@seamless-auth/oidc-provider 0.0.0-stage → 0.1.0

package/dist/adapter.js

@@ -0,0 +1,249 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { randomBytes } from 'node:crypto';
+import { OidcPayloadModelSchema, } from '@seamless-auth/types';
+import { errors } from 'oidc-provider';
+import { checkDeviceRequest, DEVICE_CODE_GRANT, DevicePollThrottle, isDeviceGrant, withLoginPrompt, } from './deviceFlow.js';
+import { adoptSession, currentRequestContext, markDeviceFlow, } from './requestContext.js';
+/** A client assertion or proof presented twice. Answered as `invalid_client`, not a 500. */
+export class ReplayDetectedError extends errors.InvalidClientAuth {
+    constructor() {
+        super('a replay detection record already exists for this assertion');
+        this.name = 'ReplayDetectedError';
+    }
+}
+const SHARED_SECRET_METHODS = new Set(['client_secret_basic', 'client_secret_post']);
+const SINGLE_USE = {
+    RefreshToken: 'refresh token',
+    AuthorizationCode: 'authorization code',
+    DeviceCode: 'device code',
+};
+export class UnsupportedModelError extends Error {
+    constructor(name, operation) {
+        super(`${operation} is not supported for oidc-provider model ${name}`);
+        this.name = 'UnsupportedModelError';
+    }
+}
+// The browser's provider session and the grant can outlive the first-party session they were
+// made under, so they only fill an empty context. Every other record is the thing the request
+// is acting on.
+const CONTEXTUAL_MODELS = new Set(['Session', 'Grant']);
+function toAdapterPayload(model, record) {
+    if (!record) {
+        return undefined;
+    }
+    adoptSession(record.sessionId, !CONTEXTUAL_MODELS.has(model));
+    const payload = { ...record.payload };
+    if (!CONTEXTUAL_MODELS.has(model) && isDeviceGrant(payload)) {
+        markDeviceFlow();
+    }
+    if (record.consumedAt) {
+        payload.consumed = Math.floor(Date.parse(record.consumedAt) / 1000);
+    }
+    return payload;
+}
+/** Stores one library model through the API's `/oidc/payloads/*` routes. */
+export class ApiPayloadAdapter {
+    #name;
+    #model;
+    #client;
+    #polls;
+    constructor(name, client, polls = new DevicePollThrottle()) {
+        this.#name = name;
+        this.#client = client;
+        this.#polls = polls;
+        const parsed = OidcPayloadModelSchema.safeParse(name);
+        this.#model = parsed.success ? parsed.data : undefined;
+    }
+    #requireModel(operation) {
+        if (!this.#model) {
+            throw new UnsupportedModelError(this.#name, operation);
+        }
+        return this.#model;
+    }
+    async upsert(id, payload, expiresIn) {
+        const model = this.#requireModel('upsert');
+        if (!expiresIn || expiresIn <= 0) {
+            throw new UnsupportedModelError(this.#name, 'upsert without an expiry');
+        }
+        const sessionId = currentRequestContext()?.sessionId;
+        const stored = { ...payload };
+        if (model === 'DeviceCode') {
+            const params = stored.params;
+            checkDeviceRequest(params);
+            // The verification page reads its authorization parameters from the stored code, so
+            // this is where every approval is made to sign in again rather than ride a session
+            // the browser already had: approving a device is the step phishing aims at.
+            if (params && !stored.accountId) {
+                stored.params = { ...params, prompt: withLoginPrompt(params.prompt) };
+            }
+            // ADR D10: never carried into the device's tokens, whatever the approver earned.
+            delete stored.acr;
+        }
+        const { created } = await this.#client.upsertPayload(model, id, {
+            payload: stored,
+            expiresIn: Math.ceil(expiresIn),
+            ...(sessionId ? { sessionId } : {}),
+        });
+        // The library checks for an existing record before it saves one, so this only
+        // fires when two requests race. Failing the request is the closed outcome.
+        if (model === 'ReplayDetection' && !created) {
+            throw new ReplayDetectedError();
+        }
+    }
+    async find(id) {
+        const model = this.#requireModel('find');
+        const context = currentRequestContext();
+        const record = await this.#client.findPayload(model, id);
+        // The grant loads the code more than once per request, and only the first is the poll.
+        // Only a code that exists is tracked, so made-up ones cannot fill the throttle.
