@adonis-agora/authkit-server 0.77.0 → 0.79.0

package/build/src/agents/poppy/config.js

@@ -0,0 +1,208 @@
+/** Scopes amplos definidos pelo protocolo (§4.4). */
+export const POPPY_READ = 'poppy:read';
+export const POPPY_WRITE = 'poppy:write';
+/** Descrições default dos scopes do protocolo — o que a tela de consentimento mostra. */
+export const POPPY_SCOPE_DESCRIPTIONS = {
+    [POPPY_READ]: 'View your account information, such as orders and bookings',
+    [POPPY_WRITE]: 'Make changes on your account, such as exchanging an item or updating a booking',
+};
+const SCOPE_ID = /^[\x21\x23-\x5B\x5D-\x7E]+$/; // RFC 6749 §3.3 scope-token
+const DOMAIN = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+function fail(message) {
+    throw new Error(`authkit: personalAgents.poppy.${message}`);
+}
+function positive(value, fallback, what) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isFinite(value) || value <= 0)
+        fail(`${what} precisa ser > 0.`);
+    return Math.floor(value);
+}
+function absoluteUrl(value, what) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        fail(`${what} precisa ser uma URL absoluta (recebeu "${value}").`);
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        fail(`${what} precisa ser http(s) (recebeu "${value}").`);
+    }
+}
+/** `www.example.com` → `example.com`, minúsculo. */
+export function stripWww(host) {
+    const lower = host.toLowerCase().replace(/\.$/, '');
+    return lower.startsWith('www.') ? lower.slice(4) : lower;
+}
+export function normalizePoppyPrefix(prefix) {
+    const trimmed = (prefix ?? '/poppy').trim().replace(/\/+$/, '');
+    if (!trimmed)
+        return '/poppy';
+    return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+}
+function membership(value) {
+    if (typeof value === 'function')
+        return async (id) => (await value(id)) === true;
+    const set = new Set(value ?? []);
+    return async (id) => set.has(id);
+}
+function listOf(value) {
+    if (typeof value === 'function')
+        return null;
+    return [...new Set(value ?? [])];
+}
+function typeScopes(input, all, what) {
+    if (input === false)
+        return null;
+    const scopes = typeof input === 'object' && input.scopes ? [...new Set(input.scopes)] : all;
+    for (const id of scopes) {
+        if (!all.includes(id))
+            fail(`signIn.${what}.scopes — scope desconhecido "${id}".`);
+    }
+    if (scopes.length === 0)
+        fail(`signIn.${what}.scopes precisa de pelo menos um scope.`);
+    return { scopes };
+}
+export function resolvePoppyConfig(input, fallbackScopes) {
+    if (!input)
+        return undefined;
+    const org = input.organization;
+    if (!org?.name?.trim())
+        fail('organization.name é obrigatório.');
+    const domains = [org.domain, ...(org.aliases ?? [])].map((d) => stripWww(d ?? ''));
+    for (const d of domains) {
+        if (!DOMAIN.test(d))
+            fail(`organization — domínio inválido "${d}" (só o host, sem esquema).`);
+    }
+    const customScopes = { ...(input.scopes ?? fallbackScopes ?? {}) };
+    for (const id of Object.keys(customScopes)) {
+        if (!SCOPE_ID.test(id))
+            fail(`scopes — id inválido "${id}" (sem espaços/aspas).`);
+        if (id.startsWith('poppy:')) {
+            fail(`scopes — "${id}": nomes com "poppy:" são reservados ao protocolo (§4.4).`);
+        }
+    }
+    const broad = input.broadScopes !== false;
+    const scopes = {
+        ...(broad
+            ? {
+                [POPPY_READ]: input.broadScopeDescriptions?.[POPPY_READ] ?? POPPY_SCOPE_DESCRIPTIONS[POPPY_READ],
+                [POPPY_WRITE]: input.broadScopeDescriptions?.[POPPY_WRITE] ?? POPPY_SCOPE_DESCRIPTIONS[POPPY_WRITE],
+            }
+            : {}),
+        ...customScopes,
+    };
+    const all = Object.keys(scopes);
+    const signInInput = input.signIn ?? {};
+    let mediated = null;
+    if (signInInput.mediated) {
+        const m = signInInput.mediated;
+        if (!Array.isArray(m.fields) || m.fields.length === 0) {
+            fail('signIn.mediated.fields precisa de pelo menos um campo.');
+        }
+        const names = new Set();
+        for (const f of m.fields) {
+            if (!f?.name || !f.label || typeof f.secret !== 'boolean') {
+                fail('signIn.mediated.fields — cada campo precisa de name, label e secret.');
+            }
+            if (names.has(f.name))
+                fail(`signIn.mediated.fields — campo duplicado "${f.name}".`);
+            names.add(f.name);
+        }
+        if (typeof m.verify !== 'function')
+            fail('signIn.mediated.verify é obrigatório.');
