@c9up/visa 0.1.0

package/dist/clients.js

@@ -0,0 +1,177 @@
+/**
+ * Who is asking, and are they allowed to ask that.
+ *
+ * Three checks live here and each one closes a known attack: the redirect URI
+ * comparison (an open redirect on the client's domain turns into a stolen
+ * code), the client authentication (a leaked client_id is not a credential),
+ * and the scope narrowing (a client must not be able to grant itself more
+ * than it was registered for).
+ */
+import { secretMatches } from "./crypto.js";
+import { OAuthError } from "./errors.js";
+/**
+ * Does this redirect URI match one the client registered?
+ *
+ * EXACT string comparison, as OAuth 2.1 §2.3.1 requires — with the single
+ * exception it names: a loopback redirect may differ in its port, because a
+ * native app cannot know in advance which port the OS will hand it.
+ *
+ * No prefix matching, no wildcard, no "same origin is close enough": every
+ * one of those has a published attack where the code lands on a URL the
+ * attacker controls.
+ */
+export function redirectUriMatches(candidate, registered) {
+    if (registered.includes(candidate))
+        return true;
+    let url;
+    try {
+        url = new URL(candidate);
+    }
+    catch {
+        return false;
+    }
+    if (!isLoopback(url.hostname))
+        return false;
+    return registered.some((entry) => {
+        let known;
+        try {
+            known = new URL(entry);
+        }
+        catch {
+            return false;
+        }
+        if (!isLoopback(known.hostname))
+            return false;
+        // Everything but the port has to be identical.
+        return (known.protocol === url.protocol &&
+            known.hostname === url.hostname &&
+            known.pathname === url.pathname &&
+            known.search === url.search);
+    });
+}
+function isLoopback(hostname) {
+    return hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+}
+/**
+ * Read `client_id` / `client_secret` out of a request.
+ *
+ * A client MUST NOT use more than one authentication method in a single
+ * request (§2.4): sending both Basic and body credentials is a sign of a
+ * confused proxy or of an attempt to have one of them ignored, so it is
+ * refused rather than resolved by precedence.
+ */
+export function readCredentials(input) {
+    const basic = parseBasic(input.authorization);
+    const bodyId = stringOrUndefined(input.body.client_id);
+    const bodySecret = stringOrUndefined(input.body.client_secret);
+    if (basic !== undefined && bodySecret !== undefined) {
+        throw new OAuthError("invalid_request", "More than one client authentication method was used.");
+    }
+    if (basic !== undefined) {
+        // A body client_id that disagrees with the header is not a mismatch to
+        // resolve — it is two different claims about who is asking.
+        if (bodyId !== undefined && bodyId !== basic.clientId) {
+            throw new OAuthError("invalid_request", "The client_id in the body does not match the one authenticated.");
+        }
+        return basic;
+    }
+    return {
+        clientId: bodyId,
+        ...(bodySecret === undefined
+            ? { method: "none" }
+            : { clientSecret: bodySecret, method: "client_secret_post" }),
+    };
+}
+function parseBasic(header) {
+    if (header === undefined)
+        return undefined;
+    const [scheme, encoded] = header.split(" ");
+    if (scheme?.toLowerCase() !== "basic" || encoded === undefined) {
+        return undefined;
+    }
+    const decoded = Buffer.from(encoded, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator === -1) {
+        throw new OAuthError("invalid_client", "Malformed Basic credentials.");
+    }
+    // RFC 6749 §2.3.1 form-encodes both halves before base64. A malformed
+    // escape throws `URIError`, which would leave the endpoint answering 500
+    // to anything that sends `Basic %zz` — an unauthenticated caller choosing
+    // the failure mode.
+    try {
+        return {
+            clientId: decodeURIComponent(decoded.slice(0, separator)),
+            clientSecret: decodeURIComponent(decoded.slice(separator + 1)),
+            method: "client_secret_basic",
+        };
+    }
+    catch {
+        throw new OAuthError("invalid_client", "Malformed Basic credentials.");
+    }
+}
+function stringOrUndefined(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+/**
+ * Authenticate a client for the token endpoint.
+ *
+ * Every failure answers `invalid_client` with no detail — "no such client",
+ * "wrong secret" and "that client has no secret" are the same sentence to the
+ * caller, because telling them apart is how a client list gets enumerated.
+ */
+export async function authenticateClient(credentials, load) {
+    if (credentials.clientId === undefined) {
+        throw new OAuthError("invalid_client", "Client authentication failed.");
+    }
+    const client = await load(credentials.clientId);
+    if (client === null) {
+        throw new OAuthError("invalid_client", "Client authentication failed.");
+    }
+    // The registered method is the only one accepted. Checked before the
+    // secret so a client cannot pick the weaker of two paths.
+    if (credentials.method !== undefined &&
+        credentials.method !== client.tokenEndpointAuthMethod) {
+        throw new OAuthError("invalid_client", "Client authentication failed.");
+    }
+    if (client.tokenEndpointAuthMethod === "none") {
+        // A public client authenticates by not authenticating. Accepting a
+        // secret here would let one be registered as public and used as
+        // confidential, which is a downgrade the client chooses.
+        if (credentials.clientSecret !== undefined) {
+            throw new OAuthError("invalid_client", "Client authentication failed.");
+        }
+        return client;
+    }
+    if (credentials.clientSecret === undefined ||
+        client.secretHash === undefined ||
+        !secretMatches(credentials.clientSecret, client.secretHash)) {
+        throw new OAuthError("invalid_client", "Client authentication failed.");
+    }
+    return client;
+}
+/** Is this grant one the client was registered for? */
+export function assertGrantAllowed(client, grant) {
+    if (client.grantTypes.includes(grant))
+        return;
+    throw new OAuthError("unauthorized_client", `This client may not use the ${grant} grant.`);
+}
+/**
+ * Narrow a requested scope against what the client may ever have.
+ *
+ * Absent, the request gets the client's registered set — never "everything".
+ * A scope the client was not registered for is refused rather than dropped:
+ * silently granting less than asked is how a client ends up believing it has
+ * a permission it does not.
+ */
+export function resolveScopes(requested, client) {
+    if (requested === undefined || requested.trim() === "") {
+        return [...client.scopes];
+    }
+    const asked = requested.split(/\s+/).filter((scope) => scope !== "");
+    const unknown = asked.filter((scope) => !client.scopes.includes(scope));
+    if (unknown.length > 0) {
+        throw new OAuthError("invalid_scope", `Not registered for: ${unknown.join(" ")}`);
+    }
+    return asked;
+}
+//# sourceMappingURL=clients.js.map

