+}
+export async function validateRefreshTokenGrant(context) {
+    const { params, authenticatedClientId, refreshTokenResolver, refreshTokenIdleTimeoutSeconds, } = context;
+    const { refreshTokenInfo } = await resolveRefreshToken(params, refreshTokenResolver);
+    const resolver = refreshTokenResolver;
+    await validateRefreshTokenUnused(refreshTokenInfo, resolver);
+    validateRefreshTokenClient(refreshTokenInfo, authenticatedClientId);
+    validateRefreshTokenExpiration(refreshTokenInfo);
+    validateRefreshTokenIdleTimeout(refreshTokenInfo, refreshTokenIdleTimeoutSeconds);
+    const effectiveScope = validateRefreshTokenScope(params.scope, refreshTokenInfo.scope);
+    return buildValidatedRefreshTokenRequest(refreshTokenInfo, authenticatedClientId, effectiveScope);
+}
+//# sourceMappingURL=refresh-token-grant.js.map

package/dist/refresh-token-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token-grant.js","sourceRoot":"","sources":["../src/refresh-token-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAoB9D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA0B,EAC1B,oBAAsD;IAEtD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,cAAc,EAC7B,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,cAAc,EAC7B,qCAAqC,CACtC,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAC5C,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,gBAAkC,EAClC,oBAA0C;IAE1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,CAAC;QAC/C,MAAM,oBAAoB,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,qCAAqC,CACtC,CAAC;AACJ,CAAC;AAKD,MAAM,UAAU,0BAA0B,CACxC,gBAAkC,EAClC,qBAA6B;IAE7B,IAAI,gBAAgB,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QACxD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,gDAAgD,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,8BAA8B,CAC5C,gBAAkC,EAClC,cAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnD,IAAI,gBAAgB,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,2BAA2B,CAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,+BAA+B,CAC7C,gBAAkC,EAClC,kBAAsC,EACtC,cAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnD,IACE,kBAAkB,KAAK,SAAS;QAChC,kBAAkB,GAAG,CAAC;QACtB,gBAAgB,CAAC,UAAU,KAAK,SAAS;QACzC,WAAW,GAAG,gBAAgB,CAAC,UAAU,GAAG,kBAAkB,EAC9D,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,yCAAyC,CAC1C,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,yBAAyB,CACvC,cAAkC,EAClC,aAAuB;IAEvB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,eAAe,GACnB,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,mCAAmC,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,aAAa,GACjB,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,2CAA2C,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAKD,MAAM,UAAU,iCAAiC,CAC/C,gBAAkC,EAClC,qBAA6B,EAC7B,cAAwB;IAExB,OAAO;QACL,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,gBAAgB,CAAC,OAAO;QACjC,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,gBAAgB,CAAC,OAAO;QACjC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;QACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;QACnC,KAAK,EAAE,gBAAgB,CAAC,KAAK;QAC7B,GAAG,EAAE,gBAAgB,CAAC,GAAG;QACzB,GAAG,EAAE,gBAAgB,CAAC,GAAG;QACzB,GAAG,EAAE,gBAAgB,CAAC,GAAG;QAEzB,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;QAEnD,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KACpE,CAAC;AACJ,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA4B;IAE5B,MAAM,EACJ,MAAM,EACN,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,GAC/B,GAAG,OAAO,CAAC;IACZ,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,mBAAmB,CACpD,MAAM,EACN,oBAAoB,CACrB,CAAC;IAGF,MAAM,QAAQ,GAAG,oBAA4C,CAAC;IAC9D,MAAM,0BAA0B,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC7D,0BAA0B,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IACpE,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IACjD,+BAA+B,CAC7B,gBAAgB,EAChB,8BAA8B,CAC/B,CAAC;IACF,MAAM,cAAc,GAAG,yBAAyB,CAC9C,MAAM,CAAC,KAAK,EACZ,gBAAgB,CAAC,KAAK,CACvB,CAAC;IAEF,OAAO,iCAAiC,CACtC,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,CACf,CAAC;AACJ,CAAC"}

package/dist/request-object.d.ts

@@ -0,0 +1,11 @@
+import type { JwkSet } from './jwks.js';
+export declare class RequestObjectError extends Error {
+    constructor(message: string);
+}
+export interface ParseRequestObjectOptions {
+    jwks?: JwkSet;
+    supportedSigningAlgs: string[];
+    allowUnsigned: boolean;
+}
+export declare function parseRequestObject(request: string, options: ParseRequestObjectOptions): Promise<Record<string, unknown>>;
+//# sourceMappingURL=request-object.d.ts.map

