@schemavaults/auth-common 0.16.1 → 0.22.3

package/dist/index.d.ts

@@ -10,6 +10,9 @@ export * from "./middleware";
 export type * from "./middleware";
 export * from "./pkce";
 export type * from "./pkce";
+export * from "./oidc";
+export type * from "./oidc";
+export { sha256_base64url } from "./sha256_digest";
 export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, collapseWebauthnFactors, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, type AvailableMfaFactor, } from "./authenticate_result";
 export * from "./mfa";
 export { createRequestTokensResultSchema, type RequestTokensResult, createSuccessfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";

package/dist/index.js

@@ -5,6 +5,8 @@ export * from "./credentials";
 export * from "./token-data";
 export * from "./middleware";
 export * from "./pkce";
+export * from "./oidc";
+export { sha256_base64url } from "./sha256_digest";
 export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, collapseWebauthnFactors, } from "./authenticate_result";
 export * from "./mfa";
 export { createRequestTokensResultSchema, createSuccessfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,QAAQ,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}

package/dist/middleware/decode-jwts.d.ts

@@ -1,10 +1,11 @@
 import type { PotentiallyValidTokenSource } from "./token-source";
 import type { DecodeTokenFn } from "./decode-token-type";
 import type { UserData } from "../user_data";
-export interface IDecodeSeveralJwtsInputOptions {
+export interface IDecodeSeveralJwtsInputOptions<TDecoded = UserData> {
     token_sources: readonly PotentiallyValidTokenSource[];
-    decodeJWT: DecodeTokenFn;
+    decodeJWT: DecodeTokenFn<TDecoded>;
     jwt_audience: string;
+    getUserData?: (decoded: TDecoded) => UserData;
 }
-export declare function decodeJWTs({ token_sources, decodeJWT, jwt_audience }: IDecodeSeveralJwtsInputOptions, debug?: boolean): Promise<UserData>;
+export declare function decodeJWTs<TDecoded = UserData>({ token_sources, decodeJWT, jwt_audience, getUserData, }: IDecodeSeveralJwtsInputOptions<TDecoded>, debug?: boolean): Promise<TDecoded>;
 export default decodeJWTs;

package/dist/middleware/decode-jwts.js

@@ -1,4 +1,4 @@
-export async function decodeJWTs({ token_sources, decodeJWT, jwt_audience }, debug = false) {
+export async function decodeJWTs({ token_sources, decodeJWT, jwt_audience, getUserData = (decoded) => decoded, }, debug = false) {
     const n_token_sources = token_sources.length;
     if (!Array.isArray(token_sources) || n_token_sources === 0) {
         throw new Error("Did not receive a list of tokens to decode");
@@ -67,12 +67,13 @@ export async function decodeJWTs({ token_sources, decodeJWT, jwt_audience }, deb
         const subs_set = new Set();
         const emails_set = new Set();
         for (const decoded of successfulDecodeResults) {
-            uids_set.add(decoded.uid);
-            subs_set.add(decoded.sub);
-            if (decoded.uid !== decoded.sub) {
+            const user = getUserData(decoded);
+            uids_set.add(user.uid);
+            subs_set.add(user.sub);
+            if (user.uid !== user.sub) {
                 throw new Error("uid not equal to sub");
             }
-            emails_set.add(decoded.email);
+            emails_set.add(user.email);
         }
         if (uids_set.size !== 1 || subs_set.size !== 1) {
             throw new Error("Token decoding produced different user IDs!");

