@c9up/visa 0.1.2 → 0.1.4

package/dist/VisaProvider.js

@@ -14,6 +14,10 @@
  * decision; the page around it is yours. The README shows the ten lines.
  *
  * Duck-typed throughout: visa must not import its host's HTTP types.
+ *
+ * NAMED DEVIATION from the usual `request.all()`: these endpoints read the
+ * body only, and refuse a request that puts an OAuth parameter in the query
+ * string — see `readBody`.
  */
 import "./augmentations.js";
 import { OAuthError } from "./errors.js";
@@ -52,7 +56,7 @@ export default class VisaProvider {
         const prefix = config?.prefix ?? "/oauth";
         router.post(`${prefix}/token`, async (ctx) => {
             await this.#answer(ctx, async () => {
-                const body = ctx.request.all();
+                const body = readBody(ctx);
                 const credentials = manager.readCredentials({
                     body,
                     ...readAuthorization(ctx),
@@ -68,7 +72,7 @@ export default class VisaProvider {
         });
         router.post(`${prefix}/introspect`, async (ctx) => {
             await this.#answer(ctx, async () => {
-                const body = ctx.request.all();
+                const body = readBody(ctx);
                 const credentials = manager.readCredentials({
                     body,
                     ...readAuthorization(ctx),
@@ -79,7 +83,7 @@ export default class VisaProvider {
         });
         router.post(`${prefix}/revoke`, async (ctx) => {
             await this.#answer(ctx, async () => {
-                const body = ctx.request.all();
+                const body = readBody(ctx);
                 const credentials = manager.readCredentials({
                     body,
                     ...readAuthorization(ctx),
@@ -97,7 +101,7 @@ export default class VisaProvider {
             router.post(`${prefix}/register`, async (ctx) => {
                 await this.#answer(ctx, async () => {
                     const bearer = readBearer(ctx);
-                    const created = await manager.register(ctx.request.all(), bearer);
+                    const created = await manager.register(readBody(ctx, REGISTRATION_PARAMETERS), bearer);
                     // §3.2.1: 201, and the body carries a secret — no cache may
                     // keep it.
                     ctx.response.status(201);
@@ -192,13 +196,91 @@ export default class VisaProvider {
         }
     }
 }
+/**
+ * What may never travel in the URL of these endpoints.
+ *
+ * Every credential and every parameter the spec defines for them: the client's
+ * own (§2.3.1, RFC 7523), each grant's (§4), introspection's and revocation's
+ * (RFC 7662 §2.1, RFC 7009 §2.1), resource indicators (RFC 8707), a bearer
+ * token in its RFC 6750 §2.3 form, and the removed password grant's — a
+ * client still sending those sends a password.
+ */
+const OAUTH_PARAMETERS = new Set([
+    "client_id",
+    "client_secret",
+    "client_assertion",
+    "client_assertion_type",
+    "grant_type",
+    "code",
+    "code_verifier",
+    "redirect_uri",
+    "refresh_token",
+    "scope",
+    "resource",
+    "token",
+    "token_type_hint",
+    "access_token",
+    "username",
+    "password",
+]);
+/** The same, plus the client metadata a registration carries (RFC 7591 §2). */
+const REGISTRATION_PARAMETERS = new Set([
+    ...OAUTH_PARAMETERS,
+    "redirect_uris",
+    "token_endpoint_auth_method",
+    "grant_types",
+    "response_types",
+    "client_name",
+    "client_uri",
+    "logo_uri",
+    "contacts",
+    "tos_uri",
+    "policy_uri",
+    "jwks_uri",
+    "jwks",
+    "software_id",
+    "software_version",
+    "software_statement",
+]);
+/**
+ * The parameters of a machine endpoint, read from the body and nowhere else.
+ *
+ * Every one of these requests carries a credential — a client secret, a code,
+ * a refresh or access token. RFC 6749 §2.3.1 says client credentials "MUST NOT
+ * be included in the request URI", and §3.2, RFC 7009 §2.1, RFC 7662 §2.1 and
+ * RFC 7591 §3.1 all define the parameters as a POST body. A URL is kept by
+ * access logs, proxies and traces where a body is not.
+ *
+ * So the query string is never read, and a request that puts an OAuth
+ * parameter there is refused rather than answered: accepting it would teach a
+ * client that the URL works, and the secret it carries is already in a log.
+ * Anything else in the query (a tracing or cache-busting parameter a proxy
+ * added) is ignored, not refused.
+ */
+function readBody(ctx, forbidden = OAUTH_PARAMETERS) {
+    const inUrl = Object.keys(ctx.request.qs()).filter((key) => forbidden.has(key));
+    if (inUrl.length > 0) {
+        throw new OAuthError("invalid_request", `OAuth parameters go in the request body, never in the URL: ${inUrl.join(", ")}.`);
+    }
+    const body = ctx.request.body();
+    if (body === undefined || body === null)
+        return {};
+    if (!isRecord(body)) {
+        throw new OAuthError("invalid_request", "The request body must be a form or a JSON object.");
+    }
+    return body;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 /** The initial access token a registration may carry (RFC 7591 §3). */
 function readBearer(ctx) {
     const header = ctx.request.header("authorization");
     if (header === undefined)
         return undefined;
     const [scheme, value] = header.split(" ");
-    if (scheme?.toLowerCase() !== "bearer" || value === undefined)
+    // An empty value is no token at all, not a token that is the empty string.
+    if (scheme?.toLowerCase() !== "bearer" || value === undefined || value === "")
         return undefined;
     return value;
 }

