@c9up/visa 0.1.1 → 0.1.3

package/dist/register.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Clients that register themselves (RFC 7591).
+ *
+ * An MCP client such as claude.ai or ChatGPT has nobody to fill in a form for
+ * it: it discovers this server, registers, and comes back with an id. Without
+ * this the only way in is a human pasting credentials somewhere.
+ *
+ * OFF unless the application turns it on, and that is the important part. Open
+ * registration means anyone who can reach the endpoint can create a client —
+ * the RFC says a server SHOULD allow it for interoperability, and also says
+ * the endpoint MAY be protected (§1.2, §3). The safe default here is the one
+ * the RFC permits rather than the one it encourages, because an authorization
+ * server that silently accepts registrations is a thing nobody asked for. Turn
+ * it on deliberately, and with an initial access token if the deployment is
+ * not meant to be open.
+ *
+ * A registered client gets exactly what this server allows: the grants,
+ * scopes and auth methods in the configuration, never what the request asked
+ * for. That is the difference between letting a client name itself and letting
+ * it decide what it may do.
+ */
+import type { Client, ClientAuthMethod, GrantType } from "./types.js";
+/** The metadata a request may send (§2). Unknown members are ignored. */
+export interface ClientRegistrationRequest {
+    redirect_uris?: unknown;
+    token_endpoint_auth_method?: unknown;
+    grant_types?: unknown;
+    response_types?: unknown;
+    client_name?: unknown;
+    client_uri?: unknown;
+    logo_uri?: unknown;
+    scope?: unknown;
+    contacts?: unknown;
+    tos_uri?: unknown;
+    policy_uri?: unknown;
+    software_id?: unknown;
+    software_version?: unknown;
+    software_statement?: unknown;
+    /**
+     * Whatever else the client sent.
+     *
+     * §2 says a server ignores metadata it does not understand, and this is a
+     * parsed HTTP body — a client that sends `client_id` hoping to pick its own
+     * is a real thing, and it lands here rather than being a type error nobody
+     * sees at run time.
+     */
+    [member: string]: unknown;
+}
+/** The 201 body (§3.2.1). */
+export interface ClientRegistrationResponse {
+    client_id: string;
+    client_secret?: string;
+    /** Seconds since the epoch. */
+    client_id_issued_at: number;
+    /** REQUIRED when a secret was issued. `0` means it does not expire. */
+    client_secret_expires_at?: number;
+    redirect_uris: string[];
+    grant_types: GrantType[];
+    token_endpoint_auth_method: ClientAuthMethod;
+    client_name: string;
+    scope?: string;
+}
+export interface RegistrationOptions {
+    /** Nothing happens unless this is true. */
+    enabled?: boolean;
+    /**
+     * Require this bearer token on the registration request.
+     *
+     * Left out, the endpoint is open — which is what an MCP client that has
+     * never met you needs, and what a deployment on the public internet should
+     * think about before shipping.
+     */
+    initialAccessToken?: string;
+    /** What a self-registered client may ever ask for. Defaults to none. */
+    scopes?: readonly string[];
+    /** Which grants it may use. Defaults to the authorization code flow and refresh. */
+    grantTypes?: readonly GrantType[];
+    /** Seconds until an issued secret expires. Omitted means it does not (§3.2.1). */
+    secretTtlSeconds?: number;
+}
+/**
+ * Check a registration request and say what the client may be.
+ *
+ * Returns the client to store and the plaintext secret, if one was issued —
+ * the caller persists the first and hands back the second, once.
+ */
+export declare function validateRegistration(request: ClientRegistrationRequest, options: RegistrationOptions, presentedToken?: string): {
+    redirectUris: string[];
+    grantTypes: GrantType[];
+    scopes: string[];
+    tokenEndpointAuthMethod: ClientAuthMethod;
+    name: string;
+};
+/** The 201 body for a client that was just created. */
+export declare function registrationResponse(client: Client, issuedAt: Date, secret: string | undefined): ClientRegistrationResponse;
+/**
+ * When a secret issued now stops working, or `undefined` for never.
+ *
+ * The TTL is the deployment's value, not the client's, so a bad one is a
+ * configuration mistake and says so — `VisaError`, not an OAuth error the
+ * caller would read as their own fault. Refused rather than rounded: a
+ * fractional or negative TTL means someone intended something this cannot
+ * carry out, and a secret quietly issued already-expired (or never expiring)
+ * is the worse answer either way.
+ */
+export declare function secretExpiryFor(issuedAt: Date, ttlSeconds: number | undefined): Date | undefined;
+//# sourceMappingURL=register.d.ts.map

