@maronn-openid-connect/experimental 0.0.5 → 0.0.7

package/dist/id-jag/issue-id-jag.js

@@ -0,0 +1,359 @@
+import { IdTokenHintError, TokenError, generateRandomString, resolveRefreshToken, validateIdTokenHint, validateRefreshTokenClient, validateRefreshTokenExpiration, validateRefreshTokenSession, validateRefreshTokenUnused, } from '@maronn-openid-connect/core';
+import { ACTOR_TOKEN_INVALID_DESCRIPTION, IdJagError, SUBJECT_TOKEN_INVALID_DESCRIPTION, } from './errors.js';
+export const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+export const ID_JAG_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id-jag';
+export const TOKEN_TYPE_ID_TOKEN = 'urn:ietf:params:oauth:token-type:id_token';
+export const TOKEN_TYPE_REFRESH_TOKEN = 'urn:ietf:params:oauth:token-type:refresh_token';
+export const TOKEN_TYPE_ACCESS_TOKEN = 'urn:ietf:params:oauth:token-type:access_token';
+export const TOKEN_TYPE_JWT = 'urn:ietf:params:oauth:token-type:jwt';
+export const TOKEN_TYPE_SAML1 = 'urn:ietf:params:oauth:token-type:saml1';
+export const TOKEN_TYPE_SAML2 = 'urn:ietf:params:oauth:token-type:saml2';
+export const ACTOR_TOKEN_TYPES_SUPPORTED = [
+    TOKEN_TYPE_ACCESS_TOKEN,
+    TOKEN_TYPE_REFRESH_TOKEN,
+    TOKEN_TYPE_ID_TOKEN,
+    TOKEN_TYPE_JWT,
+    TOKEN_TYPE_SAML1,
+    TOKEN_TYPE_SAML2,
+];
+export const ID_JAG_JWT_TYP = 'oauth-id-jag+jwt';
+export const ID_JAG_GRANT_PROFILE = 'urn:ietf:params:oauth:grant-profile:id-jag';
+const ID_JAG_SIGNING_ALG = 'RS256';
+const WEB_CRYPTO_ALGORITHM = 'RSASSA-PKCS1-v1_5';
+export function matchesIdJagIssuanceRequest(params) {
+    return (params['grant_type'] === TOKEN_EXCHANGE_GRANT_TYPE &&
+        optional(params['requested_token_type']) === ID_JAG_TOKEN_TYPE);
+}
+export function authorizeIdJagIssuanceClient(client) {
+    const grantTypes = client.grantTypes ?? ['authorization_code'];
+    if (!grantTypes.includes(TOKEN_EXCHANGE_GRANT_TYPE)) {
+        throw new IdJagError('unauthorized_client', 'The client is not authorized to use the token-exchange grant type');
+    }
+    if (client.tokenEndpointAuthMethod === 'none') {
+        throw new IdJagError('unauthorized_client', 'Public clients are not allowed to request an ID-JAG');
+    }
+}
+export function parseIdJagIssuanceParams(params, options = {}) {
+    const subjectToken = optional(params['subject_token']);
+    if (subjectToken === undefined) {
+        throw new IdJagError('invalid_request', 'subject_token is required');
+    }
+    const subjectTokenType = optional(params['subject_token_type']);
+    if (subjectTokenType === undefined) {
+        throw new IdJagError('invalid_request', 'subject_token_type is required');
+    }
+    const supportedSubjectTypes = [
+        TOKEN_TYPE_ID_TOKEN,
+        ...(options.allowRefreshTokenSubjects === true ? [TOKEN_TYPE_REFRESH_TOKEN] : []),
+    ];
+    if (!supportedSubjectTypes.includes(subjectTokenType)) {
+        throw new IdJagError('invalid_request', `Unsupported subject_token_type for ID-JAG issuance. Only ${supportedSubjectTypes.join(' or ')} is supported.`);
+    }
+    const audience = optional(params['audience']);
+    if (audience === undefined) {
+        throw new IdJagError('invalid_request', 'audience is required');
+    }
+    const resource = optional(params['resource']);
+    if (resource !== undefined && !isAbsoluteUriWithoutFragment(resource)) {
+        throw new IdJagError('invalid_request', 'resource must be an absolute URI without a fragment component');
+    }
+    const actorToken = optional(params['actor_token']);
+    const actorTokenType = optional(params['actor_token_type']);
+    if (options.allowActorTokens !== true) {
+        if (actorToken !== undefined || actorTokenType !== undefined) {
+            throw new IdJagError('invalid_request', 'actor_token is not supported for ID-JAG issuance');
+        }
+    }
+    else {
+        if (actorToken !== undefined && actorTokenType === undefined) {
+            throw new IdJagError('invalid_request', 'actor_token_type is required when actor_token is present');
+        }
+        if (actorToken === undefined && actorTokenType !== undefined) {
+            throw new IdJagError('invalid_request', 'actor_token_type must not be present without actor_token');