+        if (model === 'DeviceCode' && record && context?.tokenRequest && !context.devicePolled) {
+            context.devicePolled = true;
+            this.#polls.check(id);
+        }
+        const payload = toAdapterPayload(model, record);
+        if (context && model in SINGLE_USE && typeof payload?.grantId === 'string') {
+            context.singleUseGrants ??= new Map();
+            context.singleUseGrants.set(`${model}:${id}`, payload.grantId);
+        }
+        // The library loads only opaque records. A JWT access token the edge verified on this
+        // request is read like one, so introspection and revocation can see it.
+        if (payload?.format === 'jwt' &&
+            (model === 'AccessToken' || model === 'ClientCredentials') &&
+            currentRequestContext()?.verifiedJwtTokenId === id) {
+            delete payload.format;
+        }
+        if (model === 'RefreshToken' && payload && record?.sessionId) {
+            await this.#adoptCurrentAuthContext(payload, record.sessionId);
+        }
+        return payload;
+    }
+    /**
+     * A refresh carries the acr, amr and auth_time of the session's current row, not the ones
+     * the token was first issued with: a step-up since then moved them, and `/oidc/sign`
+     * refuses any value that differs from the row.
+     */
+    async #adoptCurrentAuthContext(payload, sessionId) {
+        const { clientId, accountId } = payload;
+        if (typeof clientId !== 'string') {
+            return;
+        }
+        const context = await this.#client.authContext(sessionId, clientId);
+        if (!context || !context.active || context.recovery || context.userId !== accountId) {
+            return;
+        }
+        payload.authTime = context.authTime;
+        if (context.acr && !isDeviceGrant(payload)) {
+            payload.acr = context.acr;
+        }
+        else {
+            delete payload.acr;
+        }
+        if (context.amr.length > 0) {
+            payload.amr = [...context.amr];
+        }
+        else {
+            delete payload.amr;
+        }
+    }
+    async findByUserCode(userCode) {
+        const model = this.#requireModel('findByUserCode');
+        return toAdapterPayload(model, await this.#client.findPayloadByUserCode(model, userCode));
+    }
+    async findByUid(uid) {
+        const model = this.#requireModel('findByUid');
+        return toAdapterPayload(model, await this.#client.findPayloadByUid(model, uid));
+    }
+    async consume(id) {
+        const model = this.#requireModel('consume');
+        const consumed = await this.#client.consumePayload(model, id);
+        const label = SINGLE_USE[model];
+        // The library checked `consumed` when it loaded the record, so another request can still
+        // have consumed it since. Only the API's answer says which of the two came first.
+        if (!consumed && label) {
+            const context = currentRequestContext();
+            if (context) {
+                const grantId = context.singleUseGrants?.get(`${model}:${id}`);
+                context.lostConsume = {
+                    model: model,
+                    ...(grantId ? { grantId } : {}),
+                };
+            }
+            throw new errors.InvalidGrant(`${label} already used`);
+        }
+    }
+    async destroy(id) {
+        await this.#client.destroyPayload(this.#requireModel('destroy'), id);
+    }
+    async revokeByGrantId(grantId) {
+        await this.#client.revokePayloadsByGrant(this.#requireModel('revokeByGrantId'), grantId);
+    }
+}
+/**
+ * Reads clients from the API's registry. Clients are managed there, never here. A third-party
+ * client does not exist while `third_party_clients_enabled` is off (ADR D10).
+ *
+ * The registry never returns a secret. A client on a shared-secret method gets the one-time
+ * value `verifyClientSecrets` set for a secret the API accepted on this request, and otherwise
+ * a random value nothing can present, which the library needs to load the client at all.
+ */
+export class ApiClientAdapter {
+    #client;
+    #config;
+    constructor(client, config) {
+        this.#client = client;
+        this.#config = config;
+    }
+    async find(id) {
+        const metadata = await this.#client.client(id);
+        if (!metadata) {
+            return undefined;
+        }
+        if (!metadata['urn:seamless:first_party']) {
+            const { thirdPartyClientsEnabled } = await this.#config.get();
+            if (!thirdPartyClientsEnabled) {
+                return undefined;
+            }
+        }
+        // ADR D10: the device grant is first-party only. The API filters it too.
