@1mcp/agent 0.35.0-beta.2 → 0.35.0-beta.4

package/build/auth/sdkOAuthServerProvider.js

@@ -1,12 +1,15 @@
 import { randomUUID } from 'node:crypto';
+import { InvalidGrantError, InvalidScopeError, InvalidTargetError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import { McpConfigManager } from '../config/mcpConfigManager.js';
 import { AUTH_CONFIG } from '../constants.js';
+import { RuntimeIdentityService } from '../core/runtime/runtimeIdentityService.js';
 import { AgentConfigManager } from '../core/server/agentConfig.js';
 import logger from '../logger/logger.js';
 import { escapeHtml } from '../utils/validation/sanitization.js';
 import { auditScopeOperation, scopesToTags, tagsToScopes, validateScopesAgainstAvailableTags, } from '../utils/validation/scopeValidation.js';
 import { OAuthStorageService } from './storage/oauthStorageService.js';
-const OAUTH_CONSENT_PAGE_CSP = "default-src 'none'; form-action 'self'; style-src 'unsafe-inline'; img-src 'self' data:; base-uri 'none'; frame-ancestors 'none';";
+const OAUTH_CONSENT_PAGE_CSP_SUFFIX = "style-src 'unsafe-inline'; img-src 'self' data:; base-uri 'none'; frame-ancestors 'none';";
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
 /**
  * File-based OAuth clients store implementation using the new repository architecture
  */
@@ -55,8 +58,9 @@ export class SDKOAuthServerProvider {
     oauthStorage;
     configManager;
     _clientsStore;
-    constructor(sessionStoragePath) {
-        this.oauthStorage = new OAuthStorageService(sessionStoragePath);
+    constructor(sessionStoragePath, runtimeScopeId) {
+        const scopeId = runtimeScopeId ?? new RuntimeIdentityService({ storageDir: sessionStoragePath }).getRuntimeScopeId();
+        this.oauthStorage = new OAuthStorageService(sessionStoragePath, scopeId);
         this.configManager = AgentConfigManager.getInstance();
         this._clientsStore = new FileBasedClientsStore(this.oauthStorage);
     }
@@ -127,7 +131,7 @@ export class SDKOAuthServerProvider {
         const authRequestId = this.oauthStorage.createAuthorizationRequest(client.client_id, params.redirectUri, params.codeChallenge, params.state, params.resource?.toString(), requestedScopes);
         const scopeTags = scopesToTags(requestedScopes);
         const consentPageHtml = this.generateConsentPageHtml(client, authRequestId, scopeTags, availableTags);
-        res.set('Content-Security-Policy', OAUTH_CONSENT_PAGE_CSP);
+        res.set('Content-Security-Policy', createConsentPageCsp(client, params.redirectUri));
         res.set('Content-Type', 'text/html');
         res.send(consentPageHtml);
     }
@@ -164,6 +168,9 @@ export class SDKOAuthServerProvider {
     generateConsentPageHtml(client, authRequestId, requestedTags, availableTags) {
         const clientName = escapeHtml(client.client_name || client.client_id);
         const escapedAuthRequestId = escapeHtml(authRequestId);
+        const renewableAccessNotice = client.grant_types?.includes('refresh_token')
+            ? '<p>This application can renew this access for up to 30 days.</p>'
+            : '';
         return `
 <!DOCTYPE html>
 <html>
@@ -199,6 +206,7 @@ export class SDKOAuthServerProvider {
 
         <div class="security-notice">
             <strong>Security Notice:</strong> Only grant access to server groups that this application needs.
