@maronn-openid-connect/experimental 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 maronnjapan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,65 @@
+# @maronn-openid-connect/experimental
+
+このディレクトリは試験的に実装したもので、まだ正式にライブラリの機能として提供できていない機能をまとめたものとなります。
+
+## 位置づけ
+
+- `@maronn-openid-connect/core` とは**別 package**です。core の通常動作にこのコードが読み込まれることはありません。
+- **API は安定していません。** マイナーリリースでも破壊的に変更されることがあります。本番利用する場合はバージョンを固定してください。
+- CLI で `--enable <feature-id>` を明示したときだけ、生成コードがこの package を利用します。デフォルトでは一切参照されません。
+
+## 提供機能
+
+| feature-id | 内容 | 準拠仕様 | import 元 |
+|---|---|---|---|
+| `par` | Pushed Authorization Requests | RFC 9126 | `@maronn-openid-connect/experimental/par` |
+| `token-exchange` | OAuth 2.0 Token Exchange (impersonation) | RFC 8693 | `@maronn-openid-connect/experimental/token-exchange` |
+
+機能ごとに subpath export で提供します。ルート (`.`) からの再エクスポートは提供しません。機能間でコードを共有しないことで、昇格・削除時に他機能へ影響しない構造を保っています。
+
+```bash
+maronn-oidc generate hono --enable par
+pnpm add @maronn-openid-connect/core @maronn-openid-connect/experimental
+```
+
+```typescript
+import { handlePushedAuthorizationRequest } from '@maronn-openid-connect/experimental/par';
+```
+
+## core とのバージョン関係
+
+`@maronn-openid-connect/core` はこの package の **peerDependency** です（`dependencies` ではありません）。
+
+experimental は core のエラークラス（`AuthorizationError` / `TokenError`）を `instanceof` で判定し、resolver / store を生成コードと受け渡しします。そのためアプリ全体で core のインスタンスが 1 つである必要があります。core を `dependencies` として同梱すると、生成コードが読み込む core と experimental が読み込む core が別インスタンスになり、`instanceof` 判定が静かに false になって、本来 `invalid_request` を返すべき場面が 500 になります。peerDependency にしておくと利用者のアプリが持つ core がそのまま使われるため、この事故が起きません。
+
+**バージョン番号は揃っている必要はありません。** experimental は core より速く publish されるため、`core 0.1.0` + `experimental 0.5.0` のような組み合わせが正常な状態です。互換性の条件は peer range（`>=0.1.0 <1.0.0`）の下限を満たしていることだけで、experimental が新しい core の API を必要とし始めたときにこの下限が上がります。下限を満たしていない場合は npm ならインストールが `ERESOLVE` で失敗し、pnpm なら `✕ unmet peer @maronn-openid-connect/core` が警告されます。
+
+> **`@maronn-openid-connect/experimental@0.0.1` は `@maronn-openid-connect/core@0.0.1` と組み合わせて使えません。**
+> 0.0.1 は core のステップ関数（`extractClientCredentials` など）を import しているのに、
+> それらを export する core がまだ publish されていない状態で公開されました。この組み合わせでは
+> バンドル時に esbuild が `No matching export ... for import "extractClientCredentials"` で落ちます。
+> peer range の下限を `>=0.1.0` へ上げて組み合わせられないようにしてあるので、両方を最新へ更新してください。
+
+> リポジトリ側では、core を minor / major で上げるときに experimental も同時にリリースすること、および peer range の下限が「次に publish される core」以上であることを CI で強制しています（`.github/scripts/verify-release-contract.mjs`）。詳細は [RELEASE.md](../../RELEASE.md) の「バージョニング方針」を参照してください。
+
+## 依存方向
+
+```text
+packages/cli ────> @maronn-openid-connect/experimental（生成コードの依存として明示）
+@maronn-openid-connect/experimental ────> @maronn-openid-connect/core（許可）
+packages/core ──X──> packages/experimental（禁止）
+```
+
+## 昇格条件
+
+Experimental 機能が core へ昇格する目安は次のとおりです。
+
+1. 生成 OP の conformance テストが 2 サイクル以上安定していること
+2. resolver / store 契約への変更要望が収束していること
+3. その仕様がリポジトリのロードマップ（例: FAPI 2.0 対応）で必須になったこと
+
+昇格するとその機能は `@maronn-openid-connect/core` へ移り、この package からは削除されます。
+
+## 利用者ドキュメント
+
+`docs/library-document` の Experimental セクションを参照してください。

