@seamless-auth/oidc-provider 0.2.0 → 0.4.0

package/dist/errorPage.d.ts

@@ -0,0 +1,10 @@
+import type { Configuration, KoaContextWithOIDC } from 'oidc-provider';
+import type { HostedPageRenderer } from './hostedPages.js';
+type ErrorOut = Parameters<NonNullable<Configuration['renderError']>>[1];
+/**
+ * The page for an error the provider cannot send back to the app: an unknown client, an
+ * unregistered redirect_uri or post_logout_redirect_uri, a broken id_token_hint. Only the
+ * code and description go to the page, as data the UI renders as text. `state` is left out.
+ */
+export declare function createErrorPage(render: HostedPageRenderer): (ctx: KoaContextWithOIDC, out: ErrorOut) => Promise<void>;
+export {};

package/dist/errorPage.js

@@ -0,0 +1,24 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+/**
+ * The page for an error the provider cannot send back to the app: an unknown client, an
+ * unregistered redirect_uri or post_logout_redirect_uri, a broken id_token_hint. Only the
+ * code and description go to the page, as data the UI renders as text. `state` is left out.
+ */
+export function createErrorPage(render) {
+    return async (ctx, out) => {
+        const error = typeof out.error === 'string' ? out.error : 'server_error';
+        // The library's own text for an unexposed error is "oops! something went wrong".
+        const description = error !== 'server_error' && typeof out.error_description === 'string'
+            ? out.error_description
+            : 'Something went wrong on our side.';
+        const { html, headers } = await render({ view: 'error', error, description });
+        ctx.set(headers);
+        ctx.type = 'html';
+        ctx.body = html;
+    };
+}
+//# sourceMappingURL=errorPage.js.map

package/dist/errorPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorPage.js","sourceRoot":"","sources":["../src/errorPage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,OAAO,KAAK,EAAE,GAAuB,EAAE,GAAa,EAAiB,EAAE;QACrE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC;QACzE,iFAAiF;QACjF,MAAM,WAAW,GACf,KAAK,KAAK,cAAc,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YACnE,CAAC,CAAC,GAAG,CAAC,iBAAiB;YACvB,CAAC,CAAC,mCAAmC,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/hostedPages.d.ts

@@ -37,6 +37,7 @@ export declare function brandingFor(appName: string, hostedUi: HostedUi | undefi
 export type HostedPageData = Record<string, unknown> & {
     view: string;
 };
+export declare function pageTitle(appName: string, page?: HostedPageData): string;
 export declare function renderIndex(template: string, branding: HostedBranding, nonce: string, style?: BrandingStyle, page?: HostedPageData): string;
 export interface RenderedPage {
     html: string;

package/dist/hostedPages.js

@@ -7,6 +7,7 @@ import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import express from 'express';
+import { brandingContrastProblems } from './brandingContrast.js';
 /**
  * Paths the SPA renders. The adapter's bundled screens (`@seamless-auth/react` AuthRoutes)
  * own most of them, and the API builds magic link and recovery URLs from some.
@@ -104,10 +105,23 @@ export function brandingFor(appName, hostedUi) {
         ...(hostedUi?.logoUrl ? { logoUrl: hostedUi.logoUrl } : {}),
     };
 }
+/** WCAG 2.4.2: a page the provider renders is titled for what it does, not "Sign in". */
+const PAGE_TITLES = {
+    logout: (app) => `Sign out of ${app}`,
+    signed_out: (app) => `Signed out of ${app}`,
+    device_input: (app) => `Sign in on a device with ${app}`,
+    device_confirm: (app) => `Sign in on a device with ${app}`,
+    device_done: (app) => `Device signed in with ${app}`,
+    error: (app) => `${app}: we could not continue`,
+};
+export function pageTitle(appName, page) {
+    const title = page ? PAGE_TITLES[page.view] : undefined;
+    return title ? title(appName) : `Sign in to ${appName}`;
+}
 export function renderIndex(template, branding, nonce, style, page) {
     const head = [
         `<meta name="seamless-csp-nonce" content="${nonce}" />`,
-        `<title>Sign in to ${escapeHtml(branding.appName)}</title>`,
+        `<title>${escapeHtml(pageTitle(branding.appName, page))}</title>`,
         `<script type="application/json" id="seamless-hosted">${inlineJson(branding)}</script>`,
         ...(page
             ? [`<script type="application/json" id="seamless-page">${inlineJson(page)}</script>`]
@@ -135,8 +149,17 @@ export function createHostedPageRenderer(options) {
     if (!template.includes(HEAD_PLACEHOLDER)) {
         throw new Error(`${options.uiDir}/index.html has no ${HEAD_PLACEHOLDER} placeholder`);
     }
+    let checkedColors;
     return async (page, formActions) => {
         const config = await options.configCache.get();
+        const colors = JSON.stringify(config.hostedUi?.colors ?? null);
+        if (colors !== checkedColors) {
+            checkedColors = colors;
+            const problems = brandingContrastProblems(config.hostedUi);
+            if (problems.length > 0) {
+                console.warn(`[oidc-provider] hosted_ui colors fall below WCAG 2.2 AA contrast on the hosted pages: ${problems.join('; ')}`);
+            }
+        }
         const nonce = randomBytes(16).toString('base64');
         const branding = brandingFor(config.appName, config.hostedUi);
         return {

