@seamless-auth/oidc-provider 0.3.0 → 0.4.0

package/dist/brandingContrast.js

@@ -0,0 +1,59 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+/** The stylesheet's light palette (ui/src/styles.css), which unset colors fall back to. */
+const DEFAULT_COLORS = {
+    primary: '#1f4fd1',
+    onPrimary: '#ffffff',
+    background: '#f5f6f8',
+    surface: '#ffffff',
+    text: '#1a1d21',
+    muted: '#4a515b',
+};
+/**
+ * The pairs the hosted pages draw. Text needs 4.5:1 (WCAG 1.4.3). The primary color is also
+ * the focus ring on the page background, which needs 3:1 (1.4.11).
+ */
+const PAIRS = [
+    { foreground: 'text', background: 'background', minimum: 4.5 },
+    { foreground: 'text', background: 'surface', minimum: 4.5 },
+    { foreground: 'muted', background: 'background', minimum: 4.5 },
+    { foreground: 'muted', background: 'surface', minimum: 4.5 },
+    { foreground: 'onPrimary', background: 'primary', minimum: 4.5 },
+    { foreground: 'primary', background: 'surface', minimum: 4.5 },
+    { foreground: 'primary', background: 'background', minimum: 3 },
+];
+function channel(value) {
+    const srgb = value / 255;
+    return srgb <= 0.04045 ? srgb / 12.92 : ((srgb + 0.055) / 1.055) ** 2.4;
+}
+function luminance(hex) {
+    const digits = hex.slice(1);
+    // An 8-digit color's alpha is ignored: the check reads it as opaque.
+    const full = digits.length === 3 ? [...digits].map((digit) => digit + digit).join('') : digits.slice(0, 6);
+    const [r, g, b] = [0, 2, 4].map((index) => channel(parseInt(full.slice(index, index + 2), 16)));
+    return 0.2126 * r + 0.7152 * g + 0.0722 * b;
+}
+export function contrastRatio(a, b) {
+    const [light, dark] = [luminance(a), luminance(b)].sort((x, y) => y - x);
+    return (light + 0.05) / (dark + 0.05);
+}
+/** The color pairs a branded palette leaves below WCAG 2.2 AA, as readable lines. */
+export function brandingContrastProblems(hostedUi) {
+    const colors = hostedUi?.colors;
+    if (!colors || Object.keys(colors).length === 0) {
+        return [];
+    }
+    const palette = { ...DEFAULT_COLORS, ...colors };
+    return PAIRS.flatMap(({ foreground, background, minimum }) => {
+        const ratio = contrastRatio(palette[foreground], palette[background]);
+        return ratio < minimum
+            ? [
+                `${foreground} ${palette[foreground]} on ${background} ${palette[background]} is ${ratio.toFixed(2)}:1, needs ${minimum}:1`,
+            ]
+            : [];
+    });
+}
+//# sourceMappingURL=brandingContrast.js.map

package/dist/brandingContrast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brandingContrast.js","sourceRoot":"","sources":["../src/brandingContrast.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,2FAA2F;AAC3F,MAAM,cAAc,GAA8B;IAChD,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,SAAS;IACpB,UAAU,EAAE,SAAS;IACrB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,SAAS;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,KAAK,GAAwE;IACjF,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE;IAC9D,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE;IAC3D,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE;IAC/D,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE;IAC5D,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE;IAChE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE;IAC9D,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE;CAChE,CAAC;AAEF,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,IAAI,GAAG,KAAK,GAAG,GAAG,CAAC;IACzB,OAAO,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,qEAAqE;IACrE,MAAM,IAAI,GACR,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,MAAM,GAAG,CAAE,GAAG,MAAM,GAAG,CAAE,GAAG,MAAM,GAAG,CAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,KAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAK,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CAAC,QAA8B;IACrE,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,OAAO,KAAK,GAAG,OAAO;YACpB,CAAC,CAAC;gBACE,GAAG,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,IAAI;aAC5H;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/claimsMismatch.d.ts

@@ -0,0 +1,15 @@
+import { errors, Provider } from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+/** RFC 6749 section 5.2, with the 500 the library answers `server_error` with. */
+export declare function claimsChangedError(): errors.OIDCProviderError;
+/**
+ * A role or membership can change between the account read that built a token and the API's
+ * sign, and the API then refuses with `claims_mismatch`. The token is built again from a fresh
+ * read and signed once more. A second mismatch fails the request as `server_error`; every other
+ * refusal is left as it was.
+ *
+ * ID tokens (and signed userinfo) copy the account's claims when they are created, so those
+ * are swapped in place. An access token reads them again on `save` through `extraTokenClaims`,
+ * and the record a failed `save` stored under its jti is overwritten by the retry.
+ */
+export declare function retryOnClaimsMismatch(provider: Provider, client: OidcApiClient): void;

