@shware/security 2.5.3 → 3.0.0

package/dist/oauth2/provider/common.cjs

@@ -1,120 +1,97 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth2/provider/common.ts
-var common_exports = {};
-__export(common_exports, {
-  createAuthorizationUri: () => createAuthorizationUri,
-  exchangeAuthorizationCode: () => exchangeAuthorizationCode,
-  refreshAccessToken: () => refreshAccessToken,
-  revokeToken: () => revokeToken,
-  verifyIdToken: () => verifyIdToken
-});
-module.exports = __toCommonJS(common_exports);
-var import_jose = require("jose");
-var import_error = require("../error.cjs");
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_oauth2_error = require("../error.cjs");
+let jose = require("jose");
+//#region src/oauth2/provider/common.ts
 function createAuthorizationUri(options) {
-  const url = new URL(options.authorizationUri);
-  url.searchParams.append("response_type", "code");
-  url.searchParams.append("client_id", options.clientId);
-  url.searchParams.append("state", options.state);
-  url.searchParams.append("scope", options.scope.join(" "));
-  url.searchParams.append("redirect_uri", options.redirectUri);
-  if (options.pkce) {
-    url.searchParams.append("code_challenge_method", options.pkce.code_challenge_method);
-    url.searchParams.append("code_challenge", options.pkce.code_challenge);
-  }
-  return url;
+	const url = new URL(options.authorizationUri);
+	url.searchParams.append("response_type", "code");
+	url.searchParams.append("client_id", options.clientId);
+	url.searchParams.append("state", options.state);
+	url.searchParams.append("scope", options.scope.join(" "));
+	url.searchParams.append("redirect_uri", options.redirectUri);
+	if (options.pkce) {
+		url.searchParams.append("code_challenge_method", options.pkce.code_challenge_method);
+		url.searchParams.append("code_challenge", options.pkce.code_challenge);
+	}
+	return url;
 }
 async function exchangeAuthorizationCode(params) {
-  const body = new URLSearchParams();
-  body.append("code", params.code);
-  body.append("redirect_uri", params.redirectUri);
-  body.append("grant_type", "authorization_code");
-  if (params.pkce) body.append("code_verifier", params.pkce.code_verifier);
-  const headers = {
-    Accept: "application/json",
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (params.authentication === "basic") {
-    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
-    headers.Authorization = `Basic ${token}`;
-  } else {
-    body.append("client_id", params.clientId);
-    body.append("client_secret", params.clientSecret);
-  }
-  return fetch(params.tokenUri, { method: "POST", headers, body });
+	const body = new URLSearchParams();
+	body.append("code", params.code);
+	body.append("redirect_uri", params.redirectUri);
+	body.append("grant_type", "authorization_code");
+	if (params.pkce) body.append("code_verifier", params.pkce.code_verifier);
+	const headers = {
+		Accept: "application/json",
+		"Content-Type": "application/x-www-form-urlencoded"
+	};
+	if (params.authentication === "basic") headers.Authorization = `Basic ${Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64")}`;
+	else {
+		body.append("client_id", params.clientId);
+		body.append("client_secret", params.clientSecret);
+	}
+	return fetch(params.tokenUri, {
+		method: "POST",
+		headers,
+		body
+	});
 }
 async function refreshAccessToken(params) {
-  const body = new URLSearchParams();
-  body.append("grant_type", "refresh_token");
-  body.append("refresh_token", params.refreshToken);
-  const headers = {
-    Accept: "application/json",
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (params.authentication === "basic") {
-    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
-    headers.Authorization = `Basic ${token}`;
-  } else {
-    body.append("client_id", params.clientId);
-    body.append("client_secret", params.clientSecret);
-  }
-  return fetch(params.tokenUri, { method: "POST", headers, body });
+	const body = new URLSearchParams();
+	body.append("grant_type", "refresh_token");
+	body.append("refresh_token", params.refreshToken);
+	const headers = {
