@neuroncloud/ido-core 0.1.0

package/dist/errors/runtime-error.d.ts

@@ -0,0 +1,8 @@
+export declare class RuntimeError extends Error {
+    readonly code?: string;
+    constructor(message: string, options?: {
+        code?: string;
+        cause?: unknown;
+    });
+}
+//# sourceMappingURL=runtime-error.d.ts.map

package/dist/errors/runtime-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-error.d.ts","sourceRoot":"","sources":["../../src/errors/runtime-error.ts"],"names":[],"mappings":"AAAA,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAK1E"}

package/dist/errors/runtime-error.js

@@ -0,0 +1,9 @@
+export class RuntimeError extends Error {
+    code;
+    constructor(message, options) {
+        super(message, options?.cause === undefined ? undefined : { cause: options.cause });
+        this.name = "RuntimeError";
+        this.code = options?.code;
+    }
+}
+//# sourceMappingURL=runtime-error.js.map

package/dist/errors/runtime-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-error.js","sourceRoot":"","sources":["../../src/errors/runtime-error.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAU;IAEvB,YAAY,OAAe,EAAE,OAA4C;QACvE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;IAC5B,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+export * from "./constants/index.js";
+export * from "./errors/index.js";
+export { decodeJwt, parseJwt } from "./crypto/jwt.js";
+export type { Jwt, ParsedJwt } from "./crypto/jwt.js";
+export { base64UrlEncode, createPkce, randomUrlSafe, sha256 } from "./crypto/random.js";
+export { loadJwks, resolveSigningKey } from "./crypto/jwks.js";
+export type { JsonWebKeySet, Jwk } from "./crypto/jwks.js";
+export { verifyIdToken } from "./crypto/id-token.js";
+export type { VerifyIdTokenOptions } from "./crypto/id-token.js";
+export type { KeyValueCache, ProtocolConfiguration, ProtocolEndpoints, ProtocolHttpClient, ProtocolHttpResponse, } from "./types/configuration.js";
+export type { Token, TokenKey, Tokens } from "./types/tokens.js";
+export { readUserClaims } from "./types/user.js";
+export type { UserClaims } from "./types/user.js";
+export { AuthenticatorLabels, isMfaMethod, parseMfaMethods, } from "./interaction/types.js";
+export { canceled, failure, pending, success } from "./interaction/response.js";
+export { challengeAuthenticatorStep, challengePasskeyStep, identifyStep, passwordStep, selectAuthenticatorStep, } from "./interaction/remediations.js";
+export { cleanAuthorizationResponseUrl, createAuthorizationRequest, isAuthorizationResponse, readAuthorizationResponse, } from "./oidc/authorization.js";
+export type { AuthorizationConfiguration, AuthorizationRequest, AuthorizationRequestOptions, AuthorizationRequestState, AuthorizationResponse, } from "./oidc/authorization.js";
+export { discoverOpenIdConfiguration } from "./oidc/discovery.js";
+export type { OpenIdConfiguration } from "./oidc/discovery.js";
+export { introspectToken } from "./oidc/introspection.js";
+export type { IntrospectionResult } from "./oidc/introspection.js";
+export { revokeToken } from "./oidc/revocation.js";
+export { exchangeToken, parseTokenResponse, refreshTokens } from "./oidc/token.js";
+export type { TokenRequest, TokenResult } from "./oidc/token.js";
+export { getUserInfo } from "./oidc/user-info.js";
+export type { AuthenticateOptions, AuthenticatorInfo, AuthenticatorKey, InteractionStatus, InteractionResult, NextStep, NextStepInput, ProceedOptions, StartOptions, StepName, TransactionMeta, } from "./interaction/types.js";
+export { asRecord, readNumber, readString, readStringList, readUnknown, } from "./utils/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACtD,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,0BAA0B,EAC1B,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,QAAQ,EACR,aAAa,EACb,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+export * from "./constants/index.js";
+export * from "./errors/index.js";
+export { decodeJwt, parseJwt } from "./crypto/jwt.js";
+export { base64UrlEncode, createPkce, randomUrlSafe, sha256 } from "./crypto/random.js";
+export { loadJwks, resolveSigningKey } from "./crypto/jwks.js";
+export { verifyIdToken } from "./crypto/id-token.js";
+export { readUserClaims } from "./types/user.js";
+export { AuthenticatorLabels, isMfaMethod, parseMfaMethods, } from "./interaction/types.js";
+export { canceled, failure, pending, success } from "./interaction/response.js";
+export { challengeAuthenticatorStep, challengePasskeyStep, identifyStep, passwordStep, selectAuthenticatorStep, } from "./interaction/remediations.js";
+export { cleanAuthorizationResponseUrl, createAuthorizationRequest, isAuthorizationResponse, readAuthorizationResponse, } from "./oidc/authorization.js";
+export { discoverOpenIdConfiguration } from "./oidc/discovery.js";
+export { introspectToken } from "./oidc/introspection.js";
+export { revokeToken } from "./oidc/revocation.js";
+export { exchangeToken, parseTokenResponse, refreshTokens } from "./oidc/token.js";
+export { getUserInfo } from "./oidc/user-info.js";
+export { asRecord, readNumber, readString, readStringList, readUnknown, } from "./utils/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAWrD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGjD,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEnF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAelD,OAAO,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC"}

