@c9up/visa 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 C9up
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,156 @@
+# @c9up/visa
+
+An OAuth 2.1 authorization server for the Ream ecosystem. It issues tokens to
+**other** applications on a user's behalf.
+
+It does not authenticate anyone — that stays warden's job. Visa asks your
+application who is signed in, and everything else is its business.
+
+No dependencies: `node:crypto` only. A package in the path that mints and
+compares credentials is a package that can replace them.
+
+```bash
+ream configure @c9up/visa
+```
+
+## What it implements
+
+| | |
+|---|---|
+| Grants | `authorization_code` (PKCE required), `refresh_token`, `client_credentials` |
+| Endpoints | `/oauth/token`, `/oauth/revoke`, `/oauth/introspect`, `/.well-known/oauth-authorization-server` |
+| Removed | `implicit` and `password` — gone from OAuth 2.1, and not available under any option |
+
+`/authorize` is **not** mounted, deliberately: it needs a signed-in user and a
+consent screen, and both belong to your application. See below.
+
+## Security decisions, and why
+
+- **PKCE on every client**, confidential ones included — a code on the front
+  channel is interceptable whoever asked for it.
+- **`S256` only.** `plain` puts the verifier in the authorization request, so
+  anything that can read that request can complete the exchange, which is what
+  PKCE exists to stop. `allowPlainChallenge: true` brings it back; don't.
+- **Exact redirect URI matching**, with the one exception the spec names (a
+  loopback port). A prefix match is how an open redirect on the client's own
+  domain becomes a stolen code.
+- **An error is never redirected to an unverified URI.** A bad `redirect_uri`
+  is shown to the user, not bounced.
+- **Everything is hashed at rest** — codes, access tokens, refresh tokens,
+  client secrets. A database dump is not a set of working credentials.
+- **Refresh rotation with replay detection.** Every use mints a new token; a
+  spent one coming back proves a leak, and since there is no telling the thief
+  from the victim, the whole family goes.
+- **One sentence per failure.** "No such code", "expired", "already used" and
+  "wrong client" are `invalid_grant: The code is not valid.` — telling them
+  apart is how a code space gets probed.
+
+## Wiring `/authorize`
+
+The decision is visa's; the page is yours.
+
+```ts
+// start/routes.ts
+import visa from '@c9up/visa/services/main'
+
+router.get('/oauth/authorize', async (ctx) => {
+  const outcome = await visa.authorize(ctx.request.qs(), ctx.auth.user?.id)
+
+  if (outcome.type === 'redirect') return ctx.response.redirect(outcome.url)
+  if (outcome.type === 'error') {
+    // NOT a redirect: the redirect URI is what failed validation.
+    return ctx.view.render('oauth/error', { error: outcome.error.toResponse() })
+  }
+  if (!ctx.auth.user) return ctx.response.redirect('/login?next=' + encodeURIComponent(ctx.request.url(true)))
+
+  return ctx.view.render('oauth/consent', {
+    client: outcome.request.client,
+    scopes: outcome.request.scopes,
+  })
+})
+
+router.post('/oauth/consent', async (ctx) => {
+  const outcome = await visa.authorize(ctx.request.all(), ctx.auth.user.id)
+  if (outcome.type !== 'consent') return ctx.response.redirect('/')
+  const url = ctx.request.input('approve')
+    ? await visa.grant(outcome.request, ctx.auth.user.id)
+    : visa.deny(outcome.request)
+  return ctx.response.redirect(url)
+})
+```
+
+## Registering a client
+
+```ts
+const { client, secret } = await visa.registerClient({
+  id: 'invoices',
+  name: 'Invoices',
+  redirectUris: ['https://invoices.example.com/callback'],
+  scopes: ['profile', 'invoices:read'],
+})
+// `secret` is shown once and never stored in plaintext. A client that loses
+// it gets a new one.
+```
+
+A public client — a SPA, a native app — registers with
+`tokenEndpointAuthMethod: 'none'` and gets no secret. It may not use
+`client_credentials`: "the client itself" means nothing when anyone can read
+its id out of a browser.