+        const grants = metadata['urn:seamless:first_party']
+            ? metadata.grant_types
+            : metadata.grant_types.filter((grant) => grant !== DEVICE_CODE_GRANT);
+        if (!SHARED_SECRET_METHODS.has(metadata.token_endpoint_auth_method)) {
+            return { ...metadata, grant_types: grants };
+        }
+        const verified = currentRequestContext()?.verifiedClientSecret;
+        const secret = verified?.clientId === metadata.client_id
+            ? verified.value
+            : randomBytes(32).toString('base64url');
+        return { ...metadata, grant_types: grants, client_secret: secret };
+    }
+    async upsert() {
+        throw new UnsupportedModelError('Client', 'upsert');
+    }
+    async findByUserCode() {
+        throw new UnsupportedModelError('Client', 'findByUserCode');
+    }
+    async findByUid() {
+        throw new UnsupportedModelError('Client', 'findByUid');
+    }
+    async consume() {
+        throw new UnsupportedModelError('Client', 'consume');
+    }
+    async destroy() {
+        throw new UnsupportedModelError('Client', 'destroy');
+    }
+    async revokeByGrantId() {
+        throw new UnsupportedModelError('Client', 'revokeByGrantId');
+    }
+}
+export function createApiAdapterFactory(client, config) {
+    const polls = new DevicePollThrottle();
+    return (name) => name === 'Client'
+        ? new ApiClientAdapter(client, config)
+        : new ApiPayloadAdapter(name, client, polls);
+}
+//# sourceMappingURL=adapter.js.map

package/dist/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAEL,sBAAsB,GAEvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAIvC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAE7B,4FAA4F;AAC5F,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,iBAAiB;IAC/D;QACE,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAErF,MAAM,UAAU,GAAG;IACjB,YAAY,EAAE,eAAe;IAC7B,iBAAiB,EAAE,oBAAoB;IACvC,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,IAAY,EAAE,SAAiB;QACzC,KAAK,CAAC,GAAG,SAAS,6CAA6C,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,6FAA6F;AAC7F,8FAA8F;AAC9F,gBAAgB;AAChB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAE1E,SAAS,gBAAgB,CACvB,KAAuB,EACvB,MAAqC;IAErC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAoB,CAAC;IACxD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4EAA4E;AAC5E,MAAM,OAAO,iBAAiB;IACnB,KAAK,CAAS;IACd,MAAM,CAA+B;IACrC,OAAO,CAAgB;IACvB,MAAM,CAAqB;IAEpC,YAAY,IAAY,EAAE,MAAqB,EAAE,KAAK,GAAG,IAAI,kBAAkB,EAAE;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAkB;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,EAAE,EAAE,SAAS,CAAC;QACrD,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,MAA6C,CAAC;YACpE,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC3B,oFAAoF;YACpF,mFAAmF;YACnF,4EAA4E;YAC5E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,CAAC;YACD,iFAAiF;YACjF,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE;YAC9D,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC,CAAC;QACH,8EAA8E;QAC9E,2EAA2E;QAC3E,IAAI,KAAK,KAAK,iBAAiB,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,uFAAuF;QACvF,gFAAgF;QAChF,IAAI,KAAK,KAAK,YAAY,IAAI,MAAM,IAAI,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACvF,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO,IAAI,KAAK,IAAI,UAAU,IAAI,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3E,OAAO,CAAC,eAAe,KAAK,IAAI,GAAG,EAAE,CAAC;YACtC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;QACD,sFAAsF;QACtF,wEAAwE;QACxE,IACE,OAAO,EAAE,MAAM,KAAK,KAAK;YACzB,CAAC,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,mBAAmB,CAAC;YAC1D,qBAAqB,EAAE,EAAE,kBAAkB,KAAK,EAAE,EAClD,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,KAAK,cAAc,IAAI,OAAO,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,wBAAwB,CAAC,OAAuB,EAAE,SAAiB;QACvE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACxC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,GAAG,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,GAAG,CAAC;QACrB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACnD,OAAO,gBAAgB,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO,gBAAgB,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAgC,CAAC,CAAC;QAC3D,yFAAyF;QACzF,kFAAkF;QAClF,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/D,OAAO,CAAC,WAAW,GAAG;oBACpB,KAAK,EAAE,KAAuB;oBAC9B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3F,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAgB;IACvB,OAAO,CAAkB;IAElC,YAAY,MAAqB,EAAE,MAAuB;QACxD