+		Accept: "application/json",
+		"Content-Type": "application/x-www-form-urlencoded"
+	};
+	if (params.authentication === "basic") headers.Authorization = `Basic ${Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64")}`;
+	else {
+		body.append("client_id", params.clientId);
+		body.append("client_secret", params.clientSecret);
+	}
+	return fetch(params.tokenUri, {
+		method: "POST",
+		headers,
+		body
+	});
 }
 async function revokeToken(params) {
-  const body = new URLSearchParams();
-  body.append("token", params.token);
-  const headers = {
-    Accept: "application/json",
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (params.authentication === "basic") {
-    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
-    headers.Authorization = `Basic ${token}`;
-  } else {
-    body.append("client_id", params.clientId);
-    body.append("client_secret", params.clientSecret);
-  }
-  const response = await fetch(params.tokenRevokeUri, { method: "POST", headers, body });
-  if (!response.ok) {
-    const error = await response.json();
-    console.error("Refresh token error:", error);
-    throw new import_error.OAuth2Error(response.status, "invalid_request", "Failed to revoke token");
-  }
+	const body = new URLSearchParams();
+	body.append("token", params.token);
+	const headers = {
+		Accept: "application/json",
+		"Content-Type": "application/x-www-form-urlencoded"
+	};
+	if (params.authentication === "basic") headers.Authorization = `Basic ${Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64")}`;
+	else {
+		body.append("client_id", params.clientId);
+		body.append("client_secret", params.clientSecret);
+	}
+	const response = await fetch(params.tokenRevokeUri, {
+		method: "POST",
+		headers,
+		body
+	});
+	if (!response.ok) {
+		const error = await response.json();
+		console.error("Refresh token error:", error);
+		throw new require_oauth2_error.OAuth2Error(response.status, "invalid_request", "Failed to revoke token");
+	}
 }
 async function verifyIdToken(idToken, jwkSetUri) {
-  try {
-    const jwks = (0, import_jose.createRemoteJWKSet)(new URL(jwkSetUri));
-    const { payload } = await (0, import_jose.jwtVerify)(idToken, jwks);
-    return payload;
-  } catch {
-    console.error("Failed to verify id_token");
-    throw new import_error.OAuth2Error(400, "invalid_request", "Failed to verify id_token");
-  }
+	try {
+		const { payload } = await (0, jose.jwtVerify)(idToken, (0, jose.createRemoteJWKSet)(new URL(jwkSetUri)));
+		return payload;
+	} catch {
+		console.error("Failed to verify id_token");
+		throw new require_oauth2_error.OAuth2Error(400, "invalid_request", "Failed to verify id_token");
+	}
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createAuthorizationUri,
-  exchangeAuthorizationCode,
-  refreshAccessToken,
-  revokeToken,
-  verifyIdToken
-});
+//#endregion
+exports.createAuthorizationUri = createAuthorizationUri;
+exports.exchangeAuthorizationCode = exchangeAuthorizationCode;
+exports.refreshAccessToken = refreshAccessToken;
+exports.revokeToken = revokeToken;
+exports.verifyIdToken = verifyIdToken;
+
 //# sourceMappingURL=common.cjs.map

package/dist/oauth2/provider/common.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport async function verifyIdToken<T>(idToken: string, jwkSetUri: string) {\n  try {\n    const jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    const { payload } = await jwtVerify(idToken, jwks);\n    return payload as T;\n  } catch {\n    console.error('Failed to verify id_token');\n    throw new OAuth2Error(400, 