@aooth/auth 0.1.15 → 0.1.17

package/dist/atscript-db.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_clock = require("./clock-Bl-H3eqE.cjs");
 const require_payload = require("./payload-BJjvj8AH.cjs");
-const require_auth_code_store = require("./auth-code-store-CmUhRrwG.cjs");
+const require_auth_code_store = require("./auth-code-store-B_m51OSB.cjs");
 let node_crypto = require("node:crypto");
 //#region src/atscript-db/authz-stores.ts
 /**
@@ -22,13 +22,15 @@ var PendingAuthorizationStoreAtscriptDb = class extends require_auth_code_store.
 	async create(rec) {
 		const now = this.clock.now();
 		const handle = (0, node_crypto.randomUUID)();
+		const expiresAt = now + this.ttlMs;
 		await this.table.insertOne({
 			handle,
 			redirectUri: rec.redirectUri,
 			codeChallenge: rec.codeChallenge,
 			tokenPolicy: JSON.stringify(rec.tokenPolicy),
+			binding: rec.binding,
 			createdAt: now,
-			expiresAt: now + this.ttlMs,
+			expiresAt,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
 			...rec.scope !== void 0 && { scope: rec.scope },
@@ -37,7 +39,10 @@ var PendingAuthorizationStoreAtscriptDb = class extends require_auth_code_store.
 			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
 			...rec.audience !== void 0 && { audience: rec.audience }
 		});
-		return { handle };
+		return {
+			handle,
+			expiresAt
+		};
 	}
 	async get(handle) {
 		const row = await this.table.findOne({ filter: { handle } });
@@ -59,6 +64,7 @@ function rowToPending(row) {
 		redirectUri: row.redirectUri,
 		codeChallenge: row.codeChallenge,
 		tokenPolicy: JSON.parse(row.tokenPolicy),
+		binding: row.binding,
 		createdAt: row.createdAt,
 		expiresAt: row.expiresAt
 	};

package/dist/atscript-db.d.cts

@@ -1,6 +1,6 @@
 import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.cjs";
 import { t as Clock } from "./clock-BjXa0LXb.cjs";
-import { a as NewAuthCode, c as PendingAuthorizationStore, n as AuthCodeStore, o as NewPendingAuthorization, s as PendingAuthorization, t as AuthCode } from "./auth-code-store-HOHlz_3z.cjs";
+import { a as NewAuthCode, c as PendingAuthorization, l as PendingAuthorizationStore, n as AuthCodeStore, s as NewPendingAuthorization, t as AuthCode } from "./auth-code-store-BZ88d_tq.cjs";
 
 //#region src/atscript-db/authz-stores.d.ts
 /**
@@ -30,6 +30,8 @@ interface PendingAuthorizationRow {
   audience?: string;
   /** `JSON.stringify(TokenPolicy)`. */
   tokenPolicy: string;
+  /** Browser-binding secret — mirrored into the `aooth_authz` cookie at `/authorize`. */
+  binding: string;
   createdAt: number;
   expiresAt: number;
 }
@@ -69,6 +71,7 @@ declare class PendingAuthorizationStoreAtscriptDb extends PendingAuthorizationSt
   constructor(opts: PendingAuthorizationStoreAtscriptDbOptions);
   create(rec: NewPendingAuthorization): Promise<{
     handle: string;
+    expiresAt: number;
   }>;
   get(handle: string): Promise<PendingAuthorization | null>;
   delete(handle: string): Promise<boolean>;

package/dist/atscript-db.d.mts

@@ -1,6 +1,6 @@
 import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.mjs";
 import { t as Clock } from "./clock-BjXa0LXb.mjs";
-import { a as NewAuthCode, c as PendingAuthorizationStore, n as AuthCodeStore, o as NewPendingAuthorization, s as PendingAuthorization, t as AuthCode } from "./auth-code-store-NqEDfqrf.mjs";
+import { a as NewAuthCode, c as PendingAuthorization, l as PendingAuthorizationStore, n as AuthCodeStore, s as NewPendingAuthorization, t as AuthCode } from "./auth-code-store-Om5MXNUT.mjs";
 
