base-idp 1.0.0

package/dist/paseto.js

@@ -0,0 +1,103 @@
+import { createPublicKey, verify as verifySignature } from "node:crypto";
+import { base64UrlDecode, concatBytes, utf8Decode, utf8Encode } from "./base64url.js";
+import { idpError } from "./errors.js";
+const HEADER = utf8Encode("v4.public.");
+const IMPLICIT_ASSERTION = utf8Encode("square-experience:idp:access:v1");
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+export function unsafeFooter(token) {
+    const parts = token.split(".");
+    if (parts.length !== 4 || parts[0] !== "v4" || parts[1] !== "public") {
+        throw idpError("invalid_token", "token is not PASETO v4.public");
+    }
+    return JSON.parse(utf8Decode(base64UrlDecode(parts[3])));
+}
+export function unsafeFooterKid(token) {
+    return unsafeFooter(token).kid;
+}
+export function verifyPasetoV4Public(token, keySet, config, options = {}) {
+    const parts = token.split(".");
+    if (parts.length !== 4 || parts[0] !== "v4" || parts[1] !== "public") {
+        throw idpError("invalid_token", "token is not PASETO v4.public");
+    }
+    const payload = base64UrlDecode(parts[2]);
+    const footerBytes = base64UrlDecode(parts[3]);
+    if (payload.length <= 64) {
+        throw idpError("invalid_token", "PASETO payload is too short");
+    }
+    const footer = JSON.parse(utf8Decode(footerBytes));
+    if (footer.alg !== "v4.public" || footer.typ !== "paseto" || !footer.kid) {
+        throw idpError("invalid_token", "PASETO footer is not a BaseIdP v4.public footer");
+    }
+    const publicKey = keySet.keys.find((key) => key.kid === footer.kid && key.alg === "v4.public");
+    if (!publicKey) {
+        throw idpError("unknown_kid", "PASETO key id is not present in the Base key set");
+    }
+    const message = payload.subarray(0, payload.length - 64);
+    const signature = payload.subarray(payload.length - 64);
+    const rawPublicKey = base64UrlDecode(publicKey.public_key_base64);
+    if (rawPublicKey.length !== 32 || signature.length !== 64) {
+        throw idpError("invalid_key", "Ed25519 public key or signature has an invalid size");
+    }
+    const spki = Buffer.concat([ED25519_SPKI_PREFIX, Buffer.from(rawPublicKey)]);
+    const keyObject = createPublicKey({ key: spki, format: "der", type: "spki" });
+    const pae = preAuthEncode([HEADER, message, footerBytes, IMPLICIT_ASSERTION]);
+    if (!verifySignature(null, Buffer.from(pae), keyObject, Buffer.from(signature))) {
+        throw idpError("invalid_signature", "PASETO signature verification failed");
+    }
+    const claims = JSON.parse(utf8Decode(message));
+    validateClaims(claims, {
+        issuer: options.issuer ?? config.issuer,
+        audience: options.audience ?? config.audience ?? "square-experience",
+        requiredScope: options.requiredScope ?? config.requiredScope,
+        maxClockSkewSeconds: options.maxClockSkewSeconds ?? 30,
+    });
+    return {
+        id: claims.gid,
+        subject: claims.sub,
+        email: claims.email,
+        name: claims.name,
+        role: claims.role,
+        scopes: claims.scp ?? [],
+        accountContext: claims.ctx,
+        claims,
+    };
+}
+function validateClaims(claims, options) {
+    if (claims.token_use !== "access") {
+        throw idpError("invalid_claims", "token_use must be access");
+    }
+    if (claims.iss !== options.issuer || claims.aud !== options.audience) {
+        throw idpError("invalid_claims", "issuer or audience mismatch");
+    }
+    const now = Date.now();
+    const skewMs = options.maxClockSkewSeconds * 1000;
+    if (Date.parse(claims.exp) <= now - skewMs) {
+        throw idpError("token_expired", "access token expired");
+    }
+    if (Date.parse(claims.nbf) > now + skewMs) {
+        throw idpError("token_not_yet_valid", "access token is not valid yet");
+    }
+    if (options.requiredScope && !(claims.scp ?? []).includes(options.requiredScope)) {
+        throw idpError("insufficient_scope", "required scope is missing");
+    }
+    if (!claims.gid || !claims.sub || !claims.sid || !claims.ctx || !claims.role) {
+        throw idpError("invalid_claims", "required identity claims are missing");
+    }
+}
+function preAuthEncode(pieces) {
+    const out = [uint64le(pieces.length)];
+    for (const piece of pieces) {
+        out.push(uint64le(piece.length), piece);
+    }
+    return concatBytes(out);
+}
+function uint64le(value) {
+    const out = new Uint8Array(8);
+    let current = BigInt(value);
+    for (let i = 0; i < 8; i++) {
+        out[i] = Number(current & 0xffn);
+        current >>= 8n;
+    }
+    return out;
+}
+//# sourceMappingURL=paseto.js.map

