@maronn-openid-connect/experimental 0.0.3 → 0.0.4

package/README.md

@@ -14,6 +14,8 @@
 |---|---|---|---|
 | `par` | Pushed Authorization Requests | RFC 9126 | `@maronn-openid-connect/experimental/par` |
 | `token-exchange` | OAuth 2.0 Token Exchange (impersonation) | RFC 8693 | `@maronn-openid-connect/experimental/token-exchange` |
+| `jarm` | JWT Secured Authorization Response Mode (signed `query.jwt` only) | JARM (OpenID Foundation Final, 2022-11-09) | `@maronn-openid-connect/experimental/jarm` |
+| `device-authorization-grant` | OAuth 2.0 Device Authorization Grant | RFC 8628 | `@maronn-openid-connect/experimental/device-authorization-grant` |
 
 機能ごとに subpath export で提供します。ルート (`.`) からの再エクスポートは提供しません。機能間でコードを共有しないことで、昇格・削除時に他機能へ影響しない構造を保っています。
 

package/dist/device-authorization-grant/device-authorization-request.d.ts

@@ -0,0 +1,41 @@
+import { type DeviceAuthorizationRecord, type DeviceAuthorizationStore } from './store.js';
+export declare const DEFAULT_DEVICE_CODE_EXPIRES_IN = 600;
+export declare const DEFAULT_POLL_INTERVAL = 5;
+export interface DeviceAuthorizationClient {
+    clientId: string;
+    grantTypes?: string[];
+}
+export interface DeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export declare function validateDeviceGrantAllowed(client: DeviceAuthorizationClient): void;
+export declare function validateDeviceAuthorizationScope(scope: string | undefined): string[];
+export declare function applyOfflineAccessPolicy(scope: string[], options: {
+    client: DeviceAuthorizationClient;
+    refreshTokenFeatureEnabled: boolean;
+}): string[];
+export declare function createDeviceAuthorizationRecord(options: {
+    clientId: string;
+    scope: string[];
+    store: DeviceAuthorizationStore;
+    expiresIn: number;
+    interval: number;
+    now?: Date;
+}): Promise<DeviceAuthorizationRecord>;
+export declare function buildDeviceAuthorizationResponse(record: DeviceAuthorizationRecord, issuer: string): DeviceAuthorizationResponse;
+export declare function processDeviceAuthorizationRequest(input: {
+    params: Record<string, string>;
+    client: DeviceAuthorizationClient;
+    issuer: string;
+    expiresIn?: number;
+    interval?: number;
+    refreshTokenFeatureEnabled: boolean;
+    store: DeviceAuthorizationStore;
+    now?: Date;
+}): Promise<DeviceAuthorizationResponse>;
+//# sourceMappingURL=device-authorization-request.d.ts.map

package/dist/device-authorization-grant/device-authorization-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization-request.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/device-authorization-request.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAGvC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAGD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,EAAE,MAAM,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AASD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAQlF;AAaD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAepF;AAUD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE;IAAE,MAAM,EAAE,yBAAyB,CAAC;IAAC,0BAA0B,EAAE,OAAO,CAAA;CAAE,GAClF,MAAM,EAAE,CAMV;AAOD,wBAAsB,+BAA+B,CAAC,OAAO,EAAE;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAoBrC;AASD,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,MAAM,GACb,2BAA2B,CAU7B;AAUD,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,yBAAyB,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0BAA0B,EAAE,OAAO,CAAC;IACpC,KAAK,EAAE,wBAAwB,CAAC;IAChC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAmBvC"}

