@antasphere/chassis-server 1.0.0

package/dist/identity/hub-grant.js

@@ -0,0 +1,594 @@
+import pg from 'pg';
+import { Counter } from 'prom-client';
+import { and, eq } from 'drizzle-orm';
+import { symmetricDecrypt, symmetricEncrypt } from 'better-auth/crypto';
+import { account, hubGrantPresentations } from '@antasphere/chassis-db';
+import { HUB_SSO_PROVIDER_ID } from './hub-sso.js';
+/**
+ * The per-user hub grant (internal/federation.md, live user-scoped federation):
+ * a cloud tool holds each user's OWN `offline_access account:read` grant
+ * (plus `orgs:create` since PRDCT-2443 — hub-sso.ts HUB_SSO_SCOPES)
+ * — obtained at SSO login, persisted by Better Auth on the `account` row —
+ * and refreshes it against the hub's token endpoint to mint HUB-audienced
+ * access tokens (`resource=<hub>/mcp`, RFC 8707) that the hub's own
+ * `/api/v1` accepts. Everything the tool reads from the hub between logins
+ * is read AS THE USER with this grant; no service key exists anywhere in
+ * the user-facing path.
+ *
+ * Storage: the `account` row is the ONLY durable store (Better Auth already
+ * re-writes both tokens at every browser SSO login — the self-healing
+ * `hub_grant_expired` recovery path). With `account.encryptOAuthTokens: true`
+ * (identity/better-auth.ts) Better Auth encrypts what IT writes; this
+ * service encrypts/decrypts with the SAME primitive and the SAME key
+ * (`(await auth.$context).secretConfig` — with our string-secret config that
+ * is exactly the boot AUTH_SECRET), so the two writers are byte-compatible.
+ * Legacy plaintext rows pass through decrypt untouched (the 1.6.15
+ * `isLikelyEncrypted` rule, mirrored below).
+ *
+ * ── SECURITY-CRITICAL: refresh serialization ─────────────────────────────
+ * The hub rotates refresh tokens on EVERY use with RFC 9700 reuse
+ * detection: presenting a rotated-out token tears down the user's whole
+ * (client,user) grant family. A cross-replica double-refresh is therefore
+ * not a race, it is a GRANT-KILLING event. Discipline, in layers:
+ *
+ *  1. in-process single-flight per user (Map<userId, Promise>);
+ *  2. a cross-replica session-scoped `pg_advisory_lock(7432004,
+ *     hashtext(userId))` on a DEDICATED pg client (the accounts/deletion.ts
+ *     OWNER_GUARD_LOCK pattern). The two-int form keys a DIFFERENT advisory
+ *     lock space than pg-boss's single-int `pg_advisory_lock(7432004)`
+ *     (classid 7432004/objsubid 2 vs classid 0/objsubid 1) — no collision;
+ *  3. RE-READ AFTER LOCK: another replica may have refreshed while we
+ *     waited — a changed refresh token (or a now-fresh stored access token)
+ *     means we consume ITS result instead of presenting the stale token;
+ *  4. a ~10 s watchdog cuts the dedicated connection so a wedged refresh
+ *     can never park the lock forever (a session lock dies with its
+ *     session);
+ *  5. AMBIGUOUS OUTCOMES NEVER RE-PRESENT BLINDLY (PRDCT-1370). The hub
+ *     rotates BEFORE it answers and cannot roll back, so a client-side
+ *     timeout (or a lost response, or a 5xx after the commit) leaves us
+ *     holding a token the hub may already have rotated out — and presenting
+ *     it again is exactly the reuse-detection teardown above, reachable
+ *     with no attacker, only a hub that is slow but alive. Every
+ *     presentation is therefore recorded FIRST (`hub_grant_presentations`,
+ *     keyed by the account row, carrying the ciphertext presented) and the
+ *     record is cleared only once the hub's answer is known. A surviving
+ *     record makes the next refresh PROBE the token through the hub's
+ *     RFC 7662 introspection endpoint (`token_type_hint=refresh_token`,
+ *     read-only: the pinned plugin answers `active:false` for a rotated-out
+ *     token WITHOUT tearing the family down) and present it only when the
+ *     hub still calls it active; an inactive answer marks the grant dead
+ *     without ever presenting — the family, the CLI grant included, lives
+ *     on at the hub and a browser SSO login heals this user.
+ *
+ * Failure taxonomy (the token endpoint's answer decides):
+ *  - `invalid_grant` (expired / revoked / reuse-detected) → the grant is
+ *    DEAD: tokens on the row are nulled (dead marker = refreshToken IS
+ *    NULL); callers surface 401 `hub_grant_expired`; the next browser SSO
+ *    login re-seeds the row and heals it.
