@udibo/oauth2 0.14.0 → 0.15.0

package/README.md

@@ -16,7 +16,7 @@ run locally without a hosted account.
 | Udibo to handle sign-in                     | [Use Udibo's identity service](docs/guides/use-udibo.md) — requires a Udibo account                                       |
 | Its own login and authorization server      | [Run the quickstart](docs/quickstart.md), then [host authorization for your app](docs/guides/become-an-oauth-provider.md) |
 | An API that accepts access tokens           | [Protect an API](docs/guides/protect-an-api.md)                                                                           |
-| A React application with server-held tokens | [Juniper starter](templates/juniper/README.md) or [React Router starter](templates/react-router/README.md)                |
+| A React application with server-held tokens | [React Router starter](templates/react-router/README.md)                                                                  |
 
 [Documentation index](docs/index.md) ·
 [API reference](https://jsr.io/@udibo/oauth2/doc) · [Examples](#examples) ·
@@ -24,12 +24,29 @@ run locally without a hosted account.
 
 ## Install
 
-Requires Deno 2 for the development workflow:
+The package supports Node.js 22 and later and ships ESM with type declarations.
+Install it from npm:
 
 ```sh
+npm install @udibo/oauth2
+# or
+pnpm add @udibo/oauth2
+```
+
+It is also published to [JSR](https://jsr.io/@udibo/oauth2) as TypeScript
+source:
+
+```sh
+npx jsr add @udibo/oauth2
+# or, with Deno
 deno add jsr:@udibo/oauth2
 ```
 
+`hono`, `react`, and `react-dom` are optional peer dependencies. Install the
+ones for the entrypoints you import: `hono` for the `/hono/*` adapters, `react`
+and `react-dom` for `/react` and `/react/components`. `vitest` is an optional
+peer dependency of the testing helpers.
+
 Import the part you use; there is no root barrel or default export:
 
 ```ts
@@ -83,11 +100,12 @@ package does not include a challenge provider; see the
 
 ## Examples
 
-From a checkout of this repository:
+From a checkout of this repository, with Node.js 24.2 or later and pnpm:
 
 ```sh
-deno ci
-deno task serve:app-with-own-auth
+pnpm install
+pnpm build
+pnpm --filter example-app-with-own-auth start
 ```
 
 Open <http://localhost:8001/> and sign in as `user` / `password`. The
@@ -95,13 +113,11 @@ Open <http://localhost:8001/> and sign in as `user` / `password`. The
 All demo credentials, in-memory stores, and local HTTP settings are for
 development.
 
-| Example                                                                         | Demonstrates                                                    |
-| ------------------------------------------------------------------------------- | --------------------------------------------------------------- |
-| [Hono with own auth](examples/hono/app-with-own-auth/README.md)                 | App login, OAuth2 server, BFF, and protected API in one process |
-| [Hono with external auth](examples/hono/app-with-external-auth/README.md)       | Delegated sign-in, token introspection, and a BFF proxy         |
-| [Standalone API](examples/hono/api-service/README.md)                           | Bearer-token validation without a frontend                      |
-| [Juniper with own auth](examples/juniper/app-with-own-auth/README.md)           | Server-rendered React with application-owned login              |
-| [Juniper with external auth](examples/juniper/app-with-external-auth/README.md) | Server-rendered React with delegated sign-in                    |
+| Example                                                                   | Demonstrates                                                    |
+| ------------------------------------------------------------------------- | --------------------------------------------------------------- |
+| [Hono with own auth](examples/hono/app-with-own-auth/README.md)           | App login, OAuth2 server, BFF, and protected API in one process |
+| [Hono with external auth](examples/hono/app-with-external-auth/README.md) | Delegated sign-in, token introspection, and a BFF proxy         |
+| [Standalone API](examples/hono/api-service/README.md)                     | Bearer-token validation without a frontend                      |
 
 ## Package entrypoints
 
@@ -128,7 +144,6 @@ and examples in the [reference](https://jsr.io/@udibo/oauth2/doc).
