@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/types/domain/client-auth.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Shared client-authentication helpers.
+ *
+ * `/token`, `/revoke`, `/introspect`, and refresh-token rotation all need
+ * to validate presented credentials against a `ClientConfig`. The logic is
+ * the same in every case:
+ *
+ *  - **Public clients** MUST NOT present a `client_secret` (RFC 6749 §2.3).
+ *  - **Confidential clients** MUST present a `client_secret`, hashed and
+ *    compared in constant time against `ClientConfig.secretHash`.
+ *
+ * Credentials may ride either in the form body (`client_id`,
+ * `client_secret`) or in an `Authorization: Basic` header
+ * (RFC 6749 §2.3.1). Both encodings are accepted; the header takes
+ * precedence when both are present.
+ *
+ * The hashing function lives in `./token.ts` (`hashClientSecret`) to keep
+ * the legacy phase-2 SHA-256 / base64url format in one place; production
+ * deployments migrate to argon2id later in the rebuild.
+ */
+import { type AuthError } from "../types/error";
+import type { ClientConfig } from "../types/tenant";
+export type ClientCredentials = {
+    /** Client identifier (always present when credentials are presented). */
+    clientId: string;
+    /** Confidential clients only. */
+    clientSecret?: string;
+};
+/**
+ * Validate presented credentials against `client`. Returns `null` on
+ * success, `AuthError` on rejection.
+ *
+ * Public clients pass when no secret is presented. Confidential clients
+ * require both a secret and a matching `secretHash`.
+ */
+export declare function verifyClientCredentials(client: ClientConfig, presentedSecret: string | undefined): Promise<AuthError | null>;
+/**
+ * Parse an `Authorization: Basic <base64>` header.
+ *
+ * Returns `null` for missing / non-Basic headers and for any decoding
+ * failure; callers fall back to form-body credentials.
+ */
+export declare function parseBasicAuth(header: string | null): ClientCredentials | null;
+/**
+ * Merge form-body credentials with an optional `Authorization: Basic`
+ * header. The header wins per RFC 6749 §2.3 when both are present.
+ *
+ * Returns `null` when neither source supplies a `client_id` — callers
+ * then decide whether that's permissible (anonymous revoke is OK; the
+ * token endpoint isn't).
+ */
+export declare function resolveClientCredentials(input: {
+    authorizationHeader: string | null;
+    bodyClientId: string | undefined;
+    bodyClientSecret: string | undefined;
+}): ClientCredentials | null;
+//# sourceMappingURL=client-auth.d.ts.map

package/dist/types/domain/client-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-auth.d.ts","sourceRoot":"","sources":["../../../src/domain/client-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAKnD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,YAAY,EACpB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAiB3B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,iBAAiB,GAAG,IAAI,CAqB1B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;CACrC,GAAG,iBAAiB,GAAG,IAAI,CAU3B"}

package/dist/types/domain/client-credentials.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `/token` endpoint logic for `grant_type=client_credentials` (RFC 6749 §4.4).
+ *
+ * Steps:
+ *   1. Authenticate the client. Must be confidential and must declare
+ *      `client_credentials` in `grantTypes`.
+ *   2. Resolve the tenant's m2m method. The plan models m2m as a method
+ *      with a `client` fn and no routes; we look for the unique
+ *      `type === "m2m"` instance on the tenant. Zero or multiple → error.
+ *   3. Call `method.client({ clientID, clientSecret, params })`. On
+ *      success the method returns the `P` properties it would have
+ *      emitted on a `success` MethodResult.
+ *   4. Invoke the user's `success` callback to mint the subject claim
+ *      with `methodKind = method.kind`, `methodId = method.id`.
+ *   5. `mintTokens` — access token only (no refresh per §4.4.3).
+ *
+ * The framework rejects requests presenting `scope` beyond what
+ * `ClientConfig.scopes` allows.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
+import type { Result } from "../types/result";
+import type { SubjectClaim } from "../types/subject";
+import type { TenantId } from "../types/tenant";
+import type { TokenResponse } from "../types/token";
+import { MethodCache } from "./method-cache";
+export type ClientCredentialsRequest = {
+    grantType: "client_credentials";
+    clientId: string;
+    clientSecret: string;
+    scope?: string;
+    /** Extra params (audience, resource, etc.). Forwarded to `method.client`. */
+    params?: Record<string, string>;
+};
+export type ClientCredentialsDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    persistUpstreamTokens?: PersistUpstreamTokens;
+    issuerUrl: string;
+    clock: () => number;
+    newRefreshFamily?: () => string;
+};
+export declare function clientCredentialsGrant(req: ClientCredentialsRequest, deps: ClientCredentialsDeps, tenantId: TenantId): Promise<Result<TokenResponse, AuthError>>;
+//# sourceMappingURL=client-credentials.d.ts.map

