@atlasauth/emulator-core 0.1.0 → 0.3.0

package/dist/handlers/oauth-flows.js

@@ -0,0 +1,480 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetOAuthFlows = exports.heldConsent = exports.cibaRecords = void 0;
+exports.claimDpopJti = claimDpopJti;
+exports.resolveRequestUri = resolveRequestUri;
+exports.consentGate = consentGate;
+exports.extensionGrant = extensionGrant;
+exports.oauthFlowHandlers = oauthFlowHandlers;
+const errors_1 = require("../errors");
+const store_1 = require("../store");
+const oauth_1 = require("./oauth");
+const oauth_adv_1 = require("./oauth-adv");
+const support_1 = require("./support");
+const emu4_oauth_auth_1 = require("./emu4-oauth-auth");
+const emu4_oauth_pub_1 = require("./emu4-oauth-pub");
+const emu4_oauth_delivery_1 = require("./emu4-oauth-delivery");
+/**
+ * The OAuth provider's interactive and out-of-band flows, on top of the core in `oauth.ts`: the consent screen (built-in
+ * `/oauth2/authorize/consent` and the delegated `/v1/oauth_consent_requests` challenge), pushed authorization requests
+ * (RFC 9126), the device authorization grant (RFC 8628) and OpenID CIBA (poll and ping). The emulator is its own user agent:
+ * the person who consents, enters the device code or answers a CIBA prompt is simulated by calling the same routes a
+ * browser or phone would.
+ */
+const PAR_TTL_MS = 60_000;
+const CONSENT_TTL_MS = 10 * 60_000;
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const CIBA_GRANT = 'urn:openid:params:grant-type:ciba';
+const DEVICE_TTL_S = 600;
+const POLL_INTERVAL_S = 5;
+const USER_CODE_ALPHABET = 'BCDFGHJKLMNPQRSTVWXZ';
+const flows = (0, support_1.engineState)(() => ({ par: new Map(), consents: new Map(), remembered: new Map(), devices: new Map(), ciba: new Map(), dpopSeen: new Map() }));
+/** The CIBA requests of this engine (the delivery sweep announces expired push requests). */
+const cibaRecords = (e) => flows(e).ciba;
+exports.cibaRecords = cibaRecords;
+/** The scopes a user holds a remembered consent for at a client, if any. */
+const heldConsent = (e, userId, clientId) => flows(e).remembered.get(`${userId}|${clientId}`);
+exports.heldConsent = heldConsent;
+const resetOAuthFlows = (_e) => undefined; // state lives in engineState, which engine.reset clears
+exports.resetOAuthFlows = resetOAuthFlows;
+/** Claim a DPoP proof's jti once inside its window; false when it was already used. */
+function claimDpopJti(e, jkt, jti, ttlMs) {
+    const seen = flows(e).dpopSeen;
+    const now = e.clock.now();
+    for (const [k, until] of seen)
+        if (until <= now)
+            seen.delete(k);
+    const key = `${jkt}:${jti}`;
+    if (seen.has(key))
+        return false;
+    seen.set(key, now + ttlMs);
+    return true;
+}
+const found = (location) => ({ status: 302, headers: { location, 'cache-control': 'no-store' } });
+/** The user a flow acts for: an explicit id or email, else the one the emulator signs in, else the only user. */
+function resolveUser(e, hint, allowSole = true) {
+    const live = e.db.users.filter((u) => !u.deleted);
+    if (hint)
+        return live.find((u) => u.id === hint || u.emails.some((m) => m.email_address.toLowerCase() === hint.toLowerCase()));
+    const auto = (0, oauth_1.st)(e).autoUser;
+    return (auto ? live.find((u) => u.id === auto) : undefined) ?? (allowSole && live.length === 1 ? live[0] : undefined);
+}
+// ── PAR ──────────────────────────────────────────────────────────────
+/** An /authorize request carrying `request_uri`: swap in the pushed parameters (single use, bound to the client). */
+function resolveRequestUri(e, query) {
+    const uri = query.get('request_uri');
+    if (!uri)
+        return { query };
+    const rec = flows(e).par.get(uri);
+    if (!rec || rec.used || rec.expiresAt <= e.clock.now())
+        return { error: { code: 'invalid_request_uri', description: 'The request_uri is unknown, expired or already used.' } };
+    if (query.get('client_id') !== rec.clientId)
+        return { error: { code: 'invalid_request', description: 'client_id does not match the client that pushed this request.' } };
+    rec.used = true;
+    return { query: new URLSearchParams({ ...rec.params, client_id: rec.clientId }) };
+}
+// ── consent ──────────────────────────────────────────────────────────
+const rememberKey = (userId, clientId) => `${userId}|${clientId}`;
+/** Where an authorize request must stop for the user's consent, or null when it can proceed (first-party client, consent not required, or already remembered). */
+async function consentGate(e, a) {
+    const { client, user, scope, prompt } = a;
+    const forced = prompt === 'consent' || a.force === true;
+    const ext = a.ext ?? oauth_adv_1.CODE_EXT;
+    if (client.first_party === true || !(client.require_consent === true || forced))
+        return null;
+    const held = flows(e).remembered.get(rememberKey(user.id, client.id));
+    if (!forced && held && scope.every((s) => held.has(s)))
+        return null;
+    // One consent for a verified publisher's other apps (openid, email and profile only).