+        }
+        if (actorTokenType !== undefined &&
+            !ACTOR_TOKEN_TYPES_SUPPORTED.includes(actorTokenType)) {
+            throw new IdJagError('invalid_request', `Unsupported actor_token_type for ID-JAG issuance. Supported values are ${ACTOR_TOKEN_TYPES_SUPPORTED.join(', ')}.`);
+        }
+    }
+    if (optional(params['authorization_details']) !== undefined) {
+        throw new IdJagError('invalid_request', 'authorization_details is not supported for ID-JAG issuance');
+    }
+    return {
+        subjectToken,
+        subjectTokenType: subjectTokenType,
+        audience,
+        scope: optional(params['scope']),
+        resource,
+        ...(actorToken === undefined
+            ? {}
+            : { actorToken, actorTokenType: actorTokenType }),
+    };
+}
+export async function resolveIdJagSubject(options) {
+    let payload;
+    try {
+        payload = await validateIdTokenHint(options.subjectToken, {
+            expectedIss: options.issuer,
+            expectedAud: options.clientId,
+            jwks: options.jwks,
+        });
+    }
+    catch (error) {
+        if (error instanceof IdTokenHintError) {
+            throw new IdJagError('invalid_request', SUBJECT_TOKEN_INVALID_DESCRIPTION);
+        }
+        throw error;
+    }
+    const authTime = typeof payload['auth_time'] === 'number' ? payload['auth_time'] : undefined;
+    const acr = typeof payload['acr'] === 'string' ? payload['acr'] : undefined;
+    const amr = Array.isArray(payload['amr']) && payload['amr'].every((v) => typeof v === 'string')
+        ? payload['amr']
+        : undefined;
+    return {
+        sub: payload.sub,
+        ...(authTime === undefined ? {} : { authTime }),
+        ...(acr === undefined ? {} : { acr }),
+        ...(amr === undefined ? {} : { amr }),
+    };
+}
+export async function resolveIdJagSubjectFromRefreshToken(options) {
+    let info;
+    try {
+        const resolved = await resolveRefreshToken({
+            grant_type: 'refresh_token',
+            refresh_token: options.refreshToken,
+        }, options.refreshTokenResolver);
+        info = resolved.refreshTokenInfo;
+        await validateRefreshTokenUnused(info, options.refreshTokenResolver);
+        validateRefreshTokenClient(info, options.clientId);
+        validateRefreshTokenExpiration(info, Math.floor((options.now ?? new Date()).getTime() / 1000));
+        await validateRefreshTokenSession(info, options.authenticationSessionResolver);
+    }
+    catch (error) {
+        if (error instanceof TokenError) {
+            throw invalidSubjectToken();
+        }
+        throw error;
+    }
+    if (!info.scope.includes('openid')) {
+        throw invalidSubjectToken();
+    }
+    return {
+        sub: info.subject,
+        authTime: info.authTime,
+        ...(info.acr === undefined ? {} : { acr: info.acr }),
+        ...(info.amr === undefined ? {} : { amr: info.amr }),
+    };
+}
+export async function resolveIdJagActor(options) {
+    let payload;
+    try {
+        payload = await validateIdTokenHint(options.actorToken, {
+            expectedIss: options.issuer,
+            expectedAud: options.clientId,
+            jwks: options.jwks,
+        });
+    }
+    catch (error) {
+        if (error instanceof IdTokenHintError) {
+            throw new IdJagError('invalid_request', ACTOR_TOKEN_INVALID_DESCRIPTION);
+        }
+        throw error;
+    }
+    return { sub: payload.sub };
+}
+export async function resolveIdJagActorToken(options) {
+    if (options.resolver === undefined) {
+        throw new IdJagError('invalid_request', ACTOR_TOKEN_INVALID_DESCRIPTION);
+    }
+    const resolved = await options.resolver({
+        actorToken: options.actorToken,
+        actorTokenType: options.actorTokenType,
+        clientId: options.clientId,
+        issuer: options.issuer,
+        jwks: options.jwks,
+    });
+    if (resolved === null) {
+        throw new IdJagError('invalid_request', ACTOR_TOKEN_INVALID_DESCRIPTION);
+    }
+    const actor = copyActorChain(resolved);
+    if (actor === undefined) {
+        throw new Error('The actorTokenResolver returned a malformed actor: sub must be a non-empty string at every level of the act chain');
+    }
