@c9up/visa 0.1.3 → 0.1.4

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAElB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,eAAe,CAAC;AAavB,MAAM,QAAQ,GAAG;IAChB,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACzC,kBAAkB,EAAE,IAAI;CACxB,CAAC;AAKF,MAAM,CAAC,KAAK,UAAU,KAAK,CAC1B,OAAqB,EACrB,WAA8B,EAC9B,KAAgB,EAChB,UAAwB,EAAE,EAC1B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CACpB,CAAC;IAEF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CACnB,wBAAwB,EACxB,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU;YAC3C,CAAC,CAAC,OAAO,KAAK,kCAAkC;YAChD,CAAC,CAAC,SAAS,CACZ,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAElC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC/B,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,CACN,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,oBAAoB,CAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAC1B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnD,2EAA2E;IAC3E,kBAAkB;IAClB,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,OAAO,CAAC;IAEtD,IACC,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAC3E,CAAC;QACF,MAAM,OAAO,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,SAAS,GAAG,eAAe,CAChC,iBAAiB,CAChB,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B,EACD,MAAM,CAAC,SAAS,IAAI,EAAE,CACtB,CAAC;IAEF,OAAO,KAAK,CACX;QACC,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,SAAS;KACT,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,MAAM,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,yCAAyC;AACzC,SAAS,eAAe,CACvB,QAAgB,EAChB,SAAiB,EACjB,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,UAAU,CAC7B,eAAe,EACf,iCAAiC,CACjC,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;IAElD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,0EAA0E;IAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GACX,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC;IAE7E,OAAO,KAAK,CACX;QACC,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,eAAe,CACzB,iBAAiB,CAChB,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B,EACD,MAAM,CAAC,SAAS,IAAI,EAAE,CACtB;KACD,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,SAAiB,EAAE,OAA0B;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,mCAAmC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,KAAK,CACX;QACC,MAAM;QACN,MAAM;QACN,iEAAiE;QACjE,kEAAkE;QAClE,SAAS,EAAE,iBAAiB,CAC3B,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B;KACD,EACD,KAAK,EACL,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EACzC,GAAG,CACH,CAAC;AACH,CAAC;AAWD,4CAA4C;AAC5C,KAAK,UAAU,KAAK,CACnB,KAAa,EACb,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GACd,OAAO,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB,CAAC;IACjE,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAElC,MAAM,KAAK,CAAC,eAAe,CAAC;QAC3B,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAChE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;KACjC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC/B,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC7B,CAAC;IAEF,MAAM,YAAY,GACjB,CAAC,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,kBAAkB,CAAC;QAC3D,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEnE,MAAM,UAAU,GACf,OAAO,CAAC,sBAAsB,IAAI,QAAQ,CAAC,sBAAsB,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC5B,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACtD,uEAAuE;QACvE,8DAA8D;QAC9D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAChE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,GAAG,YAAY,CAAC;IACtC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAElB,aAAa,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,eAAe,EACf,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,eAAe,CAAC;AAavB,MAAM,QAAQ,GAAG;IAChB,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACzC,kBAAkB,EAAE,IAAI;CACxB,CAAC;AAKF,MAAM,CAAC,KAAK,UAAU,KAAK,CAC1B,OAAqB,EACrB,WAA8B,EAC9B,KAAgB,EAChB,UAAwB,EAAE,EAC1B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CACpB,CAAC;IAEF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CACnB,wBAAwB,EACxB,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU;YAC3C,CAAC,CAAC,OAAO,KAAK,kCAAkC;YAChD,CAAC,CAAC,SAAS,CACZ,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAElC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC/B,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,CACN,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,oBAAoB,CAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAC1B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnD,2EAA2E;IAC3E,kBAAkB;IAClB,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,OAAO,CAAC;IAEtD,IACC,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAC3E,CAAC;QACF,MAAM,OAAO,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,SAAS,GAAG,eAAe,CAChC,iBAAiB,CAChB,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B,EACD,MAAM,CAAC,SAAS,IAAI,EAAE,CACtB,CAAC;IAEF,OAAO,KAAK,CACX;QACC,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,SAAS;KACT,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,QAAgB;IACnC,OAAO,MAAM,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,yCAAyC;AACzC,SAAS,eAAe,CACvB,QAAgB,EAChB,SAAiB,EACjB,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,UAAU,CAC7B,eAAe,EACf,iCAAiC,CACjC,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC;IACpE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;IAElD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC;IAE3C,0EAA0E;IAC1E,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GACX,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,eAAe,CAChC,iBAAiB,CAChB,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B,EACD,MAAM,CAAC,SAAS,IAAI,EAAE,CACtB,CAAC;IAEF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC;IAE7E,OAAO,KAAK,CACX;QACC,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS;QACT,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,OAAO,EAAE;YACR,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;SACjC;KACD,EACD,KAAK,EACL,OAAO,EACP,GAAG,CACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,SAAiB,EAAE,OAA0B;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CACnB,eAAe,EACf,mCAAmC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,MAAc,EACd,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC/C,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,IAAI,UAAU,CACnB,qBAAqB,EACrB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,KAAK,CACX;QACC,MAAM;QACN,MAAM;QACN,iEAAiE;QACjE,kEAAkE;QAClE,SAAS,EAAE,iBAAiB,CAC3B,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvC,OAAO,CAAC,kBAAkB,CAC1B;KACD,EACD,KAAK,EACL,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EACzC,GAAG,CACH,CAAC;AACH,CAAC;AAkBD,4CAA4C;AAC5C,KAAK,UAAU,KAAK,CACnB,KAAa,EACb,KAAgB,EAChB,OAAqB,EACrB,GAAS;IAET,MAAM,SAAS,GACd,OAAO,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB,CAAC;IACjE,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;IAElC,MAAM,KAAK,CAAC,eAAe,CAAC;QAC3B,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAChE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;KACjC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC/B,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC7B,CAAC;IAEF,MAAM,YAAY,GACjB,CAAC,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,kBAAkB,CAAC;QAC3D,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEnE,MAAM,UAAU,GACf,OAAO,CAAC,sBAAsB,IAAI,QAAQ,CAAC,sBAAsB,CAAC;IACnE,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IAC5D,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IAC3E,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC5B,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACtD,uEAAuE;QACvE,8DAA8D;QAC9D,GAAG,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;KACzE,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,GAAG,YAAY,CAAC;IACtC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/visa",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Visa — OAuth 2.1 authorization server for the Ream framework: authorization code with PKCE, refresh rotation, revocation and introspection, on a store contract",
   "license": "MIT",
   "type": "module",