'invalid_request', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA8C;AAC9C,mBAA4B;AAGrB,SAAS,uBAAuB,SAOpC;AACD,QAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;AAC5C,MAAI,aAAa,OAAO,iBAAiB,MAAM;AAC/C,MAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;AACrD,MAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC9C,MAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;AACxD,MAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;AAC3D,MAAI,QAAQ,MAAM;AAChB,QAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;AACnF,QAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;AAAA,EACvE;AACA,SAAO;AACT;AAEA,eAAsB,0BACpB,QAIA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,QAAQ,OAAO,IAAI;AAC/B,OAAK,OAAO,gBAAgB,OAAO,WAAW;AAC9C,OAAK,OAAO,cAAc,oBAAoB;AAC9C,MAAI,OAAO,KAAM,MAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;AAEvE,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AACA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,SAAO,MAAM,OAAO,UAAU,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,cAAc,eAAe;AACzC,OAAK,OAAO,iBAAiB,OAAO,YAAY;AAEhD,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,SAAO,MAAM,OAAO,UAAU,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;AAC3D,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,SAAS,OAAO,KAAK;AACjC,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,QAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AACrF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAM,IAAI,yBAAY,SAAS,QAAQ,mBAAmB,wBAAwB;AAAA,EACpF;AACF;AAEA,eAAsB,cAAiB,SAAiB,WAAmB;AACzE,MAAI;AACF,UAAM,WAAO,gCAAmB,IAAI,IAAI,SAAS,CAAC;AAClD,UAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,SAAS,IAAI;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,YAAQ,MAAM,2BAA2B;AACzC,UAAM,IAAI,yBAAY,KAAK,mBAAmB,2BAA2B;AAAA,EAC3E;AACF;","names":[]}
+{"version":3,"file":"common.cjs","names":["OAuth2Error"],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport async function verifyIdToken<T>(idToken: string, jwkSetUri: string) {\n  try {\n    const jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    const { payload } = await jwtVerify(idToken, jwks);\n    return payload as T;\n  } catch {\n    console.error('Failed to verify id_token');\n    throw new OAuth2Error(400, 'invalid_request', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;;AAIA,SAAgB,uBAAuB,SAOpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,cAAc,CAAC,CAAC,SAAS,QAC3C;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAClD;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,cAAc,CAAC,CAAC,SAAS,QAC3C;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAClD;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,cAAc,CAAC,CAAC,SAAS,QAC3C;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAClD;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,wBAAwB,KAAK;EAC3C,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;AAEA,eAAsB,cAAiB,SAAiB,WAAmB;CACzE,IAAI;EAEF,MAAM,EAAE,YAAY,OAAA,GAAA,KAAA,UAAA,CAAgB,UAAA,GAAA,KAAA,mBAAA,CADJ,IAAI,IAAI,SAAS,CACD,CAAC;EACjD,OAAO;CACT,QAAQ;EACN,QAAQ,MAAM,2BAA2B;EACzC,MAAM,IAAIA,qBAAAA,YAAY,KAAK,mBAAmB,2BAA2B;CAC3E;AACF"}

package/dist/oauth2/provider/common.d.cts

@@ -1,29 +1,30 @@
-import { PkceParameters, ExchangeCodeParams, RefreshTokenParams } from '../types.cjs';
-
+import { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from "../types.cjs";
+//#region src/oauth2/provider/common.d.ts
 declare function createAuthorizationUri(options: {
-    state: string;
-    scope: string[];
-    clientId: string;
-    redirectUri: string;
-    authorizationUri: string;
-    pkce?: Omit<PkceParameters, 'code_verifier'>;
+  state: string;
+  scope: string[];
+  clientId: string;
+  redirectUri: string;
+  authorizationUri: string;
+  pkce?: Omit<PkceParameters, 'code_verifier'>;
 }): URL;
 declare function exchangeAuthorizationCode(params: ExchangeCodeParams & {
-    tokenUri: string;
-    authentication?: 'basic' | 'post';
+  tokenUri: string;
+  authentication?: 'basic' | 'post';
 }): Promise<Response>;
 declare function refreshAccessToken(params: RefreshTokenParams & {
-    tokenUri: string;
-    authentication?: 'basic' | 'post';
+  tokenUri: string;
+  authentication?: 'basic' | 'post';
 }): Promise<Response>;
 interface RevokeTokenParams {
-    token: string;
-    clientId: string;
-    clientSecret: string;
-    tokenRevokeUri: string;
-    authentication?: 'basic' | 'post';
+  token: string;
+  clientId: string;
+  clientSecret: string;
+  tokenRevokeUri: string;
+  authentication?: 'basic' | 'post';
 }
 declare function revokeToken(params: RevokeTokenParams): Promise<void>;
 declare function verifyIdToken<T>(idToken: string, jwkSetUri: string): Promise<T>;