package/dist/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEtE,yEAAyE;AACzE,MAAM,WAAW,yBAAyB;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,0BAA0B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,0BAA0B,EAAE,gBAAgB,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,oFAAoF;IACpF,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,mBAAmB,EAC5B,cAAc,CAAC,EAAE,MAAM,GACrB;IACF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,gBAAgB,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;CACb,CAmDA;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,0BAA0B,CA2B5B;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,IAAI,EACd,UAAU,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,GAAG,SAAS,CAUlB"}

package/dist/register.js

@@ -0,0 +1,203 @@
+/**
+ * Clients that register themselves (RFC 7591).
+ *
+ * An MCP client such as claude.ai or ChatGPT has nobody to fill in a form for
+ * it: it discovers this server, registers, and comes back with an id. Without
+ * this the only way in is a human pasting credentials somewhere.
+ *
+ * OFF unless the application turns it on, and that is the important part. Open
+ * registration means anyone who can reach the endpoint can create a client —
+ * the RFC says a server SHOULD allow it for interoperability, and also says
+ * the endpoint MAY be protected (§1.2, §3). The safe default here is the one
+ * the RFC permits rather than the one it encourages, because an authorization
+ * server that silently accepts registrations is a thing nobody asked for. Turn
+ * it on deliberately, and with an initial access token if the deployment is
+ * not meant to be open.
+ *
+ * A registered client gets exactly what this server allows: the grants,
+ * scopes and auth methods in the configuration, never what the request asked
+ * for. That is the difference between letting a client name itself and letting
+ * it decide what it may do.
+ */
+import { OAuthError, VisaError } from "./errors.js";
+const DEFAULT_GRANTS = [
+    "authorization_code",
+    "refresh_token",
+];
+/**
+ * Check a registration request and say what the client may be.
+ *
+ * Returns the client to store and the plaintext secret, if one was issued —
+ * the caller persists the first and hands back the second, once.
+ */
+export function validateRegistration(request, options, presentedToken) {
+    if (options.enabled !== true) {
+        throw new OAuthError("invalid_client_metadata", "This server does not accept client registrations.");
+    }
+    if (options.initialAccessToken !== undefined) {
+        // Constant-time is not the point here: the token is compared once per
+        // registration, and a registration endpoint is not a guessing oracle
+        // worth the machinery. Absent or wrong reads the same to the caller.
+        if (presentedToken !== options.initialAccessToken) {
+            throw new OAuthError("invalid_client_metadata", "Registration on this server needs an initial access token.");
+        }
+    }
+    const redirectUris = readStringList(request.redirect_uris);
+    const grantTypes = resolveGrants(request.grant_types, options);
+    // A client using the authorization code flow has somewhere to come back to,
+    // and this is the last moment anyone checks.
+    if (grantTypes.includes("authorization_code") && redirectUris.length === 0) {
+        throw new OAuthError("invalid_redirect_uri", "redirect_uris is required for the authorization_code grant.");
+    }
+    for (const uri of redirectUris)
+        assertRedirectUri(uri);
+    const allowed = options.scopes ?? [];
+    const requested = readScope(request.scope);
+    const outside = requested.filter((scope) => !allowed.includes(scope));
+    if (outside.length > 0) {
+        throw new OAuthError("invalid_client_metadata", `This server does not grant ${outside.join(", ")} to a self-registered client.`);
+    }
+    return {
+        redirectUris,
+        grantTypes,
+        // What was asked for, narrowed to what is allowed — never the allowed
+        // set, or every client would be registered with everything.
+        scopes: requested,
+        tokenEndpointAuthMethod: readAuthMethod(request.token_endpoint_auth_method),
+        name: readName(request.client_name),
+    };
+}
+/** The 201 body for a client that was just created. */
+export function registrationResponse(client, issuedAt, secret) {
+    const seconds = Math.floor(issuedAt.getTime() / 1000);
+    return {
+        client_id: client.id,
+        ...(secret === undefined ? {} : { client_secret: secret }),
+        client_id_issued_at: seconds,
+        // REQUIRED when a secret was issued, and `0` is the spelling for "never"
+        // — not an omission, which would mean the field was not answered.
+        //
+        // Read off the client rather than recomputed from the options: the
+        // answer and the stored expiry are then the same value by construction,
+        // and cannot drift into a server that announces an expiry it does not
