@neuroncloud/ido-core 0.1.0

package/dist/constants/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./interaction.js";
+export * from "./oauth.js";
+export * from "./oidc.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/constants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC"}

package/dist/constants/index.js

@@ -0,0 +1,4 @@
+export * from "./interaction.js";
+export * from "./oauth.js";
+export * from "./oidc.js";
+//# sourceMappingURL=index.js.map

package/dist/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC"}

package/dist/constants/interaction.d.ts

@@ -0,0 +1,11 @@
+export declare const ChallengeTypes: {
+    readonly Password: "password";
+    readonly Passkey: "passkey";
+};
+export declare const AuthenticatorKeys: {
+    readonly Password: "password";
+    readonly Passkey: "passkey";
+    readonly Authenticator: "authenticator";
+    readonly RecoveryCode: "recovery_code";
+};
+//# sourceMappingURL=interaction.d.ts.map

package/dist/constants/interaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction.d.ts","sourceRoot":"","sources":["../../src/constants/interaction.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc;;;CAGjB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC"}

package/dist/constants/interaction.js

@@ -0,0 +1,11 @@
+export const ChallengeTypes = {
+    Password: "password",
+    Passkey: "passkey",
+};
+export const AuthenticatorKeys = {
+    Password: "password",
+    Passkey: "passkey",
+    Authenticator: "authenticator",
+    RecoveryCode: "recovery_code",
+};
+//# sourceMappingURL=interaction.js.map

package/dist/constants/interaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction.js","sourceRoot":"","sources":["../../src/constants/interaction.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,eAAe;CACrB,CAAC"}

package/dist/constants/oauth.d.ts

@@ -0,0 +1,42 @@
+export declare const GrantTypes: {
+    readonly AuthorizationCode: "authorization_code";
+    readonly Password: "password";
+    readonly RefreshToken: "refresh_token";
+    readonly ClientCredentials: "client_credentials";
+    readonly TwoFactor: "urn:identityone:grant-type:two-factor";
+    readonly Passkey: "urn:identityone:grant-type:passkey";
+};
+export declare const Parameters: {
+    readonly ClientId: "client_id";
+    readonly ClientSecret: "client_secret";
+    readonly GrantType: "grant_type";
+    readonly Username: "username";
+    readonly Password: "password";
+    readonly Scope: "scope";
+    readonly ContinuationToken: "continuation_token";
+    readonly ChallengeType: "challenge_type";
+    readonly Credential: "credential";
+    readonly Method: "method";
+    readonly AvailableMethods: "available_methods";
+    readonly Code: "code";
+    readonly LoginHint: "login_hint";
+    readonly RefreshToken: "refresh_token";
+    readonly Token: "token";
+    readonly TokenTypeHint: "token_type_hint";
+    readonly ResponseType: "response_type";
+    readonly RedirectUri: "redirect_uri";
+    readonly State: "state";
+    readonly Nonce: "nonce";
+    readonly CodeVerifier: "code_verifier";
+    readonly CodeChallenge: "code_challenge";
+    readonly CodeChallengeMethod: "code_challenge_method";
+    readonly IdTokenHint: "id_token_hint";
+    readonly PostLogoutRedirectUri: "post_logout_redirect_uri";
+    readonly Prompt: "prompt";
+    readonly Idp: "idp";
+};
+export declare const Suberrors: {
+    readonly MfaRequired: "mfa_required";
+    readonly TwoFactorMethodUnavailable: "two_factor_method_unavailable";
+};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/constants/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/constants/oauth.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU;;;;;;;CAOb,CAAC;AAEX,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Bb,CAAC;AAEX,eAAO,MAAM,SAAS;;;CAGZ,CAAC"}