package/dist/middleware/decode-jwts.js.map

@@ -1 +1 @@
-{"version":3,"file":"decode-jwts.js","sourceRoot":"","sources":["../../src/middleware/decode-jwts.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAkC,EAC1E,QAAiB,KAAK;IAEtB,MAAM,eAAe,GAAW,aAAa,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,MAAM,CACZ,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,GAAG,CAAC,EAC1D,oFAAoF,CACrF,CAAC;IAEF,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,mBAAmB,GAAwB,aAAa,CAAC,GAAG,CAAC,UACjE,KAAkC;QAElC,MAAM,IAAI,GAAmB,KAAK,CAAC,IAAI,CAAC;QAExC,MAAM,cAAc,GAAsB,SAAS,CAAC;YAClD,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY;SACb,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GACjB,MAAM,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAEhD,MAAM,uBAAuB,GAAG,aAAa,CAAC,MAAM,CAClD,SAAS,kBAAkB,CACzB,MAAsC;QAEtC,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,MAAM,uBAAuB,GAC3B,uBAAuB,CAAC,GAAG,CACzB,CAAC,uBAAuB,EAAY,EAAE,CAAC,uBAAuB,CAAC,KAAK,CACrE,CAAC;IAEJ,MAAM,2BAA2B,GAAW,uBAAuB,CAAC,MAAM,CAAC;IAE3E,MAAM,sBAAsB,GAAY,2BAA2B,IAAI,CAAC,CAAC;IAEzE,IAAI,KAAK,IAAI,sBAAsB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CACT,wBAAwB,2BAA2B,IAAI,eAAgC,uBAAuB,CAC/G,CAAC;IACJ,CAAC;IAED,SAAS,mBAAmB,CAAC,MAAmC;QAC9D,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,kBAAkB,CAAC;QACzB,OAAO,YAAY,IAAI,aAAa,MAAM,CAAC,IAAI,GAAG,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACtC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO;YACzC,MAAM,MAAM,GACV,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,iBAAiB,GACrB,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAC7B,CAAC,CAAC,4BAA4B,KAAK,uBAAuB,CAAC;YAC/D,MAAM,MAAM,GAAY,MAAM,CAAC,MAAM,CAAC;YACtC,MAAM,aAAa,GACjB,MAAM,YAAY,KAAK;gBACrB,CAAC,CAAC,MAAM,CAAC,OAAO;gBAChB,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,eAAe,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,KAAK,iBAAiB,YAAY,aAAa,IAAI,CAAC,CAAC;YAC/E,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,eAAe,GAAG,CAAC;YACjB,CAAC,CAAC,+BAA+B,eAAe,mBAAmB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrG,CAAC,CAAC,uDAAuD,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,KAAK,GACT,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,IAAI,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,4BAA4B;QACnC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,UAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAE1C,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,4BAA4B,EAAE,CAAC;IAE/B,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CACZ,2BAA2B,IAAI,CAAC,EAChC,oGAAoG,CACrG,CAAC;IACF,MAAM,qBAAqB,GAAa,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAEnE,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,eAAe,UAAU,CAAC"}
+{"version":3,"file":"decode-jwts.js","sourceRoot":"","sources":["../../src/middleware/decode-jwts.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EACE,aAAa,EACb,SAAS,EACT,YAAY,EACZ,WAAW,GAAG,CAAC,OAAiB,EAAY,EAAE,CAC5C,OAA8B,GACS,EAC3C,QAAiB,KAAK;IAEtB,MAAM,eAAe,GAAW,aAAa,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,MAAM,CACZ,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,GAAG,CAAC,EAC1D,oFAAoF,CACrF,CAAC;IAEF,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,mBAAmB,GAAwB,aAAa,CAAC,GAAG,CAAC,UACjE,KAAkC;QAElC,MAAM,IAAI,GAAmB,KAAK,CAAC,IAAI,CAAC;QAExC,MAAM,cAAc,GAAsB,SAAS,CAAC;YAClD,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY;SACb,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GACjB,MAAM,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAEhD,MAAM,uBAAuB,GAAG,aAAa,CAAC,MAAM,CAClD,SAAS,kBAAkB,CACzB,MAAsC;QAEtC,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,MAAM,uBAAuB,GAC3B,uBAAuB,CAAC,GAAG,CACzB,CAAC,uBAAuB,EAAY,EAAE,CAAC,uBAAuB,CAAC,KAAK,CACrE,CAAC;IAEJ,MAAM,2BAA2B,GAAW,uBAAuB,CAAC,MAAM,CAAC;IAE3E,MAAM,sBAAsB,GAAY,2BAA2B,IAAI,CAAC,CAAC;IAEzE,IAAI,KAAK,IAAI,sBAAsB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CACT,wBAAwB,2BAA2B,IAAI,eAAgC,uBAAuB,CAC/G,CAAC;IACJ,CAAC;IAED,SAAS,mBAAmB,CAAC,MAAmC;QAC9D,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,kBAAkB,CAAC;QACzB,OAAO,YAAY,IAAI,aAAa,MAAM,CAAC,IAAI,GAAG,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACtC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO;YACzC,MAAM,MAAM,GACV,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,iBAAiB,GACrB,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAC7B,CAAC,CAAC,4BAA4B,KAAK,uBAAuB,CAAC;YAC/D,MAAM,MAAM,GAAY,MAAM,CAAC,MAAM,CAAC;YACtC,MAAM,aAAa,GACjB,MAAM,YAAY,KAAK;gBACrB,CAAC,CAAC,MAAM,CAAC,OAAO;gBAChB,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,eAAe,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,KAAK,iBAAiB,YAAY,aAAa,IAAI,CAAC,CAAC;YAC/E,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,eAAe,GAAG,CAAC;YACjB,CAAC,CAAC,+BAA+B,eAAe,mBAAmB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrG,CAAC,CAAC,uDAAuD,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,KAAK,GACT,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,IAAI,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,4BAA4B;QACnC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,UAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAE1C,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAa,WAAW,CAAC,OAAO,CAAC,CAAC;YAC5C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,4BAA4B,EAAE,CAAC;IAE/B,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CACZ,2BAA2B,IAAI,CAAC,EAChC,oGAAoG,CACrG,CAAC;IACF,MAAM,qBAAqB,GAAa,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAEnE,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,eAAe,UAAU,CAAC"}

package/dist/middleware/decode-token-type.d.ts

@@ -3,4 +3,4 @@ import type { PotentiallyValidTokenSource } from "./token-source";
 export interface DecodeTokenFnInputOptions extends PotentiallyValidTokenSource {
     jwt_audience: string;
 }
-export type DecodeTokenFn = (opts: DecodeTokenFnInputOptions) => Promise<UserData>;
+export type DecodeTokenFn<TDecoded = UserData> = (opts: DecodeTokenFnInputOptions) => Promise<TDecoded>;

package/dist/oidc/index.d.ts

@@ -0,0 +1,4 @@
+export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
+export type { OidcSupportedScope, OidcScope, ParsedOidcScopes, } from "./scope";
+export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
+export type { OidcNonce } from "./nonce";

package/dist/oidc/index.js

@@ -0,0 +1,3 @@
+export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
+export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
+//# sourceMappingURL=index.js.map