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC1C,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC9D,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,yEAAyE;QACzE,MAAM,MAAM,GAAG,QAAQ,CAAC,0BAA0B,CAAC;YACjD,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC;QACxE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAoB,CAAC;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,EAAE,EAAE,oBAAoB,CAAC;QAC/D,MAAM,MAAM,GACV,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC,SAAS;YACvC,CAAC,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAoB,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAqB,EACrB,MAAuB;IAEvB,MAAM,KAAK,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACvC,OAAO,CAAC,IAAI,EAAE,EAAE,CACd,IAAI,KAAK,QAAQ;QACf,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;QACtC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC"}

package/dist/apiClient.d.ts

@@ -0,0 +1,35 @@
+import { type OidcAccountClaims, type OidcAccountQuery, type OidcAuthContext, type OidcClientMetadata, type OidcClientResource, type OidcEdgeConfigResponse, type OidcEdgeEvent, type OidcJwksResponse, type OidcPayloadModel, type OidcPayloadRecord, type OidcPayloadUpsertRequest, type OidcPayloadUpsertResponse, type OidcSessionRevokeRequest, type OidcSignRequest, type OidcSignResponse } from '@seamless-auth/types';
+export declare const SERVICE_TOKEN_SUBJECT = "seamless-oidc-provider";
+export interface OidcApiClientOptions {
+    apiUrl: string;
+    serviceSecret: string;
+    /** The `kid` header on the service token. Defaults to the API's development kid. */
+    serviceTokenKid?: string;
+    fetch?: typeof fetch;
+}
+export declare function routePath(template: string, params?: Record<string, string>): string;
+export declare class OidcApiClient {
+    #private;
+    constructor(options: OidcApiClientOptions);
+    config(): Promise<OidcEdgeConfigResponse | undefined>;
+    upsertPayload(model: OidcPayloadModel, id: string, body: OidcPayloadUpsertRequest): Promise<OidcPayloadUpsertResponse>;
+    findPayload(model: OidcPayloadModel, id: string): Promise<OidcPayloadRecord | undefined>;
+    findPayloadByUserCode(model: OidcPayloadModel, userCode: string): Promise<OidcPayloadRecord | undefined>;
+    findPayloadByUid(model: OidcPayloadModel, uid: string): Promise<OidcPayloadRecord | undefined>;
+    /** True only if this call consumed the record. A record that is gone was not consumed here. */
+    consumePayload(model: OidcPayloadModel, id: string): Promise<boolean>;
+    destroyPayload(model: OidcPayloadModel, id: string): Promise<void>;
+    revokePayloadsByGrant(model: OidcPayloadModel, grantId: string): Promise<void>;
+    sign(body: OidcSignRequest): Promise<OidcSignResponse>;
+    jwks(): Promise<OidcJwksResponse>;
+    client(id: string): Promise<OidcClientMetadata | undefined>;
+    /** An API from before this route, or a client that is not active, has none. */
+    clientResources(id: string): Promise<OidcClientResource[]>;
+    verifySecret(id: string, secret: string): Promise<boolean>;
+    /** Answers only for the user behind a session holding a grant for `clientId`. */
+    account(id: string, binding: OidcAccountQuery): Promise<OidcAccountClaims | undefined>;
+    /** Answers only while the session holds a grant for `clientId`, so save the Grant first. */
+    authContext(sessionId: string, clientId: string): Promise<OidcAuthContext | undefined>;
+    revokeSession(sessionId: string, body: OidcSessionRevokeRequest): Promise<void>;
+    event(event: OidcEdgeEvent): Promise<void>;
+}

package/dist/apiClient.js

@@ -0,0 +1,217 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { createServiceToken, DEV_JWKS_KID, SERVICE_TOKEN_AUDIENCE, SERVICE_TOKEN_ISSUER, } from '@seamless-auth/core';
+import { OidcAccountClaimsSchema, OidcAuthContextSchema, OidcClientMetadataSchema, OidcClientResourcesResponseSchema, OidcEdgeConfigResponseSchema, OidcEdgeRoutes, OidcJwksResponseSchema, OidcPayloadConsumeResponseSchema, OidcPayloadRecordSchema, OidcPayloadUpsertResponseSchema, OidcSignRefusalSchema, OidcSignResponseSchema, OidcVerifySecretResponseSchema, } from '@seamless-auth/types';
+import { OidcApiError, OidcSignRefusedError } from './errors.js';
+import { currentRequestContext } from './requestContext.js';
+export const SERVICE_TOKEN_SUBJECT = 'seamless-oidc-provider';
+// createServiceToken mints a 60 second token. Reusing it for less than that means a
+// request never presents a token that expires in flight.
