@seamless-auth/oidc-provider 0.0.0-stage → 0.1.1

package/dist/resumeCookie.js

@@ -0,0 +1,46 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+/**
+ * The library scopes its resume cookie to `Path=/authorize/<uid>`, and a `__Host-` cookie
+ * must have `Path=/`. This moves it to `Path=/` so a sibling subdomain cannot plant one, and,
+ * since one browser now holds a single resume cookie, refuses to resume an authorization
+ * whose uid is not the cookie's (the library would otherwise resume the cookie's).
+ */
+export function hostOnlyResumeCookie(cookieName, resumePath) {
+    const pattern = new RegExp(`^${escapeRegExp(resumePath)}/([^/]+)$`);
+    const prefixes = [`${cookieName}=`, `${cookieName}.sig=`];
+    return async (ctx, next) => {
+        const match = pattern.exec(ctx.path);
+        if (match && ctx.method === 'GET') {
+            const value = ctx.cookies.get(cookieName, { signed: true });
+            if (value !== undefined && value !== decodeURIComponent(match[1])) {
+                dropRequestCookie(ctx.req.headers, prefixes);
+            }
+        }
+        await next();
+        const header = ctx.res.getHeader('set-cookie');
+        if (!Array.isArray(header)) {
+            return;
+        }
+        ctx.res.setHeader('set-cookie', header.map((line) => prefixes.some((prefix) => line.startsWith(prefix))
+            ? line.replace(/;\s*path=[^;]*/i, '; path=/')
+            : line));
+    };
+}
+function dropRequestCookie(headers, prefixes) {
+    if (!headers.cookie) {
+        return;
+    }
+    headers.cookie = headers.cookie
+        .split(';')
+        .map((part) => part.trim())
+        .filter((part) => !prefixes.some((prefix) => part.startsWith(prefix)))
+        .join('; ');
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=resumeCookie.js.map

package/dist/resumeCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resumeCookie.js","sourceRoot":"","sources":["../src/resumeCookie.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,UAAkB;IACzE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,GAAG,EAAE,GAAG,UAAU,OAAO,CAAC,CAAC;IAE1D,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACnE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,CACf,YAAY,EACZ,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClB,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC;YAC7C,CAAC,CAAC,IAAI,CACT,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwC,EAAE,QAAkB;IACrF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;SAC5B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACrE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/server.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import express from 'express';
+import { createOidcEdge } from './createOidcEdge.js';
+import { parseEnv } from './env.js';
+async function main() {
+    const env = parseEnv();
+    const edge = await createOidcEdge({
+        apiUrl: env.SEAMLESS_API_URL,
+        ...(env.SEAMLESS_API_ISSUER ? { apiIssuer: env.SEAMLESS_API_ISSUER } : {}),
+        serviceSecret: env.SEAMLESS_OIDC_SERVICE_TOKEN,
+        ...(env.SEAMLESS_JWKS_KID ? { serviceTokenKid: env.SEAMLESS_JWKS_KID } : {}),
+        cookieKeys: env.OIDC_COOKIE_KEYS,
+        adapterCookieSecret: env.SEAMLESS_COOKIE_SECRET,
+        trustProxy: env.TRUST_PROXY,
+    });
+    const app = express();
+    app.disable('x-powered-by');
+    app.set('trust proxy', env.TRUST_PROXY ? 1 : false);
+    app.get('/healthz', (_req, res) => {
+        res.json({ status: 'ok' });
+    });
+    app.use(edge.router);
+    app.listen(env.PORT, () => {
+        console.log(`Seamless OpenID Provider listening on ${env.PORT}, issuer ${edge.issuer}`);
+    });
+}
+main().catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+});
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAEA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,gBAAgB;QAC5B,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,aAAa,EAAE,GAAG,CAAC,2BAA2B;QAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,UAAU,EAAE,GAAG,CAAC,gBAAgB;QAChC,mBAAmB,EAAE,GAAG,CAAC,sBAAsB;QAC/C,UAAU,EAAE,GAAG,CAAC,WAAW;KAC5B,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,yCAAyC,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/signingKey.d.ts