+        const mediatedScopes = typeScopes({ scopes: m.scopes ?? (broad ? [POPPY_READ] : all) }, all, 'mediated').scopes;
+        mediated = {
+            fields: m.fields.map((f) => ({ name: f.name, label: f.label, secret: f.secret })),
+            scopes: mediatedScopes,
+            verify: m.verify,
+            verifyCode: m.verifyCode,
+            codeTtl: positive(m.codeTtl, 600, 'signIn.mediated.codeTtl'),
+            maxCodeAttempts: positive(m.maxCodeAttempts, 5, 'signIn.mediated.maxCodeAttempts'),
+        };
+    }
+    if (all.length === 0 && (signInInput.direct !== false || signInInput.device !== false)) {
+        fail('nenhum scope: com broadScopes: false, declare `scopes`.');
+    }
+    for (const entry of input.agent?.protocols ?? []) {
+        if (!entry.type)
+            fail('agent.protocols[].type é obrigatório.');
+        absoluteUrl(entry.endpoint, 'agent.protocols[].endpoint');
+        if (entry.resource)
+            absoluteUrl(entry.resource, 'agent.protocols[].resource');
+    }
+    for (const api of input.apis ?? []) {
+        if (!api.type)
+            fail('apis[].type é obrigatório.');
+        absoluteUrl(api.url, 'apis[].url');
+        if (api.resource)
+            absoluteUrl(api.resource, 'apis[].resource');
+        if (typeof api.description !== 'string')
+            fail('apis[].description é obrigatório.');
+    }
+    for (const name of Object.keys(input.extensions ?? {})) {
+        if (typeof input.extensions[name]?.version !== 'string') {
+            fail(`extensions.${name}.version é obrigatório (string).`);
+        }
+    }
+    const dpopAlgs = input.dpop?.algorithms ?? ['ES256'];
+    if (dpopAlgs.length === 0 || dpopAlgs.some((a) => a === 'none' || a.startsWith('HS'))) {
+        fail('dpop.algorithms precisa de algoritmos assimétricos.');
+    }
+    const allowInsecureClientIds = input.allowInsecureClientIds === true;
+    if (allowInsecureClientIds && process.env.NODE_ENV === 'production') {
+        fail('allowInsecureClientIds é só para desenvolvimento/teste e não pode ser ligado com NODE_ENV=production.');
+    }
+    let rateLimit;
+    if (input.rateLimit === false)
+        rateLimit = false;
+    else if (typeof input.rateLimit === 'function')
+        rateLimit = input.rateLimit;
+    else {
+        rateLimit = {
+            sessionsPerMinute: positive(input.rateLimit?.sessionsPerMinute, 120, 'rateLimit.sessionsPerMinute'),
+            mediatedPerHour: positive(input.rateLimit?.mediatedPerHour, 10, 'rateLimit.mediatedPerHour'),
+        };
+    }
+    return {
+        organization: { name: org.name, domain: domains[0], aliases: domains.slice(1) },
+        prefix: normalizePoppyPrefix(input.prefix),
+        scopes,
+        customScopes,
+        signIn: {
+            direct: typeScopes(signInInput.direct, all, 'direct'),
+            device: typeScopes(signInInput.device, all, 'device'),
+            mediated,
+        },
+        agent: input.agent?.protocols?.length ? { protocols: [...input.agent.protocols] } : null,
+        apis: [...(input.apis ?? [])],
+        web: input.web === false
+            ? null
+            : { browserSession: input.web?.browserSession !== false, login: input.web?.login },
+        extensions: { ...(input.extensions ?? {}) },
+        clients: {
+            requireRegistration: input.clients?.requireRegistration === true,
+            isRegistered: membership(input.clients?.registered),
+            isBlocked: membership(input.clients?.blocked),
+            registeredList: listOf(input.clients?.registered),
+            blockedList: listOf(input.clients?.blocked),
+        },
+        allowInsecureClientIds,
+        sessionTokenTtl: positive(input.sessionTokenTtl, 3600, 'sessionTokenTtl'),
+        accountTokenTtl: positive(input.accountTokenTtl, 30 * 24 * 3600, 'accountTokenTtl'),
+        sessionTtl: positive(input.sessionTtl, 30 * 24 * 3600, 'sessionTtl'),
+        authorizationCodeTtl: positive(input.authorizationCodeTtl, 60, 'authorizationCodeTtl'),
+        deviceCodeTtl: positive(input.deviceCodeTtl, 600, 'deviceCodeTtl'),
+        pollInterval: positive(input.pollInterval, 5, 'pollInterval'),
+        assertionMaxLifetime: positive(input.assertionMaxLifetime, 300, 'assertionMaxLifetime'),
+        dpop: {
+            requireNonce: input.dpop?.requireNonce === true,
+            maxAge: positive(input.dpop?.maxAge, 60, 'dpop.maxAge'),
+            algorithms: [...dpopAlgs],
+        },
+        replay: input.replay ?? 'database',
+        rateLimit,
+        toActor: input.toActor,
+    };
+}