package/dist/interaction/remediations.d.ts

@@ -0,0 +1,7 @@
+import type { AuthenticatorKey, NextStep } from "./types.js";
+export declare function identifyStep(): NextStep;
+export declare function passwordStep(): NextStep;
+export declare function selectAuthenticatorStep(methods?: AuthenticatorKey[]): NextStep;
+export declare function challengeAuthenticatorStep(): NextStep;
+export declare function challengePasskeyStep(publicKey?: unknown): NextStep;
+//# sourceMappingURL=remediations.d.ts.map

package/dist/interaction/remediations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediations.d.ts","sourceRoot":"","sources":["../../src/interaction/remediations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG7D,wBAAgB,YAAY,IAAI,QAAQ,CAKvC;AAED,wBAAgB,YAAY,IAAI,QAAQ,CAKvC;AAED,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAY9E;AAED,wBAAgB,0BAA0B,IAAI,QAAQ,CAKrD;AAED,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAMlE"}

package/dist/interaction/remediations.js

@@ -0,0 +1,39 @@
+import { AuthenticatorLabels } from "./types.js";
+export function identifyStep() {
+    return {
+        name: "identify",
+        inputs: [{ name: "username", type: "text", required: true }],
+    };
+}
+export function passwordStep() {
+    return {
+        name: "challenge-password",
+        inputs: [{ name: "password", type: "password", required: true }],
+    };
+}
+export function selectAuthenticatorStep(methods) {
+    const defaults = ["authenticator", "recovery_code"];
+    const authenticators = (methods?.length ? methods : defaults).map((key) => ({
+        key,
+        label: AuthenticatorLabels[key],
+    }));
+    return {
+        name: "select-authenticator",
+        inputs: [{ name: "authenticator", required: true }],
+        authenticators,
+    };
+}
+export function challengeAuthenticatorStep() {
+    return {
+        name: "challenge-authenticator",
+        inputs: [{ name: "verificationCode", type: "text", required: true }],
+    };
+}
+export function challengePasskeyStep(publicKey) {
+    return {
+        name: "challenge-passkey",
+        inputs: [{ name: "credential", required: true }],
+        publicKey,
+    };
+}
+//# sourceMappingURL=remediations.js.map