+const SERVICE_TOKEN_REUSE_MS = 45_000;
+export function routePath(template, params = {}) {
+    return template.replace(/:([A-Za-z]+)/g, (_match, name) => {
+        const value = params[name];
+        if (value === undefined) {
+            throw new Error(`Missing path parameter ${name} for ${template}`);
+        }
+        return encodeURIComponent(value);
+    });
+}
+export class OidcApiClient {
+    #apiUrl;
+    #serviceSecret;
+    #serviceTokenKid;
+    #fetch;
+    #token;
+    constructor(options) {
+        this.#apiUrl = options.apiUrl.replace(/\/+$/, '');
+        this.#serviceSecret = options.serviceSecret;
+        this.#serviceTokenKid = options.serviceTokenKid ?? DEV_JWKS_KID;
+        this.#fetch = options.fetch ?? globalThis.fetch;
+    }
+    config() {
+        return this.#request('GET', OidcEdgeRoutes.config, {
+            schema: OidcEdgeConfigResponseSchema,
+            allowNotFound: true,
+        });
+    }
+    async upsertPayload(model, id, body) {
+        return this.#required('PUT', routePath(OidcEdgeRoutes.payload, { model, id }), OidcPayloadUpsertResponseSchema, body);
+    }
+    findPayload(model, id) {
+        return this.#request('GET', routePath(OidcEdgeRoutes.payload, { model, id }), {
+            schema: OidcPayloadRecordSchema,
+            allowNotFound: true,
+        });
+    }
+    findPayloadByUserCode(model, userCode) {
+        return this.#request('GET', routePath(OidcEdgeRoutes.payloadByUserCode, { model, userCode }), {
+            schema: OidcPayloadRecordSchema,
+            allowNotFound: true,
+        });
+    }
+    findPayloadByUid(model, uid) {
+        return this.#request('GET', routePath(OidcEdgeRoutes.payloadByUid, { model, uid }), {
+            schema: OidcPayloadRecordSchema,
+            allowNotFound: true,
+        });
+    }
+    /** True only if this call consumed the record. A record that is gone was not consumed here. */
+    async consumePayload(model, id) {
+        const result = await this.#request('POST', routePath(OidcEdgeRoutes.payloadConsume, { model, id }), { schema: OidcPayloadConsumeResponseSchema, allowNotFound: true });
+        return result?.consumed === true;
+    }
+    async destroyPayload(model, id) {
+        await this.#request('DELETE', routePath(OidcEdgeRoutes.payload, { model, id }), {
+            allowNotFound: true,
+        });
+    }
+    async revokePayloadsByGrant(model, grantId) {
+        await this.#request('DELETE', routePath(OidcEdgeRoutes.payloadsByGrant, { model, grantId }), {
+            allowNotFound: true,
+        });
+    }
+    async sign(body) {
+        const response = await this.#send('POST', OidcEdgeRoutes.sign, body);
+        const json = await readJson(response);
+        if (!response.ok) {
+            const refusal = OidcSignRefusalSchema.safeParse(json);
+            if (refusal.success) {
+                throw new OidcSignRefusedError(refusal.data.error, refusal.data.message);
+            }
+            throw new OidcApiError(response.status, OidcEdgeRoutes.sign);
+        }
+        const parsed = OidcSignResponseSchema.safeParse(json);
+        if (!parsed.success) {
+            throw unexpectedShape(response.status, OidcEdgeRoutes.sign);
+        }
+        return parsed.data;
+    }
+    jwks() {
+        return this.#required('GET', OidcEdgeRoutes.jwks, OidcJwksResponseSchema);
+    }
+    client(id) {
+        return this.#request('GET', routePath(OidcEdgeRoutes.client, { id }), {
+            schema: OidcClientMetadataSchema,
+            allowNotFound: true,
+        });
+    }
+    /** An API from before this route, or a client that is not active, has none. */
+    async clientResources(id) {
+        const result = await this.#request('GET', routePath(OidcEdgeRoutes.clientResources, { id }), {
+            schema: OidcClientResourcesResponseSchema,
+            allowNotFound: true,
+        });
+        return result?.resources ?? [];
+    }
+    async verifySecret(id, secret) {
+        const result = await this.#request('POST', routePath(OidcEdgeRoutes.clientVerifySecret, { id }), { body: { secret }, schema: OidcVerifySecretResponseSchema, allowNotFound: true });
+        return result?.valid === true;
+    }
+    /** Answers only for the user behind a session holding a grant for `clientId`. */
+    account(id, binding) {
+        const query = new URLSearchParams(binding).toString();
+        return this.#request('GET', `${routePath(OidcEdgeRoutes.account, { id })}?${query}`, {
+            schema: OidcAccountClaimsSchema,
+            allowNotFound: true,
+        });
+    }
+    /** Answers only while the session holds a grant for `clientId`, so save the Grant first. */
+    authContext(sessionId, clientId) {
+        const query = new URLSearchParams({ clientId }).toString();
+        const path = routePath(OidcEdgeRoutes.sessionAuthContext, { id: sessionId });