package/dist/request-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-object.d.ts","sourceRoot":"","sources":["../src/request-object.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAO,MAAM,EAAE,MAAM,WAAW,CAAC;AAQ7C,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAKD,MAAM,WAAW,yBAAyB;IAKxC,IAAI,CAAC,EAAE,MAAM,CAAC;IAId,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAO/B,aAAa,EAAE,OAAO,CAAC;CACxB;AAkBD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8FlC"}

package/dist/request-object.js

@@ -0,0 +1,92 @@
+import { verify, base64UrlToArrayBuffer, extractAlgorithmParamsFromJwk } from './crypto-utils.js';
+export class RequestObjectError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RequestObjectError';
+    }
+}
+function decodeJwtSegment(segment) {
+    const json = new TextDecoder().decode(base64UrlToArrayBuffer(segment));
+    return JSON.parse(json);
+}
+export async function parseRequestObject(request, options) {
+    if (typeof request !== 'string' || request.length === 0) {
+        throw new RequestObjectError('request object is empty');
+    }
+    const parts = request.split('.');
+    if (parts.length !== 3) {
+        throw new RequestObjectError('request object is not a JWS compact serialization');
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    let header;
+    try {
+        const decoded = decodeJwtSegment(headerB64);
+        if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {
+            throw new Error('header is not a JSON object');
+        }
+        header = decoded;
+    }
+    catch {
+        throw new RequestObjectError('request object header is not valid base64url JSON');
+    }
+    let payload;
+    try {
+        payload = decodeJwtSegment(payloadB64);
+    }
+    catch {
+        throw new RequestObjectError('request object payload is not valid base64url JSON');
+    }
+    if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
+        throw new RequestObjectError('request object payload is not a JSON object');
+    }
+    const alg = typeof header['alg'] === 'string' ? header['alg'] : undefined;
+    if (!alg) {
+        throw new RequestObjectError('request object header is missing alg');
+    }
+    if (alg === 'none') {
+        if (!options.allowUnsigned) {
+            throw new RequestObjectError('unsigned request object (alg=none) is not supported');
+        }
+        if (signatureB64 !== '') {
+            throw new RequestObjectError('unsigned request object must not carry a signature');
+        }
+        return payload;
+    }
+    if (!options.supportedSigningAlgs.includes(alg)) {
+        throw new RequestObjectError(`unsupported request object signing alg: ${alg}`);
+    }
+    const jwks = options.jwks;
+    if (!jwks || jwks.keys.length === 0) {
+        throw new RequestObjectError('no JWKS registered to verify the request object signature');
+    }
+    const kid = typeof header['kid'] === 'string' ? header['kid'] : undefined;
+    const candidates = kid
+        ? jwks.keys.filter((k) => k.kid === kid)
+        : jwks.keys.slice();
+    if (candidates.length === 0) {
+        throw new RequestObjectError('no JWK matched the request object header (kid)');
+    }
+    const signingInput = `${headerB64}.${payloadB64}`;
+    for (const jwk of candidates) {
+        if (jwk.alg && jwk.alg !== alg) {
+            continue;
+        }
+        let publicKey;
+        try {
+            const algParams = extractAlgorithmParamsFromJwk(jwk);
+            publicKey = await crypto.subtle.importKey('jwk', jwk, algParams, false, ['verify']);
+        }
+        catch {
+            continue;
+        }
+        try {
+            if (await verify(signingInput, signatureB64, publicKey)) {
+                return payload;
+            }
+        }
+        catch {
+        }
+    }
+    throw new RequestObjectError('request object signature verification failed');
+}
+//# sourceMappingURL=request-object.js.map

package/dist/request-object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-object.js","sourceRoot":"","sources":["../src/request-object.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AASlG,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAwBD,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,OAAkC;IAElC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAGjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAC1B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAC;IAEhF,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,OAAkC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,mDAAmD,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,oDAAoD,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,KAAK,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,kBAAkB,CAAC,oDAAoD,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC,2DAA2D,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,KAAK,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAGtF,MAAM,UAAU,GAAU,GAAG;QAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAEtB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,SAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;YACrD,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAkC,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IAED,MAAM,IAAI,kBAAkB,CAAC,8CAA8C,CAAC,CAAC;AAC/E,CAAC"}