package/dist/hostedPages.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostedPages.js","sourceRoot":"","sources":["../src/hostedPages.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,OAAwB,MAAM,SAAS,CAAC;AAI/C;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,GAAG;IACH,mBAAmB;IACnB,QAAQ;IACR,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;CACV,CAAC;AAEX,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAOhD,MAAM,eAAe,GAAG;IACtB,OAAO,EAAE,0BAA0B;IACnC,SAAS,EAAE,6BAA6B;IACxC,UAAU,EAAE,6BAA6B;IACzC,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,wBAAwB;CACvB,CAAC;AAQX,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,OAAgB,EAChB,cAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,uFAAuF;IACvF,4DAA4D;IAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,2BAA2B,KAAK,GAAG;QACnC,uBAAuB,UAAU,EAAE;QACnC,iBAAiB;QACjB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB,WAAW,EAAE;QAClC,wBAAwB;QACxB,iBAAiB;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAA8B;IAC1D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAmC,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE;QAC3D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAA8B;IACzE,OAAO;QACL,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,OAAO;QACrC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAKD,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,QAAwB,EACxB,KAAa,EACb,KAAqB,EACrB,IAAqB;IAErB,MAAM,IAAI,GAAG;QACX,4CAA4C,KAAK,MAAM;QACvD,qBAAqB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU;QAC3D,wDAAwD,UAAU,CAAC,QAAQ,CAAC,WAAW;QACvF,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,sDAAsD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU;aAC/F;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,OAAgB,EAAE,WAA+B;IACnF,OAAO;QACL,yBAAyB,EAAE,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;QAC7E,eAAe,EAAE,UAAU;QAC3B,4BAA4B,EAAE,aAAa;QAC3C,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,sBAAsB,gBAAgB,cAAc,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;YAClF,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;SAC3D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA2B,EAC3B,SAA6B,wBAAwB,CAAC,OAAO,CAAC;IAE9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACR,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;QAC5C,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,EAAE;aACL,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC;aACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"hostedPages.js","sourceRoot":"","sources":["../src/hostedPages.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,OAAwB,MAAM,SAAS,CAAC;AAE/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGjE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,GAAG;IACH,mBAAmB;IACnB,QAAQ;IACR,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;CACV,CAAC;AAEX,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAOhD,MAAM,eAAe,GAAG;IACtB,OAAO,EAAE,0BAA0B;IACnC,SAAS,EAAE,6BAA6B;IACxC,UAAU,EAAE,6BAA6B;IACzC,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,wBAAwB;CACvB,CAAC;AAQX,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,OAAgB,EAChB,cAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,uFAAuF;IACvF,4DAA4D;IAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,2BAA2B,KAAK,GAAG;QACnC,uBAAuB,UAAU,EAAE;QACnC,iBAAiB;QACjB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB,WAAW,EAAE;QAClC,wBAAwB;QACxB,iBAAiB;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAA8B;IAC1D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAmC,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE;QAC3D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAA8B;IACzE,OAAO;QACL,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,OAAO;QACrC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,WAAW,GAAgD;IAC/D,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,GAAG,EAAE;IACrC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,GAAG,EAAE;IAC3C,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,4BAA4B,GAAG,EAAE;IACxD,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,4BAA4B,GAAG,EAAE;IAC1D,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,GAAG,EAAE;IACpD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,yBAAyB;CAChD,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAAqB;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,QAAwB,EACxB,KAAa,EACb,KAAqB,EACrB,IAAqB;IAErB,MAAM,IAAI,GAAG;QACX,4CAA4C,KAAK,MAAM;QACvD,UAAU,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,UAAU;QACjE,wDAAwD,UAAU,CAAC,QAAQ,CAAC,WAAW;QACvF,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,sDAAsD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU;aAC/F;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,OAAgB,EAAE,WAA+B;IACnF,OAAO;QACL,yBAAyB,EAAE,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;QAC7E,eAAe,EAAE,UAAU;QAC3B,4BAA4B,EAAE,aAAa;QAC3C,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,sBAAsB,gBAAgB,cAAc,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,aAAiC,CAAC;IACtC,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,aAAa,GAAG,MAAM,CAAC;YACvB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CACV,yFAAyF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;YAClF,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;SAC3D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA2B,EAC3B,SAA6B,wBAAwB,CAAC,OAAO,CAAC;IAE9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACR,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;QAC5C,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,EAAE;aACL,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC;aACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -16,5 +16,5 @@ export { createSameOriginGuard } from './originGuard.js';
 export { buildProviderConfiguration, loadExistingGrant, PROVIDER_COOKIE_NAMES, } from './providerConfig.js';
 export type { EdgeRequestContext } from './requestContext.js';
 export { adoptSession, bindSession, currentRequestContext, runWithRequestContext, } from './requestContext.js';
-export { ApiSigningKey, classifyToken, signingKeysFrom, UnsignableTokenError, } from './signingKey.js';
+export { ApiSigningKey, classifyToken, SIGNING_KEY_REFRESH_MS, SigningKeyRing, signingKeysFrom, UnsignableTokenError, } from './signingKey.js';
 export { checkApiCompatibility } from './startup.js';