package/dist/paseto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paseto.js","sourceRoot":"","sources":["../src/paseto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;AACxC,MAAM,kBAAkB,GAAG,UAAU,CAAC,iCAAiC,CAAC,CAAC;AACzE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAQ3E,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,QAAQ,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,MAA2B,EAC3B,MAAqE,EACrE,UAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,QAAQ,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAW,CAAC;IAC7D,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACzE,MAAM,QAAQ,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;IAC/F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAClE,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,QAAQ,CAAC,aAAa,EAAE,qDAAqD,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,QAAQ,CAAC,mBAAmB,EAAE,sCAAsC,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAiB,CAAC;IAC/D,cAAc,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,mBAAmB;QACpE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa;QAC5D,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE;KACvD,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG;QACd,OAAO,EAAE,MAAM,CAAC,GAAG;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;QACxB,cAAc,EAAE,MAAM,CAAC,GAAG;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB,EAAE,OAAkJ;IAC9L,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrE,MAAM,QAAQ,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAClD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC;QAC3C,MAAM,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC;QAC1C,MAAM,QAAQ,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACjF,MAAM,QAAQ,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7E,MAAM,QAAQ,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,MAAM,GAAG,GAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/pkce.d.ts

@@ -0,0 +1,3 @@
+import type { PKCEPair } from "./types.js";
+export declare function generatePKCE(bytes?: number): Promise<PKCEPair>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,wBAAsB,YAAY,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiBhE"}

package/dist/pkce.js

@@ -0,0 +1,18 @@
+import { base64UrlEncode, utf8Encode } from "./base64url.js";
+const VERIFIER_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+export async function generatePKCE(bytes = 48) {
+    const random = new Uint8Array(bytes);
+    crypto.getRandomValues(random);
+    let verifier = "";
+    for (const byte of random) {
+        verifier += VERIFIER_CHARS[byte % VERIFIER_CHARS.length];
+    }
+    const input = utf8Encode(verifier);
+    const digest = await crypto.subtle.digest("SHA-256", input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
+    return {
+        verifier,
+        challenge: base64UrlEncode(new Uint8Array(digest)),
+        method: "S256",
+    };
+}
+//# sourceMappingURL=pkce.js.map

package/dist/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG7D,MAAM,cAAc,GAAG,oEAAoE,CAAC;AAE5F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAK,GAAG,EAAE;IAC3C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,QAAQ,IAAI,cAAc,CAAC,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CACzF,CAAC;IACF,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC"}

package/dist/react.d.ts

@@ -0,0 +1,12 @@
+import { BaseIdPClient } from "./client.js";
+import type { AuthorizeUrlOptions, BaseIdPConfig } from "./types.js";
+export type ReactBaseIdpAuth = {
+    loginHref(options?: AuthorizeUrlOptions): string;
+    login(options?: AuthorizeUrlOptions): void;
+    buttonProps(options?: AuthorizeUrlOptions): {
+        type: "button";
+        onClick(): void;
+    };
+};
+export declare function createReactBaseIdpAuth(config: BaseIdPConfig | BaseIdPClient): ReactBaseIdpAuth;
+//# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACjD,KAAK,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG;QAC1C,IAAI,EAAE,QAAQ,CAAC;QACf,OAAO,IAAI,IAAI,CAAC;KACjB,CAAC;CACH,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,GAAG,gBAAgB,CAkB9F"}