package/dist/interaction/remediations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediations.js","sourceRoot":"","sources":["../../src/interaction/remediations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA4B;IAClE,MAAM,QAAQ,GAAuB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1E,GAAG;QACH,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;KAChC,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnD,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAmB;IACtD,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChD,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/interaction/response.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimeError } from "../errors/runtime-error.js";
+import type { InteractionResult, NextStep } from "./types.js";
+import type { Tokens } from "../types/tokens.js";
+export declare function pending(nextStep: NextStep): InteractionResult;
+export declare function success(tokens: Tokens): InteractionResult;
+export declare function failure(error: RuntimeError, nextStep?: NextStep): InteractionResult;
+export declare function canceled(): InteractionResult;
+//# sourceMappingURL=response.d.ts.map

package/dist/interaction/response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../../src/interaction/response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,wBAAgB,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,iBAAiB,CAE7D;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAEzD;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,iBAAiB,CAOnF;AAED,wBAAgB,QAAQ,IAAI,iBAAiB,CAE5C"}

package/dist/interaction/response.js

@@ -0,0 +1,18 @@
+export function pending(nextStep) {
+    return { status: "PENDING", nextStep };
+}
+export function success(tokens) {
+    return { status: "SUCCESS", tokens };
+}
+export function failure(error, nextStep) {
+    return {
+        status: "FAILURE",
+        error,
+        nextStep,
+        messages: [{ class: "ERROR", message: error.message }],
+    };
+}
+export function canceled() {
+    return { status: "CANCELED" };
+}
+//# sourceMappingURL=response.js.map

package/dist/interaction/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../src/interaction/response.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,OAAO,CAAC,QAAkB;IACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAmB,EAAE,QAAmB;IAC9D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,KAAK;QACL,QAAQ;QACR,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/interaction/types.d.ts

@@ -0,0 +1,65 @@
+import type { RuntimeError } from "../errors/index.js";
+import type { Tokens } from "../types/tokens.js";
+export type InteractionStatus = "SUCCESS" | "PENDING" | "FAILURE" | "TERMINAL" | "CANCELED";
+export type StepName = "identify" | "challenge-password" | "select-authenticator" | "challenge-authenticator" | "challenge-passkey";
+export type AuthenticatorKey = "password" | "passkey" | "authenticator" | "recovery_code";
+export interface NextStepInput {
+    name: string;
+    type?: string;
+    required?: boolean;
+}
+export interface AuthenticatorInfo {
+    key: AuthenticatorKey;
+    label: string;
+}
+export interface NextStep {
+    name: StepName;
+    inputs: NextStepInput[];
+    authenticators?: AuthenticatorInfo[];
+    publicKey?: unknown;
+}
+export interface InteractionResult {
+    status: InteractionStatus;
+    nextStep?: NextStep;
+    tokens?: Tokens;
+    messages?: Array<{
+        class: "ERROR" | "INFO";
+        message: string;
+    }>;
+    error?: RuntimeError;
+}
+export interface AuthenticateOptions {
+    username?: string;
+    password?: string;
+    authenticators?: AuthenticatorKey[];
+}
+export interface StartOptions {
+    username?: string;
+    challengeType: "password" | "passkey";
+    scopes?: string;
+}
+export interface ProceedOptions {
+    step?: StepName;
+    username?: string;
+    password?: string;
+    authenticator?: AuthenticatorKey;
+    verificationCode?: string;
+    credential?: string;
+    continuationToken?: string;
+    publicKey?: unknown;
+}
+export interface TransactionMeta {
+    continuationToken: string;
+    username?: string;
+    challengeType?: string;
+    nextStep: StepName;
+    selectedMethod?: string;
+    availableMethods?: AuthenticatorKey[];
+    publicKey?: unknown;
+    expiresAt?: number;
+    scopes?: string;
+}
+export declare const AuthenticatorLabels: Record<AuthenticatorKey, string>;
+export declare function isMfaMethod(value: string | undefined): value is Extract<AuthenticatorKey, "authenticator" | "recovery_code">;
+export declare function parseMfaMethods(values?: string[]): Array<Extract<AuthenticatorKey, "authenticator" | "recovery_code">>;
+//# sourceMappingURL=types.d.ts.map