+    if (!forced && (0, emu4_oauth_pub_1.publisherDecision)(e, client, user.id, scope).skipConsent)
+        return null;
+    if (prompt === 'none')
+        return (0, emu4_oauth_auth_1.authReply)(e, client, a.redirectUri, (0, oauth_adv_1.authUrl)(e, a.redirectUri, { error: 'consent_required', error_description: 'The user has not consented to these scopes.', state: a.state, iss: e.issuer }, !!(0, oauth_adv_1.parseResponseType)(ext.rt)?.frontChannelTokens, ext.mode), ext.mode);
+    const id = `consent_${(0, store_1.randomToken)(24)}`;
+    flows(e).consents.set(id, { id, clientId: client.id, userId: user.id, scope, redirectUri: a.redirectUri, challenge: a.challenge, nonce: a.nonce, state: a.state, ext, expiresAt: e.clock.now() + CONSENT_TTL_MS, status: 'pending' });
+    return found(`${e.issuer}/oauth2/authorize/consent?consent_token=${id}`);
+}
+function liveConsent(e, id) {
+    const c = id ? flows(e).consents.get(id) : undefined;
+    if (!c || c.status !== 'pending' || c.expiresAt <= e.clock.now())
+        throw new errors_1.EmulatorError('NOT_FOUND', 'This consent request has expired or was already answered.');
+    return c;
+}
+/** Answer a consent request; returns the URL to send the browser to. The scopes granted are always a subset of what was asked. */
+async function settleConsent(e, c, d) {
+    const back = (p) => (0, oauth_adv_1.authUrl)(e, c.redirectUri, { ...p, state: c.state, iss: e.issuer }, !!(0, oauth_adv_1.parseResponseType)(c.ext.rt)?.frontChannelTokens, c.ext.mode);
+    const client = e.db.oauthClients.get(c.clientId);
+    if (!client || client.deleted) {
+        c.status = 'rejected';
+        return back({ error: 'unauthorized_client' });
+    }
+    if (!d.approve) {
+        c.status = 'rejected';
+        return back({ error: d.error ?? 'access_denied', error_description: d.description ?? 'The user denied the request.' });
+    }
+    const grant = d.grant ?? c.scope;
+    if (grant.some((s) => !c.scope.includes(s)))
+        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'grant_scope can only narrow the requested scopes.', 'grant_scope');
+    if (c.scope.includes('openid') && !grant.includes('openid'))
+        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'grant_scope must include openid.', 'grant_scope');
+    c.status = 'accepted';
+    if (d.remember !== false) {
+        const key = rememberKey(c.userId, c.clientId);
+        flows(e).remembered.set(key, new Set([...(flows(e).remembered.get(key) ?? []), ...grant]));
+    }
+    return (0, oauth_adv_1.completeAuth)(e, { client, userId: c.userId, scope: grant, redirectUri: c.redirectUri, challenge: c.challenge, nonce: c.nonce, state: c.state, ext: c.ext });
+}
+// ── extension grants on /oauth2/token ────────────────────────────────
+const pendingErr = (error, description) => (0, oauth_1.fail)(400, error, description);
+/** `device_code` and `ciba` grants. Returns undefined for any other grant type. */
+async function extensionGrant(c, client, type, cnf) {
+    const e = c.engine;
+    const now = e.clock.now();
+    if (type !== DEVICE_GRANT && type !== CIBA_GRANT)
+        return undefined;
+    const isDevice = type === DEVICE_GRANT;
+    const rec = isDevice ? flows(e).devices.get(String(c.body.device_code ?? '')) : flows(e).ciba.get(String(c.body.auth_req_id ?? ''));
+    if (!rec || rec.clientId !== client.id || rec.status === 'used')
+        return (0, oauth_1.fail)(400, 'invalid_grant', isDevice ? 'The device_code is invalid.' : 'The auth_req_id is invalid.');
+    // CIBA 10.3: a push-mode client is sent the tokens and never polls.
+    if (!isDevice && rec.mode === 'push')
+        return (0, oauth_1.fail)(400, 'invalid_request', 'This request uses push delivery; the tokens are sent to the client notification endpoint.');
+    if (rec.expiresAt <= now)
+        return pendingErr('expired_token', 'The request expired.');
+    if (rec.status === 'denied') {
+        rec.status = 'used';
+        return pendingErr('access_denied', 'The user denied the request.');
+    }
+    // Polling faster than the interval earns slow_down and a longer interval (RFC 8628 section 3.5).