package/dist/claimsMismatch.js

@@ -0,0 +1,90 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { errors, Provider } from 'oidc-provider';
+import { accountClaimsOf, providerAccountOf, withAccount } from './accountClaims.js';
+import { OidcSignRefusedError } from './errors.js';
+import { currentRequestContext } from './requestContext.js';
+function isClaimsMismatch(error) {
+    return error instanceof OidcSignRefusedError && error.code === 'claims_mismatch';
+}
+/** RFC 6749 section 5.2, with the 500 the library answers `server_error` with. */
+export function claimsChangedError() {
+    const error = new errors.OIDCProviderError(500, 'server_error');
+    error.expose = true;
+    error.error_description = 'the account changed while the token was being issued, try again';
+    return error;
+}
+/**
+ * Reads the account again for the session and client the request serves, and puts the new
+ * claims on the account the library loaded. Returns the claims it replaced, or undefined when
+ * the API no longer describes the account.
+ */
+async function rereadAccount(client, ctx) {
+    const account = ctx?.oidc?.account;
+    const previous = providerAccountOf(account);
+    const clientId = ctx?.oidc?.client?.clientId;
+    const sessionId = currentRequestContext()?.sessionId;
+    if (!account || !previous || !clientId || !sessionId) {
+        return undefined;
+    }
+    const fresh = await client.account(account.accountId, { clientId, sessionId });
+    if (!fresh || fresh.sub !== previous.sub) {
+        return undefined;
+    }
+    withAccount(account, fresh);
+    return { previous, fresh };
+}
+/**
+ * A role or membership can change between the account read that built a token and the API's
+ * sign, and the API then refuses with `claims_mismatch`. The token is built again from a fresh
+ * read and signed once more. A second mismatch fails the request as `server_error`; every other
+ * refusal is left as it was.
+ *
+ * ID tokens (and signed userinfo) copy the account's claims when they are created, so those
+ * are swapped in place. An access token reads them again on `save` through `extraTokenClaims`,
+ * and the record a failed `save` stored under its jti is overwritten by the retry.
+ */
+export function retryOnClaimsMismatch(provider, client) {
+    async function retrying(ctx, attempt, rebuild) {
+        try {
+            return await attempt();
+        }
+        catch (error) {
+            if (!isClaimsMismatch(error)) {
+                throw error;
+            }
+            const reread = await rereadAccount(client, ctx);
+            if (!reread) {
+                throw claimsChangedError();
+            }
+            rebuild(reread);
+            try {
+                return await attempt();
+            }
+            catch (retryError) {
+                throw isClaimsMismatch(retryError) ? claimsChangedError() : retryError;
+            }
+        }
+    }
+    const idToken = provider.IdToken.prototype;
+    const issue = idToken.issue;
+    idToken.issue = function (...args) {
+        return retrying(this.ctx ?? Provider.ctx, () => issue.apply(this, args), ({ previous, fresh }) => {
+            for (const key of Reflect.ownKeys(accountClaimsOf(previous))) {
+                if (key !== 'sub') {
+                    delete this.available[key];
+                }
+            }
+            Object.assign(this.available, accountClaimsOf(fresh));
+        });
+    };
+    const accessToken = provider.AccessToken.prototype;
+    const save = accessToken.save;
+    accessToken.save = function (...args) {
+        return retrying(Provider.ctx, () => save.apply(this, args), () => undefined);
+    };
+}
+//# sourceMappingURL=claimsMismatch.js.map

package/dist/claimsMismatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claimsMismatch.js","sourceRoot":"","sources":["../src/claimsMismatch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAA2B,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAErF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC;AACnF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAChE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,iBAAiB,GAAG,iEAAiE,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,MAAqB,EAAE,GAAmC;IACrF,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC;IACnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC;IAC7C,MAAM,SAAS,GAAG,qBAAqB,EAAE,EAAE,SAAS,CAAC;IACrD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB,EAAE,MAAqB;IAC7E,KAAK,UAAU,QAAQ,CACrB,GAAmC,EACnC,OAAyB,EACzB,OAAiF;QAEjF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,kBAAkB,EAAE,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAChB,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,SAEhC,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,OAAO,CAAC,KAAK,GAAG,UAAiC,GAAG,IAAe;QACjE,OAAO,QAAQ,CACb,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EACxB,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAC7B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;YACtB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC7D,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;oBAClB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,SAExC,CAAC;IACF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;IAC9B,WAAW,CAAC,IAAI,GAAG,UAAyB,GAAG,IAAe;QAC5D,OAAO,QAAQ,CACb,QAAQ,CAAC,GAAG,EACZ,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAC5B,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/createOidcEdge.d.ts

@@ -28,6 +28,11 @@ export interface OidcEdgeOptions {
      * `trust proxy` set to match.
      */
     trustProxy?: boolean;
+    /**
+     * How often to re-read the API's provider keys, so a rotation is picked up. A key the API
+     * refuses as unknown reloads them at once as well. `0` turns the timer off.
+     */
+    signingKeyRefreshMs?: number;
     /** `false` keeps the adapter on its bundled route manifest. */
     fetchAdapterManifest?: boolean;
     /** The built hosted pages. Defaults to the copy this package ships in `dist/ui`. */

