@absolutejs/auth 0.68.2 → 0.69.1

package/dist/oidc/index.js

@@ -46,6 +46,141 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
+// src/constants.ts
+var SECONDS_IN_A_MINUTE = 60, MILLISECONDS_IN_A_SECOND = 1000, MILLISECONDS_IN_A_MINUTE, MINUTES_IN_AN_HOUR = 60, HOURS_IN_A_DAY = 24, MILLISECONDS_IN_A_DAY, MILLISECONDS_IN_AN_HOUR, COOKIE_MINUTES = 30, COOKIE_DURATION, DEFAULT_MAX_SESSIONS = 1e4;
+var init_constants = __esm(() => {
+  MILLISECONDS_IN_A_MINUTE = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE;
+  MILLISECONDS_IN_A_DAY = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR * HOURS_IN_A_DAY;
+  MILLISECONDS_IN_AN_HOUR = MILLISECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR;
+  COOKIE_DURATION = SECONDS_IN_A_MINUTE * COOKIE_MINUTES;
+});
+
+// src/crypto.ts
+var exports_crypto = {};
+__export(exports_crypto, {
+  verifyTotp: () => verifyTotp,
+  verifyPassword: () => verifyPassword,
+  hashToken: () => hashToken,
+  hashPassword: () => hashPassword,
+  generateTotpSecret: () => generateTotpSecret,
+  generateTotp: () => generateTotp,
+  generateSecureToken: () => generateSecureToken,
+  generateEncryptionKey: () => generateEncryptionKey,
+  encryptSecret: () => encryptSecret,
+  decryptSecret: () => decryptSecret,
+  createTotpKeyUri: () => createTotpKeyUri,
+  constantTimeEqual: () => constantTimeEqual,
+  base32Encode: () => base32Encode,
+  base32Decode: () => base32Decode
+});
+var DEFAULT_TOKEN_BYTES = 32, AES_KEY_BYTES = 32, AES_IV_BYTES = 12, HOTP_COUNTER_BYTES = 8, TOTP_SECRET_BYTES = 20, TOTP_DIGITS = 6, TOTP_PERIOD_SECONDS = 30, DEFAULT_TOTP_WINDOW = 1, DECIMAL_RADIX = 10, LAST_NIBBLE_MASK = 15, SIGN_BIT_MASK = 2147483647, BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", BASE32_GROUP_BITS = 5, BASE32_MASK = 31, BYTE_BITS = 8, textEncoder, textDecoder3, base64UrlEncode = (bytes) => Buffer.from(bytes).toString("base64url"), base64UrlDecode = (encoded) => new Uint8Array(Buffer.from(encoded, "base64url")), sha256 = async (input) => {
+  const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(input));
+  return new Uint8Array(digest);
+}, hmacSha1 = async (key, message) => {
+  const cryptoKey = await crypto.subtle.importKey("raw", Uint8Array.from(key), { hash: "SHA-1", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, Uint8Array.from(message));
+  return new Uint8Array(signature);
+}, counterToBytes = (counter) => {
+  const bytes = new Uint8Array(HOTP_COUNTER_BYTES);
+  new DataView(bytes.buffer).setBigUint64(0, BigInt(counter), false);
+  return bytes;
+}, generateHotp = async (secret, counter, digits = TOTP_DIGITS) => {
+  const hmac = await hmacSha1(secret, counterToBytes(counter));
+  const view = new DataView(hmac.buffer, hmac.byteOffset, hmac.byteLength);
+  const offset = view.getUint8(hmac.byteLength - 1) & LAST_NIBBLE_MASK;
+  const truncated = view.getUint32(offset, false) & SIGN_BIT_MASK;
+  const otp = truncated % DECIMAL_RADIX ** digits;
+  return otp.toString().padStart(digits, "0");
+}, importAesKey = (keyMaterial) => crypto.subtle.importKey("raw", base64UrlDecode(keyMaterial), { name: "AES-GCM" }, false, ["decrypt", "encrypt"]), base32Decode = (encoded) => {
+  const normalized = encoded.toUpperCase().replace(/[^A-Z2-7]/gu, "");
+  const bits = [...normalized].map((char4) => BASE32_ALPHABET.indexOf(char4).toString(2).padStart(BASE32_GROUP_BITS, "0")).join("");
+  const byteChunks = bits.match(/.{8}/gu) ?? [];
