@seamless-auth/oidc-provider 0.0.0-stage → 0.1.1

package/dist/providerConfig.js

@@ -0,0 +1,305 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { interactionPolicy, } from 'oidc-provider';
+import { createApiAdapterFactory } from './adapter.js';
+import { ACR_VALUES, authRequirements, hasRequirements, meetsAcr, unmetRequirements, } from './authRequirements.js';
+import { createDevicePages, DEVICE_CODE_TTL_SECONDS } from './deviceFlow.js';
+import { FIRST_PARTY_CLIENT_PROPERTY } from './interactions.js';
+import { storeJwtAccessToken } from './jwtAccessTokens.js';
+import { createLogoutPages } from './logout.js';
+import { NONCE_REQUIRED_PROPERTY, PKCE_REQUIRED_PROPERTY, pkceRequired } from './pkce.js';
+import { currentRequestContext } from './requestContext.js';
+import { createResourceIndicators } from './resourceServers.js';
+import { accessTokenTtl, CLIENT_TTL_PROPERTIES, grantTtl, idTokenTtl, refreshTokenTtl, } from './tokenLifetimes.js';
+export const PROVIDER_COOKIE_NAMES = {
+    session: '__Host-oidc_session',
+    interaction: '__Host-oidc_interaction',
+    // The library scopes this one to the resume path. hostOnlyResumeCookie moves it to Path=/.
+    resume: '__Host-oidc_resume',
+};
+const ASYMMETRIC_ALGS = ['RS256', 'PS256', 'ES256', 'Ed25519', 'EdDSA'];
+function isAsymmetricAlg(alg) {
+    return ASYMMETRIC_ALGS.includes(alg);
+}
+// The routes where the library loads the browser session's account before the grant. The
+// device flow's verification page runs the same authorization checks in the browser.
+const AUTHORIZATION_ROUTES = new Set([
+    'authorization',
+    'resume',
+    'code_verification',
+    'device_resume',
+]);
+export function createFindAccount(client) {
+    return async (ctx, sub) => {
+        // The API releases claims only for the session and client this request serves.
+        const clientId = ctx.oidc?.client?.clientId;
+        const sessionId = currentRequestContext()?.sessionId;
+        const claims = clientId && sessionId ? await client.account(sub, { clientId, sessionId }) : undefined;
+        if (claims) {
+            const { org_id, ...rest } = claims;
+            return {
+                accountId: claims.sub,
+                claims: () => ({ ...rest, ...(org_id ? { org_id } : {}) }),
+            };
+        }
+        // A client this session has not used yet has no grant, so the API will not describe the
+        // account. At authorization the library only needs to know the provider session's own
+        // account; claims are read at the token and userinfo endpoints, once the grant exists.
+        if (AUTHORIZATION_ROUTES.has(ctx.oidc?.route) && ctx.oidc.session?.accountId === sub) {
+            return { accountId: sub, claims: () => ({ sub }) };
+        }
+        return undefined;
+    };
+}
+/**
+ * First-party clients have consent implied, so their grant is created or topped up with what
+ * they ask for. Third-party clients (ADR D10) see the consent page on every authorization: only the
+ * grant the interaction just produced counts, never one remembered on the provider session.
+ */
+export async function loadExistingGrant(ctx) {
+    const { oidc } = ctx;
+    const client = oidc.client;
+    if (!client) {
+        return undefined;
+    }
+    const firstParty = client[FIRST_PARTY_CLIENT_PROPERTY] === true;
+    const grantId = oidc.result?.consent?.grantId ??
+        (firstParty ? oidc.session?.grantIdFor(client.clientId) : undefined);
+    const accountId = oidc.session?.accountId;
+    if (!grantId && !(firstParty && accountId)) {
+        return undefined;
+    }
+    const grant = grantId
+        ? await oidc.provider.Grant.find(grantId)
+        : new oidc.provider.Grant({ accountId, clientId: client.clientId });
+    if (!grant || !firstParty) {
+        return grant;
+    }
+    const granted = new Set(grant.getOIDCScope().split(' '));
+    const scopes = [...oidc.requestParamOIDCScopes].filter((scope) => !granted.has(scope));
+    const grantedClaims = new Set(grant.getOIDCClaims());
+    const claims = [...oidc.requestParamClaims].filter((claim) => !grantedClaims.has(claim));
+    let resourcesChanged = false;
+    for (const [indicator, server] of Object.entries(oidc.resourceServers ?? {})) {
+        const offered = new Set((server.scope ?? '').split(' '));
+        const held = new Set((grant.getResourceScope(indicator) ?? '').split(' '));
+        const missing = [...oidc.requestParamScopes].filter((scope) => offered.has(scope) && !held.has(scope));
+        if (missing.length > 0) {
+            grant.addResourceScope(indicator, missing.join(' '));
+            resourcesChanged = true;
+        }
+    }
+    if (!grantId || scopes.length > 0 || claims.length > 0 || resourcesChanged) {