package/dist/react.js

@@ -0,0 +1,21 @@
+import { BaseIdPClient } from "./client.js";
+export function createReactBaseIdpAuth(config) {
+    const client = config instanceof BaseIdPClient ? config : new BaseIdPClient(config);
+    return {
+        loginHref(options = {}) {
+            return client.authorizeUrl(options);
+        },
+        login(options = {}) {
+            window.location.assign(client.authorizeUrl(options));
+        },
+        buttonProps(options = {}) {
+            return {
+                type: "button",
+                onClick() {
+                    window.location.assign(client.authorizeUrl(options));
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAY5C,MAAM,UAAU,sBAAsB,CAAC,MAAqC;IAC1E,MAAM,MAAM,GAAG,MAAM,YAAY,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO;QACL,SAAS,CAAC,OAAO,GAAG,EAAE;YACpB,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,EAAE;YAChB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,WAAW,CAAC,OAAO,GAAG,EAAE;YACtB,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,OAAO;oBACL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvD,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,13 @@
+import { BaseIdPClient } from "./client.js";
+import type { BaseIdPConfig, ResolvedConfig, VerifiedPrincipal, VerifyAccessTokenOptions } from "./types.js";
+export declare class BaseIdPServerClient extends BaseIdPClient {
+    private readonly serverConfig;
+    private initialized;
+    constructor(serverConfig: BaseIdPConfig);
+    init(): Promise<ResolvedConfig>;
+    verifyAccessToken(token: string, options?: VerifyAccessTokenOptions): Promise<VerifiedPrincipal>;
+}
+export { BaseIdPServerClient as BaseIdpServerClient };
+export { verifyPasetoV4Public, unsafeFooter, unsafeFooterKid } from "./paseto.js";
+export type { VerifiedPrincipal, VerifyAccessTokenOptions, AccessClaims } from "./types.js";
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE7G,qBAAa,mBAAoB,SAAQ,aAAa;IAGxC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAFzC,OAAO,CAAC,WAAW,CAAS;gBAEC,YAAY,EAAE,aAAa;IAIlD,IAAI,IAAI,OAAO,CAAC,cAAc,CAAC;IAO/B,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAK3G;AAED,OAAO,EAAE,mBAAmB,IAAI,mBAAmB,EAAE,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClF,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/server.js

@@ -0,0 +1,25 @@
+import { BaseIdPClient } from "./client.js";
+import { verifyPasetoV4Public } from "./paseto.js";
+export class BaseIdPServerClient extends BaseIdPClient {
+    serverConfig;
+    initialized = false;
+    constructor(serverConfig) {
+        super(serverConfig);
+        this.serverConfig = serverConfig;
+    }
+    async init() {
+        if (this.initialized)
+            return this.cfg;
+        const resolved = await this.resolveConfig();
+        this.initialized = true;
+        return resolved;
+    }
+    async verifyAccessToken(token, options = {}) {
+        await this.init();
+        const keySet = await this.publicKeys();
+        return verifyPasetoV4Public(token, keySet, this.cfg, options);
+    }
+}
+export { BaseIdPServerClient as BaseIdpServerClient };
+export { verifyPasetoV4Public, unsafeFooter, unsafeFooterKid } from "./paseto.js";
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IAGvB;IAFrB,WAAW,GAAG,KAAK,CAAC;IAE5B,YAA6B,YAA2B;QACtD,KAAK,CAAC,YAAY,CAAC,CAAC;QADO,iBAAY,GAAZ,YAAY,CAAe;IAExD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,UAAoC,EAAE;QAC3E,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAED,OAAO,EAAE,mBAAmB,IAAI,mBAAmB,EAAE,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/sveltekit.d.ts

@@ -0,0 +1,17 @@
+import { BaseIdPServerClient } from "./server.js";
+import type { BaseIdPConfig, TokenPair, VerifiedPrincipal } from "./types.js";
+export type SvelteKitEventLike = {
+    url: URL;
+    request: Request;
+};
+export type SvelteCallbackResult = {
+    tokens: TokenPair;
+    principal: VerifiedPrincipal;
+    state?: string;
+};
+export declare function createSvelteKitBaseIdpAuth(config: BaseIdPConfig): {
+    client: BaseIdPServerClient;
+    loginLocation(event: SvelteKitEventLike, defaultReturnTo?: string): string;
+    callback(event: SvelteKitEventLike, codeVerifier?: string): Promise<SvelteCallbackResult>;
+};
+//# sourceMappingURL=sveltekit.d.ts.map

package/dist/sveltekit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sveltekit.d.ts","sourceRoot":"","sources":["../src/sveltekit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,aAAa;;yBAIvC,kBAAkB,6BAA0B,MAAM;oBAIjD,kBAAkB,iBAAiB,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;EASlG"}