+  return new Uint8Array(byteChunks.map((chunk) => parseInt(chunk, 2)));
+}, base32Encode = (bytes) => {
+  const bits = Array.from(bytes, (byte) => byte.toString(2).padStart(BYTE_BITS, "0")).join("");
+  const groups = bits.match(/.{1,5}/gu) ?? [];
+  return groups.map((group) => BASE32_ALPHABET[parseInt(group.padEnd(BASE32_GROUP_BITS, "0"), 2) & BASE32_MASK] ?? "").join("");
+}, constantTimeEqual = async (left, right) => {
+  const [leftDigest, rightDigest] = await Promise.all([
+    sha256(left),
+    sha256(right)
+  ]);
+  const leftView = new DataView(leftDigest.buffer, leftDigest.byteOffset, leftDigest.byteLength);
+  const rightView = new DataView(rightDigest.buffer, rightDigest.byteOffset, rightDigest.byteLength);
+  let mismatch = 0;
+  for (let index2 = 0;index2 < leftDigest.byteLength; index2 += 1) {
+    mismatch |= leftView.getUint8(index2) ^ rightView.getUint8(index2);
+  }
+  return mismatch === 0;
+}, createTotpKeyUri = ({
+  accountName,
+  digits = TOTP_DIGITS,
+  issuer,
+  period = TOTP_PERIOD_SECONDS,
+  secret
+}) => {
+  const params = new URLSearchParams({
+    algorithm: "SHA1",
+    digits: `${digits}`,
+    issuer,
+    period: `${period}`,
+    secret
+  });
+  const label = encodeURIComponent(`${issuer}:${accountName}`);
+  return `otpauth://totp/${label}?${params.toString()}`;
+}, decryptSecret = async (ciphertext, keyMaterial) => {
+  const key = await importAesKey(keyMaterial);
+  const combined = base64UrlDecode(ciphertext);
+  const nonce = combined.subarray(0, AES_IV_BYTES);
+  const data = combined.subarray(AES_IV_BYTES);
+  const plaintext = await crypto.subtle.decrypt({ iv: nonce, name: "AES-GCM" }, key, data);
+  return textDecoder3.decode(plaintext);
+}, encryptSecret = async (plaintext, keyMaterial) => {
+  const key = await importAesKey(keyMaterial);
+  const nonce = new Uint8Array(AES_IV_BYTES);
+  crypto.getRandomValues(nonce);
+  const ciphertext = await crypto.subtle.encrypt({ iv: nonce, name: "AES-GCM" }, key, textEncoder.encode(plaintext));
+  const combined = new Uint8Array(nonce.byteLength + ciphertext.byteLength);
+  combined.set(nonce, 0);
+  combined.set(new Uint8Array(ciphertext), nonce.byteLength);
+  return base64UrlEncode(combined);
+}, generateEncryptionKey = () => generateSecureToken(AES_KEY_BYTES), generateSecureToken = (byteLength = DEFAULT_TOKEN_BYTES) => {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes);
+}, generateTotp = async ({
+  digits = TOTP_DIGITS,
+  now = Date.now(),
+  period = TOTP_PERIOD_SECONDS,
+  secret
+}) => {
+  const counter = Math.floor(now / MILLISECONDS_IN_A_SECOND / period);
+  return generateHotp(base32Decode(secret), counter, digits);
+}, generateTotpSecret = (byteLength = TOTP_SECRET_BYTES) => {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base32Encode(bytes);
+}, hashPassword = (password) => Bun.password.hash(password, { algorithm: "argon2id" }), hashToken = async (token) => base64UrlEncode(await sha256(token)), verifyPassword = (password, hash) => Bun.password.verify(password, hash), verifyTotp = async ({
+  digits = TOTP_DIGITS,
+  now = Date.now(),
+  period = TOTP_PERIOD_SECONDS,
+  secret,
+  token,
+  window = DEFAULT_TOTP_WINDOW
+}) => {
+  const secretBytes = base32Decode(secret);
+  const counter = Math.floor(now / MILLISECONDS_IN_A_SECOND / period);
+  const drifts = Array.from({ length: window * 2 + 1 }, (_, offset) => counter - window + offset);
