@schemavaults/auth-common 0.16.2 → 0.22.4

package/dist/audience-schema.d.ts

@@ -1,4 +1,20 @@
 import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 import type { z as zod } from "zod";
-export declare function createAudienceSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>;
-export declare function createAudienceListSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">;
+export interface AudienceSchemaOverrides {
+    /**
+     * The auth server's public URL. Browser bundles can't read the
+     * SCHEMAVAULTS_AUTH_SERVER_URL environment variable (they'd silently
+     * resolve the per-environment default), so client-side callers must inject
+     * the URL their auth client was configured with. Server-side callers can
+     * omit it to resolve from the environment.
+     */
+    auth_server_url?: string;
+    /**
+     * The auth server deployment's own app id. Same story as auth_server_url:
+     * client-side callers must inject their configured value in white-label
+     * deployments; server-side callers can omit it.
+     */
+    auth_server_app_id?: string;
+}
+export declare function createAudienceSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>;
+export declare function createAudienceListSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">;

package/dist/audience-schema.js

@@ -1,12 +1,7 @@
 import { apiServerIdSchema, getAppEnvironment, getAuthServerAppId, getAuthServerUrl, } from "@schemavaults/app-definitions";
-// NOTE: Do not add module-scope `createAudienceSchema(...)` results here. The
-// factories below read SCHEMAVAULTS_APP_ENVIRONMENT (via getAppEnvironment()),
-// the auth-server URL, and the auth server's own app id, which are runtime
-// concerns; eager module-scope initialization breaks `next build` in Docker
-// where those env vars are unset.
-export function createAudienceSchema(z, environment = getAppEnvironment()) {
-    const auth_server_url = getAuthServerUrl(environment);
-    const auth_server_app_id = getAuthServerAppId();
+export function createAudienceSchema(z, environment = getAppEnvironment(), overrides) {
+    const auth_server_url = overrides?.auth_server_url ?? getAuthServerUrl(environment);
+    const auth_server_app_id = overrides?.auth_server_app_id ?? getAuthServerAppId();
     const authServerUrlSchema = z
         .string()
         .url()
@@ -20,8 +15,8 @@ export function createAudienceSchema(z, environment = getAppEnvironment()) {
     return z.union([authServerUrlSchema, apiServerIdWithoutAuthServerIdSchema]);
 }
 const MAX_APPS_IN_AUDIENCE_LIST = 10;
-export function createAudienceListSchema(z, environment = getAppEnvironment()) {
-    return createAudienceSchema(z, environment)
+export function createAudienceListSchema(z, environment = getAppEnvironment(), overrides) {
+    return createAudienceSchema(z, environment, overrides)
         .array()
         .min(1, "Audience list may not be empty")
         .max(MAX_APPS_IN_AUDIENCE_LIST, `Audience list may not contain more than ${MAX_APPS_IN_AUDIENCE_LIST} audience references.`);

package/dist/audience-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"audience-schema.js","sourceRoot":"","sources":["../src/audience-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AAGvC,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,4EAA4E;AAC5E,kCAAkC;AAElC,MAAM,UAAU,oBAAoB,CAClC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,MAAM,eAAe,GAAW,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAW,kBAAkB,EAAE,CAAC;IAExD,MAAM,mBAAmB,GAAG,CAAC;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,KAAK,eAAe,CAAC;SACvE,QAAQ,CAAC,8DAA8D,CAAC,CAAC;IAE5E,MAAM,oCAAoC,GAAG,iBAAiB;SAC3D,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACb,OAAO,EAAE,KAAK,kBAAkB,CAAC;IACnC,CAAC,EAAE,iBAAiB,kBAAkB,qGAAqG,CAAC;SAC3I,QAAQ,CACP,4CAA4C,kBAAkB,iBAAiB,CAChF,CAAC;IAEJ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,yBAAyB,GAAG,EAA4B,CAAC;AAE/D,MAAM,UAAU,wBAAwB,CACtC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC;SACxC,KAAK,EAAE;SACP,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;SACxC,GAAG,CACF,yBAAyB,EACzB,2CAA2C,yBAAyB,uBAAuB,CAC5F,CAAC;AACN,CAAC"}
+{"version":3,"file":"audience-schema.js","sourceRoot":"","sources":["../src/audience-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AA0BvC,MAAM,UAAU,oBAAoB,CAClC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,MAAM,eAAe,GACnB,SAAS,EAAE,eAAe,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GACtB,SAAS,EAAE,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;IAExD,MAAM,mBAAmB,GAAG,CAAC;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,KAAK,eAAe,CAAC;SACvE,QAAQ,CAAC,8DAA8D,CAAC,CAAC;IAE5E,MAAM,oCAAoC,GAAG,iBAAiB;SAC3D,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACb,OAAO,EAAE,KAAK,kBAAkB,CAAC;IACnC,CAAC,EAAE,iBAAiB,kBAAkB,qGAAqG,CAAC;SAC3I,QAAQ,CACP,4CAA4C,kBAAkB,iBAAiB,CAChF,CAAC;IAEJ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,yBAAyB,GAAG,EAA4B,CAAC;AAE/D,MAAM,UAAU,wBAAwB,CACtC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SACnD,KAAK,EAAE;SACP,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;SACxC,GAAG,CACF,yBAAyB,EACzB,2CAA2C,yBAAyB,uBAAuB,CAC5F,CAAC;AACN,CAAC"}

package/dist/auth_acquire_tokens_grant_types.d.ts

@@ -1,7 +1,8 @@
 import type { z as zod } from "zod";
+import { type AudienceSchemaOverrides } from "./audience-schema";
 import { SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 export declare const grant_types: readonly ["authorization_code", "refresh_token"];
-export declare function createAuthorizationCodePOSTBodySchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodObject<{
+export declare function createAuthorizationCodePOSTBodySchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodObject<{
     code: zod.ZodString;
     challenge_time: zod.ZodNumber;
     code_verifier: zod.ZodEffects<zod.ZodString, string, string>;
@@ -26,7 +27,7 @@ export declare function createAuthorizationCodePOSTBodySchema(z: typeof zod, env
     grant_type: "authorization_code";
     redirect_uri?: string | null | undefined;
 }>;
-export declare function createRefreshTokenPOSTBodySchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodObject<{
+export declare function createRefreshTokenPOSTBodySchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodObject<{
     audience: zod.ZodUnion<[zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">]>;
     client_app_id: zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>;
     grant_type: zod.ZodLiteral<"refresh_token">;