+        // enforce.
+        ...(secret === undefined
+            ? {}
+            : {
+                client_secret_expires_at: client.secretExpiresAt === undefined
+                    ? 0
+                    : Math.floor(client.secretExpiresAt.getTime() / 1000),
+            }),
+        redirect_uris: client.redirectUris,
+        grant_types: client.grantTypes,
+        token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+        client_name: client.name,
+        ...(client.scopes.length === 0 ? {} : { scope: client.scopes.join(" ") }),
+    };
+}
+function resolveGrants(value, options) {
+    const allowed = options.grantTypes ?? DEFAULT_GRANTS;
+    const requested = readStringList(value);
+    if (requested.length === 0)
+        return [...allowed];
+    const grants = [];
+    for (const grant of requested) {
+        if (!isGrantType(grant) || !allowed.includes(grant)) {
+            throw new OAuthError("invalid_client_metadata", `This server does not allow the ${grant} grant to a self-registered client.`);
+        }
+        if (!grants.includes(grant))
+            grants.push(grant);
+    }
+    return grants;
+}
+/**
+ * A redirect URI a self-registered client may use.
+ *
+ * https, or http on a loopback address — a native app's callback. Anything
+ * else is refused: an authorization code sent over plain http to a host
+ * someone else controls is the code given away.
+ */
+function assertRedirectUri(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new OAuthError("invalid_redirect_uri", `${value} is not an absolute URI.`);
+    }
+    if (url.hash !== "") {
+        throw new OAuthError("invalid_redirect_uri", `${value} must not carry a fragment.`);
+    }
+    if (url.protocol === "https:")
+        return;
+    const loopback = url.hostname === "127.0.0.1" ||
+        url.hostname === "[::1]" ||
+        url.hostname === "localhost";
+    if (url.protocol === "http:" && loopback)
+        return;
+    throw new OAuthError("invalid_redirect_uri", `${value} must use https, or http on a loopback address.`);
+}
+/**
+ * When a secret issued now stops working, or `undefined` for never.
+ *
+ * The TTL is the deployment's value, not the client's, so a bad one is a
+ * configuration mistake and says so — `VisaError`, not an OAuth error the
+ * caller would read as their own fault. Refused rather than rounded: a
+ * fractional or negative TTL means someone intended something this cannot
+ * carry out, and a secret quietly issued already-expired (or never expiring)
+ * is the worse answer either way.
+ */
+export function secretExpiryFor(issuedAt, ttlSeconds) {
+    if (ttlSeconds === undefined)
+        return undefined;
+    if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
+        throw new VisaError("E_VISA_INVALID_SECRET_TTL", `registration.secretTtlSeconds must be a positive whole number of seconds; received ${ttlSeconds}.`, { hint: "Leave it out for a secret that never expires." });
+    }
+    return new Date(issuedAt.getTime() + ttlSeconds * 1000);
+}
+function readStringList(value) {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value)) {
+        throw new OAuthError("invalid_client_metadata", "redirect_uris and grant_types must be arrays of strings.");
+    }
+    // Refused, not filtered. Dropping the entries that are not strings answers
+    // 201 to a request nobody wrote: `["https://app/cb", 42]` registered one
+    // redirect uri while the client believed it had registered two, and the
+    // second one silently not working is found much later, by a user.
+    if (value.some((entry) => typeof entry !== "string")) {
+        throw new OAuthError("invalid_client_metadata", "redirect_uris and grant_types must be arrays of strings.");
+    }
+    return [...value];
+}
+function readScope(value) {
+    if (value === undefined || value === null)
+        return [];
+    if (typeof value !== "string") {
+        throw new OAuthError("invalid_client_metadata", "scope must be a space-separated string.");
+    }
+    return value.split(/\s+/).filter((scope) => scope !== "");
+}
+function readAuthMethod(value) {
+    if (value === undefined || value === null)
+        return "client_secret_basic";
+    if (value === "client_secret_basic" ||
+        value === "client_secret_post" ||
+        value === "none") {
+        return value;
+    }
+    throw new OAuthError("invalid_client_metadata", `token_endpoint_auth_method ${String(value)} is not supported.`);
+}
+function readName(value) {
+    if (typeof value === "string" && value.trim() !== "")
+        return value.trim();
+    // A client with no name shows as one on a consent screen, which is worse
+    // than a placeholder nobody mistakes for a brand.
+    return "Unnamed client";
+}
+function isGrantType(value) {
+    return (value === "authorization_code" ||
+        value === "refresh_token" ||
+        value === "client_credentials");
+}
+//# sourceMappingURL=register.js.map

