@1mcp/agent 0.39.0-beta.3 → 0.39.0-beta.4

package/build/auth/oauthEndpointFetch.js

@@ -0,0 +1,246 @@
+import { lookup } from 'node:dns/promises';
+import http from 'node:http';
+import https from 'node:https';
+import { isIP } from 'node:net';
+import { Readable, Transform } from 'node:stream';
+import { oauthAuthorityError } from './oauthAuthority.js';
+export const OAUTH_RESPONSE_LIMIT = 1024 * 1024;
+export const OAUTH_FETCH_TIMEOUT_MS = 10_000;
+export class OAuthResourceRedirectError extends Error {
+    constructor() {
+        super('Configured MCP resource redirects; configure the upstream URL to its final destination');
+    }
+}
+export function isPrivateOAuthAddress(address) {
+    const ip = address.toLowerCase().replace(/^\[|\]$/g, '');
+    if (ip.includes(':')) {
+        if (ip.startsWith('::ffff:'))
+            return isPrivateOAuthAddress(ip.slice(7));
+        // Fail closed for non-global unicast IPv6, including mapped/transition forms.
+        return (!/^[23][0-9a-f]{3}:/.test(ip) ||
+            ip.startsWith('2001:db8:') ||
+            ip.startsWith('2002:') ||
+            ip.startsWith('2001:0:') ||
+            ip.startsWith('2001::'));
+    }
+    const parts = ip.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return true;
+    const [a, b] = parts;
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        a >= 224 ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && (b === 168 || b === 0)) ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 198 && (b === 18 || b === 19)));
+}
+function isConfiguredLocalOrigin(url, configuredResource, configuredIssuer) {
+    for (const configuredValue of [configuredResource, configuredIssuer]) {
+        if (!configuredValue)
+            continue;
+        const configured = new URL(configuredValue);
+        const hostname = configured.hostname.replace(/^\[|\]$/g, '');
+        const local = configured.hostname === 'localhost' || (isIP(hostname) !== 0 && isPrivateOAuthAddress(hostname));
+        if (local && url.origin === configured.origin)
+            return true;
+    }
+    return false;
+}
+export function validateOAuthEndpoint(value, configuredResource, expectedOrigin, configuredIssuer) {
+    try {
+        const url = new URL(value);
+        const localException = isConfiguredLocalOrigin(url, configuredResource, configuredIssuer);
+        if (url.username || url.password || url.hash)
+            throw oauthAuthorityError();
+        if (url.protocol !== 'https:' && !(localException && url.protocol === 'http:'))
+            throw oauthAuthorityError();
+        if (expectedOrigin && url.origin !== expectedOrigin)
+            throw oauthAuthorityError();
+        if (url.hostname === 'localhost' && !localException)
+            throw oauthAuthorityError();
+        if (isIP(url.hostname.replace(/^\[|\]$/g, '')) && isPrivateOAuthAddress(url.hostname) && !localException)
+            throw oauthAuthorityError();
+        return url;
+    }
+    catch {
+        throw oauthAuthorityError();
+    }
+}
+/** Pin the DNS result into the actual socket lookup, not just a preflight check. */
+export function createOAuthEndpointFetch(options) {
+    return async (input, init) => {
+        let resourceRequest = false;
+        try {
+            const request = input instanceof Request ? input : undefined;
+            const target = new URL(request?.url ?? String(input));
+            const resource = new URL(options.resource);
+            const isResource = options.isResource(target);
+            const url = isResource ? target : validateOAuthEndpoint(target.href, options.resource, undefined, options.issuer);
+            if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash)
+                throw oauthAuthorityError();
+            resourceRequest = isResource;
+            const deadline = AbortSignal.timeout(OAUTH_FETCH_TIMEOUT_MS);
+            const signal = init?.signal ?? request?.signal;
+            const boundedSignal = signal ? AbortSignal.any([signal, deadline]) : deadline;
+            const inputInit = request
+                ? {
+                    method: request.method,
+                    headers: request.headers,
+                    body: request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.text(),
+                    ...init,
+                }
+                : init;
+            const safeInit = await options.beforeRequest(url, { ...inputInit, signal: isResource ? signal : boundedSignal });
+            const hostname = url.hostname.replace(/^\[|\]$/g, '');
+            const addresses = isIP(hostname)
+                ? [{ address: hostname, family: isIP(hostname) }]
+                : await Promise.race([
+                    lookup(hostname, { all: true }),
+                    new Promise((_resolve, reject) => boundedSignal.addEventListener('abort', () => reject(oauthAuthorityError()), { once: true })),
+                ]);
+            const localException = isResource || isConfiguredLocalOrigin(url, options.resource, options.issuer);
+            if (!addresses.length || (!localException && addresses.some((item) => isPrivateOAuthAddress(item.address))))
+                throw oauthAuthorityError();
+            const resolved = addresses
+                .map((item) => item.address)
+                .sort()
+                .join(',');
+            await options.pinDestination(url.host, resolved, safeInit);
+            if (boundedSignal.aborted)
+                throw oauthAuthorityError();
