@pymthouse/builder-sdk 0.0.8

package/dist/verify.js

@@ -0,0 +1,179 @@
+import { validateJwtAccessToken, customFetch, allowInsecureRequests, discoveryRequest, processDiscoveryResponse, ResponseBodyError, OperationProcessingError } from 'oauth4webapi';
+
+// src/verify.ts
+
+// src/errors.ts
+var PmtHouseError = class extends Error {
+  status;
+  code;
+  details;
+  constructor(message, {
+    status = 500,
+    code = "pymthouse_error",
+    details
+  } = {}) {
+    super(message);
+    this.name = "PmtHouseError";
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+};
+
+// src/string-utils.ts
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) {
+    end--;
+  }
+  return value.slice(0, end);
+}
+
+// src/discovery.ts
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+var discoveryCache = /* @__PURE__ */ new Map();
+function normalizedIssuerKey(issuerUrl) {
+  return stripTrailingSlashes(issuerUrl);
+}
+async function loadAuthorizationServer(issuerUrl, fetchImpl, options = {}) {
+  const key = normalizedIssuerKey(issuerUrl);
+  const now = Date.now();
+  const cached = discoveryCache.get(key);
+  if (!options.force && cached && now - cached.fetchedAt < CACHE_TTL_MS) {
+    return cached.as;
+  }
+  const issuerIdentifier = new URL(key);
+  const discoveryOpts = {
+    algorithm: "oidc",
+    [customFetch]: fetchImpl
+  };
+  if (options.allowInsecureHttp) {
+    discoveryOpts[allowInsecureRequests] = true;
+  }
+  let response;
+  try {
+    response = await discoveryRequest(issuerIdentifier, discoveryOpts);
+  } catch (e) {
+    throw mapDiscoveryNetworkError(e);
+  }
+  let as;
+  try {
+    as = await processDiscoveryResponse(issuerIdentifier, response);
+  } catch (e) {
+    throw mapOAuthDiscoveryError(e);
+  }
+  discoveryCache.set(key, { as, fetchedAt: now });
+  return as;
+}
+function mapOAuthDiscoveryError(error) {
+  if (error instanceof PmtHouseError) {
+    return error;
+  }
+  if (error instanceof Error) {
+    return new PmtHouseError(error.message, {
+      status: 500,
+      code: "oidc_discovery_invalid",
+      details: { cause: error.cause }
+    });
+  }
+  return new PmtHouseError("OIDC discovery failed", {
+    status: 500,
+    code: "oidc_discovery_invalid"
+  });
+}
+function mapDiscoveryNetworkError(error) {
+  if (error instanceof PmtHouseError) {
+    return error;
+  }
+  if (error instanceof Error) {
+    return new PmtHouseError(`Failed to load OIDC discovery: ${error.message}`, {
+      status: 502,
+      code: "oidc_discovery_failed"
+    });
+  }
+  return new PmtHouseError("Failed to load OIDC discovery", {
+    status: 502,
+    code: "oidc_discovery_failed"
+  });
+}
+function mapOAuthError(error) {
+  if (error instanceof PmtHouseError) {
+    return error;
+  }
+  if (error instanceof ResponseBodyError) {
+    const cause = error.cause;
+    const description = typeof error.error_description === "string" ? error.error_description : error.message;
+    const details = { ...cause };
+    if (typeof cause.error_uri === "string") {
+      details.error_uri = cause.error_uri;
+    }
+    return new PmtHouseError(description, {
+      status: error.status,
+      code: error.error,
+      details
+    });