+        grant.addOIDCScope(scopes.join(' '));
+        grant.addOIDCClaims(claims);
+        await grant.save();
+    }
+    return grant;
+}
+function adoptAuthContext(session, context) {
+    session.acr = context.acr ?? undefined;
+    session.amr = context.amr.length > 0 ? [...context.amr] : undefined;
+    session.loginTs = context.authTime;
+}
+/**
+ * Replaces the library's max_age and essential acr checks, which read the provider session's
+ * copy of the login and want an exact acr match. The API's auth context is the record: it
+ * moves with every step-up, and /oidc/sign refuses any acr, amr or auth_time that differs.
+ */
+export function authContextCheck(client) {
+    return new interactionPolicy.Check('auth_context', 'the requested authentication could not be obtained', async (ctx) => {
+        const { oidc } = ctx;
+        const accountId = oidc.session?.accountId;
+        if (!oidc.session || !accountId || !oidc.client) {
+            return interactionPolicy.Check.NO_NEED_TO_PROMPT;
+        }
+        const requirements = authRequirements(oidc.params ?? {});
+        const login = oidc.result?.login;
+        // A device approval always signs in again (see the DeviceCode upsert in adapter.ts).
+        if (oidc.route === 'code_verification' && !login) {
+            return interactionPolicy.Check.REQUEST_PROMPT;
+        }
+        if (login) {
+            // The interaction copied these from the API after checking freshness itself.
+            return requirements.acr && !meetsAcr(login.acr, requirements.acr)
+                ? interactionPolicy.Check.REQUEST_PROMPT
+                : interactionPolicy.Check.NO_NEED_TO_PROMPT;
+        }
+        const sessionId = currentRequestContext()?.sessionId;
+        const context = sessionId
+            ? await client.authContext(sessionId, oidc.client.clientId)
+            : undefined;
+        if (context) {
+            if (!context.active || context.recovery || context.userId !== accountId) {
+                return interactionPolicy.Check.REQUEST_PROMPT;
+            }
+            adoptAuthContext(oidc.session, context);
+        }
+        if (!hasRequirements(requirements)) {
+            return interactionPolicy.Check.NO_NEED_TO_PROMPT;
+        }
+        return !context || unmetRequirements(requirements, context)
+            ? interactionPolicy.Check.REQUEST_PROMPT
+            : interactionPolicy.Check.NO_NEED_TO_PROMPT;
+    });
+}
+export function buildInteractionPolicy(client) {
+    const policy = interactionPolicy.base();
+    const login = policy.get('login');
+    if (!login) {
+        throw new Error('The base interaction policy has no login prompt');
+    }
+    for (const reason of ['max_age', 'essential_acrs', 'essential_acr']) {
+        login.checks.remove(reason);
+    }
+    login.checks.add(authContextCheck(client));
+    return policy;
+}
+/**
+ * A client may introspect its own tokens. A resource server is a confidential client linked
+ * to its resource, so it may introspect tokens whose audience is that resource and nothing
+ * else: no client sees the tokens of apps it has no part in.
+ */
+export function createIntrospectionPolicy(client) {
+    return async (_ctx, caller, token) => {
+        if (token.clientId === caller.clientId) {
+            return true;
+        }
+        if (caller.clientAuthMethod === 'none' || typeof token.aud !== 'string') {
+            return false;
+        }
+        const resources = await client.clientResources(caller.clientId);
+        return resources.some((resource) => resource.identifier === token.aud);
+    };
+}
+/**
+ * The locked configuration from ADR 0001 (D1, D6). The API's admin routes refuse client
+ * settings that would loosen it, so this is the ceiling, not a default.
+ */
+export function buildProviderConfiguration(input) {
+    const [activeKey] = input.signingKeys;
+    if (!activeKey) {
+        throw new Error('No provider signing key is available');
+    }
+    const activeAlg = activeKey.alg;
+    if (!isAsymmetricAlg(activeAlg)) {
+        throw new Error(`The active provider key uses unsupported alg ${activeAlg}`);
+    }
+    const signingAlgs = [activeAlg];
+    const resourceIndicators = createResourceIndicators(input.client, activeAlg);
+    return {
+        adapter: createApiAdapterFactory(input.client, input.configCache),
+        findAccount: createFindAccount(input.client),
+        loadExistingGrant,
+        jwks: { keys: input.signingKeys },
+        responseTypes: ['code'],
+        pkce: { required: pkceRequired },
+        // Many RPs read the profile from the ID token rather than calling userinfo.
+        conformIdTokenClaims: false,
+        rotateRefreshToken: true,
+        enableHttpPostMethods: false,