package/dist/revocation.d.ts

@@ -0,0 +1,51 @@
+import type { AccessTokenInfo } from './userinfo.js';
+import type { RefreshTokenInfo } from './token-request.js';
+export declare enum RevocationErrorCode {
+    InvalidRequest = "invalid_request",
+    InvalidClient = "invalid_client",
+    InvalidGrant = "invalid_grant"
+}
+export declare class RevocationError extends Error {
+    readonly error: RevocationErrorCode;
+    readonly errorDescription: string;
+    constructor(error: RevocationErrorCode, errorDescription: string);
+    get statusCode(): number;
+    get wwwAuthenticate(): string | undefined;
+}
+export interface RevocationTokenResolvers {
+    findAccessToken(token: string): Promise<AccessTokenInfo | null>;
+    revokeAccessToken(token: string): Promise<void>;
+    findRefreshToken?(token: string): Promise<RefreshTokenInfo | null>;
+    revokeRefreshToken?(token: string): Promise<void>;
+    revokeAccessTokensByGrantId?(grantId: string): Promise<void>;
+}
+export interface RevocationRequestContext {
+    params: {
+        token?: string;
+        token_type_hint?: string;
+    };
+    authenticatedClientId: string;
+    resolvers: RevocationTokenResolvers;
+}
+export type ResolvedRevocationToken = {
+    tokenType: 'access_token';
+    accessToken: AccessTokenInfo;
+} | {
+    tokenType: 'refresh_token';
+    refreshToken: RefreshTokenInfo;
+};
+export interface ResolveRevocationTargetOptions {
+    token: string;
+    tokenTypeHint?: string;
+    resolvers: RevocationTokenResolvers;
+}
+export declare function requireRevocationToken(params: {
+    token?: string;
+}): string;
+export declare function requireRevocationClient(authenticatedClientId: string): string;
+export declare function resolveRevocationTarget(options: ResolveRevocationTargetOptions): Promise<ResolvedRevocationToken | null>;
+export declare function validateRevocationTokenClient(resolved: ResolvedRevocationToken, authenticatedClientId: string): void;
+export declare function revokeResolvedToken(token: string, resolved: ResolvedRevocationToken, resolvers: RevocationTokenResolvers): Promise<void>;
+export declare function revokeGrantAccessTokens(resolved: ResolvedRevocationToken, resolvers: RevocationTokenResolvers): Promise<void>;
+export declare function handleRevocationRequest(ctx: RevocationRequestContext): Promise<void>;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,oBAAY,mBAAmB;IAC7B,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAEhC,YAAY,kBAAkB;CAC/B;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAgB,KAAK,EAAE,mBAAmB,CAAC;IAC3C,SAAgB,gBAAgB,EAAE,MAAM,CAAC;gBAE7B,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM;IAShE,IAAI,UAAU,IAAI,MAAM,CAEvB;IAGD,IAAI,eAAe,IAAI,MAAM,GAAG,SAAS,CAKxC;CACF;AAED,MAAM,WAAW,wBAAwB;IACvC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAChE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,gBAAgB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAKlD,2BAA2B,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAMD,MAAM,MAAM,uBAAuB,GAC/B;IAAE,SAAS,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,eAAe,CAAA;CAAE,GAC3D;IAAE,SAAS,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IAEd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAQD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQzE;AAQD,wBAAgB,uBAAuB,CAAC,qBAAqB,EAAE,MAAM,GAAG,MAAM,CAQ7E;AAcD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAqBzC;AAWD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,uBAAuB,EACjC,qBAAqB,EAAE,MAAM,GAC5B,IAAI,CAYN;AASD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,uBAAuB,EACjC,SAAS,EAAE,wBAAwB,GAClC,OAAO,CAAC,IAAI,CAAC,CAMf;AAWD,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,uBAAuB,EACjC,SAAS,EAAE,wBAAwB,GAClC,OAAO,CAAC,IAAI,CAAC,CAGf;AAeD,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/revocation.js