+    if (rec.status === 'pending') {
+        if (now - rec.lastPoll < rec.interval * 1000) {
+            rec.interval += 5;
+            rec.lastPoll = now;
+            return pendingErr('slow_down', 'Polling too fast: wait at least the new interval.');
+        }
+        rec.lastPoll = now;
+        return pendingErr('authorization_pending', isDevice ? 'The user has not finished authorizing this device yet.' : 'The user has not answered yet.');
+    }
+    rec.status = 'used';
+    const userId = rec.userId;
+    const grant = { id: e.db.newId('oag'), clientId: client.id, userId, scope: rec.scope, revoked: false, jtis: new Set() };
+    (0, oauth_1.st)(e).grants.set(grant.id, grant);
+    return { body: await (0, oauth_1.issueTokens)(e, client, grant, null, now, undefined, cnf), headers: { 'cache-control': 'no-store', pragma: 'no-cache' } };
+}
+const userCodeOf = () => {
+    const bytes = crypto.getRandomValues(new Uint8Array(8));
+    const s = [...bytes].map((b) => USER_CODE_ALPHABET[b % USER_CODE_ALPHABET.length]).join('');
+    return `${s.slice(0, 4)}-${s.slice(4)}`;
+};
+const normaliseUserCode = (s) => String(s ?? '').toUpperCase().replace(/[^A-Z]/g, '');
+function scopeFor(client, asked) {
+    const allowed = client.allowed_scopes ?? [];
+    const requested = (0, oauth_1.splitScope)(asked);
+    if (!requested.length)
+        return allowed;
+    const outside = requested.filter((s) => !allowed.includes(s));
+    return outside.length ? { error: (0, oauth_1.fail)(400, 'invalid_scope', `Scope not allowed for this client: ${outside.join(' ')}.`) } : requested;
+}
+function oauthFlowHandlers() {
+    const cibaView = (r) => ({ id: r.id, scope: r.scope, binding_message: r.bindingMessage, created_at: r.createdAt, expires_at: r.expiresAt });
+    const requireClient = async (e, c, needGrant) => {
+        const auth = await (0, oauth_1.authenticateClient)(e, c);
+        if ('error' in auth)
+            return auth;
+        if (needGrant && !auth.client.grant_types.includes(needGrant))
+            return { error: (0, oauth_1.fail)(400, 'unauthorized_client', `This client is not permitted the ${needGrant} grant.`) };
+        return auth;
+    };
+    return [
+        // ── PAR ──
+        {
+            method: 'POST',
+            pattern: '/oauth2/par',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const auth = await requireClient(e, c);
+                if ('error' in auth)
+                    return auth.error;
+                const client = auth.client;
+                const b = { ...c.body };
+                let rarRaw = b.authorization_details;
+                // A signed request object supersedes the body parameters (RFC 9101).
+                if (b.request) {
+                    const loaded = await (0, oauth_adv_1.loadRequestObject)(e, client, { request: String(b.request) });
+                    if (!loaded.ok)
+                        return (0, oauth_1.fail)(400, loaded.error === 'invalid_request' ? 'invalid_request' : 'invalid_request_object', loaded.description);
+                    for (const k of oauth_adv_1.REQUEST_OBJECT_PARAMS)
+                        if (typeof loaded.claims[k] === 'string')
+                            b[k] = loaded.claims[k];
+                    if (loaded.claims.authorization_details !== undefined)
+                        rarRaw = loaded.claims.authorization_details;
+                    delete b.request;
+                }
+                else if (client.require_signed_request_object === true)
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'This client must send a signed request object.');
+                if (b.request_uri)
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'request_uri is not allowed here.');
+                if (b.client_id && b.client_id !== client.id)
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'client_id does not match the authenticated client.');
+                const redirectUri = typeof b.redirect_uri === 'string' ? b.redirect_uri : undefined;
+                if (!redirectUri || !client.redirect_uris.includes(redirectUri))
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'The redirect_uri does not match a registered URI.');
+                const rt = (0, oauth_adv_1.parseResponseType)(b.response_type);
+                if (!rt)
+                    return (0, oauth_1.fail)(400, 'unsupported_response_type', 'The response_type is not supported.');
+                if (!(0, oauth_adv_1.clientResponseTypes)(client).includes(rt.canonical))
+                    return (0, oauth_1.fail)(400, 'unauthorized_client', 'This client is not registered for this response_type.');
+                const asked = (0, oauth_1.splitScope)(b.scope ?? 'openid');
+                const outside = asked.filter((s) => !client.allowed_scopes.includes(s) && !['openid', 'profile', 'email', 'offline_access'].includes(s));
+                if (outside.length)
+                    return (0, oauth_1.fail)(400, 'invalid_scope', `Scope not allowed: ${outside.join(' ')}.`);
+                if (b.code_challenge && (b.code_challenge_method ?? 'plain') !== 'S256')
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'code_challenge_method must be S256.');
+                if (!b.code_challenge && rt.code && client.auth_method === 'none')
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'A public client must use PKCE (code_challenge).');
+                const rar = (0, oauth_adv_1.validateAuthorizationDetails)(rarRaw, (0, oauth_adv_1.adv)(e).cfg.authorization_details_types);
+                if (!rar.ok)
+                    return (0, oauth_1.fail)(400, 'invalid_authorization_details', rar.message);
+                const gm = (0, oauth_adv_1.parseGrantManagement)(b.grant_management_action, b.grant_id);
+                if (!gm.ok)
+                    return (0, oauth_1.fail)(400, 'invalid_request', gm.message);
+                const params = {};
+                for (const [k, v] of Object.entries(b))
+                    if (typeof v === 'string' && !['client_secret', 'client_id'].includes(k))
+                        params[k] = v;
+                if (rar.value)
+                    params.authorization_details = JSON.stringify(rar.value);
+                const uri = `urn:ietf:params:oauth:request_uri:${(0, store_1.randomToken)(24)}`;
+                flows(e).par.set(uri, { clientId: client.id, params, expiresAt: e.clock.now() + PAR_TTL_MS, used: false });
+                return { status: 201, body: { request_uri: uri, expires_in: PAR_TTL_MS / 1000 }, headers: { 'cache-control': 'no-store' } };
+            },
+        },
+        // ── consent: the built-in screen ──
+        {
+            method: 'GET',
+            pattern: '/oauth2/authorize/consent',
+            public: true,
+            handler: (c) => {
+                const e = c.engine;
+                const r = liveConsent(e, c.query.get('consent_token'));