package/dist/index.js

@@ -15,6 +15,6 @@ export { createInteractionRouter, FIRST_PARTY_CLIENT_PROPERTY } from './interact
 export { createSameOriginGuard } from './originGuard.js';
 export { buildProviderConfiguration, loadExistingGrant, PROVIDER_COOKIE_NAMES, } from './providerConfig.js';
 export { adoptSession, bindSession, currentRequestContext, runWithRequestContext, } from './requestContext.js';
-export { ApiSigningKey, classifyToken, signingKeysFrom, UnsignableTokenError, } from './signingKey.js';
+export { ApiSigningKey, classifyToken, SIGNING_KEY_REFRESH_MS, SigningKeyRing, signingKeysFrom, UnsignableTokenError, } from './signingKey.js';
 export { checkApiCompatibility } from './startup.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,eAAe,EACf,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/interactions.js

@@ -10,7 +10,7 @@ import { authRequirements, stepUpMethods, unmetRequirements } from './authRequir
 import { OidcApiError } from './errors.js';
 import { readFirstPartySession } from './firstPartySession.js';
 import { createSameOriginGuard } from './originGuard.js';
-import { bindSession } from './requestContext.js';
+import { bindSession, currentRequestContext } from './requestContext.js';
 import { grantLifetime } from './tokenLifetimes.js';
 export const FIRST_PARTY_CLIENT_PROPERTY = 'urn:seamless:first_party';
 class InteractionRefusal extends Error {
@@ -85,11 +85,38 @@ export function createInteractionRouter(options) {
             throw error;
         }
     }
+    /**
+     * What the confirmation shows as the account, or null when the page must not offer to
+     * continue. A browser only gets it while signed in as the account the interaction is for,
+     * which is what the consent route will require of the click.
+     */
+    async function accountIdentifier(req, interaction, clientId) {
+        const accountId = interaction.session?.accountId;
+        if (!accountId) {
+            return null;
+        }
+        const cookies = req.cookies;
+        const { session } = readFirstPartySession(cookies[options.accessCookieName], options.adapterCookieSecret);
+        if (session?.userId !== accountId) {
+            return null;
+        }
+        try {
+            // The interaction's session, which holds the grant. A refreshed cookie can name a newer one.
+            const sessionId = currentRequestContext()?.sessionId ?? session.sessionId;
+            const claims = await client.account(accountId, { clientId, sessionId });
+            return claims?.sub === accountId ? claims.email || claims.phone_number || null : null;
+        }
+        catch (error) {
+            console.error(`[oidc-provider] could not read the account to confirm: ${String(error)}`);
+            return null;
+        }
+    }
     router.get('/interaction/:uid/details', handle(async (req, res) => {
         const interaction = await load(req, res);
         const found = await clientFor(interaction);
         const details = promptDetails(interaction);
         const redirectUri = stringParam(interaction.params, 'redirect_uri');
+        const identifier = await accountIdentifier(req, interaction, found.clientId);
         res.set('cache-control', 'no-store');
         res.json({
             uid: interaction.uid,
@@ -108,6 +135,7 @@ export function createInteractionRouter(options) {
             },
             scopes: (stringParam(interaction.params, 'scope') ?? '').split(' ').filter(Boolean),
             loginHint: stringParam(interaction.params, 'login_hint') ?? null,
+            account: identifier ? { identifier } : null,
         });
     }));
     router.post('/interaction/:uid/login', express.json({ limit: '1kb' }), handle(async (req, res) => {
@@ -131,46 +159,71 @@ export function createInteractionRouter(options) {
         // Saved outside a provider request, where the ttl.Grant function cannot see the client.
         Object.assign(grant, { expiresIn: grantLifetime(found) });
         const grantId = await grant.save();
-        const context = await client.authContext(session.sessionId, found.clientId);
-        const refusal = !context || !context.active || context.userId !== session.userId
-            ? new InteractionRefusal(401, 'login_required')
-            : context.recovery
-                ? new InteractionRefusal(403, 'enrollment_required')
-                : undefined;
-        if (refusal || !context) {
-            // A grant left behind would bind the session to the client without a sign-in.
-            await grant.destroy();
-            throw refusal ?? new InteractionRefusal(401, 'login_required');
-        }