-
+//#endregion
 export { createAuthorizationUri, exchangeAuthorizationCode, refreshAccessToken, revokeToken, verifyIdToken };
+//# sourceMappingURL=common.d.cts.map

package/dist/oauth2/provider/common.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.cts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";;iBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;IACb;iBAcqB,0BACpB,QAAQ;EACN;EACA;IACD,QAAA;iBAuBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;iBAGoB,YAAY,QAAQ,oBAAiB;iBAwBrC,cAAc,GAAG,iBAAiB,oBAAiB,QAAA"}

package/dist/oauth2/provider/common.d.mts

@@ -0,0 +1,30 @@
+import { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from "../types.mjs";
+//#region src/oauth2/provider/common.d.ts
+declare function createAuthorizationUri(options: {
+  state: string;
+  scope: string[];
+  clientId: string;
+  redirectUri: string;
+  authorizationUri: string;
+  pkce?: Omit<PkceParameters, 'code_verifier'>;
+}): URL;
+declare function exchangeAuthorizationCode(params: ExchangeCodeParams & {
+  tokenUri: string;
+  authentication?: 'basic' | 'post';
+}): Promise<Response>;
+declare function refreshAccessToken(params: RefreshTokenParams & {
+  tokenUri: string;
+  authentication?: 'basic' | 'post';
+}): Promise<Response>;
+interface RevokeTokenParams {
+  token: string;
+  clientId: string;
+  clientSecret: string;
+  tokenRevokeUri: string;
+  authentication?: 'basic' | 'post';
+}
+declare function revokeToken(params: RevokeTokenParams): Promise<void>;
+declare function verifyIdToken<T>(idToken: string, jwkSetUri: string): Promise<T>;
+//#endregion
+export { createAuthorizationUri, exchangeAuthorizationCode, refreshAccessToken, revokeToken, verifyIdToken };
+//# sourceMappingURL=common.d.mts.map

package/dist/oauth2/provider/common.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.mts","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"mappings":";;iBAIgB,uBAAuB;EACrC;EACA;EACA;EACA;EACA;EACA,OAAO,KAAK;IACb;iBAcqB,0BACpB,QAAQ;EACN;EACA;IACD,QAAA;iBAuBmB,mBACpB,QAAQ;EACN;EACA;IACD,QAAA;UAsBO;EACR;EACA;EACA;EACA;EACA;;iBAGoB,YAAY,QAAQ,oBAAiB;iBAwBrC,cAAc,GAAG,iBAAiB,oBAAiB,QAAA"}

package/dist/oauth2/provider/common.mjs

@@ -1,91 +1,92 @@
-// src/oauth2/provider/common.ts
-import { createRemoteJWKSet, jwtVerify } from "jose";
 import { OAuth2Error } from "../error.mjs";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+//#region src/oauth2/provider/common.ts
 function createAuthorizationUri(options) {
-  const url = new URL(options.authorizationUri);
-  url.searchParams.append("response_type", "code");
-  url.searchParams.append("client_id", options.clientId);
-  url.searchParams.append("state", options.state);
-  url.searchParams.append("scope", options.scope.join(" "));
-  url.searchParams.append("redirect_uri", options.redirectUri);
-  if (options.pkce) {
-    url.searchParams.append("code_challenge_method", options.pkce.code_challenge_method);
-    url.searchParams.append("code_challenge", options.pkce.code_challenge);
-  }
-  return url;
+	const url = new URL(options.authorizationUri);
+	url.searchParams.append("response_type", "code");
+	url.searchParams.append("client_id", options.clientId);
+	url.searchParams.append("state", options.state);
+	url.searchParams.append("scope", options.scope.join(" "));
+	url.searchParams.append("redirect_uri", options.redirectUri);
+	if (options.pkce) {
+		url.searchParams.append("code_challenge_method", options.pkce.code_challenge_method);
+		url.searchParams.append("code_challenge", options.pkce.code_challenge);
+	}
+	return url;
 }
 async function exchangeAuthorizationCode(params) {
-  const body = new URLSearchParams();
-  body.append("code", params.code);
-  body.append("redirect_uri", params.redirectUri);
-  body.append("grant_type", "authorization_code");
-  if (params.pkce) body.append("code_verifier", params.pkce.code_verifier);
-  const headers = {
-    Accept: "application/json",
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (params.authentication === "basic") {
-    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
