@tdacorp/identity-client 0.1.0 → 0.2.0

package/README.md

@@ -160,6 +160,23 @@ const tokens = await exchangeAuthorizationCode({
 })
 ```
 
+If your relying party is registered on the identity platform for
+`client_secret_post` rather than the default `client_secret_basic`, pass
+`clientAuthMethod` so credentials are sent the way the token endpoint
+actually expects them:
+
+```ts
+const tokens = await exchangeAuthorizationCode({
+  issuer: 'https://identity.tdacorp.in',
+  clientId: process.env.IDENTITY_CLIENT_ID!,
+  clientSecret: process.env.IDENTITY_CLIENT_SECRET!,
+  clientAuthMethod: 'client_secret_post',
+  code,
+  redirectUri,
+  codeVerifier,
+})
+```
+
 Refresh (RFC 6749 §6), returning a classified outcome instead of throwing —
 so a transient infrastructure failure is never mistaken for a rejected
 refresh token:
@@ -269,12 +286,6 @@ instead.
 
 ## Limitations in v0.1
 
-- **Only `client_secret_basic` client authentication is supported** for the
-  authorization-code exchange (`exchangeAuthorizationCode` sends an HTTP
-  Basic `Authorization` header when a `clientSecret` is given). A relying
-  party configured on TDACorp Identity for `client_secret_post` cannot use
-  `exchangeAuthorizationCode` as-is today — the token endpoint will reject
-  the request.
 - **No built-in fallback for an `indeterminate` `permits()` result.** That is
   `@tdacorp/identity-authz`'s concern, not this package's, but worth knowing
   up front since most integrations hit both together — see that package's

package/dist/{chunk-VJSMXIZB.js → chunk-6WGVTO7C.js}

@@ -135,13 +135,16 @@ function toTokenSet(body) {
     scope: body.scope
   };
 }
-async function postTokenRequest(tokenEndpoint, clientId, clientSecret, params) {
+async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
   const body = new URLSearchParams(params);
   const headers = {
     "Content-Type": "application/x-www-form-urlencoded",
     Accept: "application/json"
   };
-  if (clientSecret) {
+  if (clientSecret && clientAuthMethod === "client_secret_post") {
+    body.set("client_id", clientId);
+    body.set("client_secret", clientSecret);
+  } else if (clientSecret) {
     headers.Authorization = `Basic ${btoa(`${clientId}:${clientSecret}`)}`;
   } else {
     body.set("client_id", clientId);
@@ -153,12 +156,18 @@ async function readTokenResponseBody(response) {
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscovery(options.issuer);
-  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
-    grant_type: "authorization_code",
-    code: options.code,
-    redirect_uri: options.redirectUri,
-    code_verifier: options.codeVerifier
-  });
+  const response = await postTokenRequest(
+    discovery.token_endpoint,
+    options.clientId,
+    options.clientSecret,
+    options.clientAuthMethod ?? "client_secret_basic",
+    {
+      grant_type: "authorization_code",
+      code: options.code,
+      redirect_uri: options.redirectUri,
+      code_verifier: options.codeVerifier
+    }
+  );
   const body = await readTokenResponseBody(response);
   if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
     throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });
@@ -167,10 +176,16 @@ async function exchangeAuthorizationCode(options) {
 }
 async function clientCredentialsGrant(options) {
   const discovery = await fetchDiscovery(options.issuer);
-  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
-    grant_type: "client_credentials",
-    ...options.scope ? { scope: options.scope } : {}
-  });
+  const response = await postTokenRequest(
+    discovery.token_endpoint,
+    options.clientId,
+    options.clientSecret,
+    options.clientAuthMethod ?? "client_secret_basic",
+    {
+      grant_type: "client_credentials",
+      ...options.scope ? { scope: options.scope } : {}
+    }
+  );
   const body = await readTokenResponseBody(response);
   if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
     throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });
@@ -185,10 +200,16 @@ async function refreshTokens(options) {
   let response;
   try {
     const discovery = await fetchDiscovery(options.issuer);
-    response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
-      grant_type: "refresh_token",
-      refresh_token: options.refreshToken
-    });
+    response = await postTokenRequest(
+      discovery.token_endpoint,
+      options.clientId,
+      options.clientSecret,
+      options.clientAuthMethod ?? "client_secret_basic",
+      {
+        grant_type: "refresh_token",
+        refresh_token: options.refreshToken