package/dist/constants/oauth.js

@@ -0,0 +1,42 @@
+export const GrantTypes = {
+    AuthorizationCode: "authorization_code",
+    Password: "password",
+    RefreshToken: "refresh_token",
+    ClientCredentials: "client_credentials",
+    TwoFactor: "urn:identityone:grant-type:two-factor",
+    Passkey: "urn:identityone:grant-type:passkey",
+};
+export const Parameters = {
+    ClientId: "client_id",
+    ClientSecret: "client_secret",
+    GrantType: "grant_type",
+    Username: "username",
+    Password: "password",
+    Scope: "scope",
+    ContinuationToken: "continuation_token",
+    ChallengeType: "challenge_type",
+    Credential: "credential",
+    Method: "method",
+    AvailableMethods: "available_methods",
+    Code: "code",
+    LoginHint: "login_hint",
+    RefreshToken: "refresh_token",
+    Token: "token",
+    TokenTypeHint: "token_type_hint",
+    ResponseType: "response_type",
+    RedirectUri: "redirect_uri",
+    State: "state",
+    Nonce: "nonce",
+    CodeVerifier: "code_verifier",
+    CodeChallenge: "code_challenge",
+    CodeChallengeMethod: "code_challenge_method",
+    IdTokenHint: "id_token_hint",
+    PostLogoutRedirectUri: "post_logout_redirect_uri",
+    Prompt: "prompt",
+    Idp: "idp",
+};
+export const Suberrors = {
+    MfaRequired: "mfa_required",
+    TwoFactorMethodUnavailable: "two_factor_method_unavailable",
+};
+//# sourceMappingURL=oauth.js.map

package/dist/constants/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/constants/oauth.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,iBAAiB,EAAE,oBAAoB;IACvC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,eAAe;IAC7B,iBAAiB,EAAE,oBAAoB;IACvC,SAAS,EAAE,uCAAuC;IAClD,OAAO,EAAE,oCAAoC;CACrC,CAAC;AAEX,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,iBAAiB,EAAE,oBAAoB;IACvC,aAAa,EAAE,gBAAgB;IAC/B,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,QAAQ;IAChB,gBAAgB,EAAE,mBAAmB;IACrC,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,eAAe;IAC7B,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,gBAAgB;IAC/B,mBAAmB,EAAE,uBAAuB;IAC5C,WAAW,EAAE,eAAe;IAC5B,qBAAqB,EAAE,0BAA0B;IACjD,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACF,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,WAAW,EAAE,cAAc;IAC3B,0BAA0B,EAAE,+BAA+B;CACnD,CAAC"}

package/dist/constants/oidc.d.ts

@@ -0,0 +1,11 @@
+export declare const DefaultScopes: readonly ["openid", "profile", "email", "offline_access"];
+export declare const StorageKeys: {
+    readonly Token: "identityone.tokens";
+    readonly Transaction: "identityone.transaction";
+    readonly Redirect: "identityone.redirect";
+    readonly OriginalUri: "identityone.originalUri";
+    readonly Jwks: "identityone.jwks";
+};
+export declare const DefaultExpireEarlySeconds = 30;
+export declare const DefaultJwksTtlSeconds = 600;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/constants/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/constants/oidc.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,2DAA4D,CAAC;AAEvF,eAAO,MAAM,WAAW;;;;;;CAMd,CAAC;AAEX,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,eAAO,MAAM,qBAAqB,MAAM,CAAC"}

package/dist/constants/oidc.js

@@ -0,0 +1,11 @@
+export const DefaultScopes = ["openid", "profile", "email", "offline_access"];
+export const StorageKeys = {
+    Token: "identityone.tokens",
+    Transaction: "identityone.transaction",
+    Redirect: "identityone.redirect",
+    OriginalUri: "identityone.originalUri",
+    Jwks: "identityone.jwks",
+};
+export const DefaultExpireEarlySeconds = 30;
+export const DefaultJwksTtlSeconds = 600;
+//# sourceMappingURL=oidc.js.map

package/dist/constants/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/constants/oidc.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAEvF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,yBAAyB;IACtC,QAAQ,EAAE,sBAAsB;IAChC,WAAW,EAAE,yBAAyB;IACtC,IAAI,EAAE,kBAAkB;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC"}