package/dist/device-authorization-grant/device-authorization-request.js

@@ -0,0 +1,80 @@
+import { generateRandomString } from '@maronn-openid-connect/core';
+import { DeviceAuthorizationError } from './errors.js';
+import { generateUniqueUserCode } from './user-code.js';
+import { DEVICE_CODE_GRANT_TYPE, } from './store.js';
+const DEVICE_CODE_BYTE_LENGTH = 32;
+export const DEFAULT_DEVICE_CODE_EXPIRES_IN = 600;
+export const DEFAULT_POLL_INTERVAL = 5;
+export function validateDeviceGrantAllowed(client) {
+    const grantTypes = client.grantTypes ?? [];
+    if (!grantTypes.includes(DEVICE_CODE_GRANT_TYPE)) {
+        throw new DeviceAuthorizationError('unauthorized_client', 'The client is not authorized to use the device_code grant');
+    }
+}
+export function validateDeviceAuthorizationScope(scope) {
+    if (scope === undefined || scope.trim() === '') {
+        throw new DeviceAuthorizationError('invalid_request', 'Missing required parameter: scope');
+    }
+    const values = [...new Set(scope.trim().split(/\s+/).filter((value) => value.length > 0))];
+    if (!values.includes('openid')) {
+        throw new DeviceAuthorizationError('invalid_scope', 'The openid scope is required');
+    }
+    return values;
+}
+export function applyOfflineAccessPolicy(scope, options) {
+    const clientAllowsRefresh = (options.client.grantTypes ?? []).includes('refresh_token');
+    if (options.refreshTokenFeatureEnabled && clientAllowsRefresh) {
+        return scope;
+    }
+    return scope.filter((value) => value !== 'offline_access');
+}
+export async function createDeviceAuthorizationRecord(options) {
+    const { userCode, userCodeDisplay } = await generateUniqueUserCode(options.store);
+    const createdAt = options.now ?? new Date();
+    const record = {
+        deviceCode: generateRandomString(DEVICE_CODE_BYTE_LENGTH),
+        userCode,
+        userCodeDisplay,
+        clientId: options.clientId,
+        scope: options.scope,
+        status: 'pending',
+        createdAt,
+        expiresAt: new Date(createdAt.getTime() + options.expiresIn * 1000),
+        interval: options.interval,
+        lastPolledAt: null,
+        csrfToken: null,
+        bindingHash: null,
+        loginAttempts: 0,
+    };
+    await options.store.save(record);
+    return record;
+}
+export function buildDeviceAuthorizationResponse(record, issuer) {
+    const verificationUri = `${issuer}/device`;
+    return {
+        device_code: record.deviceCode,
+        user_code: record.userCodeDisplay,
+        verification_uri: verificationUri,
+        verification_uri_complete: `${verificationUri}?user_code=${encodeURIComponent(record.userCodeDisplay)}`,
+        expires_in: Math.round((record.expiresAt.getTime() - record.createdAt.getTime()) / 1000),
+        interval: record.interval,
+    };
+}
+export async function processDeviceAuthorizationRequest(input) {
+    validateDeviceGrantAllowed(input.client);
+    const requestedScope = validateDeviceAuthorizationScope(input.params['scope']);
+    const scope = applyOfflineAccessPolicy(requestedScope, {
+        client: input.client,
+        refreshTokenFeatureEnabled: input.refreshTokenFeatureEnabled,
+    });
+    const record = await createDeviceAuthorizationRecord({
+        clientId: input.client.clientId,
+        scope,
+        store: input.store,
+        expiresIn: input.expiresIn ?? DEFAULT_DEVICE_CODE_EXPIRES_IN,
+        interval: input.interval ?? DEFAULT_POLL_INTERVAL,
+        now: input.now,
+    });
+    return buildDeviceAuthorizationResponse(record, input.issuer);
+}
+//# sourceMappingURL=device-authorization-request.js.map

package/dist/device-authorization-grant/device-authorization-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization-request.js","sourceRoot":"","sources":["../../src/device-authorization-grant/device-authorization-request.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EACL,sBAAsB,GAGvB,MAAM,YAAY,CAAC;AAGpB,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAGnC,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AA0BvC,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,gCAAgC,CAAC,KAAyB;IACxE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,iBAAiB,EACjB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD,MAAM,UAAU,wBAAwB,CACtC,KAAe,EACf,OAAmF;IAEnF,MAAM,mBAAmB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,0BAA0B,IAAI,mBAAmB,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC;AAC7D,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAOrD;IACC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAA8B;QACxC,UAAU,EAAE,oBAAoB,CAAC,uBAAuB,CAAC;QACzD,QAAQ;QACR,eAAe;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;QACnE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,MAAM,UAAU,gCAAgC,CAC9C,MAAiC,EACjC,MAAc;IAEd,MAAM,eAAe,GAAG,GAAG,MAAM,SAAS,CAAC;IAC3C,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,gBAAgB,EAAE,eAAe;QACjC,yBAAyB,EAAE,GAAG,eAAe,cAAc,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE;QACvG,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;QACxF,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KASvD;IACC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,cAAc,GAAG,gCAAgC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,wBAAwB,CAAC,cAAc,EAAE;QACrD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;QAC/B,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,8BAA8B;QAC5D,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,qBAAqB;QACjD,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IAEH,OAAO,gCAAgC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC"}

package/dist/device-authorization-grant/device-code-grant.d.ts

@@ -0,0 +1,23 @@
+import { type DeviceAuthorizationRecord, type DeviceAuthorizationStore } from './store.js';
+export declare const SLOW_DOWN_INTERVAL_INCREMENT = 5;
+export interface DeviceCodeGrantClient {
+    clientId: string;
+    grantTypes?: string[];
+}
+export interface DeviceCodeGrantResult {
+    subject: string;
+    clientId: string;
+    scope: string[];
+    authTime: number;
+    grantId: string;
+}
+export declare function validateDeviceCodeGrantAllowed(client: DeviceCodeGrantClient): void;
+export declare function resolveDeviceCodeRecord(params: Record<string, string>, client: DeviceCodeGrantClient, store: DeviceAuthorizationStore): Promise<DeviceAuthorizationRecord>;
+export declare function evaluateDeviceCodeState(record: DeviceAuthorizationRecord, store: DeviceAuthorizationStore, now?: Date): Promise<DeviceCodeGrantResult>;
+export declare function processDeviceCodeGrant(input: {
+    params: Record<string, string>;
+    client: DeviceCodeGrantClient;
+    store: DeviceAuthorizationStore;
+    now?: Date;
+}): Promise<DeviceCodeGrantResult>;
+//# sourceMappingURL=device-code-grant.d.ts.map