+
+## Protecting a resource
+
+```ts
+const grant = await visa.verify(bearerToken)
+if (!grant) return ctx.response.unauthorized({ error: 'invalid_token' })
+if (!grant.scopes.includes('invoices:read')) {
+  return ctx.response.forbidden({ error: 'insufficient_scope' })
+}
+```
+
+## Testing
+
+`@c9up/visa/testing` hands back the REAL server on a memory store, with a
+client already registered:
+
+```ts
+import { testVisa } from '@c9up/visa/testing'
+
+const t = await testVisa({ scopes: ['profile', 'invoices:read'] })
+const tokens = await t.tokensFor('user-7', 'invoices:read')
+const grant = await t.visa.verify(tokens.access_token)
+```
+
+`tokensFor()` walks authorize → consent → code → exchange rather than minting a
+token directly. Not a lenient double on purpose: a helper that granted whatever
+was asked would teach applications to ship a consent screen nobody has seen
+refuse.
+
+## The issuer
+
+It identifies the SERVER, and that is all it does here. An access token is
+opaque — a random string with no claims inside — so nothing is "bound" to an
+issuer cryptographically; the only thing that can vouch for such a token is the
+server that minted it. That is why `/oauth/introspect` answers with `iss`, and
+why the metadata document names it.
+
+It is validated at boot rather than at the first request: it must be a URL,
+`https` (localhost excepted), with no query string and no fragment, and a
+trailing slash is dropped — every endpoint is built by concatenation, so
+`https://auth.test/` would otherwise produce `https://auth.test//oauth/token`.
+
+## The store
+
+`MemoryStore` is for tests and a single development process. Everything else
+implements `VisaStore` — twelve methods. Two of them, `consumeAuthorizationCode`
+and `consumeRefreshToken`, **must be atomic**: two requests racing with the same
+code must not both succeed, and that single-use guarantee is what replay
+detection is built on.
+
+## What is not here yet
+
+OpenID Connect — `id_token`, discovery, JWKS, `/userinfo`. The `nonce` is
+already carried through the authorization code for it.
+
+## License
+
+MIT

package/dist/VisaManager.d.ts

@@ -0,0 +1,94 @@
+/**
+ * The server, assembled.
+ *
+ * Transport-agnostic on purpose: every method takes plain values and returns
+ * plain values, so the same object is driven by a ream route, by a test, or by
+ * a host that is not ream at all. The HTTP binding lives in the provider.
+ */
+import { type AuthorizationRequest, type AuthorizeOptions, type ValidatedRequest } from "./authorize.js";
+import { type ClientCredentials } from "./clients.js";
+import { OAuthError } from "./errors.js";
+import type { VisaStore } from "./store.js";
+import { type TokenOptions } from "./token.js";
+import type { Client, ClientAuthMethod, GrantType, IntrospectionResponse, TokenResponse } from "./types.js";
+export interface VisaConfig extends AuthorizeOptions, TokenOptions {
+    /** Where this server lives — `https://auth.example.com`. */
+    issuer: string;
+    store: VisaStore;
+}
+/** What `authorize()` decided. */
+export type AuthorizationOutcome = 
+/** Send the user here. */
+{
+    type: "redirect";
+    url: string;
+}
+/** Ask first: this user has not agreed to these scopes for this client. */
+ | {
+    type: "consent";
+    request: ValidatedRequest;
+}
+/**
+ * Show the user this error. It must NOT be redirected — the redirect URI
+ * is the thing that failed validation.
+ */
+ | {
+    type: "error";
+    error: OAuthError;
+};
+export declare class VisaManager {
+    #private;
+    constructor(config: VisaConfig);
+    get issuer(): string;
+    get store(): VisaStore;
+    /**
+     * Register a client and hand back its secret ONCE.
+     *
+     * The plaintext is never stored and cannot be recovered; a client that
+     * loses it gets a new one. That is not an inconvenience to work around —
+     * it is the reason a database dump is not a set of working credentials.
+     */
+    registerClient(input: {
+        id: string;
+        name: string;
+        redirectUris: string[];
+        grantTypes?: GrantType[];
+        scopes?: string[];
+        tokenEndpointAuthMethod?: ClientAuthMethod;
+        trusted?: boolean;
+    }): Promise<{
+        client: Client;
+        secret?: string;
+    }>;
+    /**
+     * Step one: check the request, and decide what happens to the user.
