@seamless-auth/oidc-provider 0.0.0-stage → 0.1.1

package/dist/interactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../src/interactions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,OAAwE,MAAM,SAAS,CAAC;AAE/F,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAkBtE,MAAM,kBAAmB,SAAQ,KAAK;IAEzB;IACA;IACA;IAHX,YACW,MAAc,EACd,KAAa,EACb,QAAiC,EAAE;QAE5C,KAAK,CAAC,KAAK,CAAC,CAAC;QAJJ,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAQ;QACb,UAAK,GAAL,KAAK,CAA8B;QAG5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,MAA+B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,WAAwB;IAC7C,OAAO,WAAW,CAAC,MAAM,CAAC,OAAwB,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,OAAwB;IAC9D,OAAO;QACL,SAAS;QACT,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAExF,KAAK,UAAU,IAAI,CAAC,GAAY,EAAE,GAAa;QAC7C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChE,uFAAuF;QACvF,gCAAgC;QAChC,IAAI,WAAW,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,WAAwB;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAY;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6C,CAAC;QAClE,MAAM,MAAM,GAAG,qBAAqB,CAClC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EACjC,OAAO,CAAC,mBAAmB,CAC5B,CAAC;QACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE;gBACN,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI;gBAC7B,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO;gBACnC,aAAa,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE;gBAC7C,aAAa,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;gBAC9C,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,GAAG,CAC5E,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAC/C;aACF;YACD,MAAM,EAAE;gBACN,EAAE,EAAE,KAAK,CAAC,QAAQ;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ;gBACxC,UAAU,EAAE,KAAK,CAAC,2BAA2B,CAAC,KAAK,IAAI;gBACvD,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAC7D;YACD,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACnF,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,IAAI;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC;QACrF,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,IAAI,WAAW,CAAC,OAAO,EAAE,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACvF,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAE3C,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE/B,sFAAsF;QACtF,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1F,wFAAwF;QACxF,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,OAAO,GACX,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAC9D,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC;YAC/C,CAAC,CAAC,OAAO,CAAC,QAAQ;gBAChB,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,8EAA8E;YAC9E,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,OAAO,IAAI,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAC7B,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,EACpC,OAAO,EACP,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE;oBACpD,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,oFAAoF;YACpF,0CAA0C;YAC1C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH;gBACE,KAAK,EAAE,mCAAmC;gBAC1C,iBAAiB,EAAE,oDAAoD;aACxE,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC5D,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,2BAA2B,EAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;QACjD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAE3C,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO;YAClC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAClF,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACrC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YACtC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC;YACtF,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EACxB,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,EAC7E,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,EAAkD;IAChE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpC,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/jwtAccessTokens.d.ts

@@ -0,0 +1,23 @@
+import type { KoaContextWithOIDC } from 'oidc-provider';
+import type { ApiSigningKey } from './signingKey.js';
+/**
+ * Maps a JWT access token this provider signed back to its `jti`. Only RS256, the one alg the
+ * API signs with, and only after the signature checks out against a published provider key.
+ */
+export declare function createJwtAccessTokenLookup(keys: readonly ApiSigningKey[], issuer: string): (value: string) => string | undefined;
+/**
+ * The library refuses JWTs at introspection and revocation, because it looks tokens up by the
+ * presented value and stores a JWT access token under its `jti`. A resource server holding a
+ * JWT is the one that most needs to see a revoked session, so the `token` parameter is swapped
+ * for the `jti` of a JWT this provider signed before the library reads the body.
+ */
+export declare function acceptJwtAccessTokens(lookup: (value: string) => string | undefined, paths: string[]): (ctx: KoaContextWithOIDC, next: () => Promise<unknown>) => Promise<unknown>;
+/**
+ * The library keeps no record of a JWT access token, so nothing could revoke one or report it
+ * inactive once its session ends. This stores one under the `jti`, bound to the session like
+ * every other record, and marked `jwt` so that only a request presenting the verified JWT
+ * itself can load it (the `jti` alone is not a bearer token).
+ */
+export declare function storeJwtAccessToken(_ctx: unknown, token: object, jwt: {
+    payload: Record<string, unknown>;
+}): Promise<void>;