+            const headers = new Headers(safeInit.headers);
+            const body = safeInit.body;
+            if (body !== undefined && body !== null && typeof body !== 'string' && !(body instanceof URLSearchParams))
+                throw oauthAuthorityError();
+            const response = await new Promise((resolve, reject) => {
+                const outgoing = (url.protocol === 'https:' ? https : http).request(url, {
+                    family: addresses[0].family,
+                    method: safeInit.method ?? 'GET',
+                    headers: Object.fromEntries(headers.entries()),
+                    signal: safeInit.signal ?? undefined,
+                    lookup: (_name, options, callback) => {
+                        if (options.all)
+                            callback(null, addresses);
+                        else
+                            callback(null, addresses[0].address, addresses[0].family);
+                    },
+                }, resolve);
+                outgoing.on('error', reject);
+                if (!isResource)
+                    outgoing.setTimeout(OAUTH_FETCH_TIMEOUT_MS, () => outgoing.destroy(oauthAuthorityError()));
+                outgoing.end(body?.toString());
+            });
+            const status = response.statusCode ?? 500;
+            if (status >= 300 && status < 400) {
+                response.destroy();
+                if (isResource)
+                    throw new OAuthResourceRedirectError();
+                throw oauthAuthorityError();
+            }
+            const responseHeaders = new Headers();
+            for (const [key, value] of Object.entries(response.headers)) {
+                if (Array.isArray(value))
+                    value.forEach((item) => responseHeaders.append(key, item));
+                else if (value !== undefined)
+                    responseHeaders.set(key, value);
+            }
+            // MCP response streams remain streaming; OAuth metadata/token bodies are bounded.
+            const oauthResponse = !isResource;
+            if (!oauthResponse) {
+                let stream = response;
+                if (url.href === resource.href &&
+                    options.acceptSseEndpoint &&
+                    responseHeaders.get('content-type')?.includes('text/event-stream')) {
+                    let pending = '';
+                    let observed = false;
+                    const parser = new Transform({
+                        transform(chunk, _encoding, callback) {
+                            if (!observed) {
+                                pending += chunk.toString('utf8');
+                                if (pending.length > 16 * 1024) {
+                                    callback(oauthAuthorityError());
+                                    return;
+                                }
+                                const end = pending.search(/\r?\n\r?\n/);
+                                if (end >= 0) {
+                                    const event = pending.slice(0, end);
+                                    if (/^event:\s*endpoint$/m.test(event)) {
+                                        const data = /^data:\s*(.+)$/m.exec(event)?.[1];
+                                        try {
+                                            if (data)
+                                                options.acceptSseEndpoint(data);
+                                        }
+                                        catch {
+                                            callback(oauthAuthorityError());
+                                            return;
+                                        }
+                                        observed = true;
+                                    }
+                                    pending = pending.slice(end).replace(/^\s+/, '');
+                                }
+                            }
+                            callback(null, chunk);
+                        },
+                    });
+                    stream = response.pipe(parser);
+                }
+                return new Response(status === 204 || status === 205 || status === 304
+                    ? null
+                    : Readable.toWeb(stream), { status, headers: responseHeaders });
+            }
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of response) {
+                const bytes = Buffer.from(chunk);
+                size += bytes.length;
+                if (size > OAUTH_RESPONSE_LIMIT) {
+                    response.destroy();
+                    throw oauthAuthorityError();
+                }
+                chunks.push(bytes);
+            }
+            let text = Buffer.concat(chunks).toString('utf8');
+            if (status >= 200 && status < 300 && (safeInit.method ?? 'GET') === 'GET') {
+                const value = JSON.parse(text);
+                if (!value || typeof value !== 'object' || Array.isArray(value))
+                    throw oauthAuthorityError();
+                text = JSON.stringify(options.metadata(value, url, safeInit));
+            }
+            if (status >= 200 && status < 300 && (safeInit.method ?? 'GET') === 'POST') {
+                const value = JSON.parse(text);
+                if (!value || typeof value !== 'object' || Array.isArray(value))
+                    throw oauthAuthorityError();
+                options.response(value, url, safeInit);
+            }
+            // Provider error descriptions are untrusted and may echo secrets.
