base-idp 1.0.0

package/dist/client.js

@@ -0,0 +1,169 @@
+import { idpError } from "./errors.js";
+export class BaseIdPClient {
+    rawConfig;
+    cfg;
+    metadataCache;
+    keyCache;
+    constructor(rawConfig) {
+        this.rawConfig = rawConfig;
+        if (!rawConfig.key) {
+            throw idpError("invalid_config", "base key is required (set BASE_IDP_KEY)");
+        }
+        if (!rawConfig.issuer) {
+            throw idpError("invalid_config", "issuer is required (set BASE_IDP_ISSUER)");
+        }
+        const fetcher = rawConfig.fetch ?? globalThis.fetch;
+        if (!fetcher) {
+            throw idpError("invalid_config", "fetch is required in this runtime");
+        }
+        this.cfg = {
+            issuer: trimSlash(rawConfig.issuer),
+            key: rawConfig.key,
+            clientId: "",
+            redirectUri: "",
+            scopes: [],
+            audience: "square-experience",
+            fetch: fetcher,
+            clientSecret: rawConfig.secret ?? "",
+            confidential: false,
+            allowedScopes: [],
+            allowedAuthMethods: [],
+            requiredScope: "",
+        };
+    }
+    get issuer() {
+        return this.cfg.issuer;
+    }
+    get clientId() {
+        return this.cfg.clientId;
+    }
+    scopes(value = this.cfg.scopes) {
+        return Array.isArray(value) ? value.filter(Boolean) : value.split(/\s+/).filter(Boolean);
+    }
+    async resolveConfig() {
+        if (this.cfg.clientId)
+            return this.cfg;
+        const response = await this.cfg.fetch(`${this.cfg.issuer}/v1/client-config?key=${encodeURIComponent(this.cfg.key)}`, { headers: { Accept: "application/json" } });
+        const payload = (await response.json().catch(() => ({})));
+        if (!response.ok) {
+            throw idpError("config_discovery_failed", "base idp: config discovery failed", response.status, payload);
+        }
+        this.cfg.issuer = trimSlash(payload.issuer);
+        this.cfg.clientId = payload.client_id;
+        this.cfg.confidential = payload.confidential;
+        this.cfg.allowedScopes = payload.allowed_scopes;
+        this.cfg.allowedAuthMethods = payload.allowed_auth_methods;
+        if (!this.cfg.redirectUri && payload.allowed_redirect_uris.length > 0) {
+            this.cfg.redirectUri = payload.allowed_redirect_uris[0];
+        }
+        if (this.cfg.scopes.length === 0 && payload.allowed_scopes.length > 0) {
+            this.cfg.scopes = payload.allowed_scopes;
+        }
+        return this.cfg;
+    }
+    async discovery(force = false) {
+        if (this.metadataCache && !force)
+            return this.metadataCache;
+        const response = await this.cfg.fetch(`${this.cfg.issuer}/.well-known/square-identity`, {
+            headers: { Accept: "application/json" },
+        });
+        if (!response.ok) {
+            throw idpError("discovery_failed", "idp discovery endpoint rejected the request", response.status);
+        }
+        this.metadataCache = (await response.json());
+        return this.metadataCache;
+    }
+    async publicKeys(force = false) {
+        if (this.keyCache && !force)
+            return this.keyCache;
+        const metadata = await this.discovery();
+        const response = await this.cfg.fetch(metadata.paseto_public_key_endpoint, {
+            headers: { Accept: "application/json" },
+        });
+        if (!response.ok) {
+            throw idpError("key_fetch_failed", "idp public-key endpoint rejected the request", response.status);
+        }
+        this.keyCache = (await response.json());
+        return this.keyCache;
+    }
+    authorizeUrl(options = {}) {
+        if (!this.cfg.clientId) {
+            throw idpError("not_initialized", "client is not initialized; call resolveConfig() or await auto-init");
+        }
+        const url = new URL(`${this.cfg.issuer}/oauth2/authorize`);
+        url.searchParams.set("response_type", options.responseType ?? "code");
+        url.searchParams.set("client_id", this.cfg.clientId);
+        url.searchParams.set("redirect_uri", options.redirectUri ?? this.cfg.redirectUri);
+        url.searchParams.set("scope", this.scopes(options.scopes).join(" "));
+        if (options.state)
+            url.searchParams.set("state", options.state);
+        if (options.nonce)
+            url.searchParams.set("nonce", options.nonce);
+        if (options.authSessionId)
+            url.searchParams.set("auth_session_id", options.authSessionId);
+        if (options.codeChallenge) {
+            url.searchParams.set("code_challenge", options.codeChallenge);
+            url.searchParams.set("code_challenge_method", options.codeChallengeMethod ?? "S256");
+        }
+        for (const [key, value] of Object.entries(options.additionalParameters ?? {})) {
+            if (key && value)
+                url.searchParams.set(key, value);
+        }
+        return url.toString();
+    }
+    async exchangeCode(options) {
+        if (!options.code) {
+            throw idpError("invalid_request", "authorization code is required");