+        return this.#request('GET', `${path}?${query}`, {
+            schema: OidcAuthContextSchema,
+            allowNotFound: true,
+        });
+    }
+    async revokeSession(sessionId, body) {
+        await this.#request('POST', routePath(OidcEdgeRoutes.sessionRevoke, { id: sessionId }), {
+            body,
+            allowNotFound: true,
+        });
+    }
+    async event(event) {
+        await this.#request('POST', OidcEdgeRoutes.events, { body: event });
+    }
+    async #required(method, path, schema, body) {
+        return this.#parse(await this.#send(method, path, body), path, schema);
+    }
+    async #request(method, path, options) {
+        const response = await this.#send(method, path, options.body);
+        if (response.status === 404 && options.allowNotFound) {
+            return undefined;
+        }
+        if (!options.schema) {
+            if (!response.ok) {
+                throw new OidcApiError(response.status, path);
+            }
+            return undefined;
+        }
+        return this.#parse(response, path, options.schema);
+    }
+    async #parse(response, path, schema) {
+        if (!response.ok) {
+            throw new OidcApiError(response.status, path);
+        }
+        const parsed = schema.safeParse(await readJson(response));
+        if (!parsed.success) {
+            throw unexpectedShape(response.status, path);
+        }
+        return parsed.data;
+    }
+    #send(method, path, body) {
+        const headers = {
+            accept: 'application/json',
+            'x-seamless-service-token': this.#serviceToken(),
+        };
+        // The API rate limits per client IP, so a call made for a browser request carries
+        // that browser's address and user agent rather than the edge's own.
+        const context = currentRequestContext();
+        if (context?.clientIp) {
+            headers['x-seamless-client-ip'] = context.clientIp;
+        }
+        if (context?.userAgent) {
+            headers['x-seamless-client-user-agent'] = context.userAgent;
+        }
+        if (body !== undefined) {
+            headers['content-type'] = 'application/json';
+        }
+        return this.#fetch(`${this.#apiUrl}${path}`, {
+            method,
+            headers,
+            body: body === undefined ? undefined : JSON.stringify(body),
+            redirect: 'error',
+        });
+    }
+    #serviceToken() {
+        const now = Date.now();
+        if (this.#token && this.#token.expiresAt > now) {
+            return this.#token.value;
+        }
+        const value = createServiceToken({
+            subject: SERVICE_TOKEN_SUBJECT,
+            issuer: SERVICE_TOKEN_ISSUER,
+            audience: SERVICE_TOKEN_AUDIENCE,
+            serviceSecret: this.#serviceSecret,
+            keyId: this.#serviceTokenKid,
+        });
+        this.#token = { value, expiresAt: now + SERVICE_TOKEN_REUSE_MS };
+        return value;
+    }
+}
+function unexpectedShape(status, path) {
+    return new OidcApiError(status, path, `Unexpected response shape from ${path}`);
+}
+async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=apiClient.js.map

package/dist/apiClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiClient.js","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,uBAAuB,EAGvB,qBAAqB,EAErB,wBAAwB,EAExB,iCAAiC,EAEjC,4BAA4B,EAE5B,cAAc,EAEd,sBAAsB,EACtB,gCAAgC,EAGhC,uBAAuB,EAGvB,+BAA+B,EAE/B,qBAAqB,EAGrB,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE9D,oFAAoF;AACpF,yDAAyD;AACzD,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAkBtC,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,SAAiC,EAAE;IAC7E,OAAO,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,QAAQ,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,cAAc,CAAS;IACvB,gBAAgB,CAAS;IACzB,MAAM,CAAe;IAC9B,MAAM,CAAmD;IAEzD,YAAY,OAA6B;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,IAAI,YAAY,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE;YACjD,MAAM,EAAE,4BAA4B;YACpC,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAuB,EACvB,EAAU,EACV,IAA8B;QAE9B,OAAO,IAAI,CAAC,SAAS,CACnB,KAAK,EACL,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAChD,+BAA+B,EAC/B,IAAI,CACL,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAAuB,EAAE,EAAU;QAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE;YAC5E,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB,CACnB,KAAuB,EACvB,QAAgB;QAEhB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE;YAC5F,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,KAAuB,EAAE,GAAW;QACnD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE;YAClF,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,cAAc,CAAC,KAAuB,EAAE,EAAU;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAChC,MAAM,EACN,SAAS,CAAC,cAAc,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EACvD,EAAE,MAAM,EAAE,gCAAgC,EAAE,aAAa,EAAE,IAAI,EAAE,CAClE,CAAC;QACF,OAAO,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAuB,EAAE,EAAU;QACtD,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE;YAC9E,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAuB,EAAE,OAAe;QAClE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YAC3F,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAqB;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE;YACpE,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE;YAC3F,MAAM,EAAE,iCAAiC;YACzC,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,MAAc;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAChC,MAAM,EACN,SAAS,CAAC,cAAc,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EACpD,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,aAAa,EAAE,IAAI,EAAE,CAClF,CAAC;QACF,OAAO,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;IAChC,CAAC;IAED,iFAAiF;IACjF,OAAO,CAAC,EAAU,EAAE,OAAyB;QAC3C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,EAAE;YACnF,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,4FAA4F;IAC5F,WAAW,CAAC,SAAiB,EAAE,QAAgB;QAC7C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,cAAc,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE;YAC9C,MAAM,EAAE,qBAAqB;YAC7B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,IAA8B;QACnE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,cAAc,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;YACtF,IAAI;YACJ,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAoB;QAC9B,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAc,EACd,IAAY,EACZ,MAAS,EACT,IAAc;QAEd,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,IAAY,EACZ,OAA0B;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAsB,QAAkB,EAAE,IAAY,EAAE,MAAS;QAC3E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,MAAM,CAAC,IAAkB,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAc,EAAE,IAAY,EAAE,IAAc;QAChD,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,0BAA0B,EAAE,IAAI,CAAC,aAAa,EAAE;SACjD,CAAC;QACF,kFAAkF;QAClF,oEAAoE;QACpE,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,8BAA8B,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAC3C,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC;YAC/B,OAAO,EAAE,qBAAqB;YAC9B,MAAM,EAAE,oBAAoB;YAC5B,QAAQ,EAAE,sBAAsB;YAChC,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,KAAK,EAAE,IAAI,CAAC,gBAAgB;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,sBAAsB,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY;IACnD,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/authRequirements.d.ts

@@ -0,0 +1,37 @@
+import type { OidcAcrValue } from '@seamless-auth/types';
+export declare const ACR_VALUES: readonly ["phr", "phrh"];
+/** What an authorization request asks of the authentication behind it (ADR D3, D9). */
+export interface AuthRequirements {
+    /** The weakest acr the request accepts. phrh satisfies a request for phr. */
+    acr?: OidcAcrValue;
+    maxAge?: number;
+    /** `prompt=login`: only an authentication during this interaction counts. */
+    reauthenticate?: boolean;
+}
+/** The acr and auth_time the API reported for the session. Never computed here. */
+export interface AuthState {
+    acr: OidcAcrValue | null | undefined;
+    authTime: number;
+}
+/**
+ * Reads `acr_values`, `max_age` and `prompt=login`. The claims parameter is not enabled, so
+ * `acr_values` is the only way to ask for an acr. Unknown values are ignored.
+ */
+export declare function authRequirements(params: Record<string, unknown>): AuthRequirements;
+export declare function hasRequirements(requirements: AuthRequirements): boolean;
+export declare function meetsAcr(actual: unknown, required: OidcAcrValue): boolean;
+export interface UnmetRequirements {
+    acr: boolean;
+    freshness: boolean;
+}
+/**
+ * `interactionStartedAt` is when the hosted pages began this interaction. An authentication
+ * since then satisfies any `max_age`, including 0, as the library's own check allows.
+ */
+export declare function unmetRequirements(requirements: AuthRequirements, state: AuthState, interactionStartedAt?: number, now?: number): UnmetRequirements | undefined;
+export type StepUpMethod = 'passkey' | 'totp';
+/**
+ * The API moves auth_time only for a step-up that alone earns the session's acr, and TOTP
+ * never earns one. So TOTP helps only with freshness on a session that has no acr.
+ */
+export declare function stepUpMethods(unmet: UnmetRequirements, state: AuthState): StepUpMethod[];

package/dist/authRequirements.js

@@ -0,0 +1,58 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+export const ACR_VALUES = ['phr', 'phrh'];
+const ACR_RANK = { phr: 1, phrh: 2 };
+function isAcrValue(value) {
+    return typeof value === 'string' && value in ACR_RANK;
+}
+/**
+ * Reads `acr_values`, `max_age` and `prompt=login`. The claims parameter is not enabled, so
+ * `acr_values` is the only way to ask for an acr. Unknown values are ignored.
