@aooth/auth 0.1.10 → 0.1.12

package/dist/authz.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_clock = require("./clock-Bl-H3eqE.cjs");
+const require_auth_code_store = require("./auth-code-store-CmUhRrwG.cjs");
 let node_crypto = require("node:crypto");
 let jose = require("jose");
 //#region src/authz/authz-errors.ts
@@ -252,127 +253,16 @@ var IdTokenSigner = class {
 	}
 };
 //#endregion
-//#region src/authz/pending-authorization-store.ts
-/**
-* Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
-* (≈ the login-session ceiling): created at `/authorize`, read+deleted at the
-* wf terminal. An in-memory impl ships for single-process apps + tests; a
-* multi-pod deployment provides a durable (e.g. Redis) impl under the same
-* `PENDING_AUTHORIZATION_STORE_TOKEN` (from `@aooth/auth-moost`).
-*/
-var PendingAuthorizationStore = class {};
-const DEFAULT_PENDING_TTL_MS = 15 * 6e4;
-/**
-* In-memory {@link PendingAuthorizationStore} — the reference impl for a
-* single-process app + tests. `structuredClone` on read/write isolates callers.
-*/
-var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
-	store = /* @__PURE__ */ new Map();
-	clock;
-	ttlMs;
-	constructor(opts) {
-		super();
-		this.clock = opts?.clock ?? require_clock.defaultClock;
-		this.ttlMs = opts?.ttlMs ?? DEFAULT_PENDING_TTL_MS;
-	}
-	async create(rec) {
-		const now = this.clock.now();
-		const row = {
-			handle: (0, node_crypto.randomUUID)(),
-			redirectUri: rec.redirectUri,
-			codeChallenge: rec.codeChallenge,
-			tokenPolicy: structuredClone(rec.tokenPolicy),
-			createdAt: now,
-			expiresAt: now + this.ttlMs,
-			...rec.clientId !== void 0 && { clientId: rec.clientId },
-			...rec.clientState !== void 0 && { clientState: rec.clientState },
-			...rec.scope !== void 0 && { scope: rec.scope },
-			...rec.nonce !== void 0 && { nonce: rec.nonce },
-			...rec.idToken !== void 0 && { idToken: rec.idToken },
-			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
-			...rec.audience !== void 0 && { audience: rec.audience }
-		};
-		this.store.set(row.handle, structuredClone(row));
-		return { handle: row.handle };
-	}
-	async get(handle) {
-		const row = this.store.get(handle);
-		if (!row) return null;
-		if (row.expiresAt <= this.clock.now()) {
-			this.store.delete(handle);
-			return null;
-		}
-		return structuredClone(row);
-	}
-	async delete(handle) {
-		return this.store.delete(handle);
-	}
-};
-//#endregion
-//#region src/authz/auth-code-store.ts
-/**
-* Storage seam for issued authorization codes (AUTH-SERVER.md §4.3). Very
-* short-lived (≈ 30–60 s) and **single-use**: {@link consume} returns the row
-* AND invalidates it in one atomic step, so a concurrent double-redeem (or a
-* back-button replay) yields the code to exactly one caller. An in-memory impl
-* ships (atomic for free in single-threaded JS); a durable impl must implement
-* `consume` as an atomic check-and-delete (e.g. `withCas` / `@db.column.version`,
-* or a Redis `GETDEL`).
-*/
-var AuthCodeStore = class {};
-const DEFAULT_CODE_TTL_MS = 6e4;
-/**
-* In-memory {@link AuthCodeStore} — the reference impl. `consume` is atomic
-* because the `get` + `delete` run with no intervening `await`, so a second
-* concurrent `consume` of the same code always misses.