+ *  - `invalid_client` (broken client secret = OUR misconfiguration) →
+ *    transient, logged LOUD, and it never kills grants — a config mistake
+ *    must not mass-destroy every user's grant.
+ *  - network / timeout / 5xx / malformed → transient (inconclusive).
+ *
+ * Access tokens are cached in-memory to exp − accessSkewMs; the account
+ * row's stored access token is trusted while fresh (it was minted with the
+ * same `resource` by either the login exchange or a sibling replica's
+ * refresh). An oss boot never constructs this class.
+ */
+/** Advisory-lock classid for the per-user refresh lock (two-int form). */
+const GRANT_REFRESH_LOCK_KEY = 7_432_004;
+/** Headroom the lock watchdog keeps beyond probe + presentation (row reads/writes, lock latency). */
+export const LOCK_WATCHDOG_HEADROOM_MS = 2_000;
+export const DEFAULT_GRANT_DIALS = {
+    accessSkewMs: 60_000,
+    tokenTimeoutMs: 5_000,
+    introspectTimeoutMs: 5_000,
+    // ≥ tokenTimeoutMs + introspectTimeoutMs + LOCK_WATCHDOG_HEADROOM_MS; the
+    // constructor clamps anything smaller (see there).
+    lockWatchdogMs: 12_000
+};
+/**
+ * Mirror of Better Auth 1.6.15's `isLikelyEncrypted` (dist/oauth2/utils.mjs):
+ * its decrypt path passes LEGACY PLAINTEXT tokens through untouched, and so
+ * must ours — enabling encryption must never brick pre-existing grants.
+ * Exported for hub-logout.ts, whose id_token read mirrors the same
+ * tolerant rule. Re-verify on any Better Auth bump.
+ */
+export function isLikelyEncrypted(token) {
+    if (token.startsWith('$ba$'))
+        return true;
+    return token.length % 2 === 0 && /^[0-9a-f]+$/i.test(token);
+}
+export class HubGrantService {
+    opts;
+    /** userId → fresh access token (in-memory only; the row is the durable store). */
+    cache = new Map();
+    inFlight = new Map();
+    tokenUrl;
+    introspectUrl;
+    fetchImpl;
+    now;
+    dials;
+    /** Registered into the Prometheus registry by boot (cloud only). */
+    promMetrics;
+    refreshes;
+    constructor(opts) {
+        this.opts = opts;
+        this.tokenUrl = opts.issuerUrl.replace(/\/+$/, '') + '/api/v1/auth/oauth2/token';
+        this.introspectUrl = opts.issuerUrl.replace(/\/+$/, '') + '/api/v1/auth/oauth2/introspect';
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+        this.now = opts.now ?? Date.now;
+        // THE WATCHDOG MUST OUTLIVE THE LONGEST HOLD (PRDCT-1370 verifier
+        // finding): under the lock a refresh may now run the probe AND the
+        // presentation back to back, each up to its own timeout, plus the
+        // row reads and writes around them. A watchdog shorter than that cuts
+        // the lock mid-refresh, a sibling replica takes it and presents the
+        // SAME token — the double presentation the lock exists to prevent, and
+        // a family teardown at the hub. Clamped here, at the one place the
+        // dials are read, so no caller can under-size it.
+        const floor = opts.dials.tokenTimeoutMs + opts.dials.introspectTimeoutMs + LOCK_WATCHDOG_HEADROOM_MS;
+        this.dials = opts.dials.lockWatchdogMs >= floor ? opts.dials : { ...opts.dials, lockWatchdogMs: floor };
+        if (this.dials !== opts.dials) {
+            opts.logger.warn({ requested: opts.dials.lockWatchdogMs, effective: floor }, 'hub grant: lockWatchdogMs raised to cover probe + presentation under the lock');
+        }
+        // registers: [] — boot attaches this to the app registry on cloud; an
+        // oss boot never constructs this class, so the metric never exists there.
+        this.refreshes = new Counter({
+            name: 'hub_grant_refreshes_total',
+            help: 'Hub user-grant refresh attempts by outcome',
+            labelNames: ['outcome'],
+            registers: []
+        });
+        this.promMetrics = [this.refreshes];
+    }
+    /**
+     * Store the H3 offline grant — the raw one-time `hubRefreshToken` from
+     * the hub's `POST /sso/tool-token` response, delivered through
+     * `/sso/cli-connect` — on the user's `antasphere` account row, encrypted
+     * with the SAME primitive + key as every Better Auth write, so the
+     * ordinary refresh path consumes it exactly like a browser-SSO grant.