package/dist/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAgEpD,MAAM,cAAc,GAAyB;IAC5C,oBAAoB;IACpB,eAAe;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAkC,EAClC,OAA4B,EAC5B,cAAuB;IAQvB,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,mDAAmD,CACnD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC9C,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,cAAc,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,4DAA4D,CAC5D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE/D,4EAA4E;IAC5E,6CAA6C;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,6DAA6D,CAC7D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY;QAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC/E,CAAC;IACH,CAAC;IAED,OAAO;QACN,YAAY;QACZ,UAAU;QACV,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,EAAE,SAAS;QACjB,uBAAuB,EAAE,cAAc,CAAC,OAAO,CAAC,0BAA0B,CAAC;QAC3E,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;KACnC,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CACnC,MAAc,EACd,QAAc,EACd,MAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO;QACN,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QAC1D,mBAAmB,EAAE,OAAO;QAC5B,yEAAyE;QACzE,kEAAkE;QAClE,EAAE;QACF,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,WAAW;QACX,GAAG,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACA,wBAAwB,EACvB,MAAM,CAAC,eAAe,KAAK,SAAS;oBACnC,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;aACvD,CAAC;QACJ,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;QAC1D,WAAW,EAAE,MAAM,CAAC,IAAI;QACxB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,KAAc,EACd,OAA4B;IAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACrD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,kCAAkC,KAAK,qCAAqC,CAC5E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,0BAA0B,CAClC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,6BAA6B,CACrC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACtC,MAAM,QAAQ,GACb,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ;QAAE,OAAO;IACjD,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,iDAAiD,CACzD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAc,EACd,UAA8B;IAE9B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAClB,2BAA2B,EAC3B,sFAAsF,UAAU,GAAG,EACnG,EAAE,IAAI,EAAE,+CAA+C,EAAE,CACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,yCAAyC,CACzC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,qBAAqB,CAAC;IACxE,IACC,KAAK,KAAK,qBAAqB;QAC/B,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,MAAM,EACf,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,8BAA8B,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAC/D,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1E,yEAAyE;IACzE,kDAAkD;IAClD,OAAO,gBAAgB,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IACjC,OAAO,CACN,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,oBAAoB,CAC9B,CAAC;AACH,CAAC"}