package/dist/createOidcEdge.js

@@ -8,7 +8,9 @@ import { fileURLToPath } from 'node:url';
 import { createSeamlessAuthServer } from '@seamless-auth/express';
 import express from 'express';
 import Provider from 'oidc-provider';
+import { releaseAuthorizationClaims } from './accountClaims.js';
 import { OidcApiClient } from './apiClient.js';
+import { retryOnClaimsMismatch } from './claimsMismatch.js';
 import { verifyClientSecrets } from './clientSecrets.js';
 import { EdgeConfigCache } from './configCache.js';
 import { deviceFlowMiddleware } from './deviceFlow.js';
@@ -21,8 +23,9 @@ import { buildProviderConfiguration, PROVIDER_COOKIE_NAMES } from './providerCon
 import { createRateLimiter } from './rateLimit.js';
 import { revokeSessionOnRefreshReuse } from './refreshReuse.js';
 import { runWithRequestContext } from './requestContext.js';
+import { formPostRefusedRequestObjects } from './requestObjectErrors.js';
 import { hostOnlyResumeCookie } from './resumeCookie.js';
-import { signingKeysFrom } from './signingKey.js';
+import { SigningKeyRing } from './signingKey.js';
 import { checkApiCompatibility } from './startup.js';
 import { auditRevocations } from './tokenAudit.js';
 export const ADAPTER_COOKIE_NAMES = {
@@ -40,7 +43,10 @@ export async function createOidcEdge(options) {
     });
     const config = await checkApiCompatibility(client);
     const configCache = new EdgeConfigCache(client, config);
-    const signingKeys = signingKeysFrom(await client.jwks(), client);
+    const signingKeys = new SigningKeyRing(await client.jwks(), client);
+    if (options.signingKeyRefreshMs !== 0) {
+        signingKeys.startRefresh(options.signingKeyRefreshMs);
+    }
     const hostedPages = {
         uiDir: options.uiDir ?? fileURLToPath(new URL('./ui/', import.meta.url)),
         configCache,
@@ -50,23 +56,30 @@ export async function createOidcEdge(options) {
         client,
         config,
         configCache,
-        signingKeys,
+        signingKeys: signingKeys.providerKeys,
         cookieKeys: options.cookieKeys,
         renderPage,
         adapterCookieSecret: options.adapterCookieSecret,
         accessCookieName: ADAPTER_COOKIE_NAMES.access,
     }));
     leaveBackchannelLogoutToApi(provider);
+    releaseAuthorizationClaims(provider);
+    retryOnClaimsMismatch(provider, client);
+    formPostRefusedRequestObjects(provider);
     provider.proxy = options.trustProxy === true;
     provider.use(hostOnlyResumeCookie(PROVIDER_COOKIE_NAMES.resume, '/authorize'));
     provider.use(verifyClientSecrets(client));
     provider.use(revokeSessionOnRefreshReuse(client));
     provider.use(auditRevocations(client));
     provider.use(endFirstPartySessionOnLogout(client, Object.values(ADAPTER_COOKIE_NAMES)));
-    provider.use(acceptJwtAccessTokens(createJwtAccessTokenLookup(signingKeys, config.issuer), [
-        '/token/introspection',
-        '/token/revocation',
-    ]));
+    provider.use(acceptJwtAccessTokens(createJwtAccessTokenLookup(() => signingKeys.keys, config.issuer), ['/token/introspection', '/token/revocation']));
+    // The library publishes the keys it was started with; this serves the API's current set.
+    provider.use(async (ctx, next) => {
+        await next();
+        if (ctx.oidc?.route === 'jwks' && ctx.status === 200) {
+            ctx.body = { keys: signingKeys.publicJwks };
+        }
+    });
     // The library answers a bare server_error and logs nothing, so this is the only trace.
     provider.on('server_error', (_ctx, error) => {
         console.error(`[oidc-provider] ${error.name}: ${error.message}`);
@@ -129,6 +142,29 @@ export async function createOidcEdge(options) {
     ];
     router.post(`${issuerBase}/device`, ...userCodeLimiters);
     router.use(issuerUrl.pathname, provider.callback());
+    router.use(jsonErrorHandler);
     return { router, provider, issuer: config.issuer, config, client };
 }
+/**
+ * Express's own handler answers HTML, with a stack trace whenever `NODE_ENV` is not
+ * production. A client error from a body parser keeps its status; anything else is logged
+ * by name and message only, and answered as a bare `server_error`.
+ */
+function jsonErrorHandler(error, _req, res, next) {
+    if (res.headersSent) {
+        next(error);
+        return;
+    }
+    const status = typeof error === 'object' && error !== null && 'status' in error
+        ? Number(error.status)
+        : undefined;
+    if (status !== undefined && status >= 400 && status < 500) {
+        res.status(status).json({ error: 'invalid_request' });
+        return;
+    }
+    const name = error instanceof Error ? error.name : 'Error';
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[oidc-provider] ${name}: ${message}`);
+    res.status(500).json({ error: 'server_error' });
+}
 //# sourceMappingURL=createOidcEdge.js.map