 //#region src/atscript-db/authz-stores.d.ts
 /**
@@ -30,6 +30,8 @@ interface PendingAuthorizationRow {
   audience?: string;
   /** `JSON.stringify(TokenPolicy)`. */
   tokenPolicy: string;
+  /** Browser-binding secret — mirrored into the `aooth_authz` cookie at `/authorize`. */
+  binding: string;
   createdAt: number;
   expiresAt: number;
 }
@@ -69,6 +71,7 @@ declare class PendingAuthorizationStoreAtscriptDb extends PendingAuthorizationSt
   constructor(opts: PendingAuthorizationStoreAtscriptDbOptions);
   create(rec: NewPendingAuthorization): Promise<{
     handle: string;
+    expiresAt: number;
   }>;
   get(handle: string): Promise<PendingAuthorization | null>;
   delete(handle: string): Promise<boolean>;

package/dist/atscript-db.mjs

@@ -1,6 +1,6 @@
 import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
 import { t as credentialPayloadOf } from "./payload-D-DzH5-J.mjs";
-import { a as PendingAuthorizationStore, t as AuthCodeStore } from "./auth-code-store-uaoL7dvU.mjs";
+import { a as PendingAuthorizationStore, t as AuthCodeStore } from "./auth-code-store-Dqc4rEOx.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/atscript-db/authz-stores.ts
 /**
@@ -21,13 +21,15 @@ var PendingAuthorizationStoreAtscriptDb = class extends PendingAuthorizationStor
 	async create(rec) {
 		const now = this.clock.now();
 		const handle = randomUUID();
+		const expiresAt = now + this.ttlMs;
 		await this.table.insertOne({
 			handle,
 			redirectUri: rec.redirectUri,
 			codeChallenge: rec.codeChallenge,
 			tokenPolicy: JSON.stringify(rec.tokenPolicy),
+			binding: rec.binding,
 			createdAt: now,
-			expiresAt: now + this.ttlMs,
+			expiresAt,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
 			...rec.scope !== void 0 && { scope: rec.scope },
@@ -36,7 +38,10 @@ var PendingAuthorizationStoreAtscriptDb = class extends PendingAuthorizationStor
 			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
 			...rec.audience !== void 0 && { audience: rec.audience }
 		});
-		return { handle };
+		return {
+			handle,
+			expiresAt
+		};
 	}
 	async get(handle) {
 		const row = await this.table.findOne({ filter: { handle } });
@@ -58,6 +63,7 @@ function rowToPending(row) {
 		redirectUri: row.redirectUri,
 		codeChallenge: row.codeChallenge,
 		tokenPolicy: JSON.parse(row.tokenPolicy),
+		binding: row.binding,
 		createdAt: row.createdAt,
 		expiresAt: row.expiresAt
 	};

