npm - @maronn-openid-connect/experimental - Versions diffs - 0.0.5 → 0.0.6 - Mend

@maronn-openid-connect/experimental 0.0.5 → 0.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/README.md +1 -5
package/dist/device-authorization-grant/verification.d.ts.map +1 -1
package/dist/device-authorization-grant/verification.js.map +1 -1
package/dist/id-jag/errors.d.ts +11 -0
package/dist/id-jag/errors.d.ts.map +1 -0
package/dist/id-jag/errors.js +19 -0
package/dist/id-jag/errors.js.map +1 -0
package/dist/id-jag/index.d.ts +4 -0
package/dist/id-jag/index.d.ts.map +1 -0
package/dist/id-jag/index.js +4 -0
package/dist/id-jag/index.js.map +1 -0
package/dist/id-jag/issue-id-jag.d.ts +138 -0
package/dist/id-jag/issue-id-jag.d.ts.map +1 -0
package/dist/id-jag/issue-id-jag.js +359 -0
package/dist/id-jag/issue-id-jag.js.map +1 -0
package/dist/id-jag/redeem-id-jag.d.ts +65 -0
package/dist/id-jag/redeem-id-jag.d.ts.map +1 -0
package/dist/id-jag/redeem-id-jag.js +305 -0
package/dist/id-jag/redeem-id-jag.js.map +1 -0
package/package.json +8 -4

package/README.md CHANGED Viewed

@@ -16,6 +16,7 @@
 | `token-exchange` | OAuth 2.0 Token Exchange (impersonation) | RFC 8693 | `@maronn-openid-connect/experimental/token-exchange` |
 | `jarm` | JWT Secured Authorization Response Mode (signed `query.jwt` only) | JARM (OpenID Foundation Final, 2022-11-09) | `@maronn-openid-connect/experimental/jarm` |
 | `device-authorization-grant` | OAuth 2.0 Device Authorization Grant | RFC 8628 | `@maronn-openid-connect/experimental/device-authorization-grant` |
+| `id-jag` | Cross-App Access / Identity Assertion Authorization Grant（発行と受領の両側） | draft-ietf-oauth-identity-assertion-authz-grant-04 | `@maronn-openid-connect/experimental/id-jag` |
 機能ごとに subpath export で提供します。ルート (`.`) からの再エクスポートは提供しません。機能間でコードを共有しないことで、昇格・削除時に他機能へ影響しない構造を保っています。
@@ -65,8 +66,3 @@ Experimental 機能が core へ昇格する目安は次のとおりです。
 ## 利用者ドキュメント
 `docs/library-document` の Experimental セクションを参照してください。
-## 実装解説
-各機能を「何を・どう実装したか」をコード全文つきで説明する解説（日本語・英語）を
-`docs/implementation-guides/experimental/` に置いています。実装の内側を読むときはこちらを参照してください。

package/dist/device-authorization-grant/verification.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/verification.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAWpB,eAAO,MAAM,yBAAyB,uCAAuC,CAAC;AA0B9E,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,wBAAwB,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAQ3C;AAcD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAOvD;AAcD,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC,CAQf;~~AAYD~~,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,IAAI,CAIN;~~AAcD~~,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAW3D;AAeD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAerC;AAQD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CASrC"}
1	+ {"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/verification.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAWpB,eAAO,MAAM,yBAAyB,uCAAuC,CAAC;AA0B9E,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,wBAAwB,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAQ3C;AAcD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAOvD;AAcD,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC,CAQf;AAWD,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,IAAI,CAIN;AAaD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAW3D;AAeD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAerC;AAQD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CASrC"}

package/dist/device-authorization-grant/verification.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/device-authorization-grant/verification.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnD,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAQ3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAQ9E,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,KAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiC,EACjC,KAA+B;IAE/B,MAAM,aAAa,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IACxE,MAAM,CAAC,WAAW,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAiC,EACjC,aAAwC;IAExC,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;~~AAYD~~,MAAM,UAAU,6BAA6B,CAC3C,MAAiC,EACjC,SAAiB;IAEjB,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;~~AAcD~~,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiC,EACjC,KAA+B,EAC/B,gBAAwB;IAExB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,GAAG,gBAAgB,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO;QACL,QAAQ;QACR,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC;KACxE,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,6BAA6B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACrC,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAG7E,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,6BAA6B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC/B,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAMD,SAAS,aAAa,CAAC,MAAiC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,yBAAyB,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC"}
1	+ {"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/device-authorization-grant/verification.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnD,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAQ3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAQ9E,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,KAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiC,EACjC,KAA+B;IAE/B,MAAM,aAAa,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IACxE,MAAM,CAAC,WAAW,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAiC,EACjC,aAAwC;IAExC,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,6BAA6B,CAC3C,MAAiC,EACjC,SAAiB;IAEjB,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiC,EACjC,KAA+B,EAC/B,gBAAwB;IAExB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,GAAG,gBAAgB,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO;QACL,QAAQ;QACR,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC;KACxE,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,6BAA6B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACrC,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAG7E,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,6BAA6B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC/B,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAMD,SAAS,aAAa,CAAC,MAAiC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,yBAAyB,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/id-jag/errors.d.ts ADDED Viewed

@@ -0,0 +1,11 @@
+export type IdJagErrorCode = 'invalid_request' | 'invalid_grant' | 'unauthorized_client' | 'invalid_scope' | 'invalid_target';
+export declare class IdJagError extends Error {
+    readonly code: IdJagErrorCode;
+    readonly errorDescription: string;
+    constructor(code: IdJagErrorCode, errorDescription: string);
+    get statusCode(): 400;
+}
+export declare const SUBJECT_TOKEN_INVALID_DESCRIPTION = "The provided subject_token is not valid";
+export declare const ACTOR_TOKEN_INVALID_DESCRIPTION = "The provided actor_token is not valid";
+export declare const ASSERTION_UNTRUSTED_DESCRIPTION = "The assertion issuer is not trusted or the assertion signature is invalid";
+//# sourceMappingURL=errors.d.ts.map

package/dist/id-jag/errors.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/id-jag/errors.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,eAAe,GACf,qBAAqB,GACrB,eAAe,GACf,gBAAgB,CAAC;AAErB,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM;IAU1D,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AASD,eAAO,MAAM,iCAAiC,4CACH,CAAC;AAS5C,eAAO,MAAM,+BAA+B,0CACH,CAAC;AAQ1C,eAAO,MAAM,+BAA+B,8EACiC,CAAC"}

package/dist/id-jag/errors.js ADDED Viewed

@@ -0,0 +1,19 @@
+import { sanitizeErrorDescription } from '@maronn-openid-connect/core';
+export class IdJagError extends Error {
+    code;
+    errorDescription;
+    constructor(code, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'IdJagError';
+        this.code = code;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return 400;
+    }
+}
+export const SUBJECT_TOKEN_INVALID_DESCRIPTION = 'The provided subject_token is not valid';
+export const ACTOR_TOKEN_INVALID_DESCRIPTION = 'The provided actor_token is not valid';
+export const ASSERTION_UNTRUSTED_DESCRIPTION = 'The assertion issuer is not trusted or the assertion signature is invalid';
+//# sourceMappingURL=errors.js.map

package/dist/id-jag/errors.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/id-jag/errors.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAiBvE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAiB;IACrB,gBAAgB,CAAS;IAElC,YAAY,IAAoB,EAAE,gBAAwB;QAExD,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AASD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,yCAAyC,CAAC;AAS5C,MAAM,CAAC,MAAM,+BAA+B,GAC1C,uCAAuC,CAAC;AAQ1C,MAAM,CAAC,MAAM,+BAA+B,GAC1C,2EAA2E,CAAC"}

