@nexauthxyz/browser 0.1.2

package/dist/discovery.d.ts

@@ -0,0 +1,19 @@
+import type { OpenIdConfiguration } from './types.js';
+export interface OpenIdDiscoveryClientOptions {
+    readonly issuer: string;
+    readonly fetch: typeof globalThis.fetch;
+}
+declare function normalizeIssuer(value: string): string;
+declare function parseDiscoveryDocument(value: unknown, expectedIssuer: string): OpenIdConfiguration;
+export declare class OpenIdDiscoveryClient {
+    private readonly issuer;
+    private readonly fetchImplementation;
+    private request;
+    constructor(options: OpenIdDiscoveryClientOptions);
+    getIssuer(): string;
+    getConfiguration(): Promise<OpenIdConfiguration>;
+    clearCache(): void;
+    private loadConfiguration;
+}
+export { normalizeIssuer, parseDiscoveryDocument };
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACzC;AAqCD,iBAAS,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAuC9C;AA4CD,iBAAS,sBAAsB,CAC7B,KAAK,EAAE,OAAO,EACd,cAAc,EAAE,MAAM,GACrB,mBAAmB,CAyIrB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA0B;IAC9D,OAAO,CAAC,OAAO,CAA2C;gBAEvC,OAAO,EAAE,4BAA4B;IAKjD,SAAS,IAAI,MAAM;IAInB,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAgBhD,UAAU,IAAI,IAAI;YAIX,iBAAiB;CAqDhC;AAED,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/discovery.js

