@c9up/visa 0.1.1 → 0.1.3

package/dist/VisaManager.d.ts

@@ -8,13 +8,17 @@
 import { type AuthorizationRequest, type AuthorizeOptions, type ValidatedRequest } from "./authorize.js";
 import { type ClientCredentials } from "./clients.js";
 import { OAuthError } from "./errors.js";
+import { verifyAccessToken } from "./introspect.js";
+import { type ClientRegistrationRequest, type ClientRegistrationResponse, type RegistrationOptions } from "./register.js";
 import type { VisaStore } from "./store.js";
 import { type TokenOptions } from "./token.js";
-import type { Client, ClientAuthMethod, GrantType, IntrospectionResponse, TokenResponse } from "./types.js";
+import type { AuthorizedApplication, Client, ClientAuthMethod, GrantType, IntrospectionResponse, TokenResponse } from "./types.js";
 export interface VisaConfig extends AuthorizeOptions, TokenOptions {
     /** Where this server lives — `https://auth.example.com`. */
     issuer: string;
     store: VisaStore;
+    /** Whether clients may register themselves, and on what terms (RFC 7591). */
+    registration?: RegistrationOptions;
 }
 /** What `authorize()` decided. */
 export type AuthorizationOutcome = 
@@ -56,10 +60,19 @@ export declare class VisaManager {
         scopes?: string[];
         tokenEndpointAuthMethod?: ClientAuthMethod;
         trusted?: boolean;
+        /** When the issued secret stops working. Omitted means it does not. */
+        secretExpiresAt?: Date;
     }): Promise<{
         client: Client;
         secret?: string;
     }>;
+    /**
+     * A client registering itself (RFC 7591).
+     *
+     * Refused unless the application turned registration on. What comes back is
+     * the 201 body, secret included — the one time it exists.
+     */
+    register(request: ClientRegistrationRequest, presentedToken?: string, now?: Date): Promise<ClientRegistrationResponse>;
     /**
      * Step one: check the request, and decide what happens to the user.
      *
@@ -79,12 +92,34 @@ export declare class VisaManager {
     token(body: Record<string, unknown>, credentials: ClientCredentials, now?: Date): Promise<TokenResponse>;
     introspect(body: Record<string, unknown>, credentials: ClientCredentials, now?: Date): Promise<IntrospectionResponse>;
     revoke(body: Record<string, unknown>, credentials: ClientCredentials, now?: Date): Promise<void>;
-    /** What a resource server calls on every request. */
-    verify(presented: string, now?: Date): Promise<{
-        clientId: string;
-        userId?: string;
-        scopes: string[];
-    } | null>;
+    /**
+     * What a resource server calls on every request.
+     *
+     * `resource` is this server's own identifier (RFC 8707): given, a token
+     * minted for a different one is refused here rather than honoured.
+     */
+    verify(presented: string, now?: Date, resource?: string): ReturnType<typeof verifyAccessToken>;
+    /**
+     * Every application this user has authorised.
+     *
+     * What a "connected applications" screen renders. Includes an application
+     * whose tokens have all expired: "last used" matters most when nothing is
+     * live any more, and hiding it would tell someone an application never
+     * touched their data when it did.
+     */
+    listAuthorizations(userId: string, now?: Date): Promise<AuthorizedApplication[]>;
+    /**
+     * End one application's access for one user.
+     *
+     * Tokens first, consent second, and deliberately in that order: someone
+     * revoking in a hurry wants the sessions dead, and a failure half-way
+     * through must not leave an application still holding live tokens with the
+     * grant already forgotten.
+     *
+     * Both kinds of token go — revoking only the refresh half would leave the
+     * access token it already bought alive for its full lifetime.
+     */
+    revokeAuthorization(userId: string, clientId: string, now?: Date): Promise<void>;
     /** Read credentials out of a request, both places the spec allows. */
     readCredentials(input: {
         authorization?: string;