+                const client = e.db.oauthClients.get(r.clientId);
+                const pub = (0, emu4_oauth_pub_1.publisherDecision)(e, client, r.userId, r.scope);
+                return { body: { object: 'oauth_consent_screen', consent_token: r.id, client: { id: client.id, name: client.name, ...(pub.publisherName ? { published_by: pub.publisherName } : {}) }, user_id: r.userId, requested_scope: r.scope, expires_at: r.expiresAt } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/oauth2/authorize/consent',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const r = liveConsent(e, typeof c.body.consent_token === 'string' ? c.body.consent_token : null);
+                const approve = c.body.decision === 'approve';
+                if (!approve && c.body.decision !== 'deny')
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'decision must be approve or deny.', 'decision');
+                return (0, emu4_oauth_auth_1.authReply)(e, e.db.oauthClients.get(r.clientId), r.redirectUri, await settleConsent(e, r, { approve }), r.ext.mode);
+            },
+        },
+        // ── consent: the delegated challenge (a customer's own consent page) ──
+        {
+            method: 'GET',
+            pattern: '/v1/oauth_consent_requests',
+            handler: (c) => {
+                const e = c.engine;
+                const r = liveConsent(e, c.query.get('consent_challenge'));
+                const client = e.db.oauthClients.get(r.clientId);
+                return { body: { object: 'oauth_consent_request', subject: r.userId, client: { id: client.id, client_id: client.id, name: client.name }, requested_scope: r.scope, expires_at: r.expiresAt } };
+            },
+        },
+        {
+            method: 'PUT',
+            pattern: '/v1/oauth_consent_requests/accept',
+            handler: async (c) => {
+                const e = c.engine;
+                const r = liveConsent(e, c.query.get('consent_challenge'));
+                if (c.body.grant_scope !== undefined && (!Array.isArray(c.body.grant_scope) || c.body.grant_scope.some((s) => typeof s !== 'string')))
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'grant_scope must be a list of scopes.', 'grant_scope');
+                return { body: { object: 'oauth_consent_redirect', redirect_to: await settleConsent(e, r, { approve: true, grant: c.body.grant_scope, remember: c.body.remember }) } };
+            },
+        },
+        {
+            method: 'PUT',
+            pattern: '/v1/oauth_consent_requests/reject',
+            handler: async (c) => {
+                const e = c.engine;
+                const r = liveConsent(e, c.query.get('consent_challenge'));
+                return { body: { object: 'oauth_consent_redirect', redirect_to: await settleConsent(e, r, { approve: false, error: c.body.error, description: c.body.error_description }) } };
+            },
+        },
+        // ── device authorization ──
+        {
+            method: 'POST',
+            pattern: '/oauth2/device_authorization',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const auth = await requireClient(e, c, DEVICE_GRANT);
+                if ('error' in auth)
+                    return auth.error;
+                const scope = scopeFor(auth.client, c.body.scope);
+                if ('error' in scope)
+                    return scope.error;
+                const rec = { deviceCode: (0, store_1.randomToken)(32), userCode: userCodeOf(), clientId: auth.client.id, scope, expiresAt: e.clock.now() + DEVICE_TTL_S * 1000, interval: POLL_INTERVAL_S, lastPoll: 0, status: 'pending' };
+                flows(e).devices.set(rec.deviceCode, rec);
+                const uri = `${e.issuer}/oauth2/device`;
+                return { body: { device_code: rec.deviceCode, user_code: rec.userCode, verification_uri: uri, verification_uri_complete: `${uri}?user_code=${rec.userCode}`, expires_in: DEVICE_TTL_S, interval: POLL_INTERVAL_S }, headers: { 'cache-control': 'no-store', pragma: 'no-cache' } };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/oauth2/device',
+            public: true,
+            handler: (c) => {
+                const e = c.engine;
+                const code = normaliseUserCode(c.query.get('user_code'));
+                const rec = [...flows(e).devices.values()].find((d) => normaliseUserCode(d.userCode) === code && d.status === 'pending' && d.expiresAt > e.clock.now());
+                if (!rec)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'That code is not valid or has expired.');
+                const client = e.db.oauthClients.get(rec.clientId);
+                return { body: { object: 'oauth_device_verification', user_code: rec.userCode, client: { id: client.id, name: client.name }, scope: rec.scope, expires_at: rec.expiresAt } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/oauth2/device/verify',
+            public: true,
+            handler: (c) => {
+                const e = c.engine;
+                const code = normaliseUserCode(c.body.user_code);
+                const rec = [...flows(e).devices.values()].find((d) => normaliseUserCode(d.userCode) === code && d.status === 'pending' && d.expiresAt > e.clock.now());
+                if (!rec)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'That code is not valid or has expired.');
+                if (c.body.decision !== 'approve' && c.body.decision !== 'deny')
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'decision must be approve or deny.', 'decision');
+                if (c.body.decision === 'deny')
+                    rec.status = 'denied';
+                else {
+                    const user = resolveUser(e, typeof c.body.user_id === 'string' ? c.body.user_id : typeof c.body.login_hint === 'string' ? c.body.login_hint : null);
+                    if (!user)
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'No user to sign in. Pass user_id or POST /__emulator/oauth/login.', 'user_id');
+                    if (user.banned)
+                        throw new errors_1.EmulatorError('FORBIDDEN', 'The user is banned.');
+                    rec.userId = user.id;
+                    rec.status = 'approved';
+                }
+                return { body: { object: 'oauth_device_verification', status: rec.status } };
+            },
+        },
+        // ── CIBA ──
+        {
+            method: 'POST',
+            pattern: '/oauth2/backchannel_authentication',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const auth = await requireClient(e, c, CIBA_GRANT);
+                if ('error' in auth)
+                    return auth.error;
+                const client = auth.client;
+                if (client.auth_method === 'none')
+                    return (0, oauth_1.fail)(400, 'invalid_client', 'CIBA requires a confidential client.');
+                // A signed authentication request carries the parameters in a JWT (OpenID CIBA 7.1.1).