package/dist/crypto/id-token.d.ts

@@ -0,0 +1,15 @@
+import type { KeyValueCache, ProtocolHttpClient } from "../types/configuration.js";
+import { type Jwt } from "./jwt.js";
+import { type Jwk } from "./jwks.js";
+export interface VerifyIdTokenOptions {
+    issuer: string;
+    clientId: string;
+    nonce?: string;
+    now?: number;
+    http?: ProtocolHttpClient;
+    jwksUri?: string;
+    cache?: KeyValueCache;
+    keys?: Jwk[];
+}
+export declare function verifyIdToken(token: string, options: VerifyIdTokenOptions): Promise<Jwt>;
+//# sourceMappingURL=id-token.d.ts.map

package/dist/crypto/id-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token.d.ts","sourceRoot":"","sources":["../../src/crypto/id-token.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAY,KAAK,GAAG,EAAkB,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAqB,KAAK,GAAG,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;CACd;AAiBD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,CAK9F"}

package/dist/crypto/id-token.js

@@ -0,0 +1,99 @@
+import { RuntimeError } from "../errors/runtime-error.js";
+import { parseJwt } from "./jwt.js";
+import { resolveSigningKey } from "./jwks.js";
+const algorithms = {
+    RS256: { import: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, verify: { name: "RSASSA-PKCS1-v1_5" } },
+    RS384: { import: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, verify: { name: "RSASSA-PKCS1-v1_5" } },
+    RS512: { import: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }, verify: { name: "RSASSA-PKCS1-v1_5" } },
+    PS256: { import: { name: "RSA-PSS", hash: "SHA-256" }, verify: { name: "RSA-PSS", saltLength: 32 } },
+    PS384: { import: { name: "RSA-PSS", hash: "SHA-384" }, verify: { name: "RSA-PSS", saltLength: 48 } },
+    PS512: { import: { name: "RSA-PSS", hash: "SHA-512" }, verify: { name: "RSA-PSS", saltLength: 64 } },
+    ES256: { import: { name: "ECDSA", namedCurve: "P-256" }, verify: { name: "ECDSA", hash: "SHA-256" } },
+    ES384: { import: { name: "ECDSA", namedCurve: "P-384" }, verify: { name: "ECDSA", hash: "SHA-384" } },
+    ES512: { import: { name: "ECDSA", namedCurve: "P-521" }, verify: { name: "ECDSA", hash: "SHA-512" } },
+};
+export async function verifyIdToken(token, options) {
+    const jwt = parseJwt(token);
+    await verifySignature(jwt, options);
+    verifyClaims(jwt, options);
+    return jwt;
+}
+async function verifySignature(jwt, options) {
+    const alg = typeof jwt.header.alg === "string" ? jwt.header.alg : undefined;
+    if (!alg || !(alg in algorithms)) {
+        throw new RuntimeError("The ID token signing algorithm is not supported.", { code: "invalid_algorithm" });
+    }
+    const kid = typeof jwt.header.kid === "string" ? jwt.header.kid : undefined;
+    const first = await signingKey(options, kid, alg, false);
+    if (await verifyWithKey(jwt, first, alg)) {
+        return;
+    }
+    if (!options.keys) {
+        const rotated = await signingKey(options, kid, alg, true);
+        if (await verifyWithKey(jwt, rotated, alg)) {
+            return;
+        }
+    }
+    throw new RuntimeError("The ID token signature is invalid.", { code: "invalid_signature" });
+}
+async function signingKey(options, kid, alg, force) {
+    if (options.keys?.length) {
+        const key = options.keys.find((item) => (!kid || item.kid === kid) && (!item.alg || item.alg === alg)) ?? options.keys[0];
+        if (!key) {
+            throw new RuntimeError("No matching JWKS signing key was found.", { code: "key_not_found" });
+        }
+        return key;
+    }
+    if (!options.http || !options.jwksUri) {
+        throw new RuntimeError("JWKS verification is not configured.", { code: "jwks_unavailable" });
+    }
+    return resolveSigningKey(options.http, options.jwksUri, options.cache, kid, alg, force);
+}
+async function verifyWithKey(jwt, key, alg) {
+    const algorithm = algorithms[alg];
+    if (!algorithm) {
+        return false;
+    }
+    try {
+        const cryptoKey = await crypto.subtle.importKey("jwk", toPublicJwk(key), algorithm.import, false, ["verify"]);
+        return crypto.subtle.verify(algorithm.verify, cryptoKey, toBufferSource(jwt.signature), toBufferSource(jwt.signingInput));
+    }
+    catch {
+        return false;
+    }
+}
+function toBufferSource(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function toPublicJwk(key) {
+    if (key.kty === "RSA" && key.n && key.e) {
+        return { kty: "RSA", n: key.n, e: key.e, ext: true };
+    }
+    if (key.kty === "EC" && key.crv && key.x && key.y) {
+        return { kty: "EC", crv: key.crv, x: key.x, y: key.y, ext: true };
+    }
+    throw new RuntimeError("The signing key is incomplete or unsupported.", { code: "key_not_found" });
+}
+function verifyClaims(jwt, options) {
+    const { payload } = jwt;
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    if (typeof payload.iss !== "string" || normalizeIssuer(payload.iss) !== normalizeIssuer(options.issuer)) {
+        throw new RuntimeError("The ID token issuer is invalid.", { code: "invalid_issuer" });
+    }
+    if (!audienceIncludes(payload.aud, options.clientId)) {
+        throw new RuntimeError("The ID token audience is invalid.", { code: "invalid_audience" });
+    }
+    if (typeof payload.exp !== "number" || payload.exp <= now) {
+        throw new RuntimeError("The ID token has expired.", { code: "invalid_exp" });
+    }
+    if (options.nonce !== undefined && payload.nonce !== options.nonce) {
+        throw new RuntimeError("The ID token nonce is invalid.", { code: "invalid_nonce" });
+    }
+}
+function normalizeIssuer(value) {
+    return value.replace(/\/+$/, "");
+}
+function audienceIncludes(audience, clientId) {
+    return audience === clientId || (Array.isArray(audience) && audience.includes(clientId));
+}
+//# sourceMappingURL=id-token.js.map