package/dist/clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CACjC,SAAiB,EACjB,UAA6B;IAE7B,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,+CAA+C;QAC/C,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC;AAC/E,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAG/B;IACA,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE/D,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,sDAAsD,CACtD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,iEAAiE,CACjE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM;QAChB,GAAG,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE;YAC7B,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,oBAA6B,EAAE,CAAC;KACvE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,oBAAoB;IACpB,IAAI,CAAC;QACJ,OAAO;YACN,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACzD,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAC9D,MAAM,EAAE,qBAAqB;SAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,WAA8B,EAC9B,IAA4C;IAE5C,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,qEAAqE;IACrE,0DAA0D;IAC1D,IACC,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,uBAAuB,EACpD,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,mEAAmE;QACnE,gEAAgE;QAChE,yDAAyD;QACzD,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IACC,WAAW,CAAC,YAAY,KAAK,SAAS;QACtC,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,CAAC,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAC1D,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAgB;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9C,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,+BAA+B,KAAK,SAAS,CAC7C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC5B,SAA6B,EAC7B,MAAc;IAEd,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC1C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `config/visa.ts` — the Adonis shape: a `defineConfig` that returns what the
+ * provider reads out of the config store.
+ */
+import type { VisaStore } from "./store.js";
+export interface VisaConfigInput {
+    /**
+     * The public URL this server answers on — `https://auth.example.com`.
+     *
+     * It is the `iss` every token is bound to, so it is not cosmetic: a client
+     * that validates the issuer rejects tokens minted under a different one.
+     */
+    issuer: string;
+    /** Where clients, codes, tokens and consents live. */
+    store: VisaStore;
+    /** Seconds. Default 3600 — an hour is long enough to be useful, short
+     * enough that a leaked token is not a standing invitation. */
+    accessTokenTtlSeconds?: number;
+    /** Seconds. Default 30 days. */
+    refreshTokenTtlSeconds?: number;
+    /** Seconds. Default 30 — a code is exchanged in milliseconds. */
+    codeTtlSeconds?: number;
+    issueRefreshTokens?: boolean;
+    /** See `AuthorizeOptions.allowPlainChallenge` — off, and stay off. */
+    allowPlainChallenge?: boolean;
+    /** Where the endpoints are mounted. Default `/oauth`. */
+    prefix?: string;
+}
+export declare function defineConfig(config: VisaConfigInput): VisaConfigInput;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,SAAS,CAAC;IACjB;kEAC8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE"}