-        const unmet = unmetRequirements(authRequirements(interaction.params), context, interaction.iat);
-        if (unmet) {
-            await grant.destroy();
-            if (!afterStepUp) {
-                throw new InteractionRefusal(409, 'step_up_required', {
-                    methods: stepUpMethods(unmet, context),
+        // A grant left behind would bind the session to the client without a sign-in, so only
+        // a finished login keeps it, whatever else ends the request.
+        let keepGrant = false;
+        try {
+            const context = await client.authContext(session.sessionId, found.clientId);
+            if (!context || !context.active || context.userId !== session.userId) {
+                throw new InteractionRefusal(401, 'login_required');
+            }
+            if (context.recovery) {
+                throw new InteractionRefusal(403, 'enrollment_required');
+            }
+            const unmet = unmetRequirements(authRequirements(interaction.params), context, interaction.iat);
+            if (unmet) {
+                if (!afterStepUp) {
+                    throw new InteractionRefusal(409, 'step_up_required', {
+                        methods: stepUpMethods(unmet, context),
+                    });
+                }
+                // A weaker step-up than the request needs (a synced passkey for phrh, say) ends the
+                // request instead of issuing a lower acr.
+                const redirectTo = await provider.interactionResult(req, res, {
+                    error: 'unmet_authentication_requirements',
+                    error_description: 'the requested authentication could not be obtained',
+                }, { mergeWithLastSubmission: false });
+                res.json({ redirectTo });
+                return;
+            }
+            // RFC 8252 section 8.6: anything on the device can claim a native client's redirect,
+            // so its consent prompt must still run and be confirmed by the user, first-party or
+            // not. A device approval is confirmed on the device pages, after the user code is
+            // entered.
+            if (found.applicationType === 'native' && !interaction.deviceCode) {
+                const redirectTo = await provider.interactionResult(req, res, {
+                    login: loginResult(session.userId, context),
                 });
+                res.json({ redirectTo });
+                return;
             }
-            // A weaker step-up than the request needs (a synced passkey for phrh, say) ends the
-            // request instead of issuing a lower acr.
             const redirectTo = await provider.interactionResult(req, res, {
-                error: 'unmet_authentication_requirements',
-                error_description: 'the requested authentication could not be obtained',
-            }, { mergeWithLastSubmission: false });
+                login: loginResult(session.userId, context),
+                consent: { grantId },
+            });
+            keepGrant = true;
             res.json({ redirectTo });
-            return;
         }
-        const redirectTo = await provider.interactionResult(req, res, {
-            login: loginResult(session.userId, context),
-            consent: { grantId },
-        });
-        res.json({ redirectTo });
+        finally {
+            if (!keepGrant) {
+                await grant.destroy().catch((error) => {
+                    console.error(`[oidc-provider] could not remove an unused grant: ${String(error)}`);
+                });
+            }
+        }
     }));
-    router.post('/interaction/:uid/consent', handle(async (req, res) => {
+    router.post('/interaction/:uid/consent', express.json({ limit: '1kb' }), handle(async (req, res) => {
         const session = firstPartySession(req);
         const interaction = await load(req, res);
         if (interaction.prompt.name !== 'consent') {
             throw new InteractionRefusal(409, 'consent_not_requested');
         }
+        // The hosted pages consent for a first-party client on their own, which a native
+        // client's prompt must never get: only a click on the confirmation sends `confirmed`.
+        const confirmed = typeof req.body === 'object' && req.body !== null && req.body.confirmed === true;
+        if (interaction.prompt.reasons.includes('native_client_prompt') && !confirmed) {
+            throw new InteractionRefusal(403, 'confirmation_required');
+        }
         const accountId = interaction.session?.accountId;
         if (!accountId || accountId !== session.userId) {
             throw new InteractionRefusal(409, 'account_mismatch');