+  const candidates = await Promise.all(drifts.map((value) => generateHotp(secretBytes, value, digits)));
+  const matches = await Promise.all(candidates.map((candidate) => constantTimeEqual(candidate, token)));
+  return matches.includes(true);
+};
+var init_crypto = __esm(() => {
+  init_constants();
+  textEncoder = new TextEncoder;
+  textDecoder3 = new TextDecoder;
+});
+
 // src/oidc/keys.ts
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
@@ -11835,13 +11970,24 @@ var oauthRefreshTokensTable = pgTable("auth_oauth_refresh_tokens", {
   audience: varchar("audience", { length: URL_LENGTH }),
   claims_json: jsonb("claims_json").$type(),
   client_id: varchar("client_id", { length: ID_LENGTH }).notNull(),
+  consumed_token_hashes: text("consumed_token_hashes").array().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  family_id: varchar("family_id", { length: ID_LENGTH }).notNull(),
+  revoked_at_ms: bigint("revoked_at_ms", { mode: "number" }),
   scopes: text("scopes").array().notNull(),
   token_hash: varchar("token_hash", { length: ID_LENGTH }).primaryKey(),
   user_id: varchar("user_id", { length: ID_LENGTH }).notNull()
 });
+var oauthSocketTicketsTable = pgTable("auth_oauth_socket_tickets", {
+  audience: varchar("audience", { length: URL_LENGTH }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  scopes: text("scopes").array().notNull(),
+  subject: varchar("subject", { length: ID_LENGTH }).notNull(),
+  ticket_hash: varchar("ticket_hash", { length: ID_LENGTH }).primaryKey()
+});
 var toClient = (row) => ({
   backchannelLogoutUri: row.backchannel_logout_uri ?? undefined,
   clientId: row.client_id,
@@ -11915,6 +12061,7 @@ var toRefresh = (row) => ({
   createdAt: row.created_at_ms,
   dpopJkt: row.dpop_jkt ?? undefined,
   expiresAt: row.expires_at_ms,
+  familyId: row.family_id,
   scopes: row.scopes,
   tokenHash: row.token_hash,
   userId: row.user_id
@@ -11924,9 +12071,12 @@ var toRefreshValues = (token) => ({
   audience: token.audience ?? null,
   claims_json: token.claims ?? null,
   client_id: token.clientId,
+  consumed_token_hashes: [],
   created_at_ms: token.createdAt,
   dpop_jkt: token.dpopJkt ?? null,
   expires_at_ms: token.expiresAt,
+  family_id: token.familyId,
+  revoked_at_ms: null,
   scopes: token.scopes,
   token_hash: token.tokenHash,
   user_id: token.userId
@@ -12105,7 +12255,7 @@ var createPostgresOAuthClientStore = (db) => ({
 });
 var createPostgresOidcRefreshTokenStore = (db) => ({
   consumeToken: async (tokenHash) => {
-    const [row] = await db.delete(oauthRefreshTokensTable).where(eq(oauthRefreshTokensTable.token_hash, tokenHash)).returning();
+    const [row] = await db.delete(oauthRefreshTokensTable).where(or(eq(oauthRefreshTokensTable.token_hash, tokenHash), sql`${tokenHash} = ANY(${oauthRefreshTokensTable.consumed_token_hashes})`)).returning();
     return row ? toRefresh(row) : undefined;
   },
   deleteForClient: async (clientId) => {
@@ -12120,20 +12270,46 @@ var createPostgresOidcRefreshTokenStore = (db) => ({
     return deleted.length;
   },
   getToken: async (tokenHash) => {
-    const [row] = await db.select().from(oauthRefreshTokensTable).where(eq(oauthRefreshTokensTable.token_hash, tokenHash)).limit(1);
+    const [row] = await db.select().from(oauthRefreshTokensTable).where(and(eq(oauthRefreshTokensTable.token_hash, tokenHash), isNull(oauthRefreshTokensTable.revoked_at_ms))).limit(1);
     return row ? toRefresh(row) : undefined;
   },
   listClientIdsForUser: async (userId) => {