package/dist/interaction/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/interaction/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5F,MAAM,MAAM,QAAQ,GAChB,UAAU,GACV,oBAAoB,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,mBAAmB,CAAC;AAExB,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;AAE1F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,gBAAgB,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,UAAU,GAAG,SAAS,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACtC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAKhE,CAAC;AAEF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,eAAe,GAAG,eAAe,CAAC,CAE5H;AAED,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,eAAe,GAAG,eAAe,CAAC,CAAC,CAEtH"}

package/dist/interaction/types.js

@@ -0,0 +1,13 @@
+export const AuthenticatorLabels = {
+    password: "Password",
+    passkey: "Passkey",
+    authenticator: "Authenticator app",
+    recovery_code: "Recovery code",
+};
+export function isMfaMethod(value) {
+    return value === "authenticator" || value === "recovery_code";
+}
+export function parseMfaMethods(values) {
+    return values?.filter(isMfaMethod) ?? [];
+}
+//# sourceMappingURL=types.js.map

package/dist/interaction/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/interaction/types.ts"],"names":[],"mappings":"AA2EA,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,aAAa,EAAE,mBAAmB;IAClC,aAAa,EAAE,eAAe;CAC/B,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,OAAO,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,eAAe,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC"}

package/dist/oidc/authorization.d.ts

@@ -0,0 +1,36 @@
+import type { ProtocolConfiguration } from "../types/configuration.js";
+export interface AuthorizationConfiguration extends ProtocolConfiguration {
+    prompt?: string;
+    idp?: string;
+    extraParams?: Record<string, string>;
+}
+export interface AuthorizationRequestOptions {
+    redirectUri?: string;
+    originalUri?: string;
+    scopes?: string[];
+    loginHint?: string;
+    prompt?: string;
+    idp?: string;
+    extraParams?: Record<string, string>;
+}
+export interface AuthorizationRequestState {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri: string;
+    originalUri?: string;
+    scopes: string;
+}
+export interface AuthorizationRequest {
+    url: string;
+    state: AuthorizationRequestState;
+}
+export interface AuthorizationResponse {
+    code: string;
+    state: string;
+}
+export declare function createAuthorizationRequest(configuration: AuthorizationConfiguration, request?: AuthorizationRequestOptions): Promise<AuthorizationRequest>;
+export declare function readAuthorizationResponse(url: string): AuthorizationResponse;
+export declare function isAuthorizationResponse(url: string): boolean;
+export declare function cleanAuthorizationResponseUrl(url: string): string;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/oidc/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/oidc/authorization.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,yBAAyB,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,0BAA0B,CAC9C,aAAa,EAAE,0BAA0B,EACzC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,oBAAoB,CAAC,CA2C/B;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,CAkB5E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAajE"}