package/dist/crypto/id-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token.js","sourceRoot":"","sources":["../../src/crypto/id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,QAAQ,EAA4B,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAY,MAAM,WAAW,CAAC;AAaxD,MAAM,UAAU,GAGZ;IACF,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;IACxG,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;IACxG,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;IACxG,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE;IACpG,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE;IACpG,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE;IACpG,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;IACrG,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;IACrG,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;CACtG,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,OAA6B;IAC9E,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAc,EAAE,OAA6B;IAC1E,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5E,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CAAC,kDAAkD,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAEzD,IAAI,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE1D,IAAI,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAA6B,EAAE,GAAuB,EAAE,GAAW,EAAE,KAAc;IAC3G,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1H,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,YAAY,CAAC,yCAAyC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,YAAY,CAAC,sCAAsC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAc,EAAE,GAAQ,EAAE,GAAW;IAChE,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9G,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;AAClG,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ;IAC3B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,YAAY,CAAC,+CAA+C,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ,EAAE,OAA6B;IAC3D,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAEzD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,YAAY,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiB,EAAE,QAAgB;IAC3D,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3F,CAAC"}

package/dist/crypto/jwks.d.ts

@@ -0,0 +1,18 @@
+import type { KeyValueCache, ProtocolHttpClient } from "../types/configuration.js";
+export interface Jwk {
+    kty: string;
+    kid?: string;
+    use?: string;
+    alg?: string;
+    n?: string;
+    e?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+}
+export interface JsonWebKeySet {
+    keys: Jwk[];
+}
+export declare function resolveSigningKey(http: ProtocolHttpClient, jwksUri: string, cache: KeyValueCache | undefined, kid: string | undefined, alg: string, force?: boolean): Promise<Jwk>;
+export declare function loadJwks(http: ProtocolHttpClient, jwksUri: string, cache?: KeyValueCache, force?: boolean): Promise<JsonWebKeySet>;
+//# sourceMappingURL=jwks.d.ts.map