-    const rows = await db.selectDistinct({ client_id: oauthRefreshTokensTable.client_id }).from(oauthRefreshTokensTable).where(and(eq(oauthRefreshTokensTable.user_id, userId), gt(oauthRefreshTokensTable.expires_at_ms, Date.now())));
+    const rows = await db.selectDistinct({ client_id: oauthRefreshTokensTable.client_id }).from(oauthRefreshTokensTable).where(and(eq(oauthRefreshTokensTable.user_id, userId), isNull(oauthRefreshTokensTable.revoked_at_ms), gt(oauthRefreshTokensTable.expires_at_ms, Date.now())));
     return rows.map((row) => row.client_id);
   },
   listConnections: async () => {
     const rows = await db.selectDistinct({
       clientId: oauthRefreshTokensTable.client_id,
       userId: oauthRefreshTokensTable.user_id
-    }).from(oauthRefreshTokensTable).where(gt(oauthRefreshTokensTable.expires_at_ms, Date.now()));
+    }).from(oauthRefreshTokensTable).where(and(gt(oauthRefreshTokensTable.expires_at_ms, Date.now()), isNull(oauthRefreshTokensTable.revoked_at_ms)));
     return rows;
   },
+  revokeByConsumedToken: async (tokenHash) => {
+    const rows = await db.update(oauthRefreshTokensTable).set({ revoked_at_ms: Date.now() }).where(and(isNull(oauthRefreshTokensTable.revoked_at_ms), sql`${tokenHash} = ANY(${oauthRefreshTokensTable.consumed_token_hashes})`)).returning({ familyId: oauthRefreshTokensTable.family_id });
+    return rows.length > 0;
+  },
+  rotateToken: async (currentTokenHash, replacement) => {
+    const active = and(eq(oauthRefreshTokensTable.token_hash, currentTokenHash), isNull(oauthRefreshTokensTable.revoked_at_ms));
+    const consumed = sql`${currentTokenHash} = ANY(${oauthRefreshTokensTable.consumed_token_hashes})`;
+    const rows = await db.update(oauthRefreshTokensTable).set({
+      acr: sql`CASE WHEN ${active} THEN ${replacement.acr ?? null} ELSE ${oauthRefreshTokensTable.acr} END`,
+      audience: sql`CASE WHEN ${active} THEN ${replacement.audience ?? null} ELSE ${oauthRefreshTokensTable.audience} END`,
+      claims_json: sql`CASE WHEN ${active} THEN ${JSON.stringify(replacement.claims ?? null)}::jsonb ELSE ${oauthRefreshTokensTable.claims_json} END`,
+      client_id: sql`CASE WHEN ${active} THEN ${replacement.clientId} ELSE ${oauthRefreshTokensTable.client_id} END`,
+      consumed_token_hashes: sql`CASE WHEN ${active} THEN array_append(${oauthRefreshTokensTable.consumed_token_hashes}, ${currentTokenHash}) ELSE ${oauthRefreshTokensTable.consumed_token_hashes} END`,
+      created_at_ms: sql`CASE WHEN ${active} THEN ${replacement.createdAt} ELSE ${oauthRefreshTokensTable.created_at_ms} END`,
+      dpop_jkt: sql`CASE WHEN ${active} THEN ${replacement.dpopJkt ?? null} ELSE ${oauthRefreshTokensTable.dpop_jkt} END`,
+      expires_at_ms: sql`CASE WHEN ${active} THEN ${replacement.expiresAt} ELSE ${oauthRefreshTokensTable.expires_at_ms} END`,
+      revoked_at_ms: sql`CASE WHEN ${consumed} THEN ${Date.now()} ELSE ${oauthRefreshTokensTable.revoked_at_ms} END`,
+      scopes: sql`CASE WHEN ${active} THEN ${replacement.scopes} ELSE ${oauthRefreshTokensTable.scopes} END`,
+      token_hash: sql`CASE WHEN ${active} THEN ${replacement.tokenHash} ELSE ${oauthRefreshTokensTable.token_hash} END`,
+      user_id: sql`CASE WHEN ${active} THEN ${replacement.userId} ELSE ${oauthRefreshTokensTable.user_id} END`
+    }).where(or(active, consumed)).returning({
+      revokedAt: oauthRefreshTokensTable.revoked_at_ms,