package/src/VisaManager.ts

@@ -21,7 +21,7 @@ import {
 	readCredentials,
 	redirectUriMatches,
 } from "./clients.js";
-import { hashSecret, randomToken } from "./crypto.js";
+import { hashMatches, hashSecret, randomToken, sha256 } from "./crypto.js";
 import { OAuthError, VisaError } from "./errors.js";
 import { introspect, revoke, verifyAccessToken } from "./introspect.js";
 import {
@@ -49,8 +49,33 @@ export interface VisaConfig extends AuthorizeOptions, TokenOptions {
 	store: VisaStore;
 	/** Whether clients may register themselves, and on what terms (RFC 7591). */
 	registration?: RegistrationOptions;
+	/**
+	 * How long a consent page may stay open before its answer is refused, in
+	 * seconds. Ten minutes by default — see {@link VisaManager.consentTicket}.
+	 */
+	consentTicketTtlSeconds?: number;
+}
+
+/**
+ * What the application keeps server-side between the consent page and the
+ * POST that answers it — in the session, never in the form.
+ *
+ * Plain values only, so any session store can hold it: the request as it was
+ * validated, not the client record (which carries the secret's hash).
+ */
+export interface ConsentTicket {
+	/** Random, 256 bits. The consent form posts it back; nothing else does. */
+	id: string;
+	/** Who was asked. Another user answering it is refused. */
+	userId: string;
+	/** Milliseconds since the epoch. */
+	expiresAt: number;
+	/** The authorization request, rebuilt from what was validated. */
+	request: AuthorizationRequest;
 }
 