package/dist/config.js

@@ -0,0 +1,8 @@
+/**
+ * `config/visa.ts` — the Adonis shape: a `defineConfig` that returns what the
+ * provider reads out of the config store.
+ */
+export function defineConfig(config) {
+    return config;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4BH,MAAM,UAAU,YAAY,CAAC,MAAuB;IACnD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/configure.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `ream configure @c9up/visa` — wire the server in one command.
+ *
+ * The provider alone is not enough: it reads `config/visa.ts` and refuses to
+ * boot without one, on purpose — an authorization server that invented its own
+ * issuer would mint tokens nobody can validate.
+ *
+ * What it does NOT write is the store and the `/authorize` route. Both are
+ * decisions rather than boilerplate, and a generated guess at either is wrong
+ * in a way that only shows up in production: a memory store loses every
+ * session on deploy, and a consent screen nobody wrote grants silently.
+ */
+interface Codemods {
+    addProvider(importPath: string): Promise<void>;
+    addEnvVars(vars: Record<string, string>): Promise<void>;
+    writeFile(filePath: string, content: string, options?: {
+        force?: boolean;
+    }): Promise<void>;
+    makeUsingStub(stubsRoot: string, stubPath: string, state?: Record<string, string | number | boolean>, options?: {
+        force?: boolean;
+    }): Promise<{
+        path: string;
+        contents: string;
+    }>;
+}
+export declare function configure(codemods: Codemods): Promise<void>;
+export {};
+//# sourceMappingURL=configure.d.ts.map

package/dist/configure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,UAAU,QAAQ;IACjB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,SAAS,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/C;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjE"}

package/dist/configure.js

@@ -0,0 +1,24 @@
+/**
+ * `ream configure @c9up/visa` — wire the server in one command.
+ *
+ * The provider alone is not enough: it reads `config/visa.ts` and refuses to
+ * boot without one, on purpose — an authorization server that invented its own
+ * issuer would mint tokens nobody can validate.
+ *
+ * What it does NOT write is the store and the `/authorize` route. Both are
+ * decisions rather than boilerplate, and a generated guess at either is wrong
+ * in a way that only shows up in production: a memory store loses every
+ * session on deploy, and a consent screen nobody wrote grants silently.
+ */
+import { stubsRoot } from "./stubs.js";
+export async function configure(codemods) {
+    // The config below reads this, so it is declared here. Writing the file
+    // without it leaves an application whose config asks the environment for
+    // something nothing ever put there.
+    await codemods.addEnvVars({
+        VISA_ISSUER: "http://localhost:3333",
+    });
+    await codemods.addProvider("@c9up/visa/provider");
+    await codemods.makeUsingStub(stubsRoot, "config/visa.stub");
+}
+//# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAkBvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IACjD,wEAAwE;IACxE,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzB,WAAW,EAAE,uBAAuB;KACpC,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAC7D,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Every secret in this package goes through here.
+ *
+ * `node:crypto` only — a dependency in the path that mints and compares
+ * credentials is a dependency that can replace them.
+ */
+/**
+ * 256 bits of randomness, base64url.
+ *
+ * The length is not a preference: a token is guessed offline, so its entropy
+ * is the only thing standing between an attacker and someone's session.
+ */
+export declare function randomToken(bytes?: number): string;
+/** SHA-256, base64url — the shape PKCE's `S256` needs (RFC 7636 §4.2). */
+export declare function sha256(value: string): string;
+/**
+ * What goes in the store for a token or a client secret.
+ *
+ * SHA-256 with no salt and no stretching, DELIBERATELY: these are values this
+ * package generated with 256 bits of entropy, so there is no dictionary to run
+ * and nothing for a slow hash to buy. Stretching here would only make every
+ * token lookup expensive — and a token lookup happens on every single request.
+ * A USER password is the opposite case and belongs in sigil.
+ */
+export declare function hashSecret(secret: string): string;
+/**
+ * Compare in constant time.
+ *
+ * A `===` on a secret leaks its prefix through timing, one byte at a time,
+ * which is enough to reconstruct it remotely given patience.
+ */
+export declare function secretMatches(candidate: string, stored: string): boolean;
+/** The same comparison for two already-hashed values. */
+export declare function hashMatches(a: string, b: string): boolean;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAE9C;AAED,0EAA0E;AAC1E,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOxE;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKzD"}