+      tokenHash: oauthRefreshTokensTable.token_hash
+    });
+    return rows.length === 1 && rows[0]?.revokedAt === null && rows[0]?.tokenHash === replacement.tokenHash;
+  },
   saveToken: async (token) => {
     await db.insert(oauthRefreshTokensTable).values(toRefreshValues(token));
   }
@@ -12207,6 +12383,408 @@ var createPostgresBackchannelAuthStore = (db) => ({
     await db.update(oauthBackchannelAuthRequestsTable).set({ status, user_sub: userSub ?? null }).where(eq(oauthBackchannelAuthRequestsTable.auth_req_id, authReqId));
   }
 });
+var toSocketTicket = (row) => ({
+  audience: row.audience,
+  clientId: row.client_id,
+  expiresAt: row.expires_at_ms,
+  scopes: row.scopes,
+  subject: row.subject,
+  ticketHash: row.ticket_hash
+});
+var createNeonSocketTicketStore = (databaseUrl) => createPostgresSocketTicketStore(createNeonDatabase(databaseUrl));
+var createPostgresSocketTicketStore = (db) => ({
+  consumeTicket: async (ticketHash, now = Date.now()) => {
+    const [row] = await db.delete(oauthSocketTicketsTable).where(eq(oauthSocketTicketsTable.ticket_hash, ticketHash)).returning();
+    if (!row || row.expires_at_ms <= now)
+      return;
+    return toSocketTicket(row);
+  },
+  saveTicket: async (ticket) => {
+    await db.insert(oauthSocketTicketsTable).values({
+      audience: ticket.audience,
+      client_id: ticket.clientId,
+      expires_at_ms: ticket.expiresAt,
+      scopes: ticket.scopes,
+      subject: ticket.subject,
+      ticket_hash: ticket.ticketHash
+    });
+  }
+});
+// src/oidc/inMemoryStores.ts
+var DEFAULT_LIST_LIMIT2 = 100;
+var createInMemoryAuthorizationCodeStore = () => {
+  const codes = new Map;
+  return {
+    consumeCode: async (codeHash) => {
+      const record = codes.get(codeHash);
+      codes.delete(codeHash);
+      return record;
+    },
+    deleteForClient: async (clientId) => {
+      let deleted = 0;
+      for (const [hash, code] of codes) {
+        if (code.clientId !== clientId)
+          continue;
+        codes.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
+    deleteForUserClient: async (userId, clientId) => {
+      let deleted = 0;
+      for (const [hash, code] of codes) {
+        if (code.userId !== userId || code.clientId !== clientId)
+          continue;
+        codes.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
+    saveCode: async (code) => {
+      codes.set(code.codeHash, { ...code });
+    }
+  };
+};
+var createInMemoryBackchannelAuthStore = () => {
+  const byAuthReqId = new Map;
+  return {
+    deleteByAuthReqId: async (authReqId) => {
+      byAuthReqId.delete(authReqId);
+    },
+    findByAuthReqId: async (authReqId) => byAuthReqId.get(authReqId),
+    recordPoll: async (authReqId, polledAt) => {
+      const record = byAuthReqId.get(authReqId);
+      if (!record)
+        return;
+      byAuthReqId.set(authReqId, { ...record, lastPolledAt: polledAt });
+    },
+    saveBackchannelAuth: async (request) => {
+      byAuthReqId.set(request.authReqId, { ...request });
+    },
+    updateStatus: async (authReqId, status, userSub) => {
+      const record = byAuthReqId.get(authReqId);
+      if (!record)
+        return;
+      byAuthReqId.set(authReqId, { ...record, status, userSub });
+    }
+  };
+};
+var createInMemoryClientAssertionJtiStore = () => {
+  const seen = new Map;
+  return {
+    recordIfFresh: async (clientId, jti, expiresAt) => {
+      const now = Date.now();
+      for (const [key, expiry] of seen) {