+        // ADR D6. Shared secrets are offered only on an instance that allows them, and are
+        // checked by the API (verifyClientSecrets). client_secret_jwt is never offered.
+        clientAuthMethods: [
+            'private_key_jwt',
+            'none',
+            ...(input.config.allowClientSecrets
+                ? ['client_secret_basic', 'client_secret_post']
+                : []),
+        ],
+        enabledJWA: {
+            clientAuthSigningAlgValues: [...ASYMMETRIC_ALGS],
+            requestObjectSigningAlgValues: [...ASYMMETRIC_ALGS],
+            idTokenSigningAlgValues: signingAlgs,
+            userinfoSigningAlgValues: signingAlgs,
+        },
+        acrValues: [...ACR_VALUES],
+        scopes: ['openid', 'offline_access', 'email', 'phone', 'seamless'],
+        // Listing claims replaces the library's defaults. The session claims sit under openid so
+        // every ID token carries the assurance the API recorded (ADR D9, D11), asked for or not.
+        claims: {
+            sid: null,
+            openid: ['sub', 'acr', 'amr', 'auth_time'],
+            email: ['email', 'email_verified'],
+            phone: ['phone_number', 'phone_number_verified'],
+            seamless: ['roles', 'org_id'],
+        },
+        extraClientMetadata: {
+            properties: [
+                'urn:seamless:first_party',
+                PKCE_REQUIRED_PROPERTY,
+                NONCE_REQUIRED_PROPERTY,
+                ...Object.values(CLIENT_TTL_PROPERTIES),
+            ],
+        },
+        routes: {
+            authorization: '/authorize',
+            token: '/token',
+            introspection: '/token/introspection',
+            revocation: '/token/revocation',
+            userinfo: '/userinfo',
+            jwks: '/jwks',
+            end_session: '/session/end',
+            code_verification: '/device',
+            device_authorization: '/device/auth',
+        },
+        formats: { customizers: { jwt: storeJwtAccessToken } },
+        ttl: {
+            // Functions, so the resource's and the application's own lifetimes apply.
+            AccessToken: accessTokenTtl,
+            IdToken: idTokenTtl,
+            RefreshToken: refreshTokenTtl,
+            AuthorizationCode: 60,
+            DeviceCode: DEVICE_CODE_TTL_SECONDS,
+            Interaction: 600,
+            // The API hides every record whose first-party session has ended, so these are
+            // ceilings, and the session's own lifetime is what actually bounds them.
+            Grant: grantTtl,
+            Session: 1_209_600,
+        },
+        cookies: {
+            keys: input.cookieKeys,
+            names: PROVIDER_COOKIE_NAMES,
+            long: { httpOnly: true, sameSite: 'lax', secure: true, path: '/' },
+            short: { httpOnly: true, sameSite: 'lax', secure: true, path: '/' },
+        },
+        interactions: {
+            policy: buildInteractionPolicy(input.client),
+            url: (_ctx, interaction) => `/interaction/${interaction.uid}`,
+        },
+        clientBasedCORS: (ctx, origin, client) => {
+            if (origin === 'null') {
+                return false;
+            }
+            if (ctx.oidc.route === 'userinfo' || client.clientAuthMethod === 'none') {
+                return (client.redirectUris ?? []).some((uri) => URL.parse(uri)?.origin === origin);
+            }
+            return false;
+        },
+        features: {
+            devInteractions: { enabled: false },
+            registration: { enabled: false },
+            // The API sends the logout tokens (see leaveBackchannelLogoutToApi).
+            backchannelLogout: { enabled: true },
+            externalSigningSupport: { enabled: true, ack: 'experimental-01' },
+            resourceIndicators: {
+                enabled: true,
+                defaultResource: resourceIndicators.defaultResource,
+                // An RP that named one resource at authorization gets a token for it without repeating
+                // it at the token endpoint, which many RP libraries never do.
+                useGrantedResource: () => true,
+                getResourceServerInfo: resourceIndicators.getResourceServerInfo,
+            },
+            clientCredentials: { enabled: true },
+            rpInitiatedLogout: { enabled: true, ...createLogoutPages(input.renderPage) },
+            introspection: { enabled: true, allowedPolicy: createIntrospectionPolicy(input.client) },
+            revocation: { enabled: true },
+            // First-party clients only: the API lists the grant for no other (ADR D10).
+            deviceFlow: { enabled: true, ...createDevicePages(input.renderPage, input.client) },
+        },
+    };
+}
+//# sourceMappingURL=providerConfig.js.map