package/dist/resource.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Which resource a token is for (RFC 8707).
+ *
+ * A token with no stated audience is a token for everything. Send it to the
+ * wrong server — or let a compromised one replay it — and every other resource
+ * that trusts the same issuer accepts it. The `resource` parameter is how a
+ * client says "this one is for the calendar API", and how the calendar API
+ * refuses one minted for somebody else.
+ *
+ * Read off the RFC rather than recalled: the value MUST be an absolute URI
+ * without a fragment (§2), it MAY repeat, and a resource the server does not
+ * accept is refused with `invalid_target` (§2) — not `invalid_request`, which
+ * would tell a client its request was malformed when it was merely aimed
+ * somewhere it may not go.
+ */
+/**
+ * Normalise however the parameter arrived into a list.
+ *
+ * A form body gives one value or several under the same name, and a query
+ * string the same; both are `resource=` repeated, which parsers hand over
+ * either way.
+ */
+export declare function readResourceParameter(value: unknown): string[];
+/**
+ * Check each one, and refuse the request if any is unusable.
+ *
+ * `invalid_target` for every rejection here, including a malformed URI: §2
+ * names that code for "cannot parse the provided value(s)" as well as for a
+ * resource the server will not issue for.
+ */
+export declare function validateResources(requested: readonly string[], accepted?: readonly string[]): string[];
+/**
+ * What a token request may narrow to.
+ *
+ * A refresh or an exchange may ask for fewer resources than were authorised,
+ * never for more — the same rule scopes follow, and for the same reason: the
+ * user agreed to a set, and a later request must not widen it.
+ */
+export declare function narrowResources(requested: readonly string[], granted: readonly string[]): string[];
+/**
+ * Is this token for me?
+ *
+ * What a resource server asks. A token bound to nothing is accepted — that is
+ * every token issued before a client started sending `resource`, and refusing
+ * them would break each one. A token bound to SOMETHING must name this
+ * resource, or it was minted for another server and arriving here means it
+ * travelled.
+ */
+export declare function audienceAllows(audience: readonly string[] | undefined, resource: string | undefined): boolean;
+//# sourceMappingURL=resource.d.ts.map

package/dist/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAM9D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,EAAE,CA8BV;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC9B,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,MAAM,EAAE,CAmBV;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAIT"}

package/dist/resource.js

@@ -0,0 +1,101 @@
+/**
+ * Which resource a token is for (RFC 8707).
+ *
+ * A token with no stated audience is a token for everything. Send it to the
+ * wrong server — or let a compromised one replay it — and every other resource
+ * that trusts the same issuer accepts it. The `resource` parameter is how a
+ * client says "this one is for the calendar API", and how the calendar API
+ * refuses one minted for somebody else.
+ *
+ * Read off the RFC rather than recalled: the value MUST be an absolute URI
+ * without a fragment (§2), it MAY repeat, and a resource the server does not
+ * accept is refused with `invalid_target` (§2) — not `invalid_request`, which
+ * would tell a client its request was malformed when it was merely aimed
+ * somewhere it may not go.
+ */
+import { OAuthError } from "./errors.js";
+/**
+ * Normalise however the parameter arrived into a list.
+ *
+ * A form body gives one value or several under the same name, and a query
+ * string the same; both are `resource=` repeated, which parsers hand over
+ * either way.
+ */
+export function readResourceParameter(value) {
+    if (value === undefined || value === null)
+        return [];
+    if (Array.isArray(value)) {
+        return value.filter((entry) => typeof entry === "string");
+    }
+    return typeof value === "string" && value !== "" ? [value] : [];
+}
+/**
+ * Check each one, and refuse the request if any is unusable.
+ *
+ * `invalid_target` for every rejection here, including a malformed URI: §2
+ * names that code for "cannot parse the provided value(s)" as well as for a
+ * resource the server will not issue for.
+ */
+export function validateResources(requested, accepted) {
+    const resources = [];
+    for (const value of requested) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            throw new OAuthError("invalid_target", `resource must be an absolute URI: ${value}`);
+        }
+        if (url.hash !== "") {
+            throw new OAuthError("invalid_target", `resource must not carry a fragment: ${value}`);
+        }
+        // §2 SHOULD NOT include a query, and recognises that some cases need
+        // one — so it travels rather than being refused or stripped. Stripping
+        // would hand back a token for a resource nobody asked for.
+        if (accepted !== undefined && !accepted.includes(value)) {
+            throw new OAuthError("invalid_target", `this server does not issue tokens for ${value}`);
+        }
+        if (!resources.includes(value))
+            resources.push(value);
+    }
+    return resources;
+}
+/**
+ * What a token request may narrow to.
+ *
+ * A refresh or an exchange may ask for fewer resources than were authorised,
+ * never for more — the same rule scopes follow, and for the same reason: the
+ * user agreed to a set, and a later request must not widen it.
+ */
+export function narrowResources(requested, granted) {
+    if (requested.length === 0)
+        return [...granted];
+    if (granted.length === 0) {
+        // Nothing was bound at authorization time, so there is nothing to narrow
+        // FROM. Letting the request name one here would mint a token for an
+        // audience the user never saw.
+        throw new OAuthError("invalid_target", "this grant is not bound to any resource");
+    }
+    const outside = requested.filter((value) => !granted.includes(value));
+    if (outside.length > 0) {
+        throw new OAuthError("invalid_target", `this grant does not cover ${outside.join(", ")}`);
+    }
+    return [...requested];
+}
+/**
+ * Is this token for me?
+ *
+ * What a resource server asks. A token bound to nothing is accepted — that is
+ * every token issued before a client started sending `resource`, and refusing
+ * them would break each one. A token bound to SOMETHING must name this
+ * resource, or it was minted for another server and arriving here means it
+ * travelled.
+ */
+export function audienceAllows(audience, resource) {
+    if (audience === undefined || audience.length === 0)
+        return true;
+    if (resource === undefined)
+        return true;
+    return audience.includes(resource);
+}
+//# sourceMappingURL=resource.js.map