@@ -0,0 +1,29 @@
+import { type KeyObject } from 'node:crypto';
+import type { OidcJwksResponse, OidcPublicJwk, OidcSignKind } from '@seamless-auth/types';
+import { ExternalSigningKey } from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+export declare class UnsignableTokenError extends Error {
+    constructor(reason: string);
+}
+type JsonObject = Record<string, unknown>;
+interface Classified {
+    kind: OidcSignKind;
+    clientId: string;
+}
+export declare function classifyToken(header: JsonObject, payload: JsonObject, sessionId: string | undefined): Classified;
+/**
+ * A provider key whose private half stays in the API. `sign` sends the JWS signing
+ * input to `POST /oidc/sign`, which checks the claims before it signs.
+ */
+export declare class ApiSigningKey extends ExternalSigningKey {
+    #private;
+    constructor(jwk: OidcPublicJwk, client: OidcApiClient, active: boolean);
+    get kid(): string;
+    get alg(): string;
+    get active(): boolean;
+    keyObject(): KeyObject;
+    sign(data: Uint8Array): Promise<Uint8Array>;
+}
+/** The active key comes first, which is the one the library selects to sign with. */
+export declare function signingKeysFrom(jwks: OidcJwksResponse, client: OidcApiClient): ApiSigningKey[];
+export {};

package/dist/signingKey.js

@@ -0,0 +1,142 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { createPublicKey } from 'node:crypto';
+import { errors, ExternalSigningKey } from 'oidc-provider';
+import { DEVICE_CODE_GRANT } from './deviceFlow.js';
+import { OidcSignRefusedError } from './errors.js';
+import { currentRequestContext } from './requestContext.js';
+export class UnsignableTokenError extends Error {
+    constructor(reason) {
+        super(`This service does not sign this token: ${reason}`);
+        this.name = 'UnsignableTokenError';
+    }
+}
+function decodePart(part) {
+    if (!part) {
+        throw new UnsignableTokenError('malformed signing input');
+    }
+    const value = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new UnsignableTokenError('malformed signing input');
+    }
+    return value;
+}
+function stringClaim(payload, name) {
+    const value = payload[name];
+    return typeof value === 'string' && value ? value : undefined;
+}
+export function classifyToken(header, payload, sessionId) {
+    const typ = header.typ;
+    if (typ === 'logout+jwt') {
+        throw new UnsignableTokenError('the API sends back-channel logout tokens itself');
+    }
+    if (typ === 'at+jwt') {
+        const clientId = stringClaim(payload, 'client_id');
+        if (!clientId) {
+            throw new UnsignableTokenError('access token without client_id');
+        }
+        const kind = !sessionId && stringClaim(payload, 'sub') === clientId
+            ? 'client_credentials'
+            : 'access_token';
+        return { kind, clientId };
+    }
+    if (typ === undefined) {
+        const aud = payload.aud;
+        const firstAud = Array.isArray(aud) ? aud[0] : aud;
+        const clientId = stringClaim(payload, 'azp') ?? (typeof firstAud === 'string' ? firstAud : undefined);
+        if (!clientId) {
+            throw new UnsignableTokenError('ID token without an audience');
+        }
+        return { kind: 'id_token', clientId };
+    }
+    throw new UnsignableTokenError(`unexpected typ ${String(typ)}`);
+}
+/**
+ * A provider key whose private half stays in the API. `sign` sends the JWS signing
+ * input to `POST /oidc/sign`, which checks the claims before it signs.
+ */
+export class ApiSigningKey extends ExternalSigningKey {
+    #kid;
+    #alg;
+    #keyObject;
+    #client;
+    #active;
+    constructor(jwk, client, active) {
+        super();
+        this.#kid = jwk.kid;
+        this.#alg = jwk.alg;
+        this.#keyObject = createPublicKey({ key: jwk, format: 'jwk' });
+        this.#client = client;
+        this.#active = active;
+    }
+    get kid() {
+        return this.#kid;
+    }
+    get alg() {
+        return this.#alg;
+    }
+    get active() {
+        return this.#active;
+    }
+    keyObject() {
+        return this.#keyObject;
+    }
+    async sign(data) {
+        if (!this.#active) {
+            throw new UnsignableTokenError(`key ${this.#kid} is published but not active`);
+        }
+        const signingInput = Buffer.from(data).toString('utf8');
+        const [headerPart, payloadPart, extra] = signingInput.split('.');
+        if (extra !== undefined) {
+            throw new UnsignableTokenError('malformed signing input');
+        }
+        const header = decodePart(headerPart);
+        if (header.alg !== this.#alg) {
+            throw new UnsignableTokenError(`alg ${String(header.alg)} does not match key ${this.#kid}`);
+        }
+        const sessionId = currentRequestContext()?.sessionId;
+        const { kind, clientId } = classifyToken(header, decodePart(payloadPart), sessionId);
+        const context = currentRequestContext();
+        const { signature } = await this.#signOrRefuse({
+            kind,
+            kid: this.#kid,
+            clientId,
+            signingInput,
+            ...(sessionId ? { sessionId } : {}),
+            ...(kind === 'client_credentials'
+                ? {}
+                : { grantType: context?.deviceFlow ? DEVICE_CODE_GRANT : 'authorization_code' }),
+        });
+        return Buffer.from(signature, 'base64url');
+    }
+    // A session that ended while the request ran (a concurrent refresh found reuse, say) is
+    // a grant that is no longer valid, which the client should hear as such, not a 500.
+    async #signOrRefuse(body) {
+        try {
+            return await this.#client.sign(body);
+        }
+        catch (error) {
+            if (error instanceof OidcSignRefusedError && error.code === 'session_revoked') {
+                throw new errors.InvalidGrant('the session behind this grant has ended');
+            }
+            throw error;
+        }
+    }
+}
+/** The active key comes first, which is the one the library selects to sign with. */
+export function signingKeysFrom(jwks, client) {
+    const active = jwks.keys.find((key) => key.kid === jwks.activeKid);
+    if (!active) {
+        throw new Error(`The API's active provider key ${jwks.activeKid} is not in its JWKS`);
+    }
+    return [
+        new ApiSigningKey(active, client, true),
+        ...jwks.keys
+            .filter((key) => key.kid !== jwks.activeKid)
+            .map((key) => new ApiSigningKey(key, client, false)),
+    ];
+}
+//# sourceMappingURL=signingKey.js.map