package/dist/device-authorization-grant/device-code-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-grant.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/device-code-grant.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAY9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAGD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAOlF;AAUD,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAapC;AAkBD,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,qBAAqB,CAAC,CA6DhC;AAUD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,KAAK,EAAE,wBAAwB,CAAC;IAChC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAIjC"}

package/dist/device-authorization-grant/device-code-grant.js

@@ -0,0 +1,63 @@
+import { DeviceAuthorizationError } from './errors.js';
+import { DEVICE_CODE_GRANT_TYPE, } from './store.js';
+export const SLOW_DOWN_INTERVAL_INCREMENT = 5;
+const INVALID_DEVICE_CODE_MESSAGE = 'The device_code is invalid, expired, or was issued to another client';
+export function validateDeviceCodeGrantAllowed(client) {
+    if (!(client.grantTypes ?? []).includes(DEVICE_CODE_GRANT_TYPE)) {
+        throw new DeviceAuthorizationError('unauthorized_client', 'The client is not authorized to use the device_code grant');
+    }
+}
+export async function resolveDeviceCodeRecord(params, client, store) {
+    const deviceCode = params['device_code'];
+    if (deviceCode === undefined || deviceCode === '') {
+        throw new DeviceAuthorizationError('invalid_request', 'Missing required parameter: device_code');
+    }
+    const record = await store.findByDeviceCode(deviceCode);
+    if (record === null || record.clientId !== client.clientId) {
+        throw new DeviceAuthorizationError('invalid_grant', INVALID_DEVICE_CODE_MESSAGE);
+    }
+    return record;
+}
+export async function evaluateDeviceCodeState(record, store, now = new Date()) {
+    if (now.getTime() >= record.expiresAt.getTime()) {
+        await store.delete(record.deviceCode);
+        throw new DeviceAuthorizationError('expired_token', 'The device_code has expired. Start a new device authorization request.');
+    }
+    if (record.lastPolledAt !== null &&
+        now.getTime() - record.lastPolledAt.getTime() < record.interval * 1000) {
+        record.interval += SLOW_DOWN_INTERVAL_INCREMENT;
+        record.lastPolledAt = now;
+        await store.update(record);
+        throw new DeviceAuthorizationError('slow_down', 'Polling too frequently. Increase the interval by 5 seconds.');
+    }
+    if (record.status === 'pending') {
+        record.lastPolledAt = now;
+        await store.update(record);
+        throw new DeviceAuthorizationError('authorization_pending', 'The authorization request is still pending');
+    }
+    if (record.status === 'denied') {
+        await store.delete(record.deviceCode);
+        throw new DeviceAuthorizationError('access_denied', 'The end-user denied the authorization request');
+    }
+    const consumed = await store.consume(record.deviceCode);
+    if (consumed === null ||
+        consumed.status !== 'approved' ||
+        consumed.subject === undefined ||
+        consumed.authTime === undefined ||
+        consumed.grantId === undefined) {
+        throw new DeviceAuthorizationError('invalid_grant', INVALID_DEVICE_CODE_MESSAGE);
+    }
+    return {
+        subject: consumed.subject,
+        clientId: consumed.clientId,
+        scope: consumed.approvedScope ?? consumed.scope,
+        authTime: consumed.authTime,
+        grantId: consumed.grantId,
+    };
+}
+export async function processDeviceCodeGrant(input) {
+    validateDeviceCodeGrantAllowed(input.client);
+    const record = await resolveDeviceCodeRecord(input.params, input.client, input.store);
+    return evaluateDeviceCodeState(record, input.store, input.now);
+}
+//# sourceMappingURL=device-code-grant.js.map

package/dist/device-authorization-grant/device-code-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-grant.js","sourceRoot":"","sources":["../../src/device-authorization-grant/device-code-grant.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,sBAAsB,GAGvB,MAAM,YAAY,CAAC;AAGpB,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAQ9C,MAAM,2BAA2B,GAC/B,sEAAsE,CAAC;AAsBzE,MAAM,UAAU,8BAA8B,CAAC,MAA6B;IAC1E,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA8B,EAC9B,MAA6B,EAC7B,KAA+B;IAE/B,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,wBAAwB,CAChC,iBAAiB,EACjB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAiC,EACjC,KAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,IACE,MAAM,CAAC,YAAY,KAAK,IAAI;QAC5B,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,EACtE,CAAC;QAGD,MAAM,CAAC,QAAQ,IAAI,4BAA4B,CAAC;QAChD,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,WAAW,EACX,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAID,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,IACE,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,MAAM,KAAK,UAAU;QAC9B,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,QAAQ,CAAC,QAAQ,KAAK,SAAS;QAC/B,QAAQ,CAAC,OAAO,KAAK,SAAS,EAC9B,CAAC;QACD,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACnF,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,KAAK;QAC/C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IACC,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtF,OAAO,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC"}

