@commonpub/server 2.48.0 → 2.49.0

package/dist/federation/oauth.d.ts

@@ -1,4 +1,5 @@
 import { type OAuthAuthorizeRequest, type OAuthTokenRequest, type OAuthDynamicRegistrationRequest } from '@commonpub/protocol';
+import type { Scope, SoftwareKind } from '@commonpub/auth';
 import type { DB } from '../types.js';
 export interface AuthorizeResult {
     /** Authorization code to return to the client */
@@ -47,14 +48,65 @@ export interface RegisteredClient {
  * In v1, this is done manually by admins. Returns client credentials for storage.
  */
 export declare function registerOAuthClient(db: DB, instanceDomain: string, redirectUris: string[]): Promise<RegisteredClient>;
+/**
+ * Optional grant attached to a `linkFederatedAccount` call. When present,
+ * the access token is encrypted at rest via `@commonpub/infra/tokenCrypto`
+ * and stored in `federated_accounts.access_token_ciphertext` + `access_token_iv`.
+ *
+ * Phase 1a clients (the v1 SSO callback) call `linkFederatedAccount`
+ * WITHOUT a grant — those rows store profile info only and remain
+ * display-only "linked profile" records. Phase 1b's flow attaches a
+ * grant with the bearer it just exchanged, enabling delegated actions
+ * via FediClient.
+ */
+export interface FederatedAccountGrant {
+    /** OAuth bearer access token, plain text. Encrypted before storage. */
+    accessToken: string;
+    /** Granted scopes. Filtered through `coerceScopes` to drop unknowns. */
+    scopes: ReadonlyArray<Scope | string>;
+    /** Detected remote AP server software. Validated via `isSoftwareKind`. */
+    softwareKind: SoftwareKind | string;
+}
 /**
  * Link a federated account to a local user after successful OAuth callback.
+ *
+ * Backward-compatible: if `grant` is omitted, the row is created/updated
+ * with profile fields only — same as the v1 SSO behaviour. Existing
+ * callers (callback.get.ts, link.post.ts) keep working unchanged.
+ *
+ * When `grant` IS passed:
+ *   - access token is encrypted (ChaCha20-Poly1305) before insert/update
+ *   - scopes filtered to known values, default `[]`
+ *   - softwareKind validated, falls back to `'unknown'` on bad input
+ *   - `last_verified_at` set to now (we just got a fresh token)
+ *   - `revoked_at` cleared to null (re-linking after a revocation lifts the soft-revoke)
+ *
+ * Identity-hijacking guard: if the actor URI is already linked to a
+ * DIFFERENT local user, this throws `Error('already linked to another
+ * account')` — same as before.
  */
 export declare function linkFederatedAccount(db: DB, userId: string, actorUri: string, instanceDomain: string, profile?: {
     preferredUsername?: string;
     displayName?: string;
     avatarUrl?: string;
-}): Promise<void>;
+}, grant?: FederatedAccountGrant): Promise<void>;
+/**
+ * Read and decrypt the access token for a federated_accounts row. Returns
+ * null if there is no token stored, the row is revoked, or the row id
+ * does not exist. Never throws on missing rows / missing tokens — only
+ * on actual decryption failures (key change, tampered ciphertext).
+ *
+ * Used by Phase 1b's FediClient factory to construct authenticated
+ * Mastodon-API clients on demand.
+ */
+export declare function getDecryptedAccessToken(db: DB, federatedAccountId: string): Promise<string | null>;
+/**
+ * Soft-revoke a federated account's grant. Marks `revoked_at = now()`;
+ * keeps the row for audit but blocks `getDecryptedAccessToken` from
+ * returning the token. Used by Phase 1b's 401-detection wrapper and by
+ * the user-facing "Unlink" action.
+ */
+export declare function revokeFederatedAccountGrant(db: DB, federatedAccountId: string): Promise<void>;
 /**
  * Find a local user linked to a federated account by actor URI.
  */