+            ${renewableAccessNotice}
         </div>
 
         <form method="POST" action="/oauth/consent">
@@ -247,7 +255,7 @@ export class SDKOAuthServerProvider {
         logger.debug('Challenge for authorization code', { clientId: client.client_id, authorizationCode });
         const codeData = this.oauthStorage.authCodeRepository.get(authorizationCode);
         if (!codeData || codeData.clientId !== client.client_id) {
-            throw new Error('Invalid authorization code');
+            throw new InvalidGrantError('Invalid authorization code');
         }
         return codeData.codeChallenge || '';
     }
@@ -266,19 +274,19 @@ export class SDKOAuthServerProvider {
         });
         const codeData = this.oauthStorage.authCodeRepository.get(authorizationCode);
         if (!codeData) {
-            throw new Error('Invalid or expired authorization code');
+            throw new InvalidGrantError('Invalid or expired authorization code');
         }
         // Validate client ID
         if (codeData.clientId !== client.client_id) {
-            throw new Error('Client ID mismatch');
+            throw new InvalidGrantError('Invalid or expired authorization code');
         }
         // Validate redirect URI if provided
         if (redirectUri && codeData.redirectUri !== redirectUri) {
-            throw new Error('Redirect URI mismatch');
+            throw new InvalidGrantError('Redirect URI mismatch');
         }
         // Validate resource if provided
         if (resource && codeData.resource && codeData.resource !== resource.toString()) {
-            throw new Error('Resource mismatch');
+            throw new InvalidTargetError('Resource mismatch');
         }
         // Delete the authorization code (one-time use)
         this.oauthStorage.authCodeRepository.delete(authorizationCode);
@@ -286,13 +294,25 @@ export class SDKOAuthServerProvider {
         const tokenId = randomUUID();
         const accessToken = AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX + tokenId;
         const ttlMs = this.configManager.get('auth').oauthTokenTtlMs;
-        // Store session for token validation
-        this.oauthStorage.sessionRepository.createWithId(tokenId, client.client_id, codeData.resource || '', codeData.scopes, ttlMs);
+        const refreshFamily = client.grant_types?.includes('refresh_token')
+            ? await this.oauthStorage.refreshTokenFamilyRepository.create(client.client_id, codeData.scopes, codeData.resource || '', tokenId, (familyId) => this.oauthStorage.sessionRepository.createRefreshFamilyAccessSession({
+                tokenId,
+                clientId: client.client_id,
+                resource: codeData.resource || '',
+                scopes: codeData.scopes,
+                ttlMs,
+                familyId,
+            }))
+            : undefined;
+        if (!refreshFamily) {
+            this.oauthStorage.sessionRepository.createWithId(tokenId, client.client_id, codeData.resource || '', codeData.scopes, ttlMs);
+        }
         const tokens = {
             access_token: accessToken,
             token_type: 'Bearer',
             expires_in: Math.floor(ttlMs / 1000),
             scope: codeData.scopes ? codeData.scopes.join(' ') : '',
+            ...(refreshFamily ? { refresh_token: refreshFamily.refreshToken } : {}),
         };
         logger.info(`Exchanged authorization code for access token`, {
             clientId: client.client_id,
@@ -302,16 +322,51 @@ export class SDKOAuthServerProvider {
         return tokens;
     }
     /**
-     * Exchanges refresh token for new access token (not implemented)
+     * Atomically rotates a single-use refresh token and issues a new access token.