package/dist/auth_acquire_tokens_grant_types.js

@@ -5,17 +5,17 @@ export const grant_types = [
     "authorization_code",
     "refresh_token",
 ];
-function createTokenEndpointBaseSchema(z, environment = getAppEnvironment()) {
+function createTokenEndpointBaseSchema(z, environment = getAppEnvironment(), overrides) {
     return z.object({
         audience: z.union([
-            createAudienceSchema(z, environment),
-            createAudienceListSchema(z, environment),
+            createAudienceSchema(z, environment, overrides),
+            createAudienceListSchema(z, environment, overrides),
         ]),
         client_app_id: appIdSchema,
     });
 }
-export function createAuthorizationCodePOSTBodySchema(z, environment = getAppEnvironment()) {
-    return createTokenEndpointBaseSchema(z, environment)
+export function createAuthorizationCodePOSTBodySchema(z, environment = getAppEnvironment(), overrides) {
+    return createTokenEndpointBaseSchema(z, environment, overrides)
         .extend({
         grant_type: z.literal("authorization_code"),
         code: z.string().min(64).max(1024).base64url(),
@@ -40,8 +40,8 @@ export function createAuthorizationCodePOSTBodySchema(z, environment = getAppEnv
     })
         .strict();
 }
-export function createRefreshTokenPOSTBodySchema(z, environment = getAppEnvironment()) {
-    return createTokenEndpointBaseSchema(z, environment)
+export function createRefreshTokenPOSTBodySchema(z, environment = getAppEnvironment(), overrides) {
+    return createTokenEndpointBaseSchema(z, environment, overrides)
         .extend({
         grant_type: z.literal("refresh_token"),
         replaceRefreshToo: z.boolean().optional(),

package/dist/auth_acquire_tokens_grant_types.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,SAAS,6BAA6B,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAChB,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC;YACpC,wBAAwB,CAAC,CAAC,EAAE,WAAW,CAAC;SACzC,CAAC;QACF,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,CAAC;SACjD,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE;QAC9C,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;QACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QACxC,8DAA8D;QAC9D,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,qCAAqC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI;KACrB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,CAAC;SACjD,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAEL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,SAAS,6BAA6B,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAChB,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;YAC/C,wBAAwB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SACpD,CAAC;QACF,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE;QAC9C,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;QACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QACxC,8DAA8D;QAC9D,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,qCAAqC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI;KACrB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -10,6 +10,9 @@ export * from "./middleware";
 export type * from "./middleware";
 export * from "./pkce";
 export type * from "./pkce";
+export * from "./oidc";
+export type * from "./oidc";
+export { sha256_base64url } from "./sha256_digest";
 export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, collapseWebauthnFactors, type AuthenticateResult, type AuthenticatedAuthenticateResult, type MfaRequiredAuthenticateResult, type AuthenticateFailureResult, type ChallengeExpiredAuthenticateResult, type AvailableMfaFactor, } from "./authenticate_result";
 export * from "./mfa";
 export { createRequestTokensResultSchema, type RequestTokensResult, createSuccessfullyGeneratedTokensRecordSchema, type SuccessfullyGeneratedTokensRecord, } from "./request_tokens_result";
@@ -18,6 +21,7 @@ export type * from "./auth_acquire_tokens_grant_types";
 export { getAuthServerUrl } from "@schemavaults/app-definitions";
 export { appIdSchema } from "@schemavaults/app-definitions";
 export { createAudienceSchema, createAudienceListSchema, } from "./audience-schema";
+export type { AudienceSchemaOverrides } from "./audience-schema";
 export { inviteCodeFormatSchema, inviteCodeDefinitionSchema, } from "./invite-code";
 export type { InviteCode, InviteCodeDefinition } from "./invite-code";
 export { organizationIdSchema, isValidOrganizationID, RESERVED_ORGANIZATION_IDS, organizationDefinitionSchema, getHardcodedOrgs, getAuthServerOwnerOrganizationId, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_ID, getAuthServerOwnerOrganizationName, DEFAULT_AUTH_SERVER_OWNER_ORGANIZATION_NAME, MAXIMUM_USER_ORGANIZATIONS, MINIMUM_ORGANIZATION_ID_LENGTH, MAXIMUM_ORGANIZATION_ID_LENGTH, inviteMemberInputModes, inviteMemberFormSchema, organizationInvitationStatusTypes, organizationInvitationStatusSchema, organizationInvitationSchema, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, isValidOrganizationMembershipRoleType, organizationMembershipRoleDetailsSchema, isValidOrganizationMembershipRoleDetails, } from "./organizations";

package/dist/index.js

@@ -5,6 +5,8 @@ export * from "./credentials";
 export * from "./token-data";
 export * from "./middleware";
 export * from "./pkce";
+export * from "./oidc";
+export { sha256_base64url } from "./sha256_digest";
 export { authenticateResultSchema, authenticatedAuthenticateResultSchema, mfaRequiredAuthenticateResultSchema, authenticateFailureResultSchema, challengeExpiredAuthenticateResultSchema, availableMfaFactorSchema, collapseWebauthnFactors, } from "./authenticate_result";
 export * from "./mfa";
 export { createRequestTokensResultSchema, createSuccessfullyGeneratedTokensRecordSchema, } from "./request_tokens_result";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,QAAQ,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}

package/dist/middleware/decode-jwts.d.ts

@@ -1,10 +1,11 @@
 import type { PotentiallyValidTokenSource } from "./token-source";
 import type { DecodeTokenFn } from "./decode-token-type";
 import type { UserData } from "../user_data";
-export interface IDecodeSeveralJwtsInputOptions {
+export interface IDecodeSeveralJwtsInputOptions<TDecoded = UserData> {
     token_sources: readonly PotentiallyValidTokenSource[];
-    decodeJWT: DecodeTokenFn;
+    decodeJWT: DecodeTokenFn<TDecoded>;
     jwt_audience: string;
+    getUserData?: (decoded: TDecoded) => UserData;
 }
-export declare function decodeJWTs({ token_sources, decodeJWT, jwt_audience }: IDecodeSeveralJwtsInputOptions, debug?: boolean): Promise<UserData>;
+export declare function decodeJWTs<TDecoded = UserData>({ token_sources, decodeJWT, jwt_audience, getUserData, }: IDecodeSeveralJwtsInputOptions<TDecoded>, debug?: boolean): Promise<TDecoded>;
 export default decodeJWTs;

package/dist/middleware/decode-jwts.js

@@ -1,4 +1,4 @@
-export async function decodeJWTs({ token_sources, decodeJWT, jwt_audience }, debug = false) {
+export async function decodeJWTs({ token_sources, decodeJWT, jwt_audience, getUserData = (decoded) => decoded, }, debug = false) {
     const n_token_sources = token_sources.length;
     if (!Array.isArray(token_sources) || n_token_sources === 0) {
         throw new Error("Did not receive a list of tokens to decode");
@@ -67,12 +67,13 @@ export async function decodeJWTs({ token_sources, decodeJWT, jwt_audience }, deb
         const subs_set = new Set();
         const emails_set = new Set();
         for (const decoded of successfulDecodeResults) {
-            uids_set.add(decoded.uid);
-            subs_set.add(decoded.sub);
-            if (decoded.uid !== decoded.sub) {
+            const user = getUserData(decoded);
+            uids_set.add(user.uid);
+            subs_set.add(user.sub);
+            if (user.uid !== user.sub) {
                 throw new Error("uid not equal to sub");
             }
-            emails_set.add(decoded.email);
+            emails_set.add(user.email);
         }
         if (uids_set.size !== 1 || subs_set.size !== 1) {
             throw new Error("Token decoding produced different user IDs!");