+        }
+        await this.resolveConfig();
+        const metadata = await this.discovery();
+        const body = new URLSearchParams({
+            grant_type: "authorization_code",
+            code: options.code,
+            client_id: this.cfg.clientId,
+            redirect_uri: options.redirectUri ?? this.cfg.redirectUri,
+        });
+        if (this.cfg.clientSecret)
+            body.set("client_secret", this.cfg.clientSecret);
+        if (options.codeVerifier)
+            body.set("code_verifier", options.codeVerifier);
+        return this.postToken(metadata.token_endpoint, body);
+    }
+    async refresh(options) {
+        if (!options.refreshToken) {
+            throw idpError("invalid_request", "refresh token is required");
+        }
+        await this.resolveConfig();
+        const metadata = await this.discovery();
+        const body = new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: options.refreshToken,
+            client_id: this.cfg.clientId,
+        });
+        if (this.cfg.clientSecret)
+            body.set("client_secret", this.cfg.clientSecret);
+        if (options.scopes)
+            body.set("scope", this.scopes(options.scopes).join(" "));
+        return this.postToken(metadata.token_endpoint, body);
+    }
+    async postToken(endpoint, body) {
+        const response = await this.cfg.fetch(endpoint, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body,
+        });
+        const payload = await response.json().catch(() => undefined);
+        if (!response.ok) {
+            throw idpError("token_exchange_failed", "idp token endpoint rejected the request", response.status, payload);
+        }
+        return payload;
+    }
+}
+export { BaseIdPClient as BaseIdpClient };
+function trimSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAcvC,MAAM,OAAO,aAAa;IAMK;IALV,GAAG,CAA2B;IAEzC,aAAa,CAA2B;IACxC,QAAQ,CAAuB;IAEvC,YAA6B,SAAwB;QAAxB,cAAS,GAAT,SAAS,CAAe;QACnD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACnB,MAAM,QAAQ,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,GAAG;YACT,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC;YACnC,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,mBAAmB;YAC7B,KAAK,EAAE,OAAoB;YAC3B,YAAY,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;YACpC,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,EAAE;YACjB,kBAAkB,EAAE,EAAE;YACtB,aAAa,EAAE,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,QAA2B,IAAI,CAAC,GAAG,CAAC,MAAM;QAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QAEvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CACnC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,yBAAyB,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAC7E,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAC5C,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAyB,CAAC;QAClF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,yBAAyB,EAAE,mCAAmC,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK;QAC3B,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAE5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,8BAA8B,EAAE;YACtF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,kBAAkB,EAAE,6CAA6C,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACxE,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,KAAK;QAC5B,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,EAAE;YACzE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,kBAAkB,EAAE,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,YAAY,CAAC,UAA+B,EAAE;QAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC,iBAAiB,EAAE,oEAAoE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC;QACtE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,aAAa;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9E,IAAI,GAAG,IAAI,KAAK;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA6B;QAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,QAAQ,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,YAAY,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW;SAC1D,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;SAC7B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,IAAqB;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI;SACL,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,uBAAuB,EAAE,yCAAyC,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,OAAoB,CAAC;IAC9B,CAAC;CACF;AAED,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,CAAC;AAE1C,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,12 @@
+export declare class BaseIdPError extends Error {
+    readonly code: string;
+    readonly status?: number;
+    readonly details?: unknown;
+    constructor(code: string, message: string, options?: {
+        status?: number;
+        details?: unknown;
+    });
+}
+export declare function idpError(code: string, message: string, status?: number, details?: unknown): BaseIdPError;
+export { BaseIdPError as BaseIdpError };
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO;CAOhG;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,YAAY,CAExG;AAED,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAC"}

