@spine-event-engine/auth 2.0.0-snapshot.26 → 2.0.0-snapshot.28

package/dist/oidc/persistent-flow-store.js

@@ -0,0 +1,413 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+var _a;
+import { Time } from "@spine-event-engine/core/time";
+import { OidcLoginGrantSchema, OidcLoginTransactionSchema, } from "@spine-event-engine/proto/auth";
+import { ColumnTypes, defaultQueryCandidateLimit, RecordColumn, RecordSpec, } from "@spine-event-engine/storage";
+import { StoragePreparations } from "@spine-event-engine/storage/provider";
+import { OidcFlowKeys } from "./records.js";
+import { SessionRecords } from "../sessions/session-record.js";
+/**
+ * Durable atomic transaction and grant transitions for one component login flow.
+ */
+export class PersistentOidcFlowStore {
+    /**
+     * Flow identity used to qualify persisted records and indexed expiry ranges.
+     */
+    flowId;
+    #transactions;
+    #grants;
+    #clock;
+    #closed = false;
+    #active = 0;
+    #drained;
+    #closing;
+    /**
+     * Binds both independent handles and their trusted maintenance clock.
+     *
+     * @param flowId Application-selected flow identity.
+     * @param transactions Transaction record handle.
+     * @param grants Grant record handle.
+     * @param clock Latest allowed maintenance cutoff.
+     */
+    constructor(flowId, transactions, grants, clock) {
+        this.flowId = flowId;
+        this.#transactions = transactions;
+        this.#grants = grants;
+        this.#clock = clock;
+    }
+    /**
+     * Acquires two handles and completes selected physical preparation.
+     *
+     * @param options Flow placement and preparation policy.
+     * @returns Ready persistent store, or an explicit non-preparing store.
+     */
+    static async create(options) {
+        if (typeof options.flowId !== "string" || options.flowId.trim().length === 0)
+            throw new TypeError("flowId must be a nonempty string.");
+        const handles = [];
+        try {
+            const transactions = options.storageFactory.createRecordStorage(context, transactionSpec, options.group, { prepareOnAccess: false });
+            handles.push(transactions);
+            const grants = options.storageFactory.createRecordStorage(context, grantSpec, options.group, {
+                prepareOnAccess: false,
+            });
+            handles.push(grants);
+            if (!transactions.atomicCompareAndSet || !grants.atomicCompareAndSet)
+                throw new Error("OIDC flow storage requires atomic compare-and-set.");
+            if (options.createMissingStructures !== false)
+                await _a.prepare(options);
+            return new _a(options.flowId, transactions, grants, options.clock ?? Time.currentTime);
+        }
+        catch (error) {
+            _a.releaseAfterFailure(handles, error);
+        }
+    }
+    /**
+     * Closes acquired handles while preserving the original construction failure.
+     *
+     * @param handles Handles acquired before failure.
+     * @param error Original acquisition or preparation failure.
+     * @returns Never returns; throws the original failure or an aggregate with close failures.
+     */
+    static releaseAfterFailure(handles, error) {
+        const failures = [error];
+        for (const handle of handles) {
+            try {
+                handle.close();
+            }
+            catch (closeError) {
+                failures.push(closeError);
+            }
+        }
+        if (failures.length > 1)
+            throw new AggregateError(failures, "OIDC flow preparation and handle cleanup failed.");
+        throw error;
+    }
+    /**
+     * Prepares both selected record families before factory completion.
+     *
+     * @param options Factory and group to prepare.
+     * @returns Completion after both structures pass compatibility checks.