 | `/react/components`          | Optional forms for login, signup, password reset, and MFA                                       |
 | `/crypto`                    | Random tokens, hashing, encoding, authenticated encryption                                      |
 | `/url`                       | Safe return paths and login continuation                                                        |
-| `/cli`                       | Local test identity provider and OIDC signing-key generation                                    |
 | `/testing`                   | In-memory fixtures and authorization-server test helpers                                        |
 | `/testing/contract`          | Tests for app-owned service and storage implementations                                         |
 | `/hono/bff/testing`          | BFF session fixtures and session-store contract tests                                           |
@@ -136,17 +151,23 @@ and examples in the [reference](https://jsr.io/@udibo/oauth2/doc).
 
 ## Runtime support
 
-The library uses Web APIs. The complete suite runs on Deno. CI also builds an
-npm-format compatibility artifact and verifies 20 entrypoints with TypeScript
-and Node; this does not publish an npm package.
+The library uses Web APIs and runs on Node.js 22 and later. CI runs the
+complete suite on Node 22, 24, and 26 on Linux, and on Node 26 on Windows and
+macOS. It also packs the npm tarball, installs it into an empty project, type
+checks a consumer of every entrypoint, and imports each one on Node.
+
+| Surface                                                                | Node 22+              | Browser                                     | Deno, Bun     |
+| ---------------------------------------------------------------------- | --------------------- | ------------------------------------------- | ------------- |
+| `/client`, `/react`, `/react/components`                               | Tested, including SSR | Intended for client code; no secrets        | Not verified  |
+| `/server/*`, `/identity/*`, `/hono/*`, `/crypto`, `/url`               | Tested                | Server functionality belongs on the backend | Not verified  |
+| `/testing`, `/testing/contract`, `/hono/bff/testing`, `/react/testing` | Tested; need Vitest   | Not supported                               | Not verified  |
+| `udibo-oauth2` command (`bin`)                                         | Tested                | Not supported                               | Not supported |
 
-| Surface                                     | Deno                  | Node                     | Browser                                     | Bun           |
-| ------------------------------------------- | --------------------- | ------------------------ | ------------------------------------------- | ------------- |
-| Clients and React                           | Tested, including SSR | Import/type smoke-tested | Intended for client code; no secrets        | Not verified  |
-| Server, identity, Hono, crypto, URL helpers | Tested                | Import/type smoke-tested | Server functionality belongs on the backend | Not verified  |
-| `/hono/bff/testing`, `/react/testing`       | Tested                | Import/type smoke-tested | React test helpers only                     | Not verified  |
-| `/testing`, `/testing/contract`             | Tested                | Not verified             | Not supported                               | Not verified  |
-| `/cli`                                      | Deno only             | Not supported            | Not supported                               | Not supported |
+The `udibo-oauth2` command is a development tool: `udibo-oauth2 oidc keygen`
+prints an OIDC signing key, and `udibo-oauth2 idp dev` runs a local identity
+provider. Run it with `npx udibo-oauth2` once the package is installed; the
+[local identity provider guide](docs/guides/run-a-local-identity-provider.md)
+covers its options. Nothing on the library path imports it.
 
 See [stability](docs/stability.md#runtime-support) for the support boundary.
 
@@ -173,7 +194,7 @@ implementing a custom store or callback.
 
 ## Contributing and security
 
-Run `deno task check` and `deno task test:all` before proposing changes. See
+Run `pnpm check` and `pnpm test` before proposing changes. See
 [CONTRIBUTING.md](CONTRIBUTING.md) for development conventions,
 [SECURITY.md](SECURITY.md) for private vulnerability reports, and
 [CHANGELOG.md](CHANGELOG.md) for release history.