+  }
+  if (error instanceof OperationProcessingError) {
+    return new PmtHouseError(error.message, {
+      status: 502,
+      code: error.code ?? "oauth_processing_error",
+      details: { cause: error.cause }
+    });
+  }
+  if (error instanceof Error) {
+    return new PmtHouseError(error.message, {
+      status: 500,
+      code: "unexpected_error"
+    });
+  }
+  return new PmtHouseError("Unexpected error", {
+    status: 500,
+    code: "unexpected_error"
+  });
+}
+
+// src/verify.ts
+async function verifyJwt(token, options) {
+  const fetchImpl = options.fetch ?? fetch;
+  const as = await loadAuthorizationServer(options.issuerUrl, fetchImpl, {
+    allowInsecureHttp: options.allowInsecureHttp
+  });
+  const request = new Request("https://resource.invalid/", {
+    headers: {
+      Authorization: `Bearer ${token}`
+    }
+  });
+  const httpOpts = {
+    [customFetch]: fetchImpl
+  };
+  if (options.allowInsecureHttp) {
+    httpOpts[allowInsecureRequests] = true;
+  }
+  try {
+    const claims = await validateJwtAccessToken(
+      as,
+      request,
+      options.audience,
+      httpOpts
+    );
+    if (options.requiredScopes?.length) {
+      const scopeStr = typeof claims.scope === "string" ? claims.scope : "";
+      const have = new Set(scopeStr.split(/\s+/).filter(Boolean));
+      for (const s of options.requiredScopes) {
+        if (!have.has(s)) {
+          throw new PmtHouseError(`Missing required scope: ${s}`, {
+            status: 403,
+            code: "insufficient_scope"
+          });
+        }
+      }
+    }
+    return claims;
+  } catch (e) {
+    throw mapOAuthError(e);
+  }
+}
+
+export { verifyJwt };
+//# sourceMappingURL=verify.js.map
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/string-utils.ts","../src/discovery.ts","../src/oauth-map.ts","../src/verify.ts"],"names":["customFetch","allowInsecureRequests"],"mappings":";;;;;AAAO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,MAAA;AAAA,EACA,IAAA;AAAA,EACA,OAAA;AAAA,EAET,YACE,OAAA,EACA;AAAA,IACE,MAAA,GAAS,GAAA;AAAA,IACT,IAAA,GAAO,iBAAA;AAAA,IACP;AAAA,GACF,GAII,EAAC,EACL;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF,CAAA;;;ACtBO,SAAS,qBAAqB,KAAA,EAAuB;AAC1D,EAAA,IAAI,MAAM,KAAA,CAAM,MAAA;AAChB,EAAA,OAAO,MAAM,CAAA,IAAK,KAAA,CAAM,WAAW,GAAA,GAAM,CAAC,MAAM,EAAA,EAAI;AAClD,IAAA,GAAA,EAAA;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC3B;;;ACuBA,IAAM,YAAA,GAAe,IAAI,EAAA,GAAK,GAAA;AAO9B,IAAM,cAAA,uBAAqB,GAAA,EAAwB;AAEnD,SAAS,oBAAoB,SAAA,EAA2B;AACtD,EAAA,OAAO,qBAAqB,SAAS,CAAA;AACvC;AAUA,eAAsB,uBAAA,CACpB,SAAA,EACA,SAAA,EACA,OAAA,GAA0C,EAAC,EACb;AAC9B,EAAA,MAAM,GAAA,GAAM,oBAAoB,SAAS,CAAA;AACzC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA;AAErC,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,IAAS,UAAU,GAAA,GAAM,MAAA,CAAO,YAAY,YAAA,EAAc;AACrE,IAAA,OAAO,MAAA,CAAO,EAAA;AAAA,EAChB;AAEA,EAAA,MAAM,gBAAA,GAAmB,IAAI,GAAA,CAAI,GAAG,CAAA;AACpC,EAAA,MAAM,aAAA,GAAwD;AAAA,IAC5D,SAAA,EAAW,MAAA;AAAA,IACX,CAAC,WAAW,GAAG;AAAA,GACjB;AACA,EAAA,IAAI,QAAQ,iBAAA,EAAmB;AAC7B,IAAA,aAAA,CAAc,qBAAqB,CAAA,GAAI,IAAA;AAAA,EACzC;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,gBAAA,CAAiB,gBAAA,EAAkB,aAAa,CAAA;AAAA,EACnE,