package/dist/par/index.d.ts

@@ -0,0 +1,4 @@
+export { ParError, assertParExpiresInSeconds, authenticateParClient, buildPushedAuthorizationResponse, createPushedAuthorizationRecord, handlePushedAuthorizationRequest, rejectForbiddenParParams, validatePushedAuthorizationParams, type ParErrorCode, type PushedAuthorizationRequestContext, type PushedAuthorizationResponse, } from './par-request.js';
+export { PushedRequestUriError, assertPushedRequestUsed, resolvePushedRequestUri, } from './resolve-request-uri.js';
+export { PAR_REQUEST_URI_PREFIX, type PushedAuthorizationRecord, type PushedAuthorizationRequestStore, } from './store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/par/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/par/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,QAAQ,EACR,yBAAyB,EACzB,qBAAqB,EACrB,gCAAgC,EAChC,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,iCAAiC,EACjC,KAAK,YAAY,EACjB,KAAK,iCAAiC,EACtC,KAAK,2BAA2B,GACjC,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,GACrC,MAAM,YAAY,CAAC"}

package/dist/par/index.js

@@ -0,0 +1,4 @@
+export { ParError, assertParExpiresInSeconds, authenticateParClient, buildPushedAuthorizationResponse, createPushedAuthorizationRecord, handlePushedAuthorizationRequest, rejectForbiddenParParams, validatePushedAuthorizationParams, } from './par-request.js';
+export { PushedRequestUriError, assertPushedRequestUsed, resolvePushedRequestUri, } from './resolve-request-uri.js';
+export { PAR_REQUEST_URI_PREFIX, } from './store.js';
+//# sourceMappingURL=index.js.map

package/dist/par/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/par/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,QAAQ,EACR,yBAAyB,EACzB,qBAAqB,EACrB,gCAAgC,EAChC,+BAA+B,EAC/B,gCAAgC,EAChC,wBAAwB,EACxB,iCAAiC,GAIlC,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,GAGvB,MAAM,YAAY,CAAC"}

package/dist/par/par-request.d.ts

@@ -0,0 +1,41 @@
+import { validateAuthorizationRequest, type ClientResolver, type TokenClientResolver, type ValidateAuthorizationRequestOptions } from '@maronn-openid-connect/core';
+import type { PushedAuthorizationRecord, PushedAuthorizationRequestStore } from './store.js';
+export type ParErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_response_type';
+export declare class ParError extends Error {
+    readonly code: ParErrorCode;
+    readonly errorDescription: string;
+    constructor(code: ParErrorCode, errorDescription: string);
+    get statusCode(): 400 | 401;
+    get wwwAuthenticate(): string | undefined;
+}
+export interface PushedAuthorizationResponse {
+    requestUri: string;
+    expiresIn: number;
+}
+export interface PushedAuthorizationRequestContext {
+    params: Record<string, string>;
+    authorizationHeader?: string;
+    clientResolver: ClientResolver & TokenClientResolver;
+    store: PushedAuthorizationRequestStore;
+    validationOptions: ValidateAuthorizationRequestOptions;
+    expiresInSeconds?: number;
+    now?: Date;
+}
+export declare function assertParExpiresInSeconds(seconds: number): void;
+export declare function rejectForbiddenParParams(params: Record<string, string>): void;
+export declare function authenticateParClient(context: {
+    params: Record<string, string>;
+    authorizationHeader?: string;
+    clientResolver: TokenClientResolver;
+}): Promise<string>;
+export declare function validatePushedAuthorizationParams(params: Record<string, string>, clientResolver: ClientResolver, options?: ValidateAuthorizationRequestOptions): Promise<Awaited<ReturnType<typeof validateAuthorizationRequest>>>;
+export declare function createPushedAuthorizationRecord(options: {
+    clientId: string;
+    params: Record<string, string>;
+    store: PushedAuthorizationRequestStore;
+    expiresInSeconds?: number;
+    now?: Date;
+}): Promise<PushedAuthorizationRecord>;
+export declare function buildPushedAuthorizationResponse(record: PushedAuthorizationRecord): PushedAuthorizationResponse;
+export declare function handlePushedAuthorizationRequest(context: PushedAuthorizationRequestContext): Promise<PushedAuthorizationResponse>;
+//# sourceMappingURL=par-request.d.ts.map

package/dist/par/par-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"par-request.d.ts","sourceRoot":"","sources":["../../src/par/par-request.ts"],"names":[],"mappings":"AAQA,OAAO,EASL,4BAA4B,EAI5B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mCAAmC,EACzC,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,YAAY,GACpB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,2BAA2B,CAAC;AAQhC,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM;IAUxD,IAAI,UAAU,IAAI,GAAG,GAAG,GAAG,CAE1B;IAGD,IAAI,eAAe,IAAI,MAAM,GAAG,SAAS,CAExC;CACF;AAGD,MAAM,WAAW,2BAA2B;IAE1C,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,iCAAiC;IAEhD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,cAAc,EAAE,cAAc,GAAG,mBAAmB,CAAC;IACrD,KAAK,EAAE,+BAA+B,CAAC;IAEvC,iBAAiB,EAAE,mCAAmC,CAAC;IAEvD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAkBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAU/D;AAUD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAa7E;AAoBD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,mBAAmB,CAAC;CACrC,GAAG,OAAO,CAAC,MAAM,CAAC,CAkClB;AAkCD,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,mCAAwC,GAChD,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAUnE;AAqBD,wBAAsB,+BAA+B,CAAC,OAAO,EAAE;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,EAAE,+BAA+B,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAmBrC;AAGD,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,yBAAyB,GAChC,2BAA2B,CAK7B;AAUD,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,2BAA2B,CAAC,CAsBtC"}