package/{esm → dist}/adapters/hono/_common.d.ts

@@ -8,11 +8,11 @@
  * @module
  */
 import type { Context, MiddlewareHandler } from "hono";
-import type { ClientInterface } from "../../models/client.js";
-import type { RequireConditions } from "../../models/authorization.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { AuthenticatedContext } from "../../server/resource-server.js";
-import { ResourceServer } from "../../server/resource-server.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { RequireConditions } from "../../models/authorization.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { AuthenticatedContext } from "../../server/resource-server.ts";
+import { ResourceServer } from "../../server/resource-server.ts";
 /**
  * Key under which the authenticated OAuth2 context is stored on the Hono
  * context. Namespaced to avoid collisions with other middleware.

package/{esm → dist}/adapters/hono/_common.js

@@ -79,7 +79,7 @@ export function authenticateHonoRequest(server, c, requiredScope) {
 }
 // Base method on purpose: the Hono subclasses' override would recurse.
 function baseAuthenticate(server, request, requiredScope) {
-    // deno-lint-ignore no-explicit-any
+    // oxlint-disable-next-line typescript/no-explicit-any
     const base = ResourceServer.prototype;
     return base.authenticate.call(server, request, requiredScope);
 }

package/{esm → dist}/adapters/hono/authorization-server.d.ts

@@ -32,15 +32,14 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 import { Hono } from "hono";
 import type { Context, Handler, MiddlewareHandler } from "hono";
-import type { RequireConditions } from "../../models/authorization.js";
-import type { AuthenticationContext } from "../../models/authentication.js";
-import type { ClientInterface } from "../../models/client.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import { AuthorizationServer, type AuthorizationServerOptions } from "../../server/authorization-server.js";
-import type { AuthenticatedContext } from "../../server/resource-server.js";
+import type { RequireConditions } from "../../models/authorization.ts";
+import type { AuthenticationContext } from "../../models/authentication.ts";
+import type { ClientInterface } from "../../models/client.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import { AuthorizationServer, type AuthorizationServerOptions } from "../../server/authorization-server.ts";
+import type { AuthenticatedContext } from "../../server/resource-server.ts";
 /**
  * Authenticates the resource owner during an authorization request.
  *

package/{esm → dist}/adapters/hono/authorization-server.js

@@ -32,7 +32,6 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 import { Hono } from "hono";
 import { AuthorizationServer, ENDPOINT_METHODS, ENDPOINT_PATHS, } from "../../server/authorization-server.js";
 import { authenticateHonoRequest, createProtectMiddleware, createRequireMiddleware, createRequireScopeMiddleware, readContext, } from "./_common.js";

package/{esm → dist}/adapters/hono/bff/auth-request-store.d.ts

@@ -27,7 +27,7 @@
  * @module
  */
 import type { Context } from "hono";
-import type { AuthRequestStorage } from "../../../client/mod.js";
+import type { AuthRequestStorage } from "../../../client/mod.ts";
 /**
  * Cookie attributes for the pending-authorization cookie.