package/dist/signingKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signingKey.js","sourceRoot":"","sources":["../src/signingKey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAmC,MAAM,aAAa,CAAC;AAG/E,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAG3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,MAAc;QACxB,KAAK,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAID,SAAS,UAAU,CAAC,IAAwB;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAOD,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAmB,EACnB,SAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,iDAAiD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GACR,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,QAAQ;YACpD,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,cAAc,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACnD,MAAM,QAAQ,GACZ,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAC1C,IAAI,CAAS;IACb,IAAI,CAAS;IACb,UAAU,CAAY;IACtB,OAAO,CAAgB;IACvB,OAAO,CAAU;IAE1B,YAAY,GAAkB,EAAE,MAAqB,EAAE,MAAe;QACpE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,IAAa,GAAG;QACd,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAa,GAAG;QACd,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEQ,SAAS;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,IAAgB;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAAC,OAAO,IAAI,CAAC,IAAI,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,EAAE,EAAE,SAAS,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YAC7C,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,QAAQ;YACR,YAAY;YACZ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,KAAK,oBAAoB;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;SACnF,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,wFAAwF;IACxF,oFAAoF;IACpF,KAAK,CAAC,aAAa,CAAC,IAA0C;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC9E,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,yCAAyC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,MAAqB;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,qBAAqB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;QACvC,GAAG,IAAI,CAAC,IAAI;aACT,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC;aAC3C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/startup.d.ts

@@ -0,0 +1,4 @@
+import { type OidcEdgeConfigResponse } from '@seamless-auth/types';
+import type { OidcApiClient } from './apiClient.js';
+/** Refuses to start against an API with the provider off or on another contract version. */
+export declare function checkApiCompatibility(client: OidcApiClient): Promise<OidcEdgeConfigResponse>;

package/dist/startup.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { OIDC_EDGE_CONTRACT_VERSION } from '@seamless-auth/types';
+import { OidcContractMismatchError, OidcProviderDisabledError } from './errors.js';
+/** Refuses to start against an API with the provider off or on another contract version. */
+export async function checkApiCompatibility(client) {
+    const config = await client.config();
+    if (!config) {
+        throw new OidcProviderDisabledError();
+    }
+    if (config.contractVersion !== OIDC_EDGE_CONTRACT_VERSION) {
+        throw new OidcContractMismatchError(config.contractVersion, OIDC_EDGE_CONTRACT_VERSION);
+    }
+    return config;
+}
+//# sourceMappingURL=startup.js.map

package/dist/startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.js","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,0BAA0B,EAA+B,MAAM,sBAAsB,CAAC;AAG/F,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAEnF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,0BAA0B,EAAE,CAAC;QAC1D,MAAM,IAAI,yBAAyB,CAAC,MAAM,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tokenAudit.d.ts

