@tinyrack/issuary-server 0.20.0

package/dist/lib/ip-utils.js

@@ -0,0 +1,213 @@
+/**
+ * IP address utilities for validating and matching IP addresses against CIDR ranges.
+ * Supports both IPv4 and IPv6 addresses.
+ */
+/**
+ * Parses an IPv4 address string into a 32-bit integer.
+ * @param ip - IPv4 address string (e.g., "192.168.1.1")
+ * @returns 32-bit integer representation, or null if invalid
+ */
+export function parseIPv4(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4) {
+        return null;
+    }
+    let result = 0;
+    for (const part of parts) {
+        const num = Number.parseInt(part, 10);
+        if (Number.isNaN(num) || num < 0 || num > 255) {
+            return null;
+        }
+        result = (result << 8) | num;
+    }
+    // Convert to unsigned 32-bit integer
+    return result >>> 0;
+}
+/**
+ * Parses an IPv6 address string into a BigInt.
+ * Supports full and compressed (::) notation.
+ * @param ip - IPv6 address string (e.g., "2001:db8::1")
+ * @returns BigInt representation, or null if invalid
+ */
+export function parseIPv6(ip) {
+    // Handle IPv4-mapped IPv6 addresses (::ffff:192.168.1.1)
+    const ipv4MappedMatch = ip.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+    if (ipv4MappedMatch) {
+        const ipv4Part = ipv4MappedMatch[1];
+        if (ipv4Part === undefined) {
+            return null;
+        }
+        const ipv4 = parseIPv4(ipv4Part);
+        if (ipv4 === null) {
+            return null;
+        }
+        return BigInt('0xffff00000000') | BigInt(ipv4);
+    }
+    // Reject multiple :: (only one :: is allowed)
+    const doubleColonCount = (ip.match(/::/g) ?? []).length;
+    if (doubleColonCount > 1) {
+        return null;
+    }
+    // Reject ::: (triple colon is invalid)
+    if (ip.includes(':::')) {
+        return null;
+    }
+    let parts = ip.split(':');
+    // Handle :: compression
+    const doubleColonIndex = ip.indexOf('::');
+    if (doubleColonIndex !== -1) {
+        const left = ip.slice(0, doubleColonIndex).split(':').filter(Boolean);
+        const right = ip
+            .slice(doubleColonIndex + 2)
+            .split(':')
+            .filter(Boolean);
+        const missing = 8 - left.length - right.length;
+        if (missing < 0) {
+            return null;
+        }
+        parts = [...left, ...Array(missing).fill('0'), ...right];
+    }
+    if (parts.length !== 8) {
+        return null;
+    }
+    let result = BigInt(0);
+    for (const part of parts) {
+        const num = Number.parseInt(part, 16);
+        if (Number.isNaN(num) || num < 0 || num > 0xffff) {
+            return null;
+        }
+        result = (result << BigInt(16)) | BigInt(num);
+    }
+    return result;
+}
+/**
+ * Checks if an IP address is an IPv4 address.
+ * @param ip - IP address string
+ * @returns true if the address is IPv4
+ */
+export function isIPv4(ip) {
+    return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(ip);
+}
+/**
+ * Checks if an IP address is an IPv6 address.
+ * @param ip - IP address string
+ * @returns true if the address is IPv6
+ */
+export function isIPv6(ip) {
+    return ip.includes(':');
+}
+/**
+ * Checks if an IPv4 address is within a CIDR range.
+ * @param ip - IPv4 address to check
+ * @param cidr - CIDR notation (e.g., "10.0.0.0/8")
+ * @returns true if the IP is within the range
+ */
+export function isIPv4InCIDR(ip, cidr) {
+    const [network, prefixStr] = cidr.split('/');
+    if (network === undefined) {
+        return false;
+    }
+    const prefix = prefixStr !== undefined ? Number.parseInt(prefixStr, 10) : 32;
+    if (Number.isNaN(prefix) || prefix < 0 || prefix > 32) {