@@ -0,0 +1,93 @@
+import { sanitizeErrorDescription } from './error-utils.js';
+export var RevocationErrorCode;
+(function (RevocationErrorCode) {
+    RevocationErrorCode["InvalidRequest"] = "invalid_request";
+    RevocationErrorCode["InvalidClient"] = "invalid_client";
+    RevocationErrorCode["InvalidGrant"] = "invalid_grant";
+})(RevocationErrorCode || (RevocationErrorCode = {}));
+export class RevocationError extends Error {
+    error;
+    errorDescription;
+    constructor(error, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'RevocationError';
+        this.error = error;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return this.error === RevocationErrorCode.InvalidClient ? 401 : 400;
+    }
+    get wwwAuthenticate() {
+        if (this.error === RevocationErrorCode.InvalidClient) {
+            return 'Basic realm="Client Authentication"';
+        }
+        return undefined;
+    }
+}
+export function requireRevocationToken(params) {
+    if (!params.token) {
+        throw new RevocationError(RevocationErrorCode.InvalidRequest, 'Missing required parameter: token');
+    }
+    return params.token;
+}
+export function requireRevocationClient(authenticatedClientId) {
+    if (!authenticatedClientId) {
+        throw new RevocationError(RevocationErrorCode.InvalidClient, 'Client authentication required');
+    }
+    return authenticatedClientId;
+}
+export async function resolveRevocationTarget(options) {
+    const { token, tokenTypeHint, resolvers } = options;
+    const findRefresh = resolvers.findRefreshToken;
+    const canRevokeRefresh = findRefresh !== undefined && resolvers.revokeRefreshToken !== undefined;
+    const resolveAccess = async () => {
+        const info = await resolvers.findAccessToken(token);
+        return info ? { tokenType: 'access_token', accessToken: info } : null;
+    };
+    const resolveRefresh = async () => {
+        if (!canRevokeRefresh || !findRefresh)
+            return null;
+        const info = await findRefresh(token);
+        return info ? { tokenType: 'refresh_token', refreshToken: info } : null;
+    };
+    if (tokenTypeHint === 'refresh_token') {
+        return (await resolveRefresh()) ?? (await resolveAccess());
+    }
+    return (await resolveAccess()) ?? (await resolveRefresh());
+}
+export function validateRevocationTokenClient(resolved, authenticatedClientId) {
+    const clientId = resolved.tokenType === 'access_token'
+        ? resolved.accessToken.clientId
+        : resolved.refreshToken.clientId;
+    if (clientId !== authenticatedClientId) {
+        throw new RevocationError(RevocationErrorCode.InvalidGrant, 'Token was not issued to the requesting client');
+    }
+}
+export async function revokeResolvedToken(token, resolved, resolvers) {
+    if (resolved.tokenType === 'access_token') {
+        await resolvers.revokeAccessToken(token);
+        return;
+    }
+    await resolvers.revokeRefreshToken?.(token);
+}
+export async function revokeGrantAccessTokens(resolved, resolvers) {
+    if (resolved.tokenType !== 'refresh_token')
+        return;
+    await resolvers.revokeAccessTokensByGrantId?.(resolved.refreshToken.grantId);
+}
+export async function handleRevocationRequest(ctx) {
+    const token = requireRevocationToken(ctx.params);
+    requireRevocationClient(ctx.authenticatedClientId);
+    const resolved = await resolveRevocationTarget({
+        token,
+        tokenTypeHint: ctx.params.token_type_hint,
+        resolvers: ctx.resolvers,
+    });
+    if (resolved === null)
+        return;
+    validateRevocationTokenClient(resolved, ctx.authenticatedClientId);
+    await revokeResolvedToken(token, resolved, ctx.resolvers);
+    await revokeGrantAccessTokens(resolved, ctx.resolvers);
+}
+//# sourceMappingURL=revocation.js.map