package/dist/id-jag/index.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+export { ACTOR_TOKEN_INVALID_DESCRIPTION, ASSERTION_UNTRUSTED_DESCRIPTION, SUBJECT_TOKEN_INVALID_DESCRIPTION, IdJagError, type IdJagErrorCode, } from './errors.js';
+export { ACTOR_TOKEN_TYPES_SUPPORTED, ID_JAG_GRANT_PROFILE, ID_JAG_JWT_TYP, ID_JAG_TOKEN_TYPE, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TOKEN_TYPE_ID_TOKEN, TOKEN_TYPE_JWT, TOKEN_TYPE_REFRESH_TOKEN, TOKEN_TYPE_SAML1, TOKEN_TYPE_SAML2, authorizeIdJagIssuanceClient, buildIdJagClaims, buildIdJagIssuanceResponse, createIdJagJwt, matchesIdJagIssuanceRequest, parseIdJagIssuanceParams, processIdJagIssuanceRequest, resolveIdJagActor, resolveIdJagActorToken, resolveIdJagSubject, resolveIdJagSubjectFromRefreshToken, validateIdJagAudience, validateIdJagScope, type IdJagActor, type IdJagActorTokenResolver, type IdJagActorTokenResolverInput, type IdJagClaims, type IdJagIssuanceContext, type IdJagIssuanceParseOptions, type IdJagIssuanceResponse, type IdJagSubject, type ParsedIdJagIssuanceParams, } from './issue-id-jag.js';
+export { DEFAULT_ASSERTION_CLOCK_SKEW_SEC, JWT_BEARER_GRANT_TYPE, authorizeIdJagRedemptionClient, parseIdJagRedemptionParams, processIdJagRedemptionRequest, resolveIdJagGrantScope, verifyIdJagAssertion, type IdJagAccessTokenInfo, type IdJagAssertionPayload, type IdJagRedemptionContext, type IdJagRedemptionGrant, type IdJagTrustedIdentityProvider, type ParsedIdJagRedemptionParams, } from './redeem-id-jag.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/id-jag/index.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/id-jag/index.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAC/B,iCAAiC,EACjC,UAAU,EACV,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,gBAAgB,EAChB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mCAAmC,EACnC,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,8BAA8B,EAC9B,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,GACjC,MAAM,oBAAoB,CAAC"}

package/dist/id-jag/index.js ADDED Viewed

@@ -0,0 +1,4 @@
+export { ACTOR_TOKEN_INVALID_DESCRIPTION, ASSERTION_UNTRUSTED_DESCRIPTION, SUBJECT_TOKEN_INVALID_DESCRIPTION, IdJagError, } from './errors.js';
+export { ACTOR_TOKEN_TYPES_SUPPORTED, ID_JAG_GRANT_PROFILE, ID_JAG_JWT_TYP, ID_JAG_TOKEN_TYPE, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TOKEN_TYPE_ID_TOKEN, TOKEN_TYPE_JWT, TOKEN_TYPE_REFRESH_TOKEN, TOKEN_TYPE_SAML1, TOKEN_TYPE_SAML2, authorizeIdJagIssuanceClient, buildIdJagClaims, buildIdJagIssuanceResponse, createIdJagJwt, matchesIdJagIssuanceRequest, parseIdJagIssuanceParams, processIdJagIssuanceRequest, resolveIdJagActor, resolveIdJagActorToken, resolveIdJagSubject, resolveIdJagSubjectFromRefreshToken, validateIdJagAudience, validateIdJagScope, } from './issue-id-jag.js';
+export { DEFAULT_ASSERTION_CLOCK_SKEW_SEC, JWT_BEARER_GRANT_TYPE, authorizeIdJagRedemptionClient, parseIdJagRedemptionParams, processIdJagRedemptionRequest, resolveIdJagGrantScope, verifyIdJagAssertion, } from './redeem-id-jag.js';
+//# sourceMappingURL=index.js.map

package/dist/id-jag/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/id-jag/index.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAC/B,iCAAiC,EACjC,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,gBAAgB,EAChB,0BAA0B,EAC1B,cAAc,EACd,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mCAAmC,EACnC,qBAAqB,EACrB,kBAAkB,GAUnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,8BAA8B,EAC9B,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,oBAAoB,GAOrB,MAAM,oBAAoB,CAAC"}

package/dist/id-jag/issue-id-jag.d.ts ADDED Viewed

@@ -0,0 +1,138 @@
+import { type AuthenticationSessionResolver, type JwkSet, type RefreshTokenResolver, type SigningKey, type TokenClientInfo } from '@maronn-openid-connect/core';
+export declare const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+export declare const ID_JAG_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id-jag";
+export declare const TOKEN_TYPE_ID_TOKEN = "urn:ietf:params:oauth:token-type:id_token";
+export declare const TOKEN_TYPE_REFRESH_TOKEN = "urn:ietf:params:oauth:token-type:refresh_token";
+export declare const TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
+export declare const TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";
+export declare const TOKEN_TYPE_SAML1 = "urn:ietf:params:oauth:token-type:saml1";
+export declare const TOKEN_TYPE_SAML2 = "urn:ietf:params:oauth:token-type:saml2";
+export declare const ACTOR_TOKEN_TYPES_SUPPORTED: readonly ["urn:ietf:params:oauth:token-type:access_token", "urn:ietf:params:oauth:token-type:refresh_token", "urn:ietf:params:oauth:token-type:id_token", "urn:ietf:params:oauth:token-type:jwt", "urn:ietf:params:oauth:token-type:saml1", "urn:ietf:params:oauth:token-type:saml2"];
+export declare const ID_JAG_JWT_TYP = "oauth-id-jag+jwt";
+export declare const ID_JAG_GRANT_PROFILE = "urn:ietf:params:oauth:grant-profile:id-jag";
+export interface IdJagActor {
+    sub: string;
+    act?: IdJagActor;
+}
+export interface IdJagActorTokenResolverInput {
+    actorToken: string;
+    actorTokenType: string;
+    clientId: string;
+    issuer: string;
+    jwks: JwkSet;
+}
+export type IdJagActorTokenResolver = (input: IdJagActorTokenResolverInput) => Promise<IdJagActor | null> | IdJagActor | null;
+export interface ParsedIdJagIssuanceParams {
+    subjectToken: string;
+    subjectTokenType: typeof TOKEN_TYPE_ID_TOKEN | typeof TOKEN_TYPE_REFRESH_TOKEN;
+    audience: string;
+    scope?: string;
+    resource?: string;
+    actorToken?: string;
+    actorTokenType?: string;
+}
+export interface IdJagIssuanceParseOptions {
+    allowRefreshTokenSubjects?: boolean;
+    allowActorTokens?: boolean;
+}
+export interface IdJagSubject {
+    sub: string;
+    authTime?: number;
+    acr?: string;
+    amr?: string[];
+}
+export interface IdJagClaims {
+    iss: string;
+    sub: string;
+    aud: string;
+    client_id: string;
+    jti: string;
+    exp: number;
+    iat: number;
+    scope?: string;
+    resource?: string;
+    auth_time?: number;
+    acr?: string;
+    amr?: string[];
+    act?: IdJagActor;
+}
+export interface IdJagIssuanceResponse {
+    access_token: string;
+    issued_token_type: typeof ID_JAG_TOKEN_TYPE;
+    token_type: 'N_A';
+    expires_in: number;
+    scope: string;
+}
+export interface IdJagIssuanceContext {
+    params: Record<string, string>;
+    client: TokenClientInfo;
+    issuer: string;
+    jwks: JwkSet;
+    signingKey: SigningKey;
+    allowedAudiences: string[];
+    allowedScopes?: string[];
+    lifetimeSeconds: number;
+    refreshTokenResolver?: RefreshTokenResolver;
+    authenticationSessionResolver?: AuthenticationSessionResolver;
+    allowActorTokens?: boolean;
+    actorTokenResolver?: IdJagActorTokenResolver;
+    now?: Date;
+}
+export declare function matchesIdJagIssuanceRequest(params: Record<string, string>): boolean;
+export declare function authorizeIdJagIssuanceClient(client: TokenClientInfo): void;
+export declare function parseIdJagIssuanceParams(params: Record<string, string>, options?: IdJagIssuanceParseOptions): ParsedIdJagIssuanceParams;
+export declare function resolveIdJagSubject(options: {
+    subjectToken: string;
+    issuer: string;
+    clientId: string;
+    jwks: JwkSet;
+}): Promise<IdJagSubject>;
+export declare function resolveIdJagSubjectFromRefreshToken(options: {
+    refreshToken: string;
+    clientId: string;
+    refreshTokenResolver: RefreshTokenResolver;
+    authenticationSessionResolver?: AuthenticationSessionResolver;
+    now?: Date;
+}): Promise<IdJagSubject>;
+export declare function resolveIdJagActor(options: {
+    actorToken: string;
+    issuer: string;
+    clientId: string;
+    jwks: JwkSet;
+}): Promise<IdJagActor>;
+export declare function resolveIdJagActorToken(options: {
+    actorToken: string;
+    actorTokenType: string;
+    clientId: string;
+    issuer: string;
+    jwks: JwkSet;
+    resolver?: IdJagActorTokenResolver;
+}): Promise<IdJagActor>;
+export declare function validateIdJagAudience(options: {
+    audience: string;
+    issuer: string;
+    allowedAudiences: string[];
+}): void;
+export declare function validateIdJagScope(requestedScope: string | undefined, allowedScopes: string[] | undefined): string[];
+export declare function buildIdJagClaims(options: {
+    issuer: string;
+    subject: IdJagSubject;
+    audience: string;
+    clientId: string;
+    scope: string[];
+    resource?: string;
+    actor?: IdJagActor;
+    lifetimeSeconds: number;
+    now?: Date;
+}): IdJagClaims;
+export declare function createIdJagJwt(options: {
+    claims: IdJagClaims;
+    signingKey: SigningKey;
+}): Promise<string>;
+export declare function buildIdJagIssuanceResponse(options: {
+    idJag: string;
+    expiresIn: number;
+    scope: string[];
+}): IdJagIssuanceResponse;
+export declare function processIdJagIssuanceRequest(context: IdJagIssuanceContext): Promise<IdJagIssuanceResponse>;
+//# sourceMappingURL=issue-id-jag.d.ts.map