package/dist/{auth-code-store-HOHlz_3z.d.cts → auth-code-store-BZ88d_tq.d.cts}

@@ -57,6 +57,15 @@ interface PendingAuthorization {
   audience?: string;
   /** What the grant will mint (fixed at authorize time). */
   tokenPolicy: TokenPolicy;
+  /**
+   * High-entropy browser-binding secret (AUTH-SERVER.md §6). Set at
+   * `/auth/authorize` and mirrored into the `aooth_authz` cookie; the
+   * code-minting terminal accepts the handle ONLY when the request carries a
+   * cookie that constant-time-matches this value — so the opaque handle can be
+   * redeemed only by the browser that started the request, not one it was
+   * phished into.
+   */
+  binding: string;
   createdAt: number;
   expiresAt: number;
 }
@@ -72,6 +81,8 @@ interface NewPendingAuthorization {
   accessToken?: boolean;
   audience?: string;
   tokenPolicy: TokenPolicy;
+  /** Browser-binding secret (see {@link PendingAuthorization.binding}). */
+  binding: string;
 }
 /**
  * Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
@@ -81,9 +92,15 @@ interface NewPendingAuthorization {
  * `PENDING_AUTHORIZATION_STORE_TOKEN` (from `@aooth/auth-moost`).
  */
 declare abstract class PendingAuthorizationStore {
-  /** Record a new pending authorization; returns its opaque `handle`. */
+  /**
+   * Record a new pending authorization; returns its opaque `handle` and the
+   * row's `expiresAt` (epoch ms). The caller derives the `aooth_authz` binding
+   * cookie's lifetime from `expiresAt`, so the cookie tracks the row's actual
+   * TTL even when a store is configured with a non-default `ttlMs`.
+   */
   abstract create(rec: NewPendingAuthorization): Promise<{
     handle: string;
+    expiresAt: number;
   }>;
   /** Fetch by handle, or `null` when unknown/expired. */
   abstract get(handle: string): Promise<PendingAuthorization | null>;
@@ -96,6 +113,8 @@ interface PendingAuthorizationStoreMemoryOptions {
   /** How long a pending authorization stays valid. Default 15 min. */
   ttlMs?: number;
 }
+/** Default pending-authorization lifetime (15 min). Shared by the memory + atscript-db stores. */
+declare const DEFAULT_PENDING_TTL_MS: number;
 /**
  * In-memory {@link PendingAuthorizationStore} — the reference impl for a
  * single-process app + tests. `structuredClone` on read/write isolates callers.
@@ -107,6 +126,7 @@ declare class PendingAuthorizationStoreMemory extends PendingAuthorizationStore
   constructor(opts?: PendingAuthorizationStoreMemoryOptions);
   create(rec: NewPendingAuthorization): Promise<{
     handle: string;
+    expiresAt: number;
   }>;
   get(handle: string): Promise<PendingAuthorization | null>;
   delete(handle: string): Promise<boolean>;
@@ -196,4 +216,4 @@ declare class AuthCodeStoreMemory extends AuthCodeStore {
   consume(code: string): Promise<AuthCode | null>;
 }
 //#endregion
-export { NewAuthCode as a, PendingAuthorizationStore as c, TokenPolicy as d, AuthCodeStoreMemoryOptions as i, PendingAuthorizationStoreMemory as l, AuthCodeStore as n, NewPendingAuthorization as o, AuthCodeStoreMemory as r, PendingAuthorization as s, AuthCode as t, PendingAuthorizationStoreMemoryOptions as u };
+export { NewAuthCode as a, PendingAuthorization as c, PendingAuthorizationStoreMemoryOptions as d, TokenPolicy as f, AuthCodeStoreMemoryOptions as i, PendingAuthorizationStore as l, AuthCodeStore as n, DEFAULT_PENDING_TTL_MS as o, AuthCodeStoreMemory as r, NewPendingAuthorization as s, AuthCode as t, PendingAuthorizationStoreMemory as u };

package/dist/{auth-code-store-CmUhRrwG.cjs → auth-code-store-B_m51OSB.cjs}

@@ -31,6 +31,7 @@ var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
 			redirectUri: rec.redirectUri,
 			codeChallenge: rec.codeChallenge,
 			tokenPolicy: structuredClone(rec.tokenPolicy),
+			binding: rec.binding,
 			createdAt: now,
 			expiresAt: now + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
@@ -42,7 +43,10 @@ var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
 			...rec.audience !== void 0 && { audience: rec.audience }
 		};
 		this.store.set(row.handle, structuredClone(row));
-		return { handle: row.handle };
+		return {
+			handle: row.handle,
+			expiresAt: row.expiresAt
+		};
 	}
 	async get(handle) {
 		const row = this.store.get(handle);

package/dist/{auth-code-store-uaoL7dvU.mjs → auth-code-store-Dqc4rEOx.mjs}

@@ -31,6 +31,7 @@ var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
 			redirectUri: rec.redirectUri,
 			codeChallenge: rec.codeChallenge,
 			tokenPolicy: structuredClone(rec.tokenPolicy),
+			binding: rec.binding,
 			createdAt: now,
 			expiresAt: now + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
@@ -42,7 +43,10 @@ var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
 			...rec.audience !== void 0 && { audience: rec.audience }
 		};
 		this.store.set(row.handle, structuredClone(row));
-		return { handle: row.handle };
+		return {
+			handle: row.handle,
+			expiresAt: row.expiresAt
+		};
 	}
 	async get(handle) {
 		const row = this.store.get(handle);