package/dist/errors.js

@@ -0,0 +1,17 @@
+export class BaseIdPError extends Error {
+    code;
+    status;
+    details;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = "BaseIdPError";
+        this.code = code;
+        this.status = options.status;
+        this.details = options.details;
+    }
+}
+export function idpError(code, message, status, details) {
+    return new BaseIdPError(code, message, { status, details });
+}
+export { BaseIdPError as BaseIdpError };
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACb,MAAM,CAAU;IAChB,OAAO,CAAW;IAE3B,YAAY,IAAY,EAAE,OAAe,EAAE,UAAkD,EAAE;QAC7F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAe,EAAE,MAAe,EAAE,OAAiB;IACxF,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,OAAO,EAAE,YAAY,IAAI,YAAY,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { BaseIdPClient, BaseIdPClient as BaseIdpClient } from "./client.js";
+export { BaseIdPError, BaseIdPError as BaseIdpError, idpError } from "./errors.js";
+export { generatePKCE } from "./pkce.js";
+export type { AccessClaims, AccountContext, AuthorizeUrlOptions, BaseIdPConfig, BaseIdPConfig as BaseIdpConfig, ClientConfigResponse, PKCEPair, RefreshOptions, ResolvedConfig, BaseIdpIdentityMetadata, BaseIdpPublicKey, BaseIdpPublicKeySet, TokenExchangeOptions, TokenPair, VerifiedPrincipal, VerifyAccessTokenOptions, } from "./types.js";
+export { createReactBaseIdpAuth, } from "./react.js";
+export { createNextBaseIdpAuth, } from "./next.js";
+export { baseIdpConfigFromNodeEnv, createNodeBaseIdpAuth, createExpressMiddleware, createNestBaseIdpGuard, } from "./node.js";
+export { createViteBaseIdpAuth, baseIdpConfigFromViteEnv, } from "./vite.js";
+export { createSvelteKitBaseIdpAuth, } from "./sveltekit.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,YAAY,IAAI,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,aAAa,IAAI,aAAa,EAC9B,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export { BaseIdPClient, BaseIdPClient as BaseIdpClient } from "./client.js";
+export { BaseIdPError, BaseIdPError as BaseIdpError, idpError } from "./errors.js";
+export { generatePKCE } from "./pkce.js";
+export { createReactBaseIdpAuth, } from "./react.js";
+export { createNextBaseIdpAuth, } from "./next.js";
+export { baseIdpConfigFromNodeEnv, createNodeBaseIdpAuth, createExpressMiddleware, createNestBaseIdpGuard, } from "./node.js";
+export { createViteBaseIdpAuth, baseIdpConfigFromViteEnv, } from "./vite.js";
+export { createSvelteKitBaseIdpAuth, } from "./sveltekit.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,YAAY,IAAI,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAmBzC,OAAO,EACL,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC"}