package/dist/types/domain/client-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5C,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;CAChC,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmH3C"}

package/dist/types/domain/crypto.d.ts

@@ -0,0 +1,53 @@
+/** 256-bit random token, base64url-encoded. ~43 chars. */
+export declare function randomToken(): string;
+/** 128-bit random id, base64url-encoded. ~22 chars. */
+export declare function randomId(): string;
+/** Cryptographic random hex string of `bytes` length. */
+export declare function randomHex(bytes: number): string;
+/** Cryptographic random `Uint8Array` of `bytes` length. */
+export declare function randomBytes(bytes: number): Uint8Array;
+/** Base64url encode raw bytes (jose alias for downstream consistency). */
+export declare const base64url: {
+    encode: (data: Uint8Array | string) => string;
+    decode: (s: string) => Uint8Array;
+};
+/** UTF-8 helpers. */
+export declare const utf8: {
+    encode: (s: string) => Uint8Array;
+    decode: (b: Uint8Array) => string;
+};
+/**
+ * Constant-time byte-array compare. Returns false fast on length mismatch
+ * (length itself is not secret), then XORs every byte to avoid early exit.
+ */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+/** Constant-time string compare (UTF-8 bytes). */
+export declare function timingSafeEqualStr(a: string, b: string): boolean;
+/** SHA-256 digest. */
+export declare function sha256(data: Uint8Array | string): Promise<Uint8Array>;
+/** Import a 32-byte HMAC-SHA-256 key for sign/verify use. */
+export declare function importHmacKey(raw: Uint8Array, usage?: ReadonlyArray<"sign" | "verify">): Promise<CryptoKey>;
+/** HMAC-SHA-256 sign. */
+export declare function hmacSign(key: CryptoKey, message: Uint8Array): Promise<Uint8Array>;
+/**
+ * HMAC-SHA-256 verify. `crypto.subtle.verify` is timing-safe by spec, which
+ * is why we use it instead of recomputing + comparing manually.
+ */
+export declare function hmacVerify(key: CryptoKey, signature: Uint8Array, message: Uint8Array): Promise<boolean>;
+/**
+ * Encrypt a JSON-serializable payload with AES-256-GCM under the supplied
+ * 256-bit key. Output is a compact JWE string (`{header}.{enc-key}.{iv}.{ct}.{tag}`).
+ *
+ * Used for `TokenStore.saveCode` — the auth-code payload is encrypted at
+ * rest. The compact-JWE format embeds the `kid` so `consumeCode` can pick
+ * the right key during overlap rotation.
+ *
+ * For symmetric direct encryption we use `dir` with `A256GCM`, so the
+ * supplied `keyBytes` is the content-encryption key itself.
+ */
+export declare function encryptPayload(payload: unknown, kid: string, keyBytes: Uint8Array): Promise<string>;
+/** Inverse of {@link encryptPayload}. Returns the parsed JSON payload. */
+export declare function decryptPayload<T = unknown>(jwe: string, resolveKey: (kid: string) => Promise<Uint8Array>): Promise<T>;
+/** Generate a fresh 32-byte AES-256 / HMAC-SHA-256 key. */
+export declare function generateSymmetricKey(): Uint8Array;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/types/domain/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/domain/crypto.ts"],"names":[],"mappings":"AAQA,0DAA0D;AAC1D,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED,uDAAuD;AACvD,wBAAgB,QAAQ,IAAI,MAAM,CAIjC;AAED,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAIrD;AAED,0EAA0E;AAC1E,eAAO,MAAM,SAAS;mBACL,UAAU,GAAG,MAAM,KAAG,MAAM;gBAC/B,MAAM,KAAG,UAAU;CAChC,CAAA;AAED,qBAAqB;AACrB,eAAO,MAAM,IAAI;gBACH,MAAM,KAAG,UAAU;gBACnB,UAAU,KAAG,MAAM;CAChC,CAAA;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAKrE;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,sBAAsB;AACtB,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAI3E;AAED,6DAA6D;AAC7D,wBAAsB,aAAa,CACjC,GAAG,EAAE,UAAU,EACf,KAAK,GAAE,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAsB,GAC3D,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED,yBAAyB;AACzB,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,0EAA0E;AAC1E,wBAAsB,cAAc,CAAC,CAAC,GAAG,OAAO,EAC9C,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,GAC/C,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED,2DAA2D;AAC3D,wBAAgB,oBAAoB,IAAI,UAAU,CAIjD"}