package/dist/VisaProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"VisaProvider.js","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAkC/C,MAAM,CAAC,OAAO,OAAO,YAAY;IAGV;IAFtB,MAAM,CAA0B;IAEhC,YAAsB,GAAmB;QAAnB,QAAG,GAAH,GAAG,CAAgB;IAAG,CAAC;IAE7C,QAAQ;QACP,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAkB,MAAM,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACd,+DAA+D,CAC/D,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAa,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAkB,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC;QAE1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACtD,6DAA6D;gBAC7D,6DAA6D;gBAC7D,eAAe;gBACf,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC1C,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACxC,iEAAiE;gBACjE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC;YACb,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,MAAM,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;oBAClC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;oBAClE,4DAA4D;oBAC5D,WAAW;oBACX,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBAC1C,OAAO,OAAO,CAAC;gBAChB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,YAAY;gBAC9D,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,QAAQ;gBAClD,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,aAAa;gBAC/D,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,SAAS;gBACxD,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qBAAqB,EAAE;oBACtB,oBAAoB;oBACpB,eAAe;oBACf,oBAAoB;iBACpB;gBACD,2DAA2D;gBAC3D,gCAAgC,EAC/B,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI;oBACzC,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,WAAW,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;gBACN,qCAAqC,EAAE;oBACtC,qBAAqB;oBACrB,oBAAoB;oBACpB,MAAM;iBACN;aACD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,MAAM,EAAE,iBAAiB,CAAC;QACpD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;gBAC1C,GAAG,iBAAiB;gBACpB,oBAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,sEAAsE;YACtE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,4BAA4B,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CACxD,CAAC,QAAQ,CAAC;YACX,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC,MAAM;YAAE,SAAS,EAAE,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACZ,GAAoB,EACpB,IAA4B;QAE5B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,IAAI;gBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACtC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACrC,8CAA8C;gBAC9C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;CACD;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,GAAoB;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS;QAC5D,OAAO,SAAS,CAAC;IAClB,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"VisaProvider.js","sourceRoot":"","sources":["../src/VisaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAqC/C,MAAM,CAAC,OAAO,OAAO,YAAY;IAGV;IAFtB,MAAM,CAA0B;IAEhC,YAAsB,GAAmB;QAAnB,QAAG,GAAH,GAAG,CAAgB;IAAG,CAAC;IAE7C,QAAQ;QACP,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAkB,MAAM,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACd,+DAA+D,CAC/D,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,OAAO,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAa,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAc,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAkB,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC;QAE1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACtD,6DAA6D;gBAC7D,6DAA6D;gBAC7D,eAAe;gBACf,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC1C,OAAO,MAAM,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC3C,IAAI;oBACJ,GAAG,iBAAiB,CAAC,GAAG,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACxC,iEAAiE;gBACjE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC;YACb,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,MAAM,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;oBAClC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CACrC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC,EACtC,MAAM,CACN,CAAC;oBACF,4DAA4D;oBAC5D,WAAW;oBACX,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBAC1C,OAAO,OAAO,CAAC;gBAChB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,YAAY;gBAC9D,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,QAAQ;gBAClD,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,aAAa;gBAC/D,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,SAAS;gBACxD,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qBAAqB,EAAE;oBACtB,oBAAoB;oBACpB,eAAe;oBACf,oBAAoB;iBACpB;gBACD,2DAA2D;gBAC3D,gCAAgC,EAC/B,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI;oBACzC,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,WAAW,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;gBACN,qCAAqC,EAAE;oBACtC,qBAAqB;oBACrB,oBAAoB;oBACpB,MAAM;iBACN;aACD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,MAAM,EAAE,iBAAiB,CAAC;QACpD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,yBAAyB,CAAC;gBAC1C,GAAG,iBAAiB;gBACpB,oBAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACjD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,sEAAsE;YACtE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,4BAA4B,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CACxD,CAAC,QAAQ,CAAC;YACX,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBAClC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC,MAAM;YAAE,SAAS,EAAE,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACZ,GAAoB,EACpB,IAA4B;QAE5B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,IAAI;gBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACtC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACrC,8CAA8C;gBAC9C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;CACD;AAED;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACrD,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,uBAAuB;IACvB,YAAY;IACZ,MAAM;IACN,eAAe;IACf,cAAc;IACd,eAAe;IACf,OAAO;IACP,UAAU;IACV,OAAO;IACP,iBAAiB;IACjB,cAAc;IACd,UAAU;IACV,UAAU;CACV,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC5D,GAAG,gBAAgB;IACnB,eAAe;IACf,4BAA4B;IAC5B,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,UAAU;IACV,UAAU;IACV,SAAS;IACT,YAAY;IACZ,UAAU;IACV,MAAM;IACN,aAAa;IACb,kBAAkB;IAClB,oBAAoB;CACpB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,SAAS,QAAQ,CAChB,GAAoB,EACpB,YAAiC,gBAAgB;IAEjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAC1D,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAClB,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,8DAA8D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,mDAAmD,CACnD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,GAAoB;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,2EAA2E;IAC3E,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAC5E,OAAO,SAAS,CAAC;IAClB,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC"}

package/dist/clients.d.ts

@@ -55,7 +55,7 @@ export declare function readCredentials(input: {
  * "wrong secret" and "that client has no secret" are the same sentence to the
  * caller, because telling them apart is how a client list gets enumerated.
  */
-export declare function authenticateClient(credentials: ClientCredentials, load: (id: string) => Promise<Client | null>): Promise<Client>;
+export declare function authenticateClient(credentials: ClientCredentials, load: (id: string) => Promise<Client | null>, now?: Date): Promise<Client>;
 /** Is this grant one the client was registered for? */
 export declare function assertGrantAllowed(client: Client, grant: GrantType): void;
 /**