+            if (status >= 400) {
+                let code = 'server_error';
+                try {
+                    const value = JSON.parse(text);
+                    if (value &&
+                        typeof value === 'object' &&
+                        'error' in value &&
+                        ['invalid_client', 'invalid_grant', 'invalid_scope', 'unauthorized_client', 'access_denied'].includes(String(value.error)))
+                        code = String(value.error);
+                }
+                catch {
+                    /* Return bounded non-secret OAuth error. */
+                }
+                text = JSON.stringify({ error: code });
+            }
+            responseHeaders.delete('content-length');
+            responseHeaders.delete('content-encoding');
+            return new Response(status === 204 || status === 205 ? null : text, { status, headers: responseHeaders });
+        }
+        catch (error) {
+            options.onFailure(resourceRequest);
+            if (error instanceof OAuthResourceRedirectError)
+                throw error;
+            throw oauthAuthorityError();
+        }
+    };
+}
+//# sourceMappingURL=oauthEndpointFetch.js.map

package/build/auth/oauthEndpointFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthEndpointFetch.js","sourceRoot":"","sources":["../../src/auth/oauthEndpointFetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD;QACE,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAClG,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,8EAA8E;QAC9E,OAAO,CACL,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;YAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YACtB,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YACxB,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/G,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,OAAO,CACL,CAAC,KAAK,CAAC;QACP,CAAC,KAAK,EAAE;QACR,CAAC,KAAK,GAAG;QACT,CAAC,IAAI,GAAG;QACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QAClC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAQ,EAAE,kBAA0B,EAAE,gBAAyB;IAC9F,KAAK,MAAM,eAAe,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,eAAe;YAAE,SAAS;QAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/G,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,kBAA0B,EAC1B,cAAuB,EACvB,gBAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,cAAc,GAAG,uBAAuB,CAAC,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;YAAE,MAAM,mBAAmB,EAAE,CAAC;QAC1E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;YAAE,MAAM,mBAAmB,EAAE,CAAC;QAC5G,IAAI,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACjF,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,cAAc;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACjF,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc;YACtG,MAAM,mBAAmB,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,OAUxC;IACC,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAClH,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;gBACzF,MAAM,mBAAmB,EAAE,CAAC;YAC9B,eAAe,GAAG,UAAU,CAAC;YAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,CAAC;YAC/C,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9E,MAAM,SAAS,GAAG,OAAO;gBACvB,CAAC,CAAC;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE;oBAC9F,GAAG,IAAI;iBACR;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACjH,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC9B,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjB,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;oBAC/B,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CACtC,aAAa,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC7F;iBACF,CAAC,CAAC;YACP,MAAM,cAAc,GAAG,UAAU,IAAI,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACpG,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzG,MAAM,mBAAmB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,SAAS;iBACvB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;iBAC3B,IAAI,EAAE;iBACN,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,aAAa,CAAC,OAAO;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,YAAY,eAAe,CAAC;gBACvG,MAAM,mBAAmB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3E,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CACjE,GAAG,EACH;oBACE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM;oBAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK;oBAChC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,SAAS;oBACpC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;wBACnC,IAAI,OAAO,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;;4BACtC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oBACjE,CAAC;iBACF,EACD,OAAO,CACR,CAAC;gBACF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,IAAI,CAAC,UAAU;oBAAE,QAAQ,CAAC,UAAU,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBAC5G,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;YAC1C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,UAAU;oBAAE,MAAM,IAAI,0BAA0B,EAAE,CAAC;gBACvD,MAAM,mBAAmB,EAAE,CAAC;YAC9B,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;YACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;qBAChF,IAAI,KAAK,KAAK,SAAS;oBAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChE,CAAC;YACD,kFAAkF;YAClF,MAAM,aAAa,GAAG,CAAC,UAAU,CAAC;YAClC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,MAAM,GAAa,QAAQ,CAAC;gBAChC,IACE,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;oBAC1B,OAAO,CAAC,iBAAiB;oBACzB,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAClE,CAAC;oBACD,IAAI,OAAO,GAAG,EAAE,CAAC;oBACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;oBACrB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;wBAC3B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;4BAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACd,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gCAClC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;oCAC/B,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC;oCAChC,OAAO;gCACT,CAAC;gCACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gCACzC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;oCACb,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oCACpC,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wCACvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;wCAChD,IAAI,CAAC;4CACH,IAAI,IAAI;gDAAE,OAAO,CAAC,iBAAkB,CAAC,IAAI,CAAC,CAAC;wCAC7C,CAAC;wCAAC,MAAM,CAAC;4CACP,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC;4CAChC,OAAO;wCACT,CAAC;wCACD,QAAQ,GAAG,IAAI,CAAC;oCAClB,CAAC;oCACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gCACnD,CAAC;4BACH,CAAC;4BACD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBACxB,CAAC;qBACF,CAAC,CAAC;oBACH,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