+        return false;
+    }
+    const ipNum = parseIPv4(ip);
+    const networkNum = parseIPv4(network);
+    if (ipNum === null || networkNum === null) {
+        return false;
+    }
+    // Create mask: all 1s for prefix length, then 0s
+    const mask = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;
+    return (ipNum & mask) === (networkNum & mask);
+}
+/**
+ * Checks if an IPv6 address is within a CIDR range.
+ * @param ip - IPv6 address to check
+ * @param cidr - CIDR notation (e.g., "2001:db8::/32")
+ * @returns true if the IP is within the range
+ */
+export function isIPv6InCIDR(ip, cidr) {
+    const [network, prefixStr] = cidr.split('/');
+    if (network === undefined) {
+        return false;
+    }
+    const prefix = prefixStr !== undefined ? Number.parseInt(prefixStr, 10) : 128;
+    if (Number.isNaN(prefix) || prefix < 0 || prefix > 128) {
+        return false;
+    }
+    const ipNum = parseIPv6(ip);
+    const networkNum = parseIPv6(network);
+    if (ipNum === null || networkNum === null) {
+        return false;
+    }
+    // Create mask: all 1s for prefix length, then 0s
+    const mask = prefix === 0
+        ? BigInt(0)
+        : (BigInt(1) << BigInt(128)) -
+            BigInt(1) -
+            ((BigInt(1) << BigInt(128 - prefix)) - BigInt(1));
+    return (ipNum & mask) === (networkNum & mask);
+}
+/**
+ * Checks if an IP address matches a given pattern.
+ * The pattern can be:
+ * - A single IP address (e.g., "192.168.1.1")
+ * - A CIDR range (e.g., "10.0.0.0/8")
+ * @param ip - IP address to check
+ * @param pattern - Pattern to match against
+ * @returns true if the IP matches the pattern
+ */
+export function isIPInRange(ip, pattern) {
+    // Normalize IPv4-mapped IPv6 addresses for comparison
+    const normalizedIp = ip.startsWith('::ffff:') ? ip.slice(7) : ip;
+    const normalizedPattern = pattern.startsWith('::ffff:')
+        ? pattern.slice(7)
+        : pattern;
+    const isCIDR = normalizedPattern.includes('/');
+    if (isIPv4(normalizedIp)) {
+        if (isCIDR) {
+            return isIPv4InCIDR(normalizedIp, normalizedPattern);
+        }
+        return normalizedIp === normalizedPattern;
+    }
+    if (isIPv6(normalizedIp)) {
+        if (isCIDR) {
+            return isIPv6InCIDR(normalizedIp, normalizedPattern);
+        }
+        // For exact match, normalize both addresses
+        const ipNum = parseIPv6(normalizedIp);
+        const patternNum = parseIPv6(normalizedPattern);
+        return ipNum !== null && patternNum !== null && ipNum === patternNum;
+    }
+    return false;
+}
+/**
+ * Checks if an IP address is trusted based on trust_proxy configuration.
+ * @param ip - IP address to check
+ * @param trustProxy - Trust proxy configuration value
+ * @returns true if the IP should be trusted
+ */
+export function isTrustedProxy(ip, trustProxy) {
+    // true = trust all proxies
+    if (trustProxy === true) {
+        return true;
+    }
+    // false = trust no proxies (direct connection expected)
+    if (trustProxy === false) {
+        return true; // Allow all requests in direct connection mode
+    }
+    // number = hop count mode (not IP-based filtering)
+    if (typeof trustProxy === 'number') {
+        return true; // Allow all requests in hop count mode
+    }
+    // string = single IP or CIDR
+    if (typeof trustProxy === 'string') {
+        return isIPInRange(ip, trustProxy);
+    }
+    // array = multiple IPs or CIDRs
+    if (Array.isArray(trustProxy)) {
+        return trustProxy.some((pattern) => isIPInRange(ip, pattern));
+    }
+    return false;
+}
+//# sourceMappingURL=ip-utils.js.map