+        if (expiry < now)
+          seen.delete(key);
+      }
+      const composite = `${clientId}|${jti}`;
+      if (seen.has(composite))
+        return false;
+      seen.set(composite, expiresAt);
+      return true;
+    }
+  };
+};
+var createInMemoryClientRegistrationTokenStore = () => {
+  const byHash = new Map;
+  return {
+    deleteByClientId: async (clientId) => {
+      for (const [hash, token] of byHash) {
+        if (token.clientId === clientId)
+          byHash.delete(hash);
+      }
+    },
+    deleteForClient: async (clientId) => {
+      let deleted = 0;
+      for (const [hash, token] of byHash) {
+        if (token.clientId !== clientId)
+          continue;
+        byHash.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
+    findByTokenHash: async (tokenHash) => byHash.get(tokenHash),
+    saveToken: async (token) => {
+      for (const [hash, existing] of byHash) {
+        if (existing.clientId === token.clientId)
+          byHash.delete(hash);
+      }
+      byHash.set(token.tokenHash, { ...token });
+    }
+  };
+};
+var createInMemoryDeviceAuthorizationStore = () => {
+  const byDeviceCode = new Map;
+  return {
+    deleteByDeviceCodeHash: async (deviceCodeHash) => {
+      byDeviceCode.delete(deviceCodeHash);
+    },
+    deleteForClient: async (clientId) => {
+      let deleted = 0;
+      for (const [hash, authorization] of byDeviceCode) {
+        if (authorization.clientId !== clientId)
+          continue;
+        byDeviceCode.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
+    deleteForUserClient: async (userId, clientId) => {
+      let deleted = 0;
+      for (const [hash, authorization] of byDeviceCode) {
+        if (authorization.userSub !== userId || authorization.clientId !== clientId)
+          continue;
+        byDeviceCode.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
+    findByDeviceCodeHash: async (deviceCodeHash) => byDeviceCode.get(deviceCodeHash),
+    findByUserCode: async (userCode) => {
+      for (const record of byDeviceCode.values()) {
+        if (record.userCode === userCode)
+          return record;
+      }
+      return;
+    },
+    saveDeviceAuthorization: async (deviceAuthorization) => {
+      byDeviceCode.set(deviceAuthorization.deviceCodeHash, {
+        ...deviceAuthorization
+      });
+    },
+    updateStatus: async (deviceCodeHash, status, userSub) => {
+      const record = byDeviceCode.get(deviceCodeHash);
+      if (!record)
+        return;
+      byDeviceCode.set(deviceCodeHash, {
+        ...record,
+        status,
+        userSub
+      });
+    }
+  };
+};
+var createInMemoryInitialAccessTokenStore = (initialHashes = []) => {
+  const remaining = new Set(initialHashes);
+  return {
+    consumeToken: async (tokenHash) => {
+      if (!remaining.has(tokenHash))
+        return false;
+      remaining.delete(tokenHash);
+      return true;
+    }
+  };
+};
+var createInMemoryLogoutDeliveryStore = () => {
+  const failures = new Map;
+  return {
+    listFailed: async (limit = DEFAULT_LIST_LIMIT2) => Array.from(failures.values()).sort((left, right) => right.createdAt - left.createdAt).slice(0, limit),
+    recordFailure: async (delivery) => {
+      failures.set(delivery.id, delivery);
+    },
+    removeFailure: async (deliveryId) => {
+      failures.delete(deliveryId);
+    }
+  };
+};
+var createInMemoryOAuthClientStore = (clients) => {