package/dist/crypto/jwks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../src/crypto/jwks.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGnF,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AASD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,GAAG,EAAE,MAAM,EACX,KAAK,UAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,CAkBd;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,aAAa,EACrB,KAAK,UAAQ,GACZ,OAAO,CAAC,aAAa,CAAC,CA6BxB"}

package/dist/crypto/jwks.js

@@ -0,0 +1,98 @@
+import { DefaultJwksTtlSeconds, StorageKeys } from "../constants/oidc.js";
+import { RuntimeError } from "../errors/runtime-error.js";
+import { asRecord } from "../utils/values.js";
+const inflight = new Map();
+export async function resolveSigningKey(http, jwksUri, cache, kid, alg, force = false) {
+    const key = selectKey(await loadJwks(http, jwksUri, cache, force), kid, alg);
+    if (key) {
+        return key;
+    }
+    if (force) {
+        throw new RuntimeError("No matching JWKS signing key was found.", { code: "key_not_found" });
+    }
+    const refreshed = selectKey(await loadJwks(http, jwksUri, cache, true), kid, alg);
+    if (!refreshed) {
+        throw new RuntimeError("No matching JWKS signing key was found.", { code: "key_not_found" });
+    }
+    return refreshed;
+}
+export async function loadJwks(http, jwksUri, cache, force = false) {
+    if (!force) {
+        const cached = readCache(cache);
+        if (cached) {
+            return cached;
+        }
+    }
+    const pending = inflight.get(jwksUri);
+    if (pending && !force) {
+        return pending;
+    }
+    const request = fetchJwks(http, jwksUri).then((result) => {
+        writeCache(cache, result.keys, result.ttl);
+        return { keys: result.keys };
+    });
+    inflight.set(jwksUri, request);
+    try {
+        return await request;
+    }
+    finally {
+        if (inflight.get(jwksUri) === request) {
+            inflight.delete(jwksUri);
+        }
+    }
+}
+function selectKey(set, kid, alg) {
+    const usable = set.keys.filter((key) => key.kty && (!key.use || key.use === "sig"));
+    const matchedKid = kid ? usable.filter((key) => key.kid === kid) : usable;
+    if (kid && matchedKid.length === 0) {
+        return undefined;
+    }
+    const pool = matchedKid.length > 0 ? matchedKid : usable;
+    return pool.find((key) => !key.alg || key.alg === alg) ?? pool[0];
+}
+async function fetchJwks(http, jwksUri) {
+    const response = await http.get(jwksUri);
+    const body = asRecord(response.body);
+    const keys = Array.isArray(body?.keys) ? body.keys.filter(isJwk) : [];
+    if (response.status < 200 || response.status >= 300 || keys.length === 0) {
+        throw new RuntimeError("The JWKS document could not be loaded.", { code: "jwks_unavailable" });
+    }
+    return { keys, ttl: cacheTtlSeconds(response.headers) };
+}
+function isJwk(value) {
+    return typeof value === "object" && value !== null && typeof value.kty === "string";
+}
+function readCache(cache) {
+    const raw = cache?.getItem(StorageKeys.Jwks);
+    if (!raw) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed.keys) || parsed.expiresAt <= Date.now()) {
+            cache?.removeItem(StorageKeys.Jwks);
+            return undefined;
+        }
+        return { keys: parsed.keys.filter(isJwk) };
+    }
+    catch {
+        cache?.removeItem(StorageKeys.Jwks);
+        return undefined;
+    }
+}
+function writeCache(cache, keys, ttl) {
+    cache?.setItem(StorageKeys.Jwks, JSON.stringify({
+        keys,
+        expiresAt: Date.now() + ttl * 1000,
+    }));
+}
+function cacheTtlSeconds(headers) {
+    const value = header(headers, "cache-control");
+    const match = value?.match(/max-age=(\d+)/i);
+    return match?.[1] ? Math.max(0, Number(match[1])) : DefaultJwksTtlSeconds;
+}
+function header(headers, name) {
+    const target = name.toLowerCase();
+    return Object.entries(headers).find(([key]) => key.toLowerCase() === target)?.[1];
+}
+//# sourceMappingURL=jwks.js.map