      */
-    async exchangeRefreshToken(_client, _refreshToken, _scopes, _resource) {
-        throw new Error('Refresh tokens not supported');
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const repository = this.oauthStorage.refreshTokenFamilyRepository;
+        const family = repository.findByToken(refreshToken);
+        if (!family || family.clientId !== client.client_id) {
+            throw new InvalidGrantError('Invalid refresh token');
+        }
+        const requestedScopes = scopes ?? family.scopeCeiling;
+        if (requestedScopes.some((scope) => !family.scopeCeiling.includes(scope))) {
+            throw new InvalidScopeError('Requested scope exceeds the originally consented scope');
+        }
+        if (resource && resource.toString() !== family.resource) {
+            throw new InvalidTargetError('Requested resource does not match the original resource');
+        }
+        const tokenId = randomUUID();
+        const ttlMs = this.configManager.get('auth').oauthTokenTtlMs;
+        const rotation = await repository.consume(refreshToken, client.client_id, tokenId, (familyId) => this.oauthStorage.sessionRepository.createRefreshFamilyAccessSession({
+            tokenId,
+            clientId: client.client_id,
+            resource: family.resource,
+            scopes: requestedScopes,
+            ttlMs,
+            familyId,
+        }));
+        if (rotation.status === 'replay') {
+            this.revokeFamilyAccessTokens(rotation.family.accessTokenIds);
+            throw new InvalidGrantError('Refresh token replay detected');
+        }
+        if (rotation.status !== 'rotated') {
+            throw new InvalidGrantError('Invalid refresh token');
+        }
+        return {
+            access_token: AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX + tokenId,
+            token_type: 'Bearer',
+            expires_in: Math.floor(ttlMs / 1000),
+            scope: requestedScopes.join(' '),
+            refresh_token: rotation.refreshToken,
+        };
     }
     /**
      * Verifies access token and returns auth info with granted scopes
      */
     async verifyAccessToken(token) {
-        logger.debug('Verifying access token', { token });
+        logger.debug('Verifying access token');
         if (!this.configManager.get('features').auth) {
             // Auth disabled, return minimal auth info with all available tags as scopes
             const configManager = McpConfigManager.getInstance();
@@ -332,6 +387,12 @@ export class SDKOAuthServerProvider {
         if (!sessionData) {
             throw new Error('Invalid or expired access token');
         }
+        if (sessionData.refreshFamilyId) {
+            const family = this.oauthStorage.refreshTokenFamilyRepository.findById(sessionData.refreshFamilyId);
+            if (!family || family.status !== 'active' || !family.accessTokenIds.includes(tokenId)) {
+                throw new Error('Invalid or expired access token');
+            }
+        }
         return {
             token,
             clientId: sessionData.clientId,
@@ -344,20 +405,43 @@ export class SDKOAuthServerProvider {
      * Revokes a token
      */
     async revokeToken(client, request) {
-        logger.debug('Revoking token', { clientId: client.client_id, request });
+        logger.debug('Revoking OAuth token', { clientId: client.client_id });
         const token = request.token;
+        const refreshFamily = this.oauthStorage.refreshTokenFamilyRepository.findByToken(token);
+        if (refreshFamily) {
+            const revokedFamily = await this.oauthStorage.refreshTokenFamilyRepository.revokeForClient(refreshFamily, client.client_id);
+            if (revokedFamily) {
+                this.revokeFamilyAccessTokens(revokedFamily.accessTokenIds);
+            }
+            return;
+        }
         // Strip prefix if present
         const tokenId = token.startsWith(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX)
             ? token.slice(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX.length)
             : token;
         const sessionId = AUTH_CONFIG.SERVER.SESSION.ID_PREFIX + tokenId;
-        const success = this.oauthStorage.sessionRepository.delete(sessionId);
+        const session = this.oauthStorage.sessionRepository.get(sessionId);
+        const success = session?.clientId === client.client_id && this.oauthStorage.sessionRepository.delete(sessionId);
         if (success) {
             logger.info(`Revoked access token for client ${client.client_id}`, {
                 tokenId: tokenId.substring(0, 8) + '...',
             });
         }
     }
+    revokeFamilyAccessTokens(accessTokenIds) {
+        const failures = [];
+        for (const accessTokenId of accessTokenIds) {
+            try {
+                this.oauthStorage.sessionRepository.delete(AUTH_CONFIG.SERVER.SESSION.ID_PREFIX + accessTokenId);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        if (failures.length > 0) {