package/dist/id-jag/issue-id-jag.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"issue-id-jag.d.ts","sourceRoot":"","sources":["../../src/id-jag/issue-id-jag.ts"],"names":[],"mappings":"AAyBA,OAAO,EAUL,KAAK,6BAA6B,EAClC,KAAK,MAAM,EAEX,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,eAAe,EAErB,MAAM,6BAA6B,CAAC;AAQrC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAG3F,eAAO,MAAM,iBAAiB,4CAA4C,CAAC;AAG3E,eAAO,MAAM,mBAAmB,8CAA8C,CAAC;AAW/E,eAAO,MAAM,wBAAwB,mDAAmD,CAAC;AAGzF,eAAO,MAAM,uBAAuB,kDAAkD,CAAC;AAGvF,eAAO,MAAM,cAAc,yCAAyC,CAAC;AAGrE,eAAO,MAAM,gBAAgB,2CAA2C,CAAC;AAGzE,eAAO,MAAM,gBAAgB,2CAA2C,CAAC;AAUzE,eAAO,MAAM,2BAA2B,uRAO9B,CAAC;AAOX,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAMjD,eAAO,MAAM,oBAAoB,+CAA+C,CAAC;AAsBjF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAGD,MAAM,WAAW,4BAA4B;IAE3C,UAAU,EAAE,MAAM,CAAC;IAEnB,cAAc,EAAE,MAAM,CAAC;IAEvB,QAAQ,EAAE,MAAM,CAAC;IAEjB,MAAM,EAAE,MAAM,CAAC;IAEf,IAAI,EAAE,MAAM,CAAC;CACd;AAqBD,MAAM,MAAM,uBAAuB,GAAG,CACpC,KAAK,EAAE,4BAA4B,KAChC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,UAAU,GAAG,IAAI,CAAC;AAGpD,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IAErB,gBAAgB,EAAE,OAAO,mBAAmB,GAAG,OAAO,wBAAwB,CAAC;IAE/E,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC;IAKpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,yBAAyB;IAKxC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAMpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAGD,MAAM,WAAW,YAAY;IAE3B,GAAG,EAAE,MAAM,CAAC;IAEZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAGD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAGD,MAAM,WAAW,qBAAqB;IAEpC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAE5C,UAAU,EAAE,KAAK,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,oBAAoB;IAEnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IAExB,MAAM,EAAE,MAAM,CAAC;IAEf,IAAI,EAAE,MAAM,CAAC;IAEb,UAAU,EAAE,UAAU,CAAC;IAEvB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAE3B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,eAAe,EAAE,MAAM,CAAC;IAMxB,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAM5C,6BAA6B,CAAC,EAAE,6BAA6B,CAAC;IAO9D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAM3B,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAE7C,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AASD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAKnF;AAWD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAiB1E;AAYD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,yBAA8B,GACtC,yBAAyB,CAmG3B;AAiBD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,YAAY,CAAC,CA8BxB;AAwBD,wBAAsB,mCAAmC,CAAC,OAAO,EAAE;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,6BAA6B,CAAC,EAAE,6BAA6B,CAAC;IAC9D,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,YAAY,CAAC,CAwCxB;AAsBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,UAAU,CAAC,CAetB;AAqBD,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBtB;AAqCD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GAAG,IAAI,CAeP;AAaD,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,aAAa,EAAE,MAAM,EAAE,GAAG,SAAS,GAClC,MAAM,EAAE,CAcV;AAcD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,WAAW,CAsBd;AAYD,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAUD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,qBAAqB,CAQxB;AAUD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CA6EhC"}