,IAAI,QAAQ,CACjB,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;oBAChD,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAgC,EAC1D,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CACrC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;gBAC/C,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,oBAAoB,EAAE,CAAC;oBAChC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,mBAAmB,EAAE,CAAC;gBAC9B,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,IAAI,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1E,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,mBAAmB,EAAE,CAAC;gBAC7F,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAgC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC3E,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,mBAAmB,EAAE,CAAC;gBAC7F,OAAO,CAAC,QAAQ,CAAC,KAAgC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACpE,CAAC;YACD,kEAAkE;YAClE,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAClB,IAAI,IAAI,GAAG,cAAc,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACxC,IACE,KAAK;wBACL,OAAO,KAAK,KAAK,QAAQ;wBACzB,OAAO,IAAI,KAAK;wBAChB,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,qBAAqB,EAAE,eAAe,CAAC,CAAC,QAAQ,CACnG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CACpB;wBAED,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,4CAA4C;gBAC9C,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzC,eAAe,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC3C,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,KAAK,YAAY,0BAA0B;gBAAE,MAAM,KAAK,CAAC;YAC7D,MAAM,mBAAmB,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/build/auth/sessionTypes.d.ts

@@ -41,8 +41,8 @@ export declare const RefreshTokenLookupDataSchema: z.ZodObject<{
     runtimeScopeId: z.ZodString;
     tokenDigest: z.ZodString;
     state: z.ZodEnum<{
-        current: "current";
         consumed: "consumed";
+        current: "current";
     }>;
     expires: z.ZodNumber;
     createdAt: z.ZodNumber;

package/build/auth/storage/clientSessionRepository.d.ts

@@ -1,3 +1,4 @@
+import { type BoundClientSession, type OAuthAttempt, type OAuthAuthority, type OAuthAuthorityContext } from '../oauthAuthority.js';
 import { ClientSessionData } from '../sessionTypes.js';
 import { FileStorageService } from './fileStorageService.js';
 /**
@@ -34,6 +35,24 @@ import { FileStorageService } from './fileStorageService.js';
 export declare class ClientSessionRepository {
     private storage;
     constructor(storage: FileStorageService);
+    claimContext(slot: string, context: OAuthAuthorityContext, observedGeneration: string | null, signal?: AbortSignal): Promise<string>;
+    getClaim(slot: string): {
+        requestVersion: number;
+        joinable: boolean;
+        fingerprint: string;
+        generation: string;
+        destinations: Record<string, string>;
+        createdAt: number;
+        expires: number;
+    } | null;
+    reserveRequest(slot: string, generation: string): Promise<number>;
+    pinDestination(slot: string, generation: string, host: string, addresses: string): Promise<void>;
+    getBound(slot: string): BoundClientSession | null;
+    activate(slot: string, authority: OAuthAuthority, discovery: string, claim: string, requestVersion?: number): Promise<BoundClientSession>;
+    updateBound(slot: string, generation: string, operation: (record: BoundClientSession) => void, requestVersion?: number): Promise<BoundClientSession>;
+    addAttempt(slot: string, generation: string, state: string, attempt: OAuthAttempt, requestVersion?: number): Promise<void>;
+    consumeAttempt(slot: string, generation: string, state: string, validate: (attempt: OAuthAttempt) => void): Promise<OAuthAttempt>;
+    quarantine(serverName: string): Promise<void>;
     /**
      * Saves or updates a client session.
      *

package/build/auth/storage/clientSessionRepository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientSessionRepository.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/clientSessionRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAK9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAE/C;;;;;;;OAOG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAerF;;;;;OAKG;IACH,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAOjD;;;;;OAKG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAOnC;;;;;;;OAOG;IACH,IAAI,IAAI,MAAM,EAAE;IA0BhB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;CAGrB"}
+{"version":3,"file":"clientSessionRepository.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/clientSessionRepository.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,kBAAkB,EAIvB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAK3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAO9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAEzC,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,qBAAqB,EAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,EACjC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC;IA0BlB,QAAQ,CAAC,IAAI,EAAE,MAAM;;;;;;;;;IAgBf,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQjE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BtG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAI3C,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,cAAc,EACzB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,kBAAkB,CAAC;IAkCxB,WAAW,CACf,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,EAC/C,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,kBAAkB,CAAC;IAqBxB,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,YAAY,EACrB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBV,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,GACxC,OAAO,CAAC,YAAY,CAAC;IAclB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnD;;;;;;;OAOG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAerF;;;;;OAKG;IACH,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAOjD;;;;;OAKG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAOnC;;;;;;;OAOG;IACH,IAAI,IAAI,MAAM,EAAE;IA0BhB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;CAGrB"}

package/build/auth/storage/clientSessionRepository.js

@@ -1,6 +1,9 @@
+import { randomUUID } from 'node:crypto';
+import { BoundClientSessionSchema, OAUTH_AUTHORITY_TTL_MS, OAUTH_MAX_ATTEMPTS, oauthAuthorityError, oauthConfigurationFingerprintAsync, oauthDigest, sameAuthority, } from '../oauthAuthority.js';
 import { AUTH_CONFIG } from '../../constants.js';
 import logger from '../../logger/logger.js';
 import { sanitizeServerName } from '../../utils/validation/sanitization.js';
+import { z } from 'zod';
 /**
  * ClientSessionRepository handles OAuth 2.1 client session storage using the layered storage architecture.