+const DEFAULT_CONSENT_TICKET_TTL_SECONDS = 600;
+
 /** What `authorize()` decided. */
 export type AuthorizationOutcome =
 	/** Send the user here. */
@@ -71,6 +96,7 @@ export class VisaManager {
 		// with a broken issuer answers every metadata fetch with something no
 		// client can use, and says so nowhere.
 		this.#config = { ...config, issuer: normalizeIssuer(config.issuer) };
+		assertRegistration(config);
 	}
 
 	get issuer(): string {
@@ -122,16 +148,10 @@ export class VisaManager {
 				: { secretExpiresAt: input.secretExpiresAt }),
 		};
 		const store = this.#config.store;
-		if (!("addClient" in store) || typeof store.addClient !== "function") {
-			throw new VisaError(
-				"E_VISA_STORE_READ_ONLY",
-				"This store cannot register clients; create them where they live.",
-				{
-					hint: "MemoryStore.addClient exists; a database store registers rows.",
-				},
-			);
-		}
-		store.addClient(client);
+		if (store.saveClient === undefined) throw readOnlyStore();
+		// Awaited: the secret below is handed out once, and handing it out for a
+		// client whose write failed is a credential nothing will ever accept.
+		await store.saveClient(client);
 		return secret === undefined ? { client } : { client, secret };
 	}
 
@@ -245,6 +265,92 @@ export class VisaManager {
 		return successRedirect(validated, code);
 	}
 
+	/**
+	 * Remember what the consent page asks, so its answer cannot change it.
+	 *
+	 * The application puts the ticket in the user's session, renders its `id`
+	 * as a hidden field, and on the POST hands both to
+	 * {@link redeemConsentTicket}. What gets granted is then the request the
+	 * user was shown — not whatever parameters the POST carries — and the
+	 * session makes it single use (`session.pull`) and bound to this browser.
+	 */
+	consentTicket(
+		validated: ValidatedRequest,
+		userId: string,
+		now: Date = new Date(),
+	): ConsentTicket {
+		const ttl =
+			this.#config.consentTicketTtlSeconds ??
+			DEFAULT_CONSENT_TICKET_TTL_SECONDS;
+		return {
+			id: randomToken(),
+			userId,
+			expiresAt: now.getTime() + ttl * 1000,
+			request: {
+				response_type: "code",
+				client_id: validated.client.id,
+				redirect_uri: validated.redirectUri,
+				// Joined from what was resolved, so an omitted `scope` that
+				// defaulted to the client's list is the list the user saw, even
+				// if the client registers more by the time the user answers.
+				scope: validated.scopes.join(" "),
+				code_challenge: validated.codeChallenge,
+				code_challenge_method: validated.codeChallengeMethod,
+				...(validated.state === undefined ? {} : { state: validated.state }),
+				...(validated.nonce === undefined ? {} : { nonce: validated.nonce }),
+				...(validated.resources.length === 0
+					? {}
+					: { resource: [...validated.resources] }),
+			},
+		};
+	}
+
+	/**
+	 * The consent page's answer, checked against the ticket it was rendered with.
+	 *
+	 * `ticket` is what the session held — pulled, not read, so a second POST
+	 * of the same form finds nothing. `presentedId` is the form's hidden field:
+	 * it must name THIS ticket, which is what stops a form left open in one tab
+	 * from approving the request another tab put in the session since. The
+	 * request is validated again — the client may have lost a scope or a
+	 * redirect URI meanwhile — and no code is minted: that is `grant`'s job,
+	 * once the user said yes.
+	 *
+	 * `null` for anything wrong: no ticket, another ticket, another user,
+	 * expired, or a request that no longer validates. The user starts again.
+	 */
+	async redeemConsentTicket(
+		ticket: unknown,
+		presentedId: unknown,
+		userId: string,
+		now: Date = new Date(),
+	): Promise<ValidatedRequest | null> {
+		const read = readConsentTicket(ticket);
+		if (read === null || typeof presentedId !== "string") return null;
+		if (!hashMatches(sha256(presentedId), sha256(read.id))) return null;
+		if (read.userId !== userId) return null;
+		if (read.expiresAt <= now.getTime()) return null;
+		try {
+			const validated = await validateAuthorizationRequest(
+				read.request,
+				this.#config.store,
+				this.#config,
+			);
+			// An empty `scope` resolves to the client's registered list, which
+			// may have grown since the page was shown: the user agreed to the
+			// list on the page, and to nothing it has become.
+			if (validated.scopes.join(" ") !== (read.request.scope ?? "")) {
+				return null;
+			}
+			return validated;
+		} catch (error) {
+			if (error instanceof UnredirectableError || error instanceof OAuthError) {
+				return null;
+			}
+			throw error;
+		}
+	}
+
 	/** The user said no. */
 	deny(validated: ValidatedRequest): string {
 		return errorRedirect(
@@ -426,6 +532,101 @@ function normalizeIssuer(issuer: string): string {
 	return issuer.replace(/\/+$/, "");
 }
 