package/dist/VisaManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"VisaManager.d.ts","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAKrB,KAAK,gBAAgB,EAErB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EACX,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,aAAa,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAW,SAAQ,gBAAgB,EAAE,YAAY;IACjE,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,MAAM,oBAAoB;AAC/B,0BAA0B;AACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC,2EAA2E;GACzE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE;AAChD;;;GAGG;GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAExC,qBAAa,WAAW;;gBAGX,MAAM,EAAE,UAAU;IAO9B,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,KAAK,IAAI,SAAS,CAErB;IAED;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;QAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgChD;;;;;OAKG;IACG,SAAS,CACd,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,oBAAoB,CAAC;IA2ChC;;;;;OAKG;IACG,KAAK,CACV,SAAS,EAAE,gBAAgB,EAC3B,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC;IAiBlB,wBAAwB;IACxB,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM;IAQnC,KAAK,CACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,aAAa,CAAC;IAInB,UAAU,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,qBAAqB,CAAC;IAI3B,MAAM,CACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC;IAIhB,qDAAqD;IAC/C,MAAM,CACX,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAI1E,sEAAsE;IACtE,eAAe,CAAC,KAAK,EAAE;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9B,GAAG,iBAAiB;CAsBrB"}
+{"version":3,"file":"VisaManager.d.ts","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAKrB,KAAK,gBAAgB,EAErB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAC;AACpD,OAAO,EAAsB,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EAIxB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EACX,qBAAqB,EACrB,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,aAAa,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAW,SAAQ,gBAAgB,EAAE,YAAY;IACjE,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAED,kCAAkC;AAClC,MAAM,MAAM,oBAAoB;AAC/B,0BAA0B;AACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC,2EAA2E;GACzE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE;AAChD;;;GAGG;GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AAExC,qBAAa,WAAW;;gBAGX,MAAM,EAAE,UAAU;IAO9B,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,KAAK,IAAI,SAAS,CAErB;IAED;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;QAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,uEAAuE;QACvE,eAAe,CAAC,EAAE,IAAI,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqChD;;;;;OAKG;IACG,QAAQ,CACb,OAAO,EAAE,yBAAyB,EAClC,cAAc,CAAC,EAAE,MAAM,EACvB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,0BAA0B,CAAC;IAqBtC;;;;;OAKG;IACG,SAAS,CACd,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,oBAAoB,CAAC;IA2ChC;;;;;OAKG;IACG,KAAK,CACV,SAAS,EAAE,gBAAgB,EAC3B,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC;IAiBlB,wBAAwB;IACxB,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM;IAQnC,KAAK,CACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,aAAa,CAAC;IAInB,UAAU,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,qBAAqB,CAAC;IAI3B,MAAM,CACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;OAKG;IACG,MAAM,CACX,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,IAAiB,EACtB,QAAQ,CAAC,EAAE,MAAM,GACf,UAAU,CAAC,OAAO,iBAAiB,CAAC;IAIvC;;;;;;;OAOG;IACG,kBAAkB,CACvB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAiCnC;;;;;;;;;;OAUG;IACG,mBAAmB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,IAAI,CAAC;IAKhB,sEAAsE;IACtE,eAAe,CAAC,KAAK,EAAE;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9B,GAAG,iBAAiB;CAsBrB"}

package/dist/VisaManager.js

@@ -10,6 +10,7 @@ import { readCredentials, redirectUriMatches, } from "./clients.js";
 import { hashSecret, randomToken } from "./crypto.js";
 import { OAuthError, VisaError } from "./errors.js";
 import { introspect, revoke, verifyAccessToken } from "./introspect.js";
+import { registrationResponse, secretExpiryFor, validateRegistration, } from "./register.js";
 import { token } from "./token.js";
 export class VisaManager {
     #config;
@@ -49,6 +50,11 @@ export class VisaManager {
             tokenEndpointAuthMethod: method,
             ...(input.trusted === undefined ? {} : { trusted: input.trusted }),
             ...(secret === undefined ? {} : { secretHash: hashSecret(secret) }),
+            // Only alongside a secret: an expiry on a client that has none is a
+            // date nothing would ever read.
+            ...(secret === undefined || input.secretExpiresAt === undefined
+                ? {}
+                : { secretExpiresAt: input.secretExpiresAt }),
         };
         const store = this.#config.store;
         if (!("addClient" in store) || typeof store.addClient !== "function") {