+      }
+    );
   } catch (error) {
     return { outcome: "transient", error };
   }

package/dist/index.cjs

@@ -172,13 +172,16 @@ function toTokenSet(body) {
     scope: body.scope
   };
 }
-async function postTokenRequest(tokenEndpoint, clientId, clientSecret, params) {
+async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
   const body = new URLSearchParams(params);
   const headers = {
     "Content-Type": "application/x-www-form-urlencoded",
     Accept: "application/json"
   };
-  if (clientSecret) {
+  if (clientSecret && clientAuthMethod === "client_secret_post") {
+    body.set("client_id", clientId);
+    body.set("client_secret", clientSecret);
+  } else if (clientSecret) {
     headers.Authorization = `Basic ${btoa(`${clientId}:${clientSecret}`)}`;
   } else {
     body.set("client_id", clientId);
@@ -190,12 +193,18 @@ async function readTokenResponseBody(response) {
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscovery(options.issuer);
-  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
-    grant_type: "authorization_code",
-    code: options.code,
-    redirect_uri: options.redirectUri,
-    code_verifier: options.codeVerifier
-  });
+  const response = await postTokenRequest(
+    discovery.token_endpoint,
+    options.clientId,
+    options.clientSecret,
+    options.clientAuthMethod ?? "client_secret_basic",
+    {
+      grant_type: "authorization_code",
+      code: options.code,
+      redirect_uri: options.redirectUri,
+      code_verifier: options.codeVerifier
+    }
+  );
   const body = await readTokenResponseBody(response);
   if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
     throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });
@@ -204,10 +213,16 @@ async function exchangeAuthorizationCode(options) {
 }
 async function clientCredentialsGrant(options) {
   const discovery = await fetchDiscovery(options.issuer);
-  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
-    grant_type: "client_credentials",
-    ...options.scope ? { scope: options.scope } : {}
-  });
+  const response = await postTokenRequest(
+    discovery.token_endpoint,
+    options.clientId,
+    options.clientSecret,
+    options.clientAuthMethod ?? "client_secret_basic",
+    {
+      grant_type: "client_credentials",
+      ...options.scope ? { scope: options.scope } : {}
+    }
+  );
   const body = await readTokenResponseBody(response);
   if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
     throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });
@@ -222,10 +237,16 @@ async function refreshTokens(options) {
   let response;
   try {
     const discovery = await fetchDiscovery(options.issuer);
-    response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
-      grant_type: "refresh_token",
-      refresh_token: options.refreshToken
-    });
+    response = await postTokenRequest(
+      discovery.token_endpoint,
+      options.clientId,
+      options.clientSecret,
+      options.clientAuthMethod ?? "client_secret_basic",
+      {
+        grant_type: "refresh_token",
+        refresh_token: options.refreshToken
+      }
+    );
   } catch (error) {
     return { outcome: "transient", error };
   }

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { createRemoteJWKSet } from 'jose';
-export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenRefreshOutcome, b as TokenRequestError, c as TokenSet, d as TokenVerificationError, e as TokenVerificationErrorCode, V as VerificationResult, f as VerifiedAccessToken, g as VerifyTokenOptions, h as clientCredentialsGrant, i as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, j as verifyIdToken } from './verify-BiGhwaIz.cjs';
+export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-DTUDjR4v.cjs';
 import '@tdacorp/identity-authz';
 
 /**

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { createRemoteJWKSet } from 'jose';
-export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenRefreshOutcome, b as TokenRequestError, c as TokenSet, d as TokenVerificationError, e as TokenVerificationErrorCode, V as VerificationResult, f as VerifiedAccessToken, g as VerifyTokenOptions, h as clientCredentialsGrant, i as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, j as verifyIdToken } from './verify-BiGhwaIz.js';
+export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-DTUDjR4v.js';
 import '@tdacorp/identity-authz';
 
 /**

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   refreshTokens,
   verifyAccessToken,
   verifyIdToken
-} from "./chunk-VJSMXIZB.js";