package/dist/sveltekit.js

@@ -0,0 +1,21 @@
+import { BaseIdPServerClient } from "./server.js";
+export function createSvelteKitBaseIdpAuth(config) {
+    const client = new BaseIdPServerClient(config);
+    return {
+        client,
+        loginLocation(event, defaultReturnTo = "/") {
+            const returnTo = event.url.searchParams.get("return_to") ?? defaultReturnTo;
+            return client.authorizeUrl({ state: returnTo });
+        },
+        async callback(event, codeVerifier) {
+            const code = event.url.searchParams.get("code");
+            if (!code)
+                throw new Error("missing OAuth authorization code");
+            const state = event.url.searchParams.get("state") ?? undefined;
+            const tokens = await client.exchangeCode({ code, codeVerifier });
+            const principal = await client.verifyAccessToken(tokens.access_token);
+            return { tokens, principal, state };
+        },
+    };
+}
+//# sourceMappingURL=sveltekit.js.map

package/dist/sveltekit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sveltekit.js","sourceRoot":"","sources":["../src/sveltekit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAclD,MAAM,UAAU,0BAA0B,CAAC,MAAqB;IAC9D,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM;QACN,aAAa,CAAC,KAAyB,EAAE,eAAe,GAAG,GAAG;YAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC;YAC5E,OAAO,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,KAAyB,EAAE,YAAqB;YAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,138 @@
+export type FetchLike = typeof fetch;
+export type BaseIdPConfig = {
+    key: string;
+    issuer: string;
+    secret?: string;
+    fetch?: FetchLike;
+};
+export type ClientConfigResponse = {
+    client_id: string;
+    anon_key: string;
+    product: string;
+    display_name: string;
+    app_domain: string;
+    logo_url?: string;
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    paseto_public_key_endpoint: string;
+    allowed_redirect_uris: string[];
+    allowed_scopes: string[];
+    allowed_auth_methods: string[];
+    requested_claims: string[];
+    confidential: boolean;
+    status: string;
+};
+export type ResolvedConfig = {
+    issuer: string;
+    clientId: string;
+    key: string;
+    redirectUri: string;
+    scopes: string[];
+    audience: string;
+    clientSecret?: string;
+    requiredScope?: string;
+    fetch: FetchLike;
+    confidential: boolean;
+    allowedScopes: string[];
+    allowedAuthMethods: string[];
+};
+export type BaseIdpIdentityMetadata = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    paseto_public_key_endpoint: string;
+    token_format: "paseto";
+    paseto_purpose: "v4.public";
+    grant_types_supported: string[];
+    code_challenge_methods_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+};
+export type BaseIdpPublicKey = {
+    kid: string;
+    alg: "v4.public";
+    kty: "OKP";
+    crv: "Ed25519";
+    public_key_base64: string;
+    implicit_assertion?: string;
+};
+export type BaseIdpPublicKeySet = {
+    keys: BaseIdpPublicKey[];
+};
+export type AuthorizeUrlOptions = {
+    responseType?: "code";
+    state?: string;
+    nonce?: string;
+    scopes?: string | string[];
+    redirectUri?: string;
+    authSessionId?: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: "S256";
+    additionalParameters?: Record<string, string | undefined>;
+};
+export type TokenExchangeOptions = {
+    code: string;
+    codeVerifier?: string;
+    redirectUri?: string;
+};
+export type RefreshOptions = {
+    refreshToken: string;
+    scopes?: string | string[];
+};
+export type TokenPair = {
+    access_token: string;
+    refresh_token: string;
+    token_type: "PASETO" | string;
+    expires_in: number;
+    refresh_token_expires_at: string;
+};
+export type AccountContext = {
+    kind: "client" | "student" | "developer" | "team" | "organization" | string;
+    tenant_id?: string;
+    actor_id?: string;
+    owner_id?: string;
+};
+export type AccessClaims = {
+    iss: string;
+    sub: string;
+    aud: string;
+    exp: string;
+    nbf: string;
+    iat: string;
+    jti: string;
+    gid: string;
+    email?: string;
+    name?: string;
+    token_use: "access" | string;
+    sid: string;
+    ctx: AccountContext;
+    role: string;
+    ent?: string[];
+    ev?: string;
+    aal: number;
+    amr?: string[];
+    azp?: string;
+    scp?: string[];
+};
+export type VerifiedPrincipal = {
+    id: string;
+    subject: string;
+    email?: string;
+    name?: string;
+    role: string;
+    scopes: string[];
+    accountContext: AccountContext;
+    claims: AccessClaims;
+};
+export type VerifyAccessTokenOptions = {
+    issuer?: string;
+    audience?: string;
+    requiredScope?: string;
+    maxClockSkewSeconds?: number;
+};
+export type PKCEPair = {
+    verifier: string;
+    challenge: string;
+    method: "S256";
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,0BAA0B,EAAE,MAAM,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,SAAS,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,0BAA0B,EAAE,MAAM,CAAC;IACnC,YAAY,EAAE,QAAQ,CAAC;IACvB,cAAc,EAAE,WAAW,CAAC;IAC5B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,gBAAgB,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,MAAM,CAAC;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,cAAc,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/vite.d.ts