package/dist/providerConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerConfig.js","sourceRoot":"","sources":["../src/providerConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAGL,iBAAiB,GAElB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,UAAU,EACV,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,qBAAqB;IAC9B,WAAW,EAAE,yBAAyB;IACtC,2FAA2F;IAC3F,MAAM,EAAE,oBAAoB;CACpB,CAAC;AAEX,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAIjF,SAAS,eAAe,CAAC,GAAW;IAClC,OAAQ,eAAqC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAWD,yFAAyF;AACzF,qFAAqF;AACrF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,eAAe;IACf,QAAQ;IACR,mBAAmB;IACnB,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC;QAC5C,MAAM,SAAS,GAAG,qBAAqB,EAAE,EAAE,SAAS,CAAC;QACrD,MAAM,MAAM,GACV,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACnC,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aAC3D,CAAC;QACJ,CAAC;QACD,wFAAwF;QACxF,sFAAsF;QACtF,uFAAuF;QACvF,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,KAAK,GAAG,EAAE,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAuB;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,2BAA2B,CAAC,KAAK,IAAI,CAAC;IAChE,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO;QAC7B,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO;QACnB,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACzC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACzF,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAClD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrD,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC3E,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID,SAAS,gBAAgB,CAAC,OAAwB,EAAE,OAAwB;IAC1E,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC;IACvC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,IAAI,iBAAiB,CAAC,KAAK,CAChC,cAAc,EACd,oDAAoD,EACpD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACnD,CAAC;QACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,qFAAqF;QACrF,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,IAAI,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,6EAA6E;YAC7E,OAAO,YAAY,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC;gBAC/D,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,cAAc;gBACxC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAChD,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,EAAE,EAAE,SAAS,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC3D,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxE,OAAO,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC;YAChD,CAAC;YACD,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,OAAO,IAAI,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;YACzD,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,cAAc;YACxC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAChD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAqB;IAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAqB;IAC7D,OAAO,KAAK,EACV,IAAwB,EACxB,MAAmE,EACnE,KAAqD,EACnC,EAAE;QACpB,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAiC;IAC1E,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;IAChC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,SAAS,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE7E,OAAO;QACL,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;QACjE,WAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,iBAAiB;QACjB,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;QACjC,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;QAChC,4EAA4E;QAC5E,oBAAoB,EAAE,KAAK;QAC3B,kBAAkB,EAAE,IAAI;QACxB,qBAAqB,EAAE,KAAK;QAC5B,mFAAmF;QACnF,gFAAgF;QAChF,iBAAiB,EAAE;YACjB,iBAAiB;YACjB,MAAM;YACN,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB;gBACjC,CAAC,CAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAW;gBAC1D,CAAC,CAAC,EAAE,CAAC;SACR;QACD,UAAU,EAAE;YACV,0BAA0B,EAAE,CAAC,GAAG,eAAe,CAAC;YAChD,6BAA6B,EAAE,CAAC,GAAG,eAAe,CAAC;YACnD,uBAAuB,EAAE,WAAW;YACpC,wBAAwB,EAAE,WAAW;SACtC;QACD,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC;QAC1B,MAAM,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;QAClE,yFAAyF;QACzF,yFAAyF;QACzF,MAAM,EAAE;YACN,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;YAC1C,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC;YAClC,KAAK,EAAE,CAAC,cAAc,EAAE,uBAAuB,CAAC;YAChD,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC9B;QACD,mBAAmB,EAAE;YACnB,UAAU,EAAE;gBACV,0BAA0B;gBAC1B,sBAAsB;gBACtB,uBAAuB;gBACvB,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;aACxC;SACF;QACD,MAAM,EAAE;YACN,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,sBAAsB;YACrC,UAAU,EAAE,mBAAmB;YAC/B,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,cAAc;YAC3B,iBAAiB,EAAE,SAAS;YAC5B,oBAAoB,EAAE,cAAc;SACrC;QACD,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,EAAE;QACtD,GAAG,EAAE;YACH,0EAA0E;YAC1E,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,UAAU;YACnB,YAAY,EAAE,eAAe;YAC7B,iBAAiB,EAAE,EAAE;YACrB,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,GAAG;YAChB,+EAA+E;YAC/E,yEAAyE;YACzE,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,SAAS;SACnB;QACD,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,UAAU;YACtB,KAAK,EAAE,qBAAqB;YAC5B,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAClE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;SACpE;QACD,YAAY,EAAE;YACZ,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5C,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE;SAC9D;QACD,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACvC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,gBAAgB,KAAK,MAAM,EAAE,CAAC;gBACxE,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,QAAQ,EAAE;YACR,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAChC,qEAAqE;YACrE,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACpC,sBAAsB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE;YACjE,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,eAAe,EAAE,kBAAkB,CAAC,eAAe;gBACnD,uFAAuF;gBACvF,8DAA8D;gBAC9D,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI;gBAC9B,qBAAqB,EAAE,kBAAkB,CAAC,qBAAqB;aAChE;YACD,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACpC,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE;YAC5E,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YACxF,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,4EAA4E;YAC5E,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;SACpF;KACF,CAAC;AACJ,CAAC"}