+ */
+export function authRequirements(params) {
+    const requested = typeof params.acr_values === 'string' ? params.acr_values.split(' ') : [];
+    const acr = requested
+        .filter(isAcrValue)
+        .sort((a, b) => ACR_RANK[a] - ACR_RANK[b])
+        .at(0);
+    const rawMaxAge = params.max_age;
+    const maxAge = typeof rawMaxAge === 'string' ? Number(rawMaxAge) : rawMaxAge;
+    const prompts = typeof params.prompt === 'string' ? params.prompt.split(' ') : [];
+    return {
+        ...(acr ? { acr } : {}),
+        ...(typeof maxAge === 'number' && Number.isInteger(maxAge) && maxAge >= 0 ? { maxAge } : {}),
+        ...(prompts.includes('login') ? { reauthenticate: true } : {}),
+    };
+}
+export function hasRequirements(requirements) {
+    return (requirements.acr !== undefined ||
+        requirements.maxAge !== undefined ||
+        requirements.reauthenticate === true);
+}
+export function meetsAcr(actual, required) {
+    return isAcrValue(actual) && ACR_RANK[actual] >= ACR_RANK[required];
+}
+/**
+ * `interactionStartedAt` is when the hosted pages began this interaction. An authentication
+ * since then satisfies any `max_age`, including 0, as the library's own check allows.
+ */
+export function unmetRequirements(requirements, state, interactionStartedAt, now = Math.floor(Date.now() / 1000)) {
+    const freshSinceStart = interactionStartedAt !== undefined && state.authTime >= interactionStartedAt;
+    const acr = requirements.acr !== undefined && !meetsAcr(state.acr, requirements.acr);
+    const stale = (requirements.reauthenticate === true && !freshSinceStart) ||
+        (requirements.maxAge !== undefined &&
+            now - state.authTime > requirements.maxAge &&
+            !freshSinceStart);
+    return acr || stale ? { acr, freshness: stale } : undefined;
+}
+/**
+ * The API moves auth_time only for a step-up that alone earns the session's acr, and TOTP
+ * never earns one. So TOTP helps only with freshness on a session that has no acr.
+ */
+export function stepUpMethods(unmet, state) {
+    return unmet.acr || state.acr ? ['passkey'] : ['passkey', 'totp'];
+}
+//# sourceMappingURL=authRequirements.js.map

package/dist/authRequirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authRequirements.js","sourceRoot":"","sources":["../src/authRequirements.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,CAA4C,CAAC;AAErF,MAAM,QAAQ,GAAiC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEnE,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,QAAQ,CAAC;AACxD,CAAC;AAiBD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,GAAG,GAAG,SAAS;SAClB,MAAM,CAAC,UAAU,CAAC;SAClB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;SACzC,EAAE,CAAC,CAAC,CAAC,CAAC;IAET,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElF,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAA8B;IAC5D,OAAO,CACL,YAAY,CAAC,GAAG,KAAK,SAAS;QAC9B,YAAY,CAAC,MAAM,KAAK,SAAS;QACjC,YAAY,CAAC,cAAc,KAAK,IAAI,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAe,EAAE,QAAsB;IAC9D,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAA8B,EAC9B,KAAgB,EAChB,oBAA6B,EAC7B,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,eAAe,GACnB,oBAAoB,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,oBAAoB,CAAC;IAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;IACrF,MAAM,KAAK,GACT,CAAC,YAAY,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC;QAC1D,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS;YAChC,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,CAAC,MAAM;YAC1C,CAAC,eAAe,CAAC,CAAC;IACtB,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB,EAAE,KAAgB;IACtE,OAAO,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC"}

package/dist/clientSecrets.d.ts

@@ -0,0 +1,10 @@
+import type { Middleware } from 'koa';
+import type { OidcApiClient } from './apiClient.js';
+/**
+ * ADR D6: a shared secret is checked by the API, never by this service. A presented secret
+ * is sent to `verify-secret`, and when the API accepts it, it is swapped in the request for a
+ * one-time value that the client's metadata carries for this request only (see
+ * `ApiClientAdapter`). The library compares against that value, so it never holds the real
+ * secret, and a secret the API did not accept can match nothing.
+ */
+export declare function verifyClientSecrets(client: OidcApiClient): Middleware;