+/**
+ * A ticket as a session store hands it back: untyped, so read field by field.
+ *
+ * A session serialises to JSON and back, and a store an application wrote
+ * itself may hand back anything — a value that is not exactly a ticket is no
+ * ticket.
+ */
+function readConsentTicket(value: unknown): ConsentTicket | null {
+	if (typeof value !== "object" || value === null) return null;
+	if (!("id" in value) || typeof value.id !== "string" || value.id === "")
+		return null;
+	if (!("userId" in value) || typeof value.userId !== "string") return null;
+	if (!("expiresAt" in value) || typeof value.expiresAt !== "number")
+		return null;
+	if (!("request" in value)) return null;
+	const request = readTicketRequest(value.request);
+	if (request === null) return null;
+	return {
+		id: value.id,
+		userId: value.userId,
+		expiresAt: value.expiresAt,
+		request,
+	};
+}
+
+/** `prompt` is left out on purpose: the ticket IS the consent being asked. */
+const TICKET_STRING_FIELDS: readonly Exclude<
+	keyof AuthorizationRequest,
+	"resource" | "prompt"
+>[] = [
+	"response_type",
+	"client_id",
+	"redirect_uri",
+	"scope",
+	"state",
+	"code_challenge",
+	"code_challenge_method",
+	"nonce",
+];
+
+function readTicketRequest(value: unknown): AuthorizationRequest | null {
+	if (typeof value !== "object" || value === null) return null;
+	const request: AuthorizationRequest = {};
+	for (const key of TICKET_STRING_FIELDS) {
+		const field: unknown = Reflect.get(value, key);
+		if (field === undefined) continue;
+		if (typeof field !== "string") return null;
+		request[key] = field;
+	}
+	const resource: unknown = Reflect.get(value, "resource");
+	if (resource !== undefined) {
+		if (
+			!Array.isArray(resource) ||
+			!resource.every((entry) => typeof entry === "string")
+		) {
+			return null;
+		}
+		request.resource = resource;
+	}
+	return request;
+}
+
+/**
+ * Registration that can actually register, checked at boot.
+ *
+ * Both failures would otherwise surface on the first `POST /register`: a store
+ * with nowhere to write a client answers every MCP client a 500, and an empty
+ * initial access token is matched by `Authorization: Bearer ` — an endpoint
+ * the deployment meant to close, open to anyone who sends the header.
+ */
+function assertRegistration(config: VisaConfig): void {
+	const registration = config.registration;
+	if (registration?.enabled !== true) return;
+	if (config.store.saveClient === undefined) throw readOnlyStore();
+	if (registration.initialAccessToken === "") {
+		throw new VisaError(
+			"E_VISA_INVALID_INITIAL_ACCESS_TOKEN",
+			"registration.initialAccessToken is empty, which would accept an empty bearer token.",
+			{
+				hint: "Set a long random value, or leave it out for open registration.",
+			},
+		);
+	}
+}
+
+function readOnlyStore(): VisaError {
+	return new VisaError(
+		"E_VISA_STORE_READ_ONLY",
+		"This store cannot register clients; create them where they live.",
+		{
+			hint: "Implement saveClient(client) on the store — MemoryStore and AtlasStore both do.",
+		},
+	);
+}
+
 /**
  * Every redirect URI a client registers, checked once.
  *

package/src/VisaProvider.ts

@@ -14,6 +14,10 @@
  * decision; the page around it is yours. The README shows the ten lines.
  *
  * Duck-typed throughout: visa must not import its host's HTTP types.
+ *
+ * NAMED DEVIATION from the usual `request.all()`: these endpoints read the
+ * body only, and refuse a request that puts an OAuth parameter in the query
+ * string — see `readBody`.
  */
 
 import "./augmentations.js";
@@ -44,7 +48,10 @@ export interface VisaAppContext {
 interface VisaHttpContext {
 	request: {
 		header(name: string): string | undefined;
-		all(): Record<string, unknown>;
+		/** The parsed body — the only place an OAuth parameter is read from. */
+		body(): unknown;
+		/** Read only to refuse a request that put parameters in the URL. */
+		qs(): Record<string, unknown>;
 	};
 	response: {
 		status(code: number): unknown;
@@ -96,7 +103,7 @@ export default class VisaProvider {
 