package/dist/rateLimit.d.ts

@@ -0,0 +1,13 @@
+import type { NextFunction, Request, Response } from 'express';
+export interface RateLimitOptions {
+    limit: number;
+    windowMs: number;
+    /** Defaults to the client IP. */
+    key?: (req: Request) => string;
+}
+/**
+ * A fixed window per client IP, per instance. Each call reaches the API's store, which has no
+ * limit of its own on reads, so this keeps one caller from turning these endpoints into a
+ * load generator against it.
+ */
+export declare function createRateLimiter({ limit, windowMs, key: keyOf }: RateLimitOptions): (req: Request, res: Response, next: NextFunction) => void;

package/dist/rateLimit.js

@@ -0,0 +1,36 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+/**
+ * A fixed window per client IP, per instance. Each call reaches the API's store, which has no
+ * limit of its own on reads, so this keeps one caller from turning these endpoints into a
+ * load generator against it.
+ */
+export function createRateLimiter({ limit, windowMs, key: keyOf }) {
+    const windows = new Map();
+    return (req, res, next) => {
+        const now = Date.now();
+        if (windows.size > 10_000) {
+            for (const [key, window] of windows) {
+                if (window.resetAt <= now)
+                    windows.delete(key);
+            }
+        }
+        const key = keyOf ? keyOf(req) : (req.ip ?? 'unknown');
+        let window = windows.get(key);
+        if (!window || window.resetAt <= now) {
+            window = { count: 0, resetAt: now + windowMs };
+            windows.set(key, window);
+        }
+        window.count += 1;
+        if (window.count > limit) {
+            res.set('retry-after', String(Math.ceil((window.resetAt - now) / 1000)));
+            res.status(429).json({ error: 'rate_limited' });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=rateLimit.js.map

