@tdacorp/identity-client 0.1.0

package/dist/chunk-VJSMXIZB.js

@@ -0,0 +1,320 @@
+// src/discovery.ts
+import { createRemoteJWKSet } from "jose";
+var DISCOVERY_CACHE_TTL_MS = 6e5;
+var CACHE_MAX_ENTRIES = 100;
+var discoveryCache = /* @__PURE__ */ new Map();
+var discoveryPending = /* @__PURE__ */ new Map();
+var jwksCache = /* @__PURE__ */ new Map();
+function touchLru(map, key) {
+  const value = map.get(key);
+  if (value === void 0) return;
+  map.delete(key);
+  map.set(key, value);
+}
+function setWithLruEviction(map, key, value, maxEntries) {
+  map.delete(key);
+  map.set(key, value);
+  if (map.size > maxEntries) {
+    const oldestKey = map.keys().next().value;
+    if (oldestKey !== void 0) map.delete(oldestKey);
+  }
+}
+function discoveryUrl(issuerUrl) {
+  return `${issuerUrl.replace(/\/+$/, "")}/.well-known/openid-configuration`;
+}
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "::1";
+}
+function assertHttps(url, label) {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:" && !isLoopbackHost(parsed.hostname)) {
+    throw new Error(`Discovery: ${label} "${url}" must be https (loopback hosts are the only http exception)`);
+  }
+}
+function validateDiscoveryDocument(document, issuerUrl) {
+  assertHttps(issuerUrl, "issuer");
+  assertHttps(document.jwks_uri, "jwks_uri");
+  assertHttps(document.token_endpoint, "token_endpoint");
+  if (document.issuer !== issuerUrl) {
+    throw new Error(`Discovery: document issuer "${document.issuer}" does not match the configured issuer "${issuerUrl}"`);
+  }
+  const issuerOrigin = new URL(issuerUrl).origin;
+  if (new URL(document.jwks_uri).origin !== issuerOrigin) {
+    throw new Error(`Discovery: jwks_uri "${document.jwks_uri}" is not same-origin as issuer "${issuerUrl}"`);
+  }
+  if (new URL(document.token_endpoint).origin !== issuerOrigin) {
+    throw new Error(`Discovery: token_endpoint "${document.token_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
+  }
+}
+async function fetchDiscovery(issuerUrl) {
+  const cached = discoveryCache.get(issuerUrl);
+  if (cached && cached.expiresAt > Date.now()) {
+    touchLru(discoveryCache, issuerUrl);
+    return cached.document;
+  }
+  const pending = discoveryPending.get(issuerUrl);
+  if (pending) return pending;
+  const promise = fetch(discoveryUrl(issuerUrl), { headers: { Accept: "application/json" } }).then(
+    async (response) => {
+      if (!response.ok) {
+        throw new Error(`Discovery fetch for ${issuerUrl} failed: HTTP ${response.status}`);
+      }
+      const document = await response.json();
+      validateDiscoveryDocument(document, issuerUrl);
+      return document;
+    }
+  );
+  discoveryPending.set(issuerUrl, promise);
+  try {
+    const document = await promise;
+    discoveryPending.delete(issuerUrl);
+    setWithLruEviction(discoveryCache, issuerUrl, { document, expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS }, CACHE_MAX_ENTRIES);
+    return document;
+  } catch (error) {
+    discoveryPending.delete(issuerUrl);
+    throw error;
+  }
+}
+function getRemoteJwksForUri(jwksUri) {
+  const cached = jwksCache.get(jwksUri);
+  if (cached) {
+    touchLru(jwksCache, jwksUri);
+    return cached;
+  }
+  const jwks = createRemoteJWKSet(new URL(jwksUri));
+  setWithLruEviction(jwksCache, jwksUri, jwks, CACHE_MAX_ENTRIES);
+  return jwks;
+}
+
+// src/pkce.ts
+var CODE_VERIFIER_BYTE_LENGTH = 32;
+var STATE_BYTE_LENGTH = 32;
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomBase64Url(byteLength) {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes);
+}
+function generateCodeVerifier() {
+  return randomBase64Url(CODE_VERIFIER_BYTE_LENGTH);
+}
+async function generateCodeChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64UrlEncode(new Uint8Array(digest));
+}
+function generateState() {
+  return randomBase64Url(STATE_BYTE_LENGTH);
+}
+
+// src/token.ts
+var TokenRequestError = class extends Error {
+  status;
+  error;
+  errorDescription;
+  constructor(details) {
+    super(