package/dist/types/domain/discovery.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Metadata-document builders for `/.well-known/openid-configuration` and
+ * `/.well-known/jwks.json`.
+ *
+ * Pure functions over typed ports + a small options record.
+ */
+import type { KeyStore } from "../ports/key-store";
+import type { AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import { buildJwksDocument } from "./jwt";
+export type DiscoveryDocument = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    revocation_endpoint: string;
+    introspection_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    scopes_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    code_challenge_methods_supported: string[];
+};
+export type DiscoveryDeps = {
+    issuerUrl: string;
+    /** Override path defaults if mounted under a non-root prefix. */
+    paths?: Partial<{
+        authorize: string;
+        token: string;
+        userinfo: string;
+        jwks: string;
+        revoke: string;
+        introspect: string;
+    }>;
+    /** Advertised scopes. Defaults to `["openid", "email", "profile"]`. */
+    scopes?: string[];
+};
+export declare function buildDiscoveryDocument(deps: DiscoveryDeps): DiscoveryDocument;
+export type JwksDoc = ReturnType<typeof buildJwksDocument>;
+export declare function buildJwks(keyStore: KeyStore): Promise<Result<JwksDoc, AuthError>>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/types/domain/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/domain/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAA;AAEzC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,uBAAuB,EAAE,MAAM,EAAE,CAAA;IACjC,qCAAqC,EAAE,MAAM,EAAE,CAAA;IAC/C,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qCAAqC,EAAE,MAAM,EAAE,CAAA;IAC/C,gCAAgC,EAAE,MAAM,EAAE,CAAA;CAC3C,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,MAAM,CAAA;KACnB,CAAC,CAAA;IACF,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB,CAAA;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA2B7E;AAED,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE1D,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAIrC"}

package/dist/types/domain/introspect.d.ts

@@ -0,0 +1,71 @@
+/**
+ * `/introspect` endpoint logic (RFC 7662).
+ *
+ * RFC 7662 §2.1 REQUIRES authentication: "To prevent token scanning
+ * attacks, the endpoint MUST also require some form of authorization to
+ * access this endpoint." Confidential-client credentials are validated
+ * against the **presenter's** tenant — resolved by the HTTP layer from
+ * the request, exactly the same way `/token client_credentials` resolves
+ * tenant. Authenticating before touching the token's `tid` means:
+ *
+ *   - Unknown presenting client OR wrong secret → `invalid_client`
+ *     (uniform — the response says nothing about the token).
+ *   - Token belongs to a different tenant than the presenter, or names a
+ *     different client as audience, or fails verification → `{active: false}`.
+ *
+ * Pre-fix the order was "verify token → load token's tenant → look up
+ * presenter in *that* tenant", which let a client authenticated in
+ * tenant X probe whether its `client_id` existed in tenant Y by
+ * watching for `invalid_client` versus `{active: false}` responses.
+ *
+ * Audience check (RFC 7662 §2.2): an authenticated client may only
+ * inspect tokens that name it as the audience. Tokens belonging to a
+ * different client return `{ active: false }` — never a structured
+ * error — to avoid leaking which tokens exist.
+ *
+ * Refresh tokens are not introspectable here; RFC 7662 §2.1 only
+ * requires access-token introspection, and our refresh tokens are
+ * opaque and don't carry the standard introspection metadata.
+ */
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TenantId } from "../types/tenant";
+export type IntrospectResponse = {
+    active: false;
+} | {
+    active: true;
+    sub: string;
+    aud: string;
+    iss: string;
+    exp: number;
+    iat: number;
+    scope?: string;
+    client_id?: string;
+    tid: string;
+    mid?: string;
+    mkind?: string;
+};
+export type IntrospectRequest = {
+    token: string;
+    tokenTypeHint?: "access_token" | "refresh_token";
+    /** REQUIRED — RFC 7662 §2.1. */
+    clientId: string;
+    clientSecret?: string;
+    /**
+     * The tenant the presenting client belongs to. Resolved by the HTTP
+     * layer via `IdPOptions.resolveTenant`, just like for the m2m grant.
+     * Cross-tenant introspection collapses to `{active: false}` regardless
+     * of whether the presenter's client exists in the token's tenant.
+     */
+    presenterTenantId: TenantId;
+};
+export type IntrospectDeps = {
+    keyStore: KeyStore;
+    configStore: ConfigStore;
+    /** Expected issuer for additional validation. */
+    issuerUrl?: string;
+};
+export declare function introspect(req: IntrospectRequest, deps: IntrospectDeps): Promise<Result<IntrospectResponse, AuthError>>;
+//# sourceMappingURL=introspect.d.ts.map