package/dist/lib/ip-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-utils.js","sourceRoot":"","sources":["../../src/lib/ip-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;IAC/B,CAAC;IAED,qCAAqC;IACrC,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,yDAAyD;IACzD,MAAM,eAAe,GAAG,EAAE,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,8CAA8C;IAC9C,MAAM,gBAAgB,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1B,wBAAwB;IACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,gBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,EAAE;aACb,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC;aAC3B,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,EAAU;IAC/B,OAAO,sCAAsC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,EAAU;IAC/B,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,IAAY;IACnD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7E,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iDAAiD;IACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,IAAY;IACnD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAE9E,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iDAAiD;IACjD,MAAM,IAAI,GACR,MAAM,KAAK,CAAC;QACV,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACX,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC;YACT,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,OAAe;IACrD,sDAAsD;IACtD,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,OAAO,CAAC;IAEZ,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE/C,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,YAAY,KAAK,iBAAiB,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACvD,CAAC;QACD,4CAA4C;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAChD,OAAO,KAAK,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,KAAK,UAAU,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,EAAU,EACV,UAAgD;IAEhD,2BAA2B;IAC3B,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,CAAC,+CAA+C;IAC9D,CAAC;IAED,mDAAmD;IACnD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,uCAAuC;IACtD,CAAC;IAED,6BAA6B;IAC7B,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,WAAW,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,gCAAgC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/locale.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Centralized locale constants for the application.
+ *
+ * AVAILABLE_LOCALES: All locales the application CAN support (compile-time).
+ *                    These have corresponding translation files.
+ *
+ * config.i18n.supported_languages: Locales ENABLED for a deployment (runtime).
+ *                                  Must be a subset of AVAILABLE_LOCALES.
+ */
+/**
+ * All locales the application can support.
+ * Each locale listed here must have corresponding translation files.
+ */
+export declare const AVAILABLE_LOCALES: readonly ["en", "ko", "ja"];
+/**
+ * Type representing any available locale.
+ */
+export type Locale = (typeof AVAILABLE_LOCALES)[number];
+/**
+ * Default locale used as fallback.
+ */
+export declare const DEFAULT_LOCALE: Locale;
+/**
+ * Check if a string is a valid available locale.
+ */
+export declare const isAvailableLocale: (code: string) => code is Locale;
+/**
+ * Email translation structure type.
+ * Matches the structure of email translation JSON files.
+ */
+export interface EmailTranslations {
+    verification: {
+        subject: string;
+        title: string;
+        greeting: string;
+        description: string;
+        buttonText: string;
+        linkAlt: string;
+        codeLabel: string;
+        expiry: string;
+        ignore: string;
+    };
+    passwordReset: {
+        subject: string;
+        title: string;
+        description: string;
+        buttonText: string;
+        linkAlt: string;
+        codeLabel: string;
+        expiry: string;
+        ignore: string;
+    };
+    common: {
+        poweredBy: string;
+    };
+}
+//# sourceMappingURL=locale.d.ts.map

package/dist/lib/locale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale.d.ts","sourceRoot":"","sources":["../../src/lib/locale.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAA8B,CAAC;AAE7D;;GAEG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,MAAa,CAAC;AAE3C;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,IAAI,IAAI,MAExD,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,aAAa,EAAE;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH"}

package/dist/lib/locale.js

@@ -0,0 +1,25 @@
+/**
+ * Centralized locale constants for the application.
+ *
+ * AVAILABLE_LOCALES: All locales the application CAN support (compile-time).
+ *                    These have corresponding translation files.
+ *
+ * config.i18n.supported_languages: Locales ENABLED for a deployment (runtime).
+ *                                  Must be a subset of AVAILABLE_LOCALES.
+ */
+/**
+ * All locales the application can support.
+ * Each locale listed here must have corresponding translation files.
+ */
+export const AVAILABLE_LOCALES = ['en', 'ko', 'ja'];
+/**
+ * Default locale used as fallback.
+ */
+export const DEFAULT_LOCALE = 'en';
+/**
+ * Check if a string is a valid available locale.
+ */
+export const isAvailableLocale = (code) => {
+    return AVAILABLE_LOCALES.includes(code);
+};
+//# sourceMappingURL=locale.js.map