+                let body = { ...c.body };
+                if (body.request) {
+                    const loaded = await (0, oauth_adv_1.loadRequestObject)(e, client, { request: String(body.request) });
+                    if (!loaded.ok)
+                        return (0, oauth_1.fail)(400, 'invalid_request_object', loaded.description);
+                    for (const k of ['scope', 'login_hint', 'id_token_hint', 'binding_message', 'user_code', 'client_notification_token', 'acr_values'])
+                        if (typeof loaded.claims[k] === 'string')
+                            body[k] = loaded.claims[k];
+                    if (loaded.claims.requested_expiry !== undefined)
+                        body.requested_expiry = String(loaded.claims.requested_expiry);
+                    delete body.request;
+                }
+                else if (client.require_signed_request_object === true)
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'This client must send a signed authentication request.');
+                const scope = scopeFor(client, body.scope);
+                if ('error' in scope)
+                    return scope.error;
+                const hint = typeof body.login_hint === 'string' ? body.login_hint : '';
+                if (!hint)
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'login_hint is required.');
+                const user = resolveUser(e, hint, false);
+                if (!user)
+                    return (0, oauth_1.fail)(400, 'unknown_user_id', 'No user matches the login_hint.');
+                if (user.banned)
+                    return (0, oauth_1.fail)(400, 'access_denied', 'The user is banned.');
+                const binding = body.binding_message;
+                if (binding !== undefined && (typeof binding !== 'string' || binding.length > 64 || !/^[\x20-\x7e]*$/.test(binding)))
+                    return (0, oauth_1.fail)(400, 'invalid_binding_message', 'binding_message is up to 64 printable characters.');
+                const expiry = body.requested_expiry === undefined ? 120 : Number(body.requested_expiry);
+                if (!Number.isInteger(expiry) || expiry < 1 || expiry > 3600)
+                    return (0, oauth_1.fail)(400, 'invalid_request', 'requested_expiry is a whole number of seconds from 1 to 3600.');
+                const mode = client.backchannel_token_delivery_mode ?? 'poll';
+                let token = null;
+                if (mode !== 'poll') {
+                    const t = body.client_notification_token;
+                    // The notification token is the bearer secret of the client's callback: at least 128 bits (22 base64url characters).
+                    if (typeof t !== 'string' || t.length < 22 || t.length > 1024 || !/^[\x21-\x7e]+$/.test(t))
+                        return (0, oauth_1.fail)(400, 'invalid_request', 'client_notification_token is required (22 to 1024 printable characters) for ping and push.');
+                    if (!client.backchannel_client_notification_endpoint)
+                        return (0, oauth_1.fail)(400, 'invalid_request', 'This client has no notification endpoint registered.');
+                    token = t;
+                }
+                const now = e.clock.now();
+                const rec = { id: `ciba_${(0, store_1.randomToken)(24)}`, clientId: client.id, userId: user.id, scope, bindingMessage: binding ?? null, expiresAt: now + expiry * 1000, interval: POLL_INTERVAL_S, lastPoll: 0, status: 'pending', mode, notificationToken: token, createdAt: now };
+                flows(e).ciba.set(rec.id, rec);
+                return { body: { auth_req_id: rec.id, expires_in: expiry, ...(mode === 'push' ? {} : { interval: POLL_INTERVAL_S }) }, headers: { 'cache-control': 'no-store' } };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/client/me/backchannel_requests',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                const now = e.clock.now();
+                const rows = [...flows(e).ciba.values()].filter((r) => r.userId === userId && r.status === 'pending' && r.expiresAt > now);
+                return { body: { object: 'list', data: rows.map((r) => ({ ...cibaView(r), client_name: e.db.oauthClients.get(r.clientId)?.name ?? 'An application' })) } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/client/me/backchannel_requests/:id',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                const rec = flows(e).ciba.get(c.params.id ?? '');
+                // 404 for someone else's or an unknown request: never confirm one exists.
+                if (!rec || rec.userId !== userId)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'Unknown request.');
+                if (rec.status !== 'pending' || rec.expiresAt <= e.clock.now())
+                    throw new errors_1.EmulatorError('VERIFICATION_FAILED', 'This request is no longer pending.');
+                const approve = c.body.decision === 'approve';
+                rec.status = approve ? 'approved' : 'denied';
+                const client = e.db.oauthClients.get(rec.clientId);
+                if (rec.mode !== 'poll' && client?.backchannel_client_notification_endpoint && rec.notificationToken) {
+                    // Ping carries only the auth_req_id; push carries the token response (or the refusal) itself and is spent by it (CIBA 10.2, 10.3).
+                    let payload = { auth_req_id: rec.id };
+                    if (rec.mode === 'push') {
+                        if (!approve)
+                            payload = { auth_req_id: rec.id, error: 'access_denied', error_description: 'The user denied the request.' };
+                        else {
+                            rec.status = 'used';
+                            const grant = { id: e.db.newId('oag'), clientId: client.id, userId: rec.userId, scope: rec.scope, revoked: false, jtis: new Set() };
+                            (0, oauth_1.st)(e).grants.set(grant.id, grant);
+                            payload = { auth_req_id: rec.id, ...(await (0, oauth_1.issueTokens)(e, client, grant, null, e.clock.now())) };
+                        }
+                    }
+                    // Queued with the real retry schedule: a failing endpoint is retried as the clock advances; a failed ping leaves the request pollable.