package/dist/jwtAccessTokens.js

@@ -0,0 +1,125 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { verify } from 'node:crypto';
+import { currentRequestContext } from './requestContext.js';
+function decode(segment) {
+    try {
+        const value = JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
+        return typeof value === 'object' && value !== null && !Array.isArray(value)
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Maps a JWT access token this provider signed back to its `jti`. Only RS256, the one alg the
+ * API signs with, and only after the signature checks out against a published provider key.
+ */
+export function createJwtAccessTokenLookup(keys, issuer) {
+    return (value) => {
+        const [header, payload, signature, extra] = value.split('.');
+        if (!header || !payload || !signature || extra !== undefined) {
+            return undefined;
+        }
+        const parsedHeader = decode(header);
+        if (parsedHeader?.typ !== 'at+jwt' || parsedHeader.alg !== 'RS256') {
+            return undefined;
+        }
+        const key = keys.find((candidate) => candidate.kid === parsedHeader.kid);
+        if (!key ||
+            !verify('sha256', Buffer.from(`${header}.${payload}`), key.keyObject(), Buffer.from(signature, 'base64url'))) {
+            return undefined;
+        }
+        const claims = decode(payload);
+        return claims?.iss === issuer && typeof claims.jti === 'string' && claims.jti
+            ? claims.jti
+            : undefined;
+    };
+}
+// The library's own limit for these bodies.
+const BODY_LIMIT = 56 * 1024;
+// Matches no stored token (stored ids are never dotted) and does not parse as a JWT, so the
+// library answers it as any unknown token: inactive, or revoked with nothing to revoke.
+const UNKNOWN_TOKEN = 'unknown.token';
+async function readBody(stream) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of stream) {
+        size += chunk.length;
+        if (size > BODY_LIMIT) {
+            return undefined;
+        }
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+/**
+ * The library refuses JWTs at introspection and revocation, because it looks tokens up by the
+ * presented value and stores a JWT access token under its `jti`. A resource server holding a
+ * JWT is the one that most needs to see a revoked session, so the `token` parameter is swapped
+ * for the `jti` of a JWT this provider signed before the library reads the body.
+ */
+export function acceptJwtAccessTokens(lookup, paths) {
+    const routes = new Set(paths);
+    return async (ctx, next) => {
+        if (ctx.method !== 'POST' ||
+            !routes.has(ctx.path) ||
+            !ctx.is('application/x-www-form-urlencoded')) {
+            return next();
+        }
+        const request = ctx.req;
+        // verifyClientSecrets may have read the body already and left it here.
+        const body = request.readable
+            ? await readBody(request)
+            : Buffer.isBuffer(request.body) || typeof request.body === 'string'
+                ? request.body.toString()
+                : undefined;
+        if (body === undefined) {
+            ctx.status = 413;
+            ctx.body = { error: 'invalid_request', error_description: 'request entity too large' };
+            return undefined;
+        }
+        const params = new URLSearchParams(body);
+        const token = params.get('token');
+        if (token?.includes('.')) {
+            const jti = lookup(token);
+            params.set('token', jti ?? UNKNOWN_TOKEN);
+            const context = currentRequestContext();
+            if (jti && context) {
+                context.verifiedJwtTokenId = jti;
+            }
+        }
+        // The library reads an already consumed body from here.
+        request.body = params.toString();
+        return next();
+    };
+}
+/**
+ * The library keeps no record of a JWT access token, so nothing could revoke one or report it
+ * inactive once its session ends. This stores one under the `jti`, bound to the session like
+ * every other record, and marked `jwt` so that only a request presenting the verified JWT
+ * itself can load it (the `jti` alone is not a bearer token).
+ */
+export async function storeJwtAccessToken(_ctx, token, jwt) {
+    const record = token;
+    const { adapter, IN_PAYLOAD } = token.constructor;
+    const { jti, iat, exp } = jwt.payload;
+    const now = Math.floor(Date.now() / 1000);
+    if (typeof jti !== 'string' || typeof exp !== 'number' || exp <= now) {
+        throw new Error('A JWT access token without a jti or a future exp cannot be stored');
+    }
+    const payload = { format: 'jwt' };
+    for (const key of IN_PAYLOAD) {
+        if (record[key] !== undefined) {
+            payload[key] = record[key];
+        }
+    }
+    Object.assign(payload, { jti, iat, exp });
+    await adapter.upsert(jti, payload, exp - now);
+}
+//# sourceMappingURL=jwtAccessTokens.js.map