package/dist/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../src/rateLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAoB;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8C,CAAC;IAEtE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;QACvD,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACrC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/refreshReuse.d.ts

@@ -0,0 +1,3 @@
+import type { KoaContextWithOIDC } from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+export declare function revokeSessionOnRefreshReuse(client: OidcApiClient): (ctx: KoaContextWithOIDC, next: () => Promise<unknown>) => Promise<void>;

package/dist/refreshReuse.js

@@ -0,0 +1,56 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { currentRequestContext } from './requestContext.js';
+/**
+ * A rotated refresh token presented again means two parties hold it, and so does one that
+ * a concurrent refresh consumed first (the API's consume answers which call won). The library revokes the
+ * grant; this ends the first-party session it was issued under too (ADR D3), so whoever has
+ * the copy cannot carry on through the user's other apps.
+ */
+async function revokeGrant(ctx, grantId) {
+    const { provider } = ctx.oidc;
+    try {
+        await Promise.all([
+            provider.AccessToken.revokeByGrantId(grantId),
+            provider.RefreshToken.revokeByGrantId(grantId),
+            provider.Grant.adapter.destroy(grantId),
+        ]);
+    }
+    catch (error) {
+        console.error(`[oidc-provider] could not revoke a reused code's grant: ${String(error)}`);
+    }
+}
+export function revokeSessionOnRefreshReuse(client) {
+    return async (ctx, next) => {
+        await next();
+        const entities = ctx.oidc?.entities;
+        const context = currentRequestContext();
+        if (ctx.oidc?.route !== 'token' || !context) {
+            return;
+        }
+        // A code redeemed by a concurrent request: as the library does for a sequential reuse,
+        // everything issued under its grant goes.
+        const lost = context.lostConsume;
+        if (lost && lost.model !== 'RefreshToken' && lost.grantId) {
+            await revokeGrant(ctx, lost.grantId);
+        }
+        const reused = lost?.model === 'RefreshToken' ||
+            (Boolean(entities?.RefreshToken?.consumed) && !entities?.RotatedRefreshToken);
+        if (!reused || !context.sessionId) {
+            return;
+        }
+        try {
+            await client.revokeSession(context.sessionId, {
+                reason: 'refresh_token_reuse',
+                correlationId: context.correlationId,
+            });
+        }
+        catch (error) {
+            console.error(`[oidc-provider] could not revoke session after refresh token reuse: ${String(error)}`);
+        }
+    };
+}
+//# sourceMappingURL=refreshReuse.js.map

package/dist/refreshReuse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshReuse.js","sourceRoot":"","sources":["../src/refreshReuse.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,GAAuB,EAAE,OAAe;IACjE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC;YAC7C,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;YAC9C,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2DAA2D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAqB;IAC/D,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;QACpC,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,uFAAuF;QACvF,0CAA0C;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;QACjC,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1D,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GACV,IAAI,EAAE,KAAK,KAAK,cAAc;YAC9B,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC5C,MAAM,EAAE,qBAAqB;gBAC7B,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,uEAAuE,MAAM,CAAC,KAAK,CAAC,EAAE,CACvF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/requestContext.d.ts