package/dist/next.d.ts

@@ -0,0 +1,19 @@
+import { BaseIdPServerClient } from "./server.js";
+import type { BaseIdPConfig, TokenPair, VerifiedPrincipal } from "./types.js";
+export type NextCallbackContext = {
+    request: Request;
+    tokens: TokenPair;
+    principal: VerifiedPrincipal;
+    state?: string;
+};
+export type NextBaseIdpAuthOptions = {
+    defaultReturnTo?: string;
+    resolveCodeVerifier?: (request: Request, state?: string) => string | Promise<string | undefined> | undefined;
+    onCallback?: (context: NextCallbackContext) => Response | Promise<Response>;
+};
+export declare function createNextBaseIdpAuth(config: BaseIdPConfig, options?: NextBaseIdpAuthOptions): {
+    client: BaseIdPServerClient;
+    login(request: Request): Response;
+    callback(request: Request): Promise<Response>;
+};
+//# sourceMappingURL=next.d.ts.map

package/dist/next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../src/next.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC7G,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,sBAA2B;;mBAI9E,OAAO,GAAG,QAAQ;sBAMT,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;EA0BtD"}

package/dist/next.js

@@ -0,0 +1,39 @@
+import { BaseIdPServerClient } from "./server.js";
+export function createNextBaseIdpAuth(config, options = {}) {
+    const client = new BaseIdPServerClient(config);
+    return {
+        client,
+        login(request) {
+            const requestURL = new URL(request.url);
+            const returnTo = requestURL.searchParams.get("return_to") ?? options.defaultReturnTo;
+            const location = client.authorizeUrl({ state: returnTo ?? undefined });
+            return Response.redirect(location, 302);
+        },
+        async callback(request) {
+            const requestURL = new URL(request.url);
+            const code = requestURL.searchParams.get("code");
+            const state = requestURL.searchParams.get("state") ?? undefined;
+            if (!code) {
+                return Response.json({ error: "missing_code" }, { status: 400 });
+            }
+            const codeVerifier = await options.resolveCodeVerifier?.(request, state);
+            const tokens = await client.exchangeCode({ code, codeVerifier });
+            const principal = await client.verifyAccessToken(tokens.access_token);
+            const context = { request, tokens, principal, state };
+            if (options.onCallback) {
+                return options.onCallback(context);
+            }
+            return Response.json({
+                ok: true,
+                principal: {
+                    id: principal.id,
+                    email: principal.email,
+                    role: principal.role,
+                    scopes: principal.scopes,
+                },
+                state,
+            });
+        },
+    };
+}
+//# sourceMappingURL=next.js.map

package/dist/next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.js","sourceRoot":"","sources":["../src/next.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgBlD,MAAM,UAAU,qBAAqB,CAAC,MAAqB,EAAE,UAAkC,EAAE;IAC/F,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM;QACN,KAAK,CAAC,OAAgB;YACpB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,eAAe,CAAC;YACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,OAAgB;YAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;YAChE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE;oBACT,EAAE,EAAE,SAAS,CAAC,EAAE;oBAChB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,MAAM,EAAE,SAAS,CAAC,MAAM;iBACzB;gBACD,KAAK;aACN,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/node.d.ts