package/dist/{auth-code-store-NqEDfqrf.d.mts → auth-code-store-Om5MXNUT.d.mts}

@@ -57,6 +57,15 @@ interface PendingAuthorization {
   audience?: string;
   /** What the grant will mint (fixed at authorize time). */
   tokenPolicy: TokenPolicy;
+  /**
+   * High-entropy browser-binding secret (AUTH-SERVER.md §6). Set at
+   * `/auth/authorize` and mirrored into the `aooth_authz` cookie; the
+   * code-minting terminal accepts the handle ONLY when the request carries a
+   * cookie that constant-time-matches this value — so the opaque handle can be
+   * redeemed only by the browser that started the request, not one it was
+   * phished into.
+   */
+  binding: string;
   createdAt: number;
   expiresAt: number;
 }
@@ -72,6 +81,8 @@ interface NewPendingAuthorization {
   accessToken?: boolean;
   audience?: string;
   tokenPolicy: TokenPolicy;
+  /** Browser-binding secret (see {@link PendingAuthorization.binding}). */
+  binding: string;
 }
 /**
  * Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
@@ -81,9 +92,15 @@ interface NewPendingAuthorization {
  * `PENDING_AUTHORIZATION_STORE_TOKEN` (from `@aooth/auth-moost`).
  */
 declare abstract class PendingAuthorizationStore {
-  /** Record a new pending authorization; returns its opaque `handle`. */
+  /**
+   * Record a new pending authorization; returns its opaque `handle` and the
+   * row's `expiresAt` (epoch ms). The caller derives the `aooth_authz` binding
+   * cookie's lifetime from `expiresAt`, so the cookie tracks the row's actual
+   * TTL even when a store is configured with a non-default `ttlMs`.
+   */
   abstract create(rec: NewPendingAuthorization): Promise<{
     handle: string;
+    expiresAt: number;
   }>;
   /** Fetch by handle, or `null` when unknown/expired. */
   abstract get(handle: string): Promise<PendingAuthorization | null>;
@@ -96,6 +113,8 @@ interface PendingAuthorizationStoreMemoryOptions {
   /** How long a pending authorization stays valid. Default 15 min. */
   ttlMs?: number;
 }
+/** Default pending-authorization lifetime (15 min). Shared by the memory + atscript-db stores. */
+declare const DEFAULT_PENDING_TTL_MS: number;
 /**
  * In-memory {@link PendingAuthorizationStore} — the reference impl for a
  * single-process app + tests. `structuredClone` on read/write isolates callers.
@@ -107,6 +126,7 @@ declare class PendingAuthorizationStoreMemory extends PendingAuthorizationStore
   constructor(opts?: PendingAuthorizationStoreMemoryOptions);
   create(rec: NewPendingAuthorization): Promise<{
     handle: string;
+    expiresAt: number;
   }>;
   get(handle: string): Promise<PendingAuthorization | null>;
   delete(handle: string): Promise<boolean>;
@@ -196,4 +216,4 @@ declare class AuthCodeStoreMemory extends AuthCodeStore {
   consume(code: string): Promise<AuthCode | null>;
 }
 //#endregion
-export { NewAuthCode as a, PendingAuthorizationStore as c, TokenPolicy as d, AuthCodeStoreMemoryOptions as i, PendingAuthorizationStoreMemory as l, AuthCodeStore as n, NewPendingAuthorization as o, AuthCodeStoreMemory as r, PendingAuthorization as s, AuthCode as t, PendingAuthorizationStoreMemoryOptions as u };
+export { NewAuthCode as a, PendingAuthorization as c, PendingAuthorizationStoreMemoryOptions as d, TokenPolicy as f, AuthCodeStoreMemoryOptions as i, PendingAuthorizationStore as l, AuthCodeStore as n, DEFAULT_PENDING_TTL_MS as o, AuthCodeStoreMemory as r, NewPendingAuthorization as s, AuthCode as t, PendingAuthorizationStoreMemory as u };