+     *
+     * `userId` is whoever is signed in — warden's business, not visa's. Pass
+     * `undefined` and the caller is told to authenticate first.
+     */
+    authorize(request: AuthorizationRequest, userId: string | undefined): Promise<AuthorizationOutcome>;
+    /**
+     * Step two: the user said yes. Record it and build the redirect.
+     *
+     * Split from `authorize` because the consent screen sits between them, and
+     * the answer to it is a POST the application owns.
+     */
+    grant(validated: ValidatedRequest, userId: string, now?: Date): Promise<string>;
+    /** The user said no. */
+    deny(validated: ValidatedRequest): string;
+    token(body: Record<string, unknown>, credentials: ClientCredentials, now?: Date): Promise<TokenResponse>;
+    introspect(body: Record<string, unknown>, credentials: ClientCredentials, now?: Date): Promise<IntrospectionResponse>;
+    revoke(body: Record<string, unknown>, credentials: ClientCredentials, now?: Date): Promise<void>;
+    /** What a resource server calls on every request. */
+    verify(presented: string, now?: Date): Promise<{
+        clientId: string;
+        userId?: string;
+        scopes: string[];
+    } | null>;
+    /** Read credentials out of a request, both places the spec allows. */
+    readCredentials(input: {
+        authorization?: string;
+        body: Record<string, unknown>;
+    }): ClientCredentials;
+}
+//# sourceMappingURL=VisaManager.d.ts.map

package/dist/VisaManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"VisaManager.d.ts","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAKrB,KAAK,gBAAgB,EAErB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EACX,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,aAAa,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAW,SAAQ,gBAAgB,EAAE,YAAY;IACjE,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,MAAM,oBAAoB;AAC/B,0BAA0B;AACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC,2EAA2E;GACzE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE;AAChD;;;GAGG;GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAExC,qBAAa,WAAW;;gBAGX,MAAM,EAAE,UAAU;IAO9B,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,KAAK,IAAI,SAAS,CAErB;IAED;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;QAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgChD;;;;;OAKG;IACG,SAAS,CACd,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,oBAAoB,CAAC;IA2ChC;;;;;OAKG;IACG,KAAK,CACV,SAAS,EAAE,gBAAgB,EAC3B,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC;IAiBlB,wBAAwB;IACxB,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM;IAQnC,KAAK,CACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,aAAa,CAAC;IAInB,UAAU,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,qBAAqB,CAAC;IAI3B,MAAM,CACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC;IAIhB,qDAAqD;IAC/C,MAAM,CACX,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAI1E,sEAAsE;IACtE,eAAe,CAAC,KAAK,EAAE;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9B,GAAG,iBAAiB;CAsBrB"}

package/dist/VisaManager.js

@@ -0,0 +1,216 @@
+/**
+ * The server, assembled.
+ *
+ * Transport-agnostic on purpose: every method takes plain values and returns
+ * plain values, so the same object is driven by a ream route, by a test, or by
+ * a host that is not ream at all. The HTTP binding lives in the provider.
+ */
+import { errorRedirect, issueAuthorizationCode, successRedirect, UnredirectableError, validateAuthorizationRequest, } from "./authorize.js";
+import { readCredentials, redirectUriMatches, } from "./clients.js";
+import { hashSecret, randomToken } from "./crypto.js";
+import { OAuthError, VisaError } from "./errors.js";
+import { introspect, revoke, verifyAccessToken } from "./introspect.js";
+import { token } from "./token.js";
+export class VisaManager {
+    #config;
+    constructor(config) {
+        // Validated here rather than at the first request: a server that boots
+        // with a broken issuer answers every metadata fetch with something no
+        // client can use, and says so nowhere.
+        this.#config = { ...config, issuer: normalizeIssuer(config.issuer) };
+    }
+    get issuer() {
+        return this.#config.issuer;
+    }
+    get store() {
+        return this.#config.store;
+    }
+    /**
+     * Register a client and hand back its secret ONCE.