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,yBAAyB,CAAC,CAAA;AAAA,EAClC;AAEA,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAK,MAAM,wBAAA,CAAyB,gBAAA,EAAkB,QAAQ,CAAA;AAAA,EAChE,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,uBAAuB,CAAC,CAAA;AAAA,EAChC;AAEA,EAAA,cAAA,CAAe,IAAI,GAAA,EAAK,EAAE,EAAA,EAAI,SAAA,EAAW,KAAK,CAAA;AAC9C,EAAA,OAAO,EAAA;AACT;AAmBA,SAAS,uBAAuB,KAAA,EAA+B;AAC7D,EAAA,IAAI,iBAAiB,aAAA,EAAe;AAClC,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO,IAAI,aAAA,CAAc,KAAA,CAAM,OAAA,EAAS;AAAA,MACtC,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM,wBAAA;AAAA,MACN,OAAA,EAAS,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA;AAAM,KAC/B,CAAA;AAAA,EACH;AACA,EAAA,OAAO,IAAI,cAAc,uBAAA,EAAyB;AAAA,IAChD,MAAA,EAAQ,GAAA;AAAA,IACR,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEA,SAAS,yBAAyB,KAAA,EAA+B;AAC/D,EAAA,IAAI,iBAAiB,aAAA,EAAe;AAClC,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO,IAAI,aAAA,CAAc,CAAA,+BAAA,EAAkC,KAAA,CAAM,OAAO,CAAA,CAAA,EAAI;AAAA,MAC1E,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,IAAI,cAAc,+BAAA,EAAiC;AAAA,IACxD,MAAA,EAAQ,GAAA;AAAA,IACR,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AClIO,SAAS,cAAc,KAAA,EAA+B;AAC3D,EAAA,IAAI,iBAAiB,aAAA,EAAe;AAClC,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,iBAAiB,iBAAA,EAAmB;AACtC,IAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,IAAA,MAAM,cACJ,OAAO,KAAA,CAAM,sBAAsB,QAAA,GAC/B,KAAA,CAAM,oBACN,KAAA,CAAM,OAAA;AACZ,IAAA,MAAM,OAAA,GAAmC,EAAE,GAAG,KAAA,EAAM;AACpD,IAAA,IAAI,OAAO,KAAA,CAAM,SAAA,KAAc,QAAA,EAAU;AACvC,MAAA,OAAA,CAAQ,YAAY,KAAA,CAAM,SAAA;AAAA,IAC5B;AACA,IAAA,OAAO,IAAI,cAAc,WAAA,EAAa;AAAA,MACpC,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,MAAM,KAAA,CAAM,KAAA;AAAA,MACZ;AAAA,KACD,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,iBAAiB,wBAAA,EAA0B;AAC7C,IAAA,OAAO,IAAI,aAAA,CAAc,KAAA,CAAM,OAAA,EAAS;AAAA,MACtC,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM,MAAM,IAAA,IAAQ,wBAAA;AAAA,MACpB,OAAA,EAAS,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA;AAAM,KAC/B,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO,IAAI,aAAA,CAAc,KAAA,CAAM,OAAA,EAAS;AAAA,MACtC,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,IAAI,cAAc,kBAAA,EAAoB;AAAA,IAC3C,MAAA,EAAQ,GAAA;AAAA,IACR,IAAA,EAAM;AAAA,GACP,CAAA;AACH;;;AC1BA,eAAsB,SAAA,CACpB,OACA,OAAA,EAC+B;AAC/B,EAAA,MAAM,SAAA,GAAY,QAAQ,KAAA,IAAS,KAAA;AACnC,EAAA,MAAM,EAAA,GAAK,MAAM,uBAAA,CAAwB,OAAA,CAAQ,WAAW,SAAA,EAAW;AAAA,IACrE,mBAAmB,OAAA,CAAQ;AAAA,GAC5B,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,2BAAA,EAA6B;AAAA,IACvD,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,KAAK,CAAA;AAAA;AAChC,GACD,CAAA;AAED,EAAA,MAAM,QAAA,GAAoC;AAAA,IACxC,CAACA,WAAW,GAAG;AAAA,GACjB;AACA,EAAA,IAAI,QAAQ,iBAAA,EAAmB;AAC7B,IAAA,QAAA,CAASC,qBAAqB,CAAA,GAAI,IAAA;AAAA,EACpC;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,sBAAA;AAAA,MACnB,EAAA;AAAA,MACA,OAAA;AAAA,MACA,OAAA,CAAQ,QAAA;AAAA,MACR;AAAA,KACF;AAEA,IAAA,IAAI,OAAA,CAAQ,gBAAgB,MAAA,EAAQ;AAClC,MAAA,MAAM,WAAW,OAAO,MAAA,CAAO,KAAA,KAAU,QAAA,GAAW,OAAO,KAAA,GAAQ,EAAA;AACnE,MAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,QAAA,CAAS,MAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAA;AAC1D,MAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,cAAA,EAAgB;AACtC,QAAA,IAAI,CAAC,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,EAAG;AAChB,UAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,CAAC,CAAA,CAAA,EAAI;AAAA,YACtD,MAAA,EAAQ,GAAA;AAAA,YACR,IAAA,EAAM;AAAA,WACP,CAAA;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,cAAc,CAAC,CAAA;AAAA,EACvB;AACF","file":"verify.js","sourcesContent":["export