+     * This is what gives a HEADLESS CLI user live as-the-user org reads
+     * between browser logins (and replaces the Stage E interim, where a
+     * connect-minted key answered 401 hub_grant_expired until one browser
+     * SSO).
+     *
+     * Overwrites any previous grant unconditionally: the H3 mint is the
+     * NEWEST valid credential, and the replaced family simply idles to expiry
+     * at the hub. The stored access token is cleared (the new grant has none
+     * yet); the caller VALIDATES the grant end-to-end by running the
+     * fail-closed connect reconcile right after — a garbage token surfaces as
+     * `grant_dead` there and no key is minted.
+     *
+     * Throws when the user holds no `antasphere` account row — the connect
+     * flow provisions the link BEFORE acquiring the grant, so that is a
+     * wiring bug, never a user state.
+     */
+    async acquireFromConnect(userId, rawRefreshToken) {
+        const key = await this.opts.key();
+        const encrypted = await symmetricEncrypt({ key, data: rawRefreshToken });
+        const updated = await this.opts.db
+            .update(account)
+            .set({
+            accessToken: null,
+            accessTokenExpiresAt: null,
+            refreshToken: encrypted,
+            refreshTokenExpiresAt: null,
+            updatedAt: new Date()
+        })
+            .where(and(eq(account.userId, userId), eq(account.providerId, HUB_SSO_PROVIDER_ID)))
+            .returning({ id: account.id });
+        if (updated.length === 0) {
+            throw new Error('acquireFromConnect: no antasphere account row to store the grant on');
+        }
+        this.cache.delete(userId);
+    }
+    /**
+     * Whether a stored (possibly stale) grant exists — the connect route's
+     * born-dead guard for requests that carry no hubRefreshToken: with no
+     * stored grant either, minting a key would strand it on
+     * hub_grant_expired, so the connect refuses with steering instead.
+     */
+    async hasStoredGrant(userId) {
+        const row = await this.readRow(userId);
+        return Boolean(row?.refreshToken);
+    }
+    /**
+     * Seed the in-memory cache with the SSO callback's access token (already
+     * hub-audienced — the code exchange sends the same `resource`), so the
+     * login-path reads and the first post-login requests need no refresh.
+     */
+    prime(userId, accessToken, expiresAt) {
+        // Without a stated expiry, assume a conservative slice of the hub's
+        // 15-minute access tokens.
+        const expiresAtMs = expiresAt?.getTime() ?? this.now() + 5 * 60_000;
+        this.cache.set(userId, { token: accessToken, expiresAtMs });
+    }
+    /** Drop the cached access token (e.g. the hub just refused it). */
+    invalidateAccess(userId) {
+        this.cache.delete(userId);
+    }
+    /** A hub-callable access token for the user, refresh-on-demand. */
+    async accessToken(userId) {
+        const cached = this.cache.get(userId);
+        if (cached && cached.expiresAtMs - this.now() > this.dials.accessSkewMs) {
+            return { kind: 'ok', accessToken: cached.token };
+        }
+        return this.acquire(userId, false);
+    }
+    /**
+     * Force a refresh (the caller saw the hub refuse the current token).
+     * Serialized behind any in-flight acquisition; the advisory lock +
+     * re-read-after-lock still guarantee at most one live rotation.
+     */
+    async refresh(userId) {
+        this.cache.delete(userId);
+        const existing = this.inFlight.get(userId);
+        if (existing)
+            await existing.catch(() => { });
+        return this.acquire(userId, true);
+    }
+    acquire(userId, force) {
+        let flight = this.inFlight.get(userId);
+        if (!flight) {
+            flight = this.doAcquire(userId, force).finally(() => {
+                if (this.inFlight.get(userId) === flight)
+                    this.inFlight.delete(userId);
+            });
+            this.inFlight.set(userId, flight);
+        }
+        return flight;
+    }
+    async doAcquire(userId, force) {
+        try {
+            const first = await this.readRow(userId);
+            if (!first)
+                return { kind: 'no_link' };
+            if (!first.refreshToken)
+                return { kind: 'grant_dead' };
+            if (!force) {
+                const stored = await this.storedAccess(userId, first);
+                if (stored)
+                    return { kind: 'ok', accessToken: stored };
+            }
+            // Slow path: rotate under the cross-replica lock.
+            const lock = await this.acquireLock(userId);
+            try {
+                // RE-READ AFTER LOCK: a sibling replica (or a concurrent browser
+                // login) may have rotated while we waited. A changed refresh token
+                // means ITS access token is brand new — consume that instead of
+                // presenting our stale copy (which reuse detection would treat as
+                // an attack and kill the whole family).