package/dist/device-authorization-grant/errors.d.ts

@@ -0,0 +1,12 @@
+export type DeviceAuthorizationErrorCode = 'authorization_pending' | 'slow_down' | 'access_denied' | 'expired_token' | 'invalid_request' | 'invalid_grant' | 'invalid_scope' | 'unauthorized_client';
+export declare class DeviceAuthorizationError extends Error {
+    readonly code: DeviceAuthorizationErrorCode;
+    readonly errorDescription: string;
+    constructor(code: DeviceAuthorizationErrorCode, errorDescription: string);
+    get statusCode(): 400;
+}
+export declare class DeviceVerificationError extends Error {
+    readonly statusCode: 401 | 403;
+    constructor(message: string, statusCode: 401 | 403);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/device-authorization-grant/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/errors.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,4BAA4B,GACpC,uBAAuB,GACvB,WAAW,GACX,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,eAAe,GACf,qBAAqB,CAAC;AAY1B,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM;IAUxE,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AAQD,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,GAAG;CAKnD"}

package/dist/device-authorization-grant/errors.js

@@ -0,0 +1,24 @@
+import { sanitizeErrorDescription } from '@maronn-openid-connect/core';
+export class DeviceAuthorizationError extends Error {
+    code;
+    errorDescription;
+    constructor(code, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'DeviceAuthorizationError';
+        this.code = code;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return 400;
+    }
+}
+export class DeviceVerificationError extends Error {
+    statusCode;
+    constructor(message, statusCode) {
+        super(message);
+        this.name = 'DeviceVerificationError';
+        this.statusCode = statusCode;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/device-authorization-grant/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/device-authorization-grant/errors.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AA8BvE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAA+B;IACnC,gBAAgB,CAAS;IAElC,YAAY,IAAkC,EAAE,gBAAwB;QAEtE,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAQD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,UAAU,CAAY;IAE/B,YAAY,OAAe,EAAE,UAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF"}

package/dist/device-authorization-grant/index.d.ts

@@ -0,0 +1,11 @@
+export { DEVICE_CODE_GRANT_TYPE, USER_CODE_CHARSET, USER_CODE_GROUP_SIZE, USER_CODE_LENGTH, } from './store.js';
+export type { DeviceAuthorizationRecord, DeviceAuthorizationStatus, DeviceAuthorizationStore, } from './store.js';
+export { DeviceAuthorizationError, DeviceVerificationError } from './errors.js';
+export type { DeviceAuthorizationErrorCode } from './errors.js';
+export { formatUserCode, generateUniqueUserCode, generateUserCode, normalizeUserCode, } from './user-code.js';
+export { DEFAULT_DEVICE_CODE_EXPIRES_IN, DEFAULT_POLL_INTERVAL, applyOfflineAccessPolicy, buildDeviceAuthorizationResponse, createDeviceAuthorizationRecord, processDeviceAuthorizationRequest, validateDeviceAuthorizationScope, validateDeviceGrantAllowed, } from './device-authorization-request.js';
+export type { DeviceAuthorizationClient, DeviceAuthorizationResponse, } from './device-authorization-request.js';
+export { INVALID_USER_CODE_MESSAGE, approveDeviceAuthorization, denyDeviceAuthorization, findPendingRecordByUserCode, issueVerificationBinding, recordDeviceLoginFailure, validateVerificationBinding, validateVerificationCsrfToken, } from './verification.js';
+export { SLOW_DOWN_INTERVAL_INCREMENT, evaluateDeviceCodeState, processDeviceCodeGrant, resolveDeviceCodeRecord, validateDeviceCodeGrantAllowed, } from './device-code-grant.js';
+export type { DeviceCodeGrantClient, DeviceCodeGrantResult, } from './device-code-grant.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/device-authorization-grant/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChF,YAAY,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,iCAAiC,EACjC,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/device-authorization-grant/index.js

@@ -0,0 +1,7 @@
+export { DEVICE_CODE_GRANT_TYPE, USER_CODE_CHARSET, USER_CODE_GROUP_SIZE, USER_CODE_LENGTH, } from './store.js';
+export { DeviceAuthorizationError, DeviceVerificationError } from './errors.js';
+export { formatUserCode, generateUniqueUserCode, generateUserCode, normalizeUserCode, } from './user-code.js';
+export { DEFAULT_DEVICE_CODE_EXPIRES_IN, DEFAULT_POLL_INTERVAL, applyOfflineAccessPolicy, buildDeviceAuthorizationResponse, createDeviceAuthorizationRecord, processDeviceAuthorizationRequest, validateDeviceAuthorizationScope, validateDeviceGrantAllowed, } from './device-authorization-request.js';
+export { INVALID_USER_CODE_MESSAGE, approveDeviceAuthorization, denyDeviceAuthorization, findPendingRecordByUserCode, issueVerificationBinding, recordDeviceLoginFailure, validateVerificationBinding, validateVerificationCsrfToken, } from './verification.js';
+export { SLOW_DOWN_INTERVAL_INCREMENT, evaluateDeviceCodeState, processDeviceCodeGrant, resolveDeviceCodeRecord, validateDeviceCodeGrantAllowed, } from './device-code-grant.js';
+//# sourceMappingURL=index.js.map