+                    await (0, emu4_oauth_delivery_1.enqueueCiba)(e, { kind: rec.mode === 'push' ? 'ciba_push' : 'ciba_ping', clientId: client.id, requestId: rec.id, endpoint: client.backchannel_client_notification_endpoint, token: rec.notificationToken, payload });
+                }
+                return { body: { object: 'backchannel_request', id: rec.id, status: approve ? 'approved' : 'denied' } };
+            },
+        },
+    ];
+}
+//# sourceMappingURL=oauth-flows.js.map

package/dist/handlers/oauth-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flows.js","sourceRoot":"","sources":["../../src/handlers/oauth-flows.ts"],"names":[],"mappings":";;;AAoFA,oCAQC;AAeD,8CAQC;AAOD,kCAaC;AAoCD,wCA6BC;AAiBD,8CA2PC;AAldD,sCAA0C;AAE1C,oCAAuC;AACvC,mCAAuG;AACvG,2CAAuN;AACvN,uCAA2D;AAC3D,uDAA8C;AAC9C,qDAAqD;AACrD,+DAAoD;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AACnC,MAAM,YAAY,GAAG,8CAA8C,CAAC;AACpE,MAAM,UAAU,GAAG,mCAAmC,CAAC;AACvD,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAmDlD,MAAM,KAAK,GAAG,IAAA,qBAAW,EAAC,GAAU,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACnK,6FAA6F;AACtF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAwB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAAjE,QAAA,WAAW,eAAsD;AAC9E,4EAA4E;AACrE,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;AAAzI,QAAA,WAAW,eAA8H;AAC/I,MAAM,eAAe,GAAG,CAAC,EAAU,EAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,wDAAwD;AAA3G,QAAA,eAAe,mBAAmC;AAE/D,uFAAuF;AACvF,SAAgB,YAAY,CAAC,CAAS,EAAE,GAAW,EAAE,GAAW,EAAE,KAAa;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI;QAAE,IAAI,KAAK,IAAI,GAAG;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AAEjH,iHAAiH;AACjH,SAAS,WAAW,CAAC,CAAS,EAAE,IAA+B,EAAE,SAAS,GAAG,IAAI;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAK,CAAC,CAAC,MAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,IAAA,UAAO,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACxH,CAAC;AAED,wEAAwE;AAExE,qHAAqH;AACrH,SAAgB,iBAAiB,CAAC,CAAS,EAAE,KAAsB;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE,EAAE,CAAC;IAC/K,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,+DAA+D,EAAE,EAAE,CAAC;IACzK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO,EAAE,KAAK,EAAE,IAAI,eAAe,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,wEAAwE;AAExE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;AAElF,kKAAkK;AAC3J,KAAK,UAAU,WAAW,CAAC,CAAS,EAAE,CAA0L;IACrO,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,oBAAQ,CAAC;IAC9B,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,IAAI,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,sFAAsF;IACtF,IAAI,CAAC,MAAM,IAAI,IAAA,kCAAiB,EAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAA,2BAAS,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,IAAA,mBAAO,EAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,6CAA6C,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAA,6BAAiB,EAAC,GAAG,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAClS,MAAM,EAAE,GAAG,WAAW,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;IACxC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACtO,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,2CAA2C,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,EAA6B;IAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,2DAA2D,CAAC,CAAC;IACpK,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kIAAkI;AAClI,KAAK,UAAU,aAAa,CAAC,CAAS,EAAE,CAAU,EAAE,CAAmG;IACrJ,MAAM,IAAI,GAAG,CAAC,CAAqC,EAAE,EAAE,CAAC,IAAA,mBAAO,EAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAA,6BAAiB,EAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1L,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC;QACtB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC;QACtB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,iBAAiB,EAAE,CAAC,CAAC,WAAW,IAAI,8BAA8B,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;IACjC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,mDAAmD,EAAE,aAAa,CAAC,CAAC;IAC9J,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,kCAAkC,EAAE,aAAa,CAAC,CAAC;IAC7J,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC;IACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9C,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,IAAA,wBAAY,EAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AACrK,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAS,EAAE,CAAC,IAAA,YAAI,EAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAEhG,mFAAmF;AAC5E,KAAK,UAAU,cAAc,CAAC,CAAe,EAAE,MAAW,EAAE,IAAY,EAAE,GAAoB;IACnG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,KAAK,YAAY,CAAC;IACvC,MAAM,GAAG,GAAoC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;IACrK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAC7K,oEAAoE;IACpE,IAAI,CAAC,QAAQ,IAAK,GAAe,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,2FAA2F,CAAC,CAAC;IACpL,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,UAAU,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IACrF,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACpB,OAAO,UAAU,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IACrE,CAAC;IACD,iGAAiG;IACjG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;YAC7C,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;YAClB,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC;YACnB,OAAO,UAAU,CAAC,WAAW,EAAE,mDAAmD,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC;QACnB,OAAO,UAAU,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;IACrJ,CAAC;IACD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,MAAM,GAAI,GAAW,CAAC,MAAgB,CAAC;IAC7C,MAAM,KAAK,GAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC/H,IAAA,UAAO,EAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAA,mBAAW,EAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;AAChJ,CAAC;AAED,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC,CAAC;AACF,MAAM,iBAAiB,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAEvG,SAAS,QAAQ,CAAC,MAAW,EAAE,KAAyB;IACtD,MAAM,OAAO,GAAa,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,IAAA,kBAAU,EAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,YAAI,EAAC,GAAG,EAAE,eAAe,EAAE,sCAAsC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxI,CAAC;AAED,SAAgB,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1J,MAAM,aAAa,GAAG,KAAK,EAAE,CAAS,EAAE,CAAe,EAAE,SAAkB,EAA+C,EAAE;QAC1H,MAAM,IAAI,GAAG,MAAM,IAAA,0BAAkB,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,SAAS,IAAI,CAAE,IAAI,CAAC,MAAM,CAAC,WAAwB,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAA,YAAI,EAAC,GAAG,EAAE,qBAAqB,EAAE,oCAAoC,SAAS,SAAS,CAAC,EAAE,CAAC;QACxL,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,YAAY;QACZ;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvC,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC,KAAK,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,MAAM,CAAC,GAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,MAAM,GAAY,CAAC,CAAC,qBAAqB,CAAC;gBAC9C,qEAAqE;gBACrE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAiB,EAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAClF,IAAI,CAAC,MAAM,CAAC,EAAE;wBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,MAAM,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;oBACxI,KAAK,MAAM,CAAC,IAAI,iCAAqB;wBAAE,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ;4BAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACzG,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;wBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;oBACpG,OAAO,CAAC,CAAC,OAAO,CAAC;gBACnB,CAAC;qBAAM,IAAI,MAAM,CAAC,6BAA6B,KAAK,IAAI;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;gBAChJ,IAAI,CAAC,CAAC,WAAW;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;gBAC3F,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;gBACxI,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpF,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;gBAC1J,MAAM,EAAE,GAAG,IAAA,6BAAiB,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC9C,IAAI,CAAC,EAAE;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,2BAA2B,EAAE,qCAAqC,CAAC,CAAC;gBAC9F,IAAI,CAAC,IAAA,+BAAmB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,qBAAqB,EAAE,uDAAuD,CAAC,CAAC;gBAC1J,MAAM,KAAK,GAAG,IAAA,kBAAU,EAAC,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzI,IAAI,OAAO,CAAC,MAAM;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,eAAe,EAAE,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClG,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,OAAO,CAAC,KAAK,MAAM;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;gBACpJ,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,iDAAiD,CAAC,CAAC;gBAC1J,MAAM,GAAG,GAAG,IAAA,wCAA4B,EAAC,MAAM,EAAE,IAAA,eAAG,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;gBACzF,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5E,MAAM,EAAE,GAAG,IAAA,gCAAoB,EAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACvE,IAAI,CAAC,EAAE,CAAC,EAAE;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5D,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAChI,IAAI,GAAG,CAAC,KAAK;oBAAE,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxE,MAAM,GAAG,GAAG,qCAAqC,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;gBACnE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3G,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;YAC9H,CAAC;SACF;QACD,qCAAqC;QACrC;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,2BAA2B;YACpC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;gBACvD,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,IAAA,kCAAiB,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC5D,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YAClQ,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2BAA2B;YACpC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjG,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;gBAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,mCAAmC,EAAE,UAAU,CAAC,CAAC;gBAC1I,OAAO,IAAA,2BAAS,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5H,CAAC;SACF;QACD,yEAAyE;QACzE;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,4BAA4B;YACrC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBAC3D,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAE,CAAC;gBAClD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YACjM,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,mCAAmC;YAC5C,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBAC3D,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,uCAAuC,EAAE,aAAa,CAAC,CAAC;gBACrP,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YACzK,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,mCAAmC;YAC5C,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC;YAChL,CAAC;SACF;QACD,6BAA6B;QAC7B;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,8BAA8B;YACvC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;gBACrD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC,KAAK,CAAC;gBACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClD,IAAI,OAAO,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC,KAAK,CAAC;gBACzC,MAAM,GAAG,GAAc,EAAE,UAAU,EAAE,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC3N,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,gBAAgB,CAAC;gBACxC,OAAO,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,GAAG,cAAc,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;YACrR,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxJ,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;gBACpD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;YAC/K,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjD,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxJ,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;gBACzF,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,mCAAmC,EAAE,UAAU,CAAC,CAAC;gBAC/J,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM;oBAAE,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;qBACjD,CAAC;oBACJ,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACpJ,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,mEAAmE,EAAE,SAAS,CAAC,CAAC;oBACxI,IAAI,IAAI,CAAC,MAAM;wBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;oBAC7E,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;oBACrB,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;gBAC1B,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,CAAC;SACF;QACD,aAAa;QACb;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oCAAoC;YAC7C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;gBACnD,IAAI,OAAO,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC,KAAK,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;gBAC9G,uFAAuF;gBACvF,IAAI,IAAI,GAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAiB,EAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACrF,IAAI,CAAC,MAAM,CAAC,EAAE;wBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,2BAA2B,EAAE,YAAY,CAAC;wBAAE,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ;4BAAE,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC1M,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;wBAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBACjH,OAAO,IAAI,CAAC,OAAO,CAAC;gBACtB,CAAC;qBAAM,IAAI,MAAM,CAAC,6BAA6B,KAAK,IAAI;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,wDAAwD,CAAC,CAAC;gBACxJ,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,OAAO,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC,KAAK,CAAC;gBACzC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;gBAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACzC,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