+                const row = await this.readRow(userId);
+                if (!row)
+                    return { kind: 'no_link' };
+                if (!row.refreshToken)
+                    return { kind: 'grant_dead' };
+                if (!force || row.refreshToken !== first.refreshToken) {
+                    const stored = await this.storedAccess(userId, row);
+                    if (stored)
+                        return { kind: 'ok', accessToken: stored };
+                }
+                let refreshToken;
+                try {
+                    refreshToken = await this.decrypt(row.refreshToken);
+                }
+                catch (err) {
+                    // Undecryptable ≠ revoked: a key/config problem must never null
+                    // the row (the invalid_client stance). Loud, transient.
+                    this.refreshes.inc({ outcome: 'error' });
+                    this.opts.logger.error({ err, userId }, 'hub grant: stored refresh token failed to decrypt — check AUTH_SECRET continuity; failing transient');
+                    return { kind: 'inconclusive' };
+                }
+                // An UNANSWERED earlier presentation of this very ciphertext (layer
+                // 5): the hub may have rotated it out already. Probe, never guess.
+                if (await this.hasUnansweredPresentation(row)) {
+                    const probe = await this.introspect(refreshToken);
+                    if (probe === 'inactive') {
+                        await this.markDead(row);
+                        await this.clearPresentation(row.id);
+                        this.cache.delete(userId);
+                        this.refreshes.inc({ outcome: 'probe_dead' });
+                        this.opts.logger.warn({ userId }, 'hub grant: an earlier refresh went unanswered and the hub now reports the token inactive — ' +
+                            'grant marked dead WITHOUT re-presenting (the family survives at the hub); a browser SSO login heals it');
+                        return { kind: 'grant_dead' };
+                    }
+                    if (probe === 'transient') {
+                        this.refreshes.inc({ outcome: 'probe_transient' });
+                        return { kind: 'inconclusive' };
+                    }
+                    this.refreshes.inc({ outcome: 'probe_live' });
+                    // active: the unanswered presentation never reached the hub —
+                    // presenting again is safe, and the record below is renewed.
+                }
+                // Record the presentation BEFORE the fetch: if the answer never
+                // arrives, this row is what makes the next attempt probe first.
+                await this.recordPresentation(row);
+                const outcome = await this.postRefresh(refreshToken);
+                if (outcome.kind === 'ok') {
+                    await this.writeRotation(row, outcome);
+                    await this.clearPresentation(row.id);
+                    this.cache.set(userId, { token: outcome.accessToken, expiresAtMs: outcome.expiresAt.getTime() });
+                    this.refreshes.inc({ outcome: 'ok' });
+                    return { kind: 'ok', accessToken: outcome.accessToken };
+                }
+                if (outcome.kind === 'invalid_grant') {
+                    // Definitive: expired, revoked, or reuse-torn-down.
+                    await this.markDead(row);
+                    await this.clearPresentation(row.id);
+                    this.cache.delete(userId);
+                    this.refreshes.inc({ outcome: 'invalid_grant' });
+                    this.opts.logger.warn({ userId }, 'hub grant: token endpoint answered invalid_grant — grant marked dead; a browser SSO login heals it');
+                    return { kind: 'grant_dead' };
+                }
+                if (outcome.kind === 'invalid_client') {
+                    // The hub answered, and it refused the CLIENT before touching the
+                    // token (the pinned plugin validates client credentials before it
+                    // rotates), so the presented token was not consumed: the record
+                    // is cleared, not kept.
+                    await this.clearPresentation(row.id);
+                    this.refreshes.inc({ outcome: 'invalid_client' });
+                    this.opts.logger.error('hub grant: token endpoint answered invalid_client — HUB_CLIENT_ID/HUB_CLIENT_SECRET are broken; ' +
+                        'refreshes are failing transient (grants are NOT being killed); fix the client credentials');
+                    return { kind: 'inconclusive' };
+                }
+                // Transient (timeout / network / 5xx / malformed): the answer is
+                // UNKNOWN, so the presentation record deliberately survives — the
+                // next attempt probes before it presents.
+                this.refreshes.inc({ outcome: 'error' });
+                return { kind: 'inconclusive' };
+            }
+            finally {
+                await this.releaseLock(lock);
+            }
+        }
+        catch (err) {
+            this.refreshes.inc({ outcome: 'error' });
+            this.opts.logger.warn({ err, userId }, 'hub grant: refresh attempt failed — failing transient');
+            return { kind: 'inconclusive' };
+        }
+    }
+    /** The user's hub account link, tokens as stored (possibly encrypted). */
+    /**
+     * Null the tokens (dead marker = refreshToken IS NULL) — CONDITIONAL on
+     * the ciphertext we hold, so a browser login that re-seeded the row
+     * mid-flight is never wiped.