package/dist/jwtAccessTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtAccessTokens.js","sourceRoot":"","sources":["../src/jwtAccessTokens.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAIrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,SAAS,MAAM,CAAC,OAAe;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzE,CAAC,CAAE,KAAiC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA8B,EAAE,MAAc;IACvF,OAAO,CAAC,KAAa,EAAsB,EAAE;QAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,YAAY,EAAE,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC;QACzE,IACE,CAAC,GAAG;YACJ,CAAC,MAAM,CACL,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,EACnC,GAAG,CAAC,SAAS,EAAE,EACf,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CACpC,EACD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,MAAM,EAAE,GAAG,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG;YAC3E,CAAC,CAAC,MAAM,CAAC,GAAG;YACZ,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7B,4FAA4F;AAC5F,wFAAwF;AACxF,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,KAAK,UAAU,QAAQ,CAAC,MAA6B;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA6C,EAC7C,KAAe;IAEf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,IACE,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YACrB,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAmC,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAA0C,CAAC;QAC/D,uEAAuE;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ;YAC3B,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBACjE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACzB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACxC,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,kBAAkB,GAAG,GAAG,CAAC;YACnC,CAAC;QACH,CAAC;QACD,wDAAwD;QACxD,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,KAAa,EACb,GAAyC;IAEzC,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,WAA0C,CAAC;IACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/logout.d.ts

@@ -0,0 +1,22 @@
+import type Provider from 'oidc-provider';
+import type { KoaContextWithOIDC } from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+import type { HostedPageRenderer } from './hostedPages.js';
+/** The library's logout confirmation and signed-out pages, rendered by the hosted UI. */
+export declare function createLogoutPages(render: HostedPageRenderer): {
+    logoutSource(ctx: KoaContextWithOIDC): Promise<void>;
+    postLogoutSuccessSource(ctx: KoaContextWithOIDC): Promise<void>;
+};
+/**
+ * The API sends back-channel logout itself (ADR D3), for every way a session ends, so the
+ * library's own sender is switched off. The feature stays on for what else it does: the
+ * client metadata, discovery and `sid` in ID tokens.
+ */
+export declare function leaveBackchannelLogoutToApi(provider: Provider): void;
+/**
+ * "Sign out" ends the provider session, which the library does, and the first-party session
+ * it was made under, which this does. That revocation is what tells every other app the user
+ * signed in to through it. The adapter cookies are cleared too, so the hosted pages do not
+ * offer a session that no longer exists.
+ */
+export declare function endFirstPartySessionOnLogout(client: OidcApiClient, adapterCookies: string[]): (ctx: KoaContextWithOIDC, next: () => Promise<unknown>) => Promise<void>;

package/dist/logout.js

@@ -0,0 +1,86 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { currentRequestContext } from './requestContext.js';
+function send(ctx, { html, headers }) {
+    ctx.set(headers);
+    ctx.type = 'html';
+    ctx.body = html;
+}
+/** The library's logout confirmation and signed-out pages, rendered by the hosted UI. */
+export function createLogoutPages(render) {
+    return {
+        async logoutSource(ctx) {
+            const { oidc } = ctx;
+            const postLogout = oidc.params?.post_logout_redirect_uri;
+            send(ctx, await render({
+                view: 'logout',
+                action: oidc.urlFor('end_session_confirm'),
+                xsrf: oidc.session?.state?.secret,
+                clientName: oidc.client ? (oidc.client.clientName ?? oidc.client.clientId) : null,
+            }, typeof postLogout === 'string' ? [postLogout] : []));
+        },
+        async postLogoutSuccessSource(ctx) {
+            const client = ctx.oidc.client;
+            send(ctx, await render({
+                view: 'signed_out',
+                clientName: client ? (client.clientName ?? client.clientId) : null,
+            }));
+        },
+    };
+}
+/**
+ * The API sends back-channel logout itself (ADR D3), for every way a session ends, so the
+ * library's own sender is switched off. The feature stays on for what else it does: the
+ * client metadata, discovery and `sid` in ID tokens.
+ */
+export function leaveBackchannelLogoutToApi(provider) {
+    provider.Client.prototype.backchannelLogout = async () => { };
+}
+/**
+ * "Sign out" ends the provider session, which the library does, and the first-party session
+ * it was made under, which this does. That revocation is what tells every other app the user
+ * signed in to through it. The adapter cookies are cleared too, so the hosted pages do not
+ * offer a session that no longer exists.
+ */
+export function endFirstPartySessionOnLogout(client, adapterCookies) {
+    return async (ctx, next) => {
+        await next();
+        if (ctx.oidc?.route !== 'end_session_confirm' || ctx.status !== 303) {
+            return;
+        }
+        const everywhere = Boolean(ctx.oidc.params?.logout);
+        const context = currentRequestContext();
+        if (everywhere) {
+            for (const name of adapterCookies) {
+                ctx.cookies.set(name, null, { path: '/', secure: true, httpOnly: true, sameSite: 'lax' });
+            }
+        }
+        if (!context?.sessionId) {
+            return;
+        }
+        const clientId = ctx.oidc.client?.clientId;
+        try {
+            if (everywhere) {
+                await client.revokeSession(context.sessionId, {
+                    reason: 'provider_logout',
+                    correlationId: context.correlationId,
+                });
+            }
+            await client.event({
+                type: 'end_session',
+                correlationId: context.correlationId,
+                occurredAt: new Date().toISOString(),
+                sessionId: context.sessionId,
+                ...(clientId ? { clientId } : {}),
+                metadata: { scope: everywhere ? 'session' : 'client' },
+            });
+        }
+        catch (error) {
+            console.error(`[oidc-provider] could not end the first-party session: ${String(error)}`);
+        }
+    };
+}
+//# sourceMappingURL=logout.js.map