package/dist/interactions.js.map

@@ -1 +1 @@
-{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../src/interactions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,OAAwE,MAAM,SAAS,CAAC;AAE/F,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAA0B,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAkBtE,MAAM,kBAAmB,SAAQ,KAAK;IAEzB;IACA;IACA;IAHX,YACW,MAAc,EACd,KAAa,EACb,QAAiC,EAAE;QAE5C,KAAK,CAAC,KAAK,CAAC,CAAC;QAJJ,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAQ;QACb,UAAK,GAAL,KAAK,CAA8B;QAG5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,MAA+B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,WAAwB;IAC7C,OAAO,WAAW,CAAC,MAAM,CAAC,OAAwB,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,OAAwB;IAC9D,OAAO;QACL,SAAS;QACT,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAExF,KAAK,UAAU,IAAI,CAAC,GAAY,EAAE,GAAa;QAC7C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChE,uFAAuF;QACvF,gCAAgC;QAChC,IAAI,WAAW,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,WAAwB;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAY;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6C,CAAC;QAClE,MAAM,MAAM,GAAG,qBAAqB,CAClC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EACjC,OAAO,CAAC,mBAAmB,CAC5B,CAAC;QACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE,QAAgB;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE;gBACN,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI;gBAC7B,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO;gBACnC,aAAa,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE;gBAC7C,aAAa,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;gBAC9C,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,GAAG,CAC5E,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAC/C;aACF;YACD,MAAM,EAAE;gBACN,EAAE,EAAE,KAAK,CAAC,QAAQ;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ;gBACxC,UAAU,EAAE,KAAK,CAAC,2BAA2B,CAAC,KAAK,IAAI;gBACvD,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAC7D;YACD,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACnF,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,IAAI;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC;QACrF,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,IAAI,WAAW,CAAC,OAAO,EAAE,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACvF,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAE3C,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE5C,sFAAsF;QACtF,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1F,wFAAwF;QACxF,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,OAAO,GACX,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAC9D,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC;YAC/C,CAAC,CAAC,OAAO,CAAC,QAAQ;gBAChB,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,8EAA8E;YAC9E,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,OAAO,IAAI,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAC7B,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,EACpC,OAAO,EACP,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE;oBACpD,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,oFAAoF;YACpF,0CAA0C;YAC1C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH;gBACE,KAAK,EAAE,mCAAmC;gBAC1C,iBAAiB,EAAE,oDAAoD;aACxE,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC5D,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,2BAA2B,EAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;QACjD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAE3C,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO;YAClC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAClF,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACrC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YACtC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC;YACtF,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EACxB,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,EAC7E,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,EAAkD;IAChE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpC,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../src/interactions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,OAAwE,MAAM,SAAS,CAAC;AAE/F,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAA0B,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAkBtE,MAAM,kBAAmB,SAAQ,KAAK;IAEzB;IACA;IACA;IAHX,YACW,MAAc,EACd,KAAa,EACb,QAAiC,EAAE;QAE5C,KAAK,CAAC,KAAK,CAAC,CAAC;QAJJ,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAQ;QACb,UAAK,GAAL,KAAK,CAA8B;QAG5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,MAA+B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,WAAwB;IAC7C,OAAO,WAAW,CAAC,MAAM,CAAC,OAAwB,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,OAAwB;IAC9D,OAAO;QACL,SAAS;QACT,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAExF,KAAK,UAAU,IAAI,CAAC,GAAY,EAAE,GAAa;QAC7C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChE,uFAAuF;QACvF,gCAAgC;QAChC,IAAI,WAAW,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,WAAwB;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAY;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6C,CAAC;QAClE,MAAM,MAAM,GAAG,qBAAqB,CAClC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EACjC,OAAO,CAAC,mBAAmB,CAC5B,CAAC;QACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE,QAAgB;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,WAAwB,EAAE,QAAgB;QACvF,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6C,CAAC;QAClE,MAAM,EAAE,OAAO,EAAE,GAAG,qBAAqB,CACvC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EACjC,OAAO,CAAC,mBAAmB,CAC5B,CAAC;QACF,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,6FAA6F;YAC7F,MAAM,SAAS,GAAG,qBAAqB,EAAE,EAAE,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,OAAO,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,0DAA0D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE;gBACN,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI;gBAC7B,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO;gBACnC,aAAa,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE;gBAC7C,aAAa,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;gBAC9C,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,GAAG,CAC5E,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAC/C;aACF;YACD,MAAM,EAAE;gBACN,EAAE,EAAE,KAAK,CAAC,QAAQ;gBAClB,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ;gBACxC,UAAU,EAAE,KAAK,CAAC,2BAA2B,CAAC,KAAK,IAAI;gBACvD,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAC7D;YACD,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACnF,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,IAAI;YAChE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC;QACrF,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,IAAI,WAAW,CAAC,OAAO,EAAE,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACvF,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAE3C,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE5C,sFAAsF;QACtF,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1F,wFAAwF;QACxF,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,sFAAsF;QACtF,6DAA6D;QAC7D,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBACrE,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,KAAK,GAAG,iBAAiB,CAC7B,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,EACpC,OAAO,EACP,WAAW,CAAC,GAAG,CAChB,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,EAAE;wBACpD,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;qBACvC,CAAC,CAAC;gBACL,CAAC;gBACD,oFAAoF;gBACpF,0CAA0C;gBAC1C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH;oBACE,KAAK,EAAE,mCAAmC;oBAC1C,iBAAiB,EAAE,oDAAoD;iBACxE,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,qFAAqF;YACrF,oFAAoF;YACpF,kFAAkF;YAClF,WAAW;YACX,IAAI,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;gBAClE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC5D,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC5C,CAAC,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC5D,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;gBAC3C,OAAO,EAAE,EAAE,OAAO,EAAE;aACrB,CAAC,CAAC;YACH,SAAS,GAAG,IAAI,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC7C,OAAO,CAAC,KAAK,CAAC,qDAAqD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtF,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,2BAA2B,EAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAC9B,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QACD,iFAAiF;QACjF,sFAAsF;QACtF,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;QACnF,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9E,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;QACjD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAE3C,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO;YAClC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GACT,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YAClF,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;YACrC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YACtC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,CAAC;YACtF,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EACxB,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CACjD,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,EAC7E,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,EAAkD;IAChE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpC,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/jwtAccessTokens.d.ts