package/dist/clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CA2BT;AAMD,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,iBAAiB,CA4BpB;AAgCD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACvC,WAAW,EAAE,iBAAiB,EAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAC1C,OAAO,CAAC,MAAM,CAAC,CAoCjB;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAMzE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GACZ,MAAM,EAAE,CAaV"}
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,CA2BT;AAMD,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,iBAAiB,CA4BpB;AAgCD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACvC,WAAW,EAAE,iBAAiB,EAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAC5C,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,MAAM,CAAC,CA6CjB;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAMzE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GACZ,MAAM,EAAE,CAaV"}

package/dist/clients.js

@@ -119,7 +119,7 @@ function stringOrUndefined(value) {
  * "wrong secret" and "that client has no secret" are the same sentence to the
  * caller, because telling them apart is how a client list gets enumerated.
  */
-export async function authenticateClient(credentials, load) {
+export async function authenticateClient(credentials, load, now = new Date()) {
     if (credentials.clientId === undefined) {
         throw new OAuthError("invalid_client", "Client authentication failed.");
     }
@@ -147,6 +147,14 @@ export async function authenticateClient(credentials, load) {
         !secretMatches(credentials.clientSecret, client.secretHash)) {
         throw new OAuthError("invalid_client", "Client authentication failed.");
     }
+    // Registration may have answered `client_secret_expires_at`. This is where
+    // that answer becomes true: checked after the secret matched, so a wrong
+    // secret and an expired one are still the same sentence to the caller.
+    // Every endpoint that authenticates a client — token, introspection,
+    // revocation — arrives here, so one check covers all three.
+    if (client.secretExpiresAt !== undefined && client.secretExpiresAt <= now) {
+        throw new OAuthError("invalid_client", "Client authentication failed.");
+    }
     return client;
 }
 /** Is this grant one the client was registered for? */

package/dist/clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CACjC,SAAiB,EACjB,UAA6B;IAE7B,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,+CAA+C;QAC/C,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC;AAC/E,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAG/B;IACA,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE/D,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,sDAAsD,CACtD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,iEAAiE,CACjE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM;QAChB,GAAG,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE;YAC7B,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,oBAA6B,EAAE,CAAC;KACvE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,oBAAoB;IACpB,IAAI,CAAC;QACJ,OAAO;YACN,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACzD,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAC9D,MAAM,EAAE,qBAAqB;SAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,WAA8B,EAC9B,IAA4C;IAE5C,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,qEAAqE;IACrE,0DAA0D;IAC1D,IACC,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,uBAAuB,EACpD,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,mEAAmE;QACnE,gEAAgE;QAChE,yDAAyD;QACzD,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IACC,WAAW,CAAC,YAAY,KAAK,SAAS;QACtC,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,CAAC,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAC1D,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAgB;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9C,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,+BAA+B,KAAK,SAAS,CAC7C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC5B,SAA6B,EAC7B,MAAc;IAEd,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC1C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CACjC,SAAiB,EACjB,UAA6B;IAE7B,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACJ,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,+CAA+C;QAC/C,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC/B,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC;AAC/E,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAG/B;IACA,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE/D,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,sDAAsD,CACtD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,iEAAiE,CACjE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM;QAChB,GAAG,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE;YAC7B,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,oBAA6B,EAAE,CAAC;KACvE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,oBAAoB;IACpB,IAAI,CAAC;QACJ,OAAO;YACN,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACzD,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAC9D,MAAM,EAAE,qBAAqB;SAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,WAA8B,EAC9B,IAA4C,EAC5C,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,qEAAqE;IACrE,0DAA0D;IAC1D,IACC,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,uBAAuB,EACpD,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,mEAAmE;QACnE,gEAAgE;QAChE,yDAAyD;QACzD,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IACC,WAAW,CAAC,YAAY,KAAK,SAAS;QACtC,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,CAAC,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAC1D,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,4DAA4D;IAC5D,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,IAAI,GAAG,EAAE,CAAC;QAC3E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,KAAgB;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO;IAC9C,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,+BAA+B,KAAK,SAAS,CAC7C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC5B,SAA6B,EAC7B,MAAc;IAEd,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC1C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/configure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,UAAU,QAAQ;IACjB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,SAAS,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/C;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBjE"}
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA2BH,UAAU,QAAQ;IACjB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,SAAS,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/C;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBjE"}

package/dist/configure.js

@@ -22,11 +22,23 @@ import { stubsRoot } from "./stubs.js";
  * losing to a name that already exists.
  */
 const MIGRATION_STUB = "database/migrations/9000_create_visa_tables.stub";
+/**
+ * Columns added after the tables first shipped, one migration each.
+ *
+ * Written on every run: `makeUsingStub` leaves a file that already exists
+ * alone, so an application that configured an earlier version keeps its 9000
+ * and gains only what it is missing by running `ream configure` again.
+ */
+const UPGRADE_STUBS = [
+    "database/migrations/9001_add_visa_client_secret_expiry.stub",
+];
 export async function configure(codemods) {
     // Fail fast BEFORE touching the project: a pruned tarball or an unreadable
     // stub must not leave an application with a provider registered, a config
     // written and no tables to put anything in.
-    await access(resolve(stubsRoot, MIGRATION_STUB), constants.R_OK);
+    for (const stub of [MIGRATION_STUB, ...UPGRADE_STUBS]) {
+        await access(resolve(stubsRoot, stub), constants.R_OK);
+    }
     // The config below reads this, so it is declared here. Writing the file
     // without it leaves an application whose config asks the environment for
     // something nothing ever put there.
@@ -39,5 +51,8 @@ export async function configure(codemods) {
     // data layer deletes the file and keeps its own store — which is why this
     // is a migration and not a schema the package owns.
     await codemods.makeUsingStub(stubsRoot, MIGRATION_STUB);
+    for (const stub of UPGRADE_STUBS) {
+        await codemods.makeUsingStub(stubsRoot, stub);
+    }
 }
 //# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -1 +1 @@
-{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,kDAAkD,CAAC;AAkB1E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IACjD,2EAA2E;IAC3E,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAEjE,wEAAwE;IACxE,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzB,WAAW,EAAE,uBAAuB;KACpC,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC5D,yEAAyE;IACzE,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,kDAAkD,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,aAAa,GAAG;IACrB,6DAA6D;CAC7D,CAAC;AAkBF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IACjD,2EAA2E;IAC3E,0EAA0E;IAC1E,4CAA4C;IAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzB,WAAW,EAAE,uBAAuB;KACpC,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC5D,yEAAyE;IACzE,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;AACF,CAAC"}