package/dist/oidc/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC"}

package/dist/oidc/nonce.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+export declare const OIDC_NONCE_VSCHAR_REGEX: RegExp;
+export declare const oidcNonceSchema: z.ZodString;
+export type OidcNonce = z.infer<typeof oidcNonceSchema>;
+/**
+ * Thrown by `parseOidcNonce` when the caller supplied a `nonce` value
+ * that is present but fails schema validation. Server-side entry points
+ * should turn this into a 400 / `invalid_request` response.
+ */
+export declare class OidcNonceValidationError extends Error {
+    readonly reasons: readonly string[];
+    constructor(reasons: readonly string[]);
+}
+/**
+ * Validates an OIDC `nonce` at a server boundary.
+ *
+ *   - Absent / null / undefined → returns `null` (nonce is optional in
+ *     the authorization-code flow).
+ *   - Present + well-formed → returns the validated string.
+ *   - Present + malformed → throws `OidcNonceValidationError` so the
+ *     caller can respond 400 / `invalid_request`.
+ *
+ * Empty strings are treated as malformed (not absent) so an RP that
+ * accidentally serializes `?nonce=` gets a loud signal instead of a
+ * silent downgrade.
+ */
+export declare function parseOidcNonce(raw: unknown): string | null;

package/dist/oidc/nonce.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+// OIDC Core §3.1.2.1 defines `nonce` as an opaque, case-sensitive string
+// the RP binds to its session and verifies when it appears in the
+// id_token. Like the OAuth2 `state` parameter (oauth2-state-schema.ts),
+// the auth server never interprets the value — it only stores it on the
+// authorization-code row and echoes it as an id_token claim — so the
+// validator enforces the same protocol-boundary properties: non-empty,
+// bounded length, printable ASCII only (no control chars / CR-LF that
+// could pollute logs or smuggle terminal escapes through the echo).
+const MAX_OIDC_NONCE_LENGTH = 512;
+export const OIDC_NONCE_VSCHAR_REGEX = /^[\x20-\x7E]+$/;
+export const oidcNonceSchema = z
+    .string()
+    .min(1)
+    .max(MAX_OIDC_NONCE_LENGTH)
+    .regex(OIDC_NONCE_VSCHAR_REGEX, {
+    message: "OIDC 'nonce' must contain only printable ASCII characters",
+});
+/**
+ * Thrown by `parseOidcNonce` when the caller supplied a `nonce` value
+ * that is present but fails schema validation. Server-side entry points
+ * should turn this into a 400 / `invalid_request` response.
+ */
+export class OidcNonceValidationError extends Error {
+    reasons;
+    constructor(reasons) {
+        super(`Invalid OIDC 'nonce' parameter: ${reasons.join("; ")}`);
+        this.name = "OidcNonceValidationError";
+        this.reasons = reasons;
+    }
+}
+/**
+ * Validates an OIDC `nonce` at a server boundary.
+ *
+ *   - Absent / null / undefined → returns `null` (nonce is optional in
+ *     the authorization-code flow).
+ *   - Present + well-formed → returns the validated string.
+ *   - Present + malformed → throws `OidcNonceValidationError` so the
+ *     caller can respond 400 / `invalid_request`.
+ *
+ * Empty strings are treated as malformed (not absent) so an RP that
+ * accidentally serializes `?nonce=` gets a loud signal instead of a
+ * silent downgrade.
+ */
+export function parseOidcNonce(raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw !== "string") {
+        throw new OidcNonceValidationError([
+            `Expected string, got ${Array.isArray(raw) ? "array" : typeof raw}`,
+        ]);
+    }
+    const parsed = oidcNonceSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new OidcNonceValidationError(parsed.error.issues.map((i) => i.message));
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=nonce.js.map

package/dist/oidc/nonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.js","sourceRoot":"","sources":["../../src/oidc/nonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yEAAyE;AACzE,kEAAkE;AAClE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AAEpE,MAAM,qBAAqB,GAAG,GAAY,CAAC;AAE3C,MAAM,CAAC,MAAM,uBAAuB,GAAW,gBAAgB,CAAC;AAEhE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,qBAAqB,CAAC;KAC1B,KAAK,CAAC,uBAAuB,EAAE;IAC9B,OAAO,EAAE,2DAA2D;CACrE,CAAC,CAAC;AAIL;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjC,OAAO,CAAoB;IAC3C,YAAmB,OAA0B;QAC3C,KAAK,CAAC,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,wBAAwB,CAAC;YACjC,wBAAwB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,wBAAwB,CAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/oidc/scope.d.ts