  *
@@ -37,6 +40,181 @@ export class ClientSessionRepository {
     constructor(storage) {
         this.storage = storage;
     }
+    async claimContext(slot, context, observedGeneration, signal) {
+        signal?.throwIfAborted();
+        // Derivation must not block the event loop or hold the cross-process slot lock.
+        const fingerprint = await oauthConfigurationFingerprintAsync(context, slot);
+        signal?.throwIfAborted();
+        return this.storage.withExclusiveLock(`oauth-${slot}`, () => {
+            signal?.throwIfAborted();
+            const current = this.getClaim(slot);
+            const joiningInitial = observedGeneration === null && current?.joinable === true && current.fingerprint === fingerprint;
+            if (!joiningInitial && (current?.generation ?? null) !== observedGeneration)
+                throw oauthAuthorityError();
+            if (current?.fingerprint === fingerprint)
+                return current.generation;
+            const generation = randomUUID();
+            this.storage.writeDataDurable('oauth-context-', slot, {
+                fingerprint,
+                generation,
+                destinations: {},
+                requestVersion: 0,
+                joinable: current === null,
+                createdAt: Date.now(),
+                expires: Date.now() + OAUTH_AUTHORITY_TTL_MS,
+            });
+            return generation;
+        });
+    }
+    getClaim(slot) {
+        return this.storage.readData('oauth-context-', slot, z.object({
+            requestVersion: z.number().int().nonnegative().default(0),
+            joinable: z.boolean().default(false),
+            fingerprint: z.string(),
+            generation: z.string(),
+            destinations: z.record(z.string(), z.string()).default({}),
+            createdAt: z.number(),
+            expires: z.number(),
+        }));
+    }
+    async reserveRequest(slot, generation) {
+        return this.storage.withExclusiveLock(`oauth-${slot}`, () => {
+            const claim = this.getClaim(slot);
+            if (!claim || claim.generation !== generation)
+                throw oauthAuthorityError();
+            return claim.requestVersion;
+        });
+    }
+    async pinDestination(slot, generation, host, addresses) {
+        const current = this.getClaim(slot);
+        if (!current || current.generation !== generation)
+            throw oauthAuthorityError();
+        const renewBefore = Date.now() + OAUTH_AUTHORITY_TTL_MS - 24 * 60 * 60 * 1000;
+        const bound = this.getBound(slot);
+        const boundNeedsRenewal = bound ? bound.generation !== generation || bound.expires <= renewBefore : false;
+        // Read current ownership on every request; caching it would miss another process's invalidation.
+        if (current.destinations[host] === addresses && current.expires > renewBefore && !boundNeedsRenewal)
+            return;
+        await this.storage.withExclusiveLock(`oauth-${slot}`, () => {
+            const claim = this.getClaim(slot);
+            if (!claim || claim.generation !== generation)
+                throw oauthAuthorityError();
+            const renewBefore = Date.now() + OAUTH_AUTHORITY_TTL_MS - 24 * 60 * 60 * 1000;
+            const record = this.getBound(slot);
+            if (record?.generation === generation && record.expires <= renewBefore) {
+                record.expires = Date.now() + OAUTH_AUTHORITY_TTL_MS;
+                this.storage.writeDataDurable('oauth-bound-', slot, record);
+            }
+            if (claim.destinations[host] === addresses && claim.expires > renewBefore)
+                return;
+            if (!claim.destinations[host] && Object.keys(claim.destinations).length >= 32)
+                throw oauthAuthorityError();
+            // Each request validates DNS and pins its own socket; public answers may rotate.