+     */
+    static async prepare(options) {
+        const provider = StoragePreparations.for(options.storageFactory);
+        await provider.prepareRecord(context, transactionSpec, options.group, "create");
+        await provider.prepareRecord(context, grantSpec, options.group, "create");
+    }
+    /**
+     * @inheritdoc
+     */
+    insertTransaction(record, signal) {
+        return this.#run(async () => {
+            this.#validate(record);
+            signal?.throwIfAborted();
+            const inserted = await this.#transactions.compareAndSet(record.lookupDigest, undefined, record);
+            if (!inserted)
+                signal?.throwIfAborted();
+            return inserted;
+        });
+    }
+    /**
+     * @inheritdoc
+     */
+    readTransaction(digest, signal) {
+        return this.#read(this.#transactions, digest, signal);
+    }
+    /**
+     * @inheritdoc
+     */
+    consumeTransaction(expected, signal) {
+        return this.#consume(this.#transactions, expected, signal);
+    }
+    /**
+     * @inheritdoc
+     */
+    insertGrant(record, signal) {
+        return this.#run(async () => {
+            this.#validate(record);
+            signal?.throwIfAborted();
+            const inserted = await this.#grants.compareAndSet(record.lookupDigest, undefined, record);
+            if (!inserted)
+                signal?.throwIfAborted();
+            return inserted;
+        });
+    }
+    /**
+     * @inheritdoc
+     */
+    readGrant(digest, signal) {
+        return this.#read(this.#grants, digest, signal);
+    }
+    /**
+     * @inheritdoc
+     */
+    consumeGrant(expected, signal) {
+        return this.#consume(this.#grants, expected, signal);
+    }
+    /**
+     * @inheritdoc
+     */
+    purgeExpired(cutoff, signal) {
+        return this.#run(async () => {
+            const valid = SessionRecords.deadline(cutoff);
+            signal?.throwIfAborted();
+            if (SessionRecords.compare(valid, SessionRecords.deadline(this.#clock())) > 0)
+                throw new RangeError("Purge cutoff cannot be later than the trusted clock.");
+            const transactions = await this.#purgeFamily(this.#transactions, valid, signal);
+            const grants = await this.#purgeFamily(this.#grants, valid, signal);
+            return { transactions, grants };
+        });
+    }
+    /**
+     * @inheritdoc
+     */
+    close() {
+        if (this.#closing !== undefined)
+            return this.#closing;
+        this.#closed = true;
+        this.#closing = this.#finishClose();
+        return this.#closing;
+    }
+    /**
+     * Closes both acquired handles after admitted work settles.
+     *
+     * @returns Completion after both close attempts.
+     */
+    async #finishClose() {
+        if (this.#active > 0)
+            await new Promise((resolve) => (this.#drained = resolve));
+        const errors = [];
+        for (const handle of [this.#transactions, this.#grants]) {
+            try {
+                handle.close();
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+        if (errors.length > 0)
+            throw new AggregateError(errors, "OIDC flow handle close failed.");
+    }
+    /**
+     * Admits work until closure and drains it before handle release.
+     *
+     * @typeParam T Operation result.
+     * @param work Admitted asynchronous operation.
+     * @returns Operation result.
+     */
+    async #run(work) {
+        if (this.#closed)
+            throw new Error("OIDC flow store is closed.");
+        this.#active += 1;
+        try {
+            return await work();
+        }
+        finally {
+            this.#active -= 1;
+            if (this.#active === 0)
+                this.#drained?.();
+        }
+    }
+    /**
+     * Checks flow binding, digest shape and deadline before mutation.
+     *
+     * @param record Complete flow record.
+     */
+    #validate(record) {
+        if (record.flowId !== this.flowId || !/^[0-9a-f]{64}$/.test(record.lookupDigest))
+            throw new TypeError("OIDC flow record has an invalid identity.");
+        OidcFlowKeys.expiry(record);
+    }
+    /**
+     * Reads only a record belonging to this configured flow.
+     *
+     * @typeParam R Transaction or grant record.
+     * @param storage Selected family handle.
+     * @param digest Flow-qualified lookup digest.
+     * @param signal Optional cancellation.
+     * @returns Current record for this flow, if present.