+     */
+    async markDead(row) {
+        await this.opts.db
+            .update(account)
+            .set({
+            accessToken: null,
+            refreshToken: null,
+            accessTokenExpiresAt: null,
+            refreshTokenExpiresAt: null,
+            updatedAt: new Date()
+        })
+            .where(and(eq(account.id, row.id), eq(account.refreshToken, row.refreshToken)));
+    }
+    /** Whether an earlier presentation of THIS ciphertext is still unanswered. */
+    async hasUnansweredPresentation(row) {
+        const [marker] = await this.opts.db
+            .select({ refreshToken: hubGrantPresentations.refreshToken })
+            .from(hubGrantPresentations)
+            .where(eq(hubGrantPresentations.accountId, row.id))
+            .limit(1);
+        // A marker for a DIFFERENT ciphertext is stale by construction (a
+        // browser login re-seeded the row): the token it names is gone.
+        return marker !== undefined && marker.refreshToken === row.refreshToken;
+    }
+    async recordPresentation(row) {
+        await this.opts.db
+            .insert(hubGrantPresentations)
+            .values({ accountId: row.id, refreshToken: row.refreshToken, presentedAt: new Date() })
+            .onConflictDoUpdate({
+            target: hubGrantPresentations.accountId,
+            set: { refreshToken: row.refreshToken, presentedAt: new Date() }
+        });
+    }
+    async clearPresentation(accountId) {
+        await this.opts.db.delete(hubGrantPresentations).where(eq(hubGrantPresentations.accountId, accountId));
+    }
+    /**
+     * RFC 7662 probe of a refresh token whose last presentation went
+     * unanswered. Read-only at the hub: the pinned oauth-provider plugin's
+     * introspection answers `active:false` for a rotated-out, expired, or
+     * unknown refresh token and never touches the family. Anything but a
+     * definite answer is transient — a probe must never be the reason a
+     * grant dies.
+     */
+    async introspect(refreshToken) {
+        const body = new URLSearchParams({
+            token: refreshToken,
+            token_type_hint: 'refresh_token',
+            client_id: this.opts.clientId,
+            client_secret: this.opts.clientSecret
+        });
+        let res;
+        try {
+            res = await this.fetchImpl(this.introspectUrl, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: body.toString(),
+                signal: AbortSignal.timeout(this.dials.introspectTimeoutMs)
+            });
+        }
+        catch (err) {
+            this.opts.logger.warn({ err }, 'hub grant: introspection endpoint unreachable — probe inconclusive');
+            return 'transient';
+        }
+        let payload = null;
+        try {
+            payload = await res.json();
+        }
+        catch {
+            // classified below by status
+        }
+        if (res.ok) {
+            const active = payload?.active;
+            if (active === true)
+                return 'active';
+            if (active === false)
+                return 'inactive';
+            this.opts.logger.warn('hub grant: introspection 200 without a boolean `active` — malformed, probe inconclusive');
+            return 'transient';
+        }
+        if (res.status === 401) {
+            this.opts.logger.error('hub grant: introspection answered invalid_client — HUB_CLIENT_ID/HUB_CLIENT_SECRET are broken; probe inconclusive');
+            return 'transient';
+        }
+        this.opts.logger.warn({ status: res.status }, 'hub grant: introspection answered non-2xx — probe inconclusive');
+        return 'transient';
+    }
+    async readRow(userId) {
+        const [row] = await this.opts.db
+            .select({
+            id: account.id,
+            accessToken: account.accessToken,
+            refreshToken: account.refreshToken,
+            accessTokenExpiresAt: account.accessTokenExpiresAt
+        })
+            .from(account)
+            .where(and(eq(account.userId, userId), eq(account.providerId, HUB_SSO_PROVIDER_ID)))
+            .limit(1);
+        return row ?? null;
+    }
+    /** Decrypt-and-cache the row's access token when it is still fresh. */
+    async storedAccess(userId, row) {
+        if (!row.accessToken || !row.accessTokenExpiresAt)
+            return null;
+        const expiresAtMs = row.accessTokenExpiresAt.getTime();
+        if (expiresAtMs - this.now() <= this.dials.accessSkewMs)
+            return null;
+        try {
+            const token = await this.decrypt(row.accessToken);
+            this.cache.set(userId, { token, expiresAtMs });
+            return token;
+        }
+        catch (err) {
+            this.opts.logger.warn({ err, userId }, 'hub grant: stored access token failed to decrypt — refreshing');
+            return null;
+        }
+    }
+    /**
+     * Persist a rotation's result on the row, Better-Auth-compatible
+     * (encrypted with the same key + primitive setTokenUtil uses).