class PmtHouseError extends Error {\n  readonly status: number;\n  readonly code: string;\n  readonly details?: unknown;\n\n  constructor(\n    message: string,\n    {\n      status = 500,\n      code = \"pymthouse_error\",\n      details,\n    }: {\n      status?: number;\n      code?: string;\n      details?: unknown;\n    } = {},\n  ) {\n    super(message);\n    this.name = \"PmtHouseError\";\n    this.status = status;\n    this.code = code;\n    this.details = details;\n  }\n}\n\nexport function toPmtHouseError(\n  error: unknown,\n  fallbackMessage: string,\n): PmtHouseError {\n  if (error instanceof PmtHouseError) {\n    return error;\n  }\n\n  if (error instanceof Error) {\n    return new PmtHouseError(error.message || fallbackMessage, {\n      code: \"unexpected_error\",\n      status: 500,\n    });\n  }\n\n  return new PmtHouseError(fallbackMessage, {\n    code: \"unexpected_error\",\n    status: 500,\n  });\n}\n","/** Removes trailing `/` without regex (linear time). */\nexport function stripTrailingSlashes(value: string): string {\n  let end = value.length;\n  while (end > 0 && value.charCodeAt(end - 1) === 47) {\n    end--;\n  }\n  return value.slice(0, end);\n}\n","import {\n  allowInsecureRequests,\n  customFetch,\n  discoveryRequest,\n  processDiscoveryResponse,\n  type AuthorizationServer,\n} from \"oauth4webapi\";\nimport { PmtHouseError } from \"./errors.js\";\nimport { stripTrailingSlashes } from \"./string-utils.js\";\nimport type { FetchLike, OidcDiscoveryDocument } from \"./types.js\";\n\nexport function authorizationServerToOidcDocument(as: AuthorizationServer): OidcDiscoveryDocument {\n  const tokenEndpoint = as.token_endpoint;\n  const jwksUri = as.jwks_uri;\n  if (!tokenEndpoint || !jwksUri) {\n    throw new PmtHouseError(\"OIDC discovery document is missing token_endpoint or jwks_uri\", {\n      status: 500,\n      code: \"oidc_discovery_invalid\",\n    });\n  }\n  return {\n    issuer: as.issuer,\n    authorization_endpoint: as.authorization_endpoint ?? \"\",\n    token_endpoint: tokenEndpoint,\n    jwks_uri: jwksUri,\n    userinfo_endpoint: as.userinfo_endpoint,\n    device_authorization_endpoint: as.device_authorization_endpoint,\n  };\n}\n\nconst CACHE_TTL_MS = 5 * 60 * 1000;\n\ntype CacheEntry = {\n  as: AuthorizationServer;\n  fetchedAt: number;\n};\n\nconst discoveryCache = new Map<string, CacheEntry>();\n\nfunction normalizedIssuerKey(issuerUrl: string): string {\n  return stripTrailingSlashes(issuerUrl);\n}\n\nexport interface LoadAuthorizationServerOptions {\n  force?: boolean;\n  allowInsecureHttp?: boolean;\n}\n\n/**\n * Loads OIDC discovery metadata via oauth4webapi (RFC 8414 / OIDC Discovery), with a 5-minute cache.