package/build/src/agents/poppy/dpop.d.ts

@@ -0,0 +1,61 @@
+import type { PoppyReplayStore } from './config.js';
+export type DpopFailure = {
+    ok: false;
+    error: 'invalid_dpop_proof' | 'use_dpop_nonce';
+    description: string;
+};
+export type DpopResult = {
+    ok: true;
+    jkt: string;
+    jti: string;
+} | DpopFailure;
+export interface DpopNonceSource {
+    /** Nonce novo para o header `DPoP-Nonce`. */
+    issue(): string;
+    /** O nonce ainda vale? */
+    valid(nonce: string): boolean;
+}
+/**
+ * Nonces sem estado: `base64url(ts).base64url(hmac(ts))`, válidos por
+ * `ttlSeconds` (default 300). Qualquer instância com o mesmo segredo valida.
+ *
+ * @experimental Poppy (Personal Agent Protocol) Draft 0.1 — acompanha a spec em desenvolvimento e PODE MUDAR
+ *   de forma incompatível fora de majors enquanto ela for draft.
+ */
+export declare function hmacNonceSource(secret: Buffer | string, options?: {
+    ttlSeconds?: number;
+    now?: () => number;
+}): DpopNonceSource;
+/** `ath`: base64url(SHA-256(access token)). */
+export declare function accessTokenHash(token: string): string;
+/**
+ * `htu` normalizado para comparação: esquema e host minúsculos, sem porta
+ * default, sem query nem fragmento. `null` se não for URL http(s).
+ */
+export declare function normalizeHtu(value: string): string | null;
+export interface VerifyDpopInput {
+    /** Valor do(s) header(s) `DPoP`. Mais de um = inválido. */
+    proof: string | string[] | undefined | null;
+    method: string;
+    /** URL da request (a query é ignorada). */
+    url: string;
+    /** Access token apresentado junto (resource server) — exige `ath`. */
+    accessToken?: string;
+    /** Thumbprint (RFC 7638) a que o token está preso. */
+    expectedJkt?: string;
+    algorithms: string[];
+    /** Janela do `iat`, em segundos. */
+    maxAge: number;
+    /** Tolerância de relógio para `iat` no futuro, em segundos. Default: 5. */
+    clockSkew?: number;
+    replay: PoppyReplayStore;
+    nonce?: {
+        required: boolean;
+        source: DpopNonceSource;
+    };
+    now?: () => number;
+}
+/**
+ * @experimental Poppy (Personal Agent Protocol) Draft 0.1 — pode mudar de forma incompatível enquanto a spec for draft.
+ */
+export declare function verifyDpopProof(input: VerifyDpopInput): Promise<DpopResult>;