+            throw new AggregateError(failures, 'Failed to revoke access sessions for refresh token family');
+        }
+    }
     /**
      * Graceful shutdown
      */
@@ -365,4 +449,35 @@ export class SDKOAuthServerProvider {
         this.oauthStorage.shutdown();
     }
 }
+function createConsentPageCsp(client, requestedRedirectUri) {
+    const callbackOrigin = getValidatedLoopbackCallbackOrigin(client.redirect_uris, requestedRedirectUri);
+    const formAction = callbackOrigin ? `form-action 'self' ${callbackOrigin};` : "form-action 'self';";
+    return `default-src 'none'; ${formAction} ${OAUTH_CONSENT_PAGE_CSP_SUFFIX}`;
+}
+function getValidatedLoopbackCallbackOrigin(registeredRedirectUris, requestedRedirectUri) {
+    let requested;
+    try {
+        requested = new URL(requestedRedirectUri);
+    }
+    catch {
+        return null;
+    }
+    if (!LOOPBACK_HOSTS.has(requested.hostname)) {
+        return null;
+    }
+    const matchesRegistered = registeredRedirectUris.some((registeredRedirectUri) => {
+        try {
+            const registered = new URL(registeredRedirectUri);
+            return (LOOPBACK_HOSTS.has(registered.hostname) &&
+                requested.protocol === registered.protocol &&
+                requested.hostname === registered.hostname &&
+                requested.pathname === registered.pathname &&
+                requested.search === registered.search);
+        }
+        catch {
+            return false;
+        }
+    });
+    return matchesRegistered ? requested.origin : null;
+}
 //# sourceMappingURL=sdkOAuthServerProvider.js.map

package/build/auth/sdkOAuthServerProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdkOAuthServerProvider.js","sourceRoot":"","sources":["../../src/auth/sdkOAuthServerProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,kCAAkC,GACnC,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,MAAM,sBAAsB,GAC1B,mIAAmI,CAAC;AAEtI;;GAEG;AACH,MAAM,qBAAqB;IACjB,YAAY,CAAsB;IAE1C,YAAY,YAAiC;QAC3C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,MAAkC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,6DAA6D;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAE9C,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IACjC;;;OAGG;IACI,YAAY,CAAsB;IACjC,aAAa,CAAqB;IAClC,aAAa,CAA8B;IAEnD,YAAY,kBAA2B;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QAChE,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,yEAAyE;YACzE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YAEvD,wDAAwD;YACxD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAE/F,mDAAmD;YACnD,MAAM,UAAU,GAAG,kCAAkC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAElF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,mBAAmB,CAAC,yBAAyB,EAAE;oBAC7C,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,eAAe,EAAE,WAAW;oBAC5B,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBACpC,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,SAAS,EAAE,EAAE;oBACpE,eAAe,EAAE,WAAW;oBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,mBAAmB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,kFAAkF;YAClF,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAE1E,IAAI,mBAAmB,EAAE,CAAC;gBACxB,oBAAoB;gBACpB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,MAAkC,EAAE,MAAgB;QAC9E,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,oDAAoD;QACpD,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAC7B,MAAkC,EAClC,MAA2B,EAC3B,eAAyB,EACzB,aAAuB,EACvB,GAAa;QAEb,8EAA8E;QAC9E,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAChE,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAC3B,eAAe,CAChB,CAAC;QAEF,MAAM,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAEtG,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,sBAAsB,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAC/B,MAAkC,EAClC,MAA2B,EAC3B,aAAuB,EACvB,GAAa;QAEb,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/F,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CACtD,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EACjC,aAAa,EACb,KAAK,EACL,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,mBAAmB,CAAC,uBAAuB,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YACpC,aAAa;YACb,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,SAAS,EAAE,EAAE;YACxE,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa;SACd,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAkC,EAClC,aAAqB,EACrB,aAAuB,EACvB,aAAuB;QAEvB,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,oBAAoB,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAEvD,OAAO;;;;uBAIY,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;sBA0BX,UAAU;;;;;;;;iEAQiC,oBAAoB;;;;;;kBAMnE,aAAa;aACZ,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAEnC,OAAO;;;2CAGgB,UAAU;;4CAET,UAAU;iCACrB,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;4CACjC,UAAU;sCAChB,UAAU;;;;sDAIM,UAAU;;iBAE/C,CAAC;QACA,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC;;;;;;;;;;;KAWtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,6BAA6B,CAAC,MAAkC,EAAE,iBAAyB;QAC/F,