  *
@@ -161,7 +161,7 @@ export declare class EncryptedCookieAuthRequestStorage implements AuthRequestSto
  * import { encryptedCookieAuthRequestStorage } from "@udibo/oauth2/hono/bff";
  *
  * const authRequestStorage = encryptedCookieAuthRequestStorage({
- *   secret: Deno.env.get("SESSION_SECRET")!,
+ *   secret: process.env.SESSION_SECRET!,
  * });
  * ```
  */

package/{esm → dist}/adapters/hono/bff/auth-request-store.js

@@ -96,7 +96,7 @@ export class EncryptedCookieAuthRequestStorage {
         this.#maxPending = options.maxPending ?? DEFAULT_MAX_PENDING;
     }
     #key() {
-        return this.#keyPromise ??= deriveAesKey(this.#secret);
+        return (this.#keyPromise ??= deriveAesKey(this.#secret));
     }
     async #read(c) {
         const cookieValue = getCookie(c, this.#name);
@@ -149,7 +149,7 @@ export class EncryptedCookieAuthRequestStorage {
  * import { encryptedCookieAuthRequestStorage } from "@udibo/oauth2/hono/bff";
  *
  * const authRequestStorage = encryptedCookieAuthRequestStorage({
- *   secret: Deno.env.get("SESSION_SECRET")!,
+ *   secret: process.env.SESSION_SECRET!,
  * });
  * ```
  */

package/{esm → dist}/adapters/hono/bff/bff.d.ts

@@ -49,14 +49,14 @@
  */
 import { Hono } from "hono";
 import type { Context, Handler, MiddlewareHandler } from "hono";
-import type { DirectClient, SessionState, TokenBundle, UserInfoClaims } from "../../../client/mod.js";
-import type { ClientInterface } from "../../../models/client.js";
-import type { AbstractScope, BasicScope } from "../../../models/scope.js";
-import type { HonoAuthorizationServer } from "../authorization-server.js";
-import type { HonoResourceServer } from "../resource-server.js";
-import type { AuthRequestStorageFactory } from "./auth-request-store.js";
-import { type SessionStore } from "./session-store.js";
-import { type HonoBffProxyOptions } from "./proxy.js";
+import type { DirectClient, SessionState, TokenBundle, UserInfoClaims } from "../../../client/mod.ts";
+import type { ClientInterface } from "../../../models/client.ts";
+import type { AbstractScope, BasicScope } from "../../../models/scope.ts";
+import type { HonoAuthorizationServer } from "../authorization-server.ts";
+import type { HonoResourceServer } from "../resource-server.ts";
+import type { AuthRequestStorageFactory } from "./auth-request-store.ts";
+import { type SessionStore } from "./session-store.ts";
+import { type HonoBffProxyOptions } from "./proxy.ts";
 /**
  * A resource server the BFF can compose with `attachToken()` to expose a
  * single `bff.protect()` middleware.
@@ -374,10 +374,20 @@ export interface HonoBffOptions {
      * Who owns the BFF's session record. Defaults to `"own"`.
      *
      * - `"own"` (default): the BFF creates and owns its session at
-     *   `/auth/callback` — it always mints a fresh id (`sessionStore.create`)
-     *   and ignores any inbound cookie. Use when the app has no session here
-     *   until the OAuth flow completes: standalone BFFs, or apps whose login
-     *   lives on a separate / external IDP.
+     *   `/auth/callback` — it always mints a fresh id (`sessionStore.create`).
+     *   A session the inbound cookie names is replaced: once the code exchange
+     *   and `resolveUser` succeed, the BFF destroys it (`sessionStore.destroy`)
+     *   before creating the new one, so signing in again in the same browser —
+     *   switching organization, a step-up — never leaves the earlier session
+     *   readable beside the new one. Its refresh token is not revoked: an
+     *   authorization server may extend a revocation to other tokens of the
+     *   same grant or sign-in (RFC 7009 §2.1), the new ones included.
+     *   A callback the authorization server refuses, or whose state check,
+     *   code exchange or `resolveUser` fails, leaves the existing session as
+     *   it was; a store failure while creating the replacement leaves the
+     *   browser signed out. Use when the app has no session here until the
+     *   OAuth flow completes: standalone BFFs, or apps whose login lives on a
+     *   separate / external IDP.
      * - `"shared"`: the app already created the session at its own login step,
      *   and the BFF **attaches** tokens to that existing session at
      *   `/auth/callback` (via `sessionStore.update`) instead of creating its

package/{esm → dist}/adapters/hono/bff/bff.js

@@ -84,8 +84,7 @@ function resolvePaths(paths = {}, options) {
     };
     if (basePath === "")
         return resolved;
-    const stray = BFF_PATH_KEYS
-        .filter((key) => key !== "backchannel" || options.backchannelMounted)
+    const stray = BFF_PATH_KEYS.filter((key) => key !== "backchannel" || options.backchannelMounted)
         .filter((key) => !resolved[key].startsWith(`${basePath}/`))
         .map((key) => `${key} ("${resolved[key]}")`);
     if (stray.length > 0) {
@@ -325,8 +324,8 @@ export class HonoBff {
         });
         this.#cookieName = sessionCookieName(options.cookie);
         this.#loginStateCookieName = loginStateCookieName(options.cookie);
-        this.#loginStateTtlMs = options.loginStateTtlMs ??