package/dist/lib/locale.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale.js","sourceRoot":"","sources":["../../src/lib/locale.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAO7D;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAW,IAAI,CAAC;AAE3C;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAkB,EAAE;IAChE,OAAQ,iBAA2C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC,CAAC"}

package/dist/lib/logger.d.ts

@@ -0,0 +1,14 @@
+import pino from 'pino';
+import { type LoggingConfig } from './config/index.ts';
+export type { Logger } from 'pino';
+export interface CreateLoggerOptions {
+    logging?: Partial<LoggingConfig> | undefined;
+}
+/**
+ * Create the root pino logger instance.
+ *
+ * @param options - Logging configuration (all fields optional)
+ * @returns A configured pino logger
+ */
+export declare function createLogger(options?: CreateLoggerOptions): pino.Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/lib/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,KAAK,aAAa,EAAuB,MAAM,mBAAmB,CAAC;AAE5E,YAAY,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAkCvE"}

package/dist/lib/logger.js

@@ -0,0 +1,41 @@
+import pino from 'pino';
+import { LoggingConfigSchema } from "./config/index.js";
+/**
+ * Create the root pino logger instance.
+ *
+ * @param options - Logging configuration (all fields optional)
+ * @returns A configured pino logger
+ */
+export function createLogger(options) {
+    const logging = LoggingConfigSchema.parse({
+        ...options?.logging,
+    });
+    const pinoOptions = {
+        level: logging.level,
+        redact: {
+            paths: [
+                'password',
+                'client_secret',
+                'security.session_secret',
+                'security.hash_secret',
+                'config.security.session_secret',
+                'config.security.hash_secret',
+                'req.headers.authorization',
+                'req.headers.cookie',
+            ],
+            censor: '[REDACTED]',
+        },
+    };
+    if (logging.format === 'pretty') {
+        pinoOptions.transport = {
+            target: 'pino-pretty',
+            options: {
+                colorize: true,
+                translateTime: 'HH:MM:ss.l',
+                ignore: 'pid,hostname',
+            },
+        };
+    }
+    return pino(pinoOptions);
+}
+//# sourceMappingURL=logger.js.map

package/dist/lib/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAsB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAQ5E;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAA6B;IACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC;QACxC,GAAG,OAAO,EAAE,OAAO;KACpB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAuB;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,UAAU;gBACV,eAAe;gBACf,yBAAyB;gBACzB,sBAAsB;gBACtB,gCAAgC;gBAChC,6BAA6B;gBAC7B,2BAA2B;gBAC3B,oBAAoB;aACrB;YACD,MAAM,EAAE,YAAY;SACrB;KACF,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,WAAW,CAAC,SAAS,GAAG;YACtB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,YAAY;gBAC3B,MAAM,EAAE,cAAc;aACvB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;AAC3B,CAAC"}

package/dist/lib/openapi.d.ts

@@ -0,0 +1,35 @@
+import type { OpenApiConfig } from './config/openapi.ts';
+type OpenApiSecurityRequirements = Array<Record<string, string[]>>;
+export declare const OPENAPI_SECURITY: {
+    cookieSession: OpenApiSecurityRequirements;
+    optionalCookieSession: OpenApiSecurityRequirements;
+    bearer: OpenApiSecurityRequirements;
+};
+export declare function createOpenApiDocumentation(config: Pick<OpenApiConfig, 'title' | 'description'>): {
+    info: {
+        title: string;
+        version: string;
+        description: string;
+    };
+    servers: {
+        url: string;
+    }[];
+    components: {
+        securitySchemes: {
+            cookieSessionAuth: {
+                type: "apiKey";
+                in: "cookie";
+                name: string;
+                description: string;
+            };
+            bearerAuth: {
+                type: "http";
+                scheme: "bearer";
+                bearerFormat: string;
+                description: string;
+            };
+        };
+    };
+};
+export {};
+//# sourceMappingURL=openapi.d.ts.map