+     *
+     * The plaintext is never stored and cannot be recovered; a client that
+     * loses it gets a new one. That is not an inconvenience to work around —
+     * it is the reason a database dump is not a set of working credentials.
+     */
+    async registerClient(input) {
+        // Refused at registration, not at the first authorization request: a
+        // URI that cannot be parsed would otherwise throw out of
+        // `successRedirect`, turning a client's mistake into a 500 on a path
+        // an attacker can reach.
+        assertRedirectUris(input.redirectUris);
+        const method = input.tokenEndpointAuthMethod ?? "client_secret_basic";
+        const secret = method === "none" ? undefined : randomToken();
+        const client = {
+            id: input.id,
+            name: input.name,
+            redirectUris: input.redirectUris,
+            grantTypes: input.grantTypes ?? ["authorization_code", "refresh_token"],
+            scopes: input.scopes ?? [],
+            tokenEndpointAuthMethod: method,
+            ...(input.trusted === undefined ? {} : { trusted: input.trusted }),
+            ...(secret === undefined ? {} : { secretHash: hashSecret(secret) }),
+        };
+        const store = this.#config.store;
+        if (!("addClient" in store) || typeof store.addClient !== "function") {
+            throw new VisaError("E_VISA_STORE_READ_ONLY", "This store cannot register clients; create them where they live.", {
+                hint: "MemoryStore.addClient exists; a database store registers rows.",
+            });
+        }
+        store.addClient(client);
+        return secret === undefined ? { client } : { client, secret };
+    }
+    /**
+     * Step one: check the request, and decide what happens to the user.
+     *
+     * `userId` is whoever is signed in — warden's business, not visa's. Pass
+     * `undefined` and the caller is told to authenticate first.
+     */
+    async authorize(request, userId) {
+        let validated;
+        try {
+            validated = await validateAuthorizationRequest(request, this.#config.store, this.#config);
+        }
+        catch (error) {
+            if (error instanceof UnredirectableError) {
+                return { type: "error", error: error.error };
+            }
+            if (error instanceof OAuthError) {
+                // Redirectable: the URI was verified before this check ran.
+                const uri = await this.#redirectUriFor(request);
+                if (uri === null)
+                    return { type: "error", error };
+                return {
+                    type: "redirect",
+                    url: errorRedirect(uri, error, request.state),
+                };
+            }
+            throw error;
+        }
+        if (userId === undefined) {
+            return { type: "consent", request: validated };
+        }
+        const consent = await this.#config.store.findConsent(userId, validated.client.id);
+        const covered = consent !== null &&
+            validated.scopes.every((scope) => consent.scopes.includes(scope));
+        const forced = request.prompt === "consent";
+        if (validated.client.trusted !== true && (!covered || forced)) {
+            return { type: "consent", request: validated };
+        }
+        return { type: "redirect", url: await this.grant(validated, userId) };
+    }
+    /**
+     * Step two: the user said yes. Record it and build the redirect.
+     *
+     * Split from `authorize` because the consent screen sits between them, and
+     * the answer to it is a POST the application owns.
+     */
+    async grant(validated, userId, now = new Date()) {
+        await this.#config.store.saveConsent({
+            userId,
+            clientId: validated.client.id,
+            scopes: validated.scopes,
+            grantedAt: now,
+        });
+        const code = await issueAuthorizationCode(validated, userId, this.#config.store, this.#config, now);
+        return successRedirect(validated, code);
+    }
+    /** The user said no. */
+    deny(validated) {
+        return errorRedirect(validated.redirectUri, new OAuthError("access_denied", "The user refused the request."), validated.state);
+    }
+    async token(body, credentials, now = new Date()) {
+        return token(body, credentials, this.#config.store, this.#config, now);
+    }
+    async introspect(body, credentials, now = new Date()) {
+        return introspect(body, credentials, this.#config.store, now, this.issuer);
+    }
+    async revoke(body, credentials, now = new Date()) {
+        return revoke(body, credentials, this.#config.store, now);
+    }
+    /** What a resource server calls on every request. */
+    async verify(presented, now = new Date()) {
+        return verifyAccessToken(presented, this.#config.store, now);
+    }
+    /** Read credentials out of a request, both places the spec allows. */
+    readCredentials(input) {
+        return readCredentials(input);
+    }
+    /**
+     * The redirect URI an error may travel to, or `null` when there is none to
+     * trust. Re-resolved rather than remembered: the validation that failed is
+     * the one that would have produced it.