package/dist/device-authorization-grant/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/device-authorization-grant/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGhF,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,iCAAiC,EACjC,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC"}

package/dist/device-authorization-grant/store.d.ts

@@ -0,0 +1,33 @@
+export declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+export declare const USER_CODE_CHARSET = "BCDFGHJKLMNPQRSTVWXZ";
+export declare const USER_CODE_LENGTH = 8;
+export declare const USER_CODE_GROUP_SIZE = 4;
+export type DeviceAuthorizationStatus = 'pending' | 'approved' | 'denied';
+export interface DeviceAuthorizationRecord {
+    deviceCode: string;
+    userCode: string;
+    userCodeDisplay: string;
+    clientId: string;
+    scope: string[];
+    status: DeviceAuthorizationStatus;
+    createdAt: Date;
+    expiresAt: Date;
+    interval: number;
+    lastPolledAt: Date | null;
+    csrfToken: string | null;
+    bindingHash: string | null;
+    loginAttempts: number;
+    subject?: string;
+    authTime?: number;
+    approvedScope?: string[];
+    grantId?: string;
+}
+export interface DeviceAuthorizationStore {
+    save(record: DeviceAuthorizationRecord): Promise<void>;
+    findByDeviceCode(deviceCode: string): Promise<DeviceAuthorizationRecord | null>;
+    findByUserCode(userCode: string): Promise<DeviceAuthorizationRecord | null>;
+    update(record: DeviceAuthorizationRecord): Promise<void>;
+    delete(deviceCode: string): Promise<void>;
+    consume(deviceCode: string): Promise<DeviceAuthorizationRecord | null>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/device-authorization-grant/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/store.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AASrF,eAAO,MAAM,iBAAiB,yBAAyB,CAAC;AAGxD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAGlC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAGtC,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAQ1E,MAAM,WAAW,yBAAyB;IAExC,UAAU,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE,MAAM,CAAC;IAEjB,eAAe,EAAE,MAAM,CAAC;IAExB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAE1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAKzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,aAAa,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAEhF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAS5E,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAc1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACxE"}

package/dist/device-authorization-grant/store.js

@@ -0,0 +1,5 @@
+export const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+export const USER_CODE_CHARSET = 'BCDFGHJKLMNPQRSTVWXZ';
+export const USER_CODE_LENGTH = 8;
+export const USER_CODE_GROUP_SIZE = 4;
+//# sourceMappingURL=store.js.map

package/dist/device-authorization-grant/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/device-authorization-grant/store.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AASrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAGxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAGlC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC"}

package/dist/device-authorization-grant/user-code.d.ts

@@ -0,0 +1,9 @@
+import { type DeviceAuthorizationStore } from './store.js';
+export declare function generateUserCode(): string;
+export declare function formatUserCode(normalized: string): string;
+export declare function normalizeUserCode(input: string): string;
+export declare function generateUniqueUserCode(store: DeviceAuthorizationStore, maxAttempts?: number): Promise<{
+    userCode: string;
+    userCodeDisplay: string;
+}>;
+//# sourceMappingURL=user-code.d.ts.map

package/dist/device-authorization-grant/user-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-code.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/user-code.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAapB,wBAAgB,gBAAgB,IAAI,MAAM,CAazC;AAQD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMzD;AAUD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvD;AAWD,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,wBAAwB,EAC/B,WAAW,SAAI,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAaxD"}

package/dist/device-authorization-grant/user-code.js

@@ -0,0 +1,39 @@
+import { USER_CODE_CHARSET, USER_CODE_GROUP_SIZE, USER_CODE_LENGTH, } from './store.js';
+export function generateUserCode() {
+    const charset = USER_CODE_CHARSET;
+    const limit = 256 - (256 % charset.length);
+    let code = '';
+    const buffer = new Uint8Array(1);
+    while (code.length < USER_CODE_LENGTH) {
+        crypto.getRandomValues(buffer);
+        const byte = buffer[0];
+        if (byte >= limit)
+            continue;
+        code += charset[byte % charset.length];
+    }
+    return formatUserCode(code);
+}
+export function formatUserCode(normalized) {
+    const groups = [];
+    for (let i = 0; i < normalized.length; i += USER_CODE_GROUP_SIZE) {
+        groups.push(normalized.slice(i, i + USER_CODE_GROUP_SIZE));
+    }
+    return groups.join('-');
+}
+export function normalizeUserCode(input) {
+    return input
+        .toUpperCase()
+        .replace(/[\s　-]/g, '');
+}
+export async function generateUniqueUserCode(store, maxAttempts = 5) {
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        const userCodeDisplay = generateUserCode();
+        const userCode = normalizeUserCode(userCodeDisplay);
+        const existing = await store.findByUserCode(userCode);
+        if (existing === null) {
+            return { userCode, userCodeDisplay };
+        }
+    }
+    throw new Error(`Failed to generate a unique user_code after ${maxAttempts} attempts`);
+}
+//# sourceMappingURL=user-code.js.map