-            DEFAULT_LOGIN_STATE_TTL_MS;
+        this.#loginStateTtlMs =
+            options.loginStateTtlMs ?? DEFAULT_LOGIN_STATE_TTL_MS;
         this.#sessionMode = options.sessionMode ?? "own";
         this.#csrf = resolveCsrf(options.csrf);
         this.#extraAuthorizeParams = resolveExtraAuthorizeParams(options);
@@ -334,16 +333,17 @@ export class HonoBff {
         this.#sessionMaxAgeMs = sessionMaxAgeMs;
         if (this.#sessionMode === "shared") {
             const maxAge = options.cookie?.maxAge;
-            this.#cookieMaxAgeSeconds = maxAge === undefined || maxAge === "session"
-                ? undefined
-                : positiveSeconds(maxAge, "cookie.maxAge");
+            this.#cookieMaxAgeSeconds =
+                maxAge === undefined || maxAge === "session"
+                    ? undefined
+                    : positiveSeconds(maxAge, "cookie.maxAge");
         }
         else {
-            const configuredMaxAge = options.cookie?.maxAge ??
-                Math.ceil(sessionMaxAgeMs / 1000);
-            this.#cookieMaxAgeSeconds = configuredMaxAge === "session"
-                ? undefined
-                : positiveSeconds(configuredMaxAge, "cookie.maxAge");
+            const configuredMaxAge = options.cookie?.maxAge ?? Math.ceil(sessionMaxAgeMs / 1000);
+            this.#cookieMaxAgeSeconds =
+                configuredMaxAge === "session"
+                    ? undefined
+                    : positiveSeconds(configuredMaxAge, "cookie.maxAge");
             if (this.#cookieMaxAgeSeconds !== undefined) {
                 const storeMaxAgeMs = sessionStoreMaxAgeMs(this.#store);
                 const sessionSeconds = Math.ceil(Math.max(sessionMaxAgeMs, storeMaxAgeMs ?? 0) / 1000);
@@ -611,7 +611,10 @@ export class HonoBff {
             const params = new URL(c.req.url).searchParams;
             const fail = (error) => this.#options.onCallbackError
                 ? this.#options.onCallbackError(c, error)
-                : c.json({ error: error.error, error_description: error.error_description }, 400);
+                : c.json({
+                    error: error.error,
+                    error_description: error.error_description,
+                }, 400);
             if (params.get("error")) {
                 return await fail({
                     error: params.get("error"),
@@ -637,8 +640,7 @@ export class HonoBff {
             this.#writeLoginStateHashes(c, pendingStates.filter((_, index) => index !== matched));
             try {
                 const origin = this.#options.resolveOrigin?.(c);
-                const { tokens, refreshToken, returnTo, raw } = await this.#client
-                    .exchangeAuthorizationCode(code, state, {
+                const { tokens, refreshToken, returnTo, raw } = await this.#client.exchangeAuthorizationCode(code, state, {
                     origin,
                     redirectUri: this.#derivedRedirectUri(c, origin),
                     authRequestStorage: this.#options.authRequestStorage?.forRequest(c),
@@ -670,9 +672,10 @@ export class HonoBff {
                     createdAt: now,
                     updatedAt: now,
                 };
-                const existing = this.#sessionMode === "shared"
-                    ? getCookie(c, this.#cookieName)
-                    : undefined;
+                const inbound = getCookie(c, this.#cookieName);
+                const existing = this.#sessionMode === "shared" ? inbound : undefined;
+                if (inbound && !existing)
+                    await this.#store.destroy(inbound);
                 const cookieValue = existing
                     ? await this.#store.update(existing, data)
                     : await this.#store.create(data);
@@ -723,8 +726,7 @@ export class HonoBff {
             if (this.#options.rpInitiatedLogout) {
                 const endSession = this.#client.endSessionEndpoint;
                 if (endSession) {
-                    const origin = this.#options.resolveOrigin?.(c) ??