package/dist/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../src/logout.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,SAAS,IAAI,CAAC,GAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAgB;IACpE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAuB;YACxC,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC;YACzD,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CACV;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;gBAC1C,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACjC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;aAClF,EACD,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,uBAAuB,CAAC,GAAuB;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/B,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;aACnE,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,GAAG,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAqB,EAAE,cAAwB;IAC1F,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,MAAM,IAAI,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,qBAAqB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;oBAC5C,MAAM,EAAE,iBAAiB;oBACzB,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,0DAA0D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/originGuard.d.ts

@@ -0,0 +1,10 @@
+import type { RequestHandler } from 'express';
+/**
+ * Refuses a state-changing request unless the browser says it came from this origin.
+ *
+ * RPs often sit on sibling subdomains, which are same-site, so `SameSite=Lax` cookies still
+ * ride their requests and `same-site` is not good enough here. `Sec-Fetch-Site` must be
+ * `same-origin` when present, `Origin` must be this origin when present, and a request
+ * carrying neither is refused, since only the hosted pages call these routes.
+ */
+export declare function createSameOriginGuard(origin: string): RequestHandler;

package/dist/originGuard.js

@@ -0,0 +1,32 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+/**
+ * Refuses a state-changing request unless the browser says it came from this origin.
+ *
+ * RPs often sit on sibling subdomains, which are same-site, so `SameSite=Lax` cookies still
+ * ride their requests and `same-site` is not good enough here. `Sec-Fetch-Site` must be
+ * `same-origin` when present, `Origin` must be this origin when present, and a request
+ * carrying neither is refused, since only the hosted pages call these routes.
+ */
+export function createSameOriginGuard(origin) {
+    return (req, res, next) => {
+        if (SAFE_METHODS.has(req.method)) {
+            next();
+            return;
+        }
+        const fetchSite = req.get('sec-fetch-site');
+        const requestOrigin = req.get('origin');
+        const siteOk = fetchSite === undefined || fetchSite === 'same-origin';
+        const originOk = requestOrigin === undefined ? fetchSite === 'same-origin' : requestOrigin === origin;
+        if (siteOk && originOk) {
+            next();
+            return;
+        }
+        res.status(403).json({ error: 'cross_origin_request_blocked' });
+    };
+}
+//# sourceMappingURL=originGuard.js.map

package/dist/originGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"originGuard.js","sourceRoot":"","sources":["../src/originGuard.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,aAAa,CAAC;QACtE,MAAM,QAAQ,GACZ,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC;QACvF,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;AACJ,CAAC"}

package/dist/pkce.d.ts

@@ -0,0 +1,16 @@
+import type { KoaContextWithOIDC } from 'oidc-provider';
+export declare const PKCE_REQUIRED_PROPERTY = "urn:seamless:pkce_required";
+export declare const NONCE_REQUIRED_PROPERTY = "urn:seamless:nonce_required";
+type ClientLike = Record<string, unknown> & {
+    clientAuthMethod?: string;
+};
+/**
+ * ADR D1, amended. PKCE is required unless the API marked a confidential client as opted
+ * out (RFC 9700 section 2.1.1). A public client is never opted out, whatever its metadata
+ * says. The library only asks when a code request has no `code_challenge`, so this is
+ * where an opted-out client's `nonce` stands in for PKCE. A nonce only binds an ID token,
+ * so a request without `openid` still needs PKCE. An admin may also waive the nonce, which
+ * leaves `state` and client authentication as the only defence against code injection.
+ */
+export declare function pkceRequired(ctx: KoaContextWithOIDC, client: ClientLike | undefined): boolean;
+export {};