package/dist/middleware/decode-jwts.js.map

@@ -1 +1 @@
-{"version":3,"file":"decode-jwts.js","sourceRoot":"","sources":["../../src/middleware/decode-jwts.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAkC,EAC1E,QAAiB,KAAK;IAEtB,MAAM,eAAe,GAAW,aAAa,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,MAAM,CACZ,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,GAAG,CAAC,EAC1D,oFAAoF,CACrF,CAAC;IAEF,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,mBAAmB,GAAwB,aAAa,CAAC,GAAG,CAAC,UACjE,KAAkC;QAElC,MAAM,IAAI,GAAmB,KAAK,CAAC,IAAI,CAAC;QAExC,MAAM,cAAc,GAAsB,SAAS,CAAC;YAClD,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY;SACb,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GACjB,MAAM,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAEhD,MAAM,uBAAuB,GAAG,aAAa,CAAC,MAAM,CAClD,SAAS,kBAAkB,CACzB,MAAsC;QAEtC,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,MAAM,uBAAuB,GAC3B,uBAAuB,CAAC,GAAG,CACzB,CAAC,uBAAuB,EAAY,EAAE,CAAC,uBAAuB,CAAC,KAAK,CACrE,CAAC;IAEJ,MAAM,2BAA2B,GAAW,uBAAuB,CAAC,MAAM,CAAC;IAE3E,MAAM,sBAAsB,GAAY,2BAA2B,IAAI,CAAC,CAAC;IAEzE,IAAI,KAAK,IAAI,sBAAsB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CACT,wBAAwB,2BAA2B,IAAI,eAAgC,uBAAuB,CAC/G,CAAC;IACJ,CAAC;IAED,SAAS,mBAAmB,CAAC,MAAmC;QAC9D,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,kBAAkB,CAAC;QACzB,OAAO,YAAY,IAAI,aAAa,MAAM,CAAC,IAAI,GAAG,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACtC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO;YACzC,MAAM,MAAM,GACV,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,iBAAiB,GACrB,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAC7B,CAAC,CAAC,4BAA4B,KAAK,uBAAuB,CAAC;YAC/D,MAAM,MAAM,GAAY,MAAM,CAAC,MAAM,CAAC;YACtC,MAAM,aAAa,GACjB,MAAM,YAAY,KAAK;gBACrB,CAAC,CAAC,MAAM,CAAC,OAAO;gBAChB,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,eAAe,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,KAAK,iBAAiB,YAAY,aAAa,IAAI,CAAC,CAAC;YAC/E,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,eAAe,GAAG,CAAC;YACjB,CAAC,CAAC,+BAA+B,eAAe,mBAAmB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrG,CAAC,CAAC,uDAAuD,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,KAAK,GACT,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,IAAI,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,4BAA4B;QACnC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,UAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAE1C,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,4BAA4B,EAAE,CAAC;IAE/B,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CACZ,2BAA2B,IAAI,CAAC,EAChC,oGAAoG,CACrG,CAAC;IACF,MAAM,qBAAqB,GAAa,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAEnE,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,eAAe,UAAU,CAAC"}
+{"version":3,"file":"decode-jwts.js","sourceRoot":"","sources":["../../src/middleware/decode-jwts.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EACE,aAAa,EACb,SAAS,EACT,YAAY,EACZ,WAAW,GAAG,CAAC,OAAiB,EAAY,EAAE,CAC5C,OAA8B,GACS,EAC3C,QAAiB,KAAK;IAEtB,MAAM,eAAe,GAAW,aAAa,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,MAAM,CACZ,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,GAAG,CAAC,EAC1D,oFAAoF,CACrF,CAAC;IAEF,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,mBAAmB,GAAwB,aAAa,CAAC,GAAG,CAAC,UACjE,KAAkC;QAElC,MAAM,IAAI,GAAmB,KAAK,CAAC,IAAI,CAAC;QAExC,MAAM,cAAc,GAAsB,SAAS,CAAC;YAClD,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY;SACb,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GACjB,MAAM,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAEhD,MAAM,uBAAuB,GAAG,aAAa,CAAC,MAAM,CAClD,SAAS,kBAAkB,CACzB,MAAsC;QAEtC,OAAO,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,MAAM,uBAAuB,GAC3B,uBAAuB,CAAC,GAAG,CACzB,CAAC,uBAAuB,EAAY,EAAE,CAAC,uBAAuB,CAAC,KAAK,CACrE,CAAC;IAEJ,MAAM,2BAA2B,GAAW,uBAAuB,CAAC,MAAM,CAAC;IAE3E,MAAM,sBAAsB,GAAY,2BAA2B,IAAI,CAAC,CAAC;IAEzE,IAAI,KAAK,IAAI,sBAAsB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CACT,wBAAwB,2BAA2B,IAAI,eAAgC,uBAAuB,CAC/G,CAAC;IACJ,CAAC;IAED,SAAS,mBAAmB,CAAC,MAAmC;QAC9D,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,kBAAkB,CAAC;QACzB,OAAO,YAAY,IAAI,aAAa,MAAM,CAAC,IAAI,GAAG,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACtC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO;YACzC,MAAM,MAAM,GACV,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,iBAAiB,GACrB,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAC7B,CAAC,CAAC,4BAA4B,KAAK,uBAAuB,CAAC;YAC/D,MAAM,MAAM,GAAY,MAAM,CAAC,MAAM,CAAC;YACtC,MAAM,aAAa,GACjB,MAAM,YAAY,KAAK;gBACrB,CAAC,CAAC,MAAM,CAAC,OAAO;gBAChB,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ;oBAC1B,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,eAAe,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,KAAK,iBAAiB,YAAY,aAAa,IAAI,CAAC,CAAC;YAC/E,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,eAAe,GAAG,CAAC;YACjB,CAAC,CAAC,+BAA+B,eAAe,mBAAmB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrG,CAAC,CAAC,uDAAuD,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,KAAK,GACT,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,IAAI,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,4BAA4B;QACnC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,UAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAE1C,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAa,WAAW,CAAC,OAAO,CAAC,CAAC;YAC5C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,4BAA4B,EAAE,CAAC;IAE/B,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CACZ,2BAA2B,IAAI,CAAC,EAChC,oGAAoG,CACrG,CAAC;IACF,MAAM,qBAAqB,GAAa,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAEnE,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,eAAe,UAAU,CAAC"}

package/dist/middleware/decode-token-type.d.ts

@@ -3,4 +3,4 @@ import type { PotentiallyValidTokenSource } from "./token-source";
 export interface DecodeTokenFnInputOptions extends PotentiallyValidTokenSource {
     jwt_audience: string;
 }
-export type DecodeTokenFn = (opts: DecodeTokenFnInputOptions) => Promise<UserData>;
+export type DecodeTokenFn<TDecoded = UserData> = (opts: DecodeTokenFnInputOptions) => Promise<TDecoded>;

package/dist/oidc/index.d.ts

@@ -0,0 +1,4 @@
+export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
+export type { OidcSupportedScope, OidcScope, ParsedOidcScopes, } from "./scope";
+export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
+export type { OidcNonce } from "./nonce";

package/dist/oidc/index.js

@@ -0,0 +1,3 @@
+export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
+export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
+//# sourceMappingURL=index.js.map