-*/
-var AuthCodeStoreMemory = class extends AuthCodeStore {
-	store = /* @__PURE__ */ new Map();
-	clock;
-	ttlMs;
-	constructor(opts) {
-		super();
-		this.clock = opts?.clock ?? require_clock.defaultClock;
-		this.ttlMs = opts?.ttlMs ?? DEFAULT_CODE_TTL_MS;
-	}
-	async mint(rec) {
-		const code = (0, node_crypto.randomUUID)();
-		const row = {
-			code,
-			userId: rec.userId,
-			codeChallenge: rec.codeChallenge,
-			redirectUri: rec.redirectUri,
-			tokenPolicy: structuredClone(rec.tokenPolicy),
-			expiresAt: this.clock.now() + this.ttlMs,
-			...rec.clientId !== void 0 && { clientId: rec.clientId },
-			...rec.scope !== void 0 && { scope: rec.scope },
-			...rec.nonce !== void 0 && { nonce: rec.nonce },
-			...rec.idToken !== void 0 && { idToken: rec.idToken },
-			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
-			...rec.audience !== void 0 && { audience: rec.audience }
-		};
-		this.store.set(code, structuredClone(row));
-		return { code };
-	}
-	async consume(code) {
-		const row = this.store.get(code);
-		if (!row) return null;
-		this.store.delete(code);
-		if (row.expiresAt <= this.clock.now()) return null;
-		return structuredClone(row);
-	}
-};
-//#endregion
-exports.AuthCodeStore = AuthCodeStore;
-exports.AuthCodeStoreMemory = AuthCodeStoreMemory;
+exports.AuthCodeStore = require_auth_code_store.AuthCodeStore;
+exports.AuthCodeStoreMemory = require_auth_code_store.AuthCodeStoreMemory;
 exports.AuthorizeError = AuthorizeError;
 exports.CompositeClientPolicy = CompositeClientPolicy;
 exports.IdTokenSigner = IdTokenSigner;
 exports.LoopbackClientPolicy = LoopbackClientPolicy;
 exports.NoopOidcClaimsResolver = NoopOidcClaimsResolver;
 exports.OidcClaimsResolver = OidcClaimsResolver;
-exports.PendingAuthorizationStore = PendingAuthorizationStore;
-exports.PendingAuthorizationStoreMemory = PendingAuthorizationStoreMemory;
+exports.PendingAuthorizationStore = require_auth_code_store.PendingAuthorizationStore;
+exports.PendingAuthorizationStoreMemory = require_auth_code_store.PendingAuthorizationStoreMemory;
 exports.RegisteredClientPolicy = RegisteredClientPolicy;
 exports.isLoopbackRedirectUri = isLoopbackRedirectUri;
 exports.scopeGrants = scopeGrants;

package/dist/authz.d.cts

@@ -1,32 +1,7 @@
 import { t as Clock } from "./clock-BjXa0LXb.cjs";
+import { a as NewAuthCode, c as PendingAuthorizationStore, d as TokenPolicy, i as AuthCodeStoreMemoryOptions, l as PendingAuthorizationStoreMemory, n as AuthCodeStore, o as NewPendingAuthorization, r as AuthCodeStoreMemory, s as PendingAuthorization, t as AuthCode, u as PendingAuthorizationStoreMemoryOptions } from "./auth-code-store-HOHlz_3z.cjs";
 import { JWK } from "jose";
 
-//#region src/authz/token-policy.d.ts
-/**
- * What the authorization server mints for a completed grant — forwarded verbatim
- * into `AuthCredential.issue(userId, …)` at the token endpoint. Decided by the
- * {@link import("./client-policy").ClientRedirectPolicy} (per client / scope),
- * never by the client request, and recorded on the pending-authorization + the
- * issued auth-code so the grant's authority is fixed at `/authorize` time, not
- * `/token` time.
- *
- * Tier 1 (CLI / loopback) → a full-authority `cli-session` (`{ kind, ttl }`, no
- * `payload`). A scoped service token (Tier 2) additionally sets `payload` with
- * the consumer's attenuation root fields.
- */
-interface TokenPolicy {
-  /** Semantic credential kind stamped on the token (e.g. `"cli-session"`). See `IssueOptions.kind`. */
-  kind?: string;
-  /** Per-mint access-token lifetime in ms (forwarded to `IssueOptions.ttl`). */
-  ttl?: number;
-  /**
-   * Extra root payload merged into `issue()` — e.g. `@arbac.attenuate.*` fields
-   * for a SCOPED token. Omit for a full-authority token. MUST be JSON-safe: it
-   * is persisted on the pending-authorization + auth-code records.
-   */
-  payload?: Record<string, unknown>;
-}
-//#endregion
 //#region src/authz/authz-errors.d.ts
 /**
  * Failure taxonomy for the authorization-server endpoints (AUTH-SERVER.md §7).