+            claim.destinations[host] = addresses;
+            claim.expires = Date.now() + OAUTH_AUTHORITY_TTL_MS;
+            this.storage.writeDataDurable('oauth-context-', slot, claim);
+        });
+    }
+    getBound(slot) {
+        return this.storage.readData('oauth-bound-', slot, BoundClientSessionSchema);
+    }
+    async activate(slot, authority, discovery, claim, requestVersion) {
+        return this.storage.withExclusiveLock(`oauth-${slot}`, () => {
+            const authorityClaim = this.getClaim(slot);
+            if (authorityClaim?.generation !== claim)
+                throw oauthAuthorityError();
+            if (requestVersion !== undefined && authorityClaim.requestVersion !== requestVersion)
+                throw oauthAuthorityError();
+            authorityClaim.requestVersion++;
+            authorityClaim.expires = Date.now() + OAUTH_AUTHORITY_TTL_MS;
+            this.storage.writeDataDurable('oauth-context-', slot, authorityClaim);
+            const current = this.getBound(slot);
+            if (current && current.generation === claim && sameAuthority(current.authority, authority)) {
+                current.discovery = discovery;
+                current.expires = Date.now() + OAUTH_AUTHORITY_TTL_MS;
+                this.storage.writeDataDurable('oauth-bound-', slot, current);
+                return current;
+            }
+            let generation = claim;
+            if (current && current.generation === claim) {
+                generation = randomUUID();
+                this.storage.writeDataDurable('oauth-context-', slot, { ...this.getClaim(slot), generation, joinable: false });
+            }
+            const record = {
+                authority,
+                discovery,
+                generation,
+                revision: 0,
+                attempts: {},
+                createdAt: Date.now(),
+                expires: Date.now() + OAUTH_AUTHORITY_TTL_MS,
+            };
+            this.storage.writeDataDurable('oauth-bound-', slot, record);
+            return record;
+        });
+    }
+    async updateBound(slot, generation, operation, requestVersion) {
+        return this.storage.withExclusiveLock(`oauth-${slot}`, () => {
+            const record = this.getBound(slot);
+            const claim = this.getClaim(slot);
+            if (!record || record.generation !== generation || claim?.generation !== generation)
+                throw oauthAuthorityError();
+            if (requestVersion !== undefined && claim.requestVersion !== requestVersion)
+                throw oauthAuthorityError();
+            operation(record);
+            if (requestVersion !== undefined)
+                claim.requestVersion++;
+            if (record.generation !== generation) {
+                claim.generation = record.generation;
+                claim.destinations = {};
+                claim.joinable = false;
+            }
+            claim.expires = Date.now() + OAUTH_AUTHORITY_TTL_MS;
+            record.expires = claim.expires;
+            this.storage.writeDataDurable('oauth-context-', slot, claim);
+            this.storage.writeDataDurable('oauth-bound-', slot, record);
+            return record;
+        });
+    }
+    async addAttempt(slot, generation, state, attempt, requestVersion) {
+        await this.updateBound(slot, generation, (record) => {
+            for (const [key, value] of Object.entries(record.attempts)) {
+                if (value.expires <= Date.now())
+                    delete record.attempts[key];
+            }
+            if (Object.keys(record.attempts).length >= OAUTH_MAX_ATTEMPTS)
+                throw new Error('Too many pending OAuth authorizations; wait fifteen minutes');
+            const key = oauthDigest(state);
+            if (record.attempts[key])
+                throw oauthAuthorityError();
+            record.attempts[key] = attempt;
+        }, requestVersion);
+    }
+    async consumeAttempt(slot, generation, state, validate) {
+        let consumed;
+        await this.updateBound(slot, generation, (record) => {
+            const attempt = record.attempts[oauthDigest(state)];
+            if (!attempt || attempt.consumed || attempt.expires <= Date.now())
+                throw oauthAuthorityError();
+            validate(attempt);
+            consumed = structuredClone(attempt);
+            attempt.consumed = true;
+            // Keep a durable tombstone; never retain PKCE after consumption.
+            attempt.verifier = 'x'.repeat(43);
+        });
+        return consumed;
+    }
+    async quarantine(serverName) {
+        const key = oauthDigest(serverName);
+        await this.storage.withExclusiveLock(`oauth-migration-${key}`, () => {
+            const old = this.get(serverName);
+            if (!old)
+                return;
+            // Write protected rollback data before deleting the old source; retry is idempotent.
+            this.storage.writeDataDurable('oauth-quarantine-', key, old);
+            this.delete(serverName);
+        });
+    }
     /**
      * Saves or updates a client session.