package/dist/device-authorization-grant/user-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-code.js","sourceRoot":"","sources":["../../src/device-authorization-grant/user-code.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AAapB,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC;IAElC,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QACjC,IAAI,IAAI,IAAI,KAAK;YAAE,SAAS;QAC5B,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAUD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA+B,EAC/B,WAAW,GAAG,CAAC;IAEf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,eAAe,GAAG,gBAAgB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+CAA+C,WAAW,WAAW,CACtE,CAAC;AACJ,CAAC"}

package/dist/device-authorization-grant/verification.d.ts

@@ -0,0 +1,26 @@
+import type { DeviceAuthorizationRecord, DeviceAuthorizationStore } from './store.js';
+export declare const INVALID_USER_CODE_MESSAGE = "The code is invalid or has expired";
+export declare function findPendingRecordByUserCode(userCode: string, store: DeviceAuthorizationStore, now?: Date): Promise<DeviceAuthorizationRecord | null>;
+export declare function issueVerificationBinding(record: DeviceAuthorizationRecord, store: DeviceAuthorizationStore): Promise<{
+    bindingSecret: string;
+    csrfToken: string;
+}>;
+export declare function validateVerificationBinding(record: DeviceAuthorizationRecord, bindingSecret: string | null | undefined): Promise<void>;
+export declare function validateVerificationCsrfToken(record: DeviceAuthorizationRecord, csrfToken: string): void;
+export declare function recordDeviceLoginFailure(record: DeviceAuthorizationRecord, store: DeviceAuthorizationStore, maxLoginAttempts: number): Promise<{
+    canRetry: boolean;
+    remainingAttempts: number;
+}>;
+export declare function approveDeviceAuthorization(input: {
+    record: DeviceAuthorizationRecord;
+    store: DeviceAuthorizationStore;
+    csrfToken: string;
+    subject: string;
+    authTime: number;
+}): Promise<DeviceAuthorizationRecord>;
+export declare function denyDeviceAuthorization(input: {
+    record: DeviceAuthorizationRecord;
+    store: DeviceAuthorizationStore;
+    csrfToken: string;
+}): Promise<DeviceAuthorizationRecord>;
+//# sourceMappingURL=verification.d.ts.map

package/dist/device-authorization-grant/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/verification.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAWpB,eAAO,MAAM,yBAAyB,uCAAuC,CAAC;AA0B9E,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,wBAAwB,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAQ3C;AAcD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAOvD;AAcD,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC,CAQf;AAYD,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,IAAI,CAIN;AAcD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAW3D;AAeD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAerC;AAQD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CASrC"}

package/dist/device-authorization-grant/verification.js

@@ -0,0 +1,88 @@
+import { generateRandomString } from '@maronn-openid-connect/core';
+import { DeviceAuthorizationError, DeviceVerificationError } from './errors.js';
+import { normalizeUserCode } from './user-code.js';
+const VERIFICATION_SECRET_BYTE_LENGTH = 32;
+export const INVALID_USER_CODE_MESSAGE = 'The code is invalid or has expired';
+async function sha256Base64Url(value) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
+    let binary = '';
+    for (const byte of new Uint8Array(digest)) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export async function findPendingRecordByUserCode(userCode, store, now = new Date()) {
+    const normalized = normalizeUserCode(userCode);
+    if (normalized === '')
+        return null;
+    const record = await store.findByUserCode(normalized);
+    if (record === null)
+        return null;
+    if (record.status !== 'pending')
+        return null;
+    if (now.getTime() >= record.expiresAt.getTime())
+        return null;
+    return record;
+}
+export async function issueVerificationBinding(record, store) {
+    const bindingSecret = generateRandomString(VERIFICATION_SECRET_BYTE_LENGTH);
+    const csrfToken = generateRandomString(VERIFICATION_SECRET_BYTE_LENGTH);
+    record.bindingHash = await sha256Base64Url(bindingSecret);
+    record.csrfToken = csrfToken;
+    await store.update(record);
+    return { bindingSecret, csrfToken };
+}
+export async function validateVerificationBinding(record, bindingSecret) {
+    if (record.bindingHash === null || !bindingSecret) {
+        throw new DeviceVerificationError('Device verification binding is missing', 403);
+    }
+    const presented = await sha256Base64Url(bindingSecret);
+    if (presented !== record.bindingHash) {
+        throw new DeviceVerificationError('Device verification binding is invalid', 403);
+    }
+}
+export function validateVerificationCsrfToken(record, csrfToken) {
+    if (record.csrfToken === null || csrfToken === '' || csrfToken !== record.csrfToken) {
+        throw new DeviceVerificationError('CSRF token mismatch', 403);
+    }
+}
+export async function recordDeviceLoginFailure(record, store, maxLoginAttempts) {
+    record.loginAttempts += 1;
+    const canRetry = record.loginAttempts < maxLoginAttempts;
+    if (!canRetry) {
+        record.status = 'denied';
+    }
+    await store.update(record);
+    return {
+        canRetry,
+        remainingAttempts: Math.max(0, maxLoginAttempts - record.loginAttempts),
+    };
+}
+export async function approveDeviceAuthorization(input) {
+    validateVerificationCsrfToken(input.record, input.csrfToken);
+    assertPending(input.record);
+    input.record.status = 'approved';
+    input.record.subject = input.subject;
+    input.record.authTime = input.authTime;
+    input.record.approvedScope = [...input.record.scope];
+    input.record.grantId = generateRandomString(VERIFICATION_SECRET_BYTE_LENGTH);
+    input.record.bindingHash = null;
+    input.record.csrfToken = null;
+    await input.store.update(input.record);
+    return input.record;
+}
+export async function denyDeviceAuthorization(input) {
+    validateVerificationCsrfToken(input.record, input.csrfToken);
+    assertPending(input.record);
+    input.record.status = 'denied';
+    input.record.bindingHash = null;
+    input.record.csrfToken = null;
+    await input.store.update(input.record);
+    return input.record;
+}
+function assertPending(record) {
+    if (record.status !== 'pending') {
+        throw new DeviceAuthorizationError('invalid_grant', INVALID_USER_CODE_MESSAGE);
+    }
+}
+//# sourceMappingURL=verification.js.map