package/dist/guard.d.ts

@@ -9,7 +9,8 @@
  * upstream rule read off `@adonisjs/auth`'s build rather than recalled.
  *
  * Two things this fixes for every application at once. A route gate no longer
- * has to introspect the token itself — the scopes are on the guard's token. And
+ * has to introspect the token itself — the scopes are on the guard's token,
+ * and only there: `user.permissions` stays the user's own. And
  * the user is fetched through the application's own provider on every request,
  * so an account disabled after the token was issued is refused here instead of
  * in each application that remembers to check.

package/dist/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,eAAe,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,IAAI,CAC5B,SAAS,EACP,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,mBAAmB,CACrB,CAAC;AAEF,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;GAMG;AACH,qBAAa,eAAe;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEZ,UAAU,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QACxB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KACf;IAUD,qEAAqE;IACrE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIhC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIhC;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAUhC,4CAA4C;IAC5C,SAAS,IAAI,OAAO;IAKpB,yEAAyE;IACzE,MAAM,IAAI;QACT,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;KACvB;CAaD;AAKD,MAAM,WAAW,eAAe;IAC/B;;;;OAIG;IACH,KAAK,EAAE,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACxD;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,SAAS;;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAGV,MAAM,EAAE,eAAe;IAUnC;;;;;;;;OAQG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC;IAM1C;;;;;;;OAOG;IACG,WAAW,CAChB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC7B,SAAS,GAAE,MAAM,EAAU,EAC3B,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,eAAe,CAAC;IAgC3B;;;;;;;;;;OAUG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1D;;;;;;OAMG;IACG,oBAAoB,CACzB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC7B,SAAS,GAAE,MAAM,EAAU,EAC3B,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,mBAAmB,CAAC;IAK/B;;;;;;;;OAQG;IACH,SAAS,CACR,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GACzD,MAAM;IAUH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CAsDrD;AAsBD,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAE5D"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,eAAe,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,IAAI,CAC5B,SAAS,EACP,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,mBAAmB,CACrB,CAAC;AAEF,0FAA0F;AAC1F,MAAM,WAAW,WAAW;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;GAMG;AACH,qBAAa,eAAe;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEZ,UAAU,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QACxB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KACf;IAUD,qEAAqE;IACrE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIhC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIhC;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAUhC,4CAA4C;IAC5C,SAAS,IAAI,OAAO;IAKpB,yEAAyE;IACzE,MAAM,IAAI;QACT,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;KACvB;CAaD;AAKD,MAAM,WAAW,eAAe;IAC/B;;;;OAIG;IACH,KAAK,EAAE,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACxD;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,SAAS;;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAGV,MAAM,EAAE,eAAe;IAUnC;;;;;;;;OAQG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC;IAM1C;;;;;;;OAOG;IACG,WAAW,CAChB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC7B,SAAS,GAAE,MAAM,EAAU,EAC3B,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,eAAe,CAAC;IAgC3B;;;;;;;;;;OAUG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1D;;;;;;OAMG;IACG,oBAAoB,CACzB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC7B,SAAS,GAAE,MAAM,EAAU,EAC3B,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,mBAAmB,CAAC;IAK/B;;;;;;;;OAQG;IACH,SAAS,CACR,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GACzD,MAAM;IAUH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CA8DrD;AAsBD,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAE5D"}

package/dist/guard.js

@@ -9,7 +9,8 @@
  * upstream rule read off `@adonisjs/auth`'s build rather than recalled.
  *
  * Two things this fixes for every application at once. A route gate no longer
- * has to introspect the token itself — the scopes are on the guard's token. And
+ * has to introspect the token itself — the scopes are on the guard's token,
+ * and only there: `user.permissions` stays the user's own. And
  * the user is fetched through the application's own provider on every request,
  * so an account disabled after the token was issued is refused here instead of
  * in each application that remembers to check.
@@ -224,7 +225,12 @@ export class VisaGuard {
     async verify(presented) {
         const store = this.#store();
         const now = new Date();
-        const verified = await verifyAccessToken(presented, store, now);
+        // The resource this guard declares is the resource it enforces. Passing
+        // it is the whole of RFC 8707 on this side: without it a token minted
+        // for another resource server — one the same authorization server also
+        // serves — is honoured here, and the `resource` advertised in the
+        // challenge is a claim nothing backs.
+        const verified = await verifyAccessToken(presented, store, now, this.#config.resource);
         if (verified === null) {
             return { authenticated: false, error: "Invalid or expired access token" };
         }
@@ -253,19 +259,17 @@ export class VisaGuard {
         });
         // A copy: the provider's object is the application's, and a guard that
         // mutated it would leak one request's token into the next.
+        //
+        // The scopes go on `currentAccessToken` and NOWHERE else — upstream's
+        // access-tokens guard leaves the user model untouched the same way. They
+        // are never merged into `permissions`: a scope is chosen by the client's
+        // registration and granted by consent, which never checks that the user
+        // holds a permission of the same name, so a merge would hand any user a
+        // route permission they lack the moment a scope is named like one
+        // (`orders:write`). And a token limited to `profile` must not carry the
+        // user's other rights to a third-party client either: the two axes meet
+        // only as an intersection, `permission && currentAccessToken.allows(...)`.
         const user = { ...subject, currentAccessToken: token };
-        if (verified.scopes.length > 0) {
-            // Scopes surface on `permissions` as well, the way warden's access-token
-            // guard does it, so `ctx.auth.user.permissions` reads the same whichever
-            // guard authenticated.
-            //
-            // They remain a SEPARATE axis from the route-level rights gate, exactly
-            // as upstream: a token ability is checked with
-            // `currentAccessToken.allows(...)`, and Bouncer does not consult it.
-            user.permissions = [
-                ...new Set([...(subject.permissions ?? []), ...verified.scopes]),
-            ];
-        }
         return { authenticated: true, user };
     }
 }