+  const registry = new Map(clients.map((client) => [client.clientId, client]));
+  return {
+    deleteClient: async (clientId) => {
+      registry.delete(clientId);
+    },
+    findClient: async (clientId) => registry.get(clientId),
+    saveClient: async (client) => {
+      registry.set(client.clientId, { ...client });
+    },
+    updateClient: async (clientId, client) => {
+      registry.set(clientId, { ...client });
+    }
+  };
+};
+var createInMemoryOidcRefreshTokenStore = () => {
+  const families = new Map;
+  const activeForHash = (tokenHash) => {
+    for (const family of families.values()) {
+      if (!family.revoked && family.token.tokenHash === tokenHash)
+        return family;
+    }
+    return;
+  };
+  const familyForConsumedHash = (tokenHash) => {
+    for (const family of families.values())
+      if (family.consumed.has(tokenHash))
+        return family;
+    return;
+  };
+  return {
+    consumeToken: async (tokenHash) => {
+      const family = activeForHash(tokenHash) ?? familyForConsumedHash(tokenHash);
+      if (!family)
+        return;
+      families.delete(family.token.familyId);
+      return family.token;
+    },
+    deleteForClient: async (clientId) => {
+      let deleted = 0;
+      for (const [familyId, family] of families) {
+        if (family.token.clientId !== clientId)
+          continue;
+        families.delete(familyId);
+        deleted += 1;
+      }
+      return deleted;
+    },
+    deleteForUser: async (userId) => {
+      for (const [familyId, family] of families) {
+        if (family.token.userId === userId)
+          families.delete(familyId);
+      }
+    },
+    deleteForUserClient: async (userId, clientId) => {
+      let deleted = 0;
+      for (const [familyId, family] of families) {
+        if (family.token.userId !== userId || family.token.clientId !== clientId)
+          continue;
+        families.delete(familyId);
+        deleted += 1;
+      }
+      return deleted;
+    },
+    getToken: async (tokenHash) => activeForHash(tokenHash)?.token,
+    listClientIdsForUser: async (userId) => {
+      const now = Date.now();
+      const active = Array.from(families.values()).filter((family) => !family.revoked && family.token.userId === userId && family.token.expiresAt > now);
+      return Array.from(new Set(active.map((family) => family.token.clientId)));
+    },
+    listConnections: async () => {
+      const now = Date.now();
+      const connections = new Map;
+      for (const family of families.values()) {
+        const { token } = family;
+        if (family.revoked || token.expiresAt <= now)
+          continue;
+        const connection = {
+          clientId: token.clientId,
+          userId: token.userId
+        };
+        connections.set(`${connection.userId}\x00${connection.clientId}`, connection);
+      }
+      return Array.from(connections.values());
+    },
+    revokeByConsumedToken: async (tokenHash) => {
+      const family = familyForConsumedHash(tokenHash);
+      if (!family)
+        return false;
+      family.revoked = true;
+      return true;
+    },
+    rotateToken: async (currentTokenHash, replacement) => {
+      const family = activeForHash(currentTokenHash);
+      if (family) {
+        family.consumed.add(currentTokenHash);
+        family.token = { ...replacement };
+        return true;
+      }
+      const reused = familyForConsumedHash(currentTokenHash);
+      if (reused)
+        reused.revoked = true;