package/build/src/agents/poppy/dpop.js

@@ -0,0 +1,158 @@
+/**
+ * Verificação de provas DPoP (RFC 9449) — utilitário genérico para o token
+ * endpoint e para resource servers (§4.3 do Poppy).
+ *
+ * Confere: um único header `DPoP`; `typ` `dpop+jwt`; algoritmo permitido; `jwk`
+ * público no header e a assinatura com ele; `jti`, `htm`, `htu` (sem query nem
+ * fragmento), `iat` dentro da janela; `ath` = SHA-256 do access token; o
+ * `nonce` quando exigido; replay do `jti` na janela; e, num resource server, que
+ * a chave é a do token (`cnf.jkt`).
+ */
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { calculateJwkThumbprint, decodeProtectedHeader, EmbeddedJWK, jwtVerify, } from 'jose';
+import { replayKey } from './replay.js';
+/**
+ * Nonces sem estado: `base64url(ts).base64url(hmac(ts))`, válidos por
+ * `ttlSeconds` (default 300). Qualquer instância com o mesmo segredo valida.
+ *
+ * @experimental Poppy (Personal Agent Protocol) Draft 0.1 — acompanha a spec em desenvolvimento e PODE MUDAR
+ *   de forma incompatível fora de majors enquanto ela for draft.
+ */
+export function hmacNonceSource(secret, options = {}) {
+    const ttl = (options.ttlSeconds ?? 300) * 1000;
+    const now = options.now ?? Date.now;
+    const mac = (ts) => createHmac('sha256', secret).update(`dpop-nonce:${ts}`).digest('base64url');
+    return {
+        issue() {
+            const ts = Buffer.from(String(now())).toString('base64url');
+            return `${ts}.${mac(ts)}`;
+        },
+        valid(nonce) {
+            const [ts, sig] = nonce.split('.');
+            if (!ts || !sig)
+                return false;
+            const expected = Buffer.from(mac(ts));
+            const given = Buffer.from(sig);
+            if (expected.length !== given.length || !timingSafeEqual(expected, given))
+                return false;
+            const issuedAt = Number(Buffer.from(ts, 'base64url').toString());
+            const t = now();
+            return Number.isFinite(issuedAt) && issuedAt <= t + 5000 && t - issuedAt <= ttl;
+        },
+    };
+}
+/** `ath`: base64url(SHA-256(access token)). */
+export function accessTokenHash(token) {
+    return createHash('sha256').update(token).digest('base64url');
+}
+/**
+ * `htu` normalizado para comparação: esquema e host minúsculos, sem porta
+ * default, sem query nem fragmento. `null` se não for URL http(s).
+ */
+export function normalizeHtu(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return null;
+        url.hash = '';
+        url.search = '';
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function failure(error, description) {
+    return { ok: false, error, description };
+}
+/**
+ * @experimental Poppy (Personal Agent Protocol) Draft 0.1 — pode mudar de forma incompatível enquanto a spec for draft.
+ */
+export async function verifyDpopProof(input) {
+    const raw = input.proof;
+    if (raw === undefined || raw === null || raw === '') {
+        return failure('invalid_dpop_proof', 'DPoP proof is missing');
+    }
+    if (Array.isArray(raw) ? raw.length !== 1 : raw.includes(',')) {
+        return failure('invalid_dpop_proof', 'Exactly one DPoP proof is allowed');
+    }
+    const proof = Array.isArray(raw) ? raw[0] : raw;
+    let header;
+    try {
+        header = decodeProtectedHeader(proof);
+    }