+     */
+    #read(storage, digest, signal) {
+        return this.#run(async () => {
+            signal?.throwIfAborted();
+            const record = await storage.read(digest);
+            signal?.throwIfAborted();
+            return record?.flowId === this.flowId ? record : undefined;
+        });
+    }
+    /**
+     * Deletes only one expected complete record.
+     *
+     * @typeParam R Transaction or grant record.
+     * @param storage Selected family handle.
+     * @param expected Validated snapshot.
+     * @param signal Optional cancellation.
+     * @returns Whether this call consumed the record.
+     */
+    #consume(storage, expected, signal) {
+        return this.#run(async () => {
+            this.#validate(expected);
+            signal?.throwIfAborted();
+            const consumed = await storage.compareAndSet(expected.lookupDigest, expected, undefined);
+            if (!consumed)
+                signal?.throwIfAborted();
+            return consumed;
+        });
+    }
+    /**
+     * Drains indexed expiry groups until no candidate remains or a CAS race occurs.
+     *
+     * @typeParam R Transaction or grant record.
+     * @param storage Selected family handle.
+     * @param cutoff Trusted maximum eligible deadline.
+     * @param signal Optional cancellation.
+     * @returns Count removed by this pass.
+     */
+    async #purgeFamily(storage, cutoff, signal) {
+        let completed;
+        let removed = 0;
+        const cutoffKey = OidcFlowKeys.upperBound(this.flowId, cutoff);
+        const lowerKey = OidcFlowKeys.lowerBound(this.flowId);
+        for (;;) {
+            signal?.throwIfAborted();
+            const key = await this.#nextExpiry(storage, lowerKey, cutoffKey, completed);
+            signal?.throwIfAborted();
+            if (key === undefined)
+                return removed;
+            const [count, raced] = await this.#purgeTie(storage, key, cutoff, signal);
+            removed += count;
+            if (raced)
+                return removed;
+            completed = key;
+        }
+    }
+    /**
+     * Finds the next indexed exact expiry group.
+     *
+     * @typeParam R Transaction or grant record.
+     * @param storage Selected family handle.
+     * @param lowerKey First key in this flow's indexed range.
+     * @param cutoffKey Encoded maximum deadline.
+     * @param completed Last drained expiry group.
+     * @returns Next expiry group, if present.
+     */
+    async #nextExpiry(storage, lowerKey, cutoffKey, completed) {
+        const entries = await storage.queryPlanEntries({
+            predicate: _a.expiryPredicate(lowerKey, cutoffKey, completed),
+            order: [{ column: "expires_order", direction: "asc" }],
+            limit: 1,
+        });
+        return entries[0] === undefined ? undefined : OidcFlowKeys.orderKey(entries[0].record);
+    }
+    /**
+     * Pages one exact expiry group by immutable digest.
+     *
+     * @typeParam R Transaction or grant record.
+     * @param storage Selected family handle.
+     * @param key Encoded exact deadline.
+     * @param cutoff Trusted maximum deadline.
+     * @param signal Optional cancellation.
+     * @returns Removed count and a concurrent-change marker.
+     */
+    async #purgeTie(storage, key, cutoff, signal) {
+        let after;
+        let removed = 0;
+        let raced = false;
+        for (;;) {
+            signal?.throwIfAborted();
+            const entries = await storage.queryEntries({
+                filters: [{ column: "expires_order", value: key }],
+                sort: [{ field: "id" }],
+                limit: defaultQueryCandidateLimit,
+                ...(after === undefined ? {} : { after }),
+            });
+            signal?.throwIfAborted();
+            if (entries.length === 0)
+                return [removed, raced];
+            for (const entry of entries) {
+                const result = await this.#removeExpired(storage, entry.record, cutoff, signal);
+                if (result === true)
+                    removed += 1;
+                if (result === false)
+                    raced = true;
+            }
+            const last = entries.at(-1);
+            if (last === undefined)
+                return [removed, raced];
+            after = { id: last.id, values: [{ field: "id", value: last.id }] };
+        }
+    }
+    /**
+     * Attempts one conditional deletion without retrying a concurrent change.