package/dist/par/par-request.js

@@ -0,0 +1,161 @@
+import { AuthorizationError, AuthorizationErrorCode, TokenError, TokenErrorCode, extractClientCredentials, generateRandomString, resolveAuthenticatedTokenClient, sanitizeErrorDescription, validateAuthorizationRequest, validateClientAuthMethod, verifyClientSecret, } from '@maronn-openid-connect/core';
+import { PAR_REQUEST_URI_PREFIX } from './store.js';
+export class ParError extends Error {
+    code;
+    errorDescription;
+    constructor(code, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'ParError';
+        this.code = code;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return this.code === 'invalid_client' ? 401 : 400;
+    }
+    get wwwAuthenticate() {
+        return this.code === 'invalid_client' ? 'Basic realm="Client Authentication"' : undefined;
+    }
+}
+const MIN_EXPIRES_IN_SECONDS = 5;
+const MAX_EXPIRES_IN_SECONDS = 600;
+const DEFAULT_EXPIRES_IN_SECONDS = 60;
+const REFERENCE_VALUE_BYTE_LENGTH = 32;
+export function assertParExpiresInSeconds(seconds) {
+    const isValid = Number.isInteger(seconds) &&
+        seconds >= MIN_EXPIRES_IN_SECONDS &&
+        seconds <= MAX_EXPIRES_IN_SECONDS;
+    if (!isValid) {
+        throw new RangeError(`expiresInSeconds must be an integer between ${MIN_EXPIRES_IN_SECONDS} and ${MAX_EXPIRES_IN_SECONDS} (RFC 9126 §2.2), received ${seconds}`);
+    }
+}
+export function rejectForbiddenParParams(params) {
+    if (params['request_uri'] !== undefined) {
+        throw new ParError('invalid_request', 'request_uri MUST NOT be included in a pushed authorization request');
+    }
+    if (params['request'] !== undefined) {
+        throw new ParError('invalid_request', 'The request parameter (Request Object) is not supported by this pushed authorization request endpoint');
+    }
+}
+export async function authenticateParClient(context) {
+    const { params, clientResolver } = context;
+    const authorizationHeader = context.authorizationHeader ?? '';
+    const usesAuthorizationHeader = authorizationHeader.trim().length > 0;
+    if (usesAuthorizationHeader && params['client_secret'] !== undefined) {
+        throw new ParError('invalid_request', 'Multiple client authentication methods provided. Use either the Authorization header or the request body, not both.');
+    }
+    const credentialParams = usesAuthorizationHeader
+        ? {}
+        : { client_id: params['client_id'], client_secret: params['client_secret'] };
+    const authenticatedClientId = await runClientAuthentication({
+        params: credentialParams,
+        authorizationHeader,
+        clientResolver,
+    });
+    const bodyClientId = params['client_id'];
+    if (bodyClientId !== undefined && bodyClientId !== authenticatedClientId) {
+        throw new ParError('invalid_request', 'client_id does not match the authenticated client');
+    }
+    return authenticatedClientId;
+}
+async function runClientAuthentication(context) {
+    try {
+        const presented = extractClientCredentials({
+            params: context.params,
+            authorizationHeader: context.authorizationHeader,
+        });
+        const client = await resolveAuthenticatedTokenClient(presented.clientId, context.clientResolver);
+        validateClientAuthMethod(client, presented);
+        await verifyClientSecret(client, presented.clientSecret);
+        return presented.clientId;
+    }
+    catch (error) {
+        throw toParError(error);
+    }
+}
+export async function validatePushedAuthorizationParams(params, clientResolver, options = {}) {
+    try {
+        return await validateAuthorizationRequest(params, clientResolver, options);
+    }
+    catch (error) {
+        throw toParError(error);
+    }
+}
+const CLIENT_AUTHENTICATION_PARAMS = ['client_secret', 'client_assertion', 'client_assertion_type'];
+export async function createPushedAuthorizationRecord(options) {
+    const expiresInSeconds = options.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS;
+    assertParExpiresInSeconds(expiresInSeconds);
+    const storedParams = { ...options.params, client_id: options.clientId };
+    for (const name of CLIENT_AUTHENTICATION_PARAMS) {
+        delete storedParams[name];
+    }
+    const createdAt = options.now ?? new Date();
+    const record = {
+        requestUri: PAR_REQUEST_URI_PREFIX + generateRandomString(REFERENCE_VALUE_BYTE_LENGTH),
+        clientId: options.clientId,
+        params: storedParams,
+        createdAt,
+        expiresAt: new Date(createdAt.getTime() + expiresInSeconds * 1000),
+    };
+    await options.store.save(record);
+    return record;
+}
+export function buildPushedAuthorizationResponse(record) {
+    return {
+        requestUri: record.requestUri,
+        expiresIn: Math.round((record.expiresAt.getTime() - record.createdAt.getTime()) / 1000),
+    };
+}
+export async function handlePushedAuthorizationRequest(context) {
+    rejectForbiddenParParams(context.params);
+    const clientId = await authenticateParClient({
+        params: context.params,
+        authorizationHeader: context.authorizationHeader,
+        clientResolver: context.clientResolver,
+    });
+    const params = { ...context.params, client_id: clientId };
+    await validatePushedAuthorizationParams(params, context.clientResolver, context.validationOptions);
+    const record = await createPushedAuthorizationRecord({
+        clientId,
+        params,
+        store: context.store,
+        expiresInSeconds: context.expiresInSeconds,
+        now: context.now,
+    });
+    return buildPushedAuthorizationResponse(record);
+}
+function toParError(error) {
+    if (error instanceof ParError)
+        return error;
+    if (error instanceof TokenError)
+        return new ParError(toParErrorCodeFromToken(error.error), error.errorDescription);
+    if (error instanceof AuthorizationError) {
+        return new ParError(toParErrorCodeFromAuthorization(error.error), error.errorDescription);
+    }
+    return error;
+}
+function toParErrorCodeFromToken(code) {
+    switch (code) {
+        case TokenErrorCode.InvalidClient:
+            return 'invalid_client';
+        case TokenErrorCode.UnauthorizedClient:
+            return 'unauthorized_client';
+        case TokenErrorCode.InvalidScope:
+            return 'invalid_scope';
+        default:
+            return 'invalid_request';
+    }
+}
+function toParErrorCodeFromAuthorization(code) {
+    switch (code) {
+        case AuthorizationErrorCode.InvalidScope:
+            return 'invalid_scope';
+        case AuthorizationErrorCode.UnauthorizedClient:
+            return 'unauthorized_client';
+        case AuthorizationErrorCode.UnsupportedResponseType:
+            return 'unsupported_response_type';
+        default:
+            return 'invalid_request';
+    }
+}
+//# sourceMappingURL=par-request.js.map