package/dist/device-authorization-grant/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/device-authorization-grant/verification.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnD,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAQ3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAQ9E,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,KAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiC,EACjC,KAA+B;IAE/B,MAAM,aAAa,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IACxE,MAAM,CAAC,WAAW,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAiC,EACjC,aAAwC;IAExC,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAYD,MAAM,UAAU,6BAA6B,CAC3C,MAAiC,EACjC,SAAiB;IAEjB,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiC,EACjC,KAA+B,EAC/B,gBAAwB;IAExB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,GAAG,gBAAgB,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO;QACL,QAAQ;QACR,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC;KACxE,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,6BAA6B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACrC,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAG7E,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,6BAA6B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC/B,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAMD,SAAS,aAAa,CAAC,MAAiC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,yBAAyB,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/jarm/index.d.ts

@@ -0,0 +1,6 @@
+export { JARM_RESPONSE_PARAM, JARM_SUPPORTED_RESPONSE_MODES, resolveJarmResponseMode, type JarmResponseModeResolution, } from './response-mode.js';
+export { assertJarmLifetimeSeconds, buildJarmRedirectUrl, createJarmResponseJwt, } from './response-jwt.js';
+export type JarmAuthTransactionFields = {
+    jarmResponseMode?: 'query.jwt';
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/jarm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/jarm/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAa3B,MAAM,MAAM,yBAAyB,GAAG;IAEtC,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAChC,CAAC"}

package/dist/jarm/index.js

@@ -0,0 +1,3 @@
+export { JARM_RESPONSE_PARAM, JARM_SUPPORTED_RESPONSE_MODES, resolveJarmResponseMode, } from './response-mode.js';
+export { assertJarmLifetimeSeconds, buildJarmRedirectUrl, createJarmResponseJwt, } from './response-jwt.js';
+//# sourceMappingURL=index.js.map

package/dist/jarm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/jarm/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/jarm/response-jwt.d.ts

@@ -0,0 +1,12 @@
+import type { SigningKey } from '@maronn-openid-connect/core';
+export declare function assertJarmLifetimeSeconds(value: number): void;
+export declare function createJarmResponseJwt(options: {
+    issuer: string;
+    clientId: string;
+    parameters: Record<string, string | undefined>;
+    signingKey: SigningKey;
+    lifetimeSeconds?: number;
+    now?: Date;
+}): Promise<string>;
+export declare function buildJarmRedirectUrl(redirectUri: string, responseJwt: string): string;
+//# sourceMappingURL=response-jwt.d.ts.map

package/dist/jarm/response-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-jwt.d.ts","sourceRoot":"","sources":["../../src/jarm/response-jwt.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAwD9D,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAU7D;AA0BD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BlB;AAQD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAIrF"}

package/dist/jarm/response-jwt.js

@@ -0,0 +1,49 @@
+const MIN_LIFETIME_SECONDS = 5;
+const MAX_LIFETIME_SECONDS = 600;
+const DEFAULT_LIFETIME_SECONDS = 60;
+const RESPONSE_SIGNING_ALG = 'RS256';
+const WEB_CRYPTO_ALGORITHM = 'RSASSA-PKCS1-v1_5';
+function base64UrlFromBytes(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64UrlFromJson(value) {
+    return base64UrlFromBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+export function assertJarmLifetimeSeconds(value) {
+    if (!Number.isInteger(value) ||
+        value < MIN_LIFETIME_SECONDS ||
+        value > MAX_LIFETIME_SECONDS) {
+        throw new Error(`jarmConfig.jarmResponseLifetimeSeconds must be an integer between ${MIN_LIFETIME_SECONDS} and ${MAX_LIFETIME_SECONDS} seconds (JARM Section 2.1), got ${value}`);
+    }
+}
+export async function createJarmResponseJwt(options) {
+    const lifetimeSeconds = options.lifetimeSeconds ?? DEFAULT_LIFETIME_SECONDS;
+    const issuedAtSeconds = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    const claims = {};
+    for (const [name, value] of Object.entries(options.parameters)) {
+        if (value !== undefined) {
+            claims[name] = value;
+        }
+    }
+    claims['iss'] = options.issuer;
+    claims['aud'] = options.clientId;
+    claims['exp'] = issuedAtSeconds + lifetimeSeconds;
+    const encodedHeader = base64UrlFromJson({
+        alg: RESPONSE_SIGNING_ALG,
+        kid: options.signingKey.keyId,
+    });
+    const encodedPayload = base64UrlFromJson(claims);
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const signature = await crypto.subtle.sign(WEB_CRYPTO_ALGORITHM, options.signingKey.privateKey, new TextEncoder().encode(signingInput));
+    return `${signingInput}.${base64UrlFromBytes(new Uint8Array(signature))}`;
+}
+export function buildJarmRedirectUrl(redirectUri, responseJwt) {
+    const url = new URL(redirectUri);
+    url.searchParams.set('response', responseJwt);
+    return url.toString();
+}
+//# sourceMappingURL=response-jwt.js.map