@@ -59,6 +65,32 @@ export class VisaManager {
         store.addClient(client);
         return secret === undefined ? { client } : { client, secret };
     }
+    /**
+     * A client registering itself (RFC 7591).
+     *
+     * Refused unless the application turned registration on. What comes back is
+     * the 201 body, secret included — the one time it exists.
+     */
+    async register(request, presentedToken, now = new Date()) {
+        const options = this.#config.registration ?? {};
+        const metadata = validateRegistration(request, options, presentedToken);
+        // Computed once, here: the same value is stored on the client and
+        // answered in the 201 body, so the server cannot announce an expiry it
+        // does not enforce.
+        const secretExpiresAt = secretExpiryFor(now, options.secretTtlSeconds);
+        const { client, secret } = await this.registerClient({
+            // The id is ours to choose: a client naming itself could claim one
+            // that already exists and read another application's tokens.
+            id: randomToken(),
+            name: metadata.name,
+            redirectUris: metadata.redirectUris,
+            grantTypes: metadata.grantTypes,
+            scopes: metadata.scopes,
+            tokenEndpointAuthMethod: metadata.tokenEndpointAuthMethod,
+            ...(secretExpiresAt === undefined ? {} : { secretExpiresAt }),
+        });
+        return registrationResponse(client, now, secret);
+    }
     /**
      * Step one: check the request, and decide what happens to the user.
      *
@@ -127,9 +159,63 @@ export class VisaManager {
     async revoke(body, credentials, now = new Date()) {
         return revoke(body, credentials, this.#config.store, now);
     }
-    /** What a resource server calls on every request. */
-    async verify(presented, now = new Date()) {
-        return verifyAccessToken(presented, this.#config.store, now);
+    /**
+     * What a resource server calls on every request.
+     *
+     * `resource` is this server's own identifier (RFC 8707): given, a token
+     * minted for a different one is refused here rather than honoured.
+     */
+    async verify(presented, now = new Date(), resource) {
+        return verifyAccessToken(presented, this.#config.store, now, resource);
+    }
+    /**
+     * Every application this user has authorised.
+     *
+     * What a "connected applications" screen renders. Includes an application
+     * whose tokens have all expired: "last used" matters most when nothing is
+     * live any more, and hiding it would tell someone an application never
+     * touched their data when it did.
+     */
+    async listAuthorizations(userId, now = new Date()) {
+        const store = this.#config.store;
+        const consents = await store.listConsents(userId);
+        const tokens = await store.listAccessTokens(userId);
+        return Promise.all(consents.map(async (consent) => {
+            const mine = tokens.filter((token) => token.clientId === consent.clientId);
+            const client = await store.findClient(consent.clientId);
+            const lastUsedAt = mine.reduce((latest, token) => {
+                if (token.lastUsedAt === undefined)
+                    return latest;
+                if (latest === undefined)
+                    return token.lastUsedAt;
+                return token.lastUsedAt > latest ? token.lastUsedAt : latest;
+            }, undefined);
+            return {
+                clientId: consent.clientId,
+                // A client that has since been deleted still shows, under its id:
+                // the grant is the user's and they must be able to end it.
+                name: client?.name ?? consent.clientId,
+                scopes: consent.scopes,
+                grantedAt: consent.grantedAt,
+                ...(lastUsedAt === undefined ? {} : { lastUsedAt }),
+                active: mine.some((token) => token.revokedAt === undefined && token.expiresAt > now),
+            };
+        }));
+    }
+    /**
+     * End one application's access for one user.
+     *
+     * Tokens first, consent second, and deliberately in that order: someone
+     * revoking in a hurry wants the sessions dead, and a failure half-way
+     * through must not leave an application still holding live tokens with the
+     * grant already forgotten.
+     *
+     * Both kinds of token go — revoking only the refresh half would leave the
+     * access token it already bought alive for its full lifetime.
+     */
+    async revokeAuthorization(userId, clientId, now = new Date()) {
+        await this.#config.store.revokeAccessFor(userId, clientId, now);
+        await this.#config.store.deleteConsent(userId, clientId);
     }
     /** Read credentials out of a request, both places the spec allows. */
     readCredentials(input) {