package/dist/federation/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/federation/oauth.ts"],"names":[],"mappings":"AAcA,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAYtC,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BxE;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAsDpE;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAY3B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjF,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAYtD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAS3F;AAID;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBnG;AAMD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUzE;AAED,4DAA4D;AAC5D,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9E;AAED,iEAAiE;AACjE,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjF;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;IAAE,QAAQ,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,EACrF,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CASlB;AAOD,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,GACxC,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAiBjC;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChH,GAAG,IAAI,CAAC,CAoCR;AAID,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC,CAajC;AAOD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,GACvC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAejC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/federation/oauth.ts"],"names":[],"mappings":"AAcA,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG3D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAYtC,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BxE;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAsDpE;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAY3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;IACtC,0EAA0E;IAC1E,YAAY,EAAE,YAAY,GAAG,MAAM,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAClF,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA0Cf;AA8BD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,EAAE,EACN,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,EAAE,EACN,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAYtD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,CAS3F;AAID;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBnG;AAMD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUzE;AAED,4DAA4D;AAC5D,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9E;AAED,iEAAiE;AACjE,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjF;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;IAAE,QAAQ,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,EACrF,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CASlB;AAOD,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,GACxC,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAiBjC;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChH,GAAG,IAAI,CAAC,CAoCR;AAID,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC,CAajC;AAOD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,GACvC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAejC"}

package/dist/federation/oauth.js

@@ -6,6 +6,8 @@
 import { eq } from 'drizzle-orm';
 import { oauthClients, users, sessions, federatedAccounts, instanceSettings, } from '@commonpub/schema';
 import { validateAuthorizeRequest, validateTokenRequest, validateDynamicRegistration, } from '@commonpub/protocol';
+import { isSoftwareKind, coerceScopes } from '@commonpub/auth';
+import { encryptToken, decryptToken } from '@commonpub/infra';
 import { storeAuthCode, consumeAuthCode } from '../oauthCodes.js';
 /** Generate a cryptographically secure random token (hex-encoded, 256 bits) */
 function generateSecureToken() {
@@ -116,8 +118,27 @@ export async function registerOAuthClient(db, instanceDomain, redirectUris) {
 }
 /**
  * Link a federated account to a local user after successful OAuth callback.
+ *
+ * Backward-compatible: if `grant` is omitted, the row is created/updated
+ * with profile fields only — same as the v1 SSO behaviour. Existing
+ * callers (callback.get.ts, link.post.ts) keep working unchanged.
+ *
+ * When `grant` IS passed:
+ *   - access token is encrypted (ChaCha20-Poly1305) before insert/update
+ *   - scopes filtered to known values, default `[]`
+ *   - softwareKind validated, falls back to `'unknown'` on bad input
+ *   - `last_verified_at` set to now (we just got a fresh token)
+ *   - `revoked_at` cleared to null (re-linking after a revocation lifts the soft-revoke)
+ *
+ * Identity-hijacking guard: if the actor URI is already linked to a
+ * DIFFERENT local user, this throws `Error('already linked to another
+ * account')` — same as before.
  */
-export async function linkFederatedAccount(db, userId, actorUri, instanceDomain, profile) {
+export async function linkFederatedAccount(db, userId, actorUri, instanceDomain, profile, grant) {
+    // If a grant was provided, prepare the encrypted token + validated
+    // scopes/softwareKind once. We do this outside the existence check so
+    // an encryption failure (missing key, etc.) fails fast before any DB I/O.
+    const grantFields = grant ? buildGrantFields(grant) : null;
     // Check if already linked
     const existing = await db
         .select()
@@ -129,7 +150,7 @@ export async function linkFederatedAccount(db, userId, actorUri, instanceDomain,
         if (existing[0].userId !== userId) {
             throw new Error('This federated identity is already linked to another account');
         }
-        // Update profile info for the same user
+        // Update profile info for the same user, plus grant if provided
         await db
             .update(federatedAccounts)
             .set({
@@ -137,6 +158,7 @@ export async function linkFederatedAccount(db, userId, actorUri, instanceDomain,
             ...(profile?.preferredUsername && { preferredUsername: profile.preferredUsername }),
             ...(profile?.displayName && { displayName: profile.displayName }),
             ...(profile?.avatarUrl && { avatarUrl: profile.avatarUrl }),
+            ...(grantFields ?? {}),
         })
             .where(eq(federatedAccounts.actorUri, actorUri));
     }
@@ -149,9 +171,69 @@ export async function linkFederatedAccount(db, userId, actorUri, instanceDomain,
             displayName: profile?.displayName,
             avatarUrl: profile?.avatarUrl,
             lastSyncedAt: new Date(),
+            ...(grantFields ?? {}),
         });
     }
 }
+/**
+ * Validate + encrypt the grant. Centralised so INSERT and UPDATE share
+ * exactly the same rules. Returns the columns to spread into the
+ * Drizzle .set() / .values() call.
+ */
+function buildGrantFields(grant) {
+    const enc = encryptToken(grant.accessToken);
+    const safeScopes = coerceScopes(grant.scopes);
+    const safeKind = isSoftwareKind(grant.softwareKind) ? grant.softwareKind : 'unknown';
+    return {
+        accessTokenCiphertext: enc.ciphertext,
+        accessTokenIv: enc.iv,
+        scopes: [...safeScopes],
+        softwareKind: safeKind,
+        lastVerifiedAt: new Date(),
+        // Re-linking lifts a soft-revocation: any prior revoked_at is cleared
+        // because we just successfully re-authenticated.
+        revokedAt: null,
+    };
+}
+/**
+ * Read and decrypt the access token for a federated_accounts row. Returns
+ * null if there is no token stored, the row is revoked, or the row id
+ * does not exist. Never throws on missing rows / missing tokens — only
+ * on actual decryption failures (key change, tampered ciphertext).
+ *
+ * Used by Phase 1b's FediClient factory to construct authenticated
+ * Mastodon-API clients on demand.
+ */
+export async function getDecryptedAccessToken(db, federatedAccountId) {
+    const [row] = await db
+        .select({
+        ct: federatedAccounts.accessTokenCiphertext,
+        iv: federatedAccounts.accessTokenIv,
+        revokedAt: federatedAccounts.revokedAt,
+    })
+        .from(federatedAccounts)
+        .where(eq(federatedAccounts.id, federatedAccountId))
+        .limit(1);
+    if (!row)
+        return null;
+    if (row.revokedAt)
+        return null;
+    if (!row.ct || !row.iv)
+        return null;
+    return decryptToken({ ciphertext: row.ct, iv: row.iv });
+}
+/**
+ * Soft-revoke a federated account's grant. Marks `revoked_at = now()`;
+ * keeps the row for audit but blocks `getDecryptedAccessToken` from
+ * returning the token. Used by Phase 1b's 401-detection wrapper and by
+ * the user-facing "Unlink" action.
+ */
+export async function revokeFederatedAccountGrant(db, federatedAccountId) {
+    await db
+        .update(federatedAccounts)
+        .set({ revokedAt: new Date() })
+        .where(eq(federatedAccounts.id, federatedAccountId));
+}
 /**
  * Find a local user linked to a federated account by actor URI.
  */