 		router.post(`${prefix}/token`, async (ctx) => {
 			await this.#answer(ctx, async () => {
-				const body = ctx.request.all();
+				const body = readBody(ctx);
 				const credentials = manager.readCredentials({
 					body,
 					...readAuthorization(ctx),
@@ -113,7 +120,7 @@ export default class VisaProvider {
 
 		router.post(`${prefix}/introspect`, async (ctx) => {
 			await this.#answer(ctx, async () => {
-				const body = ctx.request.all();
+				const body = readBody(ctx);
 				const credentials = manager.readCredentials({
 					body,
 					...readAuthorization(ctx),
@@ -125,7 +132,7 @@ export default class VisaProvider {
 
 		router.post(`${prefix}/revoke`, async (ctx) => {
 			await this.#answer(ctx, async () => {
-				const body = ctx.request.all();
+				const body = readBody(ctx);
 				const credentials = manager.readCredentials({
 					body,
 					...readAuthorization(ctx),
@@ -144,7 +151,10 @@ export default class VisaProvider {
 			router.post(`${prefix}/register`, async (ctx) => {
 				await this.#answer(ctx, async () => {
 					const bearer = readBearer(ctx);
-					const created = await manager.register(ctx.request.all(), bearer);
+					const created = await manager.register(
+						readBody(ctx, REGISTRATION_PARAMETERS),
+						bearer,
+					);
 					// §3.2.1: 201, and the body carries a secret — no cache may
 					// keep it.
 					ctx.response.status(201);
@@ -245,12 +255,104 @@ export default class VisaProvider {
 	}
 }
 
+/**
+ * What may never travel in the URL of these endpoints.
+ *
+ * Every credential and every parameter the spec defines for them: the client's
+ * own (§2.3.1, RFC 7523), each grant's (§4), introspection's and revocation's
+ * (RFC 7662 §2.1, RFC 7009 §2.1), resource indicators (RFC 8707), a bearer
+ * token in its RFC 6750 §2.3 form, and the removed password grant's — a
+ * client still sending those sends a password.
+ */
+const OAUTH_PARAMETERS: ReadonlySet<string> = new Set([
+	"client_id",
+	"client_secret",
+	"client_assertion",
+	"client_assertion_type",
+	"grant_type",
+	"code",
+	"code_verifier",
+	"redirect_uri",
+	"refresh_token",
+	"scope",
+	"resource",
+	"token",
+	"token_type_hint",
+	"access_token",
+	"username",
+	"password",
+]);
+
+/** The same, plus the client metadata a registration carries (RFC 7591 §2). */
+const REGISTRATION_PARAMETERS: ReadonlySet<string> = new Set([
+	...OAUTH_PARAMETERS,
+	"redirect_uris",
+	"token_endpoint_auth_method",
+	"grant_types",
+	"response_types",
+	"client_name",
+	"client_uri",
+	"logo_uri",
+	"contacts",
+	"tos_uri",
+	"policy_uri",
+	"jwks_uri",
+	"jwks",
+	"software_id",
+	"software_version",
+	"software_statement",
+]);
+
+/**
+ * The parameters of a machine endpoint, read from the body and nowhere else.
+ *
+ * Every one of these requests carries a credential — a client secret, a code,
+ * a refresh or access token. RFC 6749 §2.3.1 says client credentials "MUST NOT
+ * be included in the request URI", and §3.2, RFC 7009 §2.1, RFC 7662 §2.1 and
+ * RFC 7591 §3.1 all define the parameters as a POST body. A URL is kept by
+ * access logs, proxies and traces where a body is not.
+ *
+ * So the query string is never read, and a request that puts an OAuth
+ * parameter there is refused rather than answered: accepting it would teach a
+ * client that the URL works, and the secret it carries is already in a log.
+ * Anything else in the query (a tracing or cache-busting parameter a proxy
+ * added) is ignored, not refused.
+ */
+function readBody(
+	ctx: VisaHttpContext,
+	forbidden: ReadonlySet<string> = OAUTH_PARAMETERS,
+): Record<string, unknown> {
+	const inUrl = Object.keys(ctx.request.qs()).filter((key) =>
+		forbidden.has(key),
+	);
+	if (inUrl.length > 0) {
+		throw new OAuthError(
+			"invalid_request",
+			`OAuth parameters go in the request body, never in the URL: ${inUrl.join(", ")}.`,
+		);
+	}
+	const body = ctx.request.body();
+	if (body === undefined || body === null) return {};
+	if (!isRecord(body)) {
+		throw new OAuthError(
+			"invalid_request",
+			"The request body must be a form or a JSON object.",
+		);
+	}
+	return body;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 /** The initial access token a registration may carry (RFC 7591 §3). */
 function readBearer(ctx: VisaHttpContext): string | undefined {
 	const header = ctx.request.header("authorization");
 	if (header === undefined) return undefined;
 	const [scheme, value] = header.split(" ");
-	if (scheme?.toLowerCase() !== "bearer" || value === undefined)
+	// An empty value is no token at all, not a token that is the empty string.
+	if (scheme?.toLowerCase() !== "bearer" || value === undefined || value === "")
 		return undefined;
 	return value;
 }