@@ -0,0 +1,63 @@
+/**
+ * OIDC scope handling for the parallel OIDC surface.
+ *
+ * The platform's own authorization model is audience-based
+ * (see audience-schema.ts / APP_TO_API_PERMISSIONS); OAuth2 scopes exist
+ * only on the OIDC surface, where `openid` is mandatory (OIDC Core §3.1.2.1)
+ * and `email`/`profile` gate which claims the id_token and /userinfo
+ * response carry. Unknown scopes are silently dropped per RFC 6749 §3.3
+ * (the granted set is echoed back in the token response, so RPs that
+ * hardcode e.g. "openid profile email address" still interoperate).
+ */
+import { z } from "zod";
+export declare const OIDC_OPENID_SCOPE: "openid";
+export declare const OIDC_SUPPORTED_SCOPES: readonly ["openid", "email", "profile"];
+/**
+ * Scope requested by default when a flow does not name one explicitly:
+ * the SDK's `authenticateWithRedirect`/`sendAuthenticateRequest`
+ * default, and the AuthForm's fallback for entry URLs without a
+ * `scope` parameter (e.g. the auth server's own /account flow).
+ */
+export declare const DEFAULT_AUTH_SCOPE: "openid email profile";
+/**
+ * RFC 6749 §3.3 wire format for the `scope` parameter:
+ *   scope       = scope-token *( SP scope-token )
+ *   scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
+ * i.e. one or more scope-tokens joined by a SINGLE space, where a
+ * scope-token is printable ASCII excluding SP (the delimiter), `"`
+ * (0x22) and `\` (0x5C), and all control chars. This rejects leading /
+ * trailing / repeated spaces and any control / CR-LF that could pollute
+ * logs or the token-response `scope` echo.
+ */
+export declare const OIDC_SCOPE_REGEX: RegExp;
+/**
+ * Validates the FORMAT of a raw `scope` request parameter (RFC 6749
+ * §3.3, bounded length). Orthogonal to `parseAndGrantScopes`, which
+ * decides which of the (well-formed) tokens the platform grants — a
+ * value can be format-valid here yet grant nothing (all tokens
+ * unsupported). Auth flows apply this at the request boundary before
+ * deriving the granted set.
+ */
+export declare const oidcScopeSchema: z.ZodString;
+export type OidcScope = z.infer<typeof oidcScopeSchema>;
+export type OidcSupportedScope = (typeof OIDC_SUPPORTED_SCOPES)[number];
+export interface ParsedOidcScopes {
+    /**
+     * The intersection of the requested scopes with
+     * OIDC_SUPPORTED_SCOPES, deduplicated, in request order.
+     */
+    granted: OidcSupportedScope[];
+    /** Whether the request included the mandatory `openid` scope. */
+    hasOpenid: boolean;
+}
+/**
+ * Parses a raw `scope` request parameter (space-delimited per
+ * RFC 6749 §3.3) into the granted subset. Non-string or empty input
+ * grants nothing (callers reject missing `openid` via `hasOpenid`).
+ */
+export declare function parseAndGrantScopes(raw: unknown): ParsedOidcScopes;
+/**
+ * Serializes granted scopes back to the space-delimited wire format for
+ * the token response `scope` field and the AUTHORIZATION_CODES row.
+ */
+export declare function serializeOidcScopes(scopes: readonly string[]): string;

package/dist/oidc/scope.js

@@ -0,0 +1,84 @@
+/**
+ * OIDC scope handling for the parallel OIDC surface.
+ *
+ * The platform's own authorization model is audience-based
+ * (see audience-schema.ts / APP_TO_API_PERMISSIONS); OAuth2 scopes exist
+ * only on the OIDC surface, where `openid` is mandatory (OIDC Core §3.1.2.1)
+ * and `email`/`profile` gate which claims the id_token and /userinfo
+ * response carry. Unknown scopes are silently dropped per RFC 6749 §3.3
+ * (the granted set is echoed back in the token response, so RPs that
+ * hardcode e.g. "openid profile email address" still interoperate).
+ */
+import { z } from "zod";
+export const OIDC_OPENID_SCOPE = "openid";
+export const OIDC_SUPPORTED_SCOPES = ["openid", "email", "profile"];
+/**
+ * Scope requested by default when a flow does not name one explicitly:
+ * the SDK's `authenticateWithRedirect`/`sendAuthenticateRequest`
+ * default, and the AuthForm's fallback for entry URLs without a
+ * `scope` parameter (e.g. the auth server's own /account flow).
+ */
+export const DEFAULT_AUTH_SCOPE = "openid email profile";
+const MAX_OIDC_SCOPE_LENGTH = 256;
+/**
+ * RFC 6749 §3.3 wire format for the `scope` parameter:
+ *   scope       = scope-token *( SP scope-token )
+ *   scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
+ * i.e. one or more scope-tokens joined by a SINGLE space, where a
+ * scope-token is printable ASCII excluding SP (the delimiter), `"`
+ * (0x22) and `\` (0x5C), and all control chars. This rejects leading /
+ * trailing / repeated spaces and any control / CR-LF that could pollute
+ * logs or the token-response `scope` echo.
+ */
+export const OIDC_SCOPE_REGEX = /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/;
+/**
+ * Validates the FORMAT of a raw `scope` request parameter (RFC 6749
+ * §3.3, bounded length). Orthogonal to `parseAndGrantScopes`, which
+ * decides which of the (well-formed) tokens the platform grants — a
+ * value can be format-valid here yet grant nothing (all tokens
+ * unsupported). Auth flows apply this at the request boundary before
+ * deriving the granted set.
+ */
+export const oidcScopeSchema = z
+    .string()
+    .min(1)
+    .max(MAX_OIDC_SCOPE_LENGTH)
+    .regex(OIDC_SCOPE_REGEX, {
+    message: "'scope' must be a space-delimited list of RFC 6749 §3.3 scope tokens",
+});
+function isSupportedOidcScope(scope) {
+    if (typeof scope !== "string" || scope.length === 0) {
+        throw new TypeError("Expected 'scope' to be a non-empty string!");
+    }
+    return OIDC_SUPPORTED_SCOPES.includes(scope);
+}
+/**
+ * Parses a raw `scope` request parameter (space-delimited per
+ * RFC 6749 §3.3) into the granted subset. Non-string or empty input
+ * grants nothing (callers reject missing `openid` via `hasOpenid`).
+ */
+export function parseAndGrantScopes(raw) {
+    if (typeof raw !== "string") {
+        return { granted: [], hasOpenid: false };
+    }
+    if (!oidcScopeSchema.safeParse(raw).success) {
+        return { granted: [], hasOpenid: false };
+    }
+    const granted = [];
+    for (const token of raw.split(" ")) {
+        if (!token)
+            continue; // collapse repeated separators
+        if (isSupportedOidcScope(token) && !granted.includes(token)) {
+            granted.push(token);
+        }
+    }
+    return { granted, hasOpenid: granted.includes(OIDC_OPENID_SCOPE) };
+}
+/**
+ * Serializes granted scopes back to the space-delimited wire format for
+ * the token response `scope` field and the AUTHORIZATION_CODES row.
+ */
+export function serializeOidcScopes(scopes) {
+    return scopes.join(" ");
+}
+//# sourceMappingURL=scope.js.map