@@ -329,174 +304,4 @@ declare class NoopOidcClaimsResolver extends OidcClaimsResolver {
 /** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
 declare function scopeGrants(scope: string | undefined, claim: string): boolean;
 //#endregion
-//#region src/authz/pending-authorization-store.d.ts
-/**
- * One in-flight authorization request, recorded at `GET /auth/authorize` and
- * read once at the login-workflow terminal that mints the auth code. Keyed by an
- * opaque `handle` that rides the login-wf ctx (and, across a "Continue with
- * Google" detour, the federated signed `state`) — so nothing secret leaves the
- * server.
- */
-interface PendingAuthorization {
-  /** Opaque server-side handle (the only thing that rides the URL / wf state). */
-  handle: string;
-  /** Registered client id (Tier 2), absent for a public/loopback client. */
-  clientId?: string;
-  /** The client's validated `redirect_uri` — where the code is delivered. */
-  redirectUri: string;
-  /** PKCE S256 challenge (client-generated); verified against the verifier at `/token`. */
-  codeChallenge: string;
-  /** The client's `state`, echoed back on the redirect so the client can correlate. */
-  clientState?: string;
-  /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
-  scope?: string;
-  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
-  nonce?: string;
-  /** Mint an `id_token` at `/token` (Tier 2). */
-  idToken?: boolean;
-  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
-  accessToken?: boolean;
-  /** The `id_token` `aud` (the registered `client_id`). */
-  audience?: string;
-  /** What the grant will mint (fixed at authorize time). */
-  tokenPolicy: TokenPolicy;
-  createdAt: number;
-  expiresAt: number;
-}
-/** Input to {@link PendingAuthorizationStore.create} — `handle`/timestamps are store-assigned. */
-interface NewPendingAuthorization {
-  clientId?: string;
-  redirectUri: string;
-  codeChallenge: string;
-  clientState?: string;
-  scope?: string;
-  nonce?: string;
-  idToken?: boolean;
-  accessToken?: boolean;
-  audience?: string;
-  tokenPolicy: TokenPolicy;
-}
-/**
- * Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
- * (≈ the login-session ceiling): created at `/authorize`, read+deleted at the
- * wf terminal. An in-memory impl ships for single-process apps + tests; a
- * multi-pod deployment provides a durable (e.g. Redis) impl under the same
- * `PENDING_AUTHORIZATION_STORE_TOKEN` (from `@aooth/auth-moost`).
- */
-declare abstract class PendingAuthorizationStore {
-  /** Record a new pending authorization; returns its opaque `handle`. */
-  abstract create(rec: NewPendingAuthorization): Promise<{
-    handle: string;
-  }>;
-  /** Fetch by handle, or `null` when unknown/expired. */
-  abstract get(handle: string): Promise<PendingAuthorization | null>;
-  /** Drop a handle once consumed. Returns `true` when a row was removed. */
-  abstract delete(handle: string): Promise<boolean>;
-}
-interface PendingAuthorizationStoreMemoryOptions {
-  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
-  clock?: Clock;
-  /** How long a pending authorization stays valid. Default 15 min. */
-  ttlMs?: number;
-}
-/**
- * In-memory {@link PendingAuthorizationStore} — the reference impl for a
- * single-process app + tests. `structuredClone` on read/write isolates callers.
- */
-declare class PendingAuthorizationStoreMemory extends PendingAuthorizationStore {
-  private store;
-  private clock;
-  private ttlMs;
-  constructor(opts?: PendingAuthorizationStoreMemoryOptions);
-  create(rec: NewPendingAuthorization): Promise<{
-    handle: string;
-  }>;
-  get(handle: string): Promise<PendingAuthorization | null>;
-  delete(handle: string): Promise<boolean>;
-}
-//#endregion
-//#region src/authz/auth-code-store.d.ts
-/**
- * A minted, single-use authorization code, bound to the user the login resolved
- * plus the PKCE challenge / redirect / token policy recorded at `/authorize`.
- * Consumed atomically at `POST /auth/token` — the token is minted there, off the
- * browser, so nothing long-lived ever rides a redirect URL.