package/dist/oidc/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC"}

package/dist/oidc/nonce.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+export declare const OIDC_NONCE_VSCHAR_REGEX: RegExp;
+export declare const oidcNonceSchema: z.ZodString;
+export type OidcNonce = z.infer<typeof oidcNonceSchema>;
+/**
+ * Thrown by `parseOidcNonce` when the caller supplied a `nonce` value
+ * that is present but fails schema validation. Server-side entry points
+ * should turn this into a 400 / `invalid_request` response.
+ */
+export declare class OidcNonceValidationError extends Error {
+    readonly reasons: readonly string[];
+    constructor(reasons: readonly string[]);
+}
+/**
+ * Validates an OIDC `nonce` at a server boundary.
+ *
+ *   - Absent / null / undefined → returns `null` (nonce is optional in
+ *     the authorization-code flow).
+ *   - Present + well-formed → returns the validated string.
+ *   - Present + malformed → throws `OidcNonceValidationError` so the
+ *     caller can respond 400 / `invalid_request`.
+ *
+ * Empty strings are treated as malformed (not absent) so an RP that
+ * accidentally serializes `?nonce=` gets a loud signal instead of a
+ * silent downgrade.
+ */
+export declare function parseOidcNonce(raw: unknown): string | null;

package/dist/oidc/nonce.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+// OIDC Core §3.1.2.1 defines `nonce` as an opaque, case-sensitive string
+// the RP binds to its session and verifies when it appears in the
+// id_token. Like the OAuth2 `state` parameter (oauth2-state-schema.ts),
+// the auth server never interprets the value — it only stores it on the
+// authorization-code row and echoes it as an id_token claim — so the
+// validator enforces the same protocol-boundary properties: non-empty,
+// bounded length, printable ASCII only (no control chars / CR-LF that
+// could pollute logs or smuggle terminal escapes through the echo).
+const MAX_OIDC_NONCE_LENGTH = 512;
+export const OIDC_NONCE_VSCHAR_REGEX = /^[\x20-\x7E]+$/;
+export const oidcNonceSchema = z
+    .string()
+    .min(1)
+    .max(MAX_OIDC_NONCE_LENGTH)
+    .regex(OIDC_NONCE_VSCHAR_REGEX, {
+    message: "OIDC 'nonce' must contain only printable ASCII characters",
+});
+/**
+ * Thrown by `parseOidcNonce` when the caller supplied a `nonce` value
+ * that is present but fails schema validation. Server-side entry points
+ * should turn this into a 400 / `invalid_request` response.
+ */
+export class OidcNonceValidationError extends Error {
+    reasons;
+    constructor(reasons) {
+        super(`Invalid OIDC 'nonce' parameter: ${reasons.join("; ")}`);
+        this.name = "OidcNonceValidationError";
+        this.reasons = reasons;
+    }
+}
+/**
+ * Validates an OIDC `nonce` at a server boundary.
+ *
+ *   - Absent / null / undefined → returns `null` (nonce is optional in
+ *     the authorization-code flow).
+ *   - Present + well-formed → returns the validated string.
+ *   - Present + malformed → throws `OidcNonceValidationError` so the
+ *     caller can respond 400 / `invalid_request`.
+ *
+ * Empty strings are treated as malformed (not absent) so an RP that
+ * accidentally serializes `?nonce=` gets a loud signal instead of a
+ * silent downgrade.
+ */
+export function parseOidcNonce(raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw !== "string") {
+        throw new OidcNonceValidationError([
+            `Expected string, got ${Array.isArray(raw) ? "array" : typeof raw}`,
+        ]);
+    }
+    const parsed = oidcNonceSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new OidcNonceValidationError(parsed.error.issues.map((i) => i.message));
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=nonce.js.map

package/dist/oidc/nonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.js","sourceRoot":"","sources":["../../src/oidc/nonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yEAAyE;AACzE,kEAAkE;AAClE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AAEpE,MAAM,qBAAqB,GAAG,GAAY,CAAC;AAE3C,MAAM,CAAC,MAAM,uBAAuB,GAAW,gBAAgB,CAAC;AAEhE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,qBAAqB,CAAC;KAC1B,KAAK,CAAC,uBAAuB,EAAE;IAC9B,OAAO,EAAE,2DAA2D;CACrE,CAAC,CAAC;AAIL;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjC,OAAO,CAAoB;IAC3C,YAAmB,OAA0B;QAC3C,KAAK,CAAC,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,wBAAwB,CAAC;YACjC,wBAAwB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,wBAAwB,CAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/oidc/scope.d.ts

@@ -0,0 +1,63 @@
+/**
+ * OIDC scope handling for the parallel OIDC surface.
+ *
+ * The platform's own authorization model is audience-based
+ * (see audience-schema.ts / APP_TO_API_PERMISSIONS); OAuth2 scopes exist
+ * only on the OIDC surface, where `openid` is mandatory (OIDC Core §3.1.2.1)
+ * and `email`/`profile` gate which claims the id_token and /userinfo
+ * response carry. Unknown scopes are silently dropped per RFC 6749 §3.3
+ * (the granted set is echoed back in the token response, so RPs that
+ * hardcode e.g. "openid profile email address" still interoperate).
+ */
+import { z } from "zod";
+export declare const OIDC_OPENID_SCOPE: "openid";
+export declare const OIDC_SUPPORTED_SCOPES: readonly ["openid", "email", "profile"];
+/**
+ * Scope requested by default when a flow does not name one explicitly:
+ * the SDK's `authenticateWithRedirect`/`sendAuthenticateRequest`
+ * default, and the AuthForm's fallback for entry URLs without a
+ * `scope` parameter (e.g. the auth server's own /account flow).
+ */
+export declare const DEFAULT_AUTH_SCOPE: "openid email profile";
+/**
+ * RFC 6749 §3.3 wire format for the `scope` parameter:
+ *   scope       = scope-token *( SP scope-token )
+ *   scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
+ * i.e. one or more scope-tokens joined by a SINGLE space, where a
+ * scope-token is printable ASCII excluding SP (the delimiter), `"`
+ * (0x22) and `\` (0x5C), and all control chars. This rejects leading /
+ * trailing / repeated spaces and any control / CR-LF that could pollute
+ * logs or the token-response `scope` echo.
+ */
+export declare const OIDC_SCOPE_REGEX: RegExp;
+/**
+ * Validates the FORMAT of a raw `scope` request parameter (RFC 6749
+ * §3.3, bounded length). Orthogonal to `parseAndGrantScopes`, which
+ * decides which of the (well-formed) tokens the platform grants — a
+ * value can be format-valid here yet grant nothing (all tokens
+ * unsupported). Auth flows apply this at the request boundary before
+ * deriving the granted set.
+ */
+export declare const oidcScopeSchema: z.ZodString;
+export type OidcScope = z.infer<typeof oidcScopeSchema>;
+export type OidcSupportedScope = (typeof OIDC_SUPPORTED_SCOPES)[number];
+export interface ParsedOidcScopes {
+    /**
+     * The intersection of the requested scopes with
+     * OIDC_SUPPORTED_SCOPES, deduplicated, in request order.
+     */
+    granted: OidcSupportedScope[];
+    /** Whether the request included the mandatory `openid` scope. */
+    hasOpenid: boolean;
+}
+/**
+ * Parses a raw `scope` request parameter (space-delimited per
+ * RFC 6749 §3.3) into the granted subset. Non-string or empty input
+ * grants nothing (callers reject missing `openid` via `hasOpenid`).
+ */
+export declare function parseAndGrantScopes(raw: unknown): ParsedOidcScopes;
+/**
+ * Serializes granted scopes back to the space-delimited wire format for
+ * the token response `scope` field and the AUTHORIZATION_CODES row.
+ */
+export declare function serializeOidcScopes(scopes: readonly string[]): string;