+    catch {
+        return failure('invalid_dpop_proof', 'Malformed DPoP proof');
+    }
+    if (header.typ !== 'dpop+jwt')
+        return failure('invalid_dpop_proof', 'typ must be dpop+jwt');
+    if (!header.alg || !input.algorithms.includes(header.alg)) {
+        return failure('invalid_dpop_proof', 'Unsupported DPoP algorithm');
+    }
+    const jwk = header.jwk;
+    if (!jwk || typeof jwk !== 'object')
+        return failure('invalid_dpop_proof', 'jwk header is required');
+    if ('d' in jwk || jwk.kty === 'oct') {
+        return failure('invalid_dpop_proof', 'jwk must be a public key');
+    }
+    const nowMs = (input.now ?? Date.now)();
+    let payload;
+    try {
+        ({ payload } = await jwtVerify(proof, EmbeddedJWK, {
+            algorithms: input.algorithms,
+            typ: 'dpop+jwt',
+            currentDate: new Date(nowMs),
+        }));
+    }
+    catch {
+        return failure('invalid_dpop_proof', 'DPoP proof signature is invalid');
+    }
+    const { jti, htm, htu, iat, ath, nonce } = payload;
+    if (typeof jti !== 'string' || jti.length < 8 || jti.length > 256) {
+        return failure('invalid_dpop_proof', 'jti is required');
+    }
+    if (typeof htm !== 'string' || htm !== input.method.toUpperCase()) {
+        return failure('invalid_dpop_proof', 'htm does not match the request method');
+    }
+    const expectedHtu = normalizeHtu(input.url);
+    if (typeof htu !== 'string' || !expectedHtu || normalizeHtu(htu) !== expectedHtu) {
+        return failure('invalid_dpop_proof', 'htu does not match the request URL');
+    }
+    const nowS = Math.floor(nowMs / 1000);
+    const skew = input.clockSkew ?? 5;
+    if (typeof iat !== 'number' || iat > nowS + skew || iat < nowS - input.maxAge) {
+        return failure('invalid_dpop_proof', 'iat is outside the acceptance window');
+    }
+    if (input.accessToken !== undefined) {
+        if (typeof ath !== 'string' || ath !== accessTokenHash(input.accessToken)) {
+            return failure('invalid_dpop_proof', 'ath does not match the access token');
+        }
+    }
+    let jkt;
+    try {
+        jkt = await calculateJwkThumbprint(jwk, 'sha256');
+    }
+    catch {
+        return failure('invalid_dpop_proof', 'Invalid jwk');
+    }
+    if (input.expectedJkt !== undefined && jkt !== input.expectedJkt) {
+        return failure('invalid_dpop_proof', 'DPoP key does not match the token binding');
+    }
+    if (input.nonce?.required) {
+        if (typeof nonce !== 'string' || !input.nonce.source.valid(nonce)) {
+            return failure('use_dpop_nonce', 'A DPoP nonce issued by the server is required');
+        }
+    }
+    else if (nonce !== undefined && input.nonce && typeof nonce === 'string') {
+        // Nonce mandado sem ser exigido: se vier, tem de ser um nosso e válido.
+        if (!input.nonce.source.valid(nonce)) {
+            return failure('use_dpop_nonce', 'The DPoP nonce is invalid or expired');
+        }
+    }
+    // Replay por último: uma prova inválida não queima o `jti`.
+    const expiresAt = new Date((iat + input.maxAge + skew) * 1000);
+    if (!(await input.replay.claim(replayKey('dpop', jkt, jti), expiresAt))) {
+        return failure('invalid_dpop_proof', 'DPoP proof was already used');
+    }
+    return { ok: true, jkt, jti };
+}