package/dist/id-jag/issue-id-jag.js ADDED Viewed

@@ -0,0 +1,359 @@
+import { IdTokenHintError, TokenError, generateRandomString, resolveRefreshToken, validateIdTokenHint, validateRefreshTokenClient, validateRefreshTokenExpiration, validateRefreshTokenSession, validateRefreshTokenUnused, } from '@maronn-openid-connect/core';
+import { ACTOR_TOKEN_INVALID_DESCRIPTION, IdJagError, SUBJECT_TOKEN_INVALID_DESCRIPTION, } from './errors.js';
+export const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+export const ID_JAG_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id-jag';
+export const TOKEN_TYPE_ID_TOKEN = 'urn:ietf:params:oauth:token-type:id_token';
+export const TOKEN_TYPE_REFRESH_TOKEN = 'urn:ietf:params:oauth:token-type:refresh_token';
+export const TOKEN_TYPE_ACCESS_TOKEN = 'urn:ietf:params:oauth:token-type:access_token';
+export const TOKEN_TYPE_JWT = 'urn:ietf:params:oauth:token-type:jwt';
+export const TOKEN_TYPE_SAML1 = 'urn:ietf:params:oauth:token-type:saml1';
+export const TOKEN_TYPE_SAML2 = 'urn:ietf:params:oauth:token-type:saml2';
+export const ACTOR_TOKEN_TYPES_SUPPORTED = [
+    TOKEN_TYPE_ACCESS_TOKEN,
+    TOKEN_TYPE_REFRESH_TOKEN,
+    TOKEN_TYPE_ID_TOKEN,
+    TOKEN_TYPE_JWT,
+    TOKEN_TYPE_SAML1,
+    TOKEN_TYPE_SAML2,
+];
+export const ID_JAG_JWT_TYP = 'oauth-id-jag+jwt';
+export const ID_JAG_GRANT_PROFILE = 'urn:ietf:params:oauth:grant-profile:id-jag';
+const ID_JAG_SIGNING_ALG = 'RS256';
+const WEB_CRYPTO_ALGORITHM = 'RSASSA-PKCS1-v1_5';
+export function matchesIdJagIssuanceRequest(params) {
+    return (params['grant_type'] === TOKEN_EXCHANGE_GRANT_TYPE &&
+        optional(params['requested_token_type']) === ID_JAG_TOKEN_TYPE);
+}
+export function authorizeIdJagIssuanceClient(client) {
+    const grantTypes = client.grantTypes ?? ['authorization_code'];
+    if (!grantTypes.includes(TOKEN_EXCHANGE_GRANT_TYPE)) {
+        throw new IdJagError('unauthorized_client', 'The client is not authorized to use the token-exchange grant type');
+    }
+    if (client.tokenEndpointAuthMethod === 'none') {
+        throw new IdJagError('unauthorized_client', 'Public clients are not allowed to request an ID-JAG');
+    }
+}
+export function parseIdJagIssuanceParams(params, options = {}) {
+    const subjectToken = optional(params['subject_token']);
+    if (subjectToken === undefined) {
+        throw new IdJagError('invalid_request', 'subject_token is required');
+    }
+    const subjectTokenType = optional(params['subject_token_type']);
+    if (subjectTokenType === undefined) {
+        throw new IdJagError('invalid_request', 'subject_token_type is required');
+    }
+    const supportedSubjectTypes = [
+        TOKEN_TYPE_ID_TOKEN,
+        ...(options.allowRefreshTokenSubjects === true ? [TOKEN_TYPE_REFRESH_TOKEN] : []),
+    ];
+    if (!supportedSubjectTypes.includes(subjectTokenType)) {
+        throw new IdJagError('invalid_request', `Unsupported subject_token_type for ID-JAG issuance. Only ${supportedSubjectTypes.join(' or ')} is supported.`);
+    }
+    const audience = optional(params['audience']);
+    if (audience === undefined) {
+        throw new IdJagError('invalid_request', 'audience is required');
+    }
+    const resource = optional(params['resource']);
+    if (resource !== undefined && !isAbsoluteUriWithoutFragment(resource)) {
+        throw new IdJagError('invalid_request', 'resource must be an absolute URI without a fragment component');
+    }
+    const actorToken = optional(params['actor_token']);
+    const actorTokenType = optional(params['actor_token_type']);
+    if (options.allowActorTokens !== true) {
+        if (actorToken !== undefined || actorTokenType !== undefined) {
+            throw new IdJagError('invalid_request', 'actor_token is not supported for ID-JAG issuance');
+        }
+    }
+    else {
+        if (actorToken !== undefined && actorTokenType === undefined) {
+            throw new IdJagError('invalid_request', 'actor_token_type is required when actor_token is present');
+        }
+        if (actorToken === undefined && actorTokenType !== undefined) {
+            throw new IdJagError('invalid_request', 'actor_token_type must not be present without actor_token');
+        }
+        if (actorTokenType !== undefined &&
+            !ACTOR_TOKEN_TYPES_SUPPORTED.includes(actorTokenType)) {
+            throw new IdJagError('invalid_request', `Unsupported actor_token_type for ID-JAG issuance. Supported values are ${ACTOR_TOKEN_TYPES_SUPPORTED.join(', ')}.`);
+        }
+    }
+    if (optional(params['authorization_details']) !== undefined) {
+        throw new IdJagError('invalid_request', 'authorization_details is not supported for ID-JAG issuance');
+    }
+    return {
+        subjectToken,
+        subjectTokenType: subjectTokenType,
+        audience,
+        scope: optional(params['scope']),
+        resource,
+        ...(actorToken === undefined
+            ? {}
+            : { actorToken, actorTokenType: actorTokenType }),
+    };
+}
+export async function resolveIdJagSubject(options) {
+    let payload;
+    try {
+        payload = await validateIdTokenHint(options.subjectToken, {
+            expectedIss: options.issuer,
+            expectedAud: options.clientId,
+            jwks: options.jwks,
+        });
+    }
+    catch (error) {
+        if (error instanceof IdTokenHintError) {
+            throw new IdJagError('invalid_request', SUBJECT_TOKEN_INVALID_DESCRIPTION);
+        }
+        throw error;
+    }
+    const authTime = typeof payload['auth_time'] === 'number' ? payload['auth_time'] : undefined;
+    const acr = typeof payload['acr'] === 'string' ? payload['acr'] : undefined;
+    const amr = Array.isArray(payload['amr']) && payload['amr'].every((v) => typeof v === 'string')
+        ? payload['amr']
+        : undefined;
+    return {
+        sub: payload.sub,
+        ...(authTime === undefined ? {} : { authTime }),
+        ...(acr === undefined ? {} : { acr }),
+        ...(amr === undefined ? {} : { amr }),
+    };
+}
+export async function resolveIdJagSubjectFromRefreshToken(options) {
+    let info;
+    try {
+        const resolved = await resolveRefreshToken({
+            grant_type: 'refresh_token',
+            refresh_token: options.refreshToken,
+        }, options.refreshTokenResolver);
+        info = resolved.refreshTokenInfo;
+        await validateRefreshTokenUnused(info, options.refreshTokenResolver);
+        validateRefreshTokenClient(info, options.clientId);
+        validateRefreshTokenExpiration(info, Math.floor((options.now ?? new Date()).getTime() / 1000));
+        await validateRefreshTokenSession(info, options.authenticationSessionResolver);
+    }
+    catch (error) {
+        if (error instanceof TokenError) {
+            throw invalidSubjectToken();
+        }
+        throw error;
+    }
+    if (!info.scope.includes('openid')) {
+        throw invalidSubjectToken();
+    }
+    return {
+        sub: info.subject,
+        authTime: info.authTime,
+        ...(info.acr === undefined ? {} : { acr: info.acr }),
+        ...(info.amr === undefined ? {} : { amr: info.amr }),
+    };
+}
+export async function resolveIdJagActor(options) {
+    let payload;
+    try {
+        payload = await validateIdTokenHint(options.actorToken, {
+            expectedIss: options.issuer,
+            expectedAud: options.clientId,
+            jwks: options.jwks,
+        });
+    }
+    catch (error) {
+        if (error instanceof IdTokenHintError) {
+            throw new IdJagError('invalid_request', ACTOR_TOKEN_INVALID_DESCRIPTION);
+        }
+        throw error;
+    }
+    return { sub: payload.sub };
+}
+export async function resolveIdJagActorToken(options) {
+    if (options.resolver === undefined) {
+        throw new IdJagError('invalid_request', ACTOR_TOKEN_INVALID_DESCRIPTION);
+    }
+    const resolved = await options.resolver({
+        actorToken: options.actorToken,
+        actorTokenType: options.actorTokenType,
+        clientId: options.clientId,
+        issuer: options.issuer,
+        jwks: options.jwks,
+    });
+    if (resolved === null) {
+        throw new IdJagError('invalid_request', ACTOR_TOKEN_INVALID_DESCRIPTION);
+    }
+    const actor = copyActorChain(resolved);
+    if (actor === undefined) {
+        throw new Error('The actorTokenResolver returned a malformed actor: sub must be a non-empty string at every level of the act chain');
+    }
+    return actor;
+}
+function copyActorChain(value) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const record = value;
+    const sub = record['sub'];
+    if (typeof sub !== 'string' || sub.length === 0) {
+        return undefined;
+    }
+    if (record['act'] === undefined) {
+        return { sub };
+    }
+    const act = copyActorChain(record['act']);
+    return act === undefined ? undefined : { sub, act };
+}
+export function validateIdJagAudience(options) {
+    if (options.audience === options.issuer) {
+        throw new IdJagError('invalid_target', 'The requested audience must belong to a different trust domain than this authorization server');
+    }
+    if (!options.allowedAudiences.includes(options.audience)) {
+        throw new IdJagError('invalid_target', 'The requested audience is not allowed for ID-JAG issuance');
+    }
+}
+export function validateIdJagScope(requestedScope, allowedScopes) {
+    const requested = splitScope(requestedScope);
+    if (allowedScopes === undefined) {
+        return requested;
+    }
+    for (const value of requested) {
+        if (!allowedScopes.includes(value)) {
+            throw new IdJagError('invalid_scope', 'The requested scope exceeds the scopes allowed for ID-JAG issuance');
+        }
+    }
+    return requested;
+}
+export function buildIdJagClaims(options) {
+    if (!Number.isInteger(options.lifetimeSeconds) || options.lifetimeSeconds <= 0) {
+        throw new RangeError(`lifetimeSeconds must be a positive integer, received ${options.lifetimeSeconds}`);
+    }
+    const issuedAt = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    return {
+        iss: options.issuer,
+        sub: options.subject.sub,
+        aud: options.audience,
+        client_id: options.clientId,
+        jti: generateRandomString(32),
+        exp: issuedAt + options.lifetimeSeconds,
+        iat: issuedAt,
+        ...(options.scope.length === 0 ? {} : { scope: options.scope.join(' ') }),
+        ...(options.resource === undefined ? {} : { resource: options.resource }),
+        ...(options.subject.authTime === undefined ? {} : { auth_time: options.subject.authTime }),
+        ...(options.subject.acr === undefined ? {} : { acr: options.subject.acr }),
+        ...(options.subject.amr === undefined ? {} : { amr: options.subject.amr }),
+        ...(options.actor === undefined ? {} : { act: options.actor }),
+    };
+}
+export async function createIdJagJwt(options) {
+    const encodedHeader = base64UrlFromJson({
+        alg: ID_JAG_SIGNING_ALG,
+        typ: ID_JAG_JWT_TYP,
+        kid: options.signingKey.keyId,
+    });
+    const encodedPayload = base64UrlFromJson(options.claims);
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const signature = await crypto.subtle.sign(WEB_CRYPTO_ALGORITHM, options.signingKey.privateKey, new TextEncoder().encode(signingInput));
+    return `${signingInput}.${base64UrlFromBytes(new Uint8Array(signature))}`;
+}
+export function buildIdJagIssuanceResponse(options) {
+    return {
+        access_token: options.idJag,
+        issued_token_type: ID_JAG_TOKEN_TYPE,
+        token_type: 'N_A',
+        expires_in: options.expiresIn,
+        scope: options.scope.join(' '),
+    };
+}
+export async function processIdJagIssuanceRequest(context) {
+    authorizeIdJagIssuanceClient(context.client);
+    const parsed = parseIdJagIssuanceParams(context.params, {
+        allowRefreshTokenSubjects: context.refreshTokenResolver !== undefined,
+        allowActorTokens: context.allowActorTokens === true,
+    });
+    const subject = parsed.subjectTokenType === TOKEN_TYPE_REFRESH_TOKEN
+        ? await resolveIdJagSubjectFromRefreshToken({
+            refreshToken: parsed.subjectToken,
+            clientId: context.client.clientId,
+            refreshTokenResolver: context.refreshTokenResolver,
+            ...(context.authenticationSessionResolver === undefined
+                ? {}
+                : { authenticationSessionResolver: context.authenticationSessionResolver }),
+            ...(context.now === undefined ? {} : { now: context.now }),
+        })
+        : await resolveIdJagSubject({
+            subjectToken: parsed.subjectToken,
+            issuer: context.issuer,
+            clientId: context.client.clientId,
+            jwks: context.jwks,
+        });
+    const actor = parsed.actorToken === undefined
+        ? undefined
+        : await resolveIdJagActorToken({
+            actorToken: parsed.actorToken,
+            actorTokenType: parsed.actorTokenType,
+            clientId: context.client.clientId,
+            issuer: context.issuer,
+            jwks: context.jwks,
+            ...(context.actorTokenResolver === undefined
+                ? {}
+                : { resolver: context.actorTokenResolver }),
+        });
+    validateIdJagAudience({
+        audience: parsed.audience,
+        issuer: context.issuer,
+        allowedAudiences: context.allowedAudiences,
+    });
+    const scope = validateIdJagScope(parsed.scope, context.allowedScopes);
+    const claims = buildIdJagClaims({
+        issuer: context.issuer,
+        subject,
+        audience: parsed.audience,
+        clientId: context.client.clientId,
+        scope,
+        ...(parsed.resource === undefined ? {} : { resource: parsed.resource }),
+        ...(actor === undefined ? {} : { actor }),
+        lifetimeSeconds: context.lifetimeSeconds,
+        ...(context.now === undefined ? {} : { now: context.now }),
+    });
+    const idJag = await createIdJagJwt({
+        claims,
+        signingKey: context.signingKey,
+    });
+    return buildIdJagIssuanceResponse({
+        idJag,
+        expiresIn: context.lifetimeSeconds,
+        scope,
+    });
+}
+function optional(value) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+function invalidSubjectToken() {
+    return new IdJagError('invalid_request', SUBJECT_TOKEN_INVALID_DESCRIPTION);
+}
+function splitScope(scope) {
+    if (scope === undefined)
+        return [];
+    return [...new Set(scope.split(/\s+/).filter((value) => value.length > 0))];
+}
+function isAbsoluteUriWithoutFragment(value) {
+    if (value.includes('#'))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol.length > 0;
+}
+function base64UrlFromBytes(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64UrlFromJson(value) {
+    return base64UrlFromBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+//# sourceMappingURL=issue-id-jag.js.map