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAEpG,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB;IACzB,8DAA8D;IAC9D,oCAAoC;IACpC,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;YAC5C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,iBAAiB;YACjB,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,qBAAqB;QACrB,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,oCAAoC;QACpC,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,gCAAgC;QAChC,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAE/D,sBAAsB;QACtB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC;QAE7D,qCAAqC;QACrC,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,YAAY,CAC9C,OAAO,EACP,MAAM,CAAC,SAAS,EAChB,QAAQ,CAAC,QAAQ,IAAI,EAAE,EACvB,QAAQ,CAAC,MAAM,EACf,KAAK,CACN,CAAC;QAEF,MAAM,MAAM,GAAgB;YAC1B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACpC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;SACxD,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;YACxC,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAmC,EACnC,aAAqB,EACrB,OAAkB,EAClB,SAAe;QAEf,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAElD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,4EAA4E;YAC5E,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC;aACpC,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC;QAEV,mBAAmB;QACnB,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAExE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEtE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,SAAS,EAAE,EAAE;gBACjE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"sdkOAuthServerProvider.js","sourceRoot":"","sources":["../../src/auth/sdkOAuthServerProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iDAAiD,CAAC;AASzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,kCAAkC,GACnC,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE,MAAM,6BAA6B,GACjC,2FAA2F,CAAC;AAC9F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;GAEG;AACH,MAAM,qBAAqB;IACjB,YAAY,CAAsB;IAE1C,YAAY,YAAiC;QAC3C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,MAAkC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,6DAA6D;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAE9C,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IACjC;;;OAGG;IACI,YAAY,CAAsB;IACjC,aAAa,CAAqB;IAClC,aAAa,CAA8B;IAEnD,YAAY,kBAA2B,EAAE,cAAuB;QAC9D,MAAM,OAAO,GACX,cAAc,IAAI,IAAI,sBAAsB,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACvG,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,yEAAyE;YACzE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YAEvD,wDAAwD;YACxD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAE/F,mDAAmD;YACnD,MAAM,UAAU,GAAG,kCAAkC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAElF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,mBAAmB,CAAC,yBAAyB,EAAE;oBAC7C,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,eAAe,EAAE,WAAW;oBAC5B,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBACpC,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,SAAS,EAAE,EAAE;oBACpE,eAAe,EAAE,WAAW;oBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,mBAAmB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,kFAAkF;YAClF,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAE1E,IAAI,mBAAmB,EAAE,CAAC;gBACxB,oBAAoB;gBACpB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,MAAkC,EAAE,MAAgB;QAC9E,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,oDAAoD;QACpD,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAC7B,MAAkC,EAClC,MAA2B,EAC3B,eAAyB,EACzB,aAAuB,EACvB,GAAa;QAEb,8EAA8E;QAC9E,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAChE,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAC3B,eAAe,CAChB,CAAC;QAEF,MAAM,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAEtG,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAC/B,MAAkC,EAClC,MAA2B,EAC3B,aAAuB,EACvB,GAAa;QAEb,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/F,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CACtD,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EACjC,aAAa,EACb,KAAK,EACL,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,mBAAmB,CAAC,uBAAuB,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YACpC,aAAa;YACb,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,SAAS,EAAE,EAAE;YACxE,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa;SACd,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAkC,EAClC,aAAqB,EACrB,aAAuB,EACvB,aAAuB;QAEvB,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,oBAAoB,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,CAAC;YACzE,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;;;;uBAIY,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;sBA0BX,UAAU;;;;;cAKlB,qBAAqB;;;;iEAI8B,oBAAoB;;;;;;kBAMnE,aAAa;aACZ,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAEnC,OAAO;;;2CAGgB,UAAU;;4CAET,UAAU;iCACrB,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;4CACjC,UAAU;sCAChB,UAAU;;;;sDAIM,UAAU;;iBAE/C,CAAC;QACA,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC;;;;;;;;;;;KAWtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,6BAA6B,CAAC,MAAkC,EAAE,iBAAyB;QAC/F,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAEpG,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB;IACzB,8DAA8D;IAC9D,oCAAoC;IACpC,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;YAC5C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,iBAAiB;YACjB,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QAED,qBAAqB;QACrB,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QAED,oCAAoC;QACpC,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QAED,gCAAgC;QAChC,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACpD,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAE/D,sBAAsB;QACtB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC;QAE7D,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,CAAC;YACjE,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,MAAM,CACzD,MAAM,CAAC,SAAS,EAChB,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,QAAQ,IAAI,EAAE,EACvB,OAAO,EACP,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,gCAAgC,CAAC;gBACnE,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK;gBACL,QAAQ;aACT,CAAC,CACL;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,YAAY,CAC9C,OAAO,EACP,MAAM,CAAC,SAAS,EAChB,QAAQ,CAAC,QAAQ,IAAI,EAAE,EACvB,QAAQ,CAAC,MAAM,EACf,KAAK,CACN,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACpC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACvD,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;YACxC,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC;QAClE,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC;QACtD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,iBAAiB,CAAC,wDAAwD,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,kBAAkB,CAAC,yDAAyD,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC9F,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,gCAAgC,CAAC;YACnE,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,eAAe;YACvB,KAAK;YACL,QAAQ;SACT,CAAC,CACH,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9D,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QAED,OAAO;YACL,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO;YAC1D,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACpC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;YAChC,aAAa,EAAE,QAAQ,CAAC,YAAY;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,4EAA4E;YAC5E,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC;aACpC,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC;QAEV,mBAAmB;QACnB,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YACpG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAErE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,eAAe,CACxF,aAAa,EACb,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEhH,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,SAAS,EAAE,EAAE;gBACjE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,wBAAwB,CAAC,cAAwB;QACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,CAAC;YACnG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,2DAA2D,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,MAAkC,EAAE,oBAA4B;IAC5F,MAAM,cAAc,GAAG,kCAAkC,CAAC,MAAM,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IACtG,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,sBAAsB,cAAc,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpG,OAAO,uBAAuB,UAAU,IAAI,6BAA6B,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,kCAAkC,CACzC,sBAAgC,EAChC,oBAA4B;IAE5B,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAClD,OAAO,CACL,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACvC,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;gBAC1C,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;gBAC1C,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;gBAC1C,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CACvC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC"}

package/build/auth/sessionTypes.d.ts

@@ -1,5 +1,7 @@
 import { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { TemplateContextProof } from '../core/context/templateContextTrust.js';
 import { ContextNamespace, EnvironmentContext, UserContext } from '../types/context.js';
+import { z } from 'zod';
 /**
  * Base interface for all data that can expire
  */
@@ -7,11 +9,45 @@ export interface ExpirableData {
     expires: number;
     createdAt: number;
 }
-export interface SessionData extends ExpirableData {
-    clientId: string;
-    resource: string;
-    scopes: string[];
-}
+export declare const SessionDataSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    resource: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    refreshFamilyId: z.ZodOptional<z.ZodString>;
+    expires: z.ZodNumber;
+    createdAt: z.ZodNumber;
+}, z.core.$strip>;
+export type SessionData = z.infer<typeof SessionDataSchema>;
+export declare const RefreshTokenFamilyDataSchema: z.ZodObject<{
+    familyId: z.ZodString;
+    runtimeScopeId: z.ZodString;
+    clientId: z.ZodString;
+    scopeCeiling: z.ZodArray<z.ZodString>;
+    resource: z.ZodString;
+    currentTokenDigest: z.ZodString;
+    consumedTokenDigests: z.ZodArray<z.ZodString>;