+      details.errorDescription ?? details.error ?? `Token request failed${details.status ? ` with HTTP ${details.status}` : ""}`
+    );
+    this.name = "TokenRequestError";
+    this.status = details.status;
+    this.error = details.error;
+    this.errorDescription = details.errorDescription;
+  }
+};
+function toTokenSet(body) {
+  return {
+    accessToken: body.access_token,
+    tokenType: body.token_type ?? "Bearer",
+    refreshToken: body.refresh_token,
+    idToken: body.id_token,
+    expiresIn: body.expires_in,
+    scope: body.scope
+  };
+}
+async function postTokenRequest(tokenEndpoint, clientId, clientSecret, params) {
+  const body = new URLSearchParams(params);
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  if (clientSecret) {
+    headers.Authorization = `Basic ${btoa(`${clientId}:${clientSecret}`)}`;
+  } else {
+    body.set("client_id", clientId);
+  }
+  return fetch(tokenEndpoint, { method: "POST", headers, body: body.toString() });
+}
+async function readTokenResponseBody(response) {
+  return await response.json().catch(() => null);
+}
+async function exchangeAuthorizationCode(options) {
+  const discovery = await fetchDiscovery(options.issuer);
+  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
+    grant_type: "authorization_code",
+    code: options.code,
+    redirect_uri: options.redirectUri,
+    code_verifier: options.codeVerifier
+  });
+  const body = await readTokenResponseBody(response);
+  if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
+    throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });
+  }
+  return toTokenSet(body);
+}
+async function clientCredentialsGrant(options) {
+  const discovery = await fetchDiscovery(options.issuer);
+  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
+    grant_type: "client_credentials",
+    ...options.scope ? { scope: options.scope } : {}
+  });
+  const body = await readTokenResponseBody(response);
+  if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
+    throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });
+  }
+  return toTokenSet(body);
+}
+var TRANSIENT_HTTP_STATUSES = /* @__PURE__ */ new Set([408, 429]);
+function isTransientStatus(status) {
+  return TRANSIENT_HTTP_STATUSES.has(status) || status >= 500;
+}
+async function refreshTokens(options) {
+  let response;
+  try {
+    const discovery = await fetchDiscovery(options.issuer);
+    response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
+      grant_type: "refresh_token",
+      refresh_token: options.refreshToken
+    });
+  } catch (error) {
+    return { outcome: "transient", error };
+  }
+  if (isTransientStatus(response.status)) {
+    return { outcome: "transient", error: new TokenRequestError({ status: response.status }) };
+  }
+  const body = await readTokenResponseBody(response);
+  if (response.ok && body && typeof body.access_token === "string") {
+    return { outcome: "success", tokens: toTokenSet(body) };
+  }
+  const tokenError = new TokenRequestError({
+    status: response.status,
+    error: body?.error,
+    errorDescription: body?.error_description
+  });
+  const isConfirmedRejection = response.status === 400 && body?.error === "invalid_grant";
+  return isConfirmedRejection ? { outcome: "terminal", error: tokenError } : { outcome: "transient", error: tokenError };
+}
+
+// src/verify.ts
+import { jwtVerify, errors as joseErrors } from "jose";
+var CLOCK_SKEW_TOLERANCE_SECONDS = 60;
+function joseErrorCode(error) {
+  return error instanceof joseErrors.JOSEError ? error.code : void 0;
+}
+function classifyJoseError(error) {
+  const code = joseErrorCode(error);
+  const message = error instanceof Error ? error.message : "Token verification failed";
+  switch (code) {
+    case "ERR_JWT_EXPIRED":
+      return { code: "expired", message };
+    case "ERR_JWT_CLAIM_VALIDATION_FAILED": {
+      const claim = error instanceof joseErrors.JWTClaimValidationFailed ? error.claim : void 0;
+      if (claim === "aud") return { code: "invalid-audience", message };
+      if (claim === "iss") return { code: "invalid-issuer", message };