package/dist/oidc/scope.js

@@ -0,0 +1,84 @@
+/**
+ * OIDC scope handling for the parallel OIDC surface.
+ *
+ * The platform's own authorization model is audience-based
+ * (see audience-schema.ts / APP_TO_API_PERMISSIONS); OAuth2 scopes exist
+ * only on the OIDC surface, where `openid` is mandatory (OIDC Core §3.1.2.1)
+ * and `email`/`profile` gate which claims the id_token and /userinfo
+ * response carry. Unknown scopes are silently dropped per RFC 6749 §3.3
+ * (the granted set is echoed back in the token response, so RPs that
+ * hardcode e.g. "openid profile email address" still interoperate).
+ */
+import { z } from "zod";
+export const OIDC_OPENID_SCOPE = "openid";
+export const OIDC_SUPPORTED_SCOPES = ["openid", "email", "profile"];
+/**
+ * Scope requested by default when a flow does not name one explicitly:
+ * the SDK's `authenticateWithRedirect`/`sendAuthenticateRequest`
+ * default, and the AuthForm's fallback for entry URLs without a
+ * `scope` parameter (e.g. the auth server's own /account flow).
+ */
+export const DEFAULT_AUTH_SCOPE = "openid email profile";
+const MAX_OIDC_SCOPE_LENGTH = 256;
+/**
+ * RFC 6749 §3.3 wire format for the `scope` parameter:
+ *   scope       = scope-token *( SP scope-token )
+ *   scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
+ * i.e. one or more scope-tokens joined by a SINGLE space, where a
+ * scope-token is printable ASCII excluding SP (the delimiter), `"`
+ * (0x22) and `\` (0x5C), and all control chars. This rejects leading /
+ * trailing / repeated spaces and any control / CR-LF that could pollute
+ * logs or the token-response `scope` echo.
+ */
+export const OIDC_SCOPE_REGEX = /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/;
+/**
+ * Validates the FORMAT of a raw `scope` request parameter (RFC 6749
+ * §3.3, bounded length). Orthogonal to `parseAndGrantScopes`, which
+ * decides which of the (well-formed) tokens the platform grants — a
+ * value can be format-valid here yet grant nothing (all tokens
+ * unsupported). Auth flows apply this at the request boundary before
+ * deriving the granted set.
+ */
+export const oidcScopeSchema = z
+    .string()
+    .min(1)
+    .max(MAX_OIDC_SCOPE_LENGTH)
+    .regex(OIDC_SCOPE_REGEX, {
+    message: "'scope' must be a space-delimited list of RFC 6749 §3.3 scope tokens",
+});
+function isSupportedOidcScope(scope) {
+    if (typeof scope !== "string" || scope.length === 0) {
+        throw new TypeError("Expected 'scope' to be a non-empty string!");
+    }
+    return OIDC_SUPPORTED_SCOPES.includes(scope);
+}
+/**
+ * Parses a raw `scope` request parameter (space-delimited per
+ * RFC 6749 §3.3) into the granted subset. Non-string or empty input
+ * grants nothing (callers reject missing `openid` via `hasOpenid`).
+ */
+export function parseAndGrantScopes(raw) {
+    if (typeof raw !== "string") {
+        return { granted: [], hasOpenid: false };
+    }
+    if (!oidcScopeSchema.safeParse(raw).success) {
+        return { granted: [], hasOpenid: false };
+    }
+    const granted = [];
+    for (const token of raw.split(" ")) {
+        if (!token)
+            continue; // collapse repeated separators
+        if (isSupportedOidcScope(token) && !granted.includes(token)) {
+            granted.push(token);
+        }
+    }
+    return { granted, hasOpenid: granted.includes(OIDC_OPENID_SCOPE) };
+}
+/**
+ * Serializes granted scopes back to the space-delimited wire format for
+ * the token response `scope` field and the AUTHORIZATION_CODES row.
+ */
+export function serializeOidcScopes(scopes) {
+    return scopes.join(" ");
+}
+//# sourceMappingURL=scope.js.map

package/dist/oidc/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/oidc/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAA+B,CAAC;AAElE,MAAM,qBAAqB,GAAG,GAAY,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,4DAA4D,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,qBAAqB,CAAC;KAC1B,KAAK,CAAC,gBAAgB,EAAE;IACvB,OAAO,EACL,sEAAsE;CACzE,CAAC,CAAC;AAgBL,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,+BAA+B;QACrD,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC"}

package/dist/pkce/code_challenge.d.ts

@@ -6,7 +6,7 @@ export interface CreateCodeChallengeInputOptions {
         code_verifier: CodeVerifier;
         challenge_time: number;
     };
-    sha256_digest: (code_verifier: string) => Promise<string>;
+    sha256: (code_verifier: string) => Promise<string>;
 }
 export declare function create_code_challenge(verifier_opts: CreateCodeChallengeInputOptions): Promise<CodeChallengeWithDetails>;
 export declare const codeChallengeSchema: z.ZodEffects<z.ZodString, string, string>;

package/dist/pkce/code_challenge.js

@@ -17,7 +17,7 @@ export async function create_code_challenge(verifier_opts) {
     if (typeof max_age === 'number' && max_age !== MAX_PKCE_CODE_VERIFIER_AGE) {
         throw new Error("Code verifier has invalid max_age");
     }
-    const base64url_encoded_hash = await verifier_opts.sha256_digest(code_verifier);
+    const base64url_encoded_hash = await verifier_opts.sha256(code_verifier);
     if (typeof challenge_time !== 'number') {
         throw new Error("'challenge_time' is a required field!");
     }

package/dist/pkce/code_challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"code_challenge.js","sourceRoot":"","sources":["../../src/pkce/code_challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgC,0BAA0B,EAAqB,MAAM,iBAAiB,CAAC;AAE9G,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAe,CAAC;AAOrD,wCAAwC;AACxC,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAA8C;IAE9C,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC;IAC3F,aAAoC,CAAC;IACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAK,OAAO,KAAK,0BAA0B,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IAEhF,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,cAAc,EAAE,sBAAsB;QACtC,qBAAqB;QACrB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,EAAW,CAAC;AAC9C,MAAM,yBAAyB,GAAG,IAAa,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE;KAC1C,GAAG,CAAC,yBAAyB,CAAC;KAC9B,GAAG,CAAC,yBAAyB,CAAC;KAC9B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC/C,OAAO,EAAE,gDAAgD;CAC1D,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,cAAc,EAAE,mBAAmB;IACnC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAA"}
+{"version":3,"file":"code_challenge.js","sourceRoot":"","sources":["../../src/pkce/code_challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgC,0BAA0B,EAAqB,MAAM,iBAAiB,CAAC;AAE9G,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAe,CAAC;AASrD,wCAAwC;AACxC,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAA8C;IAE9C,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC;IAC3F,aAAoC,CAAC;IACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAK,OAAO,KAAK,0BAA0B,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzE,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,cAAc,EAAE,sBAAsB;QACtC,qBAAqB;QACrB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,EAAW,CAAC;AAC9C,MAAM,yBAAyB,GAAG,IAAa,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE;KAC1C,GAAG,CAAC,yBAAyB,CAAC;KAC9B,GAAG,CAAC,yBAAyB,CAAC;KAC9B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC/C,OAAO,EAAE,gDAAgD;CAC1D,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,cAAc,EAAE,mBAAmB;IACnC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAA"}