@@ -0,0 +1,190 @@
+import { NexAuthError } from './errors.js';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function requireString(value, field) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new NexAuthError('invalid_discovery_document', `NexAuth discovery metadata is missing "${field}".`);
+    }
+    return value.trim();
+}
+function requireStringArray(value, field) {
+    if (!Array.isArray(value) ||
+        !value.every((item) => typeof item === 'string')) {
+        throw new NexAuthError('invalid_discovery_document', `NexAuth discovery metadata contains an invalid "${field}" value.`);
+    }
+    return value;
+}
+function isLocalHostname(hostname) {
+    return (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]');
+}
+function normalizeIssuer(value) {
+    const normalized = value.trim().replace(/\/+$/, '');
+    let url;
+    try {
+        url = new URL(normalized);
+    }
+    catch (error) {
+        throw new NexAuthError('invalid_configuration', 'The NexAuth issuer must be a valid absolute URL.', {
+            cause: error,
+        });
+    }
+    if (url.username || url.password) {
+        throw new NexAuthError('invalid_configuration', 'The NexAuth issuer must not contain URL credentials.');
+    }
+    if (url.search || url.hash) {
+        throw new NexAuthError('invalid_configuration', 'The NexAuth issuer must not contain query parameters or a fragment.');
+    }
+    if (url.protocol !== 'https:' && !isLocalHostname(url.hostname)) {
+        throw new NexAuthError('invalid_configuration', 'The NexAuth issuer must use HTTPS outside local development.');
+    }
+    return normalized;
+}
+function validateEndpoint(value, field) {
+    const endpoint = requireString(value, field);
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch (error) {
+        throw new NexAuthError('invalid_discovery_document', `NexAuth discovery metadata contains an invalid "${field}" URL.`, {
+            cause: error,
+        });
+    }
+    if (url.username || url.password) {
+        throw new NexAuthError('invalid_discovery_document', `NexAuth discovery endpoint "${field}" must not contain URL credentials.`);
+    }
+    if (url.protocol !== 'https:' && !isLocalHostname(url.hostname)) {
+        throw new NexAuthError('invalid_discovery_document', `NexAuth discovery endpoint "${field}" must use HTTPS.`);
+    }
+    return url.toString();
+}
+function optionalEndpoint(value, field) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    return validateEndpoint(value, field);
+}
+function parseDiscoveryDocument(value, expectedIssuer) {
+    if (!isRecord(value)) {
+        throw new NexAuthError('invalid_discovery_document', 'NexAuth returned an invalid OpenID configuration.');
+    }
+    const discoveredIssuer = normalizeIssuer(requireString(value.issuer, 'issuer'));
+    if (discoveredIssuer !== expectedIssuer) {
+        throw new NexAuthError('invalid_discovery_document', 'The discovered NexAuth issuer does not match the configured issuer.');
+    }
+    const responseTypes = requireStringArray(value.response_types_supported, 'response_types_supported');
+    const grantTypes = requireStringArray(value.grant_types_supported, 'grant_types_supported');
+    const signingAlgorithms = requireStringArray(value.id_token_signing_alg_values_supported, 'id_token_signing_alg_values_supported');
+    const challengeMethods = requireStringArray(value.code_challenge_methods_supported, 'code_challenge_methods_supported');
+    const tokenAuthenticationMethods = requireStringArray(value.token_endpoint_auth_methods_supported, 'token_endpoint_auth_methods_supported');
+    if (!responseTypes.includes('code')) {
+        throw new NexAuthError('invalid_discovery_document', 'NexAuth does not advertise Authorization Code support.');
+    }
+    if (!grantTypes.includes('authorization_code')) {
+        throw new NexAuthError('invalid_discovery_document', 'NexAuth does not advertise the authorization_code grant.');
+    }
+    if (!signingAlgorithms.includes('RS256')) {
+        throw new NexAuthError('invalid_discovery_document', 'NexAuth does not advertise RS256 ID-token signing.');
+    }
+    if (!challengeMethods.includes('S256')) {
+        throw new NexAuthError('invalid_discovery_document', 'NexAuth does not advertise PKCE S256 support.');
+    }
+    if (!tokenAuthenticationMethods.includes('none')) {
+        throw new NexAuthError('invalid_discovery_document', 'NexAuth does not advertise support for public clients.');
+    }
+    const endSessionEndpoint = optionalEndpoint(value.end_session_endpoint, 'end_session_endpoint');
+    const claimsSupported = value.claims_supported === undefined
+        ? undefined
+        : requireStringArray(value.claims_supported, 'claims_supported');
+    return {
+        issuer: discoveredIssuer,
+        authorization_endpoint: validateEndpoint(value.authorization_endpoint, 'authorization_endpoint'),
+        token_endpoint: validateEndpoint(value.token_endpoint, 'token_endpoint'),
+        userinfo_endpoint: validateEndpoint(value.userinfo_endpoint, 'userinfo_endpoint'),
+        jwks_uri: validateEndpoint(value.jwks_uri, 'jwks_uri'),
+        ...(endSessionEndpoint
+            ? {
+                end_session_endpoint: endSessionEndpoint,
+            }
+            : {}),
+        response_types_supported: responseTypes,
+        grant_types_supported: grantTypes,
+        subject_types_supported: requireStringArray(value.subject_types_supported, 'subject_types_supported'),
+        id_token_signing_alg_values_supported: signingAlgorithms,
+        scopes_supported: requireStringArray(value.scopes_supported, 'scopes_supported'),
+        ...(claimsSupported
+            ? {
+                claims_supported: claimsSupported,
+            }
+            : {}),
+        code_challenge_methods_supported: challengeMethods,
+        token_endpoint_auth_methods_supported: tokenAuthenticationMethods,
+    };
+}
+export class OpenIdDiscoveryClient {
+    issuer;
+    fetchImplementation;
+    request;
+    constructor(options) {
+        this.issuer = normalizeIssuer(options.issuer);
+        this.fetchImplementation = options.fetch;
+    }
+    getIssuer() {
+        return this.issuer;
+    }
+    getConfiguration() {
+        if (!this.request) {
+            this.request = this.loadConfiguration().catch((error) => {
+                /*
+                 * Do not permanently cache discovery failures. A later request
+                 * should be able to retry after a temporary network outage.
+                 */
+                this.request = undefined;
+                throw error;
+            });
+        }
+        return this.request;