+     */
+    async #redirectUriFor(request) {
+        if (request.client_id === undefined)
+            return null;
+        const client = await this.#config.store.findClient(request.client_id);
+        if (client === null)
+            return null;
+        if (request.redirect_uri === undefined) {
+            return client.redirectUris.length === 1
+                ? (client.redirectUris[0] ?? null)
+                : null;
+        }
+        return redirectUriMatches(request.redirect_uri, client.redirectUris)
+            ? request.redirect_uri
+            : null;
+    }
+}
+/**
+ * The issuer, checked and trimmed.
+ *
+ * A trailing slash is not cosmetic here: every endpoint is built by
+ * concatenation, so `https://auth.test/` yields `https://auth.test//oauth/token`
+ * — a URL some clients normalise and others do not.
+ */
+function normalizeIssuer(issuer) {
+    if (issuer === undefined || issuer === "") {
+        throw new VisaError("E_VISA_MISSING_ISSUER", "visa needs an issuer — the public URL this authorization server answers on.", { hint: "Set `issuer` in config/visa.ts, e.g. https://auth.example.com" });
+    }
+    let url;
+    try {
+        url = new URL(issuer);
+    }
+    catch {
+        throw new VisaError("E_VISA_INVALID_ISSUER", `visa's issuer is not a URL: ${issuer}`, { hint: "It is the public origin, e.g. https://auth.example.com" });
+    }
+    if (url.protocol !== "https:" && url.hostname !== "localhost") {
+        // Tokens travel to it. `http://` is for a laptop, and the exception is
+        // named so nobody has to guess whether it applies in production.
+        throw new VisaError("E_VISA_INSECURE_ISSUER", `visa's issuer must be https (localhost excepted): ${issuer}`);
+    }
+    if (url.hash !== "" || url.search !== "") {
+        throw new VisaError("E_VISA_INVALID_ISSUER", "visa's issuer must carry no query string and no fragment.");
+    }
+    return issuer.replace(/\/+$/, "");
+}
+/**
+ * Every redirect URI a client registers, checked once.
+ *
+ * A fragment is refused because the authorization response appends its own
+ * query and a fragment would swallow it; a wildcard because this server
+ * compares exactly and `*` would simply never match, silently.
+ */
+function assertRedirectUris(uris) {
+    if (uris.length === 0) {
+        throw new VisaError("E_VISA_NO_REDIRECT_URI", "A client needs at least one redirect URI.");
+    }
+    for (const uri of uris) {
+        let url;
+        try {
+            url = new URL(uri);
+        }
+        catch {
+            throw new VisaError("E_VISA_INVALID_REDIRECT_URI", `Not a URL: ${uri}`, {
+                hint: "Register the complete URI, scheme and path included.",
+            });
+        }
+        if (url.hash !== "") {
+            throw new VisaError("E_VISA_INVALID_REDIRECT_URI", `A redirect URI must carry no fragment: ${uri}`);
+        }
+        if (uri.includes("*")) {
+            throw new VisaError("E_VISA_INVALID_REDIRECT_URI", `Wildcards are not matched, so this would never accept anything: ${uri}`);
+        }
+    }
+}
+//# sourceMappingURL=VisaManager.js.map

package/dist/VisaManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VisaManager.js","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGN,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EAEnB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEN,eAAe,EACf,kBAAkB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAqB,KAAK,EAAE,MAAM,YAAY,CAAC;AA2BtD,MAAM,OAAO,WAAW;IACd,OAAO,CAAa;IAE7B,YAAY,MAAkB;QAC7B,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACA,qEAAqE;QACrE,yDAAyD;QACzD,qEAAqE;QACrE,yBAAyB;QACzB,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAW;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACvE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,uBAAuB,EAAE,MAAM;YAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,kEAAkE,EAClE;gBACC,IAAI,EAAE,gEAAgE;aACtE,CACD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACd,OAA6B,EAC7B,MAA0B;QAE1B,IAAI,SAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,SAAS,GAAG,MAAM,4BAA4B,CAC7C,OAAO,EACP,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBACjC,4DAA4D;gBAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAClD,OAAO;oBACN,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;iBAC7C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