package/dist/types/domain/introspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.d.ts","sourceRoot":"","sources":["../../../src/domain/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAK/C,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IACE,MAAM,EAAE,IAAI,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAEL,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAA;IAChD,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,iBAAiB,EAAE,QAAQ,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,EAAE,WAAW,CAAA;IACxB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,CA8DhD"}

package/dist/types/domain/jwt.d.ts

@@ -0,0 +1,48 @@
+/**
+ * JWT signing + verification for access tokens, plus the JWKS document
+ * builder consumed by `/.well-known/jwks.json`.
+ *
+ * Per AD9 / AD11, access tokens are JWTs (ES256 default; Ed25519 supported).
+ * Refresh tokens are opaque server-side records — they do NOT pass through
+ * this module.
+ */
+import type { JWK, KeyLike } from "jose";
+import type { AccessTokenClaims } from "../types/token";
+import type { SigningKey } from "../ports/key-store";
+/**
+ * Sign an access-token claim set under the supplied private key. `kid` is
+ * stamped into the JWT header so verifiers can look up the right public
+ * key from JWKS.
+ */
+export declare function signAccessToken(claims: AccessTokenClaims, privateKey: KeyLike, alg: string, kid: string): Promise<string>;
+/**
+ * Verify a JWT access token using a list of trusted signing keys (from
+ * `KeyStore.signingKeys()`). Looks up by `kid` in the JWT header.
+ *
+ * Algorithm enforcement: the allow-list is derived from the loaded
+ * `SigningKey.alg` values, intersected with the asymmetric allow-list
+ * (`ES256`, `EdDSA`). Symmetric (`HS*`) and `none` are filtered out, so a
+ * symmetric key accidentally landing in the store does not open an
+ * alg-confusion path. The kid resolver also rejects `alg: "none"`
+ * explicitly as defense in depth — `jose` already refuses tokens whose
+ * header `alg` is outside `algorithms`, but a future call site that
+ * dropped the option would still be safe.
+ *
+ * Returns the typed claims on success. Throws (via `jose`) on any
+ * signature, expiry, or alg-mismatch failure — callers wrap in `try` and
+ * convert to `Result`.
+ */
+export declare function verifyAccessToken(token: string, keys: ReadonlyArray<SigningKey>, options?: {
+    issuer?: string;
+    audience?: string;
+}): Promise<AccessTokenClaims>;
+/**
+ * Build the JWKS document for `/.well-known/jwks.json`. Includes active +
+ * recently-rotated keys (the overlap window) so consumers caching JWKS
+ * continue to verify tokens signed under a just-retired key until they
+ * refresh.
+ */
+export declare function buildJwksDocument(keys: ReadonlyArray<SigningKey>): {
+    keys: JWK[];
+};
+//# sourceMappingURL=jwt.d.ts.map

package/dist/types/domain/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/domain/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,OAAO,EACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAC/B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAAC,iBAAiB,CAAC,CAgC5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG;IAClE,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ,CASA"}