package/dist/id-jag/issue-id-jag.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"issue-id-jag.js","sourceRoot":"","sources":["../../src/id-jag/issue-id-jag.ts"],"names":[],"mappings":"AAyBA,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,GAQ3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,+BAA+B,EAC/B,UAAU,EACV,iCAAiC,GAClC,MAAM,aAAa,CAAC;AAGrB,MAAM,CAAC,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAG3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,yCAAyC,CAAC;AAG3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,2CAA2C,CAAC;AAW/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,gDAAgD,CAAC;AAGzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAGvF,MAAM,CAAC,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAGrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAGzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAUzE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,uBAAuB;IACvB,wBAAwB;IACxB,mBAAmB;IACnB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AAOX,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAMjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAUjF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAGnC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAqLjD,MAAM,UAAU,2BAA2B,CAAC,MAA8B;IACxE,OAAO,CACL,MAAM,CAAC,YAAY,CAAC,KAAK,yBAAyB;QAClD,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,iBAAiB,CAC/D,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,4BAA4B,CAAC,MAAuB;IAIlE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,qDAAqD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAYD,MAAM,UAAU,wBAAwB,CACtC,MAA8B,EAC9B,UAAqC,EAAE;IAEvC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IAGD,MAAM,qBAAqB,GAAa;QACtC,mBAAmB;QACnB,GAAG,CAAC,OAAO,CAAC,yBAAyB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;IACF,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,4DAA4D,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC/G,CAAC;IACJ,CAAC;IAID,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAEtE,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAItC,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,kDAAkD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QAGN,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAGD,IACE,cAAc,KAAK,SAAS;YAC5B,CAAE,2BAAiD,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC5E,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,0EAA0E,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;IAID,IAAI,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,gBAAgB,EAAE,gBAAiE;QACnF,QAAQ;QACR,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,QAAQ;QAER,GAAG,CAAC,UAAU,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,cAAwB,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAKzC;IACC,IAAI,OAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE;YACxD,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAID,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,GAAG,GACP,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,CAAC,CAAE,OAAO,CAAC,KAAK,CAAc;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,OAMzD;IACC,IAAI,IAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC;YACE,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;SACd,EACvB,OAAO,CAAC,oBAAoB,CAC7B,CAAC;QACF,IAAI,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAIjC,MAAM,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrE,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,8BAA8B,CAC5B,IAAI,EACJ,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CACzD,CAAC;QAGF,MAAM,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,MAAM,mBAAmB,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAKvC;IACC,IAAI,OAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,UAAU,EAAE;YACtD,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9B,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAO5C;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAC,OAIrC;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAGxC,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,kBAAkB,CAChC,cAAkC,EAClC,aAAmC;IAEnC,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,oEAAoE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,MAAM,UAAU,gBAAgB,CAAC,OAWhC;IACC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,UAAU,CAClB,wDAAwD,OAAO,CAAC,eAAe,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG;QACxB,GAAG,EAAE,OAAO,CAAC,QAAQ;QACrB,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC7B,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe;QACvC,GAAG,EAAE,QAAQ;QACb,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1F,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAGpC;IACC,MAAM,aAAa,GAAG,iBAAiB,CAAC;QACtC,GAAG,EAAE,kBAAkB;QACvB,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;KAC9B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAA4C,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAE1D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,oBAAoB,EACpB,OAAO,CAAC,UAAU,CAAC,UAAU,EAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAC;IAEF,OAAO,GAAG,YAAY,IAAI,kBAAkB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAUD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,KAAK;QAC3B,iBAAiB,EAAE,iBAAiB;QACpC,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6B;IAI7B,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,EAAE;QACtD,yBAAyB,EAAE,OAAO,CAAC,oBAAoB,KAAK,SAAS;QACrE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,KAAK,IAAI;KACpD,CAAC,CAAC;IAEH,MAAM,OAAO,GACX,MAAM,CAAC,gBAAgB,KAAK,wBAAwB;QAClD,CAAC,CAAC,MAAM,mCAAmC,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YAEjC,oBAAoB,EAAE,OAAO,CAAC,oBAA4C;YAC1E,GAAG,CAAC,OAAO,CAAC,6BAA6B,KAAK,SAAS;gBACrD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,6BAA6B,EAAE,OAAO,CAAC,6BAA6B,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,CAAC;QACJ,CAAC,CAAC,MAAM,mBAAmB,CAAC;YACxB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IAKT,MAAM,KAAK,GACT,MAAM,CAAC,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,sBAAsB,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAE7B,cAAc,EAAE,MAAM,CAAC,cAAwB;YAC/C,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC9C,CAAC,CAAC;IAET,qBAAqB,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,gBAAgB,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KAC3D,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC;QACjC,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;QAChC,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,eAAe;QAClC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAMD,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B;IACvD,OAAO,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/id-jag/redeem-id-jag.d.ts ADDED Viewed