- */
-interface AuthCode {
-  /** Opaque single-use code (delivered to the client in the redirect query). */
-  code: string;
-  /** The user the login workflow authenticated. */
-  userId: string;
-  /** PKCE S256 challenge from the originating authorize request. */
-  codeChallenge: string;
-  /** The client's `redirect_uri` (bound; the code is meaningless elsewhere). */
-  redirectUri: string;
-  /** Registered client id (Tier 2), absent for a public/loopback client. */
-  clientId?: string;
-  /** Granted scope (space-joined) — drives the `id_token` profile claims. */
-  scope?: string;
-  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
-  nonce?: string;
-  /** Mint an `id_token` at `/token` (Tier 2). */
-  idToken?: boolean;
-  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
-  accessToken?: boolean;
-  /** The `id_token` `aud` (the registered `client_id`). */
-  audience?: string;
-  /** What `/token` mints when this code is redeemed. */
-  tokenPolicy: TokenPolicy;
-  expiresAt: number;
-}
-/** Input to {@link AuthCodeStore.mint} — `code`/`expiresAt` are store-assigned. */
-interface NewAuthCode {
-  userId: string;
-  codeChallenge: string;
-  redirectUri: string;
-  clientId?: string;
-  scope?: string;
-  nonce?: string;
-  idToken?: boolean;
-  accessToken?: boolean;
-  audience?: string;
-  tokenPolicy: TokenPolicy;
-}
-/**
- * Storage seam for issued authorization codes (AUTH-SERVER.md §4.3). Very
- * short-lived (≈ 30–60 s) and **single-use**: {@link consume} returns the row
- * AND invalidates it in one atomic step, so a concurrent double-redeem (or a
- * back-button replay) yields the code to exactly one caller. An in-memory impl
- * ships (atomic for free in single-threaded JS); a durable impl must implement
- * `consume` as an atomic check-and-delete (e.g. `withCas` / `@db.column.version`,
- * or a Redis `GETDEL`).
- */
-declare abstract class AuthCodeStore {
-  /** Mint + store a single-use code; returns the opaque code string. */
-  abstract mint(rec: NewAuthCode): Promise<{
-    code: string;
-  }>;
-  /** Atomically claim + return the code's row, or `null` on miss / reuse / expiry. */
-  abstract consume(code: string): Promise<AuthCode | null>;
-}
-interface AuthCodeStoreMemoryOptions {
-  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
-  clock?: Clock;
-  /** Code lifetime. Default 60 s. */
-  ttlMs?: number;
-}
-/**
- * In-memory {@link AuthCodeStore} — the reference impl. `consume` is atomic
- * because the `get` + `delete` run with no intervening `await`, so a second
- * concurrent `consume` of the same code always misses.
- */
-declare class AuthCodeStoreMemory extends AuthCodeStore {
-  private store;
-  private clock;
-  private ttlMs;
-  constructor(opts?: AuthCodeStoreMemoryOptions);
-  mint(rec: NewAuthCode): Promise<{
-    code: string;
-  }>;
-  consume(code: string): Promise<AuthCode | null>;
-}
-//#endregion
 export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };

package/dist/authz.d.mts

@@ -1,32 +1,7 @@
 import { t as Clock } from "./clock-BjXa0LXb.mjs";
+import { a as NewAuthCode, c as PendingAuthorizationStore, d as TokenPolicy, i as AuthCodeStoreMemoryOptions, l as PendingAuthorizationStoreMemory, n as AuthCodeStore, o as NewPendingAuthorization, r as AuthCodeStoreMemory, s as PendingAuthorization, t as AuthCode, u as PendingAuthorizationStoreMemoryOptions } from "./auth-code-store-NqEDfqrf.mjs";
 import { JWK } from "jose";
 
-//#region src/authz/token-policy.d.ts
-/**
- * What the authorization server mints for a completed grant — forwarded verbatim
- * into `AuthCredential.issue(userId, …)` at the token endpoint. Decided by the
- * {@link import("./client-policy").ClientRedirectPolicy} (per client / scope),
- * never by the client request, and recorded on the pending-authorization + the
- * issued auth-code so the grant's authority is fixed at `/authorize` time, not
- * `/token` time.
- *
- * Tier 1 (CLI / loopback) → a full-authority `cli-session` (`{ kind, ttl }`, no
- * `payload`). A scoped service token (Tier 2) additionally sets `payload` with
- * the consumer's attenuation root fields.
- */
-interface TokenPolicy {
-  /** Semantic credential kind stamped on the token (e.g. `"cli-session"`). See `IssueOptions.kind`. */
-  kind?: string;
-  /** Per-mint access-token lifetime in ms (forwarded to `IssueOptions.ttl`). */
-  ttl?: number;
-  /**
-   * Extra root payload merged into `issue()` — e.g. `@arbac.attenuate.*` fields
-   * for a SCOPED token. Omit for a full-authority token. MUST be JSON-safe: it
-   * is persisted on the pending-authorization + auth-code records.