package/dist/VisaManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"VisaManager.js","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGN,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EAEnB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEN,eAAe,EACf,kBAAkB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAqB,KAAK,EAAE,MAAM,YAAY,CAAC;AA2BtD,MAAM,OAAO,WAAW;IACd,OAAO,CAAa;IAE7B,YAAY,MAAkB;QAC7B,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACA,qEAAqE;QACrE,yDAAyD;QACzD,qEAAqE;QACrE,yBAAyB;QACzB,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAW;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACvE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,uBAAuB,EAAE,MAAM;YAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,kEAAkE,EAClE;gBACC,IAAI,EAAE,gEAAgE;aACtE,CACD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACd,OAA6B,EAC7B,MAA0B;QAE1B,IAAI,SAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,SAAS,GAAG,MAAM,4BAA4B,CAC7C,OAAO,EACP,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBACjC,4DAA4D;gBAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAClD,OAAO;oBACN,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;iBAC7C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CACnD,MAAM,EACN,SAAS,CAAC,MAAM,CAAC,EAAE,CACnB,CAAC;QACF,MAAM,OAAO,GACZ,OAAO,KAAK,IAAI;YAChB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;QAC5C,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACV,SAA2B,EAC3B,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,MAAM;YACN,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;YAC7B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,GAAG;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACxC,SAAS,EACT,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,EACZ,GAAG,CACH,CAAC;QACF,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,SAA2B;QAC/B,OAAO,aAAa,CACnB,SAAS,CAAC,WAAW,EACrB,IAAI,UAAU,CAAC,eAAe,EAAE,+BAA+B,CAAC,EAChE,SAAS,CAAC,KAAK,CACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CACV,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,UAAU,CACf,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,MAAM,CACX,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,MAAM,CACX,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,sEAAsE;IACtE,eAAe,CAAC,KAGf;QACA,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,OAA6B;QAClD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACtC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC;QACT,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,IAAI,CAAC;IACT,CAAC;CACD;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAc;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,6EAA6E,EAC7E,EAAE,IAAI,EAAE,+DAA+D,EAAE,CACzE,CAAC;IACH,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,+BAA+B,MAAM,EAAE,EACvC,EAAE,IAAI,EAAE,wDAAwD,EAAE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC/D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,qDAAqD,MAAM,EAAE,CAC7D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,2DAA2D,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,2CAA2C,CAC3C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE,cAAc,GAAG,EAAE,EAAE;gBACvE,IAAI,EAAE,sDAAsD;aAC5D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,0CAA0C,GAAG,EAAE,CAC/C,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,mEAAmE,GAAG,EAAE,CACxE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"VisaManager.js","sourceRoot":"","sources":["../src/VisaManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGN,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EAEnB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEN,eAAe,EACf,kBAAkB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAIN,oBAAoB,EACpB,eAAe,EACf,oBAAoB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAqB,KAAK,EAAE,MAAM,YAAY,CAAC;AA8BtD,MAAM,OAAO,WAAW;IACd,OAAO,CAAa;IAE7B,YAAY,MAAkB;QAC7B,uEAAuE;QACvE,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,KAUpB;QACA,qEAAqE;QACrE,yDAAyD;QACzD,qEAAqE;QACrE,yBAAyB;QACzB,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAW;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACvE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,uBAAuB,EAAE,MAAM;YAC/B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,oEAAoE;YACpE,gCAAgC;YAChC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;gBAC9D,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;SAC9C,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,kEAAkE,EAClE;gBACC,IAAI,EAAE,gEAAgE;aACtE,CACD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACb,OAAkC,EAClC,cAAuB,EACvB,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QACxE,kEAAkE;QAClE,uEAAuE;QACvE,oBAAoB;QACpB,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACpD,mEAAmE;YACnE,6DAA6D;YAC7D,EAAE,EAAE,WAAW,EAAE;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;YACzD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;SAC7D,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACd,OAA6B,EAC7B,MAA0B;QAE1B,IAAI,SAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,SAAS,GAAG,MAAM,4BAA4B,CAC7C,OAAO,EACP,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBACjC,4DAA4D;gBAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAClD,OAAO;oBACN,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;iBAC7C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CACnD,MAAM,EACN,SAAS,CAAC,MAAM,CAAC,EAAE,CACnB,CAAC;QACF,MAAM,OAAO,GACZ,OAAO,KAAK,IAAI;YAChB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;QAC5C,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CACV,SAA2B,EAC3B,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,MAAM;YACN,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;YAC7B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,GAAG;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACxC,SAAS,EACT,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,EACZ,GAAG,CACH,CAAC;QACF,OAAO,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,SAA2B;QAC/B,OAAO,aAAa,CACnB,SAAS,CAAC,WAAW,EACrB,IAAI,UAAU,CAAC,eAAe,EAAE,+BAA+B,CAAC,EAChE,SAAS,CAAC,KAAK,CACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CACV,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,UAAU,CACf,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,MAAM,CACX,IAA6B,EAC7B,WAA8B,EAC9B,MAAY,IAAI,IAAI,EAAE;QAEtB,OAAO,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACX,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE,EACtB,QAAiB;QAEjB,OAAO,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACvB,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEpD,OAAO,OAAO,CAAC,GAAG,CACjB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAC9C,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;gBAClE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC;gBAClD,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,UAAU,CAAC;gBAClD,OAAO,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9D,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,OAAO;gBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,kEAAkE;gBAClE,2DAA2D;gBAC3D,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,MAAM,EAAE,IAAI,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,CACjE;aACD,CAAC;QACH,CAAC,CAAC,CACF,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,mBAAmB,CACxB,MAAc,EACd,QAAgB,EAChB,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,sEAAsE;IACtE,eAAe,CAAC,KAGf;QACA,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,OAA6B;QAClD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACtC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC;QACT,CAAC;QACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,IAAI,CAAC;IACT,CAAC;CACD;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAc;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,6EAA6E,EAC7E,EAAE,IAAI,EAAE,+DAA+D,EAAE,CACzE,CAAC;IACH,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,+BAA+B,MAAM,EAAE,EACvC,EAAE,IAAI,EAAE,wDAAwD,EAAE,CAClE,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC/D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,qDAAqD,MAAM,EAAE,CAC7D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAClB,uBAAuB,EACvB,2DAA2D,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAClB,wBAAwB,EACxB,2CAA2C,CAC3C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE,cAAc,GAAG,EAAE,EAAE;gBACvE,IAAI,EAAE,sDAAsD;aAC5D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,0CAA0C,GAAG,EAAE,CAC/C,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAClB,6BAA6B,EAC7B,mEAAmE,GAAG,EAAE,CACxE,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/VisaProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"VisaProvider.d.ts","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,oBAAoB,CAAC;AAM5B,UAAU,aAAa;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CAC7B;AACD,UAAU,eAAe;IACxB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AACD,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;CACxB;AAqBD,MAAM,CAAC,OAAO,OAAO,YAAY;;IAGpB,SAAS,CAAC,GAAG,EAAE,cAAc;gBAAnB,GAAG,EAAE,cAAc;IAEzC,QAAQ,IAAI,IAAI;IAiBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA6EtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CA8B/B"}
+{"version":3,"file":"VisaProvider.d.ts","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,oBAAoB,CAAC;AAW5B,UAAU,aAAa;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CAC7B;AACD,UAAU,eAAe;IACxB,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AACD,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;CACxB;AAqBD,MAAM,CAAC,OAAO,OAAO,YAAY;;IAGpB,SAAS,CAAC,GAAG,EAAE,cAAc;gBAAnB,GAAG,EAAE,cAAc;IAEzC,QAAQ,IAAI,IAAI;IAiBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8HtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CA8B/B"}