-                        new URL(c.req.url).origin;
+                    const origin = this.#options.resolveOrigin?.(c) ?? new URL(c.req.url).origin;
                     const url = new URL(endSession, origin);
                     if (idToken)
                         url.searchParams.set("id_token_hint", idToken);
@@ -879,7 +881,8 @@ export class HonoBff {
             catch {
                 subject = null;
             }
-            if (!subject || (subject.sub === undefined && subject.sid === undefined)) {
+            if (!subject ||
+                (subject.sub === undefined && subject.sid === undefined)) {
                 return c.json({
                     error: "invalid_request",
                     error_description: "invalid logout_token",
@@ -1088,7 +1091,9 @@ export class HonoBff {
             try {
                 const inboundAuth = c.req.header("Authorization") ?? "";
                 const hasBearer = /^bearer\s+\S/i.test(inboundAuth);
-                if (!hasBearer && this.#csrf && this.#hasSessionCookie(c) &&
+                if (!hasBearer &&
+                    this.#csrf &&
+                    this.#hasSessionCookie(c) &&
                     !this.#csrfHeaderOk(c)) {
                     return this.#csrfReject(c);
                 }
@@ -1202,7 +1207,7 @@ export class HonoBff {
         const retryOn401 = options.retryOn401 ?? true;
         const mountPrefix = (options.stripPrefix ?? "").endsWith("/")
             ? options.stripPrefix.slice(0, -1)
-            : options.stripPrefix ?? "";
+            : (options.stripPrefix ?? "");
         return async (c) => {
             if (this.#csrf && this.#hasSessionCookie(c) && !this.#csrfHeaderOk(c)) {
                 return this.#csrfReject(c);
@@ -1243,8 +1248,7 @@ export class HonoBff {
                     cause,
                 }));
             }
-            const canRetry = retryOn401 && body === null &&
-                entry.data.refreshToken !== undefined;
+            const canRetry = retryOn401 && body === null && entry.data.refreshToken !== undefined;
             if (canRetry && isInvalidTokenChallenge(response)) {
                 await response.body?.cancel();
                 const outcome = await this.#refreshSessionEntry(c, entry);
@@ -1272,10 +1276,12 @@ export class HonoBff {
                     mountPrefix,
                 }),
             };
-            return downstream === null ? c.body(null, init) : c.body(downstream, {
-                ...init,
-                status: response.status,
-            });
+            return downstream === null
+                ? c.body(null, init)
+                : c.body(downstream, {
+                    ...init,
+                    status: response.status,
+                });
         };
     }
 }

package/{esm → dist}/adapters/hono/bff/cookie-prefix.js

@@ -79,7 +79,6 @@ export function resolveCookieName(resolution) {
         assertCookiePrefixSatisfiable(name, attributes, consequence);
         return name;
     }
-    const hostPrefixOk = attributes.secure && attributes.path === "/" &&
-        !attributes.domain;
+    const hostPrefixOk = attributes.secure && attributes.path === "/" && !attributes.domain;
     return hostPrefixOk ? `__Host-${base}` : base;
 }

package/{esm → dist}/adapters/hono/bff/mod.d.ts

@@ -6,14 +6,13 @@
  * {@link SessionStore} contract and two ready-to-use implementations
  * ({@link MemorySessionStore}, {@link EncryptedCookieSessionStore}).
  *
- * Need a server-side store (Postgres, Redis, Deno KV, …)? Implement the
+ * Need a server-side store (Postgres, Redis, …)? Implement the
  * {@link SessionStore} interface and verify it with
  * `runSessionStoreContractTests` from `@udibo/oauth2/hono/bff/testing`.