package/dist/oidc/authorization.js

@@ -0,0 +1,89 @@
+import { Parameters } from "../constants/oauth.js";
+import { ProtocolError } from "../errors/protocol-error.js";
+import { RuntimeError } from "../errors/runtime-error.js";
+import { createPkce, randomUrlSafe } from "../crypto/random.js";
+export async function createAuthorizationRequest(configuration, request = {}) {
+    const redirectUri = request.redirectUri ?? configuration.redirectUri;
+    if (!redirectUri) {
+        throw new RuntimeError("redirectUri is required for authorization code flow.", { code: "redirect_uri_required" });
+    }
+    const pkce = await createPkce();
+    const state = randomUrlSafe(16);
+    const nonce = randomUrlSafe(16);
+    const scopes = (request.scopes ?? configuration.scopes).join(" ");
+    const authorize = new URL(configuration.endpoints.authorize);
+    for (const [key, value] of Object.entries({ ...configuration.extraParams, ...request.extraParams })) {
+        if (value) {
+            authorize.searchParams.set(key, value);
+        }
+    }
+    authorize.searchParams.set(Parameters.ClientId, configuration.clientId);
+    authorize.searchParams.set(Parameters.ResponseType, "code");
+    authorize.searchParams.set(Parameters.RedirectUri, redirectUri);
+    authorize.searchParams.set(Parameters.Scope, scopes);
+    authorize.searchParams.set(Parameters.State, state);
+    authorize.searchParams.set(Parameters.Nonce, nonce);
+    authorize.searchParams.set(Parameters.CodeChallenge, pkce.challenge);
+    authorize.searchParams.set(Parameters.CodeChallengeMethod, "S256");
+    setOptional(authorize, Parameters.LoginHint, request.loginHint);
+    setOptional(authorize, Parameters.Prompt, request.prompt ?? configuration.prompt);
+    setOptional(authorize, Parameters.Idp, request.idp ?? configuration.idp);
+    return {
+        url: authorize.toString(),
+        state: {
+            state,
+            nonce,
+            codeVerifier: pkce.verifier,
+            redirectUri,
+            originalUri: request.originalUri,
+            scopes,
+        },
+    };
+}
+export function readAuthorizationResponse(url) {
+    const parameters = authorizationParameters(url);
+    const error = parameters.get("error");
+    if (error) {
+        throw new ProtocolError(error, {
+            errorDescription: parameters.get("error_description") ?? undefined,
+        });
+    }
+    const code = parameters.get("code");
+    const state = parameters.get("state");
+    if (!code || !state) {
+        throw new RuntimeError("The authorization response is incomplete.", { code: "invalid_authorization_response" });
+    }
+    return { code, state };
+}
+export function isAuthorizationResponse(url) {
+    const parameters = authorizationParameters(url);
+    return Boolean(parameters.get("code") || parameters.get("error"));
+}
+export function cleanAuthorizationResponseUrl(url) {
+    try {
+        const parsed = new URL(url);
+        for (const key of ["code", "state", "error", "error_description", "iss"]) {
+            parsed.searchParams.delete(key);
+        }
+        parsed.hash = "";
+        return parsed.toString();
+    }
+    catch {
+        return url;
+    }
+}
+function authorizationParameters(url) {
+    try {
+        const parsed = new URL(url, "http://localhost");
+        return new URLSearchParams(parsed.search || parsed.hash.replace(/^#/, ""));
+    }
+    catch {
+        return new URLSearchParams();
+    }
+}
+function setOptional(url, name, value) {
+    if (value) {
+        url.searchParams.set(name, value);
+    }
+}
+//# sourceMappingURL=authorization.js.map

package/dist/oidc/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/oidc/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAqChE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,aAAyC,EACzC,UAAuC,EAAE;IAEzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,aAAa,CAAC,WAAW,CAAC;IAErE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,sDAAsD,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAE7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACpG,IAAI,KAAK,EAAE,CAAC;YACV,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC5D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAChE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAEnE,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAChE,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAClF,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzE,OAAO;QACL,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;QACzB,KAAK,EAAE;YACL,KAAK;YACL,KAAK;YACL,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,WAAW;YACX,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,aAAa,CAAC,KAAK,EAAE;YAC7B,gBAAgB,EAAE,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC,2CAA2C,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,GAAW;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,eAAe,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ,EAAE,IAAY,EAAE,KAAyB;IACpE,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/oidc/discovery.d.ts

@@ -0,0 +1,16 @@
+import type { ProtocolHttpClient } from "../types/configuration.js";
+export interface OpenIdConfiguration {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userInfoEndpoint?: string;
+    revocationEndpoint?: string;
+    introspectionEndpoint?: string;
+    jwksUri: string;
+    endSessionEndpoint?: string;
+    scopesSupported?: string[];
+    responseTypesSupported?: string[];
+    codeChallengeMethodsSupported?: string[];
+}
+export declare function discoverOpenIdConfiguration(http: ProtocolHttpClient, issuer: string): Promise<OpenIdConfiguration>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/oidc/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/oidc/discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1C;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC,CA0B9B"}