@@ -4,7 +4,7 @@ import type { ApiSigningKey } from './signingKey.js';
  * Maps a JWT access token this provider signed back to its `jti`. Only RS256, the one alg the
  * API signs with, and only after the signature checks out against a published provider key.
  */
-export declare function createJwtAccessTokenLookup(keys: readonly ApiSigningKey[], issuer: string): (value: string) => string | undefined;
+export declare function createJwtAccessTokenLookup(currentKeys: () => readonly ApiSigningKey[], issuer: string): (value: string) => string | undefined;
 /**
  * The library refuses JWTs at introspection and revocation, because it looks tokens up by the
  * presented value and stores a JWT access token under its `jti`. A resource server holding a

package/dist/jwtAccessTokens.js

@@ -20,8 +20,9 @@ function decode(segment) {
  * Maps a JWT access token this provider signed back to its `jti`. Only RS256, the one alg the
  * API signs with, and only after the signature checks out against a published provider key.
  */
-export function createJwtAccessTokenLookup(keys, issuer) {
+export function createJwtAccessTokenLookup(currentKeys, issuer) {
     return (value) => {
+        const keys = currentKeys();
         const [header, payload, signature, extra] = value.split('.');
         if (!header || !payload || !signature || extra !== undefined) {
             return undefined;

package/dist/jwtAccessTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwtAccessTokens.js","sourceRoot":"","sources":["../src/jwtAccessTokens.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAIrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,SAAS,MAAM,CAAC,OAAe;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzE,CAAC,CAAE,KAAiC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA8B,EAAE,MAAc;IACvF,OAAO,CAAC,KAAa,EAAsB,EAAE;QAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,YAAY,EAAE,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC;QACzE,IACE,CAAC,GAAG;YACJ,CAAC,MAAM,CACL,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,EACnC,GAAG,CAAC,SAAS,EAAE,EACf,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CACpC,EACD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,MAAM,EAAE,GAAG,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG;YAC3E,CAAC,CAAC,MAAM,CAAC,GAAG;YACZ,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7B,4FAA4F;AAC5F,wFAAwF;AACxF,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,KAAK,UAAU,QAAQ,CAAC,MAA6B;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA6C,EAC7C,KAAe;IAEf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,IACE,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YACrB,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAmC,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAA0C,CAAC;QAC/D,uEAAuE;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ;YAC3B,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBACjE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACzB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACxC,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,kBAAkB,GAAG,GAAG,CAAC;YACnC,CAAC;QACH,CAAC;QACD,wDAAwD;QACxD,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,KAAa,EACb,GAAyC;IAEzC,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,WAA0C,CAAC;IACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"jwtAccessTokens.js","sourceRoot":"","sources":["../src/jwtAccessTokens.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAIrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,SAAS,MAAM,CAAC,OAAe;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzE,CAAC,CAAE,KAAiC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAA2C,EAC3C,MAAc;IAEd,OAAO,CAAC,KAAa,EAAsB,EAAE;QAC3C,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,YAAY,EAAE,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC;QACzE,IACE,CAAC,GAAG;YACJ,CAAC,MAAM,CACL,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,EACnC,GAAG,CAAC,SAAS,EAAE,EACf,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CACpC,EACD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,MAAM,EAAE,GAAG,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG;YAC3E,CAAC,CAAC,MAAM,CAAC,GAAG;YACZ,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7B,4FAA4F;AAC5F,wFAAwF;AACxF,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,KAAK,UAAU,QAAQ,CAAC,MAA6B;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA6C,EAC7C,KAAe;IAEf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,IACE,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YACrB,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAmC,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAA0C,CAAC;QAC/D,uEAAuE;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ;YAC3B,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBACjE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACzB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACxC,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,kBAAkB,GAAG,GAAG,CAAC;YACnC,CAAC;QACH,CAAC;QACD,wDAAwD;QACxD,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAa,EACb,KAAa,EACb,GAAyC;IAEzC,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,WAA0C,CAAC;IACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/logout.d.ts