      *

package/build/auth/storage/clientSessionRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientSessionRepository.js","sourceRoot":"","sources":["../../../src/auth/storage/clientSessionRepository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAI3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,OAAO,uBAAuB;IACd;IAApB,YAAoB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAEnD;;;;;;;OAOG;IACH,IAAI,CAAC,UAAkB,EAAE,iBAAoC,EAAE,KAAa;QAC1E,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG;YACrB,GAAG,iBAAiB;YACpB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC3B,SAAS,EAAE,iBAAiB,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;SACrD,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC1F,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,UAAkB;QACpB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAoB,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACrG,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,UAAkB;QACvB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACH,IAAI;QACF,uEAAuE;QACvE,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAEjG,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAEjD,uCAAuC;QACvC,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,6DAA6D;YAC7D,IAAI,UAAU,GAAG,IAAI,CAAC;YAEtB,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;YAED,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC9D,CAAC;YAED,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,mBAA2B;QAC9C,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"clientSessionRepository.js","sourceRoot":"","sources":["../../../src/auth/storage/clientSessionRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAEL,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAIlB,mBAAmB,EACnB,kCAAkC,EAClC,WAAW,EACX,aAAa,GACd,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,OAAO,uBAAuB;IACd;IAApB,YAAoB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAEnD,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,OAA8B,EAC9B,kBAAiC,EACjC,MAAoB;QAEpB,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,gFAAgF;QAChF,MAAM,WAAW,GAAG,MAAM,kCAAkC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,EAAE;YAC1D,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,cAAc,GAClB,kBAAkB,KAAK,IAAI,IAAI,OAAO,EAAE,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC;YACnG,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,KAAK,kBAAkB;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACzG,IAAI,OAAO,EAAE,WAAW,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,UAAU,CAAC;YACpE,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBACpD,WAAW;gBACX,UAAU;gBACV,YAAY,EAAE,EAAE;gBAChB,cAAc,EAAE,CAAC;gBACjB,QAAQ,EAAE,OAAO,KAAK,IAAI;gBAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB;aAC7C,CAAC,CAAC;YACH,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAC1B,gBAAgB,EAChB,IAAI,EACJ,CAAC,CAAC,MAAM,CAAC;YACP,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACzD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,UAAkB;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,EAAE;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC,cAAc,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,UAAkB,EAAE,IAAY,EAAE,SAAiB;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;YAAE,MAAM,mBAAmB,EAAE,CAAC;QAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1G,iGAAiG;QACjG,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,GAAG,WAAW,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAC5G,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,EAAE;YACzD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;gBACvE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,CAAC;gBACrD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG,WAAW;gBAAE,OAAO;YAClF,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,IAAI,EAAE;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAC3G,iFAAiF;YACjF,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;YACrC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,CAAC;YACpD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,SAAyB,EACzB,SAAiB,EACjB,KAAa,EACb,cAAuB;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,EAAE;YAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,cAAc,EAAE,UAAU,KAAK,KAAK;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACtE,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,cAAc,KAAK,cAAc;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAClH,cAAc,CAAC,cAAc,EAAE,CAAC;YAChC,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC3F,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;gBAC9B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,CAAC;gBACtD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7D,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;gBAC5C,UAAU,GAAG,UAAU,EAAE,CAAC;gBAC1B,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAClH,CAAC;YACD,MAAM,MAAM,GAAuB;gBACjC,SAAS;gBACT,SAAS;gBACT,UAAU;gBACV,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,EAAE;gBACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB;aAC7C,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAAY,EACZ,UAAkB,EAClB,SAA+C,EAC/C,cAAuB;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,EAAE;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,EAAE,UAAU,KAAK,UAAU;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACjH,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACzG,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,IAAI,cAAc,KAAK,SAAS;gBAAE,KAAK,CAAC,cAAc,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBACrC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC;gBACxB,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;YACzB,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,CAAC;YACpD,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CACd,IAAY,EACZ,UAAkB,EAClB,KAAa,EACb,OAAqB,EACrB,cAAuB;QAEvB,MAAM,IAAI,CAAC,WAAW,CACpB,IAAI,EACJ,UAAU,EACV,CAAC,MAAM,EAAE,EAAE;YACT,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3D,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE;oBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAI,kBAAkB;gBAC3D,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACjF,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACtD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;QACjC,CAAC,EACD,cAAc,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,IAAY,EACZ,UAAkB,EAClB,KAAa,EACb,QAAyC;QAEzC,IAAI,QAAkC,CAAC;QACvC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAC/F,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YACxB,iEAAiE;YACjE,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,QAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,mBAAmB,GAAG,EAAE,EAAE,GAAG,EAAE;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,UAAkB,EAAE,iBAAoC,EAAE,KAAa;QAC1E,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG;YACrB,GAAG,iBAAiB;YACpB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC3B,SAAS,EAAE,iBAAiB,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;SACrD,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC1F,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,UAAkB;QACpB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAoB,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACrG,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,UAAkB;QACvB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACH,IAAI;QACF,uEAAuE;QACvE,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAEjG,mDAAmD;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAEjD,uCAAuC;QACvC,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,6DAA6D;YAC7D,IAAI,UAAU,GAAG,IAAI,CAAC;YAEtB,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;YAED,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC9D,CAAC;YAED,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,mBAA2B;QAC9C,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACzE,CAAC;CACF"}

package/build/auth/storage/fileStorageService.d.ts

@@ -2,6 +2,9 @@ import { ExpirableData } from '../sessionTypes.js';
 import { InsecureFilePermissionsError } from '../../utils/filePermissions.js';
 import { type ZodType } from 'zod';
 export { InsecureFilePermissionsError };
+export declare class StorageLockBusyError extends Error {
+    constructor();
+}
 /**
  * Generic file storage service with unified cleanup for all expirable data types.