package/dist/oidc/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/oidc/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAA+B,CAAC;AAElE,MAAM,qBAAqB,GAAG,GAAY,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,4DAA4D,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,qBAAqB,CAAC;KAC1B,KAAK,CAAC,gBAAgB,EAAE;IACvB,OAAO,EACL,sEAAsE;CACzE,CAAC,CAAC;AAgBL,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,+BAA+B;QACrD,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC"}

package/dist/pkce/code_challenge.d.ts

@@ -6,7 +6,7 @@ export interface CreateCodeChallengeInputOptions {
         code_verifier: CodeVerifier;
         challenge_time: number;
     };
-    sha256_digest: (code_verifier: string) => Promise<string>;
+    sha256: (code_verifier: string) => Promise<string>;
 }
 export declare function create_code_challenge(verifier_opts: CreateCodeChallengeInputOptions): Promise<CodeChallengeWithDetails>;
 export declare const codeChallengeSchema: z.ZodEffects<z.ZodString, string, string>;

package/dist/pkce/code_challenge.js

@@ -17,7 +17,7 @@ export async function create_code_challenge(verifier_opts) {
     if (typeof max_age === 'number' && max_age !== MAX_PKCE_CODE_VERIFIER_AGE) {
         throw new Error("Code verifier has invalid max_age");
     }
-    const base64url_encoded_hash = await verifier_opts.sha256_digest(code_verifier);
+    const base64url_encoded_hash = await verifier_opts.sha256(code_verifier);
     if (typeof challenge_time !== 'number') {
         throw new Error("'challenge_time' is a required field!");
     }

package/dist/pkce/code_challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"code_challenge.js","sourceRoot":"","sources":["../../src/pkce/code_challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgC,0BAA0B,EAAqB,MAAM,iBAAiB,CAAC;AAE9G,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAe,CAAC;AAOrD,wCAAwC;AACxC,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAA8C;IAE9C,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC;IAC3F,aAAoC,CAAC;IACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAK,OAAO,KAAK,0BAA0B,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IAEhF,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,cAAc,EAAE,sBAAsB;QACtC,qBAAqB;QACrB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,EAAW,CAAC;AAC9C,MAAM,yBAAyB,GAAG,IAAa,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE;KAC1C,GAAG,CAAC,yBAAyB,CAAC;KAC9B,GAAG,CAAC,yBAAyB,CAAC;KAC9B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC/C,OAAO,EAAE,gDAAgD;CAC1D,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,cAAc,EAAE,mBAAmB;IACnC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAA"}
+{"version":3,"file":"code_challenge.js","sourceRoot":"","sources":["../../src/pkce/code_challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgC,0BAA0B,EAAqB,MAAM,iBAAiB,CAAC;AAE9G,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAe,CAAC;AASrD,wCAAwC;AACxC,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAA8C;IAE9C,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC;IAC3F,aAAoC,CAAC;IACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAK,OAAO,KAAK,0BAA0B,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzE,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,cAAc,EAAE,sBAAsB;QACtC,qBAAqB;QACrB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,EAAW,CAAC;AAC9C,MAAM,yBAAyB,GAAG,IAAa,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE;KAC1C,GAAG,CAAC,yBAAyB,CAAC;KAC9B,GAAG,CAAC,yBAAyB,CAAC;KAC9B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC/C,OAAO,EAAE,gDAAgD;CAC1D,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,cAAc,EAAE,mBAAmB;IACnC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAA"}