package/build/src/agents/poppy/errors.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Erros OAuth do Poppy (§4.2, §4.4, §4.6, RFC 6749 §5.2, RFC 8628 §3.5, RFC 9449)
+ * — viram `{ error, error_description }` com o status da spec.
+ */
+export type PoppyErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_session' | 'account_mismatch' | 'invalid_dpop_proof' | 'use_dpop_nonce' | 'rate_limited' | 'invalid_scope' | 'invalid_target' | 'unsupported_grant_type' | 'unsupported_token_type' | 'unauthorized_client' | 'authorization_pending' | 'slow_down' | 'access_denied' | 'expired_token';
+export declare class PoppyError extends Error {
+    readonly code: PoppyErrorCode;
+    readonly description: string;
+    readonly status: number;
+    /** Headers extras da resposta (`DPoP-Nonce`, `Retry-After`). */
+    readonly headers: Record<string, string>;
+    constructor(code: PoppyErrorCode, description: string, options?: {
+        status?: number;
+        headers?: Record<string, string>;
+    });
+    toJSON(): {
+        error: PoppyErrorCode;
+        error_description: string;
+    };
+}

package/build/src/agents/poppy/errors.js

@@ -0,0 +1,22 @@
+const STATUS = {
+    invalid_client: 401,
+    rate_limited: 429,
+};
+export class PoppyError extends Error {
+    code;
+    description;
+    status;
+    /** Headers extras da resposta (`DPoP-Nonce`, `Retry-After`). */
+    headers;
+    constructor(code, description, options = {}) {
+        super(description);
+        this.code = code;
+        this.description = description;
+        this.name = 'PoppyError';
+        this.status = options.status ?? STATUS[code] ?? 400;
+        this.headers = options.headers ?? {};
+    }
+    toJSON() {
+        return { error: this.code, error_description: this.description };
+    }
+}

package/build/src/agents/poppy/replay.d.ts

@@ -0,0 +1,25 @@
+import type { PoppyLimiter, PoppyReplayStore } from './config.js';
+export declare const JTI_TABLE = "auth_poppy_jtis";
+/** Chave curta e de tamanho fixo para um `jti` de um tipo/agente. */
+export declare function replayKey(kind: string, ...parts: string[]): string;
+/** Em memória, por processo. Só serve com uma instância. */
+export declare function memoryReplayStore(options?: {
+    max?: number;
+    now?: () => number;
+}): PoppyReplayStore;
+/**
+ * Na tabela lib-owned `auth_poppy_jtis` (PK = chave): o INSERT de uma chave que
+ * já existe falha — atômico entre instâncias. Linhas vencidas saem aos poucos.
+ */
+export declare function databaseReplayStore(conn: () => any, options?: {
+    now?: () => Date;
+}): PoppyReplayStore;
+/** Numa conexão Redis (`SET key 1 PX ttl NX`). */
+export declare function redisReplayStore(redis: {
+    set: (...args: any[]) => Promise<unknown>;
+}): PoppyReplayStore;
+/** Janelas fixas em memória, por processo: `sessionsPerMinute` por agente, `mediatedPerHour` por (agente, usuário). */
+export declare function memoryLimiter(limits: {
+    sessionsPerMinute: number;
+    mediatedPerHour: number;
+}, now?: () => number): PoppyLimiter;