@@ -0,0 +1,65 @@
+import { type AccessTokenInfo, type JwkSet, type TokenClientInfo } from '@maronn-openid-connect/core';
+import { type IdJagActor } from './issue-id-jag.js';
+export declare const JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+export declare const DEFAULT_ASSERTION_CLOCK_SKEW_SEC = 60;
+export interface IdJagTrustedIdentityProvider {
+    issuer: string;
+    jwks: JwkSet;
+}
+export interface ParsedIdJagRedemptionParams {
+    assertion: string;
+    scope?: string;
+}
+export interface IdJagAssertionPayload {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    client_id: string;
+    jti: string;
+    exp: number;
+    iat: number;
+    scope?: string;
+    resource?: string | string[];
+    auth_time?: number;
+    acr?: string;
+    amr?: string[];
+    act?: IdJagActor;
+}
+export interface IdJagRedemptionGrant {
+    subject: string;
+    clientId: string;
+    scope: string[];
+    requestedResources?: string[];
+    expiresIn: number;
+    idpIssuer: string;
+    jti: string;
+    authTime?: number;
+    acr?: string;
+    amr?: string[];
+    actor?: IdJagActor;
+}
+export type IdJagAccessTokenInfo = AccessTokenInfo & {
+    act?: IdJagActor;
+};
+export interface IdJagRedemptionContext {
+    params: Record<string, string>;
+    client: TokenClientInfo;
+    issuer: string;
+    identityProviders: IdJagTrustedIdentityProvider[];
+    configuredExpiresIn: number;
+    now?: Date;
+    clockSkewToleranceSec?: number;
+}
+export declare function authorizeIdJagRedemptionClient(client: TokenClientInfo): void;
+export declare function parseIdJagRedemptionParams(params: Record<string, string>): ParsedIdJagRedemptionParams;
+export declare function verifyIdJagAssertion(options: {
+    assertion: string;
+    issuer: string;
+    clientId: string;
+    identityProviders: IdJagTrustedIdentityProvider[];
+    now?: Date;
+    clockSkewToleranceSec?: number;
+}): Promise<IdJagAssertionPayload>;
+export declare function resolveIdJagGrantScope(requestedScope: string | undefined, assertionScope: string | undefined): string[];
+export declare function processIdJagRedemptionRequest(context: IdJagRedemptionContext): Promise<IdJagRedemptionGrant>;
+//# sourceMappingURL=redeem-id-jag.d.ts.map

package/dist/id-jag/redeem-id-jag.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"redeem-id-jag.d.ts","sourceRoot":"","sources":["../../src/id-jag/redeem-id-jag.ts"],"names":[],"mappings":"AAqBA,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,MAAM,EACX,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpE,eAAO,MAAM,qBAAqB,gDAAgD,CAAC;AAMnF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AASnD,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAMD,MAAM,WAAW,oBAAoB;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAM9B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAOf,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AASD,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IACnD,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,CAAC;AAGF,MAAM,WAAW,sBAAsB;IAErC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IAExB,MAAM,EAAE,MAAM,CAAC;IAEf,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAElD,mBAAmB,EAAE,MAAM,CAAC;IAE5B,GAAG,CAAC,EAAE,IAAI,CAAC;IAEX,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAmBD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAgB5E;AAOD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,2BAA2B,CAkB7B;AAgCD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAClD,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyKjC;AAeD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,EAAE,CAeV;AAaD,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CA8C/B"}