package/dist/pkce/pkce.js

@@ -1,6 +1,6 @@
 import { create_code_challenge, codeChallengeSchema, code_challenge_method, codeChallengeWithDetailsSchema, } from "./code_challenge";
 import { create_code_verifier, codeVerifierSchema, MAX_PKCE_CODE_VERIFIER_AGE, codeVerifierWithDetailsSchema, } from "./code_verifier";
-import { sha256_digest } from "../sha256_digest";
+import { sha256_base64url } from "../sha256_digest";
 // Handles the creation of a PKCE code verifier and challenge
 export class PKCE_ProofKeyManager {
     code_verifier;
@@ -10,7 +10,7 @@ export class PKCE_ProofKeyManager {
     static async createCodeChallenge(code_verifier) {
         const createCodeChallengeOptions = {
             code_verifier,
-            sha256_digest: sha256_digest,
+            sha256: sha256_base64url,
         };
         const code_challenge = await create_code_challenge(createCodeChallengeOptions);
         return code_challenge;
@@ -57,7 +57,7 @@ export class PKCE_ProofKeyManager {
                 code_verifier: code_verifier.code_verifier,
                 challenge_time: code_verifier.challenge_time,
             },
-            sha256_digest: sha256_digest,
+            sha256: sha256_base64url,
         };
         return await create_code_challenge(codeChallengeOptions);
     }
@@ -109,7 +109,10 @@ export class PKCE_ProofKeyManager {
      * @returns sha256_hash(input_code_verifier) === saved_code_challenge
      */
     static async doesVerifierMatchChallenge(opts) {
-        const { input_code_verifier, saved_code_challenge, challenge_time, timingSafeEqual, } = opts;
+        // `challenge_time` is accepted for caller convenience but is not used
+        // for matching (it does not feed the hash) — the proof is purely
+        // `BASE64URL-ENCODE(SHA256(verifier)) === saved_code_challenge`.
+        const { input_code_verifier, saved_code_challenge, timingSafeEqual } = opts;
         if (typeof input_code_verifier !== "string" || !input_code_verifier) {
             throw new Error("Input code verifier is not a string");
         }
@@ -122,24 +125,23 @@ export class PKCE_ProofKeyManager {
             return false;
         }
         try {
-            // Put the input code verifier through the same process
-            // that (should have) created the initial code_challenge
-            const pkce_flow = new PKCE_ProofKeyManager({
-                code_verifier: input_code_verifier,
-                challenge_time,
-            });
-            const generated_challenge = await pkce_flow.getCodeChallenge();
-            // Timing-safe byte comparison using the caller-provided function.
-            // The caller is responsible for supplying a constant-time comparator;
-            // accepting it as an argument keeps this module free of any runtime
+            // RFC 7636 §4.6: recompute the S256 challenge from the presented
+            // verifier and compare it to the stored one. Both the SchemaVaults
+            // SDK and standard OIDC RPs now emit the strict base64url encoding
+            // (see sha256_base64url), so a single computation covers every client.
+            const expected_challenge = await sha256_base64url(input_code_verifier);
+            // Timing-safe comparison using the caller-provided function. Accepting
+            // the comparator as an argument keeps this module free of any runtime
             // dependency on node:crypto, so it can be bundled for browsers (for
             // createCodeVerifier/createCodeChallenge) without bundler errors.
-            const generatedBuf = Buffer.from(generated_challenge.code_challenge, "base64");
-            const savedBuf = Buffer.from(saved_code_challenge, "base64");
-            if (generatedBuf.length !== savedBuf.length) {
+            // Challenges are compared as raw UTF-8 bytes (length-checked first).
+            const encoder = new TextEncoder();
+            const savedBytes = encoder.encode(saved_code_challenge);
+            const expectedBytes = encoder.encode(expected_challenge);
+            if (expectedBytes.length !== savedBytes.length) {
                 return false;
             }
-            return timingSafeEqual(generatedBuf, savedBuf);
+            return timingSafeEqual(expectedBytes, savedBytes);
         }
         catch (e) {
             console.error(e);

package/dist/pkce/pkce.js.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pkce/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAGrB,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAE1B,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAsBhD,6DAA6D;AAC7D,MAAM,OAAO,oBAAoB;IACvB,aAAa,CAGnB;IAEK,MAAM,CAAC,kBAAkB,CAC9B,cAAuB;QAEvB,OAAO,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,aAAsC;QAEtC,MAAM,0BAA0B,GAAoC;YAClE,aAAa;YACb,aAAa,EAAE,aAAa;SAC7B,CAAC;QACF,MAAM,cAAc,GAClB,MAAM,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC1D,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,6CAA6C;IAC7C,8EAA8E;IAC9E,YACE,aAGC;QAED,IAAI,OAAO,aAAa,KAAK,WAAW,EAAE,CAAC;YACzC,oDAAoD;YACpD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,iFAAiF;YACjF,aAA8B,CAAC;YAE/B,MAAM,QAAQ,GAA6B,aAAa,CAAC,aAAa,CAAC;YACvE,IAAI,CAAC,QAAQ,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;YACpD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,aAAa,GAAG;gBACnB,GAAG,aAAa;gBAChB,aAAa,EAAE,QAAQ;gBACvB,cAAc;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,CAAC;QACrB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,oBAAoB,GAAoC;YAC5D,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;aAC7C;YACD,aAAa,EAAE,aAAa;SAC7B,CAAC;QACF,OAAO,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,kBAAkB;QAClC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAEM,MAAM,KAAK,6BAA6B;QAC7C,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAEM,MAAM,KAAK,8BAA8B;QAC9C,OAAO,8BAA8B,CAAC;IACxC,CAAC;IAEM,MAAM,KAAK,OAAO;QACvB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAEM,MAAM,CAAC,yBAAyB,CACrC,mBAA4B;QAE5B,OAAO,oBAAoB,CAAC,6BAA6B,CAAC,SAAS,CACjE,mBAAmB,CACpB,CAAC,OAAO,CAAC;IACZ,CAAC;IAEM,MAAM,CAAC,0BAA0B,CACtC,oBAA6B;QAE7B,OAAO,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,oBAAoB,CAAC;aACvE,OAAO,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAC5C,IAAsD;QAEtD,MAAM,EACJ,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,GAAG,IAAI,CAAC;QAET,IAAI,OAAO,mBAAmB,KAAK,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,oBAAoB,CAAC,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACzE,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,+BAA+B,EAC/B,qBAAqB,CAAC,KAAK,CAC5B,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,uDAAuD;YACvD,wDAAwD;YACxD,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;gBACzC,aAAa,EAAE,mBAAmB;gBAClC,cAAc;aACf,CAAC,CAAC;YAEH,MAAM,mBAAmB,GACvB,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAErC,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,YAAY,GAAW,MAAM,CAAC,IAAI,CACtC,mBAAmB,CAAC,cAAc,EAClC,QAAQ,CACT,CAAC;YACF,MAAM,QAAQ,GAAW,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;YACrE,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pkce/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAGrB,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAE1B,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAsBnD,6DAA6D;AAC7D,MAAM,OAAO,oBAAoB;IACvB,aAAa,CAGnB;IAEK,MAAM,CAAC,kBAAkB,CAC9B,cAAuB;QAEvB,OAAO,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,aAAsC;QAEtC,MAAM,0BAA0B,GAAoC;YAClE,aAAa;YACb,MAAM,EAAE,gBAAgB;SACzB,CAAC;QACF,MAAM,cAAc,GAClB,MAAM,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC1D,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,6CAA6C;IAC7C,8EAA8E;IAC9E,YACE,aAGC;QAED,IAAI,OAAO,aAAa,KAAK,WAAW,EAAE,CAAC;YACzC,oDAAoD;YACpD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,iFAAiF;YACjF,aAA8B,CAAC;YAE/B,MAAM,QAAQ,GAA6B,aAAa,CAAC,aAAa,CAAC;YACvE,IAAI,CAAC,QAAQ,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;YACpD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,aAAa,GAAG;gBACnB,GAAG,aAAa;gBAChB,aAAa,EAAE,QAAQ;gBACvB,cAAc;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,CAAC;QACrB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,oBAAoB,GAAoC;YAC5D,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;aAC7C;YACD,MAAM,EAAE,gBAAgB;SACzB,CAAC;QACF,OAAO,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,kBAAkB;QAClC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAEM,MAAM,KAAK,6BAA6B;QAC7C,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAEM,MAAM,KAAK,8BAA8B;QAC9C,OAAO,8BAA8B,CAAC;IACxC,CAAC;IAEM,MAAM,KAAK,OAAO;QACvB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAEM,MAAM,CAAC,yBAAyB,CACrC,mBAA4B;QAE5B,OAAO,oBAAoB,CAAC,6BAA6B,CAAC,SAAS,CACjE,mBAAmB,CACpB,CAAC,OAAO,CAAC;IACZ,CAAC;IAEM,MAAM,CAAC,0BAA0B,CACtC,oBAA6B;QAE7B,OAAO,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,oBAAoB,CAAC;aACvE,OAAO,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAC5C,IAAsD;QAEtD,sEAAsE;QACtE,iEAAiE;QACjE,iEAAiE;QACjE,MAAM,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;QAE5E,IAAI,OAAO,mBAAmB,KAAK,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,oBAAoB,CAAC,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACzE,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,+BAA+B,EAC/B,qBAAqB,CAAC,KAAK,CAC5B,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,uEAAuE;YACvE,MAAM,kBAAkB,GACtB,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;YAE9C,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,UAAU,GAAe,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACpE,MAAM,aAAa,GAAe,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACrE,IAAI,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,eAAe,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/request_tokens_result.d.ts