package/dist/createOidcEdge.js.map

@@ -1 +1 @@
-{"version":3,"file":"createOidcEdge.js","sourceRoot":"","sources":["../src/createOidcEdge.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,OAAwB,MAAM,SAAS,CAAC;AAC/C,OAAO,QAAQ,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,wBAAwB;IAChC,YAAY,EAAE,2BAA2B;IACzC,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,0BAA0B;CAC3B,CAAC;AAsCX,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAwB;IAC3D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,WAAW;KACZ,CAAC;IACF,MAAM,UAAU,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,MAAM,CAAC,MAAM,EACb,0BAA0B,CAAC;QACzB,MAAM;QACN,MAAM;QACN,WAAW;QACX,WAAW;QACX,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,gBAAgB,EAAE,oBAAoB,CAAC,MAAM;KAC9C,CAAC,CACH,CAAC;IACF,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxF,QAAQ,CAAC,GAAG,CACV,qBAAqB,CAAC,0BAA0B,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QAC5E,sBAAsB;QACtB,mBAAmB;KACpB,CAAC,CACH,CAAC;IACF,uFAAuF;IACvF,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,KAAY,EAAE,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,wFAAwF;IACxF,sFAAsF;IACtF,uFAAuF;IACvF,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,qBAAqB,CACnB;YACE,aAAa,EAAE,UAAU,EAAE;YAC3B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,EACD,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,CACR,OAAO,EACP,UAAU,EACV,wBAAwB,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM;QAC7C,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,YAAY,EAAE,OAAO,CAAC,mBAAmB;QACzC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,oBAAoB,CAAC,MAAM;QAC7C,sBAAsB,EAAE,oBAAoB,CAAC,YAAY;QACzD,iBAAiB,EAAE,oBAAoB,CAAC,OAAO;QAC/C,iBAAiB,EAAE,oBAAoB,CAAC,OAAO;QAC/C,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,uBAAuB,CAAC;QACtB,QAAQ;QACR,MAAM;QACN,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,gBAAgB,EAAE,oBAAoB,CAAC,MAAM;KAC9C,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAE7D,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,MAAM,CAAC,GAAG,CACR,CAAC,GAAG,UAAU,sBAAsB,EAAE,GAAG,UAAU,mBAAmB,CAAC,EACvE,kBAAkB,CACnB,CAAC;IAEF,0FAA0F;IAC1F,sDAAsD;IACtD,MAAM,gBAAgB,GAAG;QACvB,iBAAiB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAClD,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;KACtE,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,SAAS,EAAE,GAAG,gBAAgB,CAAC,CAAC;IAEzD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrE,CAAC"}
+{"version":3,"file":"createOidcEdge.js","sourceRoot":"","sources":["../src/createOidcEdge.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,OAAwE,MAAM,SAAS,CAAC;AAC/F,OAAO,QAAQ,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,wBAAwB;IAChC,YAAY,EAAE,2BAA2B;IACzC,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,0BAA0B;CAC3B,CAAC;AA2CX,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAwB;IAC3D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,cAAc,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,mBAAmB,KAAK,CAAC,EAAE,CAAC;QACtC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,WAAW;KACZ,CAAC;IACF,MAAM,UAAU,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,MAAM,CAAC,MAAM,EACb,0BAA0B,CAAC;QACzB,MAAM;QACN,MAAM;QACN,WAAW;QACX,WAAW,EAAE,WAAW,CAAC,YAAY;QACrC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,gBAAgB,EAAE,oBAAoB,CAAC,MAAM;KAC9C,CAAC,CACH,CAAC;IACF,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACrC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxF,QAAQ,CAAC,GAAG,CACV,qBAAqB,CACnB,0BAA0B,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EACjE,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAC9C,CACF,CAAC;IACF,yFAAyF;IACzF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,IAAI,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,uFAAuF;IACvF,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,KAAY,EAAE,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,wFAAwF;IACxF,sFAAsF;IACtF,uFAAuF;IACvF,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,qBAAqB,CACnB;YACE,aAAa,EAAE,UAAU,EAAE;YAC3B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,EACD,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,CACR,OAAO,EACP,UAAU,EACV,wBAAwB,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM;QAC7C,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,YAAY,EAAE,OAAO,CAAC,mBAAmB;QACzC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,oBAAoB,CAAC,MAAM;QAC7C,sBAAsB,EAAE,oBAAoB,CAAC,YAAY;QACzD,iBAAiB,EAAE,oBAAoB,CAAC,OAAO;QAC/C,iBAAiB,EAAE,oBAAoB,CAAC,OAAO;QAC/C,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,uBAAuB,CAAC;QACtB,QAAQ;QACR,MAAM;QACN,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,gBAAgB,EAAE,oBAAoB,CAAC,MAAM;KAC9C,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAE7D,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,MAAM,CAAC,GAAG,CACR,CAAC,GAAG,UAAU,sBAAsB,EAAE,GAAG,UAAU,mBAAmB,CAAC,EACvE,kBAAkB,CACnB,CAAC;IAEF,0FAA0F;IAC1F,sDAAsD;IACtD,MAAM,gBAAgB,GAAG;QACvB,iBAAiB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAClD,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;KACtE,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,SAAS,EAAE,GAAG,gBAAgB,CAAC,CAAC;IAEzD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAa,EAAE,GAAa,EAAE,IAAkB;IACxF,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK;QAC9D,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACtB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/deviceFlow.d.ts