\n */\nexport async function loadAuthorizationServer(\n  issuerUrl: string,\n  fetchImpl: FetchLike,\n  options: LoadAuthorizationServerOptions = {},\n): Promise<AuthorizationServer> {\n  const key = normalizedIssuerKey(issuerUrl);\n  const now = Date.now();\n  const cached = discoveryCache.get(key);\n\n  if (!options.force && cached && now - cached.fetchedAt < CACHE_TTL_MS) {\n    return cached.as;\n  }\n\n  const issuerIdentifier = new URL(key);\n  const discoveryOpts: Parameters<typeof discoveryRequest>[1] = {\n    algorithm: \"oidc\",\n    [customFetch]: fetchImpl,\n  };\n  if (options.allowInsecureHttp) {\n    discoveryOpts[allowInsecureRequests] = true;\n  }\n\n  let response: Response;\n  try {\n    response = await discoveryRequest(issuerIdentifier, discoveryOpts);\n  } catch (e) {\n    throw mapDiscoveryNetworkError(e);\n  }\n\n  let as: AuthorizationServer;\n  try {\n    as = await processDiscoveryResponse(issuerIdentifier, response);\n  } catch (e) {\n    throw mapOAuthDiscoveryError(e);\n  }\n\n  discoveryCache.set(key, { as, fetchedAt: now });\n  return as;\n}\n\nexport async function fetchDiscoveryDocument(\n  issuerUrl: string,\n  fetchImpl: FetchLike,\n  options: LoadAuthorizationServerOptions = {},\n): Promise<OidcDiscoveryDocument> {\n  const as = await loadAuthorizationServer(issuerUrl, fetchImpl, options);\n  return authorizationServerToOidcDocument(as);\n}\n\nexport function clearDiscoveryCache(issuerUrl?: string): void {\n  if (!issuerUrl) {\n    discoveryCache.clear();\n    return;\n  }\n  discoveryCache.delete(normalizedIssuerKey(issuerUrl));\n}\n\nfunction mapOAuthDiscoveryError(error: unknown): PmtHouseError {\n  if (error instanceof PmtHouseError) {\n    return error;\n  }\n  if (error instanceof Error) {\n    return new PmtHouseError(error.message, {\n      status: 500,\n      code: \"oidc_discovery_invalid\",\n      details: { cause: error.cause },\n    });\n  }\n  return new PmtHouseError(\"OIDC discovery failed\", {\n    status: 500,\n    code: \"oidc_discovery_invalid\",\n  });\n}\n\nfunction mapDiscoveryNetworkError(error: unknown): PmtHouseError {\n  if (error instanceof PmtHouseError) {\n    return error;\n  }\n  if (error instanceof Error) {\n    return new PmtHouseError(`Failed to load OIDC discovery: ${error.message}`, {\n      status: 502,\n      code: \"oidc_discovery_failed\",\n    });\n  }\n  return new PmtHouseError(\"Failed to load OIDC discovery\", {\n    status: 502,\n    code: \"oidc_discovery_failed\",\n  });\n}\n","import { type Client, OperationProcessingError, ResponseBodyError } from \"oauth4webapi\";\nimport { PmtHouseError } from \"./errors.js\";\nimport type { ClientCredentialsTokenResponse, TokenExchangeResponse } from \"./types.js\";\n\nconst ACCEPTED_ISSUED_TOKEN_TYPES = new Set([\n  \"urn:ietf:params:oauth:token-type:access_token\",\n  \"urn:pmth:token-type:remote-signer-session\",\n]);\n\nexport function mapOAuthError(error: unknown): PmtHouseError {\n  if (error instanceof PmtHouseError) {\n    return error;\n  }\n\n  if (error instanceof ResponseBodyError) {\n    const cause = error.cause as Record<string, unknown>;\n    const description =\n      typeof error.error_description === \"string\"\n        ? error.error_description\n        : error.message;\n    const details: Record<string, unknown> = { ...cause };\n    if (typeof cause.error_uri === \"string\") {\n      details.error_uri = cause.error_uri;\n    }\n    return new PmtHouseError(description, {\n      status: error.status,\n      code: error.error,\n      details,\n    });\n  }\n\n  if (error instanceof OperationProcessingError) {\n    return new PmtHouseError(error.message, {\n      status: 502,\n      code: error.code ?? \"oauth_processing_error\",\n      details: { cause: error.cause },\n    });\n  }\n\n  if (error instanceof Error) {\n    return new PmtHouseError(error.message, {\n      status: 500,\n      code: \"unexpected_error\",\n    });\n  }\n\n  return new PmtHouseError(\"Unexpected error\", {\n    status: 500,\n    code: \"unexpected_error\",\n  });\n}\n\nexport function tokenEndpointResponseToExchange(\n  tr: import(\"oauth4webapi\").TokenEndpointResponse,\n): TokenExchangeResponse {\n  const issued = tr.issued_token_type;\n  if (typeof issued !== \"string\" || !ACCEPTED_ISSUED_TOKEN_TYPES.has(issued)) {\n    throw new PmtHouseError(\"Token exchange returned an unexpected issued_token_type\", {\n      status: 502,\n      code: \"invalid_token_response\",\n      details: { issued_token_type: issued },\n    });\n  }\n\n  const tt = tr.token_type;\n  if (typeof tt !== \"string\" || tt.toLowerCase() !== \"bearer\") {\n    throw new PmtHouseError(\"Token endpoint returned a non-Bearer token_type\", {\n      status: 502,\n      code: \"invalid_token_response\",\n      details: { token_type: tt },\n    });\n  }\n\n  const expiresIn = tr.expires_in;\n  if (typeof expiresIn !== \"number\") {\n    throw new PmtHouseError(\"Token response missing expires_in\", {\n      status: 502,\n      code: \"invalid_token_response\",\n    });\n  }\n\n  const scope = typeof tr.scope === \"string\" ? tr.scope : \"\";\n\n  return {\n    access_token: tr.access_token,\n    token_type: \"Bearer\",\n    expires_in: expiresIn,\n    scope,\n    issued_token_type: issued,\n  };\n}\n\nexport function tokenEndpointResponseToClientCredentials(\n  tr: import(\"oauth4webapi\").TokenEndpointResponse,\n): ClientCredentialsTokenResponse {\n  const tt = tr.token_type;\n  if (typeof tt !== \"string\" || tt.toLowerCase() !== \"bearer\") {\n    throw new PmtHouseError(\"Token endpoint returned a non-Bearer token_type\", {\n      status: 502,\n      code: \"invalid_token_response\",\n      details: { token_type: tt },\n    });\n  }\n\n  return {\n    access_token: tr.access_token,\n    token_type: \"Bearer\",\n    expires_in: tr.expires_in,\n    scope: typeof tr.scope === \"string\" ? tr.scope : undefined,\n  };\n}\n\nexport function m2mClient(clientId: string): Client {\n  return { client_id: clientId };\n}\n","import {\n  allowInsecureRequests,\n  customFetch,\n  validateJwtAccessToken,\n  type JWTAccessTokenClaims,\n} from \"oauth4webapi\";\nimport { loadAuthorizationServer } from \"./discovery.js\";\nimport { PmtHouseError } from \"./errors.js\";\nimport { mapOAuthError } from \"./oauth-map.js\";\nimport type { FetchLike } from \"./types.js\";\n\nexport interface VerifyJwtOptions {\n  issuerUrl: string;\n  /** Expected JWT `aud` (resource identifier). */\n  audience: string;\n  fetch?: FetchLike;\n  allowInsecureHttp?: boolean;\n  /** If set, every scope here must appear in the token's `scope` claim (space-separated). */\n  requiredScopes?: string[];\n}\n\n/**\n * RFC 9068 / RFC 6750: validate a JWT access token using issuer JWKS via oauth4webapi.