-    headers.Authorization = `Basic ${token}`;
-  } else {
-    body.append("client_id", params.clientId);
-    body.append("client_secret", params.clientSecret);
-  }
-  return fetch(params.tokenUri, { method: "POST", headers, body });
+	const body = new URLSearchParams();
+	body.append("code", params.code);
+	body.append("redirect_uri", params.redirectUri);
+	body.append("grant_type", "authorization_code");
+	if (params.pkce) body.append("code_verifier", params.pkce.code_verifier);
+	const headers = {
+		Accept: "application/json",
+		"Content-Type": "application/x-www-form-urlencoded"
+	};
+	if (params.authentication === "basic") headers.Authorization = `Basic ${Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64")}`;
+	else {
+		body.append("client_id", params.clientId);
+		body.append("client_secret", params.clientSecret);
+	}
+	return fetch(params.tokenUri, {
+		method: "POST",
+		headers,
+		body
+	});
 }
 async function refreshAccessToken(params) {
-  const body = new URLSearchParams();
-  body.append("grant_type", "refresh_token");
-  body.append("refresh_token", params.refreshToken);
-  const headers = {
-    Accept: "application/json",
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (params.authentication === "basic") {
-    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
-    headers.Authorization = `Basic ${token}`;
-  } else {
-    body.append("client_id", params.clientId);
-    body.append("client_secret", params.clientSecret);
-  }
-  return fetch(params.tokenUri, { method: "POST", headers, body });
+	const body = new URLSearchParams();
+	body.append("grant_type", "refresh_token");
+	body.append("refresh_token", params.refreshToken);
+	const headers = {
+		Accept: "application/json",
+		"Content-Type": "application/x-www-form-urlencoded"
+	};
+	if (params.authentication === "basic") headers.Authorization = `Basic ${Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64")}`;
+	else {
+		body.append("client_id", params.clientId);
+		body.append("client_secret", params.clientSecret);
+	}
+	return fetch(params.tokenUri, {
+		method: "POST",
+		headers,
+		body
+	});
 }
 async function revokeToken(params) {
-  const body = new URLSearchParams();
-  body.append("token", params.token);
-  const headers = {
-    Accept: "application/json",
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (params.authentication === "basic") {
-    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64");
-    headers.Authorization = `Basic ${token}`;
-  } else {
-    body.append("client_id", params.clientId);
-    body.append("client_secret", params.clientSecret);
-  }
-  const response = await fetch(params.tokenRevokeUri, { method: "POST", headers, body });
-  if (!response.ok) {
-    const error = await response.json();
-    console.error("Refresh token error:", error);
-    throw new OAuth2Error(response.status, "invalid_request", "Failed to revoke token");
-  }
+	const body = new URLSearchParams();
+	body.append("token", params.token);
+	const headers = {
+		Accept: "application/json",
+		"Content-Type": "application/x-www-form-urlencoded"
+	};
+	if (params.authentication === "basic") headers.Authorization = `Basic ${Buffer.from(`${params.clientId}:${params.clientSecret}`).toString("base64")}`;
+	else {
+		body.append("client_id", params.clientId);
+		body.append("client_secret", params.clientSecret);
+	}
+	const response = await fetch(params.tokenRevokeUri, {
+		method: "POST",
+		headers,
+		body
+	});
+	if (!response.ok) {
+		const error = await response.json();
+		console.error("Refresh token error:", error);
+		throw new OAuth2Error(response.status, "invalid_request", "Failed to revoke token");
+	}
 }
 async function verifyIdToken(idToken, jwkSetUri) {
-  try {
-    const jwks = createRemoteJWKSet(new URL(jwkSetUri));
-    const { payload } = await jwtVerify(idToken, jwks);
-    return payload;
-  } catch {
-    console.error("Failed to verify id_token");
-    throw new OAuth2Error(400, "invalid_request", "Failed to verify id_token");
-  }
+	try {
+		const { payload } = await jwtVerify(idToken, createRemoteJWKSet(new URL(jwkSetUri)));