+      return false;
+    },
+    saveToken: async (token) => {
+      families.set(token.familyId, {
+        consumed: new Set,
+        revoked: false,
+        token: { ...token }
+      });
+    }
+  };
+};
+var createInMemoryPushedAuthorizationRequestStore = () => {
+  const requests = new Map;
+  return {
+    consumeRequest: async (requestUriHash) => {
+      const record = requests.get(requestUriHash);
+      if (record === undefined)
+        return;
+      requests.delete(requestUriHash);
+      if (record.expiresAt < Date.now())
+        return;
+      return record;
+    },
+    saveRequest: async (request) => {
+      requests.set(request.requestUriHash, { ...request });
+    }
+  };
+};
+var createInMemorySocketTicketStore = () => {
+  const tickets = new Map;
+  return {
+    consumeTicket: async (ticketHash, now = Date.now()) => {
+      const ticket = tickets.get(ticketHash);
+      tickets.delete(ticketHash);
+      if (!ticket || ticket.expiresAt <= now)
+        return;
+      return { ...ticket, scopes: [...ticket.scopes] };
+    },
+    saveTicket: async (ticket) => {
+      tickets.set(ticket.ticketHash, {
+        ...ticket,
+        scopes: [...ticket.scopes]
+      });
+    }
+  };
+};
+// src/oidc/socketTickets.ts
+init_crypto();
+var DEFAULT_SOCKET_TICKET_TTL_MS = 30000;
+var TICKET_BYTES = 32;
+var consumeSocketTicket = async ({
+  audience,
+  getUser,
+  now = Date.now(),
+  store,
+  ticket
+}) => {
+  const record = await store.consumeTicket(await hashToken(ticket), now);
+  if (!record || record.audience !== audience)
+    return;
+  const user = await getUser(record.subject);
+  if (user === null)
+    return;
+  return {
+    audience: record.audience,
+    clientId: record.clientId,
+    kind: "access-token",
+    scopes: [...record.scopes],
+    subject: record.subject,
+    user
+  };
+};
+var issueSocketTicket = async ({
+  audience,
+  clientId,
+  now = Date.now(),
+  scopes,
+  store,
+  subject,
+  ttlMs = DEFAULT_SOCKET_TICKET_TTL_MS
+}) => {
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0)
+    throw new Error("socketTicketTtlMs must be positive");
+  const ticket = `ast_${generateSecureToken(TICKET_BYTES)}`;
+  await store.saveTicket({
+    audience,
+    clientId,
+    expiresAt: now + ttlMs,
+    scopes: [...scopes],
+    subject,
+    ticketHash: await hashToken(ticket)
+  });
+  return { expiresInMs: ttlMs, ticket };
+};
 export {
   verifyJwtWithKeys,
   verifyJwt,
@@ -12215,7 +12793,9 @@ export {
   signJwt,
   revokeOAuthClientCredentials,
   jwkThumbprint,
+  issueSocketTicket,
   generateSigningKey,
+  createPostgresSocketTicketStore,
   createPostgresOidcRefreshTokenStore,
   createPostgresOAuthClientStore,
   createPostgresInitialAccessTokenStore,
@@ -12223,14 +12803,17 @@ export {
   createPostgresClientRegistrationTokenStore,
   createPostgresClientAssertionJtiStore,
   createPostgresAuthorizationCodeStore,
+  createNeonSocketTicketStore,
   createNeonOidcRefreshTokenStore,
   createNeonOAuthClientStore,
   createNeonInitialAccessTokenStore,
   createNeonDeviceAuthorizationStore,
   createNeonClientRegistrationTokenStore,
   createNeonClientAssertionJtiStore,
-  createNeonAuthorizationCodeStore
+  createNeonAuthorizationCodeStore,
+  createInMemorySocketTicketStore,
+  consumeSocketTicket
 };
 
-//# debugId=09059391C2D6086264756E2164756E21
+//# debugId=B37CCAB8EEBB54A964756E2164756E21
 //# sourceMappingURL=index.js.map