package/dist/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAChC,SAA4B,EAC5B,QAA4B;IAE5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,qCAAqC,KAAK,EAAE,CAC5C,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,uCAAuC,KAAK,EAAE,CAC9C,CAAC;QACH,CAAC;QACD,qEAAqE;QACrE,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,yCAAyC,KAAK,EAAE,CAChD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC9B,SAA4B,EAC5B,OAA0B;IAE1B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,yEAAyE;QACzE,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,yCAAyC,CACzC,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,gBAAgB,EAChB,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC7B,QAAuC,EACvC,QAA4B;IAE5B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC"}

package/dist/store.d.ts

@@ -38,6 +38,31 @@ export interface VisaStore {
     revokeFamily(familyId: string, at: Date): Promise<void>;
     findConsent(userId: string, clientId: string): Promise<Consent | null>;
     saveConsent(consent: Consent): Promise<void>;
+    /**
+     * Everything this user has granted, so they can be shown it.
+     *
+     * The consent is the unit a person manages: they authorised an
+     * application, not a token. Tokens come and go under that decision.
+     */
+    listConsents(userId: string): Promise<Consent[]>;
+    /**
+     * Every access token of this user, EXPIRED ONES INCLUDED.
+     *
+     * Included deliberately: "last used" is most interesting precisely when
+     * nothing is live any more, and a screen that hid them would tell a user an
+     * application never touched their data when it did.
+     */
+    listAccessTokens(userId: string): Promise<AccessToken[]>;
+    /**
+     * Cut one application off for one user: every token, both kinds.
+     *
+     * Not the consent — {@link deleteConsent} is separate, because forgetting
+     * the grant and ending the sessions are two different things and a caller
+     * revoking in a panic wants the second one first.
+     */
+    revokeAccessFor(userId: string, clientId: string, at: Date): Promise<void>;
+    /** Forget the grant, so the user is asked again next time. */
+    deleteConsent(userId: string, clientId: string): Promise<void>;
     /**
      * Record that an access token was just used.
      *