+		return payload;
+	} catch {
+		console.error("Failed to verify id_token");
+		throw new OAuth2Error(400, "invalid_request", "Failed to verify id_token");
+	}
 }
-export {
-  createAuthorizationUri,
-  exchangeAuthorizationCode,
-  refreshAccessToken,
-  revokeToken,
-  verifyIdToken
-};
+//#endregion
+export { createAuthorizationUri, exchangeAuthorizationCode, refreshAccessToken, revokeToken, verifyIdToken };
+
 //# sourceMappingURL=common.mjs.map

package/dist/oauth2/provider/common.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport async function verifyIdToken<T>(idToken: string, jwkSetUri: string) {\n  try {\n    const jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    const { payload } = await jwtVerify(idToken, jwks);\n    return payload as T;\n  } catch {\n    console.error('Failed to verify id_token');\n    throw new OAuth2Error(400, 'invalid_request', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";AAAA,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,mBAAmB;AAGrB,SAAS,uBAAuB,SAOpC;AACD,QAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;AAC5C,MAAI,aAAa,OAAO,iBAAiB,MAAM;AAC/C,MAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;AACrD,MAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC9C,MAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;AACxD,MAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;AAC3D,MAAI,QAAQ,MAAM;AAChB,QAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;AACnF,QAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;AAAA,EACvE;AACA,SAAO;AACT;AAEA,eAAsB,0BACpB,QAIA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,QAAQ,OAAO,IAAI;AAC/B,OAAK,OAAO,gBAAgB,OAAO,WAAW;AAC9C,OAAK,OAAO,cAAc,oBAAoB;AAC9C,MAAI,OAAO,KAAM,MAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;AAEvE,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AACA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,SAAO,MAAM,OAAO,UAAU,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,cAAc,eAAe;AACzC,OAAK,OAAO,iBAAiB,OAAO,YAAY;AAEhD,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,SAAO,MAAM,OAAO,UAAU,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;AAC3D,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,OAAO,SAAS,OAAO,KAAK;AACjC,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO,mBAAmB,SAAS;AACrC,UAAM,QAAQ,OAAO,KAAK,GAAG,OAAO,QAAQ,IAAI,OAAO,YAAY,EAAE,EAAE,SAAS,QAAQ;AACxF,YAAQ,gBAAgB,SAAS,KAAK;AAAA,EACxC,OAAO;AACL,SAAK,OAAO,aAAa,OAAO,QAAQ;AACxC,SAAK,OAAO,iBAAiB,OAAO,YAAY;AAAA,EAClD;AAEA,QAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AACrF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;AAAA,EACpF;AACF;AAEA,eAAsB,cAAiB,SAAiB,WAAmB;AACzE,MAAI;AACF,UAAM,OAAO,mBAAmB,IAAI,IAAI,SAAS,CAAC;AAClD,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,SAAS,IAAI;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,YAAQ,MAAM,2BAA2B;AACzC,UAAM,IAAI,YAAY,KAAK,mBAAmB,2BAA2B;AAAA,EAC3E;AACF;","names":[]}
+{"version":3,"file":"common.mjs","names":[],"sources":["../../../src/oauth2/provider/common.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from 'jose';\nimport { OAuth2Error } from '../error';\nimport type { ExchangeCodeParams, PkceParameters, RefreshTokenParams } from '../types';\n\nexport function createAuthorizationUri(options: {\n  state: string;\n  scope: string[];\n  clientId: string;\n  redirectUri: string;\n  authorizationUri: string;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}) {\n  const url = new URL(options.authorizationUri);\n  url.searchParams.append('response_type', 'code');\n  url.searchParams.append('client_id', options.clientId);\n  url.searchParams.append('state', options.state);\n  url.searchParams.append('scope', options.scope.join(' '));\n  url.searchParams.append('redirect_uri', options.redirectUri);\n  if (options.pkce) {\n    url.searchParams.append('code_challenge_method', options.pkce.code_challenge_method);\n    url.searchParams.append('code_challenge', options.pkce.code_challenge);\n  }\n  return url;\n}\n\nexport async function exchangeAuthorizationCode(\n  params: ExchangeCodeParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('code', params.code);\n  