package/dist/lib/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/lib/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,KAAK,2BAA2B,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAEnE,eAAO,MAAM,gBAAgB,EAAE;IAC7B,aAAa,EAAE,2BAA2B,CAAC;IAC3C,qBAAqB,EAAE,2BAA2B,CAAC;IACnD,MAAM,EAAE,2BAA2B,CAAC;CAKrC,CAAC;AAEF,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,GAAG,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;EA4BrD"}

package/dist/lib/openapi.js

@@ -0,0 +1,33 @@
+const OPENAPI_INFO_VERSION = '1.0.0';
+export const OPENAPI_SECURITY = {
+    cookieSession: [{ cookieSessionAuth: [] }],
+    optionalCookieSession: [{ cookieSessionAuth: [] }, {}],
+    bearer: [{ bearerAuth: [] }],
+};
+export function createOpenApiDocumentation(config) {
+    return {
+        info: {
+            title: config.title,
+            version: OPENAPI_INFO_VERSION,
+            description: config.description,
+        },
+        servers: [{ url: '/' }],
+        components: {
+            securitySchemes: {
+                cookieSessionAuth: {
+                    type: 'apiKey',
+                    in: 'cookie',
+                    name: 'session',
+                    description: 'Encrypted session cookie issued by Issuary after authentication.',
+                },
+                bearerAuth: {
+                    type: 'http',
+                    scheme: 'bearer',
+                    bearerFormat: 'JWT',
+                    description: 'Bearer access token for OAuth 2.0/OIDC protected routes.',
+                },
+            },
+        },
+    };
+}
+//# sourceMappingURL=openapi.js.map

package/dist/lib/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/lib/openapi.ts"],"names":[],"mappings":"AAEA,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAIrC,MAAM,CAAC,MAAM,gBAAgB,GAIzB;IACF,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;IAC1C,qBAAqB,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IACtD,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,UAAU,0BAA0B,CACxC,MAAoD;IAEpD,OAAO;QACL,IAAI,EAAE;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,oBAAoB;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC;QACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACvB,UAAU,EAAE;YACV,eAAe,EAAE;gBACf,iBAAiB,EAAE;oBACjB,IAAI,EAAE,QAAiB;oBACvB,EAAE,EAAE,QAAiB;oBACrB,IAAI,EAAE,SAAS;oBACf,WAAW,EACT,kEAAkE;iBACrE;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,MAAe;oBACrB,MAAM,EAAE,QAAiB;oBACzB,YAAY,EAAE,KAAK;oBACnB,WAAW,EACT,0DAA0D;iBAC7D;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/lib/password-policy.d.ts

@@ -0,0 +1,39 @@
+/** Configuration for password length constraints. */
+export interface PasswordPolicy {
+    min_length: number;
+    max_length: number;
+}
+/** Default password policy enforcing a minimum of 12 and maximum of 256 characters. */
+export declare const DEFAULT_PASSWORD_POLICY: {
+    readonly min_length: 12;
+    readonly max_length: 256;
+};
+export declare const PASSWORD_POLICY_MIN_LENGTH: 12;
+export declare const PASSWORD_POLICY_MAX_LENGTH: 256;
+/**
+ * Applies Unicode NFC normalization to a password so that visually identical
+ * strings (e.g. precomposed vs decomposed characters) are treated equally.
+ *
+ * @param password - The raw password string.
+ * @returns The NFC-normalized password.
+ */
+export declare function normalizePassword(password: string): string;
+/**
+ * Validates a password against the given policy and returns a human-readable
+ * error message if the password violates any constraint.
+ *
+ * @param password - The raw password to validate.
+ * @param policy - The password policy to check against. Defaults to {@link DEFAULT_PASSWORD_POLICY}.
+ * @returns An error message string if validation fails, or `null` if the password is valid.
+ */
+export declare function getPasswordPolicyError(password: string, policy?: PasswordPolicy): string | null;
+/**
+ * Validates a password against the given policy and throws a
+ * {@link e.ValidationError.Error} if it does not meet the requirements.
+ *
+ * @param password - The raw password to validate.
+ * @param policy - The password policy to check against. Defaults to {@link DEFAULT_PASSWORD_POLICY}.
+ * @throws {e.ValidationError.Error} If the password violates the policy.
+ */
+export declare function assertPasswordPolicy(password: string, policy?: PasswordPolicy): void;
+//# sourceMappingURL=password-policy.d.ts.map