package/dist/crypto.js

@@ -0,0 +1,56 @@
+/**
+ * Every secret in this package goes through here.
+ *
+ * `node:crypto` only — a dependency in the path that mints and compares
+ * credentials is a dependency that can replace them.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+/**
+ * 256 bits of randomness, base64url.
+ *
+ * The length is not a preference: a token is guessed offline, so its entropy
+ * is the only thing standing between an attacker and someone's session.
+ */
+export function randomToken(bytes = 32) {
+    return randomBytes(bytes).toString("base64url");
+}
+/** SHA-256, base64url — the shape PKCE's `S256` needs (RFC 7636 §4.2). */
+export function sha256(value) {
+    return createHash("sha256").update(value).digest("base64url");
+}
+/**
+ * What goes in the store for a token or a client secret.
+ *
+ * SHA-256 with no salt and no stretching, DELIBERATELY: these are values this
+ * package generated with 256 bits of entropy, so there is no dictionary to run
+ * and nothing for a slow hash to buy. Stretching here would only make every
+ * token lookup expensive — and a token lookup happens on every single request.
+ * A USER password is the opposite case and belongs in sigil.
+ */
+export function hashSecret(secret) {
+    return sha256(secret);
+}
+/**
+ * Compare in constant time.
+ *
+ * A `===` on a secret leaks its prefix through timing, one byte at a time,
+ * which is enough to reconstruct it remotely given patience.
+ */
+export function secretMatches(candidate, stored) {
+    const a = Buffer.from(hashSecret(candidate));
+    const b = Buffer.from(stored);
+    // Different lengths cannot be compared in constant time by
+    // `timingSafeEqual`, and a length mismatch is not a secret anyway.
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+/** The same comparison for two already-hashed values. */
+export function hashMatches(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACrC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,MAAM,CAAC,KAAa;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAc;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,2DAA2D;IAC3D,mEAAmE;IACnE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Two kinds of failure, and they are not interchangeable.
+ *
+ * A PROTOCOL error is part of the OAuth response: the spec names the string
+ * (`invalid_grant`, `invalid_client`…), the client reads it, and leaking no
+ * more than that string is deliberate — "which of the four checks failed" is
+ * information an attacker uses to enumerate.
+ *
+ * A FRAMEWORK error is a mistake in the application: a store that does not
+ * answer, a client registered without a redirect URI. Those carry a
+ * `E_VISA_*` code and a message meant for a developer, never for a response
+ * body.
+ */
+/** Error codes the authorization endpoint may return (OAuth 2.1 §4.1.2.1). */
+export type AuthorizationErrorCode = "invalid_request" | "unauthorized_client" | "access_denied" | "unsupported_response_type" | "invalid_scope" | "server_error" | "temporarily_unavailable";
+/** Error codes the token endpoint may return (OAuth 2.1 §4.1.4). */
+export type TokenErrorCode = "invalid_request" | "invalid_client" | "invalid_grant" | "unauthorized_client" | "unsupported_grant_type" | "invalid_scope";
+export type ProtocolErrorCode = AuthorizationErrorCode | TokenErrorCode;
+/**
+ * A failure the client is told about, in the words the spec chose.
+ *
+ * `description` is optional and OPTIONAL on purpose: it goes on the wire, so
+ * it says what the client can act on and never why a check failed internally.
+ */
+export declare class OAuthError extends Error {
+    readonly code: ProtocolErrorCode;
+    readonly description: string | undefined;
+    /** 401 for `invalid_client`, 400 for everything else (§4.1.4). */
+    readonly status: number;
+    constructor(code: ProtocolErrorCode, description?: string, options?: {
+        status?: number;
+    });
+    /** The body, exactly as §4.1.4 shapes it. */
+    toResponse(): {
+        error: ProtocolErrorCode;
+        error_description?: string;
+    };
+}
+/** A mistake in the application, addressed to whoever wired it. */
+export declare class VisaError extends Error {
+    readonly code: string;
+    readonly hint: string | undefined;
+    constructor(code: string, message: string, options?: {
+        hint?: string;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,sBAAsB,GAC/B,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,2BAA2B,GAC3B,eAAe,GACf,cAAc,GACd,yBAAyB,CAAC;AAE7B,oEAAoE;AACpE,MAAM,MAAM,cAAc,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,CAAC;AAEnB,MAAM,MAAM,iBAAiB,GAAG,sBAAsB,GAAG,cAAc,CAAC;AAExE;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAGvB,IAAI,EAAE,iBAAiB,EACvB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IASlC,6CAA6C;IAC7C,UAAU,IAAI;QAAE,KAAK,EAAE,iBAAiB,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE;CAKtE;AAED,mEAAmE;AACnE,qBAAa,SAAU,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;gBAEtB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;CAM1E"}