@@ -0,0 +1,60 @@
+import { BaseIdPServerClient } from "./server.js";
+import type { BaseIdPConfig, VerifiedPrincipal, VerifyAccessTokenOptions } from "./types.js";
+export type HeaderBag = Headers | {
+    get?(name: string): string | null | undefined;
+    authorization?: string | string[];
+    Authorization?: string | string[];
+    cookie?: string | string[];
+    Cookie?: string | string[];
+    [key: string]: string | string[] | ((name: string) => string | null | undefined) | undefined;
+};
+export type NodeRequestLike = {
+    headers: HeaderBag;
+    cookies?: Record<string, string | undefined>;
+    user?: unknown;
+    baseIdpPrincipal?: VerifiedPrincipal;
+    baseIdpClaims?: VerifiedPrincipal["claims"];
+};
+export type NodeResponseLike = {
+    statusCode: number;
+    setHeader(name: string, value: string | string[]): void;
+    end(body?: string): void;
+};
+export type NodeNext = (error?: unknown) => void;
+export type ExpressRequestLike = NodeRequestLike & {
+    header?(name: string): string | undefined;
+};
+export type ExpressResponseLike = NodeResponseLike & {
+    status?(statusCode: number): ExpressResponseLike;
+    json?(body: unknown): void;
+};
+export type ExpressNext = NodeNext;
+export type NestExecutionContextLike = {
+    switchToHttp(): {
+        getRequest<T = NodeRequestLike>(): T;
+    };
+};
+export type NodeEnvLike = Record<string, string | undefined>;
+export type NodeBaseIdpAuthOptions = VerifyAccessTokenOptions & {
+    attach?: boolean;
+    attachUser?: boolean;
+    cookieName?: string;
+    errorBody?: boolean;
+};
+export type NodeBaseIdpAuth = ReturnType<typeof createNodeBaseIdpAuth>;
+export declare function baseIdpConfigFromNodeEnv(env?: NodeEnvLike, overrides?: Partial<BaseIdPConfig>): BaseIdPConfig;
+export declare function readHeader(headers: HeaderBag | undefined, name: string): string | null;
+export declare function bearerTokenFromHeaders(headers: HeaderBag): string | null;
+export declare function bearerTokenFromRequest(request: NodeRequestLike, options?: Pick<NodeBaseIdpAuthOptions, "cookieName">): string | null;
+export declare function createNodeBaseIdpAuth(configOrClient: BaseIdPConfig | BaseIdPServerClient): {
+    client: BaseIdPServerClient;
+    verifyRequest(request: NodeRequestLike, options?: NodeBaseIdpAuthOptions): Promise<VerifiedPrincipal>;
+    requireAuth(options?: NodeBaseIdpAuthOptions): (request: NodeRequestLike, response: NodeResponseLike, next: NodeNext) => Promise<void>;
+};
+export declare function createExpressMiddleware(configOrClient: BaseIdPConfig | BaseIdPServerClient, options?: NodeBaseIdpAuthOptions): (request: ExpressRequestLike, response: ExpressResponseLike, next: ExpressNext) => Promise<void>;
+export declare function createNestBaseIdpGuard(configOrClient: BaseIdPConfig | BaseIdPServerClient, options?: NodeBaseIdpAuthOptions): {
+    new (): {
+        canActivate(context: NestExecutionContextLike): Promise<boolean>;
+    };
+};
+//# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE7F,MAAM,MAAM,SAAS,GACjB,OAAO,GACP;IACE,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CAC9F,CAAC;AAEN,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,aAAa,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IACxD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG;IACjD,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG;IACnD,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC;AAEnC,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,IAAI;QACd,UAAU,CAAC,CAAC,GAAG,eAAe,KAAK,CAAC,CAAC;KACtC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE7D,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,GAAG;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEvE,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,WAAyB,EAC9B,SAAS,GAAE,OAAO,CAAC,aAAa,CAAM,GACrC,aAAa,CAOf;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAStF;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAKxE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAM,GAAG,MAAM,GAAG,IAAI,CASxI;AAED,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,mBAAmB;;2BAKxD,eAAe,YAAW,sBAAsB,GAAQ,OAAO,CAAC,iBAAiB,CAAC;0BAa1F,sBAAsB,IAC3B,SAAS,eAAe,EAAE,UAAU,gBAAgB,EAAE,MAAM,QAAQ;EAcvF;AAED,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,aAAa,GAAG,mBAAmB,EAAE,OAAO,GAAE,sBAA2B,IAEjH,SAAS,kBAAkB,EAAE,UAAU,mBAAmB,EAAE,MAAM,WAAW,mBAY5F;AAED,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,aAAa,GAAG,mBAAmB,EAAE,OAAO,GAAE,sBAA2B;;6BAGjG,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAC;;EAMzE"}