+    return actor;
+}
+function copyActorChain(value) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const record = value;
+    const sub = record['sub'];
+    if (typeof sub !== 'string' || sub.length === 0) {
+        return undefined;
+    }
+    if (record['act'] === undefined) {
+        return { sub };
+    }
+    const act = copyActorChain(record['act']);
+    return act === undefined ? undefined : { sub, act };
+}
+export function validateIdJagAudience(options) {
+    if (options.audience === options.issuer) {
+        throw new IdJagError('invalid_target', 'The requested audience must belong to a different trust domain than this authorization server');
+    }
+    if (!options.allowedAudiences.includes(options.audience)) {
+        throw new IdJagError('invalid_target', 'The requested audience is not allowed for ID-JAG issuance');
+    }
+}
+export function validateIdJagScope(requestedScope, allowedScopes) {
+    const requested = splitScope(requestedScope);
+    if (allowedScopes === undefined) {
+        return requested;
+    }
+    for (const value of requested) {
+        if (!allowedScopes.includes(value)) {
+            throw new IdJagError('invalid_scope', 'The requested scope exceeds the scopes allowed for ID-JAG issuance');
+        }
+    }
+    return requested;
+}
+export function buildIdJagClaims(options) {
+    if (!Number.isInteger(options.lifetimeSeconds) || options.lifetimeSeconds <= 0) {
+        throw new RangeError(`lifetimeSeconds must be a positive integer, received ${options.lifetimeSeconds}`);
+    }
+    const issuedAt = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    return {
+        iss: options.issuer,
+        sub: options.subject.sub,
+        aud: options.audience,
+        client_id: options.clientId,
+        jti: generateRandomString(32),
+        exp: issuedAt + options.lifetimeSeconds,
+        iat: issuedAt,
+        ...(options.scope.length === 0 ? {} : { scope: options.scope.join(' ') }),
+        ...(options.resource === undefined ? {} : { resource: options.resource }),
+        ...(options.subject.authTime === undefined ? {} : { auth_time: options.subject.authTime }),
+        ...(options.subject.acr === undefined ? {} : { acr: options.subject.acr }),
+        ...(options.subject.amr === undefined ? {} : { amr: options.subject.amr }),
+        ...(options.actor === undefined ? {} : { act: options.actor }),
+    };
+}
+export async function createIdJagJwt(options) {
+    const encodedHeader = base64UrlFromJson({
+        alg: ID_JAG_SIGNING_ALG,
+        typ: ID_JAG_JWT_TYP,
+        kid: options.signingKey.keyId,
+    });
+    const encodedPayload = base64UrlFromJson(options.claims);
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const signature = await crypto.subtle.sign(WEB_CRYPTO_ALGORITHM, options.signingKey.privateKey, new TextEncoder().encode(signingInput));
+    return `${signingInput}.${base64UrlFromBytes(new Uint8Array(signature))}`;
+}
+export function buildIdJagIssuanceResponse(options) {
+    return {
+        access_token: options.idJag,
+        issued_token_type: ID_JAG_TOKEN_TYPE,
+        token_type: 'N_A',
+        expires_in: options.expiresIn,
+        scope: options.scope.join(' '),
+    };
+}
+export async function processIdJagIssuanceRequest(context) {
+    authorizeIdJagIssuanceClient(context.client);
+    const parsed = parseIdJagIssuanceParams(context.params, {
+        allowRefreshTokenSubjects: context.refreshTokenResolver !== undefined,
+        allowActorTokens: context.allowActorTokens === true,
+    });
+    const subject = parsed.subjectTokenType === TOKEN_TYPE_REFRESH_TOKEN
+        ? await resolveIdJagSubjectFromRefreshToken({
+            refreshToken: parsed.subjectToken,
+            clientId: context.client.clientId,
+            refreshTokenResolver: context.refreshTokenResolver,
+            ...(context.authenticationSessionResolver === undefined
+                ? {}
+                : { authenticationSessionResolver: context.authenticationSessionResolver }),
+            ...(context.now === undefined ? {} : { now: context.now }),
+        })
+        : await resolveIdJagSubject({
+            subjectToken: parsed.subjectToken,
+            issuer: context.issuer,