CACnD,MAAM,EACN,SAAS,CAAC,MAAM,CAAC,EAAE,CACnB,CAAC;QACF,MAAM,OAAO,GACZ,OAAO,KAAK,IAAI;YAChB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;QAC5C,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACV,SAA2B,EAC3B,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,MAAM;YACN,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;YAC7B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,GAAG;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACxC,SAAS,EACT,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,EACZ,GAAG,CACH,CAAC;QACF,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,SAA2B;QAC/B,OAAO,aAAa,CACnB,SAAS,CAAC,WAAW,EACrB,IAAI,UAAU,CAAC,eAAe,EAAE,+BAA+B,CAAC,EAChE,SAAS,CAAC,KAAK,CACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CACV,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,UAAU,CACf,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,MAAM,CACX,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,MAAM,CACX,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,sEAAsE;IACtE,eAAe,CAAC,KAGf;QACA,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,OAA6B;QAClD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACtC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC;QACT,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,IAAI,CAAC;IACT,CAAC;CACD;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAc;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,6EAA6E,EAC7E,EAAE,IAAI,EAAE,+DAA+D,EAAE,CACzE,CAAC;IACH,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,+BAA+B,MAAM,EAAE,EACvC,EAAE,IAAI,EAAE,wDAAwD,EAAE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC/D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,qDAAqD,MAAM,EAAE,CAC7D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,2DAA2D,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,2CAA2C,CAC3C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE,cAAc,GAAG,EAAE,EAAE;gBACvE,IAAI,EAAE,sDAAsD;aAC5D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,0CAA0C,GAAG,EAAE,CAC/C,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,mEAAmE,GAAG,EAAE,CACxE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/VisaProvider.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Wires `config/visa.ts` into the container, and mounts the endpoints that
+ * need no human.
+ *
+ * `/token`, `/revoke` and `/introspect` are machine-to-machine: the spec says
+ * exactly what goes in and what comes out, so the provider owns them.
+ *
+ * `/authorize` is NOT mounted, and that is deliberate rather than unfinished.
+ * It needs two things visa has no opinion about: who is signed in — warden's
+ * business — and what a consent screen looks like, which is the application's.
+ * A route that guessed either would be wrong in a way that is hard to notice:
+ * a server that shows no consent screen grants silently, and one that assumes
+ * a session shape signs the wrong user in. `visa.authorize()` gives you the
+ * decision; the page around it is yours. The README shows the ten lines.
+ *
+ * Duck-typed throughout: visa must not import its host's HTTP types.
+ */
+import "./augmentations.js";
+interface VisaContainer {
+    singleton(token: unknown, factory: () => unknown): void;
+    resolve<T = unknown>(token: unknown): Promise<T>;
+    has(token: unknown): boolean;
+}
+interface VisaConfigStore {
+    get<T = unknown>(key: string): T | undefined;
+}
+export interface VisaAppContext {
+    container: VisaContainer;
+    config: VisaConfigStore;
+}
+export default class VisaProvider {
+    #private;
+    protected app: VisaAppContext;
+    constructor(app: VisaAppContext);
+    register(): void;
+    boot(): Promise<void>;
+    start(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=VisaProvider.d.ts.map

package/dist/VisaProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"VisaProvider.d.ts","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,oBAAoB,CAAC;AAM5B,UAAU,aAAa;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CAC7B;AACD,UAAU,eAAe;IACxB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AACD,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;CACxB;AAqBD,MAAM,CAAC,OAAO,OAAO,YAAY;;IAGpB,SAAS,CAAC,GAAG,EAAE,cAAc;gBAAnB,GAAG,EAAE,cAAc;IAEzC,QAAQ,IAAI,IAAI;IAiBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA6EtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CA8B/B"}