+      return { code: "malformed-claims", message };
+    }
+    case "ERR_JWS_SIGNATURE_VERIFICATION_FAILED":
+    case "ERR_JWS_INVALID":
+    case "ERR_JWKS_NO_MATCHING_KEY":
+    case "ERR_JWKS_MULTIPLE_MATCHING_KEYS":
+      return { code: "invalid-signature", message };
+    case "ERR_JWKS_TIMEOUT":
+      return { code: "jwks-unavailable", message };
+    case "ERR_JWT_INVALID":
+    default:
+      return { code: "malformed-token", message };
+  }
+}
+function checkAuthorizedParty(payload, authorizedParties) {
+  const party = typeof payload.azp === "string" ? payload.azp : typeof payload.aud === "string" ? payload.aud : void 0;
+  if (party === void 0) {
+    return { code: "unauthorized-party", message: "Token has no azp claim and no single-string aud to check against authorizedParties" };
+  }
+  if (!authorizedParties.includes(party)) {
+    return { code: "unauthorized-party", message: `Token's authorized party "${party}" is not in the configured allowlist` };
+  }
+  return null;
+}
+function requireConfig(options) {
+  if (!options.issuer) throw new Error("verify: options.issuer is required");
+  if (!options.audience) throw new Error("verify: options.audience is required");
+}
+async function verifyAgainstIssuer(token, options) {
+  requireConfig(options);
+  let jwksUri;
+  try {
+    jwksUri = (await fetchDiscovery(options.issuer)).jwks_uri;
+  } catch (error) {
+    return { errors: [{ code: "jwks-unavailable", message: error instanceof Error ? error.message : "Discovery fetch failed" }] };
+  }
+  const jwks = getRemoteJwksForUri(jwksUri);
+  try {
+    const { payload } = await jwtVerify(token, jwks, {
+      issuer: options.issuer,
+      audience: options.audience,
+      algorithms: ["EdDSA"],
+      clockTolerance: CLOCK_SKEW_TOLERANCE_SECONDS
+    });
+    if (options.authorizedParties) {
+      const authorizedPartyError = checkAuthorizedParty(payload, options.authorizedParties);
+      if (authorizedPartyError) return { errors: [authorizedPartyError] };
+    }
+    return { payload };
+  } catch (error) {
+    return { errors: [classifyJoseError(error)] };
+  }
+}
+async function verifyIdToken(idToken, options) {
+  const result = await verifyAgainstIssuer(idToken, options);
+  if ("errors" in result) return { success: false, errors: result.errors };
+  const { payload } = result;
+  if (typeof payload.sub !== "string") {
+    return { success: false, errors: [{ code: "malformed-claims", message: "id_token has no sub claim" }] };
+  }
+  return { success: true, data: payload };
+}
+async function verifyAccessToken(accessToken, options) {
+  const result = await verifyAgainstIssuer(accessToken, options);
+  if ("errors" in result) return { success: false, errors: result.errors };
+  const { payload } = result;
+  const claims = payload;
+  const roles = "roles" in claims ? claims.roles : void 0;
+  if (typeof payload.sub === "string") {
+    return { success: true, data: { kind: "user", sub: payload.sub, roles, claims } };
+  }
+  if (typeof payload.azp !== "string") {
+    return {
+      success: false,
+      errors: [{ code: "malformed-claims", message: "Access token has neither a sub (user) nor an azp (machine client id)" }]
+    };
+  }
+  return { success: true, data: { kind: "machine", clientId: payload.azp, claims } };
+}
+
+export {
+  fetchDiscovery,
+  getRemoteJwksForUri,
+  generateCodeVerifier,
+  generateCodeChallenge,
+  generateState,
+  TokenRequestError,
+  exchangeAuthorizationCode,
+  clientCredentialsGrant,
+  refreshTokens,
+  CLOCK_SKEW_TOLERANCE_SECONDS,
+  verifyIdToken,
+  verifyAccessToken
+};

package/dist/index.cjs

@@ -0,0 +1,357 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CLOCK_SKEW_TOLERANCE_SECONDS: () => CLOCK_SKEW_TOLERANCE_SECONDS,
+  TokenRequestError: () => TokenRequestError,
+  clientCredentialsGrant: () => clientCredentialsGrant,
+  exchangeAuthorizationCode: () => exchangeAuthorizationCode,
+  fetchDiscovery: () => fetchDiscovery,
+  generateCodeChallenge: () => generateCodeChallenge,
+  generateCodeVerifier: () => generateCodeVerifier,