package/dist/id-jag/redeem-id-jag.js ADDED Viewed

@@ -0,0 +1,305 @@
+import { extractAlgorithmParamsFromJwk, } from '@maronn-openid-connect/core';
+import { ASSERTION_UNTRUSTED_DESCRIPTION, IdJagError, } from './errors.js';
+import { ID_JAG_JWT_TYP } from './issue-id-jag.js';
+export const JWT_BEARER_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+export const DEFAULT_ASSERTION_CLOCK_SKEW_SEC = 60;
+const FORBIDDEN_KEY_HEADERS = ['jku', 'x5u', 'jwk', 'x5c'];
+export function authorizeIdJagRedemptionClient(client) {
+    const grantTypes = client.grantTypes ?? ['authorization_code'];
+    if (!grantTypes.includes(JWT_BEARER_GRANT_TYPE)) {
+        throw new IdJagError('unauthorized_client', 'The client is not authorized to use the jwt-bearer grant type');
+    }
+    if (client.tokenEndpointAuthMethod === 'none') {
+        throw new IdJagError('unauthorized_client', 'Public clients are not allowed to use the jwt-bearer grant type');
+    }
+}
+export function parseIdJagRedemptionParams(params) {
+    const assertion = optional(params['assertion']);
+    if (assertion === undefined) {
+        throw new IdJagError('invalid_request', 'assertion is required');
+    }
+    if (optional(params['authorization_details']) !== undefined) {
+        throw new IdJagError('invalid_request', 'authorization_details is not supported for the jwt-bearer grant');
+    }
+    return {
+        assertion,
+        scope: optional(params['scope']),
+    };
+}
+export async function verifyIdJagAssertion(options) {
+    const leeway = options.clockSkewToleranceSec ?? DEFAULT_ASSERTION_CLOCK_SKEW_SEC;
+    const parts = options.assertion.split('.');
+    if (parts.length !== 3) {
+        throw invalidAssertion('The provided assertion is not a valid JWS compact serialization');
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    let header;
+    let payload;
+    try {
+        header = parseBase64UrlJson(headerB64);
+        payload = parseBase64UrlJson(payloadB64);
+    }
+    catch {
+        throw invalidAssertion('The provided assertion is not a valid JWS compact serialization');
+    }
+    if (!isIdJagTyp(header['typ'])) {
+        throw invalidAssertion(`The assertion typ must be ${ID_JAG_JWT_TYP}`);
+    }
+    const headerAlg = typeof header['alg'] === 'string' ? header['alg'] : undefined;
+    if (!headerAlg || headerAlg === 'none') {
+        throw invalidAssertion('The assertion alg is missing or "none"');
+    }
+    for (const field of FORBIDDEN_KEY_HEADERS) {
+        if (field in header) {
+            throw invalidAssertion(`The assertion JOSE header contains unsupported field: ${field}`);
+        }
+    }
+    const iss = payload['iss'];
+    if (typeof iss !== 'string' || iss.length === 0) {
+        throw invalidAssertion(ASSERTION_UNTRUSTED_DESCRIPTION);
+    }
+    if (iss === options.issuer) {
+        throw invalidAssertion('An assertion issued by this authorization server cannot be redeemed here');
+    }
+    const identityProvider = options.identityProviders.find((idp) => idp.issuer === iss);
+    if (identityProvider === undefined) {
+        throw invalidAssertion(ASSERTION_UNTRUSTED_DESCRIPTION);
+    }
+    const headerKid = typeof header['kid'] === 'string' ? header['kid'] : undefined;
+    const candidates = headerKid
+        ? identityProvider.jwks.keys.filter((key) => key.kid === headerKid)
+        : identityProvider.jwks.keys.filter((key) => key.alg === headerAlg);
+    const signingInput = `${headerB64}.${payloadB64}`;
+    let signatureValid = false;
+    for (const jwk of candidates) {
+        if (jwk.alg !== headerAlg) {
+            continue;
+        }
+        if (await verifySignature(signingInput, signatureB64, jwk)) {
+            signatureValid = true;
+            break;
+        }
+    }
+    if (!signatureValid) {
+        throw invalidAssertion(ASSERTION_UNTRUSTED_DESCRIPTION);
+    }
+    const aud = payload['aud'];
+    const audMatches = aud === options.issuer ||
+        (Array.isArray(aud) && aud.length === 1 && aud[0] === options.issuer);
+    if (!audMatches) {
+        throw invalidAssertion('The assertion audience does not match this authorization server');
+    }
+    const nowSeconds = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    const exp = payload['exp'];
+    if (typeof exp !== 'number') {
+        throw invalidAssertion('The assertion is missing an exp claim');
+    }
+    if (exp + leeway < nowSeconds) {
+        throw invalidAssertion('The assertion has expired');
+    }
+    const iat = payload['iat'];
+    if (typeof iat !== 'number') {
+        throw invalidAssertion('The assertion is missing an iat claim');
+    }
+    if (iat > nowSeconds + leeway) {
+        throw invalidAssertion('The assertion iat is in the future');
+    }
+    const nbf = payload['nbf'];
+    if (nbf !== undefined) {
+        if (typeof nbf !== 'number' || nbf > nowSeconds + leeway) {
+            throw invalidAssertion('The assertion is not yet valid');
+        }
+    }
+    const jti = payload['jti'];
+    if (typeof jti !== 'string' || jti.length === 0) {
+        throw invalidAssertion('The assertion is missing a jti claim');
+    }
+    const sub = payload['sub'];
+    if (typeof sub !== 'string' || sub.length === 0) {
+        throw invalidAssertion('The assertion is missing a sub claim');
+    }
+    const clientId = payload['client_id'];
+    if (typeof clientId !== 'string' || clientId.length === 0) {
+        throw invalidAssertion('The assertion is missing a client_id claim');
+    }
+    if (clientId !== options.clientId) {
+        throw invalidAssertion('The assertion client_id does not match the authenticated client');
+    }
+    const scope = payload['scope'];
+    if (scope !== undefined && typeof scope !== 'string') {
+        throw invalidAssertion('The assertion scope claim must be a string');
+    }
+    const resource = payload['resource'];
+    if (resource !== undefined &&
+        typeof resource !== 'string' &&
+        !(Array.isArray(resource) && resource.every((value) => typeof value === 'string'))) {
+        throw invalidAssertion('The assertion resource claim must be a string or an array of strings');
+    }
+    const authTime = typeof payload['auth_time'] === 'number' ? payload['auth_time'] : undefined;
+    const acr = typeof payload['acr'] === 'string' ? payload['acr'] : undefined;
+    const amr = Array.isArray(payload['amr']) && payload['amr'].every((value) => typeof value === 'string')
+        ? payload['amr']
+        : undefined;
+    const act = payload['act'];
+    if (act !== undefined && !isValidActorChain(act)) {
+        throw invalidAssertion('The assertion act claim is malformed');
+    }
+    return {
+        iss,
+        sub,
+        aud: aud,
+        client_id: clientId,
+        jti,
+        exp,
+        iat,
+        ...(scope === undefined ? {} : { scope }),
+        ...(resource === undefined ? {} : { resource: resource }),
+        ...(authTime === undefined ? {} : { auth_time: authTime }),
+        ...(acr === undefined ? {} : { acr }),
+        ...(amr === undefined ? {} : { amr }),
+        ...(act === undefined ? {} : { act: act }),
+    };
+}
+export function resolveIdJagGrantScope(requestedScope, assertionScope) {
+    const granted = splitScope(assertionScope).filter((value) => value !== 'offline_access');
+    const requested = splitScope(requestedScope);
+    if (requested.length === 0) {
+        return granted;
+    }
+    for (const value of requested) {
+        if (!granted.includes(value)) {
+            throw new IdJagError('invalid_scope', 'The requested scope exceeds the scope of the assertion');
+        }
+    }
+    return requested;
+}
+export async function processIdJagRedemptionRequest(context) {
+    if (!Number.isInteger(context.configuredExpiresIn) || context.configuredExpiresIn <= 0) {
+        throw new RangeError(`configuredExpiresIn must be a positive integer, received ${context.configuredExpiresIn}`);
+    }
+    authorizeIdJagRedemptionClient(context.client);
+    const parsed = parseIdJagRedemptionParams(context.params);
+    const assertion = await verifyIdJagAssertion({
+        assertion: parsed.assertion,
+        issuer: context.issuer,
+        clientId: context.client.clientId,
+        identityProviders: context.identityProviders,
+        ...(context.now === undefined ? {} : { now: context.now }),
+        ...(context.clockSkewToleranceSec === undefined
+            ? {}
+            : { clockSkewToleranceSec: context.clockSkewToleranceSec }),
+    });
+    const scope = resolveIdJagGrantScope(parsed.scope, assertion.scope);
+    const requestedResources = assertion.resource === undefined
+        ? undefined
+        : typeof assertion.resource === 'string'
+            ? [assertion.resource]
+            : [...assertion.resource];
+    return {
+        subject: assertion.sub,
+        clientId: context.client.clientId,
+        scope,
+        ...(requestedResources === undefined ? {} : { requestedResources }),
+        expiresIn: context.configuredExpiresIn,
+        idpIssuer: assertion.iss,
+        jti: assertion.jti,
+        ...(assertion.auth_time === undefined ? {} : { authTime: assertion.auth_time }),
+        ...(assertion.acr === undefined ? {} : { acr: assertion.acr }),
+        ...(assertion.amr === undefined ? {} : { amr: assertion.amr }),
+        ...(assertion.act === undefined ? {} : { actor: assertion.act }),
+    };
+}
+function optional(value) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+function splitScope(scope) {
+    if (scope === undefined)
+        return [];
+    return [...new Set(scope.split(/\s+/).filter((value) => value.length > 0))];
+}
+function invalidAssertion(description) {
+    return new IdJagError('invalid_grant', description);
+}
+function isValidActorChain(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const actor = value;
+    if (typeof actor.sub !== 'string' || actor.sub.length === 0) {
+        return false;
+    }
+    if (actor.act !== undefined && !isValidActorChain(actor.act)) {
+        return false;
+    }
+    return true;
+}
+function isIdJagTyp(typ) {
+    if (typeof typ !== 'string')
+        return false;
+    const normalized = typ.toLowerCase();
+    return normalized === ID_JAG_JWT_TYP || normalized === `application/${ID_JAG_JWT_TYP}`;
+}
+function parseBase64UrlJson(segment) {
+    if (!/^[A-Za-z0-9_-]+$/.test(segment)) {
+        throw new Error('invalid base64url');
+    }
+    const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    const parsed = JSON.parse(new TextDecoder().decode(bytes));
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error('not a JSON object');
+    }
+    return parsed;
+}
+function base64UrlToArrayBuffer(segment) {
+    if (!/^[A-Za-z0-9_-]*$/.test(segment)) {
+        throw new Error('invalid base64url');
+    }
+    const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
+async function verifySignature(signingInput, signatureB64, jwk) {
+    let signature;
+    try {
+        signature = base64UrlToArrayBuffer(signatureB64);
+    }
+    catch {
+        return false;
+    }
+    try {
+        const algParams = extractAlgorithmParamsFromJwk(jwk);
+        const publicKey = await crypto.subtle.importKey('jwk', jwk, algParams, false, ['verify']);
+        const algorithm = publicKey.algorithm;
+        let verifyParams;
+        if (algorithm.name === 'RSASSA-PKCS1-v1_5') {
+            verifyParams = { name: 'RSASSA-PKCS1-v1_5' };
+        }
+        else if (algorithm.name === 'ECDSA' && 'namedCurve' in algorithm) {
+            const namedCurve = algorithm.namedCurve;
+            const hash = namedCurve === 'P-256' ? 'SHA-256' : namedCurve === 'P-384' ? 'SHA-384' : 'SHA-512';
+            verifyParams = { name: 'ECDSA', hash };
+        }
+        else {
+            return false;
+        }
+        return await crypto.subtle.verify(verifyParams, publicKey, signature, new TextEncoder().encode(signingInput));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=redeem-id-jag.js.map