  *
  * @module
  */
-import "../../../_dnt.polyfills.js";
-export { type BackchannelLogoutSubject, type BffCallbackError, HonoBff, type HonoBffBackchannelOptions, type HonoBffCookieOptions, type HonoBffCsrfOptions, type HonoBffOptions, type HonoBffPaths, type HonoBffResourceServer, } from "./bff.js";
-export { type AuthRequestCookieOptions, type AuthRequestStorageFactory, EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, type EncryptedCookieAuthRequestStorageOptions, } from "./auth-request-store.js";
-export { DEFAULT_PROXY_FORWARD_HEADERS, type HonoBffProxyOptions, } from "./proxy.js";
-export { type BackchannelLogoutStore, type BoundedSessionStore, DEFAULT_SESSION_MAX_AGE_MS, EncryptedCookieSessionStore, type EncryptedCookieSessionStoreOptions, MemorySessionStore, type SessionData, type SessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.js";
+export { type BackchannelLogoutSubject, type BffCallbackError, HonoBff, type HonoBffBackchannelOptions, type HonoBffCookieOptions, type HonoBffCsrfOptions, type HonoBffOptions, type HonoBffPaths, type HonoBffResourceServer, } from "./bff.ts";
+export { type AuthRequestCookieOptions, type AuthRequestStorageFactory, EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, type EncryptedCookieAuthRequestStorageOptions, } from "./auth-request-store.ts";
+export { DEFAULT_PROXY_FORWARD_HEADERS, type HonoBffProxyOptions, } from "./proxy.ts";
+export { type BackchannelLogoutStore, type BoundedSessionStore, DEFAULT_SESSION_MAX_AGE_MS, EncryptedCookieSessionStore, type EncryptedCookieSessionStoreOptions, MemorySessionStore, type SessionData, type SessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.ts";

package/{esm → dist}/adapters/hono/bff/mod.js

@@ -6,13 +6,12 @@
  * {@link SessionStore} contract and two ready-to-use implementations
  * ({@link MemorySessionStore}, {@link EncryptedCookieSessionStore}).
  *
- * Need a server-side store (Postgres, Redis, Deno KV, …)? Implement the
+ * Need a server-side store (Postgres, Redis, …)? Implement the
  * {@link SessionStore} interface and verify it with
  * `runSessionStoreContractTests` from `@udibo/oauth2/hono/bff/testing`.
  *
  * @module
  */
-import "../../../_dnt.polyfills.js";
 export { HonoBff, } from "./bff.js";
 export { EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, } from "./auth-request-store.js";
 export { DEFAULT_PROXY_FORWARD_HEADERS, } from "./proxy.js";

package/{esm → dist}/adapters/hono/bff/proxy.js

@@ -151,7 +151,8 @@ function forcePrivateCache(headers) {
     const directives = existing
         .split(",")
         .map((directive) => directive.trim().toLowerCase());
-    if (directives.some((directive) => directive === "private" || directive === "no-store" ||
+    if (directives.some((directive) => directive === "private" ||
+        directive === "no-store" ||
         directive.startsWith("private="))) {
         return;
     }

package/{esm → dist}/adapters/hono/bff/session-store.d.ts

@@ -23,7 +23,7 @@
  *
  * @module
  */
-import type { TokenBundle, UserInfoClaims } from "../../../client/mod.js";
+import type { TokenBundle, UserInfoClaims } from "../../../client/mod.ts";
 /** The data a BFF persists per session. */
 export interface SessionData {
     /** The current token bundle (access token + expiry + scope + id_token). */
@@ -211,7 +211,7 @@ export interface EncryptedCookieSessionStoreOptions {
  * // Deploy with the new secret first, the old one second: new cookies seal
  * // under NEW, cookies still sealed under OLD keep unsealing until you drop it.