@@ -30,12 +30,8 @@ export declare class DevicePollThrottle {
     constructor(now?: () => number);
     check(deviceCode: string): void;
 }
-/**
- * Marks token endpoint posts, and adds `interval` to the device authorization response. The
- * provider is mounted at the issuer's path, so paths here are relative to it, and the
- * library's router ignores case.
- */
-export declare function deviceFlowMiddleware(tokenPath?: string): (ctx: KoaContextWithOIDC, next: () => Promise<unknown>) => Promise<void>;
+/** Adds `interval` to the device authorization response. */
+export declare function deviceFlowMiddleware(): (ctx: KoaContextWithOIDC, next: () => Promise<unknown>) => Promise<void>;
 /** The device verification pages (RFC 8628 section 3.3), rendered by the hosted UI. */
 export declare function createDevicePages(render: HostedPageRenderer, client: OidcApiClient): {
     charset: "base-20";

package/dist/deviceFlow.js

@@ -78,17 +78,9 @@ export class DevicePollThrottle {
         });
     }
 }
-/**
- * Marks token endpoint posts, and adds `interval` to the device authorization response. The
- * provider is mounted at the issuer's path, so paths here are relative to it, and the
- * library's router ignores case.
- */
-export function deviceFlowMiddleware(tokenPath = '/token') {
+/** Adds `interval` to the device authorization response. */
+export function deviceFlowMiddleware() {
     return async (ctx, next) => {
-        const context = currentRequestContext();
-        if (context && ctx.method === 'POST' && ctx.path.toLowerCase() === tokenPath) {
-            context.tokenRequest = true;
-        }
         await next();
         if (ctx.oidc?.route === 'device_authorization' &&
             ctx.status === 200 &&

package/dist/deviceFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"deviceFlow.js","sourceRoot":"","sources":["../src/deviceFlow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAIvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAEhF,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAkB,CAAC;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,OAA0C;IACtE,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA2C;IAC5E,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,6DAA6D,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,kBAAkB;IACpB,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC7D,IAAI,CAAe;IAE5B,YAAY,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAC9C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,uBAAuB,GAAG,IAAI;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,8EAA8E;YAC9E,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,iBAAiB;oBAAE,MAAM;gBAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,sEAAsE;QACtE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE;gBAC1B,EAAE,EAAE,GAAG;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,4BAA4B;aACvD,CAAC,CAAC;YACH,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE;YAC1B,EAAE,EAAE,GAAG;YACP,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,4BAA4B;SACzD,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAS,GAAG,QAAQ;IACvD,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7E,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,IACE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,sBAAsB;YAC1C,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,GAAG,CAAC,IAAI;YACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAC5B,CAAC;YACA,GAAG,CAAC,IAAgC,CAAC,QAAQ,GAAG,4BAA4B,CAAC;QAChF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,GAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAgB;IACpE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,MAAyE;IAC3F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,MAAM,YAAY,GAA2B;IAC3C,aAAa,EAAE,WAAW;IAC1B,YAAY,EAAE,SAAS;IACvB,gBAAgB,EAAE,cAAc;IAChC,YAAY,EAAE,SAAS;IACvB,WAAW,EAAE,SAAS;CACvB,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,MAAqB;IACjF,KAAK,UAAU,KAAK,CAClB,IAAmD,EACnD,QAA4B;QAE5B,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,IAAI;gBACJ,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uDAAuD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,mBAAmB,CACvB,GAAuB,EACvB,KAAa,EACb,GAAwB,EACxB,GAAmC;YAEnC,IAAI,GAAG,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACjC,MAAM,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpF,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAC5C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACrC,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;gBAC/B,KAAK;aACN,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CACzB,GAAuB,EACvB,KAAa,EACb,KAA4D,EAC5D,WAAoB,EACpB,QAAgB;YAEhB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC;YAC1D,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAC5C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACrC,QAAQ;gBACR,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;gBAC7B,MAAM,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;aAC1E,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAuB;YACzC,MAAM,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deviceFlow.js","sourceRoot":"","sources":["../src/deviceFlow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAIvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAEhF,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAkB,CAAC;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,OAA0C;IACtE,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA2C;IAC5E,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,6DAA6D,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,kBAAkB;IACpB,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC7D,IAAI,CAAe;IAE5B,YAAY,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAC9C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,uBAAuB,GAAG,IAAI;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,8EAA8E;YAC9E,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,iBAAiB;oBAAE,MAAM;gBAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,sEAAsE;QACtE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE;gBAC1B,EAAE,EAAE,GAAG;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,4BAA4B;aACvD,CAAC,CAAC;YACH,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE;YAC1B,EAAE,EAAE,GAAG;YACP,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,4BAA4B;SACzD,CAAC,CAAC;IACL,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB;IAClC,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,MAAM,IAAI,EAAE,CAAC;QACb,IACE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,sBAAsB;YAC1C,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,GAAG,CAAC,IAAI;YACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAC5B,CAAC;YACA,GAAG,CAAC,IAAgC,CAAC,QAAQ,GAAG,4BAA4B,CAAC;QAChF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,GAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAgB;IACpE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,MAAyE;IAC3F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,MAAM,YAAY,GAA2B;IAC3C,aAAa,EAAE,WAAW;IAC1B,YAAY,EAAE,SAAS;IACvB,gBAAgB,EAAE,cAAc;IAChC,YAAY,EAAE,SAAS;IACvB,WAAW,EAAE,SAAS;CACvB,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,MAAqB;IACjF,KAAK,UAAU,KAAK,CAClB,IAAmD,EACnD,QAA4B;QAE5B,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,IAAI;gBACJ,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uDAAuD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,mBAAmB,CACvB,GAAuB,EACvB,KAAa,EACb,GAAwB,EACxB,GAAmC;YAEnC,IAAI,GAAG,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACjC,MAAM,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpF,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAC5C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACrC,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;gBAC/B,KAAK;aACN,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CACzB,GAAuB,EACvB,KAAa,EACb,KAA4D,EAC5D,WAAoB,EACpB,QAAgB;YAEhB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC;YAC1D,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAC5C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACrC,QAAQ;gBACR,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;gBAC7B,MAAM,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;aAC1E,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAuB;YACzC,MAAM,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/env.d.ts