package/dist/node.js

@@ -0,0 +1,148 @@
+import { BaseIdPServerClient } from "./server.js";
+import { idpError, BaseIdPError } from "./errors.js";
+export function baseIdpConfigFromNodeEnv(env = process.env, overrides = {}) {
+    return {
+        key: requiredEnv(env, "BASE_IDP_KEY", overrides.key),
+        issuer: requiredEnv(env, "BASE_IDP_ISSUER", overrides.issuer),
+        secret: overrides.secret ?? env.BASE_IDP_CLIENT_SECRET ?? env.BASE_IDP_SECRET,
+        fetch: overrides.fetch,
+    };
+}
+export function readHeader(headers, name) {
+    if (!headers)
+        return null;
+    const getter = typeof headers.get === "function" ? headers.get.bind(headers) : undefined;
+    const fromGetter = getter?.(name) ?? getter?.(name.toLowerCase()) ?? getter?.(name.toUpperCase());
+    if (fromGetter)
+        return fromGetter;
+    const record = headers;
+    const raw = record[name] ?? record[name.toLowerCase()] ?? record[canonicalHeaderName(name)];
+    if (Array.isArray(raw))
+        return raw[0] ?? null;
+    return raw ?? null;
+}
+export function bearerTokenFromHeaders(headers) {
+    const value = readHeader(headers, "authorization");
+    if (!value)
+        return null;
+    const match = value.match(/^Bearer\s+(.+)$/i);
+    return match?.[1]?.trim() || null;
+}
+export function bearerTokenFromRequest(request, options = {}) {
+    const headerToken = bearerTokenFromHeaders(request.headers);
+    if (headerToken)
+        return headerToken;
+    if (!options.cookieName)
+        return null;
+    const directCookie = request.cookies?.[options.cookieName];
+    if (directCookie)
+        return directCookie;
+    const cookieHeader = readHeader(request.headers, "cookie");
+    if (!cookieHeader)
+        return null;
+    return parseCookie(cookieHeader)[options.cookieName] ?? null;
+}
+export function createNodeBaseIdpAuth(configOrClient) {
+    const client = configOrClient instanceof BaseIdPServerClient ? configOrClient : new BaseIdPServerClient(configOrClient);
+    return {
+        client,
+        async verifyRequest(request, options = {}) {
+            const token = bearerTokenFromRequest(request, options);
+            if (!token) {
+                throw idpError("missing_bearer_token", "missing bearer token");
+            }
+            const principal = await client.verifyAccessToken(token, options);
+            if (options.attach !== false) {
+                request.baseIdpPrincipal = principal;
+                request.baseIdpClaims = principal.claims;
+                if (options.attachUser)
+                    request.user = principal;
+            }
+            return principal;
+        },
+        requireAuth(options = {}) {
+            return async (request, response, next) => {
+                try {
+                    await this.verifyRequest(request, options);
+                    next();
+                }
+                catch (error) {
+                    if (options.errorBody === false) {
+                        next(error);
+                        return;
+                    }
+                    writeAuthError(response, error);
+                }
+            };
+        },
+    };
+}
+export function createExpressMiddleware(configOrClient, options = {}) {
+    const auth = createNodeBaseIdpAuth(configOrClient);
+    return async (request, response, next) => {
+        try {
+            await auth.verifyRequest(request, options);
+            next();
+        }
+        catch (error) {
+            if (options.errorBody === false) {
+                next(error);
+                return;
+            }
+            writeAuthError(response, error);
+        }
+    };
+}
+export function createNestBaseIdpGuard(configOrClient, options = {}) {
+    const auth = createNodeBaseIdpAuth(configOrClient);
+    return class BaseIdPNestGuard {
+        async canActivate(context) {
+            const request = context.switchToHttp().getRequest();
+            await auth.verifyRequest(request, options);
+            return true;
+        }
+    };
+}
+function writeAuthError(response, error) {
+    const code = error instanceof BaseIdPError ? error.code : "unauthorized";
+    const statusCode = code === "insufficient_scope" ? 403 : 401;
+    const body = { error: code, error_description: error instanceof Error ? error.message : "unauthorized" };
+    response.setHeader("WWW-Authenticate", `Bearer error="${code}"`);
+    response.setHeader("Content-Type", "application/json");
+    const maybeExpress = response;