-   */
-  payload?: Record<string, unknown>;
-}
-//#endregion
 //#region src/authz/authz-errors.d.ts
 /**
  * Failure taxonomy for the authorization-server endpoints (AUTH-SERVER.md §7).
@@ -329,174 +304,4 @@ declare class NoopOidcClaimsResolver extends OidcClaimsResolver {
 /** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
 declare function scopeGrants(scope: string | undefined, claim: string): boolean;
 //#endregion
-//#region src/authz/pending-authorization-store.d.ts
-/**
- * One in-flight authorization request, recorded at `GET /auth/authorize` and
- * read once at the login-workflow terminal that mints the auth code. Keyed by an
- * opaque `handle` that rides the login-wf ctx (and, across a "Continue with
- * Google" detour, the federated signed `state`) — so nothing secret leaves the
- * server.
- */
-interface PendingAuthorization {
-  /** Opaque server-side handle (the only thing that rides the URL / wf state). */
-  handle: string;
-  /** Registered client id (Tier 2), absent for a public/loopback client. */
-  clientId?: string;
-  /** The client's validated `redirect_uri` — where the code is delivered. */
-  redirectUri: string;
-  /** PKCE S256 challenge (client-generated); verified against the verifier at `/token`. */
-  codeChallenge: string;
-  /** The client's `state`, echoed back on the redirect so the client can correlate. */
-  clientState?: string;
-  /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
-  scope?: string;
-  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
-  nonce?: string;
-  /** Mint an `id_token` at `/token` (Tier 2). */
-  idToken?: boolean;
-  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
-  accessToken?: boolean;
-  /** The `id_token` `aud` (the registered `client_id`). */
-  audience?: string;
-  /** What the grant will mint (fixed at authorize time). */
-  tokenPolicy: TokenPolicy;
-  createdAt: number;
-  expiresAt: number;
-}
-/** Input to {@link PendingAuthorizationStore.create} — `handle`/timestamps are store-assigned. */
-interface NewPendingAuthorization {
-  clientId?: string;
-  redirectUri: string;
-  codeChallenge: string;
-  clientState?: string;
-  scope?: string;
-  nonce?: string;
-  idToken?: boolean;
-  accessToken?: boolean;
-  audience?: string;
-  tokenPolicy: TokenPolicy;
-}
-/**
- * Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
- * (≈ the login-session ceiling): created at `/authorize`, read+deleted at the
- * wf terminal. An in-memory impl ships for single-process apps + tests; a
- * multi-pod deployment provides a durable (e.g. Redis) impl under the same
- * `PENDING_AUTHORIZATION_STORE_TOKEN` (from `@aooth/auth-moost`).
- */
-declare abstract class PendingAuthorizationStore {
-  /** Record a new pending authorization; returns its opaque `handle`. */
-  abstract create(rec: NewPendingAuthorization): Promise<{
-    handle: string;
-  }>;
-  /** Fetch by handle, or `null` when unknown/expired. */
-  abstract get(handle: string): Promise<PendingAuthorization | null>;
-  /** Drop a handle once consumed. Returns `true` when a row was removed. */
-  abstract delete(handle: string): Promise<boolean>;
-}
-interface PendingAuthorizationStoreMemoryOptions {
-  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
-  clock?: Clock;
-  /** How long a pending authorization stays valid. Default 15 min. */
-  ttlMs?: number;
-}
-/**
- * In-memory {@link PendingAuthorizationStore} — the reference impl for a
- * single-process app + tests. `structuredClone` on read/write isolates callers.
- */
-declare class PendingAuthorizationStoreMemory extends PendingAuthorizationStore {
-  private store;
-  private clock;
-  private ttlMs;
-  constructor(opts?: PendingAuthorizationStoreMemoryOptions);
-  create(rec: NewPendingAuthorization): Promise<{
-    handle: string;
-  }>;
-  get(handle: string): Promise<PendingAuthorization | null>;
-  delete(handle: string): Promise<boolean>;
-}
-//#endregion
-//#region src/authz/auth-code-store.d.ts
-/**
- * A minted, single-use authorization code, bound to the user the login resolved
- * plus the PKCE challenge / redirect / token policy recorded at `/authorize`.
- * Consumed atomically at `POST /auth/token` — the token is minted there, off the
- * browser, so nothing long-lived ever rides a redirect URL.