@@ -1,6 +1,7 @@
 import type { z as zod } from "zod";
+import { type AudienceSchemaOverrides } from "./audience-schema";
 import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
-export declare function createSuccessfullyGeneratedTokensRecordSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodEffects<zod.ZodEffects<zod.ZodObject<{
+export declare function createSuccessfullyGeneratedTokensRecordSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodEffects<zod.ZodEffects<zod.ZodObject<{
     access: zod.ZodOptional<zod.ZodRecord<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, zod.ZodUnion<[zod.ZodObject<{
         uid: zod.ZodString;
         iat: zod.ZodNumber;
@@ -176,7 +177,7 @@ export declare function createSuccessfullyGeneratedTokensRecordSchema(z: typeof
     refresh_token_expiry?: number | undefined;
 }>;
 export type SuccessfullyGeneratedTokensRecord = zod.infer<ReturnType<typeof createSuccessfullyGeneratedTokensRecordSchema>>;
-export declare function createRequestTokensResultSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodUnion<[zod.ZodObject<{
+export declare function createRequestTokensResultSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodUnion<[zod.ZodObject<{
     message: zod.ZodString;
     success: zod.ZodLiteral<false>;
     error: zod.ZodLiteral<true>;
@@ -425,6 +426,7 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         invite_code?: string | undefined;
     }>>;
     userOrgs: zod.ZodOptional<zod.ZodArray<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, "many">>;
+    nonce: zod.ZodOptional<zod.ZodString>;
 }, "strict", zod.ZodTypeAny, {
     message: string;
     client_app_id: string;
@@ -464,6 +466,7 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         invite_code?: string | undefined;
     } | undefined;
     userOrgs?: string[] | undefined;
+    nonce?: string | undefined;
 }, {
     message: string;
     client_app_id: string;
@@ -503,5 +506,6 @@ export declare function createRequestTokensResultSchema(z: typeof zod, environme
         invite_code?: string | undefined;
     } | undefined;
     userOrgs?: string[] | undefined;
+    nonce?: string | undefined;
 }>]>;
 export type RequestTokensResult = zod.infer<ReturnType<typeof createRequestTokensResultSchema>>;

package/dist/request_tokens_result.js

@@ -1,19 +1,20 @@
 import { userDataSchema } from "./user_data";
 import { accessTokenDataSchema, refreshTokenDataSchema } from "./token-data";
-import { createAudienceSchema } from "./audience-schema";
+import { createAudienceSchema, } from "./audience-schema";
 import { organizationIdSchema } from "./organizations";
+import { oidcNonceSchema } from "./oidc/nonce";
 import { appIdSchema, getAppEnvironment, } from "@schemavaults/app-definitions";
 // NOTE: These schemas are exposed as factories (rather than module-scope
 // constants) because the audience schema depends on the app environment and
 // auth-server URL, which must be resolved at call time. Eager module-scope
 // initialization breaks `next build` in Docker where those env vars are unset.
-export function createSuccessfullyGeneratedTokensRecordSchema(z, environment = getAppEnvironment()) {
+export function createSuccessfullyGeneratedTokensRecordSchema(z, environment = getAppEnvironment(), overrides) {
     return z
         .object({
         access: z
             .record(
         // map of audience (app id, fs region, or auth server url) to token for that audience
-        createAudienceSchema(z, environment), z.union([accessTokenDataSchema, z.literal("AS_HTTP_ONLY_COOKIE")]))
+        createAudienceSchema(z, environment, overrides), z.union([accessTokenDataSchema, z.literal("AS_HTTP_ONLY_COOKIE")]))
             .optional(),
         refresh: z
             .union([refreshTokenDataSchema, z.literal("AS_HTTP_ONLY_COOKIE")])
@@ -42,16 +43,24 @@ export function createSuccessfullyGeneratedTokensRecordSchema(z, environment = g
         return true;
     }, "Passing 'refresh_token_expiry' is redundant when refresh token is passed as an object!");
 }
-export function createRequestTokensResultSchema(z, environment = getAppEnvironment()) {
+export function createRequestTokensResultSchema(z, environment = getAppEnvironment(), overrides) {
     const requestTokensSuccessfulResultSchema = z
         .object({
         success: z.literal(true),
         error: z.literal(false),
         message: z.string(),
         client_app_id: appIdSchema,
-        tokens: createSuccessfullyGeneratedTokensRecordSchema(z, environment).optional(),
+        tokens: createSuccessfullyGeneratedTokensRecordSchema(z, environment, overrides).optional(),
         userData: userDataSchema.optional(),
         userOrgs: organizationIdSchema.array().optional(),
+        // Echo of the login-time replay nonce bound to the redeemed
+        // authorization code — the custom surface's analogue of the OIDC
+        // id_token `nonce` claim; the SDK verifies it against the value it
+        // stored at redirect time. Absent on refresh grants and on codes
+        // minted before nonces became first-class. Validated with the shared
+        // `oidcNonceSchema` (the same schema that gated it at the login
+        // boundary) so the echo round-trip is symmetric.
+        nonce: oidcNonceSchema.optional(),
     })
         .required({
         success: true,