+     * @typeParam R Transaction or grant record.
+     * @param storage Selected family handle.
+     * @param record Candidate snapshot from the indexed page.
+     * @param cutoff Trusted maximum eligible deadline.
+     * @param signal Optional cancellation.
+     * @returns True when removed, false after a race, or undefined if ineligible.
+     */
+    async #removeExpired(storage, record, cutoff, signal) {
+        if (record.flowId !== this.flowId ||
+            SessionRecords.compare(OidcFlowKeys.expiry(record), cutoff) > 0)
+            return undefined;
+        const removed = await storage.compareAndSet(record.lookupDigest, record, undefined);
+        signal?.throwIfAborted();
+        return removed;
+    }
+    /**
+     * Builds the indexed range for one flow and cutoff without scanning other flows.
+     *
+     * @param lowerKey Start of this flow's range.
+     * @param cutoffKey Last eligible exact expiry key.
+     * @param completed Previously drained expiry key, if any.
+     * @returns Provider-supported comparison predicate.
+     */
+    static expiryPredicate(lowerKey, cutoffKey, completed) {
+        return {
+            kind: "all",
+            predicates: [
+                {
+                    kind: "comparison",
+                    column: "expires_order",
+                    operator: "lessOrEqual",
+                    value: cutoffKey,
+                },
+                {
+                    kind: "comparison",
+                    column: "expires_order",
+                    operator: completed === undefined ? "greaterOrEqual" : "greaterThan",
+                    value: completed ?? lowerKey,
+                },
+            ],
+        };
+    }
+}
+_a = PersistentOidcFlowStore;
+const context = { name: "__AUTH_OIDC_FLOW__", multitenant: false };
+const transactionSpec = new RecordSpec({
+    recordType: OidcLoginTransactionSchema,
+    idKind: "string",
+    extractId: (record) => record.lookupDigest,
+    columns: [new RecordColumn("expires_order", ColumnTypes.fixedBytes(44), OidcFlowKeys.orderKey)],
+    indexes: [{ name: "expiry", columns: ["expires_order", "id"] }],
+});
+const grantSpec = new RecordSpec({
+    recordType: OidcLoginGrantSchema,
+    idKind: "string",
+    extractId: (record) => record.lookupDigest,
+    columns: [new RecordColumn("expires_order", ColumnTypes.fixedBytes(44), OidcFlowKeys.orderKey)],
+    indexes: [{ name: "expiry", columns: ["expires_order", "id"] }],
+});
+//# sourceMappingURL=persistent-flow-store.js.map

package/dist/oidc/persistent-flow-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistent-flow-store.js","sourceRoot":"","sources":["../../src/oidc/persistent-flow-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,WAAW,EACX,0BAA0B,EAC1B,YAAY,EACZ,UAAU,GAMX,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAG3E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAyC/D;;GAEG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACM,MAAM,CAAS;IAEf,aAAa,CAA8C;IAE3D,OAAO,CAAwC;IAE/C,MAAM,CAAkB;IAEjC,OAAO,GAAG,KAAK,CAAC;IAEhB,OAAO,GAAG,CAAC,CAAC;IAEZ,QAAQ,CAA2B;IAEnC,QAAQ,CAA4B;IAEpC;;;;;;;OAOG;IACH,YACE,MAAc,EACd,YAAyD,EACzD,MAA6C,EAC7C,KAAsB;QAEtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAkC;QACpD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAC1E,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAwC,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAC7D,OAAO,EACP,eAAe,EACf,OAAO,CAAC,KAAK,EACb,EAAE,eAAe,EAAE,KAAK,EAAE,CAC3B,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE;gBAC3F,eAAe,EAAE,KAAK;aACvB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,CAAC,YAAY,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,mBAAmB;gBAClE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,uBAAuB,KAAK,KAAK;gBAAE,MAAM,EAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9F,OAAO,IAAI,EAAuB,CAChC,OAAO,CAAC,MAAM,EACd,YAAY,EACZ,MAAM,EACN,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,CAClC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,EAAuB,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,mBAAmB,CAChC,OAAqD,EACrD,KAAc;QAEd,MAAM,QAAQ,GAAc,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrB,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,kDAAkD,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAkC;QAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChF,MAAM,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,MAA4B,EAAE,MAAoB;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CACrD,MAAM,CAAC,YAAY,EACnB,SAAS,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxC,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAc,EAAE,MAAoB;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,QAA8B,EAAE,MAAoB;QACrE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAsB,EAAE,MAAoB;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1F,IAAI,CAAC,QAAQ;gBAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxC,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAc,EAAE,MAAoB;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAwB,EAAE,MAAoB;QACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,YAAY,CACV,MAAiB,EACjB,MAAoB;QAEpB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;gBAC3E,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC,CAAC;YAC/E,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAI,IAAsB;QAClC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAkB;QAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9E,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CACH,OAAiC,EACjC,MAAc,EACd,MAAoB;QAEpB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,OAAO,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CACN,OAAiC,EACjC,QAAW,EACX,MAAoB;QAEpB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YACzF,IAAI,CAAC,QAAQ;gBAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxC,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAChB,OAAiC,EACjC,MAAiB,EACjB,MAAoB;QAEpB,IAAI,SAAiC,CAAC;QACtC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,SAAS,CAAC;YACR,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5E,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACtC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,IAAI,KAAK,CAAC;YACjB,IAAI,KAAK;gBAAE,OAAO,OAAO,CAAC;YAC1B,SAAS,GAAG,GAAG,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,WAAW,CACf,OAAiC,EACjC,QAAoB,EACpB,SAAqB,EACrB,SAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC;YAC7C,SAAS,EAAE,EAAuB,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;YAClF,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtD,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS,CACb,OAAiC,EACjC,GAAe,EACf,MAAiB,EACjB,MAAoB;QAEpB,IAAI,KAA6C,CAAC;QAClD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,SAAS,CAAC;YACR,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;gBACzC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;gBAClD,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACvB,KAAK,EAAE,0BAA0B;gBACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAChF,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC,CAAC;gBAClC,IAAI,MAAM,KAAK,KAAK;oBAAE,KAAK,GAAG,IAAI,CAAC;YACrC,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChD,KAAK,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAClB,OAAiC,EACjC,MAAS,EACT,MAAiB,EACjB,MAAoB;QAEpB,IACE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAC7B,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;YAE/D,OAAO,SAAS,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpF,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,eAAe,CAC5B,QAAoB,EACpB,SAAqB,EACrB,SAAsB;QAEtB,OAAO;YACL,IAAI,EAAE,KAAc;YACpB,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,YAAqB;oBAC3B,MAAM,EAAE,eAAe;oBACvB,QAAQ,EAAE,aAAsB;oBAChC,KAAK,EAAE,SAAS;iBACjB;gBACD;oBACE,IAAI,EAAE,YAAqB;oBAC3B,MAAM,EAAE,eAAe;oBACvB,QAAQ,EACN,SAAS,KAAK,SAAS,CAAC,CAAC,CAAE,gBAA0B,CAAC,CAAC,CAAE,aAAuB;oBAClF,KAAK,EAAE,SAAS,IAAI,QAAQ;iBAC7B;aACF;SACF,CAAC;IACJ,CAAC;CACF;;AAED,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACnF,MAAM,eAAe,GAAG,IAAI,UAAU,CAA+B;IACnE,UAAU,EAAE,0BAA0B;IACtC,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY;IAC1C,OAAO,EAAE,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC/F,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;CAChE,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,IAAI,UAAU,CAAyB;IACvD,UAAU,EAAE,oBAAoB;IAChC,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY;IAC1C,OAAO,EAAE,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC/F,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;CAChE,CAAC,CAAC"}

package/dist/oidc/records.d.ts

@@ -0,0 +1,15 @@
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { OidcLoginGrant, OidcLoginTransaction } from "@spine-event-engine/proto/auth";
+import type { AuthenticatedPrincipal } from "../index.js";
+/**
+ * Exact identity and expiry helpers for component login records.