package/build/src/agents/poppy/replay.js

@@ -0,0 +1,106 @@
+/**
+ * Proteção contra replay (`jti` de asserções, client assertions, provas DPoP e
+ * asserções de navegador) e limites de taxa do Poppy.
+ */
+import { createHash } from 'node:crypto';
+export const JTI_TABLE = 'auth_poppy_jtis';
+/** Chave curta e de tamanho fixo para um `jti` de um tipo/agente. */
+export function replayKey(kind, ...parts) {
+    return `${kind}:${createHash('sha256').update(parts.join('\u0000')).digest('base64url')}`;
+}
+/** Em memória, por processo. Só serve com uma instância. */
+export function memoryReplayStore(options = {}) {
+    const seen = new Map();
+    const max = options.max ?? 100_000;
+    const now = options.now ?? Date.now;
+    let claims = 0;
+    return {
+        async claim(key, expiresAt) {
+            const t = now();
+            if (++claims % 1000 === 0 || seen.size >= max) {
+                for (const [k, exp] of seen)
+                    if (exp <= t)
+                        seen.delete(k);
+            }
+            const existing = seen.get(key);
+            if (existing !== undefined && existing > t)
+                return false;
+            if (seen.size >= max)
+                seen.delete(seen.keys().next().value);
+            seen.set(key, expiresAt.getTime());
+            return true;
+        },
+    };
+}
+/**
+ * Na tabela lib-owned `auth_poppy_jtis` (PK = chave): o INSERT de uma chave que
+ * já existe falha — atômico entre instâncias. Linhas vencidas saem aos poucos.
+ */
+export function databaseReplayStore(conn, options = {}) {
+    const now = options.now ?? (() => new Date());
+    let claims = 0;
+    return {
+        async claim(key, expiresAt) {
+            const t = now();
+            if (++claims % 200 === 1) {
+                await conn().from(JTI_TABLE).where('expires_at', '<', t).delete();
+            }
+            try {
+                await conn().table(JTI_TABLE).insert({ key, expires_at: expiresAt });
+                return true;
+            }
+            catch (error) {
+                // Chave já usada — a não ser que a linha vencida ainda não tenha saído.
+                const row = await conn().from(JTI_TABLE).where('key', key).first();
+                if (!row)
+                    throw error;
+                const exp = row.expires_at instanceof Date
+                    ? row.expires_at
+                    : new Date(Number(row.expires_at) || row.expires_at);
+                if (exp.getTime() > t.getTime())
+                    return false;
+                const updated = await conn()
+                    .from(JTI_TABLE)
+                    .where('key', key)
+                    .where('expires_at', '<=', t)
+                    .update({ expires_at: expiresAt });
+                return ((typeof updated === 'number' ? updated : Array.isArray(updated) ? updated.length : 0) > 0);
+            }
+        },
+    };
+}
+/** Numa conexão Redis (`SET key 1 PX ttl NX`). */
+export function redisReplayStore(redis) {
+    return {
+        async claim(key, expiresAt) {
+            const ttl = Math.max(1000, expiresAt.getTime() - Date.now());
+            const result = await redis.set(`authkit:poppy:jti:${key}`, '1', 'PX', ttl, 'NX');
+            return result === 'OK';
+        },
+    };
+}
+/** Janelas fixas em memória, por processo: `sessionsPerMinute` por agente, `mediatedPerHour` por (agente, usuário). */
+export function memoryLimiter(limits, now = Date.now) {
+    const windows = new Map();
+    return async ({ action, key }) => {
+        const [limit, windowMs] = action === 'session'
+            ? [limits.sessionsPerMinute, 60_000]
+            : [limits.mediatedPerHour, 3_600_000];
+        const t = now();
+        const id = `${action}:${key}`;
+        let w = windows.get(id);
+        if (!w || t - w.start >= windowMs) {
+            w = { start: t, count: 0 };
+            windows.set(id, w);
+            if (windows.size > 50_000) {
+                for (const [k, v] of windows)
+                    if (t - v.start >= 3_600_000)
+                        windows.delete(k);
+            }
+        }
+        if (w.count >= limit)
+            return Math.ceil((w.start + windowMs - t) / 1000);
+        w.count++;
+        return null;
+    };
+}