package/dist/par/par-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"par-request.js","sourceRoot":"","sources":["../../src/par/par-request.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,+BAA+B,EAC/B,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,GAKnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAuBpD,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAe;IACnB,gBAAgB,CAAS;IAElC,YAAY,IAAkB,EAAE,gBAAwB;QAEtD,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,CAAC;IAGD,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,CAAC;CACF;AA4BD,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAGtC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAUvC,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,IAAI,sBAAsB;QACjC,OAAO,IAAI,sBAAsB,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,+CAA+C,sBAAsB,QAAQ,sBAAsB,8BAA8B,OAAO,EAAE,CAC3I,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,wBAAwB,CAAC,MAA8B;IACrE,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,uGAAuG,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAI3C;IACC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC9D,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAItE,IAAI,uBAAuB,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAID,MAAM,gBAAgB,GAAuC,uBAAuB;QAClF,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;IAE/E,MAAM,qBAAqB,GAAG,MAAM,uBAAuB,CAAC;QAC1D,MAAM,EAAE,gBAAgB;QACxB,mBAAmB;QACnB,cAAc;KACf,CAAC,CAAC;IAIH,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,qBAAqB,EAAE,CAAC;QACzE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAKD,KAAK,UAAU,uBAAuB,CAAC,OAItC;IACC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;SACjD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QACjG,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAA8B,EAC9B,cAA8B,EAC9B,UAA+C,EAAE;IAEjD,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CACvC,MAA+C,EAC/C,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAUD,MAAM,4BAA4B,GAAG,CAAC,eAAe,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;AAWpG,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAMrD;IACC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAChF,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAE5C,MAAM,YAAY,GAA2B,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChG,KAAK,MAAM,IAAI,IAAI,4BAA4B,EAAE,CAAC;QAChD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAA8B;QACxC,UAAU,EAAE,sBAAsB,GAAG,oBAAoB,CAAC,2BAA2B,CAAC;QACtF,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,YAAY;QACpB,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;KACnE,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAGD,MAAM,UAAU,gCAAgC,CAC9C,MAAiC;IAEjC,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;KACxF,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAA0C;IAE1C,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IAGH,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC1D,MAAM,iCAAiC,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEnG,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,QAAQ;QACR,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAOD,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,YAAY,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,IAAI,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACnH,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,OAAO,IAAI,QAAQ,CAAC,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAoB;IACnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc,CAAC,aAAa;YAC/B,OAAO,gBAAgB,CAAC;QAC1B,KAAK,cAAc,CAAC,kBAAkB;YACpC,OAAO,qBAAqB,CAAC;QAC/B,KAAK,cAAc,CAAC,YAAY;YAC9B,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,iBAAiB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,IAA4B;IACnE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB,CAAC,YAAY;YACtC,OAAO,eAAe,CAAC;QACzB,KAAK,sBAAsB,CAAC,kBAAkB;YAC5C,OAAO,qBAAqB,CAAC;QAC/B,KAAK,sBAAsB,CAAC,uBAAuB;YACjD,OAAO,2BAA2B,CAAC;QACrC;YAIE,OAAO,iBAAiB,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/dist/par/resolve-request-uri.d.ts