+    accessTokenIds: z.ZodArray<z.ZodUUID>;
+    status: z.ZodEnum<{
+        active: "active";
+        revoked: "revoked";
+    }>;
+    revokedAt: z.ZodOptional<z.ZodNumber>;
+    expires: z.ZodNumber;
+    createdAt: z.ZodNumber;
+}, z.core.$strip>;
+export type RefreshTokenFamilyData = z.infer<typeof RefreshTokenFamilyDataSchema>;
+export declare const RefreshTokenLookupDataSchema: z.ZodObject<{
+    familyId: z.ZodString;
+    runtimeScopeId: z.ZodString;
+    tokenDigest: z.ZodString;
+    state: z.ZodEnum<{
+        current: "current";
+        consumed: "consumed";
+    }>;
+    expires: z.ZodNumber;
+    createdAt: z.ZodNumber;
+}, z.core.$strip>;
+export type RefreshTokenLookupData = z.infer<typeof RefreshTokenLookupDataSchema>;
 export interface ClientData extends ExpirableData, OAuthClientInformationFull {
 }
 export interface AuthCodeData extends ExpirableData {
@@ -79,5 +115,6 @@ export interface StreamableSessionData extends ExpirableData {
             };
         };
     };
+    contextProof?: TemplateContextProof;
 }
 //# sourceMappingURL=sessionTypes.d.ts.map

package/build/auth/sessionTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionTypes.d.ts","sourceRoot":"","sources":["../../src/auth/sessionTypes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAEtF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa,EAAE,0BAA0B;CAAG;AAEhF,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAGD,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAC5C,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,IAAI,CAAC,EAAE,WAAW,CAAC;QACnB,WAAW,CAAC,EAAE,kBAAkB,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;YAC7B,MAAM,CAAC,EAAE;gBACP,IAAI,EAAE,MAAM,CAAC;gBACb,OAAO,EAAE,MAAM,CAAC;gBAChB,KAAK,CAAC,EAAE,MAAM,CAAC;aAChB,CAAC;SACH,CAAC;KACH,CAAC;CACH"}
+{"version":3,"file":"sessionTypes.d.ts","sourceRoot":"","sources":["../../src/auth/sessionTypes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAEtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,eAAO,MAAM,iBAAiB;;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;iBAYvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;;;;;;;;iBAMvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,WAAW,UAAW,SAAQ,aAAa,EAAE,0BAA0B;CAAG;AAEhF,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAGD,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAC5C,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,IAAI,CAAC,EAAE,WAAW,CAAC;QACnB,WAAW,CAAC,EAAE,kBAAkB,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;YACb,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;YAC7B,MAAM,CAAC,EAAE;gBACP,IAAI,EAAE,MAAM,CAAC;gBACb,OAAO,EAAE,MAAM,CAAC;gBAChB,KAAK,CAAC,EAAE,MAAM,CAAC;aAChB,CAAC;SACH,CAAC;KACH,CAAC;IACF,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC"}

package/build/auth/sessionTypes.js

@@ -1,2 +1,34 @@
-export {};
+import { z } from 'zod';
+const ExpirableDataShape = {
+    expires: z.number().finite(),
+    createdAt: z.number().finite(),
+};
+export const SessionDataSchema = z.object({
+    ...ExpirableDataShape,
+    clientId: z.string().min(1),
+    resource: z.string(),
+    scopes: z.array(z.string()),
+    refreshFamilyId: z.string().optional(),
+});
+const RefreshTokenDigestSchema = z.string().regex(/^[a-f0-9]{64}$/);
+export const RefreshTokenFamilyDataSchema = z.object({
+    ...ExpirableDataShape,
+    familyId: z.string().min(1),
+    runtimeScopeId: z.string().min(1),
+    clientId: z.string().min(1),
+    scopeCeiling: z.array(z.string()),
+    resource: z.string(),
+    currentTokenDigest: RefreshTokenDigestSchema,
+    consumedTokenDigests: z.array(RefreshTokenDigestSchema),
+    accessTokenIds: z.array(z.uuid()),
+    status: z.enum(['active', 'revoked']),
+    revokedAt: z.number().finite().optional(),
+});
+export const RefreshTokenLookupDataSchema = z.object({
+    ...ExpirableDataShape,
+    familyId: z.string().min(1),
+    runtimeScopeId: z.string().min(1),
+    tokenDigest: RefreshTokenDigestSchema,
+    state: z.enum(['current', 'consumed']),
+});
 //# sourceMappingURL=sessionTypes.js.map

package/build/auth/sessionTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionTypes.js","sourceRoot":"","sources":["../../src/auth/sessionTypes.ts"],"names":[],"mappings":""}
+{"version":3,"file":"sessionTypes.js","sourceRoot":"","sources":["../../src/auth/sessionTypes.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,MAAM,kBAAkB,GAAG;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,kBAAkB;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,kBAAkB;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,kBAAkB;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,WAAW,EAAE,wBAAwB;IACrC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;CACvC,CAAC,CAAC"}

package/build/auth/storage/fileStorageService.d.ts

@@ -1,4 +1,5 @@
 import { ExpirableData } from '../../auth/sessionTypes.js';
+import { type ZodType } from 'zod';
 /**
  * Generic file storage service with unified cleanup for all expirable data types.