package/dist/lib/password-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.d.ts","sourceRoot":"","sources":["../../src/lib/password-policy.ts"],"names":[],"mappings":"AAEA,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,uFAAuF;AACvF,eAAO,MAAM,uBAAuB;;;CAGD,CAAC;AAEpC,eAAO,MAAM,0BAA0B,IAAqC,CAAC;AAC7E,eAAO,MAAM,0BAA0B,KAAqC,CAAC;AAE7E;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,cAAwC,GAC/C,MAAM,GAAG,IAAI,CAYf;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,cAAwC,GAC/C,IAAI,CAKN"}

package/dist/lib/password-policy.js

@@ -0,0 +1,51 @@
+import { e } from "../schemas/error.js";
+/** Default password policy enforcing a minimum of 12 and maximum of 256 characters. */
+export const DEFAULT_PASSWORD_POLICY = {
+    min_length: 12,
+    max_length: 256,
+};
+export const PASSWORD_POLICY_MIN_LENGTH = DEFAULT_PASSWORD_POLICY.min_length;
+export const PASSWORD_POLICY_MAX_LENGTH = DEFAULT_PASSWORD_POLICY.max_length;
+/**
+ * Applies Unicode NFC normalization to a password so that visually identical
+ * strings (e.g. precomposed vs decomposed characters) are treated equally.
+ *
+ * @param password - The raw password string.
+ * @returns The NFC-normalized password.
+ */
+export function normalizePassword(password) {
+    return password.normalize('NFC');
+}
+/**
+ * Validates a password against the given policy and returns a human-readable
+ * error message if the password violates any constraint.
+ *
+ * @param password - The raw password to validate.
+ * @param policy - The password policy to check against. Defaults to {@link DEFAULT_PASSWORD_POLICY}.
+ * @returns An error message string if validation fails, or `null` if the password is valid.
+ */
+export function getPasswordPolicyError(password, policy = DEFAULT_PASSWORD_POLICY) {
+    const normalized = normalizePassword(password);
+    if (normalized.length < policy.min_length) {
+        return `Password must be at least ${policy.min_length} characters long.`;
+    }
+    if (normalized.length > policy.max_length) {
+        return `Password must be at most ${policy.max_length} characters long.`;
+    }
+    return null;
+}
+/**
+ * Validates a password against the given policy and throws a
+ * {@link e.ValidationError.Error} if it does not meet the requirements.
+ *
+ * @param password - The raw password to validate.
+ * @param policy - The password policy to check against. Defaults to {@link DEFAULT_PASSWORD_POLICY}.
+ * @throws {e.ValidationError.Error} If the password violates the policy.
+ */
+export function assertPasswordPolicy(password, policy = DEFAULT_PASSWORD_POLICY) {
+    const error = getPasswordPolicyError(password, policy);
+    if (error) {
+        throw new e.ValidationError.Error(error);
+    }
+}
+//# sourceMappingURL=password-policy.js.map