@@ -0,0 +1,13 @@
+import type { PushedAuthorizationRequestStore } from './store.js';
+export declare class PushedRequestUriError extends Error {
+    readonly code: 'invalid_request_uri' | 'invalid_request';
+    readonly errorDescription: string;
+    constructor(code: 'invalid_request_uri' | 'invalid_request', errorDescription: string);
+}
+export declare function resolvePushedRequestUri(options: {
+    params: Record<string, string>;
+    store: PushedAuthorizationRequestStore;
+    now?: Date;
+}): Promise<Record<string, string> | null>;
+export declare function assertPushedRequestUsed(params: Record<string, string>): void;
+//# sourceMappingURL=resolve-request-uri.d.ts.map

package/dist/par/resolve-request-uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-request-uri.d.ts","sourceRoot":"","sources":["../../src/par/resolve-request-uri.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAWlE,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAAC;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,MAAM;CAQtF;AAyBD,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,EAAE,+BAA+B,CAAC;IACvC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CA4BzC;AASD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAQ5E"}

package/dist/par/resolve-request-uri.js

@@ -0,0 +1,40 @@
+import { sanitizeErrorDescription } from '@maronn-openid-connect/core';
+import { PAR_REQUEST_URI_PREFIX } from './store.js';
+export class PushedRequestUriError extends Error {
+    code;
+    errorDescription;
+    constructor(code, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'PushedRequestUriError';
+        this.code = code;
+        this.errorDescription = sanitized;
+    }
+}
+const OPAQUE_RESOLUTION_FAILURE_DESCRIPTION = 'The request_uri is invalid, expired, or has already been used';
+export async function resolvePushedRequestUri(options) {
+    const requestUri = options.params['request_uri'];
+    if (requestUri === undefined || !requestUri.startsWith(PAR_REQUEST_URI_PREFIX)) {
+        return null;
+    }
+    const record = await options.store.consume(requestUri);
+    if (record === null) {
+        throw new PushedRequestUriError('invalid_request_uri', OPAQUE_RESOLUTION_FAILURE_DESCRIPTION);
+    }
+    const now = options.now ?? new Date();
+    if (record.expiresAt.getTime() < now.getTime()) {
+        throw new PushedRequestUriError('invalid_request_uri', OPAQUE_RESOLUTION_FAILURE_DESCRIPTION);
+    }
+    if (options.params['client_id'] !== record.clientId) {
+        throw new PushedRequestUriError('invalid_request_uri', OPAQUE_RESOLUTION_FAILURE_DESCRIPTION);
+    }
+    const { request_uri: _consumed, ...pushedParams } = record.params;
+    return pushedParams;
+}
+export function assertPushedRequestUsed(params) {
+    const requestUri = params['request_uri'];
+    if (requestUri === undefined || !requestUri.startsWith(PAR_REQUEST_URI_PREFIX)) {
+        throw new PushedRequestUriError('invalid_request', 'Pushed authorization requests are required by this authorization server');
+    }
+}
+//# sourceMappingURL=resolve-request-uri.js.map

package/dist/par/resolve-request-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-request-uri.js","sourceRoot":"","sources":["../../src/par/resolve-request-uri.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAYpD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,CAA4C;IAChD,gBAAgB,CAAS;IAElC,YAAY,IAA+C,EAAE,gBAAwB;QAEnF,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;CACF;AAQD,MAAM,qCAAqC,GACzC,+DAA+D,CAAC;AAgBlE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAI7C;IACC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;IAChG,CAAC;IAGD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;IAChG,CAAC;IAID,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;IAChG,CAAC;IAID,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IAClE,OAAO,YAAY,CAAC;AACtB,CAAC;AASD,MAAM,UAAU,uBAAuB,CAAC,MAA8B;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,qBAAqB,CAC7B,iBAAiB,EACjB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/par/store.d.ts