package/dist/crypto/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../src/crypto/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAuB9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAwB,EACxB,OAAe,EACf,KAAgC,EAChC,GAAuB,EACvB,GAAW,EACX,KAAK,GAAG,KAAK;IAEb,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAE7E,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,YAAY,CAAC,yCAAyC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAElF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,yCAAyC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAwB,EACxB,OAAe,EACf,KAAqB,EACrB,KAAK,GAAG,KAAK;IAEb,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACvD,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/B,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;YACtC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAkB,EAAE,GAAuB,EAAE,GAAW;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAE1E,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAwB,EAAE,OAAe;IAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,YAAY,CAAC,wCAAwC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAAa,CAAC,GAAG,KAAK,QAAQ,CAAC;AAC/F,CAAC;AAED,SAAS,SAAS,CAAC,KAAgC;IACjD,MAAM,GAAG,GAAG,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;QAE7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAgC,EAAE,IAAW,EAAE,GAAW;IAC5E,KAAK,EAAE,OAAO,CACZ,WAAW,CAAC,IAAI,EAChB,IAAI,CAAC,SAAS,CAAC;QACb,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI;KACd,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAA+B;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAC5E,CAAC;AAED,SAAS,MAAM,CAAC,OAA+B,EAAE,IAAY;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/crypto/jwt.d.ts

@@ -0,0 +1,12 @@
+export interface Jwt {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+}
+export interface ParsedJwt extends Jwt {
+    signingInput: Uint8Array;
+    signature: Uint8Array;
+}
+export declare function decodeJwt(token: string): Jwt;
+export declare function parseJwt(token: string): ParsedJwt;
+export declare function base64UrlToBytes(value: string): Uint8Array;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/crypto/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/crypto/jwt.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,SAAU,SAAQ,GAAG;IACpC,YAAY,EAAE,UAAU,CAAC;IACzB,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAW5C;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAajD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAW1D"}

package/dist/crypto/jwt.js

@@ -0,0 +1,52 @@
+import { RuntimeError } from "../errors/index.js";
+export function decodeJwt(token) {
+    const parts = token.split(".");
+    if (parts.length < 2) {
+        throw new RuntimeError("The token is not a JWT.", { code: "invalid_token" });
+    }
+    return {
+        header: decodeSegment(parts[0] ?? ""),
+        payload: decodeSegment(parts[1] ?? ""),
+    };
+}
+export function parseJwt(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) {
+        throw new RuntimeError("The token is not a signed JWT.", { code: "invalid_token" });
+    }
+    return {
+        header: decodeSegment(parts[0]),
+        payload: decodeSegment(parts[1]),
+        signingInput: new TextEncoder().encode(`${parts[0]}.${parts[1]}`),
+        signature: base64UrlToBytes(parts[2]),
+    };
+}
+export function base64UrlToBytes(value) {
+    const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+    const binary = decodeBase64(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    return bytes;
+}
+function decodeSegment(segment) {
+    const json = new TextDecoder().decode(base64UrlToBytes(segment));
+    const value = JSON.parse(json);
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new RuntimeError("The token segment is not a JSON object.", { code: "invalid_token" });
+    }
+    return value;
+}
+function decodeBase64(value) {
+    if (typeof atob === "function") {
+        return atob(value);
+    }
+    const bufferFactory = globalThis.Buffer;
+    if (bufferFactory) {
+        return bufferFactory.from(value, "base64").toString("binary");
+    }
+    throw new RuntimeError("Base64 decoding is not available.", { code: "unsupported" });
+}
+//# sourceMappingURL=jwt.js.map

package/dist/crypto/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/crypto/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAYlD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,YAAY,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO;QACL,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,YAAY,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IAE1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,YAAY,CAAC,yCAAyC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,aAAa,GAAI,UAErB,CAAC,MAAM,CAAC;IAEV,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/crypto/random.d.ts