- */
-interface AuthCode {
-  /** Opaque single-use code (delivered to the client in the redirect query). */
-  code: string;
-  /** The user the login workflow authenticated. */
-  userId: string;
-  /** PKCE S256 challenge from the originating authorize request. */
-  codeChallenge: string;
-  /** The client's `redirect_uri` (bound; the code is meaningless elsewhere). */
-  redirectUri: string;
-  /** Registered client id (Tier 2), absent for a public/loopback client. */
-  clientId?: string;
-  /** Granted scope (space-joined) — drives the `id_token` profile claims. */
-  scope?: string;
-  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
-  nonce?: string;
-  /** Mint an `id_token` at `/token` (Tier 2). */
-  idToken?: boolean;
-  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
-  accessToken?: boolean;
-  /** The `id_token` `aud` (the registered `client_id`). */
-  audience?: string;
-  /** What `/token` mints when this code is redeemed. */
-  tokenPolicy: TokenPolicy;
-  expiresAt: number;
-}
-/** Input to {@link AuthCodeStore.mint} — `code`/`expiresAt` are store-assigned. */
-interface NewAuthCode {
-  userId: string;
-  codeChallenge: string;
-  redirectUri: string;
-  clientId?: string;
-  scope?: string;
-  nonce?: string;
-  idToken?: boolean;
-  accessToken?: boolean;
-  audience?: string;
-  tokenPolicy: TokenPolicy;
-}
-/**
- * Storage seam for issued authorization codes (AUTH-SERVER.md §4.3). Very
- * short-lived (≈ 30–60 s) and **single-use**: {@link consume} returns the row
- * AND invalidates it in one atomic step, so a concurrent double-redeem (or a
- * back-button replay) yields the code to exactly one caller. An in-memory impl
- * ships (atomic for free in single-threaded JS); a durable impl must implement
- * `consume` as an atomic check-and-delete (e.g. `withCas` / `@db.column.version`,
- * or a Redis `GETDEL`).
- */
-declare abstract class AuthCodeStore {
-  /** Mint + store a single-use code; returns the opaque code string. */
-  abstract mint(rec: NewAuthCode): Promise<{
-    code: string;
-  }>;
-  /** Atomically claim + return the code's row, or `null` on miss / reuse / expiry. */
-  abstract consume(code: string): Promise<AuthCode | null>;
-}
-interface AuthCodeStoreMemoryOptions {
-  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
-  clock?: Clock;
-  /** Code lifetime. Default 60 s. */
-  ttlMs?: number;
-}
-/**
- * In-memory {@link AuthCodeStore} — the reference impl. `consume` is atomic
- * because the `get` + `delete` run with no intervening `await`, so a second
- * concurrent `consume` of the same code always misses.
- */
-declare class AuthCodeStoreMemory extends AuthCodeStore {
-  private store;
-  private clock;
-  private ttlMs;
-  constructor(opts?: AuthCodeStoreMemoryOptions);
-  mint(rec: NewAuthCode): Promise<{
-    code: string;
-  }>;
-  consume(code: string): Promise<AuthCode | null>;
-}
-//#endregion
 export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };

package/dist/authz.mjs

@@ -1,5 +1,6 @@
 import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
-import { randomUUID, timingSafeEqual } from "node:crypto";
+import { a as PendingAuthorizationStore, n as AuthCodeStoreMemory, o as PendingAuthorizationStoreMemory, t as AuthCodeStore } from "./auth-code-store-uaoL7dvU.mjs";
+import { timingSafeEqual } from "node:crypto";
 import { SignJWT, exportJWK, importPKCS8, importSPKI } from "jose";
 //#region src/authz/authz-errors.ts
 /** A typed authorization-server failure. */
@@ -251,115 +252,4 @@ var IdTokenSigner = class {
 	}
 };
 //#endregion
-//#region src/authz/pending-authorization-store.ts
-/**
-* Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
-* (≈ the login-session ceiling): created at `/authorize`, read+deleted at the
-* wf terminal. An in-memory impl ships for single-process apps + tests; a
-* multi-pod deployment provides a durable (e.g. Redis) impl under the same
-* `PENDING_AUTHORIZATION_STORE_TOKEN` (from `@aooth/auth-moost`).