+            clientId: context.client.clientId,
+            jwks: context.jwks,
+        });
+    const actor = parsed.actorToken === undefined
+        ? undefined
+        : await resolveIdJagActorToken({
+            actorToken: parsed.actorToken,
+            actorTokenType: parsed.actorTokenType,
+            clientId: context.client.clientId,
+            issuer: context.issuer,
+            jwks: context.jwks,
+            ...(context.actorTokenResolver === undefined
+                ? {}
+                : { resolver: context.actorTokenResolver }),
+        });
+    validateIdJagAudience({
+        audience: parsed.audience,
+        issuer: context.issuer,
+        allowedAudiences: context.allowedAudiences,
+    });
+    const scope = validateIdJagScope(parsed.scope, context.allowedScopes);
+    const claims = buildIdJagClaims({
+        issuer: context.issuer,
+        subject,
+        audience: parsed.audience,
+        clientId: context.client.clientId,
+        scope,
+        ...(parsed.resource === undefined ? {} : { resource: parsed.resource }),
+        ...(actor === undefined ? {} : { actor }),
+        lifetimeSeconds: context.lifetimeSeconds,
+        ...(context.now === undefined ? {} : { now: context.now }),
+    });
+    const idJag = await createIdJagJwt({
+        claims,
+        signingKey: context.signingKey,
+    });
+    return buildIdJagIssuanceResponse({
+        idJag,
+        expiresIn: context.lifetimeSeconds,
+        scope,
+    });
+}
+function optional(value) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+function invalidSubjectToken() {
+    return new IdJagError('invalid_request', SUBJECT_TOKEN_INVALID_DESCRIPTION);
+}
+function splitScope(scope) {
+    if (scope === undefined)
+        return [];
+    return [...new Set(scope.split(/\s+/).filter((value) => value.length > 0))];
+}
+function isAbsoluteUriWithoutFragment(value) {
+    if (value.includes('#'))
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol.length > 0;
+}
+function base64UrlFromBytes(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64UrlFromJson(value) {
+    return base64UrlFromBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+//# sourceMappingURL=issue-id-jag.js.map

package/dist/id-jag/issue-id-jag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-id-jag.js","sourceRoot":"","sources":["../../src/id-jag/issue-id-jag.ts"],"names":[],"mappings":"AAyBA,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,GAQ3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,+BAA+B,EAC/B,UAAU,EACV,iCAAiC,GAClC,MAAM,aAAa,CAAC;AAGrB,MAAM,CAAC,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAG3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,yCAAyC,CAAC;AAG3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,2CAA2C,CAAC;AAW/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,gDAAgD,CAAC;AAGzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAGvF,MAAM,CAAC,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAGrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAGzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAUzE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,uBAAuB;IACvB,wBAAwB;IACxB,mBAAmB;IACnB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AAOX,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAMjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAUjF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAGnC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAqLjD,MAAM,UAAU,2BAA2B,CAAC,MAA8B;IACxE,OAAO,CACL,MAAM,CAAC,YAAY,CAAC,KAAK,yBAAyB;QAClD,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,iBAAiB,CAC/D,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,4BAA4B,CAAC,MAAuB;IAIlE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,qDAAqD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAYD,MAAM,UAAU,wBAAwB,CACtC,MAA8B,EAC9B,OAAO,GAA8B,EAAE;IAEvC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IAC5E,CAAC;IAGD,MAAM,qBAAqB,GAAa;QACtC,mBAAmB;QACnB,GAAG,CAAC,OAAO,CAAC,yBAAyB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;IACF,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,4DAA4D,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC/G,CAAC;IACJ,CAAC;IAID,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAEtE,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAItC,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,kDAAkD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QAGN,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAGD,IACE,cAAc,KAAK,SAAS;YAC5B,CAAE,2BAAiD,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC5E,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,0EAA0E,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;IAID,IAAI,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,gBAAgB,EAAE,gBAAiE;QACnF,QAAQ;QACR,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,QAAQ;QAER,GAAG,CAAC,UAAU,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,cAAwB,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAKzC;IACC,IAAI,OAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE;YACxD,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAID,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,GAAG,GACP,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,CAAC,CAAE,OAAO,CAAC,KAAK,CAAc;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,OAMzD;IACC,IAAI,IAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC;YACE,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;SACd,EACvB,OAAO,CAAC,oBAAoB,CAC7B,CAAC;QACF,IAAI,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QAIjC,MAAM,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrE,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,8BAA8B,CAC5B,IAAI,EACJ,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CACzD,CAAC;QAGF,MAAM,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,MAAM,mBAAmB,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAKvC;IACC,IAAI,OAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,UAAU,EAAE;YACtD,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9B,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAO5C;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAC,OAIrC;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAGxC,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,kBAAkB,CAChC,cAAkC,EAClC,aAAmC;IAEnC,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,oEAAoE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,MAAM,UAAU,gBAAgB,CAAC,OAWhC;IACC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,UAAU,CAClB,wDAAwD,OAAO,CAAC,eAAe,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG;QACxB,GAAG,EAAE,OAAO,CAAC,QAAQ;QACrB,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,GAAG,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC7B,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe;QACvC,GAAG,EAAE,QAAQ;QACb,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1F,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAGpC;IACC,MAAM,aAAa,GAAG,iBAAiB,CAAC;QACtC,GAAG,EAAE,kBAAkB;QACvB,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;KAC9B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAA4C,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAE1D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,oBAAoB,EACpB,OAAO,CAAC,UAAU,CAAC,UAAU,EAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAC;IAEF,OAAO,GAAG,YAAY,IAAI,kBAAkB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAUD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,KAAK;QAC3B,iBAAiB,EAAE,iBAAiB;QACpC,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6B;IAI7B,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,EAAE;QACtD,yBAAyB,EAAE,OAAO,CAAC,oBAAoB,KAAK,SAAS;QACrE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,KAAK,IAAI;KACpD,CAAC,CAAC;IAEH,MAAM,OAAO,GACX,MAAM,CAAC,gBAAgB,KAAK,wBAAwB;QAClD,CAAC,CAAC,MAAM,mCAAmC,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YAEjC,oBAAoB,EAAE,OAAO,CAAC,oBAA4C;YAC1E,GAAG,CAAC,OAAO,CAAC,6BAA6B,KAAK,SAAS;gBACrD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,6BAA6B,EAAE,OAAO,CAAC,6BAA6B,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,CAAC;QACJ,CAAC,CAAC,MAAM,mBAAmB,CAAC;YACxB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IAKT,MAAM,KAAK,GACT,MAAM,CAAC,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,sBAAsB,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAE7B,cAAc,EAAE,MAAM,CAAC,cAAwB;YAC/C,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC9C,CAAC,CAAC;IAET,qBAAqB,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,gBAAgB,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KAC3D,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC;QACjC,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,OAAO,0BAA0B,CAAC;QAChC,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,eAAe;QAClC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAMD,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B;IACvD,OAAO,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/id-jag/redeem-id-jag.d.ts