package/dist/types/domain/method-cache.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `MethodCache` — loads `AuthMethodFactory` builds per
+ * `(tenantId, MethodConfig.id)` and caches the result.
+ *
+ * Responsibilities per plan §"Per-tenant config → typed method config":
+ *  1. Look up the factory by `MethodConfig.kind`. Unknown kind → audit
+ *     `unknown_method_kind`, treat instance as disabled.
+ *  2. Validate `MethodConfig.config` against `factory.configSchema`.
+ *     Failure → audit `invalid_method_config`, treat instance as disabled.
+ *  3. Call `factory.build({ id, kind, tenantId, config })`. Verify the
+ *     returned `AuthMethod` has `id` / `kind` matching the inputs. Mismatch
+ *     → audit `factory_id_mismatch`, fail the load.
+ *  4. Cache per `(tenantId, MethodConfig.id)`. The cache is in-process —
+ *     TTL is governed by the `ConfigStore` invalidation hook in Phase 3+;
+ *     in Phase 2 / tests, manual `invalidate(tenantId)` is sufficient.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import { type AuthError } from "../types/error";
+import type { AnyAuthMethodFactory, AuthMethod } from "../types/method";
+import type { Result } from "../types/result";
+import type { TenantConfig, TenantId } from "../types/tenant";
+export type MethodCacheOptions = {
+    factories: Record<string, AnyAuthMethodFactory>;
+    auditLog?: AuditLog;
+    /** Injectable clock for audit timestamps. */
+    now: () => number;
+};
+export declare class MethodCache {
+    #private;
+    constructor(opts: MethodCacheOptions);
+    /**
+     * Load (or fetch from cache) the `AuthMethod` for the given tenant +
+     * tenant-local method instance id. Returns `method_not_found` for any
+     * disabled / unknown / invalid-config path.
+     */
+    resolve(tenant: TenantConfig, methodId: string): Promise<Result<AuthMethod, AuthError>>;
+    /** Drop cached instances for a tenant. Called on config invalidation. */
+    invalidate(tenantId: TenantId, methodId?: string): void;
+    /** List all enabled methods for a tenant — used by method-selection UI. */
+    listAvailable(tenant: TenantConfig): Promise<AuthMethod[]>;
+}
+//# sourceMappingURL=method-cache.d.ts.map

package/dist/types/domain/method-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-cache.d.ts","sourceRoot":"","sources":["../../../src/domain/method-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE3E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC/C,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,MAAM,CAAA;CAClB,CAAA;AAED,qBAAa,WAAW;;gBAQV,IAAI,EAAE,kBAAkB;IAMpC;;;;OAIG;IACG,OAAO,CACX,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAsCzC,yEAAyE;IACzE,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAevD,2EAA2E;IACrE,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAgHjE"}

package/dist/types/domain/method-dispatch.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Method dispatch — invoke a method's route handler, then enforce the
+ * `saveMethodState` durability contract.
+ *
+ * Per `ARCHITECTURE.md`: when a method handler returns
+ * `{ kind: "challenge", saveMethodState }`, the framework MUST persist
+ * `methodState` via `SessionStore.updateFlowMethodState` **before**
+ * surfacing the response. Centralizing that here keeps the
+ * happens-before contract uniform across every call site.
+ */
+import type { SessionStore } from "../ports/session-store";
+import { type AuthError } from "../types/error";
+import type { FlowRecord } from "../types/flow";
+import type { AuthMethod, MethodDispatchData, MethodResult } from "../types/method";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+export type RouteKey = `${"GET" | "POST"} ${string}`;
+export type DispatchInput = {
+    method: AuthMethod;
+    route: RouteKey;
+    tenant: TenantContext;
+    request: Request;
+    subPath: string;
+    flow: FlowRecord | null;
+    cookies: ReadonlyMap<string, string>;
+    sessionStore: SessionStore;
+    /** Populated at `GET /authorize`; null on callbacks. */
+    dispatch: MethodDispatchData | null;
+};
+/**
+ * Invoke the named route on the method. If the result is a challenge with
+ * `saveMethodState`, persist it to `SessionStore` and only then return.
+ * The framework owns this happens-before guarantee so methods cannot
+ * accidentally surface a redirect before the upstream verifier is durable.
+ */
+export declare function dispatchMethod(input: DispatchInput): Promise<Result<MethodResult<unknown, unknown>, AuthError>>;
+//# sourceMappingURL=method-dispatch.d.ts.map

package/dist/types/domain/method-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAEpD,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAgD5D"}