+  generateState: () => generateState,
+  getRemoteJwksForUri: () => getRemoteJwksForUri,
+  refreshTokens: () => refreshTokens,
+  verifyAccessToken: () => verifyAccessToken,
+  verifyIdToken: () => verifyIdToken
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/discovery.ts
+var import_jose = require("jose");
+var DISCOVERY_CACHE_TTL_MS = 6e5;
+var CACHE_MAX_ENTRIES = 100;
+var discoveryCache = /* @__PURE__ */ new Map();
+var discoveryPending = /* @__PURE__ */ new Map();
+var jwksCache = /* @__PURE__ */ new Map();
+function touchLru(map, key) {
+  const value = map.get(key);
+  if (value === void 0) return;
+  map.delete(key);
+  map.set(key, value);
+}
+function setWithLruEviction(map, key, value, maxEntries) {
+  map.delete(key);
+  map.set(key, value);
+  if (map.size > maxEntries) {
+    const oldestKey = map.keys().next().value;
+    if (oldestKey !== void 0) map.delete(oldestKey);
+  }
+}
+function discoveryUrl(issuerUrl) {
+  return `${issuerUrl.replace(/\/+$/, "")}/.well-known/openid-configuration`;
+}
+function isLoopbackHost(hostname) {
+  return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "::1";
+}
+function assertHttps(url, label) {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:" && !isLoopbackHost(parsed.hostname)) {
+    throw new Error(`Discovery: ${label} "${url}" must be https (loopback hosts are the only http exception)`);
+  }
+}
+function validateDiscoveryDocument(document, issuerUrl) {
+  assertHttps(issuerUrl, "issuer");
+  assertHttps(document.jwks_uri, "jwks_uri");
+  assertHttps(document.token_endpoint, "token_endpoint");
+  if (document.issuer !== issuerUrl) {
+    throw new Error(`Discovery: document issuer "${document.issuer}" does not match the configured issuer "${issuerUrl}"`);
+  }
+  const issuerOrigin = new URL(issuerUrl).origin;
+  if (new URL(document.jwks_uri).origin !== issuerOrigin) {
+    throw new Error(`Discovery: jwks_uri "${document.jwks_uri}" is not same-origin as issuer "${issuerUrl}"`);
+  }
+  if (new URL(document.token_endpoint).origin !== issuerOrigin) {
+    throw new Error(`Discovery: token_endpoint "${document.token_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
+  }
+}
+async function fetchDiscovery(issuerUrl) {
+  const cached = discoveryCache.get(issuerUrl);
+  if (cached && cached.expiresAt > Date.now()) {
+    touchLru(discoveryCache, issuerUrl);
+    return cached.document;
+  }
+  const pending = discoveryPending.get(issuerUrl);
+  if (pending) return pending;
+  const promise = fetch(discoveryUrl(issuerUrl), { headers: { Accept: "application/json" } }).then(
+    async (response) => {
+      if (!response.ok) {
+        throw new Error(`Discovery fetch for ${issuerUrl} failed: HTTP ${response.status}`);
+      }
+      const document = await response.json();
+      validateDiscoveryDocument(document, issuerUrl);
+      return document;
+    }
+  );
+  discoveryPending.set(issuerUrl, promise);
+  try {
+    const document = await promise;
+    discoveryPending.delete(issuerUrl);
+    setWithLruEviction(discoveryCache, issuerUrl, { document, expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS }, CACHE_MAX_ENTRIES);
+    return document;
+  } catch (error) {
+    discoveryPending.delete(issuerUrl);
+    throw error;
+  }
+}
+function getRemoteJwksForUri(jwksUri) {
+  const cached = jwksCache.get(jwksUri);
+  if (cached) {
+    touchLru(jwksCache, jwksUri);
+    return cached;
+  }
+  const jwks = (0, import_jose.createRemoteJWKSet)(new URL(jwksUri));
+  setWithLruEviction(jwksCache, jwksUri, jwks, CACHE_MAX_ENTRIES);
+  return jwks;
+}
+
+// src/pkce.ts
+var CODE_VERIFIER_BYTE_LENGTH = 32;
+var STATE_BYTE_LENGTH = 32;
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomBase64Url(byteLength) {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes);
+}
+function generateCodeVerifier() {
+  return randomBase64Url(CODE_VERIFIER_BYTE_LENGTH);
+}
+async function generateCodeChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64UrlEncode(new Uint8Array(digest));
+}