+    }
+    clearCache() {
+        this.request = undefined;
+    }
+    async loadConfiguration() {
+        const discoveryUrl = `${this.issuer}/.well-known/openid-configuration`;
+        let response;
+        try {
+            response = await this.fetchImplementation(discoveryUrl, {
+                method: 'GET',
+                headers: {
+                    Accept: 'application/json',
+                },
+            });
+        }
+        catch (error) {
+            throw new NexAuthError('network_error', 'Unable to connect to the NexAuth OpenID provider.', {
+                cause: error,
+            });
+        }
+        const requestId = response.headers.get('x-request-id')?.trim() || undefined;
+        if (!response.ok) {
+            throw new NexAuthError('discovery_failed', `Unable to load NexAuth OpenID configuration (${response.status}).`, {
+                status: response.status,
+                ...(requestId ? { requestId } : {}),
+            });
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch (error) {
+            throw new NexAuthError('invalid_discovery_document', 'NexAuth returned malformed OpenID configuration JSON.', {
+                status: response.status,
+                ...(requestId ? { requestId } : {}),
+                cause: error,
+            });
+        }
+        return parseDiscoveryDocument(body, this.issuer);
+    }
+}
+export { normalizeIssuer, parseDiscoveryDocument };
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,0CAA0C,KAAK,IAAI,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAa;IACvD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAChD,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,mDAAmD,KAAK,UAAU,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,CACL,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEpD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,kDAAkD,EAClD;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE7C,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,mDAAmD,KAAK,QAAQ,EAChE;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,+BAA+B,KAAK,qCAAqC,CAC1E,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,+BAA+B,KAAK,mBAAmB,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc,EACd,cAAsB;IAEtB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,eAAe,CACtC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CACtC,CAAC;IAEF,IAAI,gBAAgB,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CACtC,KAAK,CAAC,wBAAwB,EAC9B,0BAA0B,CAC3B,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CACnC,KAAK,CAAC,qBAAqB,EAC3B,uBAAuB,CACxB,CAAC;IAEF,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,KAAK,CAAC,qCAAqC,EAC3C,uCAAuC,CACxC,CAAC;IAEF,MAAM,gBAAgB,GAAG,kBAAkB,CACzC,KAAK,CAAC,gCAAgC,EACtC,kCAAkC,CACnC,CAAC;IAEF,MAAM,0BAA0B,GAAG,kBAAkB,CACnD,KAAK,CAAC,qCAAqC,EAC3C,uCAAuC,CACxC,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,oDAAoD,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,gBAAgB,CACzC,KAAK,CAAC,oBAAoB,EAC1B,sBAAsB,CACvB,CAAC;IAEF,MAAM,eAAe,GACnB,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAClC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAErE,OAAO;QACL,MAAM,EAAE,gBAAgB;QAExB,sBAAsB,EAAE,gBAAgB,CACtC,KAAK,CAAC,sBAAsB,EAC5B,wBAAwB,CACzB;QAED,cAAc,EAAE,gBAAgB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAExE,iBAAiB,EAAE,gBAAgB,CACjC,KAAK,CAAC,iBAAiB,EACvB,mBAAmB,CACpB;QAED,QAAQ,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAEtD,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC;gBACE,oBAAoB,EAAE,kBAAkB;aACzC;YACH,CAAC,CAAC,EAAE,CAAC;QAEP,wBAAwB,EAAE,aAAa;QACvC,qBAAqB,EAAE,UAAU;QAEjC,uBAAuB,EAAE,kBAAkB,CACzC,KAAK,CAAC,uBAAuB,EAC7B,yBAAyB,CAC1B;QAED,qCAAqC,EAAE,iBAAiB;QAExD,gBAAgB,EAAE,kBAAkB,CAClC,KAAK,CAAC,gBAAgB,EACtB,kBAAkB,CACnB;QAED,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC;gBACE,gBAAgB,EAAE,eAAe;aAClC;YACH,CAAC,CAAC,EAAE,CAAC;QAEP,gCAAgC,EAAE,gBAAgB;QAElD,qCAAqC,EAAE,0BAA0B;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,qBAAqB;IACf,MAAM,CAAS;IACf,mBAAmB,CAA0B;IACtD,OAAO,CAA2C;IAE1D,YAAmB,OAAqC;QACtD,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC;IAC3C,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEM,gBAAgB;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC/D;;;mBAGG;gBACH,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBAEzB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEM,UAAU;QACf,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,MAAM,mCAAmC,CAAC;QAEvE,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE;gBACtD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,mDAAmD,EACnD;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,gDAAgD,QAAQ,CAAC,MAAM,IAAI,EACnE;gBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAElB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,uDAAuD,EACvD;gBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,OAAO,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;CACF;AAED,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,16 @@
+export type NexAuthErrorCode = 'invalid_configuration' | 'discovery_failed' | 'invalid_discovery_document' | 'login_failed' | 'callback_failed' | 'invalid_state' | 'missing_authorization_code' | 'missing_pkce_transaction' | 'token_exchange_failed' | 'invalid_token_response' | 'id_token_validation_failed' | 'userinfo_failed' | 'logout_failed' | 'network_error' | 'storage_error' | 'authorization_error';
+export interface NexAuthErrorOptions {
+    readonly status?: number;
+    readonly requestId?: string;
+    readonly cause?: unknown;
+}
+export declare class NexAuthError extends Error {
+    readonly code: NexAuthErrorCode;
+    readonly status: number | undefined;
+    readonly requestId: string | undefined;
+    readonly cause: unknown;
+    constructor(code: NexAuthErrorCode, message: string, options?: NexAuthErrorOptions);
+}
+export declare function isNexAuthError(error: unknown): error is NexAuthError;
+export declare function toNexAuthError(error: unknown, fallbackCode: NexAuthErrorCode, fallbackMessage: string): NexAuthError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GACxB,uBAAuB,GACvB,kBAAkB,GAClB,4BAA4B,GAC5B,cAAc,GACd,iBAAiB,GACjB,eAAe,GACf,4BAA4B,GAC5B,0BAA0B,GAC1B,uBAAuB,GACvB,wBAAwB,GACxB,4BAA4B,GAC5B,iBAAiB,GACjB,eAAe,GACf,eAAe,GACf,eAAe,GACf,qBAAqB,CAAC;AAE1B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAgB,IAAI,EAAE,gBAAgB,CAAC;IACvC,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,SAAgB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,SAAyB,KAAK,EAAE,OAAO,CAAC;gBAGtC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,mBAAwB;CAUpC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,gBAAgB,EAC9B,eAAe,EAAE,MAAM,GACtB,YAAY,CAQd"}