package/src/configure.ts

@@ -25,6 +25,17 @@ import { stubsRoot } from "./stubs.js";
  */
 const MIGRATION_STUB = "database/migrations/9000_create_visa_tables.stub";
 
+/**
+ * Columns added after the tables first shipped, one migration each.
+ *
+ * Written on every run: `makeUsingStub` leaves a file that already exists
+ * alone, so an application that configured an earlier version keeps its 9000
+ * and gains only what it is missing by running `ream configure` again.
+ */
+const UPGRADE_STUBS = [
+	"database/migrations/9001_add_visa_client_secret_expiry.stub",
+];
+
 interface Codemods {
 	addProvider(importPath: string): Promise<void>;
 	addEnvVars(vars: Record<string, string>): Promise<void>;
@@ -45,7 +56,9 @@ export async function configure(codemods: Codemods): Promise<void> {
 	// Fail fast BEFORE touching the project: a pruned tarball or an unreadable
 	// stub must not leave an application with a provider registered, a config
 	// written and no tables to put anything in.
-	await access(resolve(stubsRoot, MIGRATION_STUB), constants.R_OK);
+	for (const stub of [MIGRATION_STUB, ...UPGRADE_STUBS]) {
+		await access(resolve(stubsRoot, stub), constants.R_OK);
+	}
 
 	// The config below reads this, so it is declared here. Writing the file
 	// without it leaves an application whose config asks the environment for
@@ -60,4 +73,7 @@ export async function configure(codemods: Codemods): Promise<void> {
 	// data layer deletes the file and keeps its own store — which is why this
 	// is a migration and not a schema the package owns.
 	await codemods.makeUsingStub(stubsRoot, MIGRATION_STUB);
+	for (const stub of UPGRADE_STUBS) {
+		await codemods.makeUsingStub(stubsRoot, stub);
+	}
 }

package/src/guard.ts

@@ -9,7 +9,8 @@
  * upstream rule read off `@adonisjs/auth`'s build rather than recalled.
  *
  * Two things this fixes for every application at once. A route gate no longer
- * has to introspect the token itself — the scopes are on the guard's token. And
+ * has to introspect the token itself — the scopes are on the guard's token,
+ * and only there: `user.permissions` stays the user's own. And
  * the user is fetched through the application's own provider on every request,
  * so an account disabled after the token was issued is refused here instead of
  * in each application that remembers to check.
@@ -410,19 +411,17 @@ export class VisaGuard {
 
 		// A copy: the provider's object is the application's, and a guard that
 		// mutated it would leak one request's token into the next.
+		//
+		// The scopes go on `currentAccessToken` and NOWHERE else — upstream's
+		// access-tokens guard leaves the user model untouched the same way. They
+		// are never merged into `permissions`: a scope is chosen by the client's
+		// registration and granted by consent, which never checks that the user
+		// holds a permission of the same name, so a merge would hand any user a
+		// route permission they lack the moment a scope is named like one
+		// (`orders:write`). And a token limited to `profile` must not carry the
+		// user's other rights to a third-party client either: the two axes meet
+		// only as an intersection, `permission && currentAccessToken.allows(...)`.
 		const user: GuardUser = { ...subject, currentAccessToken: token };
-		if (verified.scopes.length > 0) {
-			// Scopes surface on `permissions` as well, the way warden's access-token
-			// guard does it, so `ctx.auth.user.permissions` reads the same whichever
-			// guard authenticated.
-			//
-			// They remain a SEPARATE axis from the route-level rights gate, exactly
-			// as upstream: a token ability is checked with
-			// `currentAccessToken.allows(...)`, and Bouncer does not consult it.
-			user.permissions = [
-				...new Set([...(subject.permissions ?? []), ...verified.scopes]),
-			];
-		}
 		return { authenticated: true, user };
 	}
 }

package/src/index.ts

@@ -103,6 +103,7 @@ export type {
 } from "./types.js";
 export {
 	type AuthorizationOutcome,
+	type ConsentTicket,
 	type VisaConfig,
 	VisaManager,
 } from "./VisaManager.js";

package/src/register.ts

@@ -20,6 +20,7 @@
  * it decide what it may do.
  */
 
+import { hashMatches, sha256 } from "./crypto.js";
 import { OAuthError, VisaError } from "./errors.js";
 import type { Client, ClientAuthMethod, GrantType } from "./types.js";
 