body.append('redirect_uri', params.redirectUri);\n  body.append('grant_type', 'authorization_code');\n  if (params.pkce) body.append('code_verifier', params.pkce.code_verifier);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\nexport async function refreshAccessToken(\n  params: RefreshTokenParams & {\n    tokenUri: string;\n    authentication?: 'basic' | 'post';\n  }\n) {\n  const body = new URLSearchParams();\n  body.append('grant_type', 'refresh_token');\n  body.append('refresh_token', params.refreshToken);\n\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  return fetch(params.tokenUri, { method: 'POST', headers, body });\n}\n\ninterface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n  tokenRevokeUri: string;\n  authentication?: 'basic' | 'post';\n}\n\nexport async function revokeToken(params: RevokeTokenParams) {\n  const body = new URLSearchParams();\n  body.append('token', params.token);\n  const headers: Record<string, string> = {\n    Accept: 'application/json',\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  if (params.authentication === 'basic') {\n    const token = Buffer.from(`${params.clientId}:${params.clientSecret}`).toString('base64');\n    headers.Authorization = `Basic ${token}`;\n  } else {\n    body.append('client_id', params.clientId);\n    body.append('client_secret', params.clientSecret);\n  }\n\n  const response = await fetch(params.tokenRevokeUri, { method: 'POST', headers, body });\n  if (!response.ok) {\n    const error = await response.json();\n    console.error('Refresh token error:', error);\n    throw new OAuth2Error(response.status, 'invalid_request', 'Failed to revoke token');\n  }\n}\n\nexport async function verifyIdToken<T>(idToken: string, jwkSetUri: string) {\n  try {\n    const jwks = createRemoteJWKSet(new URL(jwkSetUri));\n    const { payload } = await jwtVerify(idToken, jwks);\n    return payload as T;\n  } catch {\n    console.error('Failed to verify id_token');\n    throw new OAuth2Error(400, 'invalid_request', 'Failed to verify id_token');\n  }\n}\n"],"mappings":";;;AAIA,SAAgB,uBAAuB,SAOpC;CACD,MAAM,MAAM,IAAI,IAAI,QAAQ,gBAAgB;CAC5C,IAAI,aAAa,OAAO,iBAAiB,MAAM;CAC/C,IAAI,aAAa,OAAO,aAAa,QAAQ,QAAQ;CACrD,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;CAC9C,IAAI,aAAa,OAAO,SAAS,QAAQ,MAAM,KAAK,GAAG,CAAC;CACxD,IAAI,aAAa,OAAO,gBAAgB,QAAQ,WAAW;CAC3D,IAAI,QAAQ,MAAM;EAChB,IAAI,aAAa,OAAO,yBAAyB,QAAQ,KAAK,qBAAqB;EACnF,IAAI,aAAa,OAAO,kBAAkB,QAAQ,KAAK,cAAc;CACvE;CACA,OAAO;AACT;AAEA,eAAsB,0BACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,QAAQ,OAAO,IAAI;CAC/B,KAAK,OAAO,gBAAgB,OAAO,WAAW;CAC9C,KAAK,OAAO,cAAc,oBAAoB;CAC9C,IAAI,OAAO,MAAM,KAAK,OAAO,iBAAiB,OAAO,KAAK,aAAa;CAEvE,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CACA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,cAAc,CAAC,CAAC,SAAS,QAC3C;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAClD;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAEA,eAAsB,mBACpB,QAIA;CACA,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,cAAc,eAAe;CACzC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAEhD,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,cAAc,CAAC,CAAC,SAAS,QAC3C;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAClD;CAEA,OAAO,MAAM,OAAO,UAAU;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;AACjE;AAUA,eAAsB,YAAY,QAA2B;CAC3D,MAAM,OAAO,IAAI,gBAAgB;CACjC,KAAK,OAAO,SAAS,OAAO,KAAK;CACjC,MAAM,UAAkC;EACtC,QAAQ;EACR,gBAAgB;CAClB;CAEA,IAAI,OAAO,mBAAmB,SAE5B,QAAQ,gBAAgB,SADV,OAAO,KAAK,GAAG,OAAO,SAAS,GAAG,OAAO,cAAc,CAAC,CAAC,SAAS,QAC3C;MAChC;EACL,KAAK,OAAO,aAAa,OAAO,QAAQ;EACxC,KAAK,OAAO,iBAAiB,OAAO,YAAY;CAClD;CAEA,MAAM,WAAW,MAAM,MAAM,OAAO,gBAAgB;EAAE,QAAQ;EAAQ;EAAS;CAAK,CAAC;CACrF,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,QAAQ,MAAM,SAAS,KAAK;EAClC,QAAQ,MAAM,wBAAwB,KAAK;EAC3C,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,wBAAwB;CACpF;AACF;AAEA,eAAsB,cAAiB,SAAiB,WAAmB;CACzE,IAAI;EAEF,MAAM,EAAE,YAAY,MAAM,UAAU,SADvB,mBAAmB,IAAI,IAAI,SAAS,CACD,CAAC;EACjD,OAAO;CACT,QAAQ;EACN,QAAQ,MAAM,2BAA2B;EACzC,MAAM,IAAI,YAAY,KAAK,mBAAmB,2BAA2B;CAC3E;AACF"}