\n */\nexport async function verifyJwt(\n  token: string,\n  options: VerifyJwtOptions,\n): Promise<JWTAccessTokenClaims> {\n  const fetchImpl = options.fetch ?? fetch;\n  const as = await loadAuthorizationServer(options.issuerUrl, fetchImpl, {\n    allowInsecureHttp: options.allowInsecureHttp,\n  });\n\n  const request = new Request(\"https://resource.invalid/\", {\n    headers: {\n      Authorization: `Bearer ${token}`,\n    },\n  });\n\n  const httpOpts: Record<symbol, unknown> = {\n    [customFetch]: fetchImpl,\n  };\n  if (options.allowInsecureHttp) {\n    httpOpts[allowInsecureRequests] = true;\n  }\n\n  try {\n    const claims = await validateJwtAccessToken(\n      as,\n      request,\n      options.audience,\n      httpOpts as import(\"oauth4webapi\").ValidateJWTAccessTokenOptions,\n    );\n\n    if (options.requiredScopes?.length) {\n      const scopeStr = typeof claims.scope === \"string\" ? claims.scope : \"\";\n      const have = new Set(scopeStr.split(/\\s+/).filter(Boolean));\n      for (const s of options.requiredScopes) {\n        if (!have.has(s)) {\n          throw new PmtHouseError(`Missing required scope: ${s}`, {\n            status: 403,\n            code: \"insufficient_scope\",\n          });\n        }\n      }\n    }\n\n    return claims;\n  } catch (e) {\n    throw mapOAuthError(e);\n  }\n}\n"]}

package/package.json

@@ -0,0 +1,86 @@
+{
+  "name": "@pymthouse/builder-sdk",
+  "version": "0.0.8",
+  "description": "PymtHouse Builder API and OIDC client (OpenID-certified oauth4webapi)",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./format": {
+      "types": "./dist/format.d.ts",
+      "import": "./dist/format.js",
+      "require": "./dist/format.cjs"
+    },
+    "./env": {
+      "types": "./dist/env.d.ts",
+      "import": "./dist/env.js",
+      "require": "./dist/env.cjs"
+    },
+    "./device": {
+      "types": "./dist/device.d.ts",
+      "import": "./dist/device.js",
+      "require": "./dist/device.cjs"
+    },
+    "./verify": {
+      "types": "./dist/verify.d.ts",
+      "import": "./dist/verify.js",
+      "require": "./dist/verify.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "test": "vitest run",
+    "format": "prettier . --write",
+    "format:check": "prettier . --check",
+    "prepack": "pnpm run build"
+  },
+  "dependencies": {
+    "oauth4webapi": "^3.8.5"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.18.0",
+    "@types/node": "^22.10.0",
+    "eslint": "^9.18.0",
+    "prettier": "^3.4.2",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "typescript-eslint": "^8.20.0",
+    "vitest": "^4.1.4"
+  },
+  "packageManager": "pnpm@10.33.0",
+  "license": "MIT",
+  "keywords": [
+    "pymthouse",
+    "oauth2",
+    "oidc",
+    "builder-sdk"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pymthouse/builder-sdk.git"
+  },
+  "bugs": {
+    "url": "https://github.com/pymthouse/builder-sdk/issues"
+  },
+  "homepage": "https://github.com/pymthouse/builder-sdk#readme"
+}