package/dist/VisaProvider.js

@@ -17,6 +17,7 @@
  */
 import "./augmentations.js";
 import { OAuthError } from "./errors.js";
+import { PROTECTED_RESOURCE_PATH, protectedResourceMetadata, protectedResourceMetadataUrl, } from "./protectedResource.js";
 import { clearVisa, getVisa, setVisa } from "./services/main.js";
 import { VisaManager } from "./VisaManager.js";
 export default class VisaProvider {
@@ -89,6 +90,23 @@ export default class VisaProvider {
                 return null;
             });
         });
+        // RFC 7591 — a client that registers itself. Mounted only when the
+        // application turned it on: an authorization server quietly accepting
+        // registrations is a thing nobody asked for.
+        if (config?.registration?.enabled === true) {
+            router.post(`${prefix}/register`, async (ctx) => {
+                await this.#answer(ctx, async () => {
+                    const bearer = readBearer(ctx);
+                    const created = await manager.register(ctx.request.all(), bearer);
+                    // §3.2.1: 201, and the body carries a secret — no cache may
+                    // keep it.
+                    ctx.response.status(201);
+                    ctx.response.header("cache-control", "no-store");
+                    ctx.response.header("pragma", "no-cache");
+                    return created;
+                });
+            });
+        }
         // RFC 8414 — what a client fetches to discover the endpoints.
         router.get("/.well-known/oauth-authorization-server", async (ctx) => {
             ctx.response.header("content-type", "application/json");
@@ -106,6 +124,9 @@ export default class VisaProvider {
                 ],
                 // S256 only unless the application turned `plain` back on.
                 code_challenge_methods_supported: config?.allowPlainChallenge === true ? ["S256", "plain"] : ["S256"],
+                ...(config?.registration?.enabled === true
+                    ? { registration_endpoint: `${manager.issuer}${prefix}/register` }
+                    : {}),
                 token_endpoint_auth_methods_supported: [
                     "client_secret_basic",
                     "client_secret_post",
@@ -113,6 +134,31 @@ export default class VisaProvider {
                 ],
             });
         });
+        // RFC 9728 — what a client fetches after a 401 to learn where tokens
+        // come from. Mounted only when the application named its resource: a
+        // document announcing a resource nobody declared would point clients at
+        // something that does not exist.
+        const protectedResource = config?.protectedResource;
+        if (protectedResource !== undefined) {
+            const document = protectedResourceMetadata({
+                ...protectedResource,
+                authorizationServers: [manager.issuer],
+            });
+            router.get(PROTECTED_RESOURCE_PATH, async (ctx) => {
+                ctx.response.header("content-type", "application/json");
+                ctx.response.send(document);
+            });
+            // §3: the well-known segment goes BETWEEN the host and the resource's
+            // path, so a resource at `/mcp` publishes at `…/oauth-protected-
+            // resource/mcp`. Both are served: a client may ask for either.
+            const withPath = new URL(protectedResourceMetadataUrl(protectedResource.resource)).pathname;
+            if (withPath !== PROTECTED_RESOURCE_PATH) {
+                router.get(withPath, async (ctx) => {
+                    ctx.response.header("content-type", "application/json");
+                    ctx.response.send(document);
+                });
+            }
+        }
     }
     async shutdown() {
         if (this.#owned !== undefined && getVisa() === this.#owned)
@@ -146,6 +192,16 @@ export default class VisaProvider {
         }
     }
 }
+/** The initial access token a registration may carry (RFC 7591 §3). */
+function readBearer(ctx) {
+    const header = ctx.request.header("authorization");
+    if (header === undefined)
+        return undefined;
+    const [scheme, value] = header.split(" ");
+    if (scheme?.toLowerCase() !== "bearer" || value === undefined)
+        return undefined;
+    return value;
+}
 function readAuthorization(ctx) {
     const header = ctx.request.header("authorization");
     return header === undefined ? {} : { authorization: header };

package/dist/VisaProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"VisaProvider.js","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAkC/C,MAAM,CAAC,OAAO,OAAO,YAAY;IAGV;IAFtB,MAAM,CAA0B;IAEhC,YAAsB,GAAmB;QAAnB,QAAG,GAAH,GAAG,CAAgB;IAAG,CAAC;IAE7C,QAAQ;QACP,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAkB,MAAM,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACd,+DAA+D,CAC/D,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAa,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAkB,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC;QAE1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACtD,6DAA6D;gBAC7D,6DAA6D;gBAC7D,eAAe;gBACf,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC1C,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACxC,iEAAiE;gBACjE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC;YACb,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,8DAA8D;QAC9D,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,YAAY;gBAC9D,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,QAAQ;gBAClD,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,aAAa;gBAC/D,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,SAAS;gBACxD,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qBAAqB,EAAE;oBACtB,oBAAoB;oBACpB,eAAe;oBACf,oBAAoB;iBACpB;gBACD,2DAA2D;gBAC3D,gCAAgC,EAC/B,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpE,qCAAqC,EAAE;oBACtC,qBAAqB;oBACrB,oBAAoB;oBACpB,MAAM;iBACN;aACD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC,MAAM;YAAE,SAAS,EAAE,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACZ,GAAoB,EACpB,IAA4B;QAE5B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,IAAI;gBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACtC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACrC,8CAA8C;gBAC9C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;CACD;AAED,SAAS,iBAAiB,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"VisaProvider.js","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAkC/C,MAAM,CAAC,OAAO,OAAO,YAAY;IAGV;IAFtB,MAAM,CAA0B;IAEhC,YAAsB,GAAmB;QAAnB,QAAG,GAAH,GAAG,CAAgB;IAAG,CAAC;IAE7C,QAAQ;QACP,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAkB,MAAM,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACd,+DAA+D,CAC/D,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAa,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAkB,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC;QAE1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACtD,6DAA6D;gBAC7D,6DAA6D;gBAC7D,eAAe;gBACf,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC1C,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACxC,iEAAiE;gBACjE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC;YACb,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,MAAM,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;oBAClC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;oBAClE,4DAA4D;oBAC5D,WAAW;oBACX,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBAC1C,OAAO,OAAO,CAAC;gBAChB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,YAAY;gBAC9D,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,QAAQ;gBAClD,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,aAAa;gBAC/D,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,SAAS;gBACxD,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qBAAqB,EAAE;oBACtB,oBAAoB;oBACpB,eAAe;oBACf,oBAAoB;iBACpB;gBACD,2DAA2D;gBAC3D,gCAAgC,EAC/B,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI;oBACzC,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,WAAW,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;gBACN,qCAAqC,EAAE;oBACtC,qBAAqB;oBACrB,oBAAoB;oBACpB,MAAM;iBACN;aACD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,MAAM,EAAE,iBAAiB,CAAC;QACpD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;gBAC1C,GAAG,iBAAiB;gBACpB,oBAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,sEAAsE;YACtE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,4BAA4B,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CACxD,CAAC,QAAQ,CAAC;YACX,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC,MAAM;YAAE,SAAS,EAAE,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACZ,GAAoB,EACpB,IAA4B;QAE5B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,IAAI;gBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACtC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACrC,8CAA8C;gBAC9C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;CACD;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,GAAoB;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS;QAC5D,OAAO,SAAS,CAAC;IAClB,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC"}