package/dist/pkce/pkce.js

@@ -1,6 +1,6 @@
 import { create_code_challenge, codeChallengeSchema, code_challenge_method, codeChallengeWithDetailsSchema, } from "./code_challenge";
 import { create_code_verifier, codeVerifierSchema, MAX_PKCE_CODE_VERIFIER_AGE, codeVerifierWithDetailsSchema, } from "./code_verifier";
-import { sha256_digest } from "../sha256_digest";
+import { sha256_base64url } from "../sha256_digest";
 // Handles the creation of a PKCE code verifier and challenge
 export class PKCE_ProofKeyManager {
     code_verifier;
@@ -10,7 +10,7 @@ export class PKCE_ProofKeyManager {
     static async createCodeChallenge(code_verifier) {
         const createCodeChallengeOptions = {
             code_verifier,
-            sha256_digest: sha256_digest,
+            sha256: sha256_base64url,
         };
         const code_challenge = await create_code_challenge(createCodeChallengeOptions);
         return code_challenge;
@@ -57,7 +57,7 @@ export class PKCE_ProofKeyManager {
                 code_verifier: code_verifier.code_verifier,
                 challenge_time: code_verifier.challenge_time,
             },
-            sha256_digest: sha256_digest,
+            sha256: sha256_base64url,
         };
         return await create_code_challenge(codeChallengeOptions);
     }
@@ -109,7 +109,10 @@ export class PKCE_ProofKeyManager {
      * @returns sha256_hash(input_code_verifier) === saved_code_challenge
      */
     static async doesVerifierMatchChallenge(opts) {
-        const { input_code_verifier, saved_code_challenge, challenge_time, timingSafeEqual, } = opts;
+        // `challenge_time` is accepted for caller convenience but is not used
+        // for matching (it does not feed the hash) — the proof is purely
+        // `BASE64URL-ENCODE(SHA256(verifier)) === saved_code_challenge`.
+        const { input_code_verifier, saved_code_challenge, timingSafeEqual } = opts;
         if (typeof input_code_verifier !== "string" || !input_code_verifier) {
             throw new Error("Input code verifier is not a string");
         }
@@ -122,24 +125,23 @@ export class PKCE_ProofKeyManager {
             return false;
         }
         try {
-            // Put the input code verifier through the same process
-            // that (should have) created the initial code_challenge
-            const pkce_flow = new PKCE_ProofKeyManager({
-                code_verifier: input_code_verifier,
-                challenge_time,
-            });
-            const generated_challenge = await pkce_flow.getCodeChallenge();
-            // Timing-safe byte comparison using the caller-provided function.
-            // The caller is responsible for supplying a constant-time comparator;
-            // accepting it as an argument keeps this module free of any runtime
+            // RFC 7636 §4.6: recompute the S256 challenge from the presented
+            // verifier and compare it to the stored one. Both the SchemaVaults
+            // SDK and standard OIDC RPs now emit the strict base64url encoding
+            // (see sha256_base64url), so a single computation covers every client.
+            const expected_challenge = await sha256_base64url(input_code_verifier);
+            // Timing-safe comparison using the caller-provided function. Accepting
+            // the comparator as an argument keeps this module free of any runtime
             // dependency on node:crypto, so it can be bundled for browsers (for
             // createCodeVerifier/createCodeChallenge) without bundler errors.
-            const generatedBuf = Buffer.from(generated_challenge.code_challenge, "base64");
-            const savedBuf = Buffer.from(saved_code_challenge, "base64");
-            if (generatedBuf.length !== savedBuf.length) {
+            // Challenges are compared as raw UTF-8 bytes (length-checked first).
+            const encoder = new TextEncoder();
+            const savedBytes = encoder.encode(saved_code_challenge);
+            const expectedBytes = encoder.encode(expected_challenge);
+            if (expectedBytes.length !== savedBytes.length) {
                 return false;
             }
-            return timingSafeEqual(generatedBuf, savedBuf);
+            return timingSafeEqual(expectedBytes, savedBytes);
         }
         catch (e) {
             console.error(e);

package/dist/pkce/pkce.js.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pkce/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAGrB,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAE1B,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAsBhD,6DAA6D;AAC7D,MAAM,OAAO,oBAAoB;IACvB,aAAa,CAGnB;IAEK,MAAM,CAAC,kBAAkB,CAC9B,cAAuB;QAEvB,OAAO,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,aAAsC;QAEtC,MAAM,0BAA0B,GAAoC;YAClE,aAAa;YACb,aAAa,EAAE,aAAa;SAC7B,CAAC;QACF,MAAM,cAAc,GAClB,MAAM,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC1D,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,6CAA6C;IAC7C,8EAA8E;IAC9E,YACE,aAGC;QAED,IAAI,OAAO,aAAa,KAAK,WAAW,EAAE,CAAC;YACzC,oDAAoD;YACpD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,iFAAiF;YACjF,aAA8B,CAAC;YAE/B,MAAM,QAAQ,GAA6B,aAAa,CAAC,aAAa,CAAC;YACvE,IAAI,CAAC,QAAQ,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;YACpD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,aAAa,GAAG;gBACnB,GAAG,aAAa;gBAChB,aAAa,EAAE,QAAQ;gBACvB,cAAc;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,CAAC;QACrB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,oBAAoB,GAAoC;YAC5D,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;aAC7C;YACD,aAAa,EAAE,aAAa;SAC7B,CAAC;QACF,OAAO,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,kBAAkB;QAClC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAEM,MAAM,KAAK,6BAA6B;QAC7C,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAEM,MAAM,KAAK,8BAA8B;QAC9C,OAAO,8BAA8B,CAAC;IACxC,CAAC;IAEM,MAAM,KAAK,OAAO;QACvB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAEM,MAAM,CAAC,yBAAyB,CACrC,mBAA4B;QAE5B,OAAO,oBAAoB,CAAC,6BAA6B,CAAC,SAAS,CACjE,mBAAmB,CACpB,CAAC,OAAO,CAAC;IACZ,CAAC;IAEM,MAAM,CAAC,0BAA0B,CACtC,oBAA6B;QAE7B,OAAO,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,oBAAoB,CAAC;aACvE,OAAO,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAC5C,IAAsD;QAEtD,MAAM,EACJ,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,GAAG,IAAI,CAAC;QAET,IAAI,OAAO,mBAAmB,KAAK,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,oBAAoB,CAAC,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACzE,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,+BAA+B,EAC/B,qBAAqB,CAAC,KAAK,CAC5B,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,uDAAuD;YACvD,wDAAwD;YACxD,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;gBACzC,aAAa,EAAE,mBAAmB;gBAClC,cAAc;aACf,CAAC,CAAC;YAEH,MAAM,mBAAmB,GACvB,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAErC,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,YAAY,GAAW,MAAM,CAAC,IAAI,CACtC,mBAAmB,CAAC,cAAc,EAClC,QAAQ,CACT,CAAC;YACF,MAAM,QAAQ,GAAW,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;YACrE,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pkce/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAGrB,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAE1B,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAsBnD,6DAA6D;AAC7D,MAAM,OAAO,oBAAoB;IACvB,aAAa,CAGnB;IAEK,MAAM,CAAC,kBAAkB,CAC9B,cAAuB;QAEvB,OAAO,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,aAAsC;QAEtC,MAAM,0BAA0B,GAAoC;YAClE,aAAa;YACb,MAAM,EAAE,gBAAgB;SACzB,CAAC;QACF,MAAM,cAAc,GAClB,MAAM,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC1D,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,6CAA6C;IAC7C,8EAA8E;IAC9E,YACE,aAGC;QAED,IAAI,OAAO,aAAa,KAAK,WAAW,EAAE,CAAC;YACzC,oDAAoD;YACpD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,iFAAiF;YACjF,aAA8B,CAAC;YAE/B,MAAM,QAAQ,GAA6B,aAAa,CAAC,aAAa,CAAC;YACvE,IAAI,CAAC,QAAQ,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;YACpD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,aAAa,GAAG;gBACnB,GAAG,aAAa;gBAChB,aAAa,EAAE,QAAQ;gBACvB,cAAc;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,CAAC;QACrB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,oBAAoB,GAAoC;YAC5D,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;aAC7C;YACD,MAAM,EAAE,gBAAgB;SACzB,CAAC;QACF,OAAO,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,kBAAkB;QAClC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAEM,MAAM,KAAK,6BAA6B;QAC7C,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAEM,MAAM,KAAK,8BAA8B;QAC9C,OAAO,8BAA8B,CAAC;IACxC,CAAC;IAEM,MAAM,KAAK,OAAO;QACvB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAEM,MAAM,CAAC,yBAAyB,CACrC,mBAA4B;QAE5B,OAAO,oBAAoB,CAAC,6BAA6B,CAAC,SAAS,CACjE,mBAAmB,CACpB,CAAC,OAAO,CAAC;IACZ,CAAC;IAEM,MAAM,CAAC,0BAA0B,CACtC,oBAA6B;QAE7B,OAAO,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,oBAAoB,CAAC;aACvE,OAAO,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAC5C,IAAsD;QAEtD,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,MAAM,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QAE5E,IAAI,OAAO,mBAAmB,KAAK,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,oBAAoB,CAAC,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACzE,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,+BAA+B,EAC/B,qBAAqB,CAAC,KAAK,CAC5B,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,uEAAuE;YACvE,MAAM,kBAAkB,GACtB,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;YAE9C,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,UAAU,GAAe,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACpE,MAAM,aAAa,GAAe,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACrE,IAAI,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,eAAe,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/request_tokens_result.d.ts