+} from "./chunk-6WGVTO7C.js";
 export {
   CLOCK_SKEW_TOLERANCE_SECONDS,
   TokenRequestError,

package/dist/next.cjs

@@ -163,13 +163,16 @@ function toTokenSet(body) {
     scope: body.scope
   };
 }
-async function postTokenRequest(tokenEndpoint, clientId, clientSecret, params) {
+async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
   const body = new URLSearchParams(params);
   const headers = {
     "Content-Type": "application/x-www-form-urlencoded",
     Accept: "application/json"
   };
-  if (clientSecret) {
+  if (clientSecret && clientAuthMethod === "client_secret_post") {
+    body.set("client_id", clientId);
+    body.set("client_secret", clientSecret);
+  } else if (clientSecret) {
     headers.Authorization = `Basic ${btoa(`${clientId}:${clientSecret}`)}`;
   } else {
     body.set("client_id", clientId);
@@ -181,12 +184,18 @@ async function readTokenResponseBody(response) {
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscovery(options.issuer);
-  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
-    grant_type: "authorization_code",
-    code: options.code,
-    redirect_uri: options.redirectUri,
-    code_verifier: options.codeVerifier
-  });
+  const response = await postTokenRequest(
+    discovery.token_endpoint,
+    options.clientId,
+    options.clientSecret,
+    options.clientAuthMethod ?? "client_secret_basic",
+    {
+      grant_type: "authorization_code",
+      code: options.code,
+      redirect_uri: options.redirectUri,
+      code_verifier: options.codeVerifier
+    }
+  );
   const body = await readTokenResponseBody(response);
   if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
     throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });

package/dist/next.d.cts

@@ -1,5 +1,5 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { c as TokenSet, I as IdTokenClaims } from './verify-BiGhwaIz.cjs';
+import { d as TokenSet, I as IdTokenClaims } from './verify-DTUDjR4v.cjs';
 import { SealSecret } from './sealed.cjs';
 import '@tdacorp/identity-authz';
 import 'jose';

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { c as TokenSet, I as IdTokenClaims } from './verify-BiGhwaIz.js';
+import { d as TokenSet, I as IdTokenClaims } from './verify-DTUDjR4v.js';
 import { SealSecret } from './sealed.js';
 import '@tdacorp/identity-authz';
 import 'jose';

package/dist/next.js

@@ -5,7 +5,7 @@ import {
   generateCodeVerifier,
   generateState,
   verifyIdToken
-} from "./chunk-VJSMXIZB.js";
+} from "./chunk-6WGVTO7C.js";
 import {
   seal,
   unseal

package/dist/{verify-BiGhwaIz.d.cts → verify-DTUDjR4v.d.cts}

@@ -31,6 +31,10 @@ declare class TokenRequestError extends Error {
         errorDescription?: string;
     });
 }
+/** The token endpoint client-authentication methods this package supports --
+ *  see RFC 6749 §2.3.1 and OIDC Discovery 1.0's
+ *  `token_endpoint_auth_methods_supported`. */
+type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post';
 /** Options for `exchangeAuthorizationCode`. */
 interface AuthorizationCodeExchangeOptions {
     /** The identity server's issuer URL, used to look up `token_endpoint`. */
@@ -46,6 +50,16 @@ interface AuthorizationCodeExchangeOptions {
     /** The PKCE verifier generated (and kept) alongside the code challenge
      *  sent on the authorization request; see `generateCodeVerifier`. */
     codeVerifier: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, which is this package's original and only
+     *  behavior -- omitting this field changes nothing for an existing caller.
+     *  Set it to `'client_secret_post'` if the relying party is registered on
+     *  the identity platform for that method instead: sending Basic auth to a
+     *  `client_secret_post`-only client gets `invalid_client` back, since the
+     *  token endpoint never receives credentials in the form it expects. An
+     *  issuer's OIDC discovery document's `token_endpoint_auth_methods_supported`
+     *  says which methods it actually accepts. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
 }
 /** RFC 6749 §4.1.3 / RFC 7636 §4.5: exchanges an authorization code for a
  *  token set. Throws `TokenRequestError` on any non-success response. */
@@ -60,6 +74,16 @@ interface ClientCredentialsGrantOptions {
     clientSecret: string;
     /** Space-separated scopes to request for the resulting token. */
     scope?: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, which is this package's original and only
+     *  behavior -- omitting this field changes nothing for an existing caller.