package/dist/errors.js

@@ -0,0 +1,50 @@
+/**
+ * Two kinds of failure, and they are not interchangeable.
+ *
+ * A PROTOCOL error is part of the OAuth response: the spec names the string
+ * (`invalid_grant`, `invalid_client`…), the client reads it, and leaking no
+ * more than that string is deliberate — "which of the four checks failed" is
+ * information an attacker uses to enumerate.
+ *
+ * A FRAMEWORK error is a mistake in the application: a store that does not
+ * answer, a client registered without a redirect URI. Those carry a
+ * `E_VISA_*` code and a message meant for a developer, never for a response
+ * body.
+ */
+/**
+ * A failure the client is told about, in the words the spec chose.
+ *
+ * `description` is optional and OPTIONAL on purpose: it goes on the wire, so
+ * it says what the client can act on and never why a check failed internally.
+ */
+export class OAuthError extends Error {
+    code;
+    description;
+    /** 401 for `invalid_client`, 400 for everything else (§4.1.4). */
+    status;
+    constructor(code, description, options = {}) {
+        super(description === undefined ? code : `${code}: ${description}`);
+        this.name = "OAuthError";
+        this.code = code;
+        this.description = description;
+        this.status = options.status ?? (code === "invalid_client" ? 401 : 400);
+    }
+    /** The body, exactly as §4.1.4 shapes it. */
+    toResponse() {
+        return this.description === undefined
+            ? { error: this.code }
+            : { error: this.code, error_description: this.description };
+    }
+}
+/** A mistake in the application, addressed to whoever wired it. */
+export class VisaError extends Error {
+    code;
+    hint;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = "VisaError";
+        this.code = code;
+        this.hint = options.hint;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAuBH;;;;;GAKG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC3B,IAAI,CAAoB;IACxB,WAAW,CAAqB;IACzC,kEAAkE;IACzD,MAAM,CAAS;IAExB,YACC,IAAuB,EACvB,WAAoB,EACpB,UAA+B,EAAE;QAEjC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,WAAW,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,6CAA6C;IAC7C,UAAU;QACT,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;YACtB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;CACD;AAED,mEAAmE;AACnE,MAAM,OAAO,SAAU,SAAQ,KAAK;IAC1B,IAAI,CAAS;IACb,IAAI,CAAqB;IAElC,YAAY,IAAY,EAAE,OAAe,EAAE,UAA6B,EAAE;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,CAAC;CACD"}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Visa — an OAuth 2.1 authorization server.
+ *
+ * It issues tokens to OTHER applications on a user's behalf. Knowing who that
+ * user is stays warden's job; visa never authenticates anyone, it only asks
+ * the application who is signed in.
+ *
+ * Nothing here depends on a transport or on a database: the manager takes
+ * values and returns values, the store is a contract. The HTTP endpoints are
+ * in the provider.
+ */
+import "./augmentations.js";
+export { type AuthorizationRequest, type AuthorizeOptions, errorRedirect, issueAuthorizationCode, successRedirect, UnredirectableError, type ValidatedRequest, validateAuthorizationRequest, } from "./authorize.js";
+export { assertGrantAllowed, authenticateClient, type ClientCredentials, readCredentials, redirectUriMatches, resolveScopes, } from "./clients.js";
+export { defineConfig, type VisaConfigInput } from "./config.js";
+export { hashSecret, randomToken, secretMatches, sha256 } from "./crypto.js";
+export { type AuthorizationErrorCode, OAuthError, type ProtocolErrorCode, type TokenErrorCode, VisaError, } from "./errors.js";
+export { introspect, revoke, verifyAccessToken } from "./introspect.js";
+export { clearVisa, default as visa, getVisa, setVisa, } from "./services/main.js";
+export type { VisaStore } from "./store.js";
+export { MemoryStore } from "./stores/memory.js";
+export { type TokenOptions, type TokenRequest, token } from "./token.js";
+export type { AccessToken, AuthorizationCode, Client, ClientAuthMethod, Consent, GrantType, IntrospectionResponse, RefreshToken, TokenResponse, } from "./types.js";
+export { type AuthorizationOutcome, type VisaConfig, VisaManager, } from "./VisaManager.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,eAAe,EACf,kBAAkB,EAClB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EACN,KAAK,sBAAsB,EAC3B,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,SAAS,EACT,OAAO,IAAI,IAAI,EACf,OAAO,EACP,OAAO,GACP,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACzE,YAAY,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,qBAAqB,EACrB,YAAY,EACZ,aAAa,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,WAAW,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,23 @@
+/**
+ * Visa — an OAuth 2.1 authorization server.
+ *
+ * It issues tokens to OTHER applications on a user's behalf. Knowing who that
+ * user is stays warden's job; visa never authenticates anyone, it only asks
+ * the application who is signed in.
+ *
+ * Nothing here depends on a transport or on a database: the manager takes
+ * values and returns values, the store is a contract. The HTTP endpoints are
+ * in the provider.
+ */
+import "./augmentations.js";
+export { errorRedirect, issueAuthorizationCode, successRedirect, UnredirectableError, validateAuthorizationRequest, } from "./authorize.js";
+export { assertGrantAllowed, authenticateClient, readCredentials, redirectUriMatches, resolveScopes, } from "./clients.js";
+export { defineConfig } from "./config.js";
+export { hashSecret, randomToken, secretMatches, sha256 } from "./crypto.js";
+export { OAuthError, VisaError, } from "./errors.js";
+export { introspect, revoke, verifyAccessToken } from "./introspect.js";
+export { clearVisa, default as visa, getVisa, setVisa, } from "./services/main.js";
+export { MemoryStore } from "./stores/memory.js";
+export { token } from "./token.js";
+export { VisaManager, } from "./VisaManager.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAGN,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EAEnB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAElB,eAAe,EACf,kBAAkB,EAClB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAwB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAEN,UAAU,EAGV,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,SAAS,EACT,OAAO,IAAI,IAAI,EACf,OAAO,EACP,OAAO,GACP,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAwC,KAAK,EAAE,MAAM,YAAY,CAAC;AAYzE,OAAO,EAGN,WAAW,GACX,MAAM,kBAAkB,CAAC"}