package/dist/authz.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_clock = require("./clock-Bl-H3eqE.cjs");
-const require_auth_code_store = require("./auth-code-store-CmUhRrwG.cjs");
+const require_auth_code_store = require("./auth-code-store-B_m51OSB.cjs");
 let node_crypto = require("node:crypto");
 let jose = require("jose");
 //#region src/authz/authz-errors.ts
@@ -257,6 +257,7 @@ exports.AuthCodeStore = require_auth_code_store.AuthCodeStore;
 exports.AuthCodeStoreMemory = require_auth_code_store.AuthCodeStoreMemory;
 exports.AuthorizeError = AuthorizeError;
 exports.CompositeClientPolicy = CompositeClientPolicy;
+exports.DEFAULT_PENDING_TTL_MS = require_auth_code_store.DEFAULT_PENDING_TTL_MS;
 exports.IdTokenSigner = IdTokenSigner;
 exports.LoopbackClientPolicy = LoopbackClientPolicy;
 exports.NoopOidcClaimsResolver = NoopOidcClaimsResolver;

package/dist/authz.d.cts

@@ -1,5 +1,5 @@
 import { t as Clock } from "./clock-BjXa0LXb.cjs";
-import { a as NewAuthCode, c as PendingAuthorizationStore, d as TokenPolicy, i as AuthCodeStoreMemoryOptions, l as PendingAuthorizationStoreMemory, n as AuthCodeStore, o as NewPendingAuthorization, r as AuthCodeStoreMemory, s as PendingAuthorization, t as AuthCode, u as PendingAuthorizationStoreMemoryOptions } from "./auth-code-store-HOHlz_3z.cjs";
+import { a as NewAuthCode, c as PendingAuthorization, d as PendingAuthorizationStoreMemoryOptions, f as TokenPolicy, i as AuthCodeStoreMemoryOptions, l as PendingAuthorizationStore, n as AuthCodeStore, o as DEFAULT_PENDING_TTL_MS, r as AuthCodeStoreMemory, s as NewPendingAuthorization, t as AuthCode, u as PendingAuthorizationStoreMemory } from "./auth-code-store-BZ88d_tq.cjs";
 import { JWK } from "jose";
 
 //#region src/authz/authz-errors.d.ts
@@ -304,4 +304,4 @@ declare class NoopOidcClaimsResolver extends OidcClaimsResolver {
 /** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
 declare function scopeGrants(scope: string | undefined, claim: string): boolean;
 //#endregion
-export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };
+export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, DEFAULT_PENDING_TTL_MS, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };

package/dist/authz.d.mts

@@ -1,5 +1,5 @@
 import { t as Clock } from "./clock-BjXa0LXb.mjs";
-import { a as NewAuthCode, c as PendingAuthorizationStore, d as TokenPolicy, i as AuthCodeStoreMemoryOptions, l as PendingAuthorizationStoreMemory, n as AuthCodeStore, o as NewPendingAuthorization, r as AuthCodeStoreMemory, s as PendingAuthorization, t as AuthCode, u as PendingAuthorizationStoreMemoryOptions } from "./auth-code-store-NqEDfqrf.mjs";
+import { a as NewAuthCode, c as PendingAuthorization, d as PendingAuthorizationStoreMemoryOptions, f as TokenPolicy, i as AuthCodeStoreMemoryOptions, l as PendingAuthorizationStore, n as AuthCodeStore, o as DEFAULT_PENDING_TTL_MS, r as AuthCodeStoreMemory, s as NewPendingAuthorization, t as AuthCode, u as PendingAuthorizationStoreMemory } from "./auth-code-store-Om5MXNUT.mjs";
 import { JWK } from "jose";
 