@@ -425,6 +425,7 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         invite_code?: string | undefined;
     }>>;
     userOrgs: zod.ZodOptional<zod.ZodArray<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, "many">>;
+    nonce: zod.ZodOptional<zod.ZodString>;
 }, "strict", zod.ZodTypeAny, {
     message: string;
     client_app_id: string;
@@ -464,6 +465,7 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         invite_code?: string | undefined;
     } | undefined;
     userOrgs?: string[] | undefined;
+    nonce?: string | undefined;
 }, {
     message: string;
     client_app_id: string;
@@ -503,5 +505,6 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         invite_code?: string | undefined;
     } | undefined;
     userOrgs?: string[] | undefined;
+    nonce?: string | undefined;
 }>]>;
 export type RequestTokensResult = zod.infer<ReturnType<typeof createRequestTokensResultSchema>>;

package/dist/request_tokens_result.js

@@ -2,6 +2,7 @@ import { userDataSchema } from "./user_data";
 import { accessTokenDataSchema, refreshTokenDataSchema } from "./token-data";
 import { createAudienceSchema } from "./audience-schema";
 import { organizationIdSchema } from "./organizations";
+import { oidcNonceSchema } from "./oidc/nonce";
 import { appIdSchema, getAppEnvironment, } from "@schemavaults/app-definitions";
 // NOTE: These schemas are exposed as factories (rather than module-scope
 // constants) because the audience schema depends on the app environment and
@@ -52,6 +53,14 @@ export function createRequestTokensResultSchema(z, environment = getAppEnvironme
         tokens: createSuccessfullyGeneratedTokensRecordSchema(z, environment).optional(),
         userData: userDataSchema.optional(),
         userOrgs: organizationIdSchema.array().optional(),
+        // Echo of the login-time replay nonce bound to the redeemed
+        // authorization code — the custom surface's analogue of the OIDC
+        // id_token `nonce` claim; the SDK verifies it against the value it
+        // stored at redirect time. Absent on refresh grants and on codes
+        // minted before nonces became first-class. Validated with the shared
+        // `oidcNonceSchema` (the same schema that gated it at the login
+        // boundary) so the echo round-trip is symmetric.
+        nonce: oidcNonceSchema.optional(),
     })
         .required({
         success: true,

package/dist/request_tokens_result.js.map

@@ -1 +1 @@
-{"version":3,"file":"request_tokens_result.js","sourceRoot":"","sources":["../src/request_tokens_result.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6CAA6C,CAC3D,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,MAAM;QACL,qFAAqF;QACrF,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,EACpC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACnE;aACA,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACjE,QAAQ,EAAE;QACb,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;YAC7C,IACE,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ;gBAC/C,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,EACnC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,uGAAuG,CAAC;SAC1G,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzD,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,wFAAwF,CAAC,CAAC;AACjG,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAC7C,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,MAAM,mCAAmC,GAAG,CAAC;SAC1C,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,aAAa,EAAE,WAAW;QAC1B,MAAM,EAAE,6CAA6C,CACnD,CAAC,EACD,WAAW,CACZ,CAAC,QAAQ,EAAE;QACZ,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;KAClD,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,MAAM,gCAAgC,GAAG,CAAC;SACvC,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;KACZ,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,OAAO,CAAC,CAAC,KAAK,CAAC;QACb,gCAAgC;QAChC,mCAAmC;KACpC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"request_tokens_result.js","sourceRoot":"","sources":["../src/request_tokens_result.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6CAA6C,CAC3D,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,MAAM;QACL,qFAAqF;QACrF,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,EACpC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACnE;aACA,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACjE,QAAQ,EAAE;QACb,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;YAC7C,IACE,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ;gBAC/C,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,EACnC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,uGAAuG,CAAC;SAC1G,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzD,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,wFAAwF,CAAC,CAAC;AACjG,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAC7C,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,MAAM,mCAAmC,GAAG,CAAC;SAC1C,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,aAAa,EAAE,WAAW;QAC1B,MAAM,EAAE,6CAA6C,CACnD,CAAC,EACD,WAAW,CACZ,CAAC,QAAQ,EAAE;QACZ,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QACjD,4DAA4D;QAC5D,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,qEAAqE;QACrE,gEAAgE;QAChE,iDAAiD;QACjD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;KAClC,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,MAAM,gCAAgC,GAAG,CAAC;SACvC,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;KACZ,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,OAAO,CAAC,CAAC,KAAK,CAAC;QACb,gCAAgC;QAChC,mCAAmC;KACpC,CAAC,CAAC;AACL,CAAC"}