package/dist/introspect.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Revocation (RFC 7009) and introspection (RFC 7662).
+ *
+ * Both answer the same way to a token that is unknown, expired, revoked or
+ * belongs to someone else — revocation with 200, introspection with
+ * `{ active: false }`. That uniformity IS the security property: a different
+ * answer per case turns either endpoint into an oracle for guessing tokens.
+ */
+import { type ClientCredentials } from "./clients.js";
+import type { VisaStore } from "./store.js";
+import type { IntrospectionResponse } from "./types.js";
+export declare function introspect(request: Record<string, unknown>, credentials: ClientCredentials, store: VisaStore, now?: Date, issuer?: string): Promise<IntrospectionResponse>;
+/**
+ * Revoke a token. Answers nothing, always successfully (RFC 7009 §2.2).
+ *
+ * Revoking a REFRESH token takes its whole family with it, access tokens
+ * included: "sign me out" has to mean the session is over, not that one of
+ * its two credentials was retired.
+ */
+export declare function revoke(request: Record<string, unknown>, credentials: ClientCredentials, store: VisaStore, now?: Date): Promise<void>;
+/**
+ * Is this bearer token good, and for what?
+ *
+ * What a resource server calls on every request — so it reads the store
+ * directly instead of going through introspection's client authentication.
+ */
+export declare function verifyAccessToken(presented: string, store: VisaStore, now?: Date): Promise<{
+    clientId: string;
+    userId?: string;
+    scopes: string[];
+} | null>;
+//# sourceMappingURL=introspect.d.ts.map

package/dist/introspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.d.ts","sourceRoot":"","sources":["../src/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAG1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAKxD,wBAAsB,UAAU,CAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,SAAS,EAChB,GAAG,GAAE,IAAiB,EACtB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,CAAC,CAsDhC;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,SAAS,EAChB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,EAChB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CASzE"}