+ */
+export declare const OidcFlowKeys: Readonly<{
+    digest(flowId: string, value: string): string;
+    lowerBound(flowId: string): Uint8Array;
+    upperBound(flowId: string, cutoff: Timestamp): Uint8Array;
+    expiry(record: OidcLoginTransaction | OidcLoginGrant): Timestamp;
+    orderKey(record: OidcLoginTransaction | OidcLoginGrant): Uint8Array;
+    principal(record: OidcLoginGrant): AuthenticatedPrincipal;
+}>;
+//# sourceMappingURL=records.d.ts.map

package/dist/oidc/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../src/oidc/records.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAG3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC;IAClC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACvC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC1D,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,GAAG,UAAU,CAAC;IACpE,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,sBAAsB,CAAC;CAC3D,CA2EC,CAAC"}

package/dist/oidc/records.js

@@ -0,0 +1,91 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import { createHash } from "node:crypto";
+import { SessionRecords } from "../sessions/session-record.js";
+/**
+ * Exact identity and expiry helpers for component login records.
+ */
+export const OidcFlowKeys = Object.freeze({
+    /**
+     * Qualifies a one-use browser value by its configured flow before hashing.
+     *
+     * @param flowId Application-selected flow identity.
+     * @param value Random state or grant value.
+     * @returns SHA-256 digest used only as the record slot.
+     */
+    digest(flowId, value) {
+        if (!flowId || !value)
+            throw new TypeError("OIDC flow and lookup value must be nonempty.");
+        return createHash("sha256")
+            .update(JSON.stringify([flowId, value]))
+            .digest("hex");
+    },
+    /**
+     * Starts the indexed expiry range for one flow.
+     *
+     * @param flowId Application-selected flow identity.
+     * @returns Digest prefix followed by the least twelve-byte deadline.
+     */
+    lowerBound(flowId) {
+        return Buffer.concat([createHash("sha256").update(flowId).digest(), Buffer.alloc(12)]);
+    },
+    /**
+     * Ends the indexed expiry range at one exact deadline.
+     *
+     * @param flowId Application-selected flow identity.
+     * @param cutoff Trusted maximum deadline.
+     * @returns Digest prefix followed by the encoded cutoff.
+     */
+    upperBound(flowId, cutoff) {
+        return Buffer.concat([
+            createHash("sha256").update(flowId).digest(),
+            SessionRecords.orderKey(cutoff),
+        ]);
+    },
+    /**
+     * Reads the required exact application deadline.
+     *
+     * @param record Complete transaction or grant.
+     * @returns Detached validated deadline.
+     */
+    expiry(record) {
+        if (record.whenExpires === undefined)
+            throw new Error("OIDC flow record has no expiry.");
+        return SessionRecords.deadline(record.whenExpires);
+    },
+    /**
+     * Encodes an exact deadline for provider index ordering.
+     *
+     * @param record Complete transaction or grant.
+     * @returns Flow digest and twelve ordered deadline bytes.
+     */
+    orderKey(record) {
+        return OidcFlowKeys.upperBound(record.flowId, OidcFlowKeys.expiry(record));
+    },
+    /**
+     * Restores the complete mapped principal without losing empty attributes.
+     *
+     * @param record Consumed application grant.
+     * @returns Detached public principal.