package/dist/authorize.d.ts

@@ -22,6 +22,13 @@ export interface AuthorizationRequest {
     nonce?: string;
     /** A client may ask to always see the consent screen. */
     prompt?: string;
+    /**
+     * Which resource the token is for (RFC 8707). One, or several.
+     *
+     * A parser hands repeated parameters over as an array, so both shapes are
+     * accepted rather than one being silently the only one that works.
+     */
+    resource?: string | string[];
 }
 /** A request that passed every check, with the values it resolved to. */
 export interface ValidatedRequest {
@@ -32,6 +39,8 @@ export interface ValidatedRequest {
     codeChallenge: string;
     codeChallengeMethod: "S256" | "plain";
     nonce: string | undefined;
+    /** The resources the token will be bound to (RFC 8707). Empty means unbound. */
+    resources: string[];
 }
 /**
  * A failure that cannot be redirected — the user must be told directly.
@@ -46,6 +55,15 @@ export declare class UnredirectableError extends Error {
 export interface AuthorizeOptions {
     /** Lifetime of the code. Short on purpose — see `issueAuthorizationCode`. */
     codeTtlSeconds?: number;
+    /**
+     * The resources this server will issue tokens for (RFC 8707).
+     *
+     * Left out, any well-formed resource is accepted and carried — which is
+     * useful while a deployment finds its names, and worth replacing with the
+     * list once it has: an unknown resource should be refused with
+     * `invalid_target` rather than minted for.
+     */
+    resourcesSupported?: readonly string[];
     /**
      * Accept `plain` as a code challenge method.
      *

package/dist/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAqB,MAAM,EAAE,MAAM,YAAY,CAAC;AAE5D,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;gBACf,KAAK,EAAE,UAAU;CAK7B;AAED,MAAM,WAAW,gBAAgB;IAChC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,gBAAqB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAgD3B;AA2DD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,gBAAgB,EAC3B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,gBAAqB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAC9B,SAAS,EAAE,gBAAgB,EAC3B,IAAI,EAAE,MAAM,GACV,MAAM,CAQR;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,EACjB,KAAK,CAAC,EAAE,MAAM,GACZ,MAAM,CAQR"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAqB,MAAM,EAAE,MAAM,YAAY,CAAC;AAE5D,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,gFAAgF;IAChF,SAAS,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;gBACf,KAAK,EAAE,UAAU;CAK7B;AAED,MAAM,WAAW,gBAAgB;IAChC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,gBAAqB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAqD3B;AA2DD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,gBAAgB,EAC3B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,gBAAqB,EAC9B,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAC9B,SAAS,EAAE,gBAAgB,EAC3B,IAAI,EAAE,MAAM,GACV,MAAM,CAQR;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,EACjB,KAAK,CAAC,EAAE,MAAM,GACZ,MAAM,CAQR"}

package/dist/authorize.js

@@ -10,6 +10,7 @@
 import { assertGrantAllowed, redirectUriMatches, resolveScopes, } from "./clients.js";
 import { hashSecret, randomToken } from "./crypto.js";
 import { OAuthError } from "./errors.js";
+import { readResourceParameter, validateResources } from "./resource.js";
 /**
  * A failure that cannot be redirected — the user must be told directly.
  *
@@ -53,6 +54,7 @@ export async function validateAuthorizationRequest(request, store, options = {})
     assertGrantAllowed(client, "authorization_code");
     const { codeChallenge, codeChallengeMethod } = readChallenge(request, options);
     const scopes = resolveScopes(request.scope, client);
+    const resources = validateResources(readResourceParameter(request.resource), options.resourcesSupported);
     return {
         client,
         redirectUri,
@@ -61,6 +63,7 @@ export async function validateAuthorizationRequest(request, store, options = {})
         codeChallenge,
         codeChallengeMethod,
         nonce: request.nonce,
+        resources,
     };
 }
 /**
@@ -121,6 +124,9 @@ export async function issueAuthorizationCode(validated, userId, store, options =
         codeChallengeMethod: validated.codeChallengeMethod,
         expiresAt: new Date(now.getTime() + ttl * 1000),
         ...(validated.nonce === undefined ? {} : { nonce: validated.nonce }),
+        ...(validated.resources.length === 0
+            ? {}
+            : { resources: validated.resources }),
     };
     await store.saveAuthorizationCode(record);
     return code;