+     *  Set it to `'client_secret_post'` if the relying party is registered on
+     *  the identity platform for that method instead: sending Basic auth to a
+     *  `client_secret_post`-only client gets `invalid_client` back, since the
+     *  token endpoint never receives credentials in the form it expects. An
+     *  issuer's OIDC discovery document's `token_endpoint_auth_methods_supported`
+     *  says which methods it actually accepts. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
 }
 /** RFC 6749 §4.4: mints a token with no end user, for service-to-service
  *  calls. Always confidential -- `clientSecret` is required, not optional,
@@ -75,6 +99,16 @@ interface RefreshTokensOptions {
     clientSecret?: string;
     /** The refresh token to redeem. */
     refreshToken: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, which is this package's original and only
+     *  behavior -- omitting this field changes nothing for an existing caller.
+     *  Set it to `'client_secret_post'` if the relying party is registered on
+     *  the identity platform for that method instead: sending Basic auth to a
+     *  `client_secret_post`-only client gets `invalid_client` back, since the
+     *  token endpoint never receives credentials in the form it expects. An
+     *  issuer's OIDC discovery document's `token_endpoint_auth_methods_supported`
+     *  says which methods it actually accepts. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
 }
 type TokenRefreshOutcome = {
     outcome: 'success';
@@ -303,4 +337,4 @@ declare function verifyIdToken(idToken: string, options: VerifyTokenOptions): Pr
  *  contract as `verifyIdToken`. */
 declare function verifyAccessToken(accessToken: string, options: VerifyTokenOptions): Promise<VerificationResult<VerifiedAccessToken>>;
 
-export { type AuthorizationCodeExchangeOptions as A, CLOCK_SKEW_TOLERANCE_SECONDS as C, type IdTokenClaims as I, type RefreshTokensOptions as R, type TokenRefreshOutcome as T, type VerificationResult as V, type ClientCredentialsGrantOptions as a, TokenRequestError as b, type TokenSet as c, type TokenVerificationError as d, type TokenVerificationErrorCode as e, type VerifiedAccessToken as f, type VerifyTokenOptions as g, clientCredentialsGrant as h, exchangeAuthorizationCode as i, verifyIdToken as j, refreshTokens as r, verifyAccessToken as v };
+export { type AuthorizationCodeExchangeOptions as A, CLOCK_SKEW_TOLERANCE_SECONDS as C, type IdTokenClaims as I, type RefreshTokensOptions as R, type TokenEndpointAuthMethod as T, type VerificationResult as V, type ClientCredentialsGrantOptions as a, type TokenRefreshOutcome as b, TokenRequestError as c, type TokenSet as d, type TokenVerificationError as e, type TokenVerificationErrorCode as f, type VerifiedAccessToken as g, type VerifyTokenOptions as h, clientCredentialsGrant as i, exchangeAuthorizationCode as j, verifyIdToken as k, refreshTokens as r, verifyAccessToken as v };

package/dist/{verify-BiGhwaIz.d.ts → verify-DTUDjR4v.d.ts}

@@ -31,6 +31,10 @@ declare class TokenRequestError extends Error {
         errorDescription?: string;
     });
 }
+/** The token endpoint client-authentication methods this package supports --
+ *  see RFC 6749 §2.3.1 and OIDC Discovery 1.0's
+ *  `token_endpoint_auth_methods_supported`. */
+type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post';
 /** Options for `exchangeAuthorizationCode`. */
 interface AuthorizationCodeExchangeOptions {
     /** The identity server's issuer URL, used to look up `token_endpoint`. */
@@ -46,6 +50,16 @@ interface AuthorizationCodeExchangeOptions {
     /** The PKCE verifier generated (and kept) alongside the code challenge
      *  sent on the authorization request; see `generateCodeVerifier`. */
     codeVerifier: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, which is this package's original and only
+     *  behavior -- omitting this field changes nothing for an existing caller.