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACzB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/C,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAClE,oEAAoE;IACpE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C;;;;;;OAMG;IACH,gBAAgB,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,0EAA0E;IAC1E,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,SAAS;IACzB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/C,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAClE,oEAAoE;IACpE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,8DAA8D;IAC9D,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,gBAAgB,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,0EAA0E;IAC1E,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC"}

package/dist/stores/atlas.d.ts

@@ -33,6 +33,8 @@ export interface AtlasQuery {
     whereNull(column: string): AtlasQuery;
     orderBy(column: string, direction?: "asc" | "desc"): AtlasQuery;
     first(): Promise<Row | null>;
+    /** Run the select and return every row — atlas' `exec()`. */
+    exec(): Promise<Row[]>;
     insert(data: Row): PromiseLike<unknown>;
     /** Resolves to the number of rows affected, which is what the atomic paths read. */
     update(data: Row): PromiseLike<number | Row[]>;
@@ -92,6 +94,11 @@ export declare class AtlasStore implements VisaStore {
      * three different ways, and re-granting is not a hot path.
      */
     saveConsent(consent: Consent): Promise<void>;
+    listConsents(userId: string): Promise<Consent[]>;
+    /** Expired ones included — see the contract for why. */
+    listAccessTokens(userId: string): Promise<AccessToken[]>;
+    revokeAccessFor(userId: string, clientId: string, at: Date): Promise<void>;
+    deleteConsent(userId: string, clientId: string): Promise<void>;
     /** Drop what has expired and can no longer be presented. */
     prune(now: Date): Promise<void>;
 }

package/dist/stores/atlas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atlas.d.ts","sourceRoot":"","sources":["../../src/stores/atlas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EAEN,OAAO,EAEP,YAAY,EACZ,MAAM,aAAa,CAAC;AAErB,oCAAoC;AACpC,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,8CAA8C;AAC9C,KAAK,QAAQ,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,KAAK,CAAC,UAAU,EAAE,GAAG,GAAG,UAAU,CAAC;IACnC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC;IACtE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;IAChE,KAAK,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,oFAAoF;IACpF,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;CACtC;AAED,wDAAwD;AACxD,MAAM,WAAW,OAAO;IACvB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;CACjC;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAgFD,qBAAa,UAAW,YAAW,SAAS;;gBAI/B,EAAE,EAAE,OAAO,EAAE,MAAM,GAAE,gBAAqB;IAYhD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkBpD,+FAA+F;IACzF,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczC,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7D,qBAAqB,CAC1B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBpC;;;;;;;OAOG;IACG,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAStE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAclD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsB/D,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ7D,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAcpD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAqBvE,sEAAsE;IAChE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IASxE;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAavD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAc5E;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAalD,4DAA4D;IACtD,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CASrC"}
+{"version":3,"file":"atlas.d.ts","sourceRoot":"","sources":["../../src/stores/atlas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EACX,WAAW,EACX,iBAAiB,EACjB,MAAM,EAEN,OAAO,EAEP,YAAY,EACZ,MAAM,aAAa,CAAC;AAErB,oCAAoC;AACpC,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,8CAA8C;AAC9C,KAAK,QAAQ,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,KAAK,CAAC,UAAU,EAAE,GAAG,GAAG,UAAU,CAAC;IACnC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC;IACtE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;IAChE,KAAK,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACvB,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,oFAAoF;IACpF,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;CACtC;AAED,wDAAwD;AACxD,MAAM,WAAW,OAAO;IACvB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;CACjC;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAgFD,qBAAa,UAAW,YAAW,SAAS;;gBAI/B,EAAE,EAAE,OAAO,EAAE,MAAM,GAAE,gBAAqB;IAYhD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkBpD,+FAA+F;IACzF,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczC,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB7D,qBAAqB,CAC1B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAwBpC;;;;;;;OAOG;IACG,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAStE,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAelD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAQ/D,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ7D,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5D,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAepD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAsBvE,sEAAsE;IAChE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IASxE;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAavD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAc5E;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAa5C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IActD,wDAAwD;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IASxD,eAAe,CACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,IAAI,CAAC;IAaV,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpE,4DAA4D;IACtD,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CASrC"}