+     */
+    principal(record) {
+        const principal = record.principal;
+        if (principal === undefined)
+            throw new Error("OIDC grant has no mapped principal.");
+        return Object.freeze(principal.attributes === undefined
+            ? { id: principal.id }
+            : { id: principal.id, attributes: Object.freeze({ ...principal.attributes.values }) });
+    },
+});
+//# sourceMappingURL=records.js.map

package/dist/oidc/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../../src/oidc/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAG/D;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAOpB,MAAM,CAAC,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,MAAM,CAAC,MAAc,EAAE,KAAa;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;QAC3F,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;aACvC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,MAAc;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,MAAc,EAAE,MAAiB;QAC1C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE;YAC5C,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAA6C;QAClD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACzF,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,MAA6C;QACpD,OAAO,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAsB;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC,MAAM,CAClB,SAAS,CAAC,UAAU,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE;YACtB,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/providers/index.d.ts

@@ -123,16 +123,20 @@ export interface GitHubProviderOptions {
     readonly includeVerifiedPrimaryEmail?: boolean;
 }
 /**
- * Fetches and validates OpenID Connect discovery metadata before constructing an adapter.
- * @param options The trusted issuer and bounded discovery settings.
- * @returns The configured provider, or undefined when discovery cannot be trusted.
+ * Trusted issuer and optional exact metadata URL for provider discovery.
  */
-export declare function discoverOidcProvider(options: Omit<OidcProviderOptions, "authorizationEndpoint" | "tokenEndpoint" | "jwksEndpoint"> & {
+type DiscoveryOptions = Omit<OidcProviderOptions, "authorizationEndpoint" | "tokenEndpoint" | "jwksEndpoint"> & {
     /**
      * Trusted HTTPS discovery URL; defaults under the configured issuer.
      */
     readonly discoveryEndpoint?: string;
-}): Promise<ConfiguredOidcProvider | undefined>;
+};
+/**
+ * Fetches and validates OpenID Connect discovery metadata before constructing an adapter.
+ * @param options The trusted issuer and bounded discovery settings.
+ * @returns The configured provider, or undefined when discovery cannot be trusted.
+ */
+export declare function discoverOidcProvider(options: DiscoveryOptions): Promise<ConfiguredOidcProvider | undefined>;
 /**
  * Creates an OIDC authorization-code verifier from explicitly trusted metadata.
  * @param options The trusted OIDC endpoints, client credentials, and bounds.
@@ -151,4 +155,5 @@ export declare function createGoogleProvider(options: Omit<OidcProviderOptions,
  * @returns The configured GitHub provider.
  */
 export declare function createGitHubProvider(options: GitHubProviderOptions): ConfiguredOidcProvider;
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAGV,4BAA4B,EAC7B,MAAM,sBAAsB,CAAC;AAqB9B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IAEzD;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IAGrC;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,uBAAuB,GAAG,eAAe,GAAG,cAAc,CAAC,GAAG;IAG/F;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC,GACA,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CA0B7C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,sBAAsB,CAQvF;AAyLD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,IAAI,CACX,mBAAmB,EACnB,QAAQ,GAAG,uBAAuB,GAAG,eAAe,GAAG,cAAc,CACtE,GACA,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CA2B7C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,sBAAsB,CAwI3F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAGV,4BAA4B,EAC7B,MAAM,sBAAsB,CAAC;AAqB9B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IAEzD;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IAGrC;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD;AAED;;GAEG;AACH,KAAK,gBAAgB,GAAG,IAAI,CAC1B,mBAAmB,EACnB,uBAAuB,GAAG,eAAe,GAAG,cAAc,CAC3D,GAAG;IACF;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CA2B7C;AAqED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,sBAAsB,CAQvF;AAgMD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,IAAI,CACX,mBAAmB,EACnB,QAAQ,GAAG,uBAAuB,GAAG,eAAe,GAAG,cAAc,CACtE,GACA,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CA2B7C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,sBAAsB,CAwI3F"}