+     *  Set it to `'client_secret_post'` if the relying party is registered on
+     *  the identity platform for that method instead: sending Basic auth to a
+     *  `client_secret_post`-only client gets `invalid_client` back, since the
+     *  token endpoint never receives credentials in the form it expects. An
+     *  issuer's OIDC discovery document's `token_endpoint_auth_methods_supported`
+     *  says which methods it actually accepts. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
 }
 /** RFC 6749 §4.1.3 / RFC 7636 §4.5: exchanges an authorization code for a
  *  token set. Throws `TokenRequestError` on any non-success response. */
@@ -60,6 +74,16 @@ interface ClientCredentialsGrantOptions {
     clientSecret: string;
     /** Space-separated scopes to request for the resulting token. */
     scope?: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, which is this package's original and only
+     *  behavior -- omitting this field changes nothing for an existing caller.
+     *  Set it to `'client_secret_post'` if the relying party is registered on
+     *  the identity platform for that method instead: sending Basic auth to a
+     *  `client_secret_post`-only client gets `invalid_client` back, since the
+     *  token endpoint never receives credentials in the form it expects. An
+     *  issuer's OIDC discovery document's `token_endpoint_auth_methods_supported`
+     *  says which methods it actually accepts. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
 }
 /** RFC 6749 §4.4: mints a token with no end user, for service-to-service
  *  calls. Always confidential -- `clientSecret` is required, not optional,
@@ -75,6 +99,16 @@ interface RefreshTokensOptions {
     clientSecret?: string;
     /** The refresh token to redeem. */
     refreshToken: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, which is this package's original and only
+     *  behavior -- omitting this field changes nothing for an existing caller.
+     *  Set it to `'client_secret_post'` if the relying party is registered on
+     *  the identity platform for that method instead: sending Basic auth to a
+     *  `client_secret_post`-only client gets `invalid_client` back, since the
+     *  token endpoint never receives credentials in the form it expects. An
+     *  issuer's OIDC discovery document's `token_endpoint_auth_methods_supported`
+     *  says which methods it actually accepts. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
 }
 type TokenRefreshOutcome = {
     outcome: 'success';
@@ -303,4 +337,4 @@ declare function verifyIdToken(idToken: string, options: VerifyTokenOptions): Pr
  *  contract as `verifyIdToken`. */
 declare function verifyAccessToken(accessToken: string, options: VerifyTokenOptions): Promise<VerificationResult<VerifiedAccessToken>>;
 
-export { type AuthorizationCodeExchangeOptions as A, CLOCK_SKEW_TOLERANCE_SECONDS as C, type IdTokenClaims as I, type RefreshTokensOptions as R, type TokenRefreshOutcome as T, type VerificationResult as V, type ClientCredentialsGrantOptions as a, TokenRequestError as b, type TokenSet as c, type TokenVerificationError as d, type TokenVerificationErrorCode as e, type VerifiedAccessToken as f, type VerifyTokenOptions as g, clientCredentialsGrant as h, exchangeAuthorizationCode as i, verifyIdToken as j, refreshTokens as r, verifyAccessToken as v };
+export { type AuthorizationCodeExchangeOptions as A, CLOCK_SKEW_TOLERANCE_SECONDS as C, type IdTokenClaims as I, type RefreshTokensOptions as R, type TokenEndpointAuthMethod as T, type VerificationResult as V, type ClientCredentialsGrantOptions as a, type TokenRefreshOutcome as b, TokenRequestError as c, type TokenSet as d, type TokenVerificationError as e, type TokenVerificationErrorCode as f, type VerifiedAccessToken as g, type VerifyTokenOptions as h, clientCredentialsGrant as i, exchangeAuthorizationCode as j, verifyIdToken as k, refreshTokens as r, verifyAccessToken as v };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdacorp/identity-client",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "OIDC relying-party client for TDACorp Identity: discovery, PKCE, token exchange, token verification and Next.js route helpers.",
   "license": "MIT",
   "bugs": {
@@ -50,17 +50,12 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
-  },
   "files": [
     "dist"
   ],
   "dependencies": {
-    "@tdacorp/identity-authz": "workspace:*",
-    "jose": "^6.2.9"
+    "jose": "^6.2.9",
+    "@tdacorp/identity-authz": "^0.2.0"
   },
   "peerDependencies": {
     "next": ">=14"
@@ -71,10 +66,15 @@
     }
   },
   "devDependencies": {
-    "@tdacorp/typescript-config": "workspace:*",
     "next": "^16.3.2",
     "tsup": "^8.5.1",
     "typescript": "^5.7.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.11",
+    "@tdacorp/typescript-config": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
   }
-}
+}