+     * Conditional on the ciphertext we rotated FROM: if a concurrent browser
+     * login re-wrote the row, its (equally valid, same-family) tokens win and
+     * our rotation is only served from memory.
+     */
+    async writeRotation(row, outcome) {
+        const key = await this.opts.key();
+        const encryptedAccess = await symmetricEncrypt({ key, data: outcome.accessToken });
+        const encryptedRefresh = outcome.refreshToken
+            ? await symmetricEncrypt({ key, data: outcome.refreshToken })
+            : row.refreshToken; // no rotation in the answer — keep the presented one
+        await this.opts.db
+            .update(account)
+            .set({
+            accessToken: encryptedAccess,
+            refreshToken: encryptedRefresh,
+            accessTokenExpiresAt: outcome.expiresAt,
+            updatedAt: new Date()
+        })
+            .where(and(eq(account.id, row.id), eq(account.refreshToken, row.refreshToken)));
+    }
+    async decrypt(stored) {
+        if (!isLikelyEncrypted(stored))
+            return stored; // legacy plaintext passthrough
+        return symmetricDecrypt({ key: await this.opts.key(), data: stored });
+    }
+    /** One refresh_token grant POST, classified per the failure taxonomy. */
+    async postRefresh(refreshToken) {
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: this.opts.clientId,
+            client_secret: this.opts.clientSecret
+        });
+        if (this.opts.tokenResource)
+            body.set('resource', this.opts.tokenResource);
+        let res;
+        try {
+            res = await this.fetchImpl(this.tokenUrl, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: body.toString(),
+                signal: AbortSignal.timeout(this.dials.tokenTimeoutMs)
+            });
+        }
+        catch (err) {
+            this.opts.logger.warn({ err }, 'hub grant: token endpoint unreachable');
+            return { kind: 'transient' };
+        }
+        let payload = null;
+        try {
+            payload = await res.json();
+        }
+        catch {
+            // fall through — classified below by status
+        }
+        if (res.ok) {
+            const p = (payload ?? {});
+            if (typeof p.access_token !== 'string' || !p.access_token) {
+                this.opts.logger.warn('hub grant: token endpoint 200 without an access_token — malformed');
+                return { kind: 'transient' };
+            }
+            const expiresInS = typeof p.expires_in === 'number' && Number.isFinite(p.expires_in) && p.expires_in > 0
+                ? p.expires_in
+                : 300; // conservative default when the hub omits it
+            return {
+                kind: 'ok',
+                accessToken: p.access_token,
+                expiresAt: new Date(this.now() + expiresInS * 1000),
+                refreshToken: typeof p.refresh_token === 'string' && p.refresh_token ? p.refresh_token : null
+            };
+        }
+        // RFC 6749 errors ride 400/401; anything else (5xx…) is transient.
+        if (res.status === 400 || res.status === 401) {
+            const error = payload?.error;
+            if (error === 'invalid_grant')
+                return { kind: 'invalid_grant' };
+            if (error === 'invalid_client')
+                return { kind: 'invalid_client' };
+            this.opts.logger.warn({ status: res.status, error }, 'hub grant: unrecognized token-endpoint error');
+            return { kind: 'transient' };
+        }
+        this.opts.logger.warn({ status: res.status }, 'hub grant: token endpoint answered non-2xx');
+        return { kind: 'transient' };
+    }
+    /**
+     * Session-scoped pg_advisory_lock on a dedicated client — never the pool
+     * (a session lock parked on a pooled connection would poison the pool).
+     * The watchdog cuts the connection after lockWatchdogMs; a session lock
+     * dies with its session, so a wedged refresh is strictly bounded.