package/dist/oidc/discovery.js

@@ -0,0 +1,31 @@
+import { RuntimeError } from "../errors/runtime-error.js";
+import { asRecord, readString } from "../utils/values.js";
+export async function discoverOpenIdConfiguration(http, issuer) {
+    const url = `${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`;
+    const response = await http.get(url);
+    const body = asRecord(response.body);
+    const discoveredIssuer = readString(body, "issuer");
+    const authorizationEndpoint = readString(body, "authorization_endpoint");
+    const tokenEndpoint = readString(body, "token_endpoint");
+    const jwksUri = readString(body, "jwks_uri");
+    if (response.status < 200 || response.status >= 300 || !discoveredIssuer || !authorizationEndpoint || !tokenEndpoint || !jwksUri) {
+        throw new RuntimeError("The OpenID Connect discovery document is invalid.", { code: "invalid_discovery_document" });
+    }
+    return {
+        issuer: discoveredIssuer,
+        authorizationEndpoint,
+        tokenEndpoint,
+        userInfoEndpoint: readString(body, "userinfo_endpoint"),
+        revocationEndpoint: readString(body, "revocation_endpoint"),
+        introspectionEndpoint: readString(body, "introspection_endpoint"),
+        jwksUri,
+        endSessionEndpoint: readString(body, "end_session_endpoint"),
+        scopesSupported: stringArray(body?.scopes_supported),
+        responseTypesSupported: stringArray(body?.response_types_supported),
+        codeChallengeMethodsSupported: stringArray(body?.code_challenge_methods_supported),
+    };
+}
+function stringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : undefined;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/oidc/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/oidc/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAgB1D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAwB,EACxB,MAAc;IAEd,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACzE,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE7C,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,CAAC;QACjI,MAAM,IAAI,YAAY,CAAC,mDAAmD,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,qBAAqB;QACrB,aAAa;QACb,gBAAgB,EAAE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC;QACvD,kBAAkB,EAAE,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC;QAC3D,qBAAqB,EAAE,UAAU,CAAC,IAAI,EAAE,wBAAwB,CAAC;QACjE,OAAO;QACP,kBAAkB,EAAE,UAAU,CAAC,IAAI,EAAE,sBAAsB,CAAC;QAC5D,eAAe,EAAE,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC;QACpD,sBAAsB,EAAE,WAAW,CAAC,IAAI,EAAE,wBAAwB,CAAC;QACnE,6BAA6B,EAAE,WAAW,CAAC,IAAI,EAAE,gCAAgC,CAAC;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC"}

package/dist/oidc/introspection.d.ts

@@ -0,0 +1,7 @@
+import type { ProtocolConfiguration, ProtocolHttpClient } from "../types/configuration.js";
+export interface IntrospectionResult {
+    active: boolean;
+    [claim: string]: unknown;
+}
+export declare function introspectToken(http: ProtocolHttpClient, configuration: ProtocolConfiguration, token: string, hint?: "access_token" | "refresh_token"): Promise<IntrospectionResult>;
+//# sourceMappingURL=introspection.d.ts.map

package/dist/oidc/introspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.d.ts","sourceRoot":"","sources":["../../src/oidc/introspection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG3F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,kBAAkB,EACxB,aAAa,EAAE,qBAAqB,EACpC,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,cAAc,GAAG,eAAe,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAqB9B"}

package/dist/oidc/introspection.js

@@ -0,0 +1,19 @@
+import { Parameters } from "../constants/oauth.js";
+import { ProtocolError } from "../errors/protocol-error.js";
+import { asRecord, readString } from "../utils/values.js";
+export async function introspectToken(http, configuration, token, hint) {
+    const response = await http.postForm(configuration.endpoints.introspection, {
+        [Parameters.ClientId]: configuration.clientId,
+        [Parameters.Token]: token,
+        [Parameters.TokenTypeHint]: hint ?? "",
+    }, true);
+    const body = asRecord(response.body);
+    if (response.status >= 200 && response.status < 300 && body && typeof body.active === "boolean") {
+        return body;
+    }
+    throw new ProtocolError(readString(body, "error") ?? "invalid_request", {
+        errorDescription: readString(body, "error_description", "errorDescription") ??
+            `The introspection endpoint returned HTTP ${response.status}.`,
+    });
+}
+//# sourceMappingURL=introspection.js.map