package/dist/lib/password-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.js","sourceRoot":"","sources":["../../src/lib/password-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAQxC,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,GAAG;CACkB,CAAC;AAEpC,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC,UAAU,CAAC;AAC7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC,UAAU,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,SAAyB,uBAAuB;IAEhD,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,6BAA6B,MAAM,CAAC,UAAU,mBAAmB,CAAC;IAC3E,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,4BAA4B,MAAM,CAAC,UAAU,mBAAmB,CAAC;IAC1E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,SAAyB,uBAAuB;IAEhD,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/lib/pkce.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Generate PKCE code verifier and challenge pair
+ *
+ * @param length - Length of the code verifier (43-128 characters, default 64)
+ * @returns PKCE pair containing verifier, challenge, and method
+ * @throws {InvalidCodeVerifierLength} When length is outside the 43-128 character range
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.1 | RFC 7636 §4.1 - Client Creates a Code Verifier}
+ */
+export declare function generatePKCE(length?: number): Promise<{
+    verifier: string;
+    challenge: string;
+    method: string;
+}>;
+/**
+ * Validate PKCE code verifier against stored challenge
+ *
+ * @param verifier - Code verifier sent by the client in token request
+ * @param challenge - Code challenge previously stored from authorization request
+ * @param method - Transform method used ('S256' or 'plain', default 'S256')
+ * @returns True if the verifier matches the challenge, false otherwise
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.6 | RFC 7636 §4.6 - Client Sends the Authorization Code and the Code Verifier to the Token Endpoint}
+ */
+export declare function validatePKCE(verifier: string, challenge: string, method?: 'S256' | 'plain'): Promise<boolean>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/lib/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAmBA;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW;;;;GAWrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAM,GAAG,OAAgB,oBAalC"}

package/dist/lib/pkce.js

@@ -0,0 +1,59 @@
+import { base64url } from 'jose';
+import { e } from "../schemas/error.js";
+const CODE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+function generateVerifier(length) {
+    const buffer = new Uint8Array(length);
+    crypto.getRandomValues(buffer);
+    return base64url.encode(buffer).slice(0, length);
+}
+async function generateChallenge(verifier, method) {
+    if (method === 'plain')
+        return verifier;
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hash = await crypto.subtle.digest('SHA-256', data);
+    return base64url.encode(new Uint8Array(hash));
+}
+/**
+ * Generate PKCE code verifier and challenge pair
+ *
+ * @param length - Length of the code verifier (43-128 characters, default 64)
+ * @returns PKCE pair containing verifier, challenge, and method
+ * @throws {InvalidCodeVerifierLength} When length is outside the 43-128 character range
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.1 | RFC 7636 §4.1 - Client Creates a Code Verifier}
+ */
+export async function generatePKCE(length = 64) {
+    if (length < 43 || length > 128) {
+        throw new e.InvalidCodeVerifierLength.Error();
+    }
+    const verifier = generateVerifier(length);
+    const challenge = await generateChallenge(verifier, 'S256');
+    return {
+        verifier,
+        challenge,
+        method: 'S256',
+    };
+}
+/**
+ * Validate PKCE code verifier against stored challenge
+ *
+ * @param verifier - Code verifier sent by the client in token request
+ * @param challenge - Code challenge previously stored from authorization request
+ * @param method - Transform method used ('S256' or 'plain', default 'S256')
+ * @returns True if the verifier matches the challenge, false otherwise
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.6 | RFC 7636 §4.6 - Client Sends the Authorization Code and the Code Verifier to the Token Endpoint}
+ */
+export async function validatePKCE(verifier, challenge, method = 'S256') {
+    if (method !== 'S256') {
+        return false;
+    }
+    if (!CODE_VERIFIER_PATTERN.test(verifier)) {
+        return false;
+    }
+    const generatedChallenge = await generateChallenge(verifier, method);
+    // timing safe equals?
+    return generatedChallenge === challenge;
+}
+//# sourceMappingURL=pkce.js.map

package/dist/lib/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/lib/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAwB;IACzE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE;IACpD,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO;QACL,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAAiB,EACjB,SAA2B,MAAM;IAEjC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,sBAAsB;IACtB,OAAO,kBAAkB,KAAK,SAAS,CAAC;AAC1C,CAAC"}