package/dist/errors.js

@@ -0,0 +1,26 @@
+export class NexAuthError extends Error {
+    code;
+    status;
+    requestId;
+    cause;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = 'NexAuthError';
+        this.code = code;
+        this.status = options.status;
+        this.requestId = options.requestId;
+        this.cause = options.cause;
+    }
+}
+export function isNexAuthError(error) {
+    return error instanceof NexAuthError;
+}
+export function toNexAuthError(error, fallbackCode, fallbackMessage) {
+    if (isNexAuthError(error)) {
+        return error;
+    }
+    return new NexAuthError(fallbackCode, fallbackMessage, {
+        cause: error,
+    });
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAwBA,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrB,IAAI,CAAmB;IACvB,MAAM,CAAqB;IAC3B,SAAS,CAAqB;IACrB,KAAK,CAAU;IAExC,YACE,IAAsB,EACtB,OAAe,EACf,UAA+B,EAAE;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,YAAY,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,YAA8B,EAC9B,eAAuB;IAEvB,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,YAAY,CAAC,YAAY,EAAE,eAAe,EAAE;QACrD,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/id-token-verifier.d.ts

@@ -0,0 +1,8 @@
+import type { NexAuthIdTokenClaims, OpenIdConfiguration } from './types.js';
+export declare class IdTokenVerifier {
+    private readonly clientId;
+    private readonly keySets;
+    constructor(clientId: string);
+    verify(idToken: string, configuration: OpenIdConfiguration, expectedNonce: string): Promise<NexAuthIdTokenClaims>;
+}
+//# sourceMappingURL=id-token-verifier.d.ts.map

package/dist/id-token-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token-verifier.d.ts","sourceRoot":"","sources":["../src/id-token-verifier.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiD5E,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;gBAExC,QAAQ,EAAE,MAAM;IAItB,MAAM,CACjB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,mBAAmB,EAClC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;CAoHjC"}