package/dist/oidc/introspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.js","sourceRoot":"","sources":["../../src/oidc/introspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAO1D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAwB,EACxB,aAAoC,EACpC,KAAa,EACb,IAAuC;IAEvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAClC,aAAa,CAAC,SAAS,CAAC,aAAa,EACrC;QACE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ;QAC7C,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK;QACzB,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,IAAI,IAAI,EAAE;KACvC,EACD,IAAI,CACL,CAAC;IACF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAErC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChG,OAAO,IAA2B,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,iBAAiB,EAAE;QACtE,gBAAgB,EACd,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;YACzD,4CAA4C,QAAQ,CAAC,MAAM,GAAG;KACjE,CAAC,CAAC;AACL,CAAC"}

package/dist/oidc/revocation.d.ts

@@ -0,0 +1,3 @@
+import type { ProtocolConfiguration, ProtocolHttpClient } from "../types/configuration.js";
+export declare function revokeToken(http: ProtocolHttpClient, configuration: ProtocolConfiguration, token: string, hint?: "access_token" | "refresh_token"): Promise<void>;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/oidc/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/oidc/revocation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE3F,wBAAsB,WAAW,CAC/B,IAAI,EAAE,kBAAkB,EACxB,aAAa,EAAE,qBAAqB,EACpC,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,cAAc,GAAG,eAAe,GACtC,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/oidc/revocation.js

@@ -0,0 +1,9 @@
+import { Parameters } from "../constants/oauth.js";
+export async function revokeToken(http, configuration, token, hint) {
+    await http.postForm(configuration.endpoints.revocation, {
+        [Parameters.ClientId]: configuration.clientId,
+        [Parameters.Token]: token,
+        [Parameters.TokenTypeHint]: hint ?? "",
+    }, true);
+}
+//# sourceMappingURL=revocation.js.map

package/dist/oidc/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/oidc/revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAwB,EACxB,aAAoC,EACpC,KAAa,EACb,IAAuC;IAEvC,MAAM,IAAI,CAAC,QAAQ,CACjB,aAAa,CAAC,SAAS,CAAC,UAAU,EAClC;QACE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ;QAC7C,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK;QACzB,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,IAAI,IAAI,EAAE;KACvC,EACD,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/oidc/token.d.ts

@@ -0,0 +1,22 @@
+import { ProtocolError } from "../errors/protocol-error.js";
+import type { ProtocolConfiguration, ProtocolHttpClient } from "../types/configuration.js";
+import type { Tokens } from "../types/tokens.js";
+export interface TokenRequest {
+    grantType: string;
+    extra?: Record<string, string>;
+    scopes?: string;
+}
+export interface TokenResult {
+    tokens?: Tokens;
+    mfa?: {
+        continuationToken: string;
+        description?: string;
+        availableMethods?: string[];
+        method?: string;
+    };
+    error?: ProtocolError;
+}
+export declare function exchangeToken(http: ProtocolHttpClient, configuration: ProtocolConfiguration, request: TokenRequest): Promise<TokenResult>;
+export declare function refreshTokens(http: ProtocolHttpClient, configuration: ProtocolConfiguration, refreshToken: string): Promise<Tokens>;
+export declare function parseTokenResponse(body: unknown, issuedAt?: number): Tokens;
+//# sourceMappingURL=token.d.ts.map

package/dist/oidc/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/oidc/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE;QACJ,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,kBAAkB,EACxB,aAAa,EAAE,qBAAqB,EACpC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC,CA+CtB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,kBAAkB,EACxB,aAAa,EAAE,qBAAqB,EACpC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,SAAgC,GAAG,MAAM,CAmBlG"}