+    const status = maybeExpress.status;
+    const json = maybeExpress.json;
+    if (typeof status === "function" && typeof json === "function") {
+        status.call(maybeExpress, statusCode);
+        json.call(maybeExpress, body);
+        return;
+    }
+    response.statusCode = statusCode;
+    response.end(JSON.stringify(body));
+}
+function parseCookie(header) {
+    const out = {};
+    for (const part of header.split(";")) {
+        const idx = part.indexOf("=");
+        if (idx <= 0)
+            continue;
+        const key = part.slice(0, idx).trim();
+        const value = part.slice(idx + 1).trim();
+        if (key)
+            out[key] = decodeURIComponent(value);
+    }
+    return out;
+}
+function requiredEnv(env, name, override) {
+    const value = override ?? env[name];
+    if (!value)
+        throw new Error(`${name} is required`);
+    return value;
+}
+function canonicalHeaderName(name) {
+    return name
+        .split("-")
+        .map((part) => part.slice(0, 1).toUpperCase() + part.slice(1).toLowerCase())
+        .join("-");
+}
+//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0DrD,MAAM,UAAU,wBAAwB,CACtC,MAAmB,OAAO,CAAC,GAAG,EAC9B,YAAoC,EAAE;IAEtC,OAAO;QACL,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC;QACpD,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC;QAC7D,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,eAAe;QAC7E,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAA8B,EAAE,IAAY;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAClG,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9C,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAkB;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAwB,EAAE,UAAsD,EAAE;IACvH,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,WAAW,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,cAAmD;IACvF,MAAM,MAAM,GAAG,cAAc,YAAY,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAExH,OAAO;QACL,MAAM;QACN,KAAK,CAAC,aAAa,CAAC,OAAwB,EAAE,UAAkC,EAAE;YAChF,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;gBACrC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC;gBACzC,IAAI,OAAO,CAAC,UAAU;oBAAE,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;YACnD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,WAAW,CAAC,UAAkC,EAAE;YAC9C,OAAO,KAAK,EAAE,OAAwB,EAAE,QAA0B,EAAE,IAAc,EAAE,EAAE;gBACpF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC3C,IAAI,EAAE,CAAC;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;wBAChC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACZ,OAAO;oBACT,CAAC;oBACD,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,cAAmD,EAAE,UAAkC,EAAE;IAC/H,MAAM,IAAI,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,OAA2B,EAAE,QAA6B,EAAE,IAAiB,EAAE,EAAE;QAC7F,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,cAAmD,EAAE,UAAkC,EAAE;IAC9H,MAAM,IAAI,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,MAAM,gBAAgB;QAC3B,KAAK,CAAC,WAAW,CAAC,OAAiC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;YACrE,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgD,EAAE,KAAc;IACtF,MAAM,IAAI,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IACzG,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE,iBAAiB,IAAI,GAAG,CAAC,CAAC;IACjE,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,QAA+B,CAAC;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,CAAC;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAgB,EAAE,IAAY,EAAE,QAAiB;IACpE,MAAM,KAAK,GAAG,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC3E,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC"}

package/dist/paseto.d.ts

@@ -0,0 +1,15 @@
+import type { BaseIdpPublicKeySet, VerifiedPrincipal, VerifyAccessTokenOptions } from "./types.js";
+type Footer = {
+    kid?: string;
+    alg?: string;
+    typ?: string;
+};
+export declare function unsafeFooter(token: string): Footer;
+export declare function unsafeFooterKid(token: string): string | undefined;
+export declare function verifyPasetoV4Public(token: string, keySet: BaseIdpPublicKeySet, config: {
+    issuer: string;
+    audience?: string;
+    requiredScope?: string;
+}, options?: VerifyAccessTokenOptions): VerifiedPrincipal;
+export {};
+//# sourceMappingURL=paseto.d.ts.map

package/dist/paseto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paseto.d.ts","sourceRoot":"","sources":["../src/paseto.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAgC,mBAAmB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAMjI,KAAK,MAAM,GAAG;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,EACrE,OAAO,GAAE,wBAA6B,GACrC,iBAAiB,CAsDnB"}