+     */
+    async acquireLock(userId) {
+        const client = new pg.Client({ connectionString: this.opts.connectionString });
+        await client.connect();
+        const lock = { client, released: false };
+        lock.watchdog = setTimeout(() => {
+            this.opts.logger.warn({ userId }, 'hub grant: refresh lock watchdog fired — cutting the dedicated connection');
+            lock.released = true;
+            void client.end().catch(() => { });
+        }, this.dials.lockWatchdogMs);
+        lock.watchdog.unref();
+        try {
+            await client.query('SELECT pg_advisory_lock($1, hashtext($2))', [GRANT_REFRESH_LOCK_KEY, userId]);
+        }
+        catch (cause) {
+            await this.releaseLock(lock);
+            throw cause;
+        }
+        return lock;
+    }
+    /** Idempotent; closing the client guarantees the session lock dies with it. */
+    async releaseLock(lock) {
+        if (lock.released)
+            return;
+        lock.released = true;
+        if (lock.watchdog)
+            clearTimeout(lock.watchdog);
+        await lock.client.end().catch(() => { });
+    }
+}
+//# sourceMappingURL=hub-grant.js.map

package/dist/identity/hub-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-grant.js","sourceRoot":"","sources":["../../src/identity/hub-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAW,MAAM,wBAAwB,CAAC;AAEjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,SAAS,CAAC;AACzC,qGAAqG;AACrG,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAa/C,MAAM,CAAC,MAAM,mBAAmB,GAAkB;IAChD,YAAY,EAAE,MAAM;IACpB,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,KAAK;IAC1B,0EAA0E;IAC1E,mDAAmD;IACnD,cAAc,EAAE,MAAM;CACvB,CAAC;AA8DF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAWD,MAAM,OAAO,eAAe;IAcG;IAb7B,kFAAkF;IACjE,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAC;IAClE,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACnD,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,SAAS,CAAe;IACxB,GAAG,CAAe;IAC1B,KAAK,CAAgB;IAE9B,oEAAoE;IAC3D,WAAW,CAAY;IACf,SAAS,CAAU;IAEpC,YAA6B,IAA4B;QAA5B,SAAI,GAAJ,IAAI,CAAwB;QACvD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,2BAA2B,CAAC;QACjF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,gCAAgC,CAAC;QAC3F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,mEAAmE;QACnE,kDAAkD;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,yBAAyB,CAAC;QACrG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QACxG,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,EAC1D,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,OAAO,CAAC;YAC3B,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,4CAA4C;YAClD,UAAU,EAAE,CAAC,SAAS,CAAU;YAChC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,eAAuB;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC/B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,IAAI;YAC1B,YAAY,EAAE,SAAS;YACvB,qBAAqB,EAAE,IAAI;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;aACnF,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAc,EAAE,WAAmB,EAAE,SAAsB;QAC/D,oEAAoE;QACpE,2BAA2B;QAC3B,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;QACpE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,mEAAmE;IACnE,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAEO,OAAO,CAAC,MAAc,EAAE,KAAc;QAC5C,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,KAAc;QACpD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,YAAY;gBAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACtD,IAAI,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;YACzD,CAAC;YAED,kDAAkD;YAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,iEAAiE;gBACjE,mEAAmE;gBACnE,gEAAgE;gBAChE,kEAAkE;gBAClE,wCAAwC;gBACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,CAAC,GAAG;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBACrC,IAAI,CAAC,GAAG,CAAC,YAAY;oBAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBACrD,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;oBACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;oBACpD,IAAI,MAAM;wBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;gBACzD,CAAC;gBAED,IAAI,YAAoB,CAAC;gBACzB,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,gEAAgE;oBAChE,wDAAwD;oBACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;oBACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,GAAG,EAAE,MAAM,EAAE,EACf,qGAAqG,CACtG,CAAC;oBACF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;gBAClC,CAAC;gBAED,oEAAoE;gBACpE,mEAAmE;gBACnE,IAAI,MAAM,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBAClD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;wBACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;wBACzB,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACrC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;wBAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,MAAM,EAAE,EACV,6FAA6F;4BAC3F,wGAAwG,CAC3G,CAAC;wBACF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;oBAChC,CAAC;oBACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;wBAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;wBACnD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;oBAClC,CAAC;oBACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC9C,8DAA8D;oBAC9D,6DAA6D;gBAC/D,CAAC;gBAED,gEAAgE;gBAChE,gEAAgE;gBAChE,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBACrD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC1B,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACvC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACjG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC1D,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACrC,oDAAoD;oBACpD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACzB,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;oBACjD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,MAAM,EAAE,EACV,oGAAoG,CACrG,CAAC;oBACF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBAChC,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACtC,kEAAkE;oBAClE,kEAAkE;oBAClE,gEAAgE;oBAChE,wBAAwB;oBACxB,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;oBAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,kGAAkG;wBAChG,2FAA2F,CAC9F,CAAC;oBACF,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;gBAClC,CAAC;gBACD,iEAAiE;gBACjE,kEAAkE;gBAClE,0CAA0C;gBAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAClC,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,uDAAuD,CAAC,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E;;;;OAIG;IACK,KAAK,CAAC,QAAQ,CAAC,GAAa;QAClC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACf,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;YAClB,oBAAoB,EAAE,IAAI;YAC1B,qBAAqB,EAAE,IAAI;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,YAAa,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,yBAAyB,CAAC,GAAa;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,YAAY,EAAE,qBAAqB,CAAC,YAAY,EAAE,CAAC;aAC5D,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAClD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,kEAAkE;QAClE,gEAAgE;QAChE,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAa;QAC5C,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACf,MAAM,CAAC,qBAAqB,CAAC;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,YAAa,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACvF,kBAAkB,CAAC;YAClB,MAAM,EAAE,qBAAqB,CAAC,SAAS;YACvC,GAAG,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,YAAa,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE;SAClE,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC/C,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,UAAU,CAAC,YAAoB;QAC3C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,KAAK,EAAE,YAAY;YACnB,eAAe,EAAE,eAAe;YAChC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC7B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;SACtC,CAAC,CAAC;QACH,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oEAAoE,CAAC,CAAC;YACrG,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,GAAY,IAAI,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,OAAuC,EAAE,MAAM,CAAC;YAChE,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,QAAQ,CAAC;YACrC,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,UAAU,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,yFAAyF,CAC1F,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,mHAAmH,CACpH,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EACtB,gEAAgE,CACjE,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc;QAClC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC;YACN,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;SACnD,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;aACnF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,uEAAuE;IAC/D,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAa;QACtD,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;QACvD,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,+DAA+D,CAAC,CAAC;YACxG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CACzB,GAAa,EACb,OAAgD;QAEhD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;YAC3C,CAAC,CAAC,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;YAC7D,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,qDAAqD;QAC3E,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACf,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC;YACH,WAAW,EAAE,eAAe;YAC5B,YAAY,EAAE,gBAAgB;YAC9B,oBAAoB,EAAE,OAAO,CAAC,SAAS;YACvC,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,YAAa,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc;QAClC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,+BAA+B;QAC9E,OAAO,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,WAAW,CAAC,YAAoB;QAC5C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC7B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;SACtC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACxE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,GAAY,IAAI,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA8E,CAAC;YACvG,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;gBAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;gBAC3F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAC/B,CAAC;YACD,MAAM,UAAU,GACd,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;gBACnF,CAAC,CAAC,CAAC,CAAC,UAAU;gBACd,CAAC,CAAC,GAAG,CAAC,CAAC,6CAA6C;YACxD,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,CAAC,CAAC,YAAY;gBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;gBACnD,YAAY,EAAE,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;aAC9F,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAI,OAAsC,EAAE,KAAK,CAAC;YAC7D,IAAI,KAAK,KAAK,eAAe;gBAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YAChE,IAAI,KAAK,KAAK,gBAAgB;gBAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,8CAA8C,CAAC,CAAC;YACrG,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,4CAA4C,CAAC,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CAAC,MAAc;QACtC,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,MAAM,EAAE,EACV,2EAA2E,CAC5E,CAAC;YACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,WAAW,CAAC,IAAiB;QACzC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/identity/hub-jwt.d.ts

@@ -0,0 +1,22 @@
+import { type JWTPayload } from 'jose';
+/**
+ * Verifies hub-minted RS256 JWTs against the hub's REMOTE JWKS (discovered
+ * via OIDC discovery at the issuer root) — the cloud edition's trust anchor
+ * for "Sign in with Antasphere" (internal/federation.md). Same discipline as
+ * the local OauthJwtVerifier: hard issuer pinning, per-call audience
+ * pinning, RS256 allowlist (implicitly rejects none/HS256), small clock
+ * tolerance. jose's remote key set self-refreshes on an unknown `kid`; a
+ * signature failure on a KNOWN kid (rotation racing the cache) gets exactly
+ * one retry against a freshly created key set.
+ */
+export declare class HubJwtVerifier {
+    private readonly issuerUrl;
+    private discoveryCache;
+    private keySet;
+    constructor(issuerUrl: string);
+    private jwksUri;
+    private keys;
+    /** Verify a hub JWT with the given audience pin; throws on any failure. */
+    verify(token: string, audience: string): Promise<JWTPayload>;
+}
+//# sourceMappingURL=hub-jwt.d.ts.map

package/dist/identity/hub-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-jwt.d.ts","sourceRoot":"","sources":["../../src/identity/hub-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,UAAU,EAAyB,MAAM,MAAM,CAAC;AAK7F;;;;;;;;;GASG;AACH,qBAAa,cAAc;IAIb,OAAO,CAAC,QAAQ,CAAC,SAAS;IAHtC,OAAO,CAAC,cAAc,CAAuD;IAC7E,OAAO,CAAC,MAAM,CAAsD;gBAEvC,SAAS,EAAE,MAAM;YAEhC,OAAO;YAqBP,IAAI;IAOlB,2EAA2E;IACrE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA2BnE"}