  *
@@ -56,15 +57,26 @@ export declare class FileStorageService {
      * Writes data to a file with the specified prefix and ID
      */
     writeData<T extends ExpirableData>(filePrefix: string, id: string, data: T): void;
+    /**
+     * Atomically replaces a record and flushes it before returning.
+     */
+    writeDataDurable<T extends ExpirableData>(filePrefix: string, id: string, data: T): void;
     /**
      * Reads data from a file with the specified prefix and ID
      * Returns null if file doesn't exist or data is expired
      */
-    readData<T extends ExpirableData>(filePrefix: string, id: string): T | null;
+    readData<T extends ExpirableData>(filePrefix: string, id: string, schema?: ZodType<T>): T | null;
     /**
      * Deletes data file with the specified prefix and ID
      */
     deleteData(filePrefix: string, id: string): boolean;
+    /**
+     * Runs a storage transition under an inter-process lock.
+     *
+     * Lock ownership is recorded so a process that dies while holding the lock
+     * cannot block the Runtime Scope permanently.
+     */
+    withExclusiveLock<T>(lockName: string, operation: () => Promise<T> | T): Promise<T>;
     /**
      * Starts periodic cleanup of expired data files
      */
@@ -88,5 +100,10 @@ export declare class FileStorageService {
      * Graceful shutdown - stops cleanup interval
      */
     shutdown(): void;
+    private flushStorageDirectory;
+    private tryAcquireLock;
+    private reclaimAbandonedLock;
+    private releaseLock;
+    private readLockOwner;
 }
 //# sourceMappingURL=fileStorageService.d.ts.map

package/build/auth/storage/fileStorageService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fileStorageService.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/fileStorageService.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,eAAe,CAA+C;gBAE1D,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAY7C;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAqE/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAczB;;OAEG;IACI,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM;IAmB1D;;OAEG;IACH,OAAO,CAAC,SAAS;IAwDjB;;OAEG;IACH,SAAS,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAWjF;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI;IA4B3E;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAoBnD;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACI,kBAAkB,IAAI,MAAM;IAyCnC;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IAwBxC;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,QAAQ,IAAI,IAAI;CAOjB"}
+{"version":3,"file":"fileStorageService.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/fileStorageService.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAI1D,OAAO,EAAK,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AAQtC;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,eAAe,CAA+C;gBAE1D,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAY7C;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAqE/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAczB;;OAEG;IACI,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM;IAmB1D;;OAEG;IACH,OAAO,CAAC,SAAS;IA8DjB;;OAEG;IACH,SAAS,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAWjF;;OAEG;IACH,gBAAgB,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IA6BxF;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;IA6BhG;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAoBnD;;;;;OAKG;IACG,iBAAiB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuBzF;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACI,kBAAkB,IAAI,MAAM;IAuDnC;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IAwBxC;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,QAAQ,IAAI,IAAI;IAQhB,OAAO,CAAC,qBAAqB;IAqB7B,OAAO,CAAC,cAAc;IAmCtB,OAAO,CAAC,oBAAoB;IAqC5B,OAAO,CAAC,WAAW;IA+CnB,OAAO,CAAC,aAAa;CAStB"}