@@ -0,0 +1,6 @@
+import type { ReactBaseIdpAuth } from "./react.js";
+import type { BaseIdPConfig } from "./types.js";
+export type ViteBaseIdpEnv = Record<string, string | boolean | undefined>;
+export declare function baseIdpConfigFromViteEnv(env: ViteBaseIdpEnv, overrides?: Partial<BaseIdPConfig>): BaseIdPConfig;
+export declare function createViteBaseIdpAuth(env: ViteBaseIdpEnv, overrides?: Partial<BaseIdPConfig>): ReactBaseIdpAuth;
+//# sourceMappingURL=vite.d.ts.map

package/dist/vite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.d.ts","sourceRoot":"","sources":["../src/vite.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;AAE1E,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,cAAc,EACnB,SAAS,GAAE,OAAO,CAAC,aAAa,CAAM,GACrC,aAAa,CAOf;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,cAAc,EACnB,SAAS,GAAE,OAAO,CAAC,aAAa,CAAM,GACrC,gBAAgB,CAElB"}

package/dist/vite.js

@@ -0,0 +1,24 @@
+import { BaseIdPClient } from "./client.js";
+import { createReactBaseIdpAuth } from "./react.js";
+export function baseIdpConfigFromViteEnv(env, overrides = {}) {
+    return {
+        key: stringEnv(env, "VITE_BASE_IDP_KEY", "BASE_IDP_KEY", overrides.key),
+        issuer: stringEnv(env, "VITE_BASE_IDP_ISSUER", "BASE_IDP_ISSUER", overrides.issuer),
+        secret: overrides.secret ?? optionalStringEnv(env, "VITE_BASE_IDP_SECRET", "BASE_IDP_SECRET"),
+        fetch: overrides.fetch,
+    };
+}
+export function createViteBaseIdpAuth(env, overrides = {}) {
+    return createReactBaseIdpAuth(new BaseIdPClient(baseIdpConfigFromViteEnv(env, overrides)));
+}
+function stringEnv(env, publicKey, fallbackKey, fallback) {
+    const value = optionalStringEnv(env, publicKey, fallbackKey) ?? fallback;
+    if (!value)
+        throw new Error(`Missing ${publicKey}`);
+    return value;
+}
+function optionalStringEnv(env, publicKey, fallbackKey) {
+    const value = env[publicKey] ?? env[fallbackKey];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+//# sourceMappingURL=vite.js.map

package/dist/vite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.js","sourceRoot":"","sources":["../src/vite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAMpD,MAAM,UAAU,wBAAwB,CACtC,GAAmB,EACnB,YAAoC,EAAE;IAEtC,OAAO;QACL,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC;QACvE,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,CAAC;QACnF,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,sBAAsB,EAAE,iBAAiB,CAAC;QAC7F,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,YAAoC,EAAE;IAEtC,OAAO,sBAAsB,CAAC,IAAI,aAAa,CAAC,wBAAwB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,SAAiB,EAAE,WAAmB,EAAE,QAAiB;IAC/F,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,QAAQ,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAmB,EAAE,SAAiB,EAAE,WAAmB;IACpF,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC"}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "base-idp",
+  "version": "1.0.0",
+  "description": "Base IdP SDK for React, Next.js, SvelteKit, Vite, and server-side TypeScript.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "bin": {
+    "base-idp": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "import": "./dist/next.js"
+    },
+    "./node": {
+      "types": "./dist/node.d.ts",
+      "import": "./dist/node.js"
+    },
+    "./vite": {
+      "types": "./dist/vite.d.ts",
+      "import": "./dist/vite.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit.d.ts",
+      "import": "./dist/sveltekit.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "init": "node ./dist/cli.js init"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.10",
+    "typescript": "^5.8.2"
+  }
+}