package/dist/jarm/response-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-jwt.js","sourceRoot":"","sources":["../../src/jarm/response-jwt.ts"],"names":[],"mappings":"AAcA,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAQ/B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAGjC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAiBpC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAGrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B;IACvD,OAAO,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAUD,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACxB,KAAK,GAAG,oBAAoB;QAC5B,KAAK,GAAG,oBAAoB,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qEAAqE,oBAAoB,QAAQ,oBAAoB,oCAAoC,KAAK,EAAE,CACjK,CAAC;IACJ,CAAC;AACH,CAAC;AA0BD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAO3C;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC;IAC5E,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,GAAG,eAAe,CAAC;IAElD,MAAM,aAAa,GAAG,iBAAiB,CAAC;QACtC,GAAG,EAAE,oBAAoB;QACzB,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;KAC9B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAE1D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,oBAAoB,EACpB,OAAO,CAAC,UAAU,CAAC,UAAU,EAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAC;IAEF,OAAO,GAAG,YAAY,IAAI,kBAAkB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAQD,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,WAAmB;IAC3E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/jarm/response-mode.d.ts

@@ -0,0 +1,13 @@
+export declare const JARM_SUPPORTED_RESPONSE_MODES: readonly ["query.jwt", "jwt"];
+export declare const JARM_RESPONSE_PARAM = "response";
+export type JarmResponseModeResolution = {
+    kind: 'jarm';
+    mode: 'query.jwt';
+} | {
+    kind: 'plain';
+} | {
+    kind: 'unsupported-jwt-mode';
+    requested: string;
+};
+export declare function resolveJarmResponseMode(params: object): JarmResponseModeResolution;
+//# sourceMappingURL=response-mode.d.ts.map

package/dist/jarm/response-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-mode.d.ts","sourceRoot":"","sources":["../../src/jarm/response-mode.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,6BAA6B,+BAAgC,CAAC;AAG3E,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAU9C,MAAM,MAAM,0BAA0B,GAElC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAEnC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAEjB;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBxD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,0BAA0B,CAgBlF"}

package/dist/jarm/response-mode.js

@@ -0,0 +1,16 @@
+export const JARM_SUPPORTED_RESPONSE_MODES = ['query.jwt', 'jwt'];
+export const JARM_RESPONSE_PARAM = 'response';
+export function resolveJarmResponseMode(params) {
+    const responseMode = params['response_mode'];
+    if (typeof responseMode !== 'string') {
+        return { kind: 'plain' };
+    }
+    if (JARM_SUPPORTED_RESPONSE_MODES.includes(responseMode)) {
+        return { kind: 'jarm', mode: 'query.jwt' };
+    }
+    if (responseMode.endsWith('.jwt')) {
+        return { kind: 'unsupported-jwt-mode', requested: responseMode };
+    }
+    return { kind: 'plain' };
+}
+//# sourceMappingURL=response-mode.js.map

package/dist/jarm/response-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-mode.js","sourceRoot":"","sources":["../../src/jarm/response-mode.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,KAAK,CAAU,CAAC;AAG3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAkC9C,MAAM,UAAU,uBAAuB,CAAC,MAAc;IAKpD,MAAM,YAAY,GAAI,MAAsC,CAAC,eAAe,CAAC,CAAC;IAC9E,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAK,6BAAmD,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/package.json

@@ -1,9 +1,17 @@
 {
   "name": "@maronn-openid-connect/experimental",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "Experimental OAuth/OIDC extensions for maronn-openid-connect (unstable APIs)",
   "type": "module",
   "exports": {
+    "./device-authorization-grant": {
+      "types": "./dist/device-authorization-grant/index.d.ts",
+      "import": "./dist/device-authorization-grant/index.js"
+    },
+    "./jarm": {
+      "types": "./dist/jarm/index.d.ts",
+      "import": "./dist/jarm/index.js"
+    },
     "./par": {
       "types": "./dist/par/index.d.ts",
       "import": "./dist/par/index.js"