@@ -0,0 +1,40 @@
+export interface EdgeRequestContext {
+    correlationId: string;
+    clientIp?: string;
+    userAgent?: string;
+    /** The first-party `sessions` row the request acts for, once a sign-in has linked one. */
+    sessionId?: string;
+    /** Set when a verified first-party session named `sessionId`, so stored records cannot. */
+    sessionBound?: boolean;
+    /** The one-time stand-in for a client secret the API verified on this request. */
+    verifiedClientSecret?: {
+        clientId: string;
+        value: string;
+    };
+    /** The `jti` of a JWT access token this request presented and the edge verified. */
+    verifiedJwtTokenId?: string;
+    /** Set once the request loads a record from a device approval (ADR D10). */
+    deviceFlow?: boolean;
+    /** A POST to the token endpoint, where loading a device code is a poll. */
+    tokenRequest?: boolean;
+    devicePolled?: boolean;
+    /** A grant source another request consumed first, which makes this one a reuse. */
+    lostConsume?: {
+        model: SingleUseModel;
+        grantId?: string;
+    };
+    /** The grant behind each single-use record this request loaded, by `model:id`. */
+    singleUseGrants?: Map<string, string>;
+}
+export type SingleUseModel = 'RefreshToken' | 'AuthorizationCode' | 'DeviceCode';
+export declare function runWithRequestContext<T>(context: EdgeRequestContext, fn: () => T): T;
+export declare function currentRequestContext(): EdgeRequestContext | undefined;
+/** Pins the request to a first-party session the edge verified itself. */
+export declare function bindSession(sessionId: string): void;
+export declare function markDeviceFlow(): void;
+/**
+ * Takes the session a stored record was saved with. An `authoritative` record (the code,
+ * token or interaction the request is acting on) replaces what an earlier lookup set, such as
+ * the browser's provider session. Neither overrides a session bound with `bindSession`.
+ */
+export declare function adoptSession(sessionId: string | null, authoritative: boolean): void;

package/dist/requestContext.js

@@ -0,0 +1,43 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+const storage = new AsyncLocalStorage();
+export function runWithRequestContext(context, fn) {
+    return storage.run(context, fn);
+}
+export function currentRequestContext() {
+    return storage.getStore();
+}
+/** Pins the request to a first-party session the edge verified itself. */
+export function bindSession(sessionId) {
+    const context = storage.getStore();
+    if (!context) {
+        throw new Error('bindSession called outside a request context');
+    }
+    context.sessionId = sessionId;
+    context.sessionBound = true;
+}
+export function markDeviceFlow() {
+    const context = storage.getStore();
+    if (context) {
+        context.deviceFlow = true;
+    }
+}
+/**
+ * Takes the session a stored record was saved with. An `authoritative` record (the code,
+ * token or interaction the request is acting on) replaces what an earlier lookup set, such as
+ * the browser's provider session. Neither overrides a session bound with `bindSession`.
+ */
+export function adoptSession(sessionId, authoritative) {
+    const context = storage.getStore();
+    if (!context || !sessionId || context.sessionBound) {
+        return;
+    }
+    if (authoritative || !context.sessionId) {
+        context.sessionId = sessionId;
+    }
+}
+//# sourceMappingURL=requestContext.js.map

package/dist/requestContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.js","sourceRoot":"","sources":["../src/requestContext.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA2BrD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAsB,CAAC;AAE5D,MAAM,UAAU,qBAAqB,CAAI,OAA2B,EAAE,EAAW;IAC/E,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAwB,EAAE,aAAsB;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAChC,CAAC;AACH,CAAC"}

package/dist/resourceServers.d.ts

@@ -0,0 +1,16 @@
+import { type AsymmetricSigningAlgorithm, type Client, type KoaContextWithOIDC, type ResourceServer } from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+export declare const DEFAULT_ACCESS_TOKEN_TTL = 600;
+/**
+ * RFC 8707 and RFC 9068: a token for a resource is a JWT whose `aud` is the resource's
+ * identifier, carrying only scopes the client is allowed there. The API keeps the links and
+ * `/oidc/sign` checks the same ones, so this only decides what to ask it to sign.
+ */
+export declare function createResourceIndicators(client: OidcApiClient, signingAlg: AsymmetricSigningAlgorithm): {
+    /**
+     * Without a resource a user's access token stays an opaque one for userinfo. A client
+     * credentials token is only ever for a resource: the client's only one, or the one named.
+     */
+    defaultResource(ctx: KoaContextWithOIDC, oidcClient: Client, oneOf?: readonly string[]): Promise<string | readonly string[] | undefined>;
+    getResourceServerInfo(ctx: KoaContextWithOIDC, indicator: string, oidcClient: Client): Promise<ResourceServer>;
+};