package/dist/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,yDAAkC,CAAA;IAClC,uDAAgC,CAAA;IAEhC,qDAA8B,CAAA;AAChC,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxB,KAAK,CAAsB;IAC3B,gBAAgB,CAAS;IAEzC,YAAY,KAA0B,EAAE,gBAAwB;QAE9D,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,CAAC;IAGD,IAAI,eAAe;QACjB,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,aAAa,EAAE,CAAC;YACrD,OAAO,qCAAqC,CAAC;QAC/C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAyCD,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CACvB,mBAAmB,CAAC,cAAc,EAClC,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAQD,MAAM,UAAU,uBAAuB,CAAC,qBAA6B;IACnE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CACvB,mBAAmB,CAAC,aAAa,EACjC,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuC;IAEvC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEpD,MAAM,WAAW,GAAG,SAAS,CAAC,gBAAgB,CAAC;IAC/C,MAAM,gBAAgB,GAAG,WAAW,KAAK,SAAS,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,CAAC;IAEjG,MAAM,aAAa,GAAG,KAAK,IAA6C,EAAE;QACxE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,IAA6C,EAAE;QACzE,IAAI,CAAC,gBAAgB,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC,CAAC;IAEF,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,cAAc,EAAE,CAAC,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;AAC7D,CAAC;AAWD,MAAM,UAAU,6BAA6B,CAC3C,QAAiC,EACjC,qBAA6B;IAE7B,MAAM,QAAQ,GACZ,QAAQ,CAAC,SAAS,KAAK,cAAc;QACnC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ;QAC/B,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC;IAErC,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CACvB,mBAAmB,CAAC,YAAY,EAChC,+CAA+C,CAChD,CAAC;IACJ,CAAC;AACH,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,QAAiC,EACjC,SAAmC;IAEnC,IAAI,QAAQ,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QAC1C,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAiC,EACjC,SAAmC;IAEnC,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe;QAAE,OAAO;IACnD,MAAM,SAAS,CAAC,2BAA2B,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/E,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAA6B;IAE7B,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,uBAAuB,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,KAAK;QACL,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe;QACzC,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IAE9B,6BAA6B,CAAC,QAAQ,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnE,MAAM,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC"}

package/dist/signing-key.d.ts

@@ -0,0 +1,21 @@
+import type { webcrypto } from 'node:crypto';
+export interface SigningKey {
+    privateKey: CryptoKey;
+    publicJwk: webcrypto.JsonWebKey;
+    keyId: string;
+}
+export interface SigningKeyProvider {
+    getSigningKey(): Promise<SigningKey>;
+    getSigningKeys?(): Promise<SigningKey[]>;
+}
+export declare function getRegisteredSigningKeys(provider: SigningKeyProvider): Promise<SigningKey[]>;
+export declare function selectSigningKeyByAlg(keys: readonly SigningKey[], requestedAlg: string | undefined): SigningKey;
+export declare function assertHasRs256Key(keys: CryptoKey[]): void;
+export declare function assertKidStrategyConsistent(keys: readonly SigningKey[]): void;
+export interface KeyStrengthPolicy {
+    minRsaModulusBits?: number;
+    allowedCurves?: readonly string[];
+}
+export declare function assertKeyStrength(keys: readonly SigningKey[], policy?: KeyStrengthPolicy): void;
+export declare function createCachedSigningKeyProvider(base: SigningKeyProvider, ttlMs: number): SigningKeyProvider;
+//# sourceMappingURL=signing-key.d.ts.map

package/dist/signing-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-key.d.ts","sourceRoot":"","sources":["../src/signing-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;CACf;AAeD,MAAM,WAAW,kBAAkB;IACjC,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,cAAc,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CAC1C;AASD,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,UAAU,EAAE,CAAC,CAKvB;AAcD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,SAAS,UAAU,EAAE,EAC3B,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,UAAU,CAiBZ;AAWD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAazD;AAcD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,IAAI,CAc7E;AASD,MAAM,WAAW,iBAAiB;IAEhC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AA8BD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,UAAU,EAAE,EAC3B,MAAM,CAAC,EAAE,iBAAiB,GACzB,IAAI,CAmCN;AAWD,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,MAAM,GACZ,kBAAkB,CAsBpB"}