package/dist/pkce.js

@@ -0,0 +1,32 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { errors } from 'oidc-provider';
+export const PKCE_REQUIRED_PROPERTY = 'urn:seamless:pkce_required';
+export const NONCE_REQUIRED_PROPERTY = 'urn:seamless:nonce_required';
+/**
+ * ADR D1, amended. PKCE is required unless the API marked a confidential client as opted
+ * out (RFC 9700 section 2.1.1). A public client is never opted out, whatever its metadata
+ * says. The library only asks when a code request has no `code_challenge`, so this is
+ * where an opted-out client's `nonce` stands in for PKCE. A nonce only binds an ID token,
+ * so a request without `openid` still needs PKCE. An admin may also waive the nonce, which
+ * leaves `state` and client authentication as the only defence against code injection.
+ */
+export function pkceRequired(ctx, client) {
+    if (!client || client.clientAuthMethod === 'none' || client[PKCE_REQUIRED_PROPERTY] !== false) {
+        return true;
+    }
+    const params = ctx.oidc.params;
+    const asksForIdToken = typeof params?.scope === 'string' && params.scope.split(' ').includes('openid');
+    if (!asksForIdToken)
+        return true;
+    if (client[NONCE_REQUIRED_PROPERTY] === false)
+        return false;
+    if (typeof params?.nonce !== 'string' || params.nonce === '') {
+        throw new errors.InvalidRequest('nonce is required when PKCE is not used');
+    }
+    return false;
+}
+//# sourceMappingURL=pkce.js.map

package/dist/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAC;AAIrE;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB,EAAE,MAA8B;IAClF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,gBAAgB,KAAK,MAAM,IAAI,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAA0D,CAAC;IACnF,MAAM,cAAc,GAClB,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,uBAAuB,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,yCAAyC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/providerConfig.d.ts

@@ -0,0 +1,50 @@
+import type { OidcEdgeConfigResponse } from '@seamless-auth/types';
+import { type Configuration, type FindAccount, interactionPolicy, type KoaContextWithOIDC } from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+import type { EdgeConfigCache } from './configCache.js';
+import type { HostedPageRenderer } from './hostedPages.js';
+import type { ApiSigningKey } from './signingKey.js';
+export declare const PROVIDER_COOKIE_NAMES: {
+    readonly session: "__Host-oidc_session";
+    readonly interaction: "__Host-oidc_interaction";
+    readonly resume: "__Host-oidc_resume";
+};
+export interface ProviderConfigurationInput {
+    client: OidcApiClient;
+    config: OidcEdgeConfigResponse;
+    signingKeys: ApiSigningKey[];
+    cookieKeys: string[];
+    configCache: EdgeConfigCache;
+    renderPage: HostedPageRenderer;
+}
+export declare function createFindAccount(client: OidcApiClient): FindAccount;
+/**
+ * First-party clients have consent implied, so their grant is created or topped up with what
+ * they ask for. Third-party clients (ADR D10) see the consent page on every authorization: only the
+ * grant the interaction just produced counts, never one remembered on the provider session.
+ */
+export declare function loadExistingGrant(ctx: KoaContextWithOIDC): Promise<import("oidc-provider").Grant | undefined>;
+/**
+ * Replaces the library's max_age and essential acr checks, which read the provider session's
+ * copy of the login and want an exact acr match. The API's auth context is the record: it
+ * moves with every step-up, and /oidc/sign refuses any acr, amr or auth_time that differs.
+ */
+export declare function authContextCheck(client: OidcApiClient): interactionPolicy.Check;
+export declare function buildInteractionPolicy(client: OidcApiClient): interactionPolicy.DefaultPolicy;
+/**
+ * A client may introspect its own tokens. A resource server is a confidential client linked
+ * to its resource, so it may introspect tokens whose audience is that resource and nothing
+ * else: no client sees the tokens of apps it has no part in.
+ */
+export declare function createIntrospectionPolicy(client: OidcApiClient): (_ctx: KoaContextWithOIDC, caller: {
+    clientId: string;
+    clientAuthMethod?: string | undefined;
+}, token: {
+    clientId?: string;
+    aud?: string | string[];
+}) => Promise<boolean>;
+/**
+ * The locked configuration from ADR 0001 (D1, D6). The API's admin routes refuse client
+ * settings that would loosen it, so this is the ceiling, not a default.
+ */
+export declare function buildProviderConfiguration(input: ProviderConfigurationInput): Configuration;