@@ -18,5 +18,9 @@ export declare function leaveBackchannelLogoutToApi(provider: Provider): void;
  * it was made under, which this does. That revocation is what tells every other app the user
  * signed in to through it. The adapter cookies are cleared too, so the hosted pages do not
  * offer a session that no longer exists.
+ *
+ * A provider session with no account gets no confirmation page: the library posts
+ * `logout=yes` on its own, so any site could send a browser there. The first-party session
+ * and its cookies are left alone then, since nobody chose to sign out of anything.
  */
 export declare function endFirstPartySessionOnLogout(client: OidcApiClient, adapterCookies: string[]): (ctx: KoaContextWithOIDC, next: () => Promise<unknown>) => Promise<void>;

package/dist/logout.js

@@ -44,11 +44,18 @@ export function leaveBackchannelLogoutToApi(provider) {
  * it was made under, which this does. That revocation is what tells every other app the user
  * signed in to through it. The adapter cookies are cleared too, so the hosted pages do not
  * offer a session that no longer exists.
+ *
+ * A provider session with no account gets no confirmation page: the library posts
+ * `logout=yes` on its own, so any site could send a browser there. The first-party session
+ * and its cookies are left alone then, since nobody chose to sign out of anything.
  */
 export function endFirstPartySessionOnLogout(client, adapterCookies) {
     return async (ctx, next) => {
         await next();
-        if (ctx.oidc?.route !== 'end_session_confirm' || ctx.status !== 303) {
+        // The library destroys the session it ends, but the loaded copy still names its account.
+        if (ctx.oidc?.route !== 'end_session_confirm' ||
+            ctx.status !== 303 ||
+            !ctx.oidc.session?.accountId) {
             return;
         }
         const everywhere = Boolean(ctx.oidc.params?.logout);

package/dist/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../src/logout.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,SAAS,IAAI,CAAC,GAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAgB;IACpE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAuB;YACxC,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC;YACzD,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CACV;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;gBAC1C,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACjC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;aAClF,EACD,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,uBAAuB,CAAC,GAAuB;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/B,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;aACnE,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,GAAG,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAqB,EAAE,cAAwB;IAC1F,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,MAAM,IAAI,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,qBAAqB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;oBAC5C,MAAM,EAAE,iBAAiB;oBACzB,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,0DAA0D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../src/logout.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,SAAS,IAAI,CAAC,GAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAgB;IACpE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAuB;YACxC,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC;YACzD,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CACV;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;gBAC1C,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACjC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;aAClF,EACD,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,uBAAuB,CAAC,GAAuB;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/B,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;aACnE,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,GAAG,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAqB,EAAE,cAAwB;IAC1F,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,MAAM,IAAI,EAAE,CAAC;QACb,yFAAyF;QACzF,IACE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,qBAAqB;YACzC,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAC5B,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE;oBAC5C,MAAM,EAAE,iBAAiB;oBACzB,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,IAAI,EAAE,aAAa;gBACnB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,0DAA0D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/providerConfig.d.ts