@@ -0,0 +1,65 @@
+import { type AccessTokenInfo, type JwkSet, type TokenClientInfo } from '@maronn-openid-connect/core';
+import { type IdJagActor } from './issue-id-jag.js';
+export declare const JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+export declare const DEFAULT_ASSERTION_CLOCK_SKEW_SEC = 60;
+export interface IdJagTrustedIdentityProvider {
+    issuer: string;
+    jwks: JwkSet;
+}
+export interface ParsedIdJagRedemptionParams {
+    assertion: string;
+    scope?: string;
+}
+export interface IdJagAssertionPayload {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    client_id: string;
+    jti: string;
+    exp: number;
+    iat: number;
+    scope?: string;
+    resource?: string | string[];
+    auth_time?: number;
+    acr?: string;
+    amr?: string[];
+    act?: IdJagActor;
+}
+export interface IdJagRedemptionGrant {
+    subject: string;
+    clientId: string;
+    scope: string[];
+    requestedResources?: string[];
+    expiresIn: number;
+    idpIssuer: string;
+    jti: string;
+    authTime?: number;
+    acr?: string;
+    amr?: string[];
+    actor?: IdJagActor;
+}
+export type IdJagAccessTokenInfo = AccessTokenInfo & {
+    act?: IdJagActor;
+};
+export interface IdJagRedemptionContext {
+    params: Record<string, string>;
+    client: TokenClientInfo;
+    issuer: string;
+    identityProviders: IdJagTrustedIdentityProvider[];
+    configuredExpiresIn: number;
+    now?: Date;
+    clockSkewToleranceSec?: number;
+}
+export declare function authorizeIdJagRedemptionClient(client: TokenClientInfo): void;
+export declare function parseIdJagRedemptionParams(params: Record<string, string>): ParsedIdJagRedemptionParams;
+export declare function verifyIdJagAssertion(options: {
+    assertion: string;
+    issuer: string;
+    clientId: string;
+    identityProviders: IdJagTrustedIdentityProvider[];
+    now?: Date;
+    clockSkewToleranceSec?: number;
+}): Promise<IdJagAssertionPayload>;
+export declare function resolveIdJagGrantScope(requestedScope: string | undefined, assertionScope: string | undefined): string[];
+export declare function processIdJagRedemptionRequest(context: IdJagRedemptionContext): Promise<IdJagRedemptionGrant>;
+//# sourceMappingURL=redeem-id-jag.d.ts.map

package/dist/id-jag/redeem-id-jag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeem-id-jag.d.ts","sourceRoot":"","sources":["../../src/id-jag/redeem-id-jag.ts"],"names":[],"mappings":"AAqBA,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,MAAM,EACX,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpE,eAAO,MAAM,qBAAqB,gDAAgD,CAAC;AAMnF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AASnD,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAMD,MAAM,WAAW,oBAAoB;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAM9B,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,MAAM,CAAC;IAElB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAOf,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AASD,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IACnD,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,CAAC;AAGF,MAAM,WAAW,sBAAsB;IAErC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IAExB,MAAM,EAAE,MAAM,CAAC;IAEf,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAElD,mBAAmB,EAAE,MAAM,CAAC;IAE5B,GAAG,CAAC,EAAE,IAAI,CAAC;IAEX,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAmBD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAgB5E;AAOD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,2BAA2B,CAkB7B;AAgCD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;IAClD,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyKjC;AAeD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,EAAE,CAeV;AAaD,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CA8C/B"}