package/dist/request_tokens_result.js.map

@@ -1 +1 @@
-{"version":3,"file":"request_tokens_result.js","sourceRoot":"","sources":["../src/request_tokens_result.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6CAA6C,CAC3D,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,MAAM;QACL,qFAAqF;QACrF,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,EACpC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACnE;aACA,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACjE,QAAQ,EAAE;QACb,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;YAC7C,IACE,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ;gBAC/C,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,EACnC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,uGAAuG,CAAC;SAC1G,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzD,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,wFAAwF,CAAC,CAAC;AACjG,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAC7C,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,MAAM,mCAAmC,GAAG,CAAC;SAC1C,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,aAAa,EAAE,WAAW;QAC1B,MAAM,EAAE,6CAA6C,CACnD,CAAC,EACD,WAAW,CACZ,CAAC,QAAQ,EAAE;QACZ,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;KAClD,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,MAAM,gCAAgC,GAAG,CAAC;SACvC,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;KACZ,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,OAAO,CAAC,CAAC,KAAK,CAAC;QACb,gCAAgC;QAChC,mCAAmC;KACpC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"request_tokens_result.js","sourceRoot":"","sources":["../src/request_tokens_result.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAEL,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAE/E,MAAM,UAAU,6CAA6C,CAC3D,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,MAAM;QACL,qFAAqF;QACrF,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAC/C,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CACnE;aACA,QAAQ,EAAE;QACb,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACjE,QAAQ,EAAE;QACb,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5C,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,qBAAqB,EAAE,CAAC;YAC7C,IACE,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ;gBAC/C,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,EACnC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,uGAAuG,CAAC;SAC1G,MAAM,CAAC,CAAC,MAAM,EAAW,EAAE;QAC1B,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzD,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,wFAAwF,CAAC,CAAC;AACjG,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAC7C,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,MAAM,mCAAmC,GAAG,CAAC;SAC1C,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,aAAa,EAAE,WAAW;QAC1B,MAAM,EAAE,6CAA6C,CACnD,CAAC,EACD,WAAW,EACX,SAAS,CACV,CAAC,QAAQ,EAAE;QACZ,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QACjD,4DAA4D;QAC5D,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,qEAAqE;QACrE,gEAAgE;QAChE,iDAAiD;QACjD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;KAClC,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,MAAM,gCAAgC,GAAG,CAAC;SACvC,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,QAAQ,CAAC;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;KACZ,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,OAAO,CAAC,CAAC,KAAK,CAAC;QACb,gCAAgC;QAChC,mCAAmC;KACpC,CAAC,CAAC;AACL,CAAC"}

package/dist/sha256_digest/index.d.ts

@@ -1 +1 @@
-export { sha256_digest, sha256_digest as default } from "./sha256_digest";
+export { sha256_base64url, sha256_base64url as default, } from "./sha256_digest";

package/dist/sha256_digest/index.js

@@ -1,2 +1,2 @@
-export { sha256_digest, sha256_digest as default } from "./sha256_digest";
+export { sha256_base64url, sha256_base64url as default, } from "./sha256_digest";
 //# sourceMappingURL=index.js.map

package/dist/sha256_digest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sha256_digest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sha256_digest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,IAAI,OAAO,GAC5B,MAAM,iBAAiB,CAAC"}

package/dist/sha256_digest/sha256_digest.d.ts

@@ -1,3 +1,9 @@
 export declare const digest_algorithm: "SHA-256";
-export declare function sha256_digest(code_verifier: string): Promise<string>;
-export default sha256_digest;
+/**
+ * Strict RFC 7636 §4.2 / RFC 4648 §5 base64url (no padding) encoding of
+ * the SHA-256 digest — the `code_challenge` encoding used by both the
+ * SchemaVaults SDK and standard OAuth2/OIDC clients. Produces a 43-char
+ * string.
+ */
+export declare function sha256_base64url(code_verifier: string): Promise<string>;
+export default sha256_base64url;

package/dist/sha256_digest/sha256_digest.js

@@ -1,6 +1,12 @@
 import isCryptoApiAvailable from "../is_crypto_api_available";
 export const digest_algorithm = "SHA-256";
-export async function sha256_digest(code_verifier) {
+/**
+ * Computes the SHA-256 digest of the input and returns it as a
+ * standard base64 string (RFC 4648 §4, with `+`, `/`, and `=` padding).
+ * Picks the WebCrypto implementation in secure contexts and falls back
+ * to crypto-js in insecure HTTP contexts (both return standard base64).
+ */
+async function sha256_standard_base64(code_verifier) {
     let sha256;
     try {
         if (isCryptoApiAvailable()) {
@@ -21,8 +27,17 @@ export async function sha256_digest(code_verifier) {
     if (typeof output !== "string") {
         throw new TypeError("Expected output to be a string!");
     }
-    // url_encode
-    return output.replace(/[^A-Za-z0-9_-]/g, "_");
+    return output;
 }
-export default sha256_digest;
+/**
+ * Strict RFC 7636 §4.2 / RFC 4648 §5 base64url (no padding) encoding of
+ * the SHA-256 digest — the `code_challenge` encoding used by both the
+ * SchemaVaults SDK and standard OAuth2/OIDC clients. Produces a 43-char
+ * string.
+ */
+export async function sha256_base64url(code_verifier) {
+    const output = await sha256_standard_base64(code_verifier);
+    return output.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export default sha256_base64url;
 //# sourceMappingURL=sha256_digest.js.map

package/dist/sha256_digest/sha256_digest.js.map

@@ -1 +1 @@
-{"version":3,"file":"sha256_digest.js","sourceRoot":"","sources":["../../src/sha256_digest/sha256_digest.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,MAAM,2BAA2B,CAAC;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAkB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,aAAqB;IACvD,IAAI,MAAkD,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,oBAAoB,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IAED,aAAa;IACb,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,eAAe,aAAa,CAAC"}
+{"version":3,"file":"sha256_digest.js","sourceRoot":"","sources":["../../src/sha256_digest/sha256_digest.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,MAAM,2BAA2B,CAAC;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAkB,CAAC;AAEnD;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IACzD,IAAI,MAAkD,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,oBAAoB,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAEnD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,aAAqB;IAC1D,MAAM,MAAM,GAAW,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,eAAe,gBAAgB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.16.2",
+  "version": "0.22.4",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -14,7 +14,7 @@
   "types": "dist/index.d.ts",
   "dependencies": {
     "zod": "3.25.8",
-    "@schemavaults/app-definitions": "0.10.1",
+    "@schemavaults/app-definitions": "0.11.4",
     "crypto-js": "4.2.0"
   },
   "scripts": {