package/dist/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA+CzD;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAC3B,0EAA0E;IACjE,QAAQ,CAAS;IAC1B,mEAAmE;IAC1D,MAAM,CAAU;IACzB,sEAAsE;IAC7D,SAAS,CAAW;IAC7B;;;;;;OAMG;IACM,IAAI,CAAgB;IACpB,SAAS,CAAc;IACvB,UAAU,CAAc;IACjC;;;;;;;OAOG;IACM,KAAK,CAAU;IAExB,YAAY,UAQX;QACA,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,IAAI,CAAC;QAChD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IACnE,CAAC;IAED,qEAAqE;IACrE,MAAM,CAAC,OAAe;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,OAAe;QACrB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,OAAe;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,CACtB,4CAA4C,OAAO,GAAG,CACV,CAAC;QAC9C,KAAK,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACrC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,MAAM,KAAK,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,SAAS;QACR,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,yEAAyE;IACzE,MAAM;QASL,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,mEAAmE;YACnE,0DAA0D;YAC1D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC;IACH,CAAC;CACD;AAED,sDAAsD;AACtD,MAAM,WAAW,GAAG,IAAI,CAAC;AAiDzB;;;;;GAKG;AACH,MAAM,OAAO,SAAS;IACZ,IAAI,CAAS;IACb,OAAO,CAAkB;IAElC,YAAY,MAAuB;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC;IACnC,CAAC;IAED,MAAM;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY;QACjB,MAAM,IAAI,KAAK,CACd,yFAAyF,CACzF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAChB,IAA6B,EAC7B,YAAsB,CAAC,GAAG,CAAC,EAC3B,UAAwD,EAAE;QAE1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACd,oJAAoJ,CACpJ,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GACR,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,WAAW,CAAC;QAC1E,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QAEpD,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC;YACnC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC;YAC7B,QAAQ;YACR,MAAM;YACN,MAAM,EAAE,SAAS;YACjB,SAAS;SACT,CAAC,CAAC;QAEH,OAAO,IAAI,eAAe,CAAC;YAC1B,QAAQ;YACR,MAAM;YACN,SAAS;YACT,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,SAAS;YACT,uCAAuC;YACvC,KAAK,EAAE,MAAM;SACb,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACzB,IAA6B,EAC7B,YAAsB,CAAC,GAAG,CAAC,EAC3B,UAAwD,EAAE;QAE1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;IAChE,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CACR,UAAyD,EAAE;QAE3D,OAAO,eAAe,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QAC3E,CAAC;QAED,MAAM,OAAO,GACZ,QAAQ,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3D,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/C,uEAAuE;YACvE,gDAAgD;YAChD,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,QAAQ,CAAC,MAAM,KAAK,SAAS;oBAC5B,CAAC,CAAC,kCAAkC;oBACpC,CAAC,CAAC,sDAAsD;aAC1D,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrE,SAAS,EAAE,QAAQ,CAAC,MAAM;YAC1B,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;YACrC,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;SACvC,CAAC,CAAC;QAEH,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,IAAI,GAAc,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,yEAAyE;YACzE,yEAAyE;YACzE,uBAAuB;YACvB,EAAE;YACF,wEAAwE;YACxE,+CAA+C;YAC/C,qEAAqE;YACrE,IAAI,CAAC,WAAW,GAAG;gBAClB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;aAChE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;CACD;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CACnB,KAAiB,EACjB,SAAiB,EACjB,GAAS;IAET,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO;IACjD,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACR,yEAAyE;QACzE,wBAAwB;IACzB,CAAC;AACF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,MAAuB;IAChD,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA+CzD;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAC3B,0EAA0E;IACjE,QAAQ,CAAS;IAC1B,mEAAmE;IAC1D,MAAM,CAAU;IACzB,sEAAsE;IAC7D,SAAS,CAAW;IAC7B;;;;;;OAMG;IACM,IAAI,CAAgB;IACpB,SAAS,CAAc;IACvB,UAAU,CAAc;IACjC;;;;;;;OAOG;IACM,KAAK,CAAU;IAExB,YAAY,UAQX;QACA,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,IAAI,CAAC;QAChD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IACnE,CAAC;IAED,qEAAqE;IACrE,MAAM,CAAC,OAAe;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,OAAe;QACrB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,OAAe;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,CACtB,4CAA4C,OAAO,GAAG,CACV,CAAC;QAC9C,KAAK,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACrC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,MAAM,KAAK,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,SAAS;QACR,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,yEAAyE;IACzE,MAAM;QASL,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,mEAAmE;YACnE,0DAA0D;YAC1D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC;IACH,CAAC;CACD;AAED,sDAAsD;AACtD,MAAM,WAAW,GAAG,IAAI,CAAC;AAiDzB;;;;;GAKG;AACH,MAAM,OAAO,SAAS;IACZ,IAAI,CAAS;IACb,OAAO,CAAkB;IAElC,YAAY,MAAuB;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC;IACnC,CAAC;IAED,MAAM;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACjC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY;QACjB,MAAM,IAAI,KAAK,CACd,yFAAyF,CACzF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAChB,IAA6B,EAC7B,YAAsB,CAAC,GAAG,CAAC,EAC3B,UAAwD,EAAE;QAE1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACd,oJAAoJ,CACpJ,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GACR,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,WAAW,CAAC;QAC1E,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QAEpD,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC;YACnC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC;YAC7B,QAAQ;YACR,MAAM;YACN,MAAM,EAAE,SAAS;YACjB,SAAS;SACT,CAAC,CAAC;QAEH,OAAO,IAAI,eAAe,CAAC;YAC1B,QAAQ;YACR,MAAM;YACN,SAAS;YACT,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,SAAS;YACT,uCAAuC;YACvC,KAAK,EAAE,MAAM;SACb,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACzB,IAA6B,EAC7B,YAAsB,CAAC,GAAG,CAAC,EAC3B,UAAwD,EAAE;QAE1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;IAChE,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CACR,UAAyD,EAAE;QAE3D,OAAO,eAAe,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,kEAAkE;QAClE,sCAAsC;QACtC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACvC,SAAS,EACT,KAAK,EACL,GAAG,EACH,IAAI,CAAC,OAAO,CAAC,QAAQ,CACrB,CAAC;QACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QAC3E,CAAC;QAED,MAAM,OAAO,GACZ,QAAQ,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3D,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/C,uEAAuE;YACvE,gDAAgD;YAChD,OAAO;gBACN,aAAa,EAAE,KAAK;gBACpB,KAAK,EACJ,QAAQ,CAAC,MAAM,KAAK,SAAS;oBAC5B,CAAC,CAAC,kCAAkC;oBACpC,CAAC,CAAC,sDAAsD;aAC1D,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrE,SAAS,EAAE,QAAQ,CAAC,MAAM;YAC1B,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;YACrC,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;SACvC,CAAC,CAAC;QAEH,uEAAuE;QACvE,2DAA2D;QAC3D,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,kEAAkE;QAClE,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAc,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;QAClE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;CACD;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CACnB,KAAiB,EACjB,SAAiB,EACjB,GAAS;IAET,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO;IACjD,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACR,yEAAyE;QACzE,wBAAwB;IACzB,CAAC;AACF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,MAAuB;IAChD,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC"}