package/dist/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BzC;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACpC,KAAK,CAAa;IAC3B,YAAY,KAAiB;QAC5B,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAiBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAA6B,EAC7B,KAAgB,EAChB,UAA4B,EAAE;IAE9B,yEAAyE;IACzE,wCAAwC;IACxC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAC3D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CACpD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAErE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CACnB,OAAO,CAAC,aAAa,KAAK,SAAS;YAClC,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,2BAA2B;QAC9B,iEAAiE;QACjE,iEAAiE;QACjE,OAAO,CAAC,aAAa,KAAK,OAAO;YAChC,CAAC,CAAC,8DAA8D;YAChE,CAAC,CAAC,uCAAuC,CAC1C,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAEjD,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,GAAG,aAAa,CAC3D,OAAO,EACP,OAAO,CACP,CAAC;IACF,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEpD,OAAO;QACN,MAAM;QACN,WAAW;QACX,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa;QACb,mBAAmB;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAC1B,SAA6B,EAC7B,MAAc;IAEd,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CACrE,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CACb,iBAAiB,EACjB,iEAAiE,CACjE,CACD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CACpE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CACrB,OAA6B,EAC7B,OAAyB;IAEzB,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACjD,iEAAiE;QACjE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC;IACxD,IAAI,MAAM,KAAK,MAAM;QACpB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAClE,IAAI,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,qCAAqC,CACrC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,SAA2B,EAC3B,MAAc,EACd,KAAgB,EAChB,UAA4B,EAAE,EAC9B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAsB;QACjC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;QAC7B,MAAM;QACN,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;QAClD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;KACpE,CAAC;IACF,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAC9B,SAA2B,EAC3B,IAAY;IAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,uEAAuE;IACvE,6DAA6D;IAC7D,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAC5B,WAAmB,EACnB,KAAiB,EACjB,KAAc;IAEd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAsCzE;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACpC,KAAK,CAAa;IAC3B,YAAY,KAAiB;QAC5B,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AA0BD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAA6B,EAC7B,KAAgB,EAChB,UAA4B,EAAE;IAE9B,yEAAyE;IACzE,wCAAwC;IACxC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAC3D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CACpD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAErE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CACnB,OAAO,CAAC,aAAa,KAAK,SAAS;YAClC,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,2BAA2B;QAC9B,iEAAiE;QACjE,iEAAiE;QACjE,OAAO,CAAC,aAAa,KAAK,OAAO;YAChC,CAAC,CAAC,8DAA8D;YAChE,CAAC,CAAC,uCAAuC,CAC1C,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAEjD,MAAM,EAAE,aAAa,EAAE,mBAAmB,EAAE,GAAG,aAAa,CAC3D,OAAO,EACP,OAAO,CACP,CAAC;IACF,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,iBAAiB,CAClC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B,CAAC;IAEF,OAAO;QACN,MAAM;QACN,WAAW;QACX,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa;QACb,mBAAmB;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS;KACT,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAC1B,SAA6B,EAC7B,MAAc;IAEd,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CACrE,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CACb,iBAAiB,EACjB,iEAAiE,CACjE,CACD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,mBAAmB,CAC5B,IAAI,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CACpE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CACrB,OAA6B,EAC7B,OAAyB;IAEzB,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACjD,iEAAiE;QACjE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC;IACxD,IAAI,MAAM,KAAK,MAAM;QACpB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAClE,IAAI,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,qCAAqC,CACrC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,SAA2B,EAC3B,MAAc,EACd,KAAgB,EAChB,UAA4B,EAAE,EAC9B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAsB;QACjC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE;QAC7B,MAAM;QACN,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;QAClD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;KACtC,CAAC;IACF,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAC9B,SAA2B,EAC3B,IAAY;IAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,uEAAuE;IACvE,6DAA6D;IAC7D,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAC5B,WAAmB,EACnB,KAAiB,EACjB,KAAc;IAEd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC"}

package/dist/clients.d.ts

@@ -55,7 +55,7 @@ export declare function readCredentials(input: {
  * "wrong secret" and "that client has no secret" are the same sentence to the
  * caller, because telling them apart is how a client list gets enumerated.
  */
-export declare function authenticateClient(credentials: ClientCredentials, load: (id: string) => Promise<Client | null>): Promise<Client>;
+export declare function authenticateClient(credentials: ClientCredentials, load: (id: string) => Promise<Client | null>, now?: Date): Promise<Client>;
 /** Is this grant one the client was registered for? */
 export declare function assertGrantAllowed(client: Client, grant: GrantType): void;
 /**

package/dist/clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CA2BT;AAMD,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,iBAAiB,CA4BpB;AAgCD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACvC,WAAW,EAAE,iBAAiB,EAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAC1C,OAAO,CAAC,MAAM,CAAC,CAoCjB;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAMzE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GACZ,MAAM,EAAE,CAaV"}
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CA2BT;AAMD,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,iBAAiB,CA4BpB;AAgCD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACvC,WAAW,EAAE,iBAAiB,EAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAC5C,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC,CA6CjB;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAMzE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GACZ,MAAM,EAAE,CAaV"}

package/dist/clients.js

@@ -119,7 +119,7 @@ function stringOrUndefined(value) {
  * "wrong secret" and "that client has no secret" are the same sentence to the
  * caller, because telling them apart is how a client list gets enumerated.
  */
-export async function authenticateClient(credentials, load) {
+export async function authenticateClient(credentials, load, now = new Date()) {
     if (credentials.clientId === undefined) {
         throw new OAuthError("invalid_client", "Client authentication failed.");
     }
@@ -147,6 +147,14 @@ export async function authenticateClient(credentials, load) {
         !secretMatches(credentials.clientSecret, client.secretHash)) {
         throw new OAuthError("invalid_client", "Client authentication failed.");
     }
+    // Registration may have answered `client_secret_expires_at`. This is where
+    // that answer becomes true: checked after the secret matched, so a wrong
+    // secret and an expired one are still the same sentence to the caller.
+    // Every endpoint that authenticates a client — token, introspection,
+    // revocation — arrives here, so one check covers all three.
+    if (client.secretExpiresAt !== undefined && client.secretExpiresAt <= now) {
+        throw new OAuthError("invalid_client", "Client authentication failed.");
+    }
     return client;
 }
 /** Is this grant one the client was registered for? */