 //#region src/authz/authz-errors.d.ts
@@ -304,4 +304,4 @@ declare class NoopOidcClaimsResolver extends OidcClaimsResolver {
 /** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
 declare function scopeGrants(scope: string | undefined, claim: string): boolean;
 //#endregion
-export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };
+export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, DEFAULT_PENDING_TTL_MS, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };

package/dist/authz.mjs

@@ -1,5 +1,5 @@
 import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
-import { a as PendingAuthorizationStore, n as AuthCodeStoreMemory, o as PendingAuthorizationStoreMemory, t as AuthCodeStore } from "./auth-code-store-uaoL7dvU.mjs";
+import { a as PendingAuthorizationStore, i as DEFAULT_PENDING_TTL_MS, n as AuthCodeStoreMemory, o as PendingAuthorizationStoreMemory, t as AuthCodeStore } from "./auth-code-store-Dqc4rEOx.mjs";
 import { timingSafeEqual } from "node:crypto";
 import { SignJWT, exportJWK, importPKCS8, importSPKI } from "jose";
 //#region src/authz/authz-errors.ts
@@ -252,4 +252,4 @@ var IdTokenSigner = class {
 	}
 };
 //#endregion
-export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, CompositeClientPolicy, IdTokenSigner, LoopbackClientPolicy, NoopOidcClaimsResolver, OidcClaimsResolver, PendingAuthorizationStore, PendingAuthorizationStoreMemory, RegisteredClientPolicy, isLoopbackRedirectUri, scopeGrants };
+export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, CompositeClientPolicy, DEFAULT_PENDING_TTL_MS, IdTokenSigner, LoopbackClientPolicy, NoopOidcClaimsResolver, OidcClaimsResolver, PendingAuthorizationStore, PendingAuthorizationStoreMemory, RegisteredClientPolicy, isLoopbackRedirectUri, scopeGrants };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/auth",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Auth method layer for aoothjs (sessions, tokens, password reset, MFA primitives)",
   "keywords": [
     "aoothjs",
@@ -94,17 +94,17 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@aooth/user": "0.1.15"
+    "@aooth/user": "0.1.17"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.74",
-    "@atscript/db": "^0.1.101",
-    "@atscript/db-sql-tools": "^0.1.101",
-    "@atscript/db-sqlite": "^0.1.101",
-    "@atscript/typescript": "^0.1.74",
+    "@atscript/core": "^0.1.75",
+    "@atscript/db": "^0.1.104",
+    "@atscript/db-sql-tools": "^0.1.104",
+    "@atscript/db-sqlite": "^0.1.104",
+    "@atscript/typescript": "^0.1.75",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.74"
+    "unplugin-atscript": "^0.1.75"
   },
   "peerDependencies": {
     "@atscript/db": ">=0.1.79"

package/src/atscript-db/pending-authorization.as

@@ -36,6 +36,15 @@ export interface AoothPendingAuthorization {
      */
     tokenPolicy: string
 
+    /**
+     * High-entropy browser-binding secret (AUTH-SERVER.md §6). Mirrored into the
+     * `aooth_authz` cookie at `/authorize`; the code-minting terminal accepts the
+     * handle only when the request carries a cookie that constant-time-matches
+     * this — so the opaque handle can't be redeemed in a browser it was phished
+     * into.
+     */
+    binding: string
+
     createdAt: number.timestamp
     /** Lazy-GC'd on read once past. */
     expiresAt: number.timestamp

package/src/atscript-db/pending-authorization.as.d.ts

@@ -25,6 +25,7 @@ export declare class AoothPendingAuthorization {
   accessToken?: boolean
   audience?: string
   tokenPolicy: string
+  binding: string
   createdAt: number /* timestamp */
   expiresAt: number /* timestamp */
   static __is_atscript_annotated_type: true
@@ -47,6 +48,7 @@ export declare class AoothPendingAuthorization {
     "accessToken"?: boolean
     "audience"?: string
     "tokenPolicy": string
+    "binding": string
     "createdAt": number /* timestamp */
     "expiresAt": number /* timestamp */
   }
@@ -62,6 +64,7 @@ export declare class AoothPendingAuthorization {
     "accessToken"?: boolean
     "audience"?: string
     "tokenPolicy": string
+    "binding": string
     "createdAt": number /* timestamp */
     "expiresAt": number /* timestamp */
   }