;gBAClF,IAAI,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;gBAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;gBACrC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;gBACvN,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBACzF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI;oBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,+DAA+D,CAAC,CAAC;gBACnK,MAAM,IAAI,GAA6B,MAAM,CAAC,+BAA+B,IAAI,MAAM,CAAC;gBACxF,IAAI,KAAK,GAAkB,IAAI,CAAC;gBAChC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,MAAM,CAAC,GAAG,IAAI,CAAC,yBAAyB,CAAC;oBACzC,qHAAqH;oBACrH,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;wBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,4FAA4F,CAAC,CAAC;oBAC9N,IAAI,CAAC,MAAM,CAAC,wCAAwC;wBAAE,OAAO,IAAA,YAAI,EAAC,GAAG,EAAE,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;oBAClJ,KAAK,GAAG,CAAC,CAAC;gBACZ,CAAC;gBACD,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAY,EAAE,EAAE,EAAE,QAAQ,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,IAAI,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;gBAChR,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC/B,OAAO,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;YACpK,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,oCAAoC;YAC7C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;gBAC3H,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7J,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wCAAwC;YACjD,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,0EAA0E;gBAC1E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;gBAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBAAE,MAAM,IAAI,sBAAa,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;gBACrJ,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;gBAC9C,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,EAAE,wCAAwC,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;oBACrG,mIAAmI;oBACnI,IAAI,OAAO,GAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;oBAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBACxB,IAAI,CAAC,OAAO;4BAAE,OAAO,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,CAAC;6BACtH,CAAC;4BACJ,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;4BACpB,MAAM,KAAK,GAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;4BAC3I,IAAA,UAAO,EAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;4BACvC,OAAO,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,IAAA,mBAAW,EAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;wBACnG,CAAC;oBACH,CAAC;oBACD,uIAAuI;oBACvI,MAAM,IAAA,iCAAW,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,wCAAwC,EAAE,KAAK,EAAE,GAAG,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5N,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1G,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/oauth.d.ts

@@ -0,0 +1,96 @@
+import type { Engine, Reply, RouteContext, RouteDef } from '../engine';
+import { type Obj } from '../openapi';
+import { type AuthExt } from './oauth-adv';
+export interface Grant {
+    id: string;
+    clientId: string;
+    userId: string | null;
+    scope: string[];
+    revoked: boolean;
+    /** Access token jtis minted from this grant, so reuse of a code can revoke them. */
+    jtis: Set<string>;
+    /** The DPoP key the grant's refresh tokens are bound to (RFC 9449 section 8). */
+    jkt?: string;
+    /** The OP session (browser session) the grant's ID tokens name in `sid`. */
+    sid?: string;
+    /** The granted authorization_details (RFC 9396). */
+    details?: unknown[] | null;
+    /** The OpenID grant-management grant these tokens belong to. */
+    managedId?: string;
+}
+export interface OAuthState {
+    codes: Map<string, {
+        grantId: string;
+        redirectUri: string;
+        challenge: string | null;
+        nonce: string | null;
+        authTime: number;
+        expiresAt: number;
+        used: boolean;
+        ext?: AuthExt;
+    }>;
+    grants: Map<string, Grant>;
+    refresh: Map<string, {
+        grantId: string;
+        rotatedAt?: number;
+        successor?: string;
+    }>;
+    /** jti -> access token record (client_credentials and exchanged tokens have no grant). */
+    access: Map<string, {
+        clientId: string;
+        userId: string | null;
+        scope: string[];
+        exp: number;
+        revoked: boolean;
+        grantId: string | null;
+        cnf?: Obj;
+    }>;
+    autoUser: string | null;
+}
+export declare const st: (e: Engine) => OAuthState;
+export declare const resetOAuth: (e: Engine) => void;
+export declare const fail: (status: number, error: string, description: string, extra?: Obj) => Reply;
+export declare function discoveryDocument(e: Engine): Obj;
+/** Client authentication with the method the client is REGISTERED for: Basic, `client_id` (+ `client_secret`) in the body, a signed `client_assertion` (private_key_jwt), or nothing for a public client. */
+export declare function authenticateClient(e: Engine, c: RouteContext): Promise<{
+    client: Obj;
+} | {
+    error: Reply;
+}>;
+export declare const splitScope: (s: unknown) => string[];
+export declare function mintAccess(e: Engine, input: {
+    client: Obj;
+    userId: string | null;
+    scope: string[];
+    grant: Grant | null;
+    audience?: string;
+    extra?: Obj;
+    cnf?: Obj;
+    ttl?: number;
+}): Promise<{
+    token: string;
+    jti: string;
+}>;
+export declare const userClaims: (e: Engine, userId: string, scope: string[]) => Obj;
+export declare function issueTokens(e: Engine, client: Obj, grant: Grant, nonce: string | null, authTime: number, refreshRec?: string, cnf?: Obj): Promise<Obj>;
+export declare function idTokenFor(e: Engine, client: Obj, userId: string, scope: string[], nonce: string | null, authTime: number, sid?: string, extra?: Obj): Promise<string>;
+/** End a grant and every access token minted from it. */
+export declare function revokeGrant(e: Engine, g: Grant): void;
+/** A presented access token for a resource of this provider: signature, revocation and its sender constraint (DPoP proof or client certificate). */
+export declare function checkResourceToken(c: RouteContext, bearer: string, scheme: string): Promise<{
+    rec: NonNullable<ReturnType<OAuthState['access']['get']>>;
+} | {
+    error: true;
+    message: string;
+}>;
+/** Create the grant and the single-use authorization code for an approved request (after login and, when needed, consent). */
+export declare function issueCode(e: Engine, a: {
+    client: Obj;
+    userId: string;
+    scope: string[];
+    redirectUri: string;
+    challenge: string | null;
+    nonce: string | null;
+    ext?: AuthExt;
+}): string;
+export declare function oauthHandlers(): RouteDef[];