@@ -0,0 +1,4 @@
+import type { KoaContextWithOIDC } from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+/** Records a token an app revoked (RFC 7009) in the API's audit log. */
+export declare function auditRevocations(client: OidcApiClient): (ctx: KoaContextWithOIDC, next: () => Promise<unknown>) => Promise<void>;

package/dist/tokenAudit.js

@@ -0,0 +1,42 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { currentRequestContext } from './requestContext.js';
+const REVOCABLE = ['RefreshToken', 'AccessToken', 'ClientCredentials'];
+/** Records a token an app revoked (RFC 7009) in the API's audit log. */
+export function auditRevocations(client) {
+    return async (ctx, next) => {
+        await next();
+        if (ctx.oidc?.route !== 'revocation' || ctx.status !== 200) {
+            return;
+        }
+        const entities = ctx.oidc.entities;
+        const kind = REVOCABLE.find((name) => entities[name]);
+        const token = kind ? entities[kind] : undefined;
+        const context = currentRequestContext();
+        // The library answers 200 without revoking a public client's request for another
+        // client's token, so only a token the caller owns was revoked.
+        if (!kind || !token || !context || token.clientId !== ctx.oidc.client?.clientId) {
+            return;
+        }
+        try {
+            await client.event({
+                type: 'token_revoked',
+                correlationId: context.correlationId,
+                occurredAt: new Date().toISOString(),
+                ...(token.clientId ? { clientId: token.clientId } : {}),
+                ...(token.accountId && context.sessionId
+                    ? { userId: token.accountId, sessionId: context.sessionId }
+                    : {}),
+                ...(token.grantId ? { grantId: token.grantId } : {}),
+                metadata: { tokenType: kind },
+            });
+        }
+        catch (error) {
+            console.error(`[oidc-provider] could not record a token revocation: ${String(error)}`);
+        }
+    };
+}
+//# sourceMappingURL=tokenAudit.js.map

package/dist/tokenAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenAudit.js","sourceRoot":"","sources":["../src/tokenAudit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAU,CAAC;AAEhF,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,MAAM,IAAI,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAGzB,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,iFAAiF;QACjF,+DAA+D;QAC/D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,IAAI,EAAE,eAAe;gBACrB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;oBACtC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tokenLifetimes.d.ts

@@ -0,0 +1,31 @@
+import type { KoaContextWithOIDC } from 'oidc-provider';
+export declare const CLIENT_TTL_PROPERTIES: {
+    readonly accessToken: "urn:seamless:access_token_ttl";
+    readonly idToken: "urn:seamless:id_token_ttl";
+    readonly refreshToken: "urn:seamless:refresh_token_ttl";
+};
+export declare const DEFAULT_ID_TOKEN_TTL = 600;
+export declare const DEFAULT_REFRESH_TOKEN_TTL: number;
+type ClientLike = Record<string, unknown> & {
+    applicationType?: string;
+    clientAuthMethod?: string;
+};
+/** The resource's lifetime, the application's, or the default: the shortest that is set. */
+export declare function accessTokenTtl(_ctx: KoaContextWithOIDC, token: {
+    resourceServer?: {
+        accessTokenTTL?: number;
+    };
+}, client: ClientLike): number;
+export declare function idTokenTtl(_ctx: KoaContextWithOIDC, _token: unknown, client: ClientLike): number;
+/** At least as long as the application's refresh tokens, which the grant must outlive. */
+export declare function grantLifetime(client: unknown): number;
+export declare function grantTtl(ctx: KoaContextWithOIDC | undefined): number;
+/**
+ * The application's lifetime, or the library's 14 days. As the library does, a rotated token
+ * for a browser app that cannot bind it to a key keeps what was left of the one it replaces,
+ * so rotating never extends how long a stolen chain lives.
+ */
+export declare function refreshTokenTtl(ctx: KoaContextWithOIDC | undefined, token: {
+    isSenderConstrained: () => boolean;
+}, client: ClientLike): number;
+export {};