  *
@@ -18,7 +21,10 @@ export { InsecureFilePermissionsError };
 export declare class FileStorageService {
     private storageDir;
     private cleanupInterval;
-    constructor(baseDir?: string, subDir?: string);
+    constructor(baseDir?: string, subDir?: string, options?: {
+        manageLifecycle?: boolean;
+        initializeDirectory?: boolean;
+    });
     /**
      * Hardens file or directory permissions on POSIX systems.
      * Tolerates filesystems that lack POSIX permission capabilities (e.g. FAT, exFAT, FUSE)
@@ -118,6 +124,8 @@ export declare class FileStorageService {
      * cannot block the Runtime Scope permanently.
      */
     withExclusiveLock<T>(lockName: string, operation: () => Promise<T> | T): Promise<T>;
+    /** Synchronous callers cannot wait on a suspended async owner; fail busy and retry. */
+    withExclusiveLockSync<T>(lockName: string, operation: () => T): T;
     /**
      * Starts periodic cleanup of expired data files
      */

package/build/auth/storage/fileStorageService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fileStorageService.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/fileStorageService.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG1D,OAAO,EAIL,4BAA4B,EAE7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAK,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AAItC,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAQxC;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,eAAe,CAA+C;gBAE1D,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAY7C;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IA2B/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAevB;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAqF/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAczB;;OAEG;IACI,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM;IAmB1D;;OAEG;IACH,OAAO,CAAC,SAAS;IAiEjB,OAAO,CAAC,MAAM,CAAC,oBAAoB;IASnC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;OAEG;IACH,OAAO,CAAC,aAAa;IAOrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAUnC;;;;OAIG;IACH,OAAO,CAAC,eAAe;IA4CvB;;OAEG;IACH,SAAS,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAIjF;;OAEG;IACH,gBAAgB,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAIxF;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;IA6ChG;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAoBnD;;;;;OAKG;IACG,iBAAiB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuBzF;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACI,kBAAkB,IAAI,MAAM;IA+EnC;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IA2BxC;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,QAAQ,IAAI,IAAI;IAQhB,OAAO,CAAC,qBAAqB;IAqB7B,OAAO,CAAC,cAAc;IAmCtB,OAAO,CAAC,oBAAoB;IAqC5B,OAAO,CAAC,WAAW;IAqDnB,OAAO,CAAC,aAAa;CAStB"}
+{"version":3,"file":"fileStorageService.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/fileStorageService.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG1D,OAAO,EAIL,4BAA4B,EAE7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAK,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AAItC,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAExC,qBAAa,oBAAqB,SAAQ,KAAK;;CAI9C;AAQD;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,eAAe,CAA+C;gBAGpE,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAO;IAe5E;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IA2B/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAevB;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAqF/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAczB;;OAEG;IACI,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM;IAmB1D;;OAEG;IACH,OAAO,CAAC,SAAS;IAmEjB,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAWnC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAKzB;;OAEG;IACH,OAAO,CAAC,aAAa;IAOrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAUxB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAUnC;;;;OAIG;IACH,OAAO,CAAC,eAAe;IA4CvB;;OAEG;IACH,SAAS,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAIjF;;OAEG;IACH,gBAAgB,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAIxF;;;OAGG;IACH,QAAQ,CAAC,CAAC,SAAS,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;IA6ChG;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;IAoBnD;;;;;OAKG;IACG,iBAAiB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuBzF,uFAAuF;IACvF,qBAAqB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;IAYjE;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACI,kBAAkB,IAAI,MAAM;IA+EnC;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IA2BxC;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,QAAQ,IAAI,IAAI;IAQhB,OAAO,CAAC,qBAAqB;IAqB7B,OAAO,CAAC,cAAc;IAmCtB,OAAO,CAAC,oBAAoB;IAqC5B,OAAO,CAAC,WAAW;IAqDnB,OAAO,CAAC,aAAa;CAStB"}