package/dist/index.d.ts

@@ -26,5 +26,5 @@ export { type AtlasDb, type AtlasQuery, AtlasStore, type AtlasStoreTables, } fro
 export { MemoryStore } from "./stores/memory.js";
 export { type TokenOptions, type TokenRequest, token } from "./token.js";
 export type { AccessToken, AuthorizationCode, AuthorizedApplication, Client, ClientAuthMethod, Consent, GrantType, IntrospectionResponse, RefreshToken, TokenResponse, } from "./types.js";
-export { type AuthorizationOutcome, type VisaConfig, VisaManager, } from "./VisaManager.js";
+export { type AuthorizationOutcome, type ConsentTicket, type VisaConfig, VisaManager, } from "./VisaManager.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,eAAe,EACf,kBAAkB,EAClB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EACN,KAAK,sBAAsB,EAC3B,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,eAAe,EACf,SAAS,EACT,KAAK,eAAe,EACpB,SAAS,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,eAAe,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,SAAS,EACT,OAAO,IAAI,IAAI,EACf,OAAO,EACP,OAAO,GACP,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,UAAU,EACf,UAAU,EACV,KAAK,gBAAgB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACzE,YAAY,EACX,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,EACN,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,qBAAqB,EACrB,YAAY,EACZ,aAAa,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,WAAW,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,eAAe,EACf,kBAAkB,EAClB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EACN,KAAK,sBAAsB,EAC3B,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,eAAe,EACf,SAAS,EACT,KAAK,eAAe,EACpB,SAAS,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,eAAe,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,SAAS,EACT,OAAO,IAAI,IAAI,EACf,OAAO,EACP,OAAO,GACP,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,UAAU,EACf,UAAU,EACV,KAAK,gBAAgB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACzE,YAAY,EACX,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,EACN,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,qBAAqB,EACrB,YAAY,EACZ,aAAa,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,WAAW,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAGN,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EAEnB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAElB,eAAe,EACf,kBAAkB,EAClB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAwB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAEN,UAAU,EAIV,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAKN,eAAe,EACf,SAAS,EAET,SAAS,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,wBAAwB,EAExB,uBAAuB,EAGvB,yBAAyB,EACzB,4BAA4B,EAC5B,eAAe,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAIN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,SAAS,EACT,OAAO,IAAI,IAAI,EACf,OAAO,EACP,OAAO,GACP,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAGN,UAAU,GAEV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAwC,KAAK,EAAE,MAAM,YAAY,CAAC;AAazE,OAAO,EAGN,WAAW,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAGN,aAAa,EACb,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EAEnB,4BAA4B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAElB,eAAe,EACf,kBAAkB,EAClB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAwB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAEN,UAAU,EAIV,SAAS,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAKN,eAAe,EACf,SAAS,EAET,SAAS,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACN,wBAAwB,EAExB,uBAAuB,EAGvB,yBAAyB,EACzB,4BAA4B,EAC5B,eAAe,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAIN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,SAAS,EACT,OAAO,IAAI,IAAI,EACf,OAAO,EACP,OAAO,GACP,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAGN,UAAU,GAEV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAwC,KAAK,EAAE,MAAM,YAAY,CAAC;AAazE,OAAO,EAIN,WAAW,GACX,MAAM,kBAAkB,CAAC"}