+function generateState() {
+  return randomBase64Url(STATE_BYTE_LENGTH);
+}
+
+// src/token.ts
+var TokenRequestError = class extends Error {
+  status;
+  error;
+  errorDescription;
+  constructor(details) {
+    super(
+      details.errorDescription ?? details.error ?? `Token request failed${details.status ? ` with HTTP ${details.status}` : ""}`
+    );
+    this.name = "TokenRequestError";
+    this.status = details.status;
+    this.error = details.error;
+    this.errorDescription = details.errorDescription;
+  }
+};
+function toTokenSet(body) {
+  return {
+    accessToken: body.access_token,
+    tokenType: body.token_type ?? "Bearer",
+    refreshToken: body.refresh_token,
+    idToken: body.id_token,
+    expiresIn: body.expires_in,
+    scope: body.scope
+  };
+}
+async function postTokenRequest(tokenEndpoint, clientId, clientSecret, params) {
+  const body = new URLSearchParams(params);
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  if (clientSecret) {
+    headers.Authorization = `Basic ${btoa(`${clientId}:${clientSecret}`)}`;
+  } else {
+    body.set("client_id", clientId);
+  }
+  return fetch(tokenEndpoint, { method: "POST", headers, body: body.toString() });
+}
+async function readTokenResponseBody(response) {
+  return await response.json().catch(() => null);
+}
+async function exchangeAuthorizationCode(options) {
+  const discovery = await fetchDiscovery(options.issuer);
+  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
+    grant_type: "authorization_code",
+    code: options.code,
+    redirect_uri: options.redirectUri,
+    code_verifier: options.codeVerifier
+  });
+  const body = await readTokenResponseBody(response);
+  if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
+    throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });
+  }
+  return toTokenSet(body);
+}
+async function clientCredentialsGrant(options) {
+  const discovery = await fetchDiscovery(options.issuer);
+  const response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
+    grant_type: "client_credentials",
+    ...options.scope ? { scope: options.scope } : {}
+  });
+  const body = await readTokenResponseBody(response);
+  if (!response.ok || !body || body.error || typeof body.access_token !== "string") {
+    throw new TokenRequestError({ status: response.status, error: body?.error, errorDescription: body?.error_description });
+  }
+  return toTokenSet(body);
+}
+var TRANSIENT_HTTP_STATUSES = /* @__PURE__ */ new Set([408, 429]);
+function isTransientStatus(status) {
+  return TRANSIENT_HTTP_STATUSES.has(status) || status >= 500;
+}
+async function refreshTokens(options) {
+  let response;
+  try {
+    const discovery = await fetchDiscovery(options.issuer);
+    response = await postTokenRequest(discovery.token_endpoint, options.clientId, options.clientSecret, {
+      grant_type: "refresh_token",
+      refresh_token: options.refreshToken
+    });
+  } catch (error) {
+    return { outcome: "transient", error };
+  }
+  if (isTransientStatus(response.status)) {
+    return { outcome: "transient", error: new TokenRequestError({ status: response.status }) };
+  }
+  const body = await readTokenResponseBody(response);
+  if (response.ok && body && typeof body.access_token === "string") {
+    return { outcome: "success", tokens: toTokenSet(body) };
+  }
+  const tokenError = new TokenRequestError({
+    status: response.status,
+    error: body?.error,
+    errorDescription: body?.error_description
+  });
+  const isConfirmedRejection = response.status === 400 && body?.error === "invalid_grant";
+  return isConfirmedRejection ? { outcome: "terminal", error: tokenError } : { outcome: "transient", error: tokenError };
+}
+
+// src/verify.ts
+var import_jose2 = require("jose");
+var CLOCK_SKEW_TOLERANCE_SECONDS = 60;
+function joseErrorCode(error) {
+  return error instanceof import_jose2.errors.JOSEError ? error.code : void 0;
+}
+function classifyJoseError(error) {
+  const code = joseErrorCode(error);
+  const message = error instanceof Error ? error.message : "Token verification failed";