package/dist/id-jag/redeem-id-jag.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"redeem-id-jag.js","sourceRoot":"","sources":["../../src/id-jag/redeem-id-jag.ts"],"names":[],"mappings":"AAqBA,OAAO,EACL,6BAA6B,GAK9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,+BAA+B,EAC/B,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAmB,MAAM,mBAAmB,CAAC;AAGpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,6CAA6C,CAAC;AAMnF,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AA6GnD,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAYpE,MAAM,UAAU,8BAA8B,CAAC,MAAuB;IAGpE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,0BAA0B,CACxC,MAA8B;IAE9B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IAGD,IAAI,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KACjC,CAAC;AACJ,CAAC;AAgCD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAO1C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAEjF,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAC;IAEhF,IAAI,MAA+B,CAAC;IACpC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IAID,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,gBAAgB,CAAC,6BAA6B,cAAc,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACpB,MAAM,gBAAgB,CAAC,yDAAyD,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IAID,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,gBAAgB,CACpB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACrF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IAKD,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC;QACnE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAEtE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,MAAM,eAAe,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3D,cAAc,GAAG,IAAI,CAAC;YACtB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QAEpB,MAAM,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IAGD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GACd,GAAG,KAAK,OAAO,CAAC,MAAM;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,gBAAgB,CAAC,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,GAAG,GAAG,MAAM,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,gBAAgB,CAAC,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,GAAG,GAAG,UAAU,GAAG,MAAM,EAAE,CAAC;QAC9B,MAAM,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,UAAU,GAAG,MAAM,EAAE,CAAC;YACzD,MAAM,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACjE,CAAC;IAID,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IACE,QAAQ,KAAK,SAAS;QACtB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAClF,CAAC;QACD,MAAM,gBAAgB,CAAC,sEAAsE,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,GAAG,GACP,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACzF,CAAC,CAAE,OAAO,CAAC,KAAK,CAAc;QAC9B,CAAC,CAAC,SAAS,CAAC;IAKhB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG;QACH,GAAG,EAAE,GAAwB;QAC7B,SAAS,EAAE,QAAQ;QACnB,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAA6B,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAeD,MAAM,UAAU,sBAAsB,CACpC,cAAkC,EAClC,cAAkC;IAElC,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,wDAAwD,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,UAAU,CAClB,4DAA4D,OAAO,CAAC,mBAAmB,EAAE,CAC1F,CAAC;IACJ,CAAC;IAID,8BAA8B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;KAC9D,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,kBAAkB,GACtB,SAAS,CAAC,QAAQ,KAAK,SAAS;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACtC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;YACtB,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEhC,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG;QACtB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC;QACnE,SAAS,EAAE,OAAO,CAAC,mBAAmB;QACtC,SAAS,EAAE,SAAS,CAAC,GAAG;QACxB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC;AAMD,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,KAAyC,CAAC;IACxD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,UAAU,KAAK,cAAc,IAAI,UAAU,KAAK,eAAe,cAAc,EAAE,CAAC;AACzF,CAAC;AAGD,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAUD,KAAK,UAAU,eAAe,CAC5B,YAAoB,EACpB,YAAoB,EACpB,GAAQ;IAER,IAAI,SAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,6BAA6B,CAAC,GAA2B,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAA2B,EAC3B,SAAS,EACT,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACtC,IAAI,YAAmE,CAAC;QACxE,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC3C,YAAY,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;QAC/C,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;YACnE,MAAM,UAAU,GAAI,SAAsC,CAAC,UAAU,CAAC;YACtE,MAAM,IAAI,GACR,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,YAAY,EACZ,SAAS,EACT,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@maronn-openid-connect/experimental",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "Experimental OAuth/OIDC extensions for maronn-openid-connect (unstable APIs)",
   "type": "module",
   "exports": {
@@ -8,6 +8,10 @@
       "types": "./dist/device-authorization-grant/index.d.ts",
       "import": "./dist/device-authorization-grant/index.js"
     },
+    "./id-jag": {
+      "types": "./dist/id-jag/index.d.ts",
+      "import": "./dist/id-jag/index.js"
+    },
     "./jarm": {
       "types": "./dist/jarm/index.d.ts",
       "import": "./dist/jarm/index.js"
@@ -46,14 +50,14 @@
   },
   "homepage": "https://github.com/maronnjapan/maronn-openid-connect/tree/main/packages/experimental#readme",
   "peerDependencies": {
-    "@maronn-openid-connect/core": ">=0.1.1 <1.0.0"
+    "@maronn-openid-connect/core": ">=0.2.0 <1.0.0"
   },
   "devDependencies": {
     "@edge-runtime/vm": "^5.0.0",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "typescript": "^5.7.2",
     "vitest": "^3.2.6",
-    "@maronn-openid-connect/core": "0.1.1"
+    "@maronn-openid-connect/core": "0.2.0"
   },
   "scripts": {
     "build": "tsc",