package/dist/id-token-verifier.js

@@ -0,0 +1,121 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { NexAuthError } from './errors.js';
+function requireStringClaim(value, claim) {
+    if (typeof value !== 'string' || !value.trim()) {
+        throw new NexAuthError('id_token_validation_failed', `The NexAuth ID token is missing the required "${claim}" claim.`);
+    }
+    return value;
+}
+function requireNumberClaim(value, claim) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        throw new NexAuthError('id_token_validation_failed', `The NexAuth ID token is missing the required "${claim}" claim.`);
+    }
+    return value;
+}
+function validateAudience(audience) {
+    if (typeof audience === 'string' && audience.trim()) {
+        return audience;
+    }
+    if (Array.isArray(audience) &&
+        audience.length > 0 &&
+        audience.every((value) => typeof value === 'string' && value.trim().length > 0)) {
+        return audience;
+    }
+    throw new NexAuthError('id_token_validation_failed', 'The NexAuth ID token contains an invalid audience.');
+}
+export class IdTokenVerifier {
+    clientId;
+    keySets = new Map();
+    constructor(clientId) {
+        this.clientId = clientId;
+    }
+    async verify(idToken, configuration, expectedNonce) {
+        if (!idToken.trim()) {
+            throw new NexAuthError('id_token_validation_failed', 'NexAuth did not return an ID token.');
+        }
+        let keySet = this.keySets.get(configuration.jwks_uri);
+        if (!keySet) {
+            keySet = createRemoteJWKSet(new URL(configuration.jwks_uri));
+            this.keySets.set(configuration.jwks_uri, keySet);
+        }
+        let payload;
+        try {
+            const result = await jwtVerify(idToken, keySet, {
+                issuer: configuration.issuer,
+                audience: this.clientId,
+                algorithms: ['RS256'],
+                clockTolerance: 5,
+            });
+            payload = result.payload;
+        }
+        catch (error) {
+            throw new NexAuthError('id_token_validation_failed', 'The NexAuth ID token could not be verified.', {
+                cause: error,
+            });
+        }
+        const issuer = requireStringClaim(payload.iss, 'iss');
+        const subject = requireStringClaim(payload.sub, 'sub');
+        const audience = validateAudience(payload.aud);
+        const expiresAt = requireNumberClaim(payload.exp, 'exp');
+        const issuedAt = requireNumberClaim(payload.iat, 'iat');
+        const nonce = requireStringClaim(payload.nonce, 'nonce');
+        if (nonce !== expectedNonce) {
+            throw new NexAuthError('id_token_validation_failed', 'The NexAuth ID token nonce does not match the authorization request.');
+        }
+        /*
+         * OIDC requires azp when an ID token contains multiple audiences.
+         */
+        if (Array.isArray(audience) && audience.length > 1) {
+            if (typeof payload.azp !== 'string' || payload.azp !== this.clientId) {
+                throw new NexAuthError('id_token_validation_failed', 'The NexAuth ID token contains an invalid authorized party.');
+            }
+        }
+        /*
+         * Remove typed optional claims before spreading the JWT payload.
+         * They are added back only when their runtime types are valid.
+         */
+        const sanitizedPayload = {
+            ...payload,
+        };
+        delete sanitizedPayload.email;
+        delete sanitizedPayload.email_verified;
+        delete sanitizedPayload.name;
+        delete sanitizedPayload.picture;
+        delete sanitizedPayload.azp;
+        return {
+            ...sanitizedPayload,
+            iss: issuer,
+            sub: subject,
+            aud: audience,
+            exp: expiresAt,
+            iat: issuedAt,
+            nonce,
+            ...(typeof payload.azp === 'string'
+                ? {
+                    azp: payload.azp,
+                }
+                : {}),
+            ...(typeof payload.email === 'string'
+                ? {
+                    email: payload.email,
+                }
+                : {}),
+            ...(typeof payload.email_verified === 'boolean'
+                ? {
+                    email_verified: payload.email_verified,
+                }
+                : {}),
+            ...(typeof payload.name === 'string'
+                ? {
+                    name: payload.name,
+                }
+                : {}),
+            ...(typeof payload.picture === 'string'
+                ? {
+                    picture: payload.picture,
+                }
+                : {}),
+        };
+    }
+}
+//# sourceMappingURL=id-token-verifier.js.map