@@ -113,10 +114,16 @@ export function validateRegistration(
 		);
 	}
 	if (options.initialAccessToken !== undefined) {
-		// Constant-time is not the point here: the token is compared once per
-		// registration, and a registration endpoint is not a guessing oracle
-		// worth the machinery. Absent or wrong reads the same to the caller.
-		if (presentedToken !== options.initialAccessToken) {
+		// Constant time, like every other secret here. This one is a static,
+		// operator-chosen string — often shorter than a minted token — that an
+		// anonymous caller may test once per request, as often as they like.
+		// Both sides are hashed first so the comparison never depends on the
+		// configured length either. Absent or wrong reads the same to the caller.
+		if (
+			presentedToken === undefined ||
+			presentedToken === "" ||
+			!hashMatches(sha256(presentedToken), sha256(options.initialAccessToken))
+		) {
 			throw new OAuthError(
 				"invalid_client_metadata",
 				"Registration on this server needs an initial access token.",

package/src/store.ts

@@ -20,6 +20,17 @@ import type {
 export interface VisaStore {
 	findClient(id: string): Promise<Client | null>;
 
+	/**
+	 * Persist a client — what `registerClient`, and so dynamic registration
+	 * (RFC 7591), writes through. Awaited: a 201 carrying a secret for a
+	 * client whose insert failed would hand out a credential nothing accepts.
+	 *
+	 * Optional, for a store whose clients live in a table another service
+	 * owns. Without it `registerClient` refuses, and a server with
+	 * registration turned on refuses to boot.
+	 */
+	saveClient?(client: Client): Promise<void>;
+
 	saveAuthorizationCode(code: AuthorizationCode): Promise<void>;
 	findAuthorizationCode(codeHash: string): Promise<AuthorizationCode | null>;
 	/**

package/src/stores/atlas.ts

@@ -166,10 +166,12 @@ export class AtlasStore implements VisaStore {
 		const row = await this.#db.from(this.#tables.clients).where({ id }).first();
 		if (row === null) return null;
 		const secretHash = optionalString(row.secret_hash);
+		const secretExpiresAt = decodeDate(row.secret_expires_at);
 		return {
 			id: requireString(row.id, "id"),
 			name: requireString(row.name, "name"),
 			...(secretHash === undefined ? {} : { secretHash }),
+			...(secretExpiresAt === undefined ? {} : { secretExpiresAt }),
 			redirectUris: decodeList(row.redirect_uris, "redirect_uris"),
 			grantTypes: decodeList(row.grant_types, "grant_types").filter(
 				isGrantType,
@@ -180,12 +182,15 @@ export class AtlasStore implements VisaStore {
 		};
 	}
 
-	/** Persist a registered client. Not on the contract — what `registerClient` writes through. */
+	/** Persist a registered client — what `registerClient` writes through. */
 	async saveClient(client: Client): Promise<void> {
 		await this.#db.table(this.#tables.clients).insert({
 			id: client.id,
 			name: client.name,
 			secret_hash: client.secretHash ?? null,
+			// Without it an expiry announced at registration is never enforced:
+			// authentication reads it off the client and nowhere else.
+			secret_expires_at: client.secretExpiresAt ?? null,
 			redirect_uris: encodeList(client.redirectUris),
 			grant_types: encodeList(client.grantTypes),
 			scopes: encodeList(client.scopes),

package/src/stores/memory.ts

@@ -30,10 +30,8 @@ export class MemoryStore implements VisaStore {
 		for (const client of clients) this.#clients.set(client.id, client);
 	}
 
-	/** Register a client. Returns it, so a caller can keep the reference. */
-	addClient(client: Client): Client {
+	async saveClient(client: Client): Promise<void> {
 		this.#clients.set(client.id, client);
-		return client;
 	}
 
 	async findClient(id: string): Promise<Client | null> {