@@ -7,10 +7,7 @@ export declare const EnvSchema: z.ZodObject<{
     SEAMLESS_JWKS_KID: z.ZodOptional<z.ZodString>;
     SEAMLESS_COOKIE_SECRET: z.ZodString;
     OIDC_COOKIE_KEYS: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>, z.ZodArray<z.ZodString>>;
-    TRUST_PROXY: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
-        true: "true";
-        false: "false";
-    }>>, z.ZodTransform<boolean, "true" | "false">>;
+    TRUST_PROXY: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number | false | string[], string>>;
 }, z.core.$strip>;
 export type Env = z.infer<typeof EnvSchema>;
 export declare function parseEnv(source?: NodeJS.ProcessEnv): Env;

package/dist/env.js

@@ -3,12 +3,54 @@
  * Licensed under the Apache License, Version 2.0
  * See LICENSE file in the project root for full license information
  */
+import { isIP } from 'node:net';
 import { z } from 'zod';
 const SECRET_MIN_LENGTH = 32;
-const booleanString = z
-    .enum(['true', 'false'])
+// Express's own names for the private ranges, which `trust proxy` accepts in a list.
+const NAMED_RANGES = new Set(['loopback', 'linklocal', 'uniquelocal']);
+function isProxyAddress(entry) {
+    if (NAMED_RANGES.has(entry)) {
+        return true;
+    }
+    const [address = '', prefix, extra] = entry.split('/');
+    const version = isIP(address);
+    if (version === 0 || extra !== undefined) {
+        return false;
+    }
+    if (prefix === undefined) {
+        return true;
+    }
+    const bits = Number(prefix);
+    return /^\d+$/.test(prefix) && bits <= (version === 4 ? 32 : 128);
+}
+/**
+ * Express's `trust proxy`: `false`, the number of proxies in front of this service, or the
+ * addresses and subnets of the ones it trusts. `true` keeps its old meaning of one proxy.
+ */
+const trustProxy = z
+    .string()
     .default('false')
-    .transform((value) => value === 'true');
+    .transform((value, ctx) => {
+    const trimmed = value.trim();
+    if (trimmed === '' || trimmed === 'false' || trimmed === '0') {
+        return false;
+    }
+    if (trimmed === 'true') {
+        return 1;
+    }
+    if (/^\d+$/.test(trimmed)) {
+        return Number(trimmed);
+    }
+    const entries = trimmed
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    if (entries.length === 0 || !entries.every(isProxyAddress)) {
+        ctx.addIssue({ code: 'custom', message: 'expected a hop count or addresses and subnets' });
+        return z.NEVER;
+    }
+    return entries;
+});
 export const EnvSchema = z.object({
     PORT: z.coerce.number().int().min(1).max(65535).default(5314),
     SEAMLESS_API_URL: z.url(),
@@ -23,7 +65,7 @@ export const EnvSchema = z.object({
         .map((key) => key.trim())
         .filter(Boolean))
         .pipe(z.array(z.string().min(SECRET_MIN_LENGTH)).min(1)),
-    TRUST_PROXY: booleanString,
+    TRUST_PROXY: trustProxy,
 });
 export function parseEnv(source = process.env) {
     const parsed = EnvSchema.safeParse(source);

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,aAAa,GAAG,CAAC;KACpB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvB,OAAO,CAAC,OAAO,CAAC;KAChB,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACzD,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK;SACF,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,OAAO,CAAC,CACnB;SACA,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,WAAW,EAAE,aAAa;CAC3B,CAAC,CAAC;AAIH,MAAM,UAAU,QAAQ,CAAC,SAA4B,OAAO,CAAC,GAAG;IAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,qFAAqF;AACrF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAEvE,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,OAAO,CAAC,OAAO,CAAC;KAChB,SAAS,CAAC,CAAC,KAAK,EAAE,GAAG,EAA6B,EAAE;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACzD,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK;SACF,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,OAAO,CAAC,CACnB;SACA,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,WAAW,EAAE,UAAU;CACxB,CAAC,CAAC;AAIH,MAAM,UAAU,QAAQ,CAAC,SAA4B,OAAO,CAAC,GAAG;IAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/errorPage.d.ts