  * const store = new EncryptedCookieSessionStore({
- *   secret: [Deno.env.get("SESSION_SECRET")!, Deno.env.get("SESSION_SECRET_OLD")!],
+ *   secret: [process.env.SESSION_SECRET!, process.env.SESSION_SECRET_OLD!],
  *   maxAgeMs: 7 * 24 * 60 * 60 * 1000,
  * });
  * ```

package/{esm → dist}/adapters/hono/bff/session-store.js

@@ -27,8 +27,8 @@ import { InvalidGrantError } from "../../../errors.js";
 import { deriveAesKey, sealJson, unsealJson } from "../../../utils/crypto.js";
 /** Whether a store implements the {@link BackchannelLogoutStore} capability. */
 export function supportsBackchannelLogout(store) {
-    return typeof store.destroyByLogout ===
-        "function";
+    return (typeof store.destroyByLogout ===
+        "function");
 }
 /**
  * Default session lifetime — 14 days — shared by
@@ -102,10 +102,11 @@ export class MemorySessionStore {
     }
 }
 function isSealedSession(value) {
-    return typeof value === "object" && value !== null &&
+    return (typeof value === "object" &&
+        value !== null &&
         typeof value.issuedAt === "number" &&
         typeof value.data === "object" &&
-        value.data !== null;
+        value.data !== null);
 }
 /**
  * Stateless session store. The cookie value is the AES-GCM-encrypted
@@ -131,7 +132,7 @@ function isSealedSession(value) {
  * // Deploy with the new secret first, the old one second: new cookies seal
  * // under NEW, cookies still sealed under OLD keep unsealing until you drop it.
  * const store = new EncryptedCookieSessionStore({
- *   secret: [Deno.env.get("SESSION_SECRET")!, Deno.env.get("SESSION_SECRET_OLD")!],
+ *   secret: [process.env.SESSION_SECRET!, process.env.SESSION_SECRET_OLD!],
  *   maxAgeMs: 7 * 24 * 60 * 60 * 1000,
  * });
  * ```
@@ -175,7 +176,7 @@ export class EncryptedCookieSessionStore {
         return this.#maxAgeMs;
     }
     #key(index) {
-        return this.#keyPromises[index] ??= deriveAesKey(this.#secrets[index]);
+        return (this.#keyPromises[index] ??= deriveAesKey(this.#secrets[index]));
     }
     /** Encrypts the session into the cookie value under the current secret; there is no server-side record. */
     async create(data) {

package/{esm → dist}/adapters/hono/bff/testing.d.ts

@@ -14,13 +14,12 @@
  *
  * @module
  */
-import "../../../_dnt.polyfills.js";
-import type { ClientInterface } from "../../../models/client.js";
-import type { AbstractScope } from "../../../models/scope.js";
-import type { TokenServiceInterface } from "../../../server/services/token.js";
-import type { TokenBundle, UserInfoClaims } from "../../../client/mod.js";
-import type { HonoBff } from "./bff.js";
-import { type SessionData, type SessionStore } from "./session-store.js";
+import type { ClientInterface } from "../../../models/client.ts";
+import type { AbstractScope } from "../../../models/scope.ts";
+import type { TokenServiceInterface } from "../../../server/services/token.ts";
+import type { TokenBundle, UserInfoClaims } from "../../../client/mod.ts";
+import type { HonoBff } from "./bff.ts";
+import { type SessionData, type SessionStore } from "./session-store.ts";
 /** Options for {@link createTestSession}. */
 export interface CreateTestSessionOptions {
     /**
@@ -168,7 +167,7 @@ export interface SessionStoreContractOptions {
 }
 /**
  * Contract test suite for {@link SessionStore} implementations. Registers
- * `describe`/`it` blocks from `@std/testing/bdd`, so call it at a test
+ * `describe`/`it` blocks from Vitest, so call it at a test
  * module's top level. It does not check that a stateful store's `update`
  * rejects a missing or destroyed session, which {@link SessionStore.update}
  * requires — test that yourself.