@@ -0,0 +1,13 @@
+export declare const PAR_REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+export interface PushedAuthorizationRecord {
+    requestUri: string;
+    clientId: string;
+    params: Record<string, string>;
+    createdAt: Date;
+    expiresAt: Date;
+}
+export interface PushedAuthorizationRequestStore {
+    save(record: PushedAuthorizationRecord): Promise<void>;
+    consume(requestUri: string): Promise<PushedAuthorizationRecord | null>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/par/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/par/store.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,sBAAsB,uCAAuC,CAAC;AAS3E,MAAM,WAAW,yBAAyB;IAExC,UAAU,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE,MAAM,CAAC;IAEjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAQD,MAAM,WAAW,+BAA+B;IAE9C,IAAI,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAYvD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACxE"}

package/dist/par/store.js

@@ -0,0 +1,2 @@
+export const PAR_REQUEST_URI_PREFIX = 'urn:ietf:params:oauth:request_uri:';
+//# sourceMappingURL=store.js.map

package/dist/par/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/par/store.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,sBAAsB,GAAG,oCAAoC,CAAC"}

package/dist/token-exchange/index.d.ts

@@ -0,0 +1,2 @@
+export { SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, type ParsedTokenExchangeParams, type TokenExchangeErrorCode, type TokenExchangeGrant, type TokenExchangeRequestContext, type TokenExchangeResponse, } from './token-exchange-request.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/token-exchange/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC"}

package/dist/token-exchange/index.js

@@ -0,0 +1,2 @@
+export { SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, } from './token-exchange-request.js';
+//# sourceMappingURL=index.js.map

package/dist/token-exchange/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GAMtB,MAAM,6BAA6B,CAAC"}

package/dist/token-exchange/token-exchange-request.d.ts

@@ -0,0 +1,66 @@
+import { type AccessTokenInfo, type AccessTokenResolver, type TokenClientInfo } from '@maronn-openid-connect/core';
+export declare const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+export declare const TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
+export declare const SUBJECT_TOKEN_INVALID_DESCRIPTION = "The provided subject_token is not valid";
+export type TokenExchangeErrorCode = 'invalid_request' | 'unauthorized_client' | 'invalid_scope' | 'invalid_target';
+export declare class TokenExchangeError extends Error {
+    readonly code: TokenExchangeErrorCode;
+    readonly errorDescription: string;
+    constructor(code: TokenExchangeErrorCode, errorDescription: string);
+    get statusCode(): 400;
+}
+export interface ParsedTokenExchangeParams {
+    subjectToken: string;
+    scope?: string;
+    audience?: string;
+    resource?: string;
+}
+export interface TokenExchangeGrant {
+    subject: string;
+    clientId: string;
+    scope: string[];
+    requestedAudience?: string[];
+    expiresIn: number;
+    grantId?: string;
+}
+export interface TokenExchangeResponse {
+    access_token: string;
+    issued_token_type: typeof TOKEN_TYPE_ACCESS_TOKEN;
+    token_type: 'Bearer';
+    expires_in: number;
+    scope: string;
+}
+export interface TokenExchangeRequestContext {
+    params: Record<string, string>;
+    client: TokenClientInfo;
+    accessTokenResolver: AccessTokenResolver;
+    allowedTargets: string[];
+    configuredExpiresIn: number;
+    now?: Date;
+}
+export declare function authorizeTokenExchangeClient(client: TokenClientInfo): void;
+export declare function parseTokenExchangeParams(params: Record<string, string>): ParsedTokenExchangeParams;
+export declare function resolveSubjectToken(options: {
+    subjectToken: string;
+    accessTokenResolver: AccessTokenResolver;
+    now?: Date;
+}): Promise<AccessTokenInfo>;
+export declare function validateExchangeScope(requestedScope: string | undefined, subjectScope: string[]): string[];
+export declare function resolveExchangeTarget(options: {
+    audience?: string;
+    resource?: string;
+    allowedTargets: string[];
+    subjectAudience?: string[];
+}): string[] | undefined;
+export declare function computeExchangedTokenLifetime(options: {
+    subjectExpiresAt: number;
+    configuredExpiresIn: number;
+    now?: Date;
+}): number;
+export declare function buildTokenExchangeResponse(options: {
+    accessToken: string;
+    expiresIn: number;
+    scope: string[];
+}): TokenExchangeResponse;
+export declare function processTokenExchangeRequest(context: TokenExchangeRequestContext): Promise<TokenExchangeGrant>;
+//# sourceMappingURL=token-exchange-request.d.ts.map

package/dist/token-exchange/token-exchange-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange-request.d.ts","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAGrC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAG3F,eAAO,MAAM,uBAAuB,kDAAkD,CAAC;AASvF,eAAO,MAAM,iCAAiC,4CACH,CAAC;AAS5C,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,CAAC;AASrB,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM;IAUlE,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AAGD,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,kBAAkB;IAEjC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,uBAAuB,CAAC;IAClD,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,2BAA2B;IAE1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IACxB,mBAAmB,EAAE,mBAAmB,CAAC;IAEzC,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB,mBAAmB,EAAE,MAAM,CAAC;IAE5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAgB1E;AAUD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,yBAAyB,CAoD3B;AAaD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAe3B;AAWD,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,EAAE,CAcV;AAcD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,GAAG,MAAM,EAAE,GAAG,SAAS,CAmBvB;AAeD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IAErD,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,MAAM,CAcT;AAGD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,qBAAqB,CAUxB;AAUD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAoC7B"}