package/dist/tokenLifetimes.js

@@ -0,0 +1,51 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { DEFAULT_ACCESS_TOKEN_TTL } from './resourceServers.js';
+export const CLIENT_TTL_PROPERTIES = {
+    accessToken: 'urn:seamless:access_token_ttl',
+    idToken: 'urn:seamless:id_token_ttl',
+    refreshToken: 'urn:seamless:refresh_token_ttl',
+};
+export const DEFAULT_ID_TOKEN_TTL = 600;
+export const DEFAULT_REFRESH_TOKEN_TTL = 14 * 24 * 60 * 60;
+function clientTtl(client, property) {
+    const value = client?.[property];
+    return typeof value === 'number' && value > 0 ? value : undefined;
+}
+/** The resource's lifetime, the application's, or the default: the shortest that is set. */
+export function accessTokenTtl(_ctx, token, client) {
+    const ttls = [
+        token.resourceServer?.accessTokenTTL,
+        clientTtl(client, CLIENT_TTL_PROPERTIES.accessToken),
+    ].filter((ttl) => ttl !== undefined);
+    return ttls.length > 0 ? Math.min(...ttls) : DEFAULT_ACCESS_TOKEN_TTL;
+}
+export function idTokenTtl(_ctx, _token, client) {
+    return clientTtl(client, CLIENT_TTL_PROPERTIES.idToken) ?? DEFAULT_ID_TOKEN_TTL;
+}
+/** At least as long as the application's refresh tokens, which the grant must outlive. */
+export function grantLifetime(client) {
+    return Math.max(DEFAULT_REFRESH_TOKEN_TTL, clientTtl(client, CLIENT_TTL_PROPERTIES.refreshToken) ?? 0);
+}
+export function grantTtl(ctx) {
+    return grantLifetime(ctx?.oidc?.client);
+}
+/**
+ * The application's lifetime, or the library's 14 days. As the library does, a rotated token
+ * for a browser app that cannot bind it to a key keeps what was left of the one it replaces,
+ * so rotating never extends how long a stolen chain lives.
+ */
+export function refreshTokenTtl(ctx, token, client) {
+    const rotated = ctx?.oidc?.entities.RotatedRefreshToken;
+    if (rotated &&
+        client.applicationType === 'web' &&
+        client.clientAuthMethod === 'none' &&
+        !token.isSenderConstrained()) {
+        return rotated.remainingTTL;
+    }
+    return clientTtl(client, CLIENT_TTL_PROPERTIES.refreshToken) ?? DEFAULT_REFRESH_TOKEN_TTL;
+}
+//# sourceMappingURL=tokenLifetimes.js.map

package/dist/tokenLifetimes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenLifetimes.js","sourceRoot":"","sources":["../src/tokenLifetimes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,WAAW,EAAE,+BAA+B;IAC5C,OAAO,EAAE,2BAA2B;IACpC,YAAY,EAAE,gCAAgC;CACtC,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAO3D,SAAS,SAAS,CAAC,MAA8B,EAAE,QAAgB;IACjE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAC5B,IAAwB,EACxB,KAAuD,EACvD,MAAkB;IAElB,MAAM,IAAI,GAAG;QACX,KAAK,CAAC,cAAc,EAAE,cAAc;QACpC,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,WAAW,CAAC;KACrD,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAwB,EAAE,MAAe,EAAE,MAAkB;IACtF,OAAO,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,oBAAoB,CAAC;AAClF,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,OAAO,IAAI,CAAC,GAAG,CACb,yBAAyB,EACzB,SAAS,CAAC,MAAgC,EAAE,qBAAqB,CAAC,YAAY,CAAC,IAAI,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAmC;IAC1D,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAmC,EACnC,KAA6C,EAC7C,MAAkB;IAElB,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC;IACxD,IACE,OAAO;QACP,MAAM,CAAC,eAAe,KAAK,KAAK;QAChC,MAAM,CAAC,gBAAgB,KAAK,MAAM;QAClC,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAC5B,CAAC;QACD,OAAO,OAAO,CAAC,YAAY,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,YAAY,CAAC,IAAI,yBAAyB,CAAC;AAC5F,CAAC"}