package/dist/register.d.ts

@@ -92,5 +92,16 @@ export declare function validateRegistration(request: ClientRegistrationRequest,
     name: string;
 };
 /** The 201 body for a client that was just created. */
-export declare function registrationResponse(client: Client, issuedAt: Date, secret: string | undefined, options: RegistrationOptions): ClientRegistrationResponse;
+export declare function registrationResponse(client: Client, issuedAt: Date, secret: string | undefined): ClientRegistrationResponse;
+/**
+ * When a secret issued now stops working, or `undefined` for never.
+ *
+ * The TTL is the deployment's value, not the client's, so a bad one is a
+ * configuration mistake and says so — `VisaError`, not an OAuth error the
+ * caller would read as their own fault. Refused rather than rounded: a
+ * fractional or negative TTL means someone intended something this cannot
+ * carry out, and a secret quietly issued already-expired (or never expiring)
+ * is the worse answer either way.
+ */
+export declare function secretExpiryFor(issuedAt: Date, ttlSeconds: number | undefined): Date | undefined;
 //# sourceMappingURL=register.d.ts.map

package/dist/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEtE,yEAAyE;AACzE,MAAM,WAAW,yBAAyB;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,0BAA0B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,0BAA0B,EAAE,gBAAgB,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,oFAAoF;IACpF,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,mBAAmB,EAC5B,cAAc,CAAC,EAAE,MAAM,GACrB;IACF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,gBAAgB,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;CACb,CAmDA;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,mBAAmB,GAC1B,0BAA0B,CAsB5B"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEtE,yEAAyE;AACzE,MAAM,WAAW,yBAAyB;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,0BAA0B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,0BAA0B,EAAE,gBAAgB,CAAC;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,oFAAoF;IACpF,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAOD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,yBAAyB,EAClC,OAAO,EAAE,mBAAmB,EAC5B,cAAc,CAAC,EAAE,MAAM,GACrB;IACF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,EAAE,gBAAgB,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;CACb,CAyDA;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,IAAI,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,0BAA0B,CA2B5B;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,IAAI,EACd,UAAU,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,GAAG,SAAS,CAUlB"}

package/dist/register.js

@@ -19,7 +19,8 @@
  * for. That is the difference between letting a client name itself and letting
  * it decide what it may do.
  */
-import { OAuthError } from "./errors.js";
+import { hashMatches, sha256 } from "./crypto.js";
+import { OAuthError, VisaError } from "./errors.js";
 const DEFAULT_GRANTS = [
     "authorization_code",
     "refresh_token",
@@ -35,10 +36,14 @@ export function validateRegistration(request, options, presentedToken) {
         throw new OAuthError("invalid_client_metadata", "This server does not accept client registrations.");
     }
     if (options.initialAccessToken !== undefined) {
-        // Constant-time is not the point here: the token is compared once per
-        // registration, and a registration endpoint is not a guessing oracle
-        // worth the machinery. Absent or wrong reads the same to the caller.
-        if (presentedToken !== options.initialAccessToken) {
+        // Constant time, like every other secret here. This one is a static,
+        // operator-chosen string — often shorter than a minted token — that an
+        // anonymous caller may test once per request, as often as they like.
+        // Both sides are hashed first so the comparison never depends on the
+        // configured length either. Absent or wrong reads the same to the caller.
+        if (presentedToken === undefined ||
+            presentedToken === "" ||
+            !hashMatches(sha256(presentedToken), sha256(options.initialAccessToken))) {
             throw new OAuthError("invalid_client_metadata", "Registration on this server needs an initial access token.");
         }
     }
@@ -68,7 +73,7 @@ export function validateRegistration(request, options, presentedToken) {
     };
 }
 /** The 201 body for a client that was just created. */
-export function registrationResponse(client, issuedAt, secret, options) {
+export function registrationResponse(client, issuedAt, secret) {
     const seconds = Math.floor(issuedAt.getTime() / 1000);
     return {
         client_id: client.id,
@@ -76,12 +81,17 @@ export function registrationResponse(client, issuedAt, secret, options) {
         client_id_issued_at: seconds,
         // REQUIRED when a secret was issued, and `0` is the spelling for "never"
         // — not an omission, which would mean the field was not answered.
+        //
+        // Read off the client rather than recomputed from the options: the
+        // answer and the stored expiry are then the same value by construction,
+        // and cannot drift into a server that announces an expiry it does not
+        // enforce.
         ...(secret === undefined
             ? {}
             : {
-                client_secret_expires_at: options.secretTtlSeconds === undefined
+                client_secret_expires_at: client.secretExpiresAt === undefined
                     ? 0
-                    : seconds + options.secretTtlSeconds,
+                    : Math.floor(client.secretExpiresAt.getTime() / 1000),
             }),
         redirect_uris: client.redirectUris,
         grant_types: client.grantTypes,
@@ -132,13 +142,38 @@ function assertRedirectUri(value) {
         return;
     throw new OAuthError("invalid_redirect_uri", `${value} must use https, or http on a loopback address.`);
 }
+/**
+ * When a secret issued now stops working, or `undefined` for never.
+ *
+ * The TTL is the deployment's value, not the client's, so a bad one is a
+ * configuration mistake and says so — `VisaError`, not an OAuth error the
+ * caller would read as their own fault. Refused rather than rounded: a
+ * fractional or negative TTL means someone intended something this cannot
+ * carry out, and a secret quietly issued already-expired (or never expiring)
+ * is the worse answer either way.
+ */
+export function secretExpiryFor(issuedAt, ttlSeconds) {
+    if (ttlSeconds === undefined)
+        return undefined;
+    if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
+        throw new VisaError("E_VISA_INVALID_SECRET_TTL", `registration.secretTtlSeconds must be a positive whole number of seconds; received ${ttlSeconds}.`, { hint: "Leave it out for a secret that never expires." });
+    }
+    return new Date(issuedAt.getTime() + ttlSeconds * 1000);
+}
 function readStringList(value) {
     if (value === undefined || value === null)
         return [];
     if (!Array.isArray(value)) {
         throw new OAuthError("invalid_client_metadata", "redirect_uris and grant_types must be arrays of strings.");
     }
-    return value.filter((entry) => typeof entry === "string");
+    // Refused, not filtered. Dropping the entries that are not strings answers
+    // 201 to a request nobody wrote: `["https://app/cb", 42]` registered one
+    // redirect uri while the client believed it had registered two, and the
+    // second one silently not working is found much later, by a user.
+    if (value.some((entry) => typeof entry !== "string")) {
+        throw new OAuthError("invalid_client_metadata", "redirect_uris and grant_types must be arrays of strings.");
+    }
+    return [...value];
 }
 function readScope(value) {
     if (value === undefined || value === null)