package/dist/token-exchange/token-exchange-request.js

@@ -0,0 +1,178 @@
+import { sanitizeErrorDescription, } from '@maronn-openid-connect/core';
+export const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+export const TOKEN_TYPE_ACCESS_TOKEN = 'urn:ietf:params:oauth:token-type:access_token';
+export const SUBJECT_TOKEN_INVALID_DESCRIPTION = 'The provided subject_token is not valid';
+export class TokenExchangeError extends Error {
+    code;
+    errorDescription;
+    constructor(code, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'TokenExchangeError';
+        this.code = code;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return 400;
+    }
+}
+export function authorizeTokenExchangeClient(client) {
+    const grantTypes = client.grantTypes ?? ['authorization_code'];
+    if (!grantTypes.includes(TOKEN_EXCHANGE_GRANT_TYPE)) {
+        throw new TokenExchangeError('unauthorized_client', 'The client is not authorized to use the token-exchange grant type');
+    }
+    if (client.tokenEndpointAuthMethod === 'none') {
+        throw new TokenExchangeError('unauthorized_client', 'Public clients are not allowed to use the token-exchange grant type');
+    }
+}
+export function parseTokenExchangeParams(params) {
+    if (params['actor_token'] !== undefined || params['actor_token_type'] !== undefined) {
+        throw new TokenExchangeError('invalid_request', 'Delegation is not supported: actor_token and actor_token_type must not be present.');
+    }
+    const subjectToken = optional(params['subject_token']);
+    if (subjectToken === undefined) {
+        throw new TokenExchangeError('invalid_request', 'subject_token is required');
+    }
+    const subjectTokenType = optional(params['subject_token_type']);
+    if (subjectTokenType === undefined) {
+        throw new TokenExchangeError('invalid_request', 'subject_token_type is required');
+    }
+    if (subjectTokenType !== TOKEN_TYPE_ACCESS_TOKEN) {
+        throw new TokenExchangeError('invalid_request', `Unsupported subject_token_type. Only ${TOKEN_TYPE_ACCESS_TOKEN} is supported.`);
+    }
+    const requestedTokenType = optional(params['requested_token_type']);
+    if (requestedTokenType !== undefined && requestedTokenType !== TOKEN_TYPE_ACCESS_TOKEN) {
+        throw new TokenExchangeError('invalid_request', `Unsupported requested_token_type. Only ${TOKEN_TYPE_ACCESS_TOKEN} is supported.`);
+    }
+    const resource = optional(params['resource']);
+    if (resource !== undefined && !isAbsoluteUriWithoutFragment(resource)) {
+        throw new TokenExchangeError('invalid_request', 'resource must be an absolute URI without a fragment component');
+    }
+    return {
+        subjectToken,
+        scope: optional(params['scope']),
+        audience: optional(params['audience']),
+        resource,
+    };
+}
+export async function resolveSubjectToken(options) {
+    const info = await options.accessTokenResolver.findAccessToken(options.subjectToken);
+    if (info === null) {
+        throw invalidSubjectToken();
+    }
+    const nowSeconds = toEpochSeconds(options.now);
+    if (info.expiresAt <= nowSeconds) {
+        throw invalidSubjectToken();
+    }
+    if (info.nbf !== undefined && info.nbf > nowSeconds) {
+        throw invalidSubjectToken();
+    }
+    return info;
+}
+export function validateExchangeScope(requestedScope, subjectScope) {
+    const requested = splitScope(requestedScope);
+    if (requested.length === 0) {
+        return [...subjectScope];
+    }
+    for (const value of requested) {
+        if (!subjectScope.includes(value)) {
+            throw new TokenExchangeError('invalid_scope', 'The requested scope exceeds the scope of the subject_token');
+        }
+    }
+    return requested;
+}
+export function resolveExchangeTarget(options) {
+    const { audience, resource, allowedTargets, subjectAudience } = options;
+    if (audience === undefined && resource === undefined) {
+        return subjectAudience === undefined ? undefined : [...subjectAudience];
+    }
+    const targets = [];
+    for (const requested of [audience, resource]) {
+        if (requested === undefined)
+            continue;
+        if (!allowedTargets.includes(requested)) {
+            throw new TokenExchangeError('invalid_target', 'The requested target is not allowed for token exchange');
+        }
+        targets.push(requested);
+    }
+    return [...new Set(targets)];
+}
+export function computeExchangedTokenLifetime(options) {
+    const { subjectExpiresAt, configuredExpiresIn } = options;
+    if (!Number.isInteger(configuredExpiresIn) || configuredExpiresIn <= 0) {
+        throw new RangeError(`configuredExpiresIn must be a positive integer, received ${configuredExpiresIn}`);
+    }
+    const remaining = subjectExpiresAt - toEpochSeconds(options.now);
+    if (remaining <= 0) {
+        throw invalidSubjectToken();
+    }
+    return Math.min(configuredExpiresIn, remaining);
+}
+export function buildTokenExchangeResponse(options) {
+    return {
+        access_token: options.accessToken,
+        issued_token_type: TOKEN_TYPE_ACCESS_TOKEN,
+        token_type: 'Bearer',
+        expires_in: options.expiresIn,
+        scope: options.scope.join(' '),
+    };
+}
+export async function processTokenExchangeRequest(context) {
+    authorizeTokenExchangeClient(context.client);
+    const parsed = parseTokenExchangeParams(context.params);
+    const subject = await resolveSubjectToken({
+        subjectToken: parsed.subjectToken,
+        accessTokenResolver: context.accessTokenResolver,
+        now: context.now,
+    });
+    const scope = validateExchangeScope(parsed.scope, subject.scope);
+    const requestedAudience = resolveExchangeTarget({
+        audience: parsed.audience,
+        resource: parsed.resource,
+        allowedTargets: context.allowedTargets,
+        subjectAudience: subject.audience,
+    });
+    const expiresIn = computeExchangedTokenLifetime({
+        subjectExpiresAt: subject.expiresAt,
+        configuredExpiresIn: context.configuredExpiresIn,
+        now: context.now,
+    });
+    return {
+        subject: subject.sub,
+        clientId: context.client.clientId,
+        scope,
+        requestedAudience,
+        expiresIn,
+        grantId: subject.grantId,
+    };
+}
+function optional(value) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+function splitScope(scope) {
+    if (scope === undefined)
+        return [];
+    return [...new Set(scope.split(/\s+/).filter((value) => value.length > 0))];
+}
+function toEpochSeconds(now) {
+    return Math.floor((now ?? new Date()).getTime() / 1000);
+}
+function invalidSubjectToken() {
+    return new TokenExchangeError('invalid_request', SUBJECT_TOKEN_INVALID_DESCRIPTION);
+}
+function isAbsoluteUriWithoutFragment(value) {
+    if (value.includes('#'))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol.length > 0;
+}
+//# sourceMappingURL=token-exchange-request.js.map