package/dist/sha256_digest/index.d.ts

@@ -1 +1 @@
-export { sha256_digest, sha256_digest as default } from "./sha256_digest";
+export { sha256_base64url, sha256_base64url as default, } from "./sha256_digest";

package/dist/sha256_digest/index.js

@@ -1,2 +1,2 @@
-export { sha256_digest, sha256_digest as default } from "./sha256_digest";
+export { sha256_base64url, sha256_base64url as default, } from "./sha256_digest";
 //# sourceMappingURL=index.js.map

package/dist/sha256_digest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sha256_digest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sha256_digest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,IAAI,OAAO,GAC5B,MAAM,iBAAiB,CAAC"}

package/dist/sha256_digest/sha256_digest.d.ts

@@ -1,3 +1,9 @@
 export declare const digest_algorithm: "SHA-256";
-export declare function sha256_digest(code_verifier: string): Promise<string>;
-export default sha256_digest;
+/**
+ * Strict RFC 7636 §4.2 / RFC 4648 §5 base64url (no padding) encoding of
+ * the SHA-256 digest — the `code_challenge` encoding used by both the
+ * SchemaVaults SDK and standard OAuth2/OIDC clients. Produces a 43-char
+ * string.
+ */
+export declare function sha256_base64url(code_verifier: string): Promise<string>;
+export default sha256_base64url;

package/dist/sha256_digest/sha256_digest.js

@@ -1,6 +1,12 @@
 import isCryptoApiAvailable from "../is_crypto_api_available";
 export const digest_algorithm = "SHA-256";
-export async function sha256_digest(code_verifier) {
+/**
+ * Computes the SHA-256 digest of the input and returns it as a
+ * standard base64 string (RFC 4648 §4, with `+`, `/`, and `=` padding).
+ * Picks the WebCrypto implementation in secure contexts and falls back
+ * to crypto-js in insecure HTTP contexts (both return standard base64).
+ */
+async function sha256_standard_base64(code_verifier) {
     let sha256;
     try {
         if (isCryptoApiAvailable()) {
@@ -21,8 +27,17 @@ export async function sha256_digest(code_verifier) {
     if (typeof output !== "string") {
         throw new TypeError("Expected output to be a string!");
     }
-    // url_encode
-    return output.replace(/[^A-Za-z0-9_-]/g, "_");
+    return output;
 }
-export default sha256_digest;
+/**
+ * Strict RFC 7636 §4.2 / RFC 4648 §5 base64url (no padding) encoding of
+ * the SHA-256 digest — the `code_challenge` encoding used by both the
+ * SchemaVaults SDK and standard OAuth2/OIDC clients. Produces a 43-char
+ * string.
+ */
+export async function sha256_base64url(code_verifier) {
+    const output = await sha256_standard_base64(code_verifier);
+    return output.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export default sha256_base64url;
 //# sourceMappingURL=sha256_digest.js.map

package/dist/sha256_digest/sha256_digest.js.map

@@ -1 +1 @@
-{"version":3,"file":"sha256_digest.js","sourceRoot":"","sources":["../../src/sha256_digest/sha256_digest.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,MAAM,2BAA2B,CAAC;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAkB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,aAAqB;IACvD,IAAI,MAAkD,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,oBAAoB,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IAED,aAAa;IACb,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,eAAe,aAAa,CAAC"}
+{"version":3,"file":"sha256_digest.js","sourceRoot":"","sources":["../../src/sha256_digest/sha256_digest.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,MAAM,2BAA2B,CAAC;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAkB,CAAC;AAEnD;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IACzD,IAAI,MAAkD,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,oBAAoB,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,aAAqB;IAC1D,MAAM,MAAM,GAAW,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,eAAe,gBAAgB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.16.1",
+  "version": "0.22.3",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -14,7 +14,7 @@
   "types": "dist/index.d.ts",
   "dependencies": {
     "zod": "3.25.8",
-    "@schemavaults/app-definitions": "0.10.0",
+    "@schemavaults/app-definitions": "0.11.4",
     "crypto-js": "4.2.0"
   },
   "scripts": {
@@ -27,8 +27,8 @@
     "typecheck": "tsc --project tsconfig.json --noEmit"
   },
   "devDependencies": {
-    "typescript": "5.8.3",
-    "tsc-alias": "1.8.16",
+    "typescript": "6.0.3",
+    "tsc-alias": "1.9.0",
     "@types/crypto-js": "4.2.0",
     "bun-types": "1.3.14",
     "eslint": "9.39.1",