+  switch (code) {
+    case "ERR_JWT_EXPIRED":
+      return { code: "expired", message };
+    case "ERR_JWT_CLAIM_VALIDATION_FAILED": {
+      const claim = error instanceof import_jose2.errors.JWTClaimValidationFailed ? error.claim : void 0;
+      if (claim === "aud") return { code: "invalid-audience", message };
+      if (claim === "iss") return { code: "invalid-issuer", message };
+      return { code: "malformed-claims", message };
+    }
+    case "ERR_JWS_SIGNATURE_VERIFICATION_FAILED":
+    case "ERR_JWS_INVALID":
+    case "ERR_JWKS_NO_MATCHING_KEY":
+    case "ERR_JWKS_MULTIPLE_MATCHING_KEYS":
+      return { code: "invalid-signature", message };
+    case "ERR_JWKS_TIMEOUT":
+      return { code: "jwks-unavailable", message };
+    case "ERR_JWT_INVALID":
+    default:
+      return { code: "malformed-token", message };
+  }
+}
+function checkAuthorizedParty(payload, authorizedParties) {
+  const party = typeof payload.azp === "string" ? payload.azp : typeof payload.aud === "string" ? payload.aud : void 0;
+  if (party === void 0) {
+    return { code: "unauthorized-party", message: "Token has no azp claim and no single-string aud to check against authorizedParties" };
+  }
+  if (!authorizedParties.includes(party)) {
+    return { code: "unauthorized-party", message: `Token's authorized party "${party}" is not in the configured allowlist` };
+  }
+  return null;
+}
+function requireConfig(options) {
+  if (!options.issuer) throw new Error("verify: options.issuer is required");
+  if (!options.audience) throw new Error("verify: options.audience is required");
+}
+async function verifyAgainstIssuer(token, options) {
+  requireConfig(options);
+  let jwksUri;
+  try {
+    jwksUri = (await fetchDiscovery(options.issuer)).jwks_uri;
+  } catch (error) {
+    return { errors: [{ code: "jwks-unavailable", message: error instanceof Error ? error.message : "Discovery fetch failed" }] };
+  }
+  const jwks = getRemoteJwksForUri(jwksUri);
+  try {
+    const { payload } = await (0, import_jose2.jwtVerify)(token, jwks, {
+      issuer: options.issuer,
+      audience: options.audience,
+      algorithms: ["EdDSA"],
+      clockTolerance: CLOCK_SKEW_TOLERANCE_SECONDS
+    });
+    if (options.authorizedParties) {
+      const authorizedPartyError = checkAuthorizedParty(payload, options.authorizedParties);
+      if (authorizedPartyError) return { errors: [authorizedPartyError] };
+    }
+    return { payload };
+  } catch (error) {
+    return { errors: [classifyJoseError(error)] };
+  }
+}
+async function verifyIdToken(idToken, options) {
+  const result = await verifyAgainstIssuer(idToken, options);
+  if ("errors" in result) return { success: false, errors: result.errors };
+  const { payload } = result;
+  if (typeof payload.sub !== "string") {
+    return { success: false, errors: [{ code: "malformed-claims", message: "id_token has no sub claim" }] };
+  }
+  return { success: true, data: payload };
+}
+async function verifyAccessToken(accessToken, options) {
+  const result = await verifyAgainstIssuer(accessToken, options);
+  if ("errors" in result) return { success: false, errors: result.errors };
+  const { payload } = result;
+  const claims = payload;
+  const roles = "roles" in claims ? claims.roles : void 0;
+  if (typeof payload.sub === "string") {
+    return { success: true, data: { kind: "user", sub: payload.sub, roles, claims } };
+  }
+  if (typeof payload.azp !== "string") {
+    return {
+      success: false,
+      errors: [{ code: "malformed-claims", message: "Access token has neither a sub (user) nor an azp (machine client id)" }]
+    };
+  }
+  return { success: true, data: { kind: "machine", clientId: payload.azp, claims } };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CLOCK_SKEW_TOLERANCE_SECONDS,
+  TokenRequestError,
+  clientCredentialsGrant,
+  exchangeAuthorizationCode,
+  fetchDiscovery,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  generateState,
+  getRemoteJwksForUri,
+  refreshTokens,
+  verifyAccessToken,
+  verifyIdToken
+});