@@ -1,9 +1,8 @@
 import type { OidcEdgeConfigResponse } from '@seamless-auth/types';
-import { type Configuration, type FindAccount, interactionPolicy, type KoaContextWithOIDC } from 'oidc-provider';
+import { type Configuration, type ExternalSigningKey, type FindAccount, interactionPolicy, type KoaContextWithOIDC } from 'oidc-provider';
 import type { OidcApiClient } from './apiClient.js';
 import type { EdgeConfigCache } from './configCache.js';
 import type { HostedPageRenderer } from './hostedPages.js';
-import type { ApiSigningKey } from './signingKey.js';
 export declare const PROVIDER_COOKIE_NAMES: {
     readonly session: "__Host-oidc_session";
     readonly interaction: "__Host-oidc_interaction";
@@ -12,7 +11,8 @@ export declare const PROVIDER_COOKIE_NAMES: {
 export interface ProviderConfigurationInput {
     client: OidcApiClient;
     config: OidcEdgeConfigResponse;
-    signingKeys: ApiSigningKey[];
+    /** The active key first. */
+    signingKeys: ExternalSigningKey[];
     cookieKeys: string[];
     configCache: EdgeConfigCache;
     renderPage: HostedPageRenderer;

package/dist/providerConfig.js

@@ -4,9 +4,12 @@
  * See LICENSE file in the project root for full license information
  */
 import { interactionPolicy, } from 'oidc-provider';
+import { accessTokenClaims } from './accessTokenClaims.js';
+import { accountClaimsOf, CUSTOM_CLAIMS_SCOPE, PERMISSIONS_SCOPE, PERMISSIONS_SCOPE_CLAIMS, providerAccountOf, withAccount, } from './accountClaims.js';
 import { createApiAdapterFactory } from './adapter.js';
 import { ACR_VALUES, authRequirements, hasRequirements, meetsAcr, unmetRequirements, } from './authRequirements.js';
 import { createDevicePages, DEVICE_CODE_TTL_SECONDS } from './deviceFlow.js';
+import { createErrorPage } from './errorPage.js';
 import { OidcApiError } from './errors.js';
 import { readFirstPartySession } from './firstPartySession.js';
 import { FIRST_PARTY_CLIENT_PROPERTY } from './interactions.js';
@@ -41,11 +44,12 @@ export function createFindAccount(client) {
         const sessionId = currentRequestContext()?.sessionId;
         const claims = clientId && sessionId ? await client.account(sub, { clientId, sessionId }) : undefined;
         if (claims) {
-            const { org_id, ...rest } = claims;
-            return {
+            // Read at call time: a claims_mismatch retry replaces the account's claims in place.
+            const account = withAccount({
                 accountId: claims.sub,
-                claims: () => ({ ...rest, ...(org_id ? { org_id } : {}) }),
-            };
+                claims: () => accountClaimsOf(providerAccountOf(account) ?? claims),
+            }, claims);
+            return account;
         }
         // A client this session has not used yet has no grant, so the API will not describe the
         // account. At authorization the library only needs to know the provider session's own
@@ -203,7 +207,7 @@ export function buildProviderConfiguration(input) {
     if (!activeKey) {
         throw new Error('No provider signing key is available');
     }
-    const activeAlg = activeKey.alg;
+    const activeAlg = activeKey.alg ?? '';
     if (!isAsymmetricAlg(activeAlg)) {
         throw new Error(`The active provider key uses unsupported alg ${activeAlg}`);
     }
@@ -212,6 +216,7 @@ export function buildProviderConfiguration(input) {
     return {
         adapter: createApiAdapterFactory(input.client, input.configCache),
         findAccount: createFindAccount(input.client),
+        renderError: createErrorPage(input.renderPage),
         loadExistingGrant,
         jwks: { keys: input.signingKeys },
         responseTypes: ['code'],
@@ -236,15 +241,25 @@ export function buildProviderConfiguration(input) {
             userinfoSigningAlgValues: signingAlgs,
         },
         acrValues: [...ACR_VALUES],
-        scopes: ['openid', 'offline_access', 'email', 'phone', 'seamless'],
+        scopes: [
+            'openid',
+            'offline_access',
+            'email',
+            'phone',
+            'seamless',
+            PERMISSIONS_SCOPE,
+            CUSTOM_CLAIMS_SCOPE,
+        ],
         // Listing claims replaces the library's defaults. The session claims sit under openid so
         // every ID token carries the assurance the API recorded (ADR D9, D11), asked for or not.
+        // Custom claim names are the adopter's, so releaseAuthorizationClaims adds them.
         claims: {
             sid: null,
             openid: ['sub', 'acr', 'amr', 'auth_time'],
             email: ['email', 'email_verified'],
             phone: ['phone_number', 'phone_number_verified'],
             seamless: ['roles', 'org_id'],
+            [PERMISSIONS_SCOPE]: [...PERMISSIONS_SCOPE_CLAIMS],
         },
         extraClientMetadata: {
             properties: [
@@ -266,6 +281,7 @@ export function buildProviderConfiguration(input) {
             device_authorization: '/device/auth',
         },
         formats: { customizers: { jwt: storeJwtAccessToken } },
+        extraTokenClaims: accessTokenClaims,
         ttl: {
             // Functions, so the resource's and the application's own lifetimes apply.
             AccessToken: accessTokenTtl,