package/dist/token-exchange/token-exchange-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange-request.js","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,wBAAwB,GAIzB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAG3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AASvF,MAAM,CAAC,MAAM,iCAAiC,GAC5C,yCAAyC,CAAC;AAsB5C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,gBAAgB,CAAS;IAElC,YAAY,IAA4B,EAAE,gBAAwB;QAEhE,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AA+DD,MAAM,UAAU,4BAA4B,CAAC,MAAuB;IAGlE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,wBAAwB,CACtC,MAA8B;IAG9B,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,wCAAwC,uBAAuB,gBAAgB,CAChF,CAAC;IACJ,CAAC;IAID,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACpE,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,uBAAuB,EAAE,CAAC;QACvF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0CAA0C,uBAAuB,gBAAgB,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAItE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,QAAQ;KACT,CAAC;AACJ,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAIzC;IACC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAElB,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,MAAM,UAAU,qBAAqB,CACnC,cAAkC,EAClC,YAAsB;IAEtB,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAExC,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAeD,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,UAAU,CAClB,4DAA4D,mBAAmB,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAEnB,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,iBAAiB,EAAE,uBAAuB;QAE1C,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,OAAO,CAAC,SAAS;QAE7B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC;IAIpC,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,QAAQ;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,iBAAiB;QACjB,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,GAAqB;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;AACtF,CAAC;AAMD,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@maronn-openid-connect/experimental",
+  "version": "0.0.1",
+  "description": "Experimental OAuth/OIDC extensions for maronn-oidc (unstable APIs)",
+  "type": "module",
+  "exports": {
+    "./par": {
+      "types": "./dist/par/index.d.ts",
+      "import": "./dist/par/index.js"
+    },
+    "./token-exchange": {
+      "types": "./dist/token-exchange/index.d.ts",
+      "import": "./dist/token-exchange/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "openid-connect",
+    "oauth2.1",
+    "experimental"
+  ],
+  "author": "maronnjapan",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/maronnjapan/maronn-oidc.git",
+    "directory": "packages/experimental"
+  },
+  "bugs": {
+    "url": "https://github.com/maronnjapan/maronn-oidc/issues"
+  },
+  "homepage": "https://github.com/maronnjapan/maronn-oidc/tree/main/packages/experimental#readme",
+  "peerDependencies": {
+    "@maronn-openid-connect/core": ">=0.0.1 <1.0.0"
+  },
+  "devDependencies": {
+    "@edge-runtime/vm": "^5.0.0",
+    "@types/node": "^26.1.2",
+    "typescript": "^5.7.2",
+    "vitest": "^3.2.6",
+    "@maronn-openid-connect/core": "0.0.1"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:ci": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  }
+}