package/dist/resourceServers.js

@@ -0,0 +1,59 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { errors, } from 'oidc-provider';
+export const DEFAULT_ACCESS_TOKEN_TTL = 600;
+/**
+ * RFC 8707 and RFC 9068: a token for a resource is a JWT whose `aud` is the resource's
+ * identifier, carrying only scopes the client is allowed there. The API keeps the links and
+ * `/oidc/sign` checks the same ones, so this only decides what to ask it to sign.
+ */
+export function createResourceIndicators(client, signingAlg) {
+    // The library asks once per indicator, sometimes several times in one request.
+    const perRequest = new WeakMap();
+    function resourcesFor(ctx, clientId) {
+        let pending = perRequest.get(ctx);
+        if (!pending) {
+            pending = client.clientResources(clientId);
+            perRequest.set(ctx, pending);
+        }
+        return pending;
+    }
+    return {
+        /**
+         * Without a resource a user's access token stays an opaque one for userinfo. A client
+         * credentials token is only ever for a resource: the client's only one, or the one named.
+         */
+        async defaultResource(ctx, oidcClient, oneOf) {
+            if (oneOf) {
+                return oneOf;
+            }
+            if (ctx.oidc.route !== 'token' || ctx.oidc.params?.grant_type !== 'client_credentials') {
+                return undefined;
+            }
+            const resources = await resourcesFor(ctx, oidcClient.clientId);
+            const [only] = resources;
+            if (resources.length !== 1 || !only) {
+                throw new errors.InvalidTarget('name the resource this token is for');
+            }
+            return only.identifier;
+        },
+        async getResourceServerInfo(ctx, indicator, oidcClient) {
+            const resources = await resourcesFor(ctx, oidcClient.clientId);
+            const resource = resources.find((candidate) => candidate.identifier === indicator);
+            if (!resource) {
+                throw new errors.InvalidTarget();
+            }
+            return {
+                audience: resource.identifier,
+                scope: resource.scopes.join(' '),
+                accessTokenTTL: resource.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL,
+                accessTokenFormat: 'jwt',
+                jwt: { sign: { alg: signingAlg } },
+            };
+        },
+    };
+}
+//# sourceMappingURL=resourceServers.js.map

package/dist/resourceServers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceServers.js","sourceRoot":"","sources":["../src/resourceServers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAGL,MAAM,GAGP,MAAM,eAAe,CAAC;AAIvB,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,UAAsC;IAEtC,+EAA+E;IAC/E,MAAM,UAAU,GAAG,IAAI,OAAO,EAAqD,CAAC;IAEpF,SAAS,YAAY,CAAC,GAAuB,EAAE,QAAgB;QAC7D,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3C,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL;;;WAGG;QACH,KAAK,CAAC,eAAe,CACnB,GAAuB,EACvB,UAAkB,EAClB,KAAyB;YAEzB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,oBAAoB,EAAE,CAAC;gBACvF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;YACzB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC,qCAAqC,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,qBAAqB,CACzB,GAAuB,EACvB,SAAiB,EACjB,UAAkB;YAElB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;YACnF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACnC,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,UAAU;gBAC7B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAChC,cAAc,EAAE,QAAQ,CAAC,qBAAqB,IAAI,wBAAwB;gBAC1E,iBAAiB,EAAE,KAAK;gBACxB,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;aACnC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/resumeCookie.d.ts

@@ -0,0 +1,8 @@
+import type { Middleware } from 'koa';
+/**
+ * The library scopes its resume cookie to `Path=/authorize/<uid>`, and a `__Host-` cookie
+ * must have `Path=/`. This moves it to `Path=/` so a sibling subdomain cannot plant one, and,
+ * since one browser now holds a single resume cookie, refuses to resume an authorization
+ * whose uid is not the cookie's (the library would otherwise resume the cookie's).
+ */
+export declare function hostOnlyResumeCookie(cookieName: string, resumePath: string): Middleware;