-*/
-var PendingAuthorizationStore = class {};
-const DEFAULT_PENDING_TTL_MS = 15 * 6e4;
-/**
-* In-memory {@link PendingAuthorizationStore} — the reference impl for a
-* single-process app + tests. `structuredClone` on read/write isolates callers.
-*/
-var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
-	store = /* @__PURE__ */ new Map();
-	clock;
-	ttlMs;
-	constructor(opts) {
-		super();
-		this.clock = opts?.clock ?? defaultClock;
-		this.ttlMs = opts?.ttlMs ?? DEFAULT_PENDING_TTL_MS;
-	}
-	async create(rec) {
-		const now = this.clock.now();
-		const row = {
-			handle: randomUUID(),
-			redirectUri: rec.redirectUri,
-			codeChallenge: rec.codeChallenge,
-			tokenPolicy: structuredClone(rec.tokenPolicy),
-			createdAt: now,
-			expiresAt: now + this.ttlMs,
-			...rec.clientId !== void 0 && { clientId: rec.clientId },
-			...rec.clientState !== void 0 && { clientState: rec.clientState },
-			...rec.scope !== void 0 && { scope: rec.scope },
-			...rec.nonce !== void 0 && { nonce: rec.nonce },
-			...rec.idToken !== void 0 && { idToken: rec.idToken },
-			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
-			...rec.audience !== void 0 && { audience: rec.audience }
-		};
-		this.store.set(row.handle, structuredClone(row));
-		return { handle: row.handle };
-	}
-	async get(handle) {
-		const row = this.store.get(handle);
-		if (!row) return null;
-		if (row.expiresAt <= this.clock.now()) {
-			this.store.delete(handle);
-			return null;
-		}
-		return structuredClone(row);
-	}
-	async delete(handle) {
-		return this.store.delete(handle);
-	}
-};
-//#endregion
-//#region src/authz/auth-code-store.ts
-/**
-* Storage seam for issued authorization codes (AUTH-SERVER.md §4.3). Very
-* short-lived (≈ 30–60 s) and **single-use**: {@link consume} returns the row
-* AND invalidates it in one atomic step, so a concurrent double-redeem (or a
-* back-button replay) yields the code to exactly one caller. An in-memory impl
-* ships (atomic for free in single-threaded JS); a durable impl must implement
-* `consume` as an atomic check-and-delete (e.g. `withCas` / `@db.column.version`,
-* or a Redis `GETDEL`).
-*/
-var AuthCodeStore = class {};
-const DEFAULT_CODE_TTL_MS = 6e4;
-/**
-* In-memory {@link AuthCodeStore} — the reference impl. `consume` is atomic
-* because the `get` + `delete` run with no intervening `await`, so a second
-* concurrent `consume` of the same code always misses.
-*/
-var AuthCodeStoreMemory = class extends AuthCodeStore {
-	store = /* @__PURE__ */ new Map();
-	clock;
-	ttlMs;
-	constructor(opts) {
-		super();
-		this.clock = opts?.clock ?? defaultClock;
-		this.ttlMs = opts?.ttlMs ?? DEFAULT_CODE_TTL_MS;
-	}
-	async mint(rec) {
-		const code = randomUUID();
-		const row = {
-			code,
-			userId: rec.userId,
-			codeChallenge: rec.codeChallenge,
-			redirectUri: rec.redirectUri,
-			tokenPolicy: structuredClone(rec.tokenPolicy),
-			expiresAt: this.clock.now() + this.ttlMs,
-			...rec.clientId !== void 0 && { clientId: rec.clientId },
-			...rec.scope !== void 0 && { scope: rec.scope },
-			...rec.nonce !== void 0 && { nonce: rec.nonce },
-			...rec.idToken !== void 0 && { idToken: rec.idToken },
-			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
-			...rec.audience !== void 0 && { audience: rec.audience }
-		};
-		this.store.set(code, structuredClone(row));
-		return { code };
-	}
-	async consume(code) {
-		const row = this.store.get(code);
-		if (!row) return null;
-		this.store.delete(code);
-		if (row.expiresAt <= this.clock.now()) return null;
-		return structuredClone(row);
-	}
-};
-//#endregion
 export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, CompositeClientPolicy, IdTokenSigner, LoopbackClientPolicy, NoopOidcClaimsResolver, OidcClaimsResolver, PendingAuthorizationStore, PendingAuthorizationStoreMemory, RegisteredClientPolicy, isLoopbackRedirectUri, scopeGrants };