@@ -0,0 +1,10 @@
+import type { Configuration, KoaContextWithOIDC } from 'oidc-provider';
+import type { HostedPageRenderer } from './hostedPages.js';
+type ErrorOut = Parameters<NonNullable<Configuration['renderError']>>[1];
+/**
+ * The page for an error the provider cannot send back to the app: an unknown client, an
+ * unregistered redirect_uri or post_logout_redirect_uri, a broken id_token_hint. Only the
+ * code and description go to the page, as data the UI renders as text. `state` is left out.
+ */
+export declare function createErrorPage(render: HostedPageRenderer): (ctx: KoaContextWithOIDC, out: ErrorOut) => Promise<void>;
+export {};

package/dist/errorPage.js

@@ -0,0 +1,24 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+/**
+ * The page for an error the provider cannot send back to the app: an unknown client, an
+ * unregistered redirect_uri or post_logout_redirect_uri, a broken id_token_hint. Only the
+ * code and description go to the page, as data the UI renders as text. `state` is left out.
+ */
+export function createErrorPage(render) {
+    return async (ctx, out) => {
+        const error = typeof out.error === 'string' ? out.error : 'server_error';
+        // The library's own text for an unexposed error is "oops! something went wrong".
+        const description = error !== 'server_error' && typeof out.error_description === 'string'
+            ? out.error_description
+            : 'Something went wrong on our side.';
+        const { html, headers } = await render({ view: 'error', error, description });
+        ctx.set(headers);
+        ctx.type = 'html';
+        ctx.body = html;
+    };
+}
+//# sourceMappingURL=errorPage.js.map

package/dist/errorPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorPage.js","sourceRoot":"","sources":["../src/errorPage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,OAAO,KAAK,EAAE,GAAuB,EAAE,GAAa,EAAiB,EAAE;QACrE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC;QACzE,iFAAiF;QACjF,MAAM,WAAW,GACf,KAAK,KAAK,cAAc,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YACnE,CAAC,CAAC,GAAG,CAAC,iBAAiB;YACvB,CAAC,CAAC,mCAAmC,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/hostedPages.d.ts

@@ -37,6 +37,7 @@ export declare function brandingFor(appName: string, hostedUi: HostedUi | undefi
 export type HostedPageData = Record<string, unknown> & {
     view: string;
 };
+export declare function pageTitle(appName: string, page?: HostedPageData): string;
 export declare function renderIndex(template: string, branding: HostedBranding, nonce: string, style?: BrandingStyle, page?: HostedPageData): string;
 export interface RenderedPage {
     html: string;

package/dist/hostedPages.js

@@ -7,6 +7,7 @@ import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import express from 'express';
+import { brandingContrastProblems } from './brandingContrast.js';
 /**
  * Paths the SPA renders. The adapter's bundled screens (`@seamless-auth/react` AuthRoutes)
  * own most of them, and the API builds magic link and recovery URLs from some.
@@ -104,10 +105,23 @@ export function brandingFor(appName, hostedUi) {
         ...(hostedUi?.logoUrl ? { logoUrl: hostedUi.logoUrl } : {}),
     };
 }
+/** WCAG 2.4.2: a page the provider renders is titled for what it does, not "Sign in". */
+const PAGE_TITLES = {
+    logout: (app) => `Sign out of ${app}`,
+    signed_out: (app) => `Signed out of ${app}`,
+    device_input: (app) => `Sign in on a device with ${app}`,
+    device_confirm: (app) => `Sign in on a device with ${app}`,
+    device_done: (app) => `Device signed in with ${app}`,
+    error: (app) => `${app}: we could not continue`,
+};
+export function pageTitle(appName, page) {
+    const title = page ? PAGE_TITLES[page.view] : undefined;
+    return title ? title(appName) : `Sign in to ${appName}`;
+}
 export function renderIndex(template, branding, nonce, style, page) {
     const head = [
         `<meta name="seamless-csp-nonce" content="${nonce}" />`,
-        `<title>Sign in to ${escapeHtml(branding.appName)}</title>`,
+        `<title>${escapeHtml(pageTitle(branding.appName, page))}</title>`,
         `<script type="application/json" id="seamless-hosted">${inlineJson(branding)}</script>`,
         ...(page
             ? [`<script type="application/json" id="seamless-page">${inlineJson(page)}</script>`]
@@ -135,8 +149,17 @@ export function createHostedPageRenderer(options) {
     if (!template.includes(HEAD_PLACEHOLDER)) {
         throw new Error(`${options.uiDir}/index.html has no ${HEAD_PLACEHOLDER} placeholder`);
     }
+    let checkedColors;
     return async (page, formActions) => {
         const config = await options.configCache.get();
+        const colors = JSON.stringify(config.hostedUi?.colors ?? null);
+        if (colors !== checkedColors) {
+            checkedColors = colors;
+            const problems = brandingContrastProblems(config.hostedUi);
+            if (problems.length > 0) {
+                console.warn(`[oidc-provider] hosted_ui colors fall below WCAG 2.2 AA contrast on the hosted pages: ${problems.join('; ')}`);
+            }
+        }
         const nonce = randomBytes(16).toString('base64');
         const branding = brandingFor(config.appName, config.hostedUi);
         return {