package/dist/signing-key.js

@@ -0,0 +1,99 @@
+import { getJwaAlgorithm, rsaModulusBitLength } from './crypto-utils.js';
+export async function getRegisteredSigningKeys(provider) {
+    if (provider.getSigningKeys) {
+        return provider.getSigningKeys();
+    }
+    return [await provider.getSigningKey()];
+}
+export function selectSigningKeyByAlg(keys, requestedAlg) {
+    if (keys.length === 0) {
+        throw new Error('No signing keys available');
+    }
+    const alg = requestedAlg ?? 'RS256';
+    for (let i = keys.length - 1; i >= 0; i--) {
+        const key = keys[i];
+        try {
+            if (getJwaAlgorithm(key.privateKey) === alg) {
+                return key;
+            }
+        }
+        catch {
+        }
+    }
+    throw new Error(`No signing key registered for alg "${alg}"`);
+}
+export function assertHasRs256Key(keys) {
+    for (const key of keys) {
+        try {
+            if (getJwaAlgorithm(key) === 'RS256') {
+                return;
+            }
+        }
+        catch {
+        }
+    }
+    throw new Error('OIDC Core 1.0 §15.1 violation: at least one RS256 (RSASSA-PKCS1-v1_5 with SHA-256) key is required');
+}
+export function assertKidStrategyConsistent(keys) {
+    if (keys.length <= 1)
+        return;
+    const seen = new Set();
+    for (const key of keys) {
+        if (!key.keyId) {
+            throw new Error('Multiple signing keys are published but a key has an empty kid (RFC 7517 §4.5)');
+        }
+        if (seen.has(key.keyId)) {
+            throw new Error(`Duplicate kid in signing key set: ${key.keyId} (RFC 7517 §4.5)`);
+        }
+        seen.add(key.keyId);
+    }
+}
+const DEFAULT_MIN_RSA_MODULUS_BITS = 2048;
+const DEFAULT_ALLOWED_CURVES = ['P-256', 'P-384', 'P-521'];
+export function assertKeyStrength(keys, policy) {
+    const minRsaModulusBits = policy?.minRsaModulusBits ?? DEFAULT_MIN_RSA_MODULUS_BITS;
+    const allowedCurves = policy?.allowedCurves ?? DEFAULT_ALLOWED_CURVES;
+    for (const key of keys) {
+        const jwk = key.publicJwk;
+        if (jwk.kty === 'RSA') {
+            if (!jwk.n) {
+                throw new Error(`Signing key "${key.keyId}" is an RSA key but its public JWK has no modulus (n)`);
+            }
+            const bits = rsaModulusBitLength(jwk.n);
+            if (bits < minRsaModulusBits) {
+                throw new Error(`Signing key "${key.keyId}" has a ${bits}-bit RSA modulus; minimum allowed is ${minRsaModulusBits} bits (NIST SP 800-131A Rev.2)`);
+            }
+            continue;
+        }
+        if (jwk.kty === 'EC') {
+            if (!jwk.crv || !allowedCurves.includes(jwk.crv)) {
+                throw new Error(`Signing key "${key.keyId}" uses unsupported EC curve "${jwk.crv ?? '(missing)'}"; allowed curves: ${allowedCurves.join(', ')}`);
+            }
+            continue;
+        }
+        throw new Error(`Signing key "${key.keyId}" uses unsupported key type "${jwk.kty ?? '(missing)'}"`);
+    }
+}
+export function createCachedSigningKeyProvider(base, ttlMs) {
+    let singleCache = null;
+    let multiCache = null;
+    return {
+        async getSigningKey() {
+            if (!singleCache || Date.now() > singleCache.expiresAt) {
+                const key = await base.getSigningKey();
+                singleCache = { key, expiresAt: Date.now() + ttlMs };
+            }
+            return singleCache.key;
+        },
+        async getSigningKeys() {
+            if (!multiCache || Date.now() > multiCache.expiresAt) {
+                const keys = base.getSigningKeys
+                    ? await base.getSigningKeys()
+                    : [await base.getSigningKey()];
+                multiCache = { keys, expiresAt: Date.now() + ttlMs };
+            }
+            return multiCache.keys;
+        },
+    };
+}
+//# sourceMappingURL=signing-key.js.map

package/dist/signing-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-key.js","sourceRoot":"","sources":["../src/signing-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAiCzE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAA4B;IAE5B,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,cAAc,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;AAC1C,CAAC;AAcD,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,YAAgC;IAEhC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,IAAI,OAAO,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,GAAG,CAAC,CAAC;AAChE,CAAC;AAWD,MAAM,UAAU,iBAAiB,CAAC,IAAiB;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBACrC,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;AACJ,CAAC;AAcD,MAAM,UAAU,2BAA2B,CAAC,IAA2B;IACrE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAkBD,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAE1C,MAAM,sBAAsB,GAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAwB9E,MAAM,UAAU,iBAAiB,CAC/B,IAA2B,EAC3B,MAA0B;IAE1B,MAAM,iBAAiB,GAAG,MAAM,EAAE,iBAAiB,IAAI,4BAA4B,CAAC;IACpF,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,sBAAsB,CAAC;IAEtE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC;QAE1B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,CAAC,KAAK,uDAAuD,CACjF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,CAAC,KAAK,WAAW,IAAI,wCAAwC,iBAAiB,gCAAgC,CAClI,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,CAAC,KAAK,gCAAgC,GAAG,CAAC,GAAG,IAAI,WAAW,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChI,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,CAAC,KAAK,gCAAgC,GAAG,CAAC,GAAG,IAAI,WAAW,GAAG,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,8BAA8B,CAC5C,IAAwB,EACxB,KAAa;IAEb,IAAI,WAAW,GAAkD,IAAI,CAAC;IACtE,IAAI,UAAU,GAAqD,IAAI,CAAC;IAExE,OAAO;QACL,KAAK,CAAC,aAAa;YACjB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;gBACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvC,WAAW,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc;oBAC9B,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE;oBAC7B,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;gBACjC,UAAU,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/token-error.d.ts