package/dist/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgEzC,MAAM,cAAc,GAAyB;IAC5C,oBAAoB;IACpB,eAAe;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAkC,EAClC,OAA4B,EAC5B,cAAuB;IAQvB,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,mDAAmD,CACnD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC9C,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,cAAc,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,4DAA4D,CAC5D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE/D,4EAA4E;IAC5E,6CAA6C;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,6DAA6D,CAC7D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY;QAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC/E,CAAC;IACH,CAAC;IAED,OAAO;QACN,YAAY;QACZ,UAAU;QACV,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,EAAE,SAAS;QACjB,uBAAuB,EAAE,cAAc,CAAC,OAAO,CAAC,0BAA0B,CAAC;QAC3E,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;KACnC,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CACnC,MAAc,EACd,QAAc,EACd,MAA0B,EAC1B,OAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO;QACN,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QAC1D,mBAAmB,EAAE,OAAO;QAC5B,yEAAyE;QACzE,kEAAkE;QAClE,GAAG,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACA,wBAAwB,EACvB,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACrC,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,gBAAgB;aACtC,CAAC;QACJ,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;QAC1D,WAAW,EAAE,MAAM,CAAC,IAAI;QACxB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,KAAc,EACd,OAA4B;IAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACrD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,kCAAkC,KAAK,qCAAqC,CAC5E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,0BAA0B,CAClC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,6BAA6B,CACrC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACtC,MAAM,QAAQ,GACb,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ;QAAE,OAAO;IACjD,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,iDAAiD,CACzD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,yCAAyC,CACzC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,qBAAqB,CAAC;IACxE,IACC,KAAK,KAAK,qBAAqB;QAC/B,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,MAAM,EACf,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,8BAA8B,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAC/D,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1E,yEAAyE;IACzE,kDAAkD;IAClD,OAAO,gBAAgB,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IACjC,OAAO,CACN,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,oBAAoB,CAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAgEpD,MAAM,cAAc,GAAyB;IAC5C,oBAAoB;IACpB,eAAe;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAkC,EAClC,OAA4B,EAC5B,cAAuB;IAQvB,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,mDAAmD,CACnD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC9C,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,0EAA0E;QAC1E,IACC,cAAc,KAAK,SAAS;YAC5B,cAAc,KAAK,EAAE;YACrB,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EACvE,CAAC;YACF,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,4DAA4D,CAC5D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE/D,4EAA4E;IAC5E,6CAA6C;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,6DAA6D,CAC7D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY;QAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC/E,CAAC;IACH,CAAC;IAED,OAAO;QACN,YAAY;QACZ,UAAU;QACV,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,EAAE,SAAS;QACjB,uBAAuB,EAAE,cAAc,CAAC,OAAO,CAAC,0BAA0B,CAAC;QAC3E,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;KACnC,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CACnC,MAAc,EACd,QAAc,EACd,MAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO;QACN,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;QAC1D,mBAAmB,EAAE,OAAO;QAC5B,yEAAyE;QACzE,kEAAkE;QAClE,EAAE;QACF,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,WAAW;QACX,GAAG,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACA,wBAAwB,EACvB,MAAM,CAAC,eAAe,KAAK,SAAS;oBACnC,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;aACvD,CAAC;QACJ,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;QAC1D,WAAW,EAAE,MAAM,CAAC,IAAI;QACxB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,KAAc,EACd,OAA4B;IAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACrD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,kCAAkC,KAAK,qCAAqC,CAC5E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,0BAA0B,CAClC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,6BAA6B,CACrC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACtC,MAAM,QAAQ,GACb,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ;QAAE,OAAO;IACjD,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,GAAG,KAAK,iDAAiD,CACzD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAc,EACd,UAA8B;IAE9B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAClB,2BAA2B,EAC3B,sFAAsF,UAAU,GAAG,EACnG,EAAE,IAAI,EAAE,+CAA+C,EAAE,CACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,yCAAyC,CACzC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,qBAAqB,CAAC;IACxE,IACC,KAAK,KAAK,qBAAqB;QAC/B,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,MAAM,EACf,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,UAAU,CACnB,yBAAyB,EACzB,8BAA8B,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAC/D,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1E,yEAAyE;IACzE,kDAAkD;IAClD,OAAO,gBAAgB,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IACjC,OAAO,CACN,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,oBAAoB,CAC9B,CAAC;AACH,CAAC"}

package/dist/store.d.ts

@@ -11,6 +11,16 @@
 import type { AccessToken, AuthorizationCode, Client, Consent, RefreshToken } from "./types.js";
 export interface VisaStore {
     findClient(id: string): Promise<Client | null>;
+    /**
+     * Persist a client — what `registerClient`, and so dynamic registration
+     * (RFC 7591), writes through. Awaited: a 201 carrying a secret for a
+     * client whose insert failed would hand out a credential nothing accepts.
+     *
+     * Optional, for a store whose clients live in a table another service
+     * owns. Without it `registerClient` refuses, and a server with
+     * registration turned on refuses to boot.
+     */
+    saveClient?(client: Client): Promise<void>;
     saveAuthorizationCode(code: AuthorizationCode): Promise<void>;
     findAuthorizationCode(codeHash: string): Promise<AuthorizationCode | null>;
     /**