package/dist/hostedPages.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostedPages.js","sourceRoot":"","sources":["../src/hostedPages.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,OAAwB,MAAM,SAAS,CAAC;AAI/C;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,GAAG;IACH,mBAAmB;IACnB,QAAQ;IACR,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;CACV,CAAC;AAEX,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAOhD,MAAM,eAAe,GAAG;IACtB,OAAO,EAAE,0BAA0B;IACnC,SAAS,EAAE,6BAA6B;IACxC,UAAU,EAAE,6BAA6B;IACzC,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,wBAAwB;CACvB,CAAC;AAQX,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,OAAgB,EAChB,cAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,uFAAuF;IACvF,4DAA4D;IAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,2BAA2B,KAAK,GAAG;QACnC,uBAAuB,UAAU,EAAE;QACnC,iBAAiB;QACjB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB,WAAW,EAAE;QAClC,wBAAwB;QACxB,iBAAiB;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAA8B;IAC1D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAmC,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE;QAC3D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAA8B;IACzE,OAAO;QACL,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,OAAO;QACrC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAKD,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,QAAwB,EACxB,KAAa,EACb,KAAqB,EACrB,IAAqB;IAErB,MAAM,IAAI,GAAG;QACX,4CAA4C,KAAK,MAAM;QACvD,qBAAqB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU;QAC3D,wDAAwD,UAAU,CAAC,QAAQ,CAAC,WAAW;QACvF,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,sDAAsD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU;aAC/F;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,OAAgB,EAAE,WAA+B;IACnF,OAAO;QACL,yBAAyB,EAAE,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;QAC7E,eAAe,EAAE,UAAU;QAC3B,4BAA4B,EAAE,aAAa;QAC3C,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,sBAAsB,gBAAgB,cAAc,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;YAClF,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;SAC3D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA2B,EAC3B,SAA6B,wBAAwB,CAAC,OAAO,CAAC;IAE9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACR,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;QAC5C,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,EAAE;aACL,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC;aACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"hostedPages.js","sourceRoot":"","sources":["../src/hostedPages.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,OAAwB,MAAM,SAAS,CAAC;AAE/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGjE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,GAAG;IACH,mBAAmB;IACnB,QAAQ;IACR,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;CACV,CAAC;AAEX,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAOhD,MAAM,eAAe,GAAG;IACtB,OAAO,EAAE,0BAA0B;IACnC,SAAS,EAAE,6BAA6B;IACxC,UAAU,EAAE,6BAA6B;IACzC,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,wBAAwB;CACvB,CAAC;AAQX,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,OAAgB,EAChB,cAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,uFAAuF;IACvF,4DAA4D;IAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,2BAA2B,KAAK,GAAG;QACnC,uBAAuB,UAAU,EAAE;QACnC,iBAAiB;QACjB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB,WAAW,EAAE;QAClC,wBAAwB;QACxB,iBAAiB;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAA8B;IAC1D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAmC,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE;QAC3D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAA8B;IACzE,OAAO;QACL,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,OAAO;QACrC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,WAAW,GAAgD;IAC/D,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,GAAG,EAAE;IACrC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,GAAG,EAAE;IAC3C,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,4BAA4B,GAAG,EAAE;IACxD,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,4BAA4B,GAAG,EAAE;IAC1D,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,GAAG,EAAE;IACpD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,yBAAyB;CAChD,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAAqB;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,QAAwB,EACxB,KAAa,EACb,KAAqB,EACrB,IAAqB;IAErB,MAAM,IAAI,GAAG;QACX,4CAA4C,KAAK,MAAM;QACvD,UAAU,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,UAAU;QACjE,wDAAwD,UAAU,CAAC,QAAQ,CAAC,WAAW;QACvF,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,sDAAsD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU;aAC/F;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,OAAgB,EAAE,WAA+B;IACnF,OAAO;QACL,yBAAyB,EAAE,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;QAC7E,eAAe,EAAE,UAAU;QAC3B,4BAA4B,EAAE,aAAa;QAC3C,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,sBAAsB,gBAAgB,cAAc,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,aAAiC,CAAC;IACtC,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,aAAa,GAAG,MAAM,CAAC;YACvB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CACV,yFAAyF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;YAClF,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;SAC3D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA2B,EAC3B,SAA6B,wBAAwB,CAAC,OAAO,CAAC;IAE9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACR,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;QAC5C,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,EAAE;aACL,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC;aACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -16,5 +16,5 @@ export { createSameOriginGuard } from './originGuard.js';
 export { buildProviderConfiguration, loadExistingGrant, PROVIDER_COOKIE_NAMES, } from './providerConfig.js';
 export type { EdgeRequestContext } from './requestContext.js';
 export { adoptSession, bindSession, currentRequestContext, runWithRequestContext, } from './requestContext.js';
-export { ApiSigningKey, classifyToken, signingKeysFrom, UnsignableTokenError, } from './signingKey.js';
+export { ApiSigningKey, classifyToken, SIGNING_KEY_REFRESH_MS, SigningKeyRing, signingKeysFrom, UnsignableTokenError, } from './signingKey.js';
 export { checkApiCompatibility } from './startup.js';