package/dist/types/domain/method-route.d.ts

@@ -0,0 +1,77 @@
+/**
+ * `handleMethodRoute` — the third pipeline.
+ *
+ * `/authorize` and `/cb/:methodId` are the two pipelines that produce a
+ * flow record and consume it respectively. Credential-style methods
+ * (password, code, passkey) additionally need a way to make in-flight
+ * POSTs against the IdP — submitting a login form, asking for a one-time
+ * code, completing a WebAuthn ceremony. The HTTP layer mounts these at
+ * `/m/<methodId>/<subPath>` and delegates here.
+ *
+ * Responsibilities:
+ *   1. Read `flowId` from the framework-set HttpOnly `idp.flow` cookie.
+ *      No cookie → `invalid_request` (the user lost their flow).
+ *   2. `SessionStore.readFlow(flowId)` — peek, do not consume. Methods may
+ *      need multiple round trips before completing (e.g. send-code →
+ *      verify-code).
+ *   3. Tenant must match the cookie's flow. If the request's tenant
+ *      (resolved via `resolveTenant`) disagrees with the flow's tenant,
+ *      audit `flow_tenant_mismatch` and reject. This is the same invariant
+ *      the upstream-callback path enforces.
+ *   4. Dispatch the method's `<METHOD> <subPath>` route.
+ *   5. Translate `MethodResult`:
+ *      - `challenge` → return response (methodState merged before send).
+ *      - `success`   → `consumeFlow`, snapshot into auth code, return
+ *                      `issue-code` for the HTTP layer to redirect.
+ *      - `denied`    → return reason; HTTP layer renders.
+ *      - `error`     → propagated.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { KeyStore } from "../ports/key-store";
+import type { SessionStore } from "../ports/session-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { CachePolicy, SetCookie } from "../types/method";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+import { MethodCache } from "./method-cache";
+export type MethodRouteOutput = {
+    kind: "issue-code";
+    code: string;
+    appRedirectUri: string;
+    appState: string | null;
+} | {
+    kind: "challenge";
+    response: Response;
+    setCookies: SetCookie[];
+    cache?: CachePolicy;
+} | {
+    kind: "denied";
+    reason: string;
+    setCookies: SetCookie[];
+};
+export type HandleMethodRouteInput = {
+    rawRequest: Request;
+    tenant: TenantContext;
+    /** Tenant-local instance id (`MethodConfig.id`) parsed from the URL. */
+    methodId: string;
+    /** Path within the method's mount, e.g. `"/login"`. */
+    subPath: string;
+    /** HTTP method of the incoming request: `"GET"` or `"POST"`. */
+    httpMethod: "GET" | "POST";
+    /** flowId from the `idp.flow` cookie. */
+    flowId: string;
+    cookies: ReadonlyMap<string, string>;
+};
+export type HandleMethodRouteDeps = {
+    sessionStore: SessionStore;
+    tokenStore: TokenStore;
+    /** Needed for at-rest encryption of the code payload — see `domain/token.ts`. */
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    clock: () => number;
+    newCodeId?: () => string;
+};
+export declare function handleMethodRoute(input: HandleMethodRouteInput, deps: HandleMethodRouteDeps): Promise<Result<MethodRouteOutput, AuthError>>;
+//# sourceMappingURL=method-route.d.ts.map

package/dist/types/domain/method-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAgB,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAgD/C"}

package/dist/types/domain/pkce.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Compute the S256 challenge for a verifier. Used at `/token` to recompute
+ * the expected challenge from the supplied `code_verifier` and compare it
+ * (timing-safe) against the challenge stashed in the auth-code payload.
+ */
+export declare function s256Challenge(verifier: string): Promise<string>;
+/**
+ * Verify a `code_verifier` against a previously-stored `code_challenge`.
+ *
+ * - Returns `false` on any length / character anomaly without computing the
+ *   hash — these are public-shape checks, not secret-dependent.
+ * - Uses a constant-time compare for the recomputed challenge.
+ */
+export declare function validatePkce(verifier: string, challenge: string): Promise<boolean>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/types/domain/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/domain/pkce.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/types/domain/refresh.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `/token` endpoint logic for `grant_type=refresh_token`.
+ *
+ * Rotation semantics (plan §"Cross-cutting Decisions" + §"Port consistency
+ * contracts"):
+ *
+ *  - Refresh tokens rotate on every use. The presented token is consumed
+ *    (CAS); a fresh refresh token is issued, keyed by the same `family`.
+ *  - If the same token is presented a second time within the reuse window
+ *    (default 60 s), the family is revoked and the request is rejected
+ *    with `invalid_grant`. Audit: `refresh_reuse_detected`.
+ *  - Outside the reuse window the row should be GC'd; presentation
+ *    returns `invalid_grant` ("unknown token").
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TokenResponse } from "../types/token";
+export type RefreshGrantRequest = {
+    grantType: "refresh_token";
+    refreshToken: string;
+    /** Optional per RFC 6749 — narrow scope. If absent, original scopes are reused. */
+    scope?: string;
+    /** Confidential clients authenticate at /token. */
+    clientId?: string;
+    clientSecret?: string;
+};
+export type RefreshTokensDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    issuerUrl: string;
+    clock: () => number;
+    /** Reuse-detection window (ms). Default 60 s. */
+    reuseWindowMs?: number;
+    newRefreshToken?: () => string;
+};
+export declare function refreshTokens(req: RefreshGrantRequest, deps: RefreshTokensDeps): Promise<Result<TokenResponse, AuthError>>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/types/domain/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/domain/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;CAC/B,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmH3C"}