@@ -0,0 +1,16 @@
+export declare enum TokenErrorCode {
+    InvalidRequest = "invalid_request",
+    InvalidClient = "invalid_client",
+    InvalidGrant = "invalid_grant",
+    UnauthorizedClient = "unauthorized_client",
+    UnsupportedGrantType = "unsupported_grant_type",
+    InvalidScope = "invalid_scope"
+}
+export declare class TokenError extends Error {
+    readonly error: TokenErrorCode;
+    readonly errorDescription: string;
+    constructor(error: TokenErrorCode, errorDescription: string);
+    get statusCode(): number;
+    get wwwAuthenticate(): string | undefined;
+}
+//# sourceMappingURL=token-error.d.ts.map

package/dist/token-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-error.d.ts","sourceRoot":"","sources":["../src/token-error.ts"],"names":[],"mappings":"AAMA,oBAAY,cAAc;IACxB,cAAc,oBAAoB;IAClC,aAAa,mBAAmB;IAChC,YAAY,kBAAkB;IAC9B,kBAAkB,wBAAwB;IAC1C,oBAAoB,2BAA2B;IAC/C,YAAY,kBAAkB;CAC/B;AAKD,qBAAa,UAAW,SAAQ,KAAK;IACnC,SAAgB,KAAK,EAAE,cAAc,CAAC;IACtC,SAAgB,gBAAgB,EAAE,MAAM,CAAC;gBAE7B,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM;IAc3D,IAAI,UAAU,IAAI,MAAM,CAEvB;IAOD,IAAI,eAAe,IAAI,MAAM,GAAG,SAAS,CAKxC;CACF"}

package/dist/token-error.js

@@ -0,0 +1,31 @@
+import { sanitizeErrorDescription } from './error-utils.js';
+export var TokenErrorCode;
+(function (TokenErrorCode) {
+    TokenErrorCode["InvalidRequest"] = "invalid_request";
+    TokenErrorCode["InvalidClient"] = "invalid_client";
+    TokenErrorCode["InvalidGrant"] = "invalid_grant";
+    TokenErrorCode["UnauthorizedClient"] = "unauthorized_client";
+    TokenErrorCode["UnsupportedGrantType"] = "unsupported_grant_type";
+    TokenErrorCode["InvalidScope"] = "invalid_scope";
+})(TokenErrorCode || (TokenErrorCode = {}));
+export class TokenError extends Error {
+    error;
+    errorDescription;
+    constructor(error, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'TokenError';
+        this.error = error;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return this.error === TokenErrorCode.InvalidClient ? 401 : 400;
+    }
+    get wwwAuthenticate() {
+        if (this.error === TokenErrorCode.InvalidClient) {
+            return 'Basic realm="Client Authentication"';
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=token-error.js.map

package/dist/token-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-error.js","sourceRoot":"","sources":["../src/token-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAM5D,MAAM,CAAN,IAAY,cAOX;AAPD,WAAY,cAAc;IACxB,oDAAkC,CAAA;IAClC,kDAAgC,CAAA;IAChC,gDAA8B,CAAA;IAC9B,4DAA0C,CAAA;IAC1C,iEAA+C,CAAA;IAC/C,gDAA8B,CAAA;AAChC,CAAC,EAPW,cAAc,KAAd,cAAc,QAOzB;AAKD,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnB,KAAK,CAAiB;IACtB,gBAAgB,CAAS;IAEzC,YAAY,KAAqB,EAAE,gBAAwB;QAGzD,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAMD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjE,CAAC;IAOD,IAAI,eAAe;QACjB,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,CAAC,aAAa,EAAE,CAAC;YAChD,OAAO,qCAAqC,CAAC;QAC/C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}