@@ -0,0 +1,8 @@
+export declare function randomUrlSafe(byteLength?: number): string;
+export declare function base64UrlEncode(value: ArrayBuffer | Uint8Array): string;
+export declare function sha256(value: string): Promise<ArrayBuffer>;
+export declare function createPkce(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+//# sourceMappingURL=random.d.ts.map

package/dist/crypto/random.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"random.d.ts","sourceRoot":"","sources":["../../src/crypto/random.ts"],"names":[],"mappings":"AAAA,wBAAgB,aAAa,CAAC,UAAU,SAAK,GAAG,MAAM,CAIrD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CASvE;AAED,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAEhE;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAInF"}

package/dist/crypto/random.js

@@ -0,0 +1,22 @@
+export function randomUrlSafe(byteLength = 32) {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return base64UrlEncode(bytes);
+}
+export function base64UrlEncode(value) {
+    const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export async function sha256(value) {
+    return crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+}
+export async function createPkce() {
+    const verifier = randomUrlSafe(32);
+    const challenge = base64UrlEncode(await sha256(verifier));
+    return { verifier, challenge };
+}
+//# sourceMappingURL=random.js.map

package/dist/crypto/random.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"random.js","sourceRoot":"","sources":["../../src/crypto/random.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,aAAa,CAAC,UAAU,GAAG,EAAE;IAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA+B;IAC7D,MAAM,KAAK,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/dist/errors/index.d.ts

@@ -0,0 +1,3 @@
+export { ProtocolError, ProtocolError as OAuthError } from "./protocol-error.js";
+export { RuntimeError } from "./runtime-error.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/errors/index.js

@@ -0,0 +1,3 @@
+export { ProtocolError, ProtocolError as OAuthError } from "./protocol-error.js";
+export { RuntimeError } from "./runtime-error.js";
+//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/errors/protocol-error.d.ts

@@ -0,0 +1,14 @@
+import { RuntimeError } from "./runtime-error.js";
+export declare class ProtocolError extends RuntimeError {
+    readonly error: string;
+    readonly errorDescription?: string;
+    readonly suberror?: string;
+    readonly continuationToken?: string;
+    constructor(error: string, options?: {
+        errorDescription?: string;
+        suberror?: string;
+        continuationToken?: string;
+        cause?: unknown;
+    });
+}
+//# sourceMappingURL=protocol-error.d.ts.map

package/dist/errors/protocol-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-error.d.ts","sourceRoot":"","sources":["../../src/errors/protocol-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,aAAc,SAAQ,YAAY;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;gBAGlC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;CASJ"}

package/dist/errors/protocol-error.js

@@ -0,0 +1,16 @@
+import { RuntimeError } from "./runtime-error.js";
+export class ProtocolError extends RuntimeError {
+    error;
+    errorDescription;
+    suberror;
+    continuationToken;
+    constructor(error, options) {
+        super(options?.errorDescription ?? error, { code: error, cause: options?.cause });
+        this.name = "ProtocolError";
+        this.error = error;
+        this.errorDescription = options?.errorDescription;
+        this.suberror = options?.suberror;
+        this.continuationToken = options?.continuationToken;
+    }
+}
+//# sourceMappingURL=protocol-error.js.map

package/dist/errors/protocol-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-error.js","sourceRoot":"","sources":["../../src/errors/protocol-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,aAAc,SAAQ,YAAY;IACpC,KAAK,CAAS;IACd,gBAAgB,CAAU;IAC1B,QAAQ,CAAU;IAClB,iBAAiB,CAAU;IAEpC,YACE,KAAa,EACb,OAKC;QAED,KAAK,CAAC,OAAO,EAAE,gBAAgB,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;QAClC,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF"}