package/dist/id-token-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token-verifier.js","sourceRoot":"","sources":["../src/id-token-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAK3C,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAa;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,iDAAiD,KAAK,UAAU,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAa;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,iDAAiD,KAAK,UAAU,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA2B;IAE3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IACE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvB,QAAQ,CAAC,MAAM,GAAG,CAAC;QACnB,QAAQ,CAAC,KAAK,CACZ,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAChE,EACD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,oDAAoD,CACrD,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,eAAe;IACT,QAAQ,CAAS;IACjB,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE3D,YAAmB,QAAgB;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,OAAe,EACf,aAAkC,EAClC,aAAqB;QAErB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,qCAAqC,CACtC,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,OAAmB,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE;gBAC9C,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,CAAC;aAClB,CAAC,CAAC;YAEH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,6CAA6C,EAC7C;gBACE,KAAK,EAAE,KAAK;aACb,CACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED;;WAEG;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrE,MAAM,IAAI,YAAY,CACpB,4BAA4B,EAC5B,4DAA4D,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,MAAM,gBAAgB,GAAe;YACnC,GAAG,OAAO;SACX,CAAC;QAEF,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAC9B,OAAO,gBAAgB,CAAC,cAAc,CAAC;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAC7B,OAAO,gBAAgB,CAAC,OAAO,CAAC;QAChC,OAAO,gBAAgB,CAAC,GAAG,CAAC;QAE5B,OAAO;YACL,GAAG,gBAAgB;YACnB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,QAAQ;YACb,KAAK;YAEL,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBACjC,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;gBACnC,CAAC,CAAC;oBACE,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,KAAK,SAAS;gBAC7C,CAAC,CAAC;oBACE,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAClC,CAAC,CAAC;oBACE,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;gBACrC,CAAC,CAAC;oBACE,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export declare const NEXAUTH_BROWSER_SDK_VERSION = "0.1.0";
+export { NexAuthBrowserClient } from './nexauth-browser-client.js';
+export { NexAuthError, isNexAuthError, toNexAuthError, type NexAuthErrorCode, type NexAuthErrorOptions, } from './errors.js';
+export type { AuthenticationStatus, AuthorizationCallbackInput, AuthorizationCallbackResult, AuthorizationTransaction, LoginOptions, LogoutOptions, NexAuthBrowserClientOptions, NexAuthIdTokenClaims, NexAuthSession, NexAuthStorage, NexAuthUser, OAuthTokenResponse, OpenIdConfiguration, } from './types.js';
+export { getDefaultBrowserStorage, NexAuthStorageManager, type NexAuthStorageEntry, } from './storage.js';
+export { createCodeChallenge, createPkcePair, generateSecureRandomValue, type PkcePair, } from './pkce.js';
+export { OpenIdDiscoveryClient, normalizeIssuer, parseDiscoveryDocument, type OpenIdDiscoveryClientOptions, } from './discovery.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,UAAU,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,YAAY,EACZ,aAAa,EACb,2BAA2B,EAC3B,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,yBAAyB,EACzB,KAAK,QAAQ,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,sBAAsB,EACtB,KAAK,4BAA4B,GAClC,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export const NEXAUTH_BROWSER_SDK_VERSION = '0.1.0';
+export { NexAuthBrowserClient } from './nexauth-browser-client.js';
+export { NexAuthError, isNexAuthError, toNexAuthError, } from './errors.js';
+export { getDefaultBrowserStorage, NexAuthStorageManager, } from './storage.js';
+export { createCodeChallenge, createPkcePair, generateSecureRandomValue, } from './pkce.js';
+export { OpenIdDiscoveryClient, normalizeIssuer, parseDiscoveryDocument, } from './discovery.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAO,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,GAGf,MAAM,aAAa,CAAC;AAiBrB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,yBAAyB,GAE1B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC"}

package/dist/nexauth-browser-client.d.ts

@@ -0,0 +1,23 @@
+import type { AuthorizationCallbackInput, AuthorizationCallbackResult, LoginOptions, LogoutOptions, NexAuthBrowserClientOptions, NexAuthSession, NexAuthUser, OpenIdConfiguration } from './types.js';
+export declare class NexAuthBrowserClient {
+    private readonly clientId;
+    private readonly redirectUri;
+    private readonly scope;
+    private readonly fetchImplementation;
+    private readonly storage;
+    private readonly discovery;
+    private readonly idTokenVerifier;
+    constructor(options: NexAuthBrowserClientOptions);
+    getConfiguration(): Promise<OpenIdConfiguration>;
+    login(options?: LoginOptions): Promise<void>;
+    handleCallback(input?: AuthorizationCallbackInput): Promise<AuthorizationCallbackResult>;
+    getSession(): NexAuthSession | null;
+    isAuthenticated(): boolean;
+    getAccessToken(): string | null;
+    getUser(): NexAuthUser | null;
+    logout(options?: LogoutOptions): Promise<void>;
+    clearLocalSession(): void;
+    private exchangeAuthorizationCode;
+    private loadUserInfo;
+}
+//# sourceMappingURL=nexauth-browser-client.d.ts.map

package/dist/nexauth-browser-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexauth-browser-client.d.ts","sourceRoot":"","sources":["../src/nexauth-browser-client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAE3B,YAAY,EACZ,aAAa,EACb,2BAA2B,EAE3B,cAAc,EACd,WAAW,EAEX,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAiSpB,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA0B;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;gBAE/B,OAAO,EAAE,2BAA2B;IA4C1C,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIhD,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwChD,cAAc,CACzB,KAAK,GAAE,0BAA+B,GACrC,OAAO,CAAC,2BAA2B,CAAC;IAuJhC,UAAU,IAAI,cAAc,GAAG,IAAI;IA8BnC,eAAe,IAAI,OAAO;IAI1B,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B,OAAO,IAAI,WAAW,GAAG,IAAI;IAIvB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuExD,iBAAiB,IAAI,IAAI;YAIlB,yBAAyB;YAoEzB,YAAY;CA4D3B"}