package/dist/clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CACjC,SAAiB,EACjB,UAA6B;IAE7B,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,+CAA+C;QAC/C,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC;AAC/E,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAG/B;IACA,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE/D,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,sDAAsD,CACtD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,iEAAiE,CACjE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM;QAChB,GAAG,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE;YAC7B,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,oBAA6B,EAAE,CAAC;KACvE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,oBAAoB;IACpB,IAAI,CAAC;QACJ,OAAO;YACN,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACzD,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAC9D,MAAM,EAAE,qBAAqB;SAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,WAA8B,EAC9B,IAA4C;IAE5C,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,qEAAqE;IACrE,0DAA0D;IAC1D,IACC,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,uBAAuB,EACpD,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,mEAAmE;QACnE,gEAAgE;QAChE,yDAAyD;QACzD,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IACC,WAAW,CAAC,YAAY,KAAK,SAAS;QACtC,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,CAAC,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAC1D,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAgB;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9C,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,+BAA+B,KAAK,SAAS,CAC7C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC5B,SAA6B,EAC7B,MAAc;IAEd,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC1C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CACjC,SAAiB,EACjB,UAA6B;IAE7B,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,+CAA+C;QAC/C,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC;AAC/E,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAG/B;IACA,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE/D,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,sDAAsD,CACtD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,iEAAiE,CACjE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM;QAChB,GAAG,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE;YAC7B,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,oBAA6B,EAAE,CAAC;KACvE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,oBAAoB;IACpB,IAAI,CAAC;QACJ,OAAO;YACN,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACzD,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAC9D,MAAM,EAAE,qBAAqB;SAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,WAA8B,EAC9B,IAA4C,EAC5C,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,qEAAqE;IACrE,0DAA0D;IAC1D,IACC,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,uBAAuB,EACpD,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,mEAAmE;QACnE,gEAAgE;QAChE,yDAAyD;QACzD,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IACC,WAAW,CAAC,YAAY,KAAK,SAAS;QACtC,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,CAAC,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAC1D,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,4DAA4D;IAC5D,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,IAAI,GAAG,EAAE,CAAC;QAC3E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAgB;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9C,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,+BAA+B,KAAK,SAAS,CAC7C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC5B,SAA6B,EAC7B,MAAc;IAEd,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC1C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/config.d.ts

@@ -2,6 +2,7 @@
  * `config/visa.ts` — the Adonis shape: a `defineConfig` that returns what the
  * provider reads out of the config store.
  */
+import type { RegistrationOptions } from "./register.js";
 import type { VisaStore } from "./store.js";
 export interface VisaConfigInput {
     /**
@@ -25,6 +26,40 @@ export interface VisaConfigInput {
     allowPlainChallenge?: boolean;
     /** Where the endpoints are mounted. Default `/oauth`. */
     prefix?: string;
+    /**
+     * The resources this server issues tokens for (RFC 8707).
+     *
+     * Left out, any well-formed `resource` is accepted and carried. Named, an
+     * unknown one is refused with `invalid_target` — which is what stops a
+     * client asking for a token aimed at a server you do not run.
+     */
+    resourcesSupported?: string[];
+    /**
+     * Let clients register themselves (RFC 7591).
+     *
+     * OFF unless you say otherwise. An MCP client such as claude.ai has nobody
+     * to fill in a form for it, so it needs this; a server on the public
+     * internet with it open lets anyone create a client, so think about
+     * `initialAccessToken` before shipping one.
+     */
+    registration?: RegistrationOptions;
+    /**
+     * The protected resource this server issues tokens for (RFC 9728).
+     *
+     * Declare it and two things follow: the metadata document is served at
+     * `/.well-known/oauth-protected-resource`, and a refusal can name it. An
+     * MCP client walks from the 401 to that document to this server without
+     * anybody pasting a URL into a config file, which is the whole reason the
+     * RFC exists.
+     */
+    protectedResource?: {
+        /** The resource identifier — an absolute URI, no fragment. */
+        resource: string;
+        /** What a client may ask for. RECOMMENDED by §3.2. */
+        scopesSupported?: string[];
+        resourceName?: string;
+        resourceDocumentation?: string;
+    };
 }
 export declare function defineConfig(config: VisaConfigInput): VisaConfigInput;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,SAAS,CAAC;IACjB;kEAC8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,SAAS,CAAC;IACjB;kEAC8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE;QACnB,8DAA8D;QAC9D,QAAQ,EAAE,MAAM,CAAC;QACjB,sDAAsD;QACtD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE"}

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4BH,MAAM,UAAU,YAAY,CAAC,MAAuB;IACnD,OAAO,MAAM,CAAC;AACf,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA+DH,MAAM,UAAU,YAAY,CAAC,MAAuB;IACnD,OAAO,MAAM,CAAC;AACf,CAAC"}