package/dist/federation/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/federation/oauth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,EAAE,EAAW,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,YAAY,EAEZ,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,2BAA2B,GAI5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,+EAA+E;AAC/E,SAAS,mBAAmB;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AA2BD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,MAA6B,EAC7B,MAAc,EACd,MAAc;IAEd,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,WAAW,GAAG,MAAM;QACxB,CAAC,CAAC;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAwB;YAC7C,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,uBAAuB;IACvB,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,8EAA8E;IAC9E,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3E,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,MAAyB,EACzB,MAAc;IAEd,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,WAAW,GAAG,MAAM;QACxB,CAAC,CAAC;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAwB;YAC7C,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,uBAAuB;IACvB,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,qCAAqC;IACrC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,uCAAuC,EAAE,CAAC;IAC/F,CAAC;IAED,mBAAmB;IACnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACvE,CAAC;IAED,mDAAmD;IACnD,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,WAAW,MAAM,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;IAE5D,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,cAAsB,EACtB,YAAsB;IAEtB,MAAM,QAAQ,GAAG,QAAQ,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9D,MAAM,YAAY,GAAG,SAAS,mBAAmB,EAAE,EAAE,CAAC;IAEtD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QACnC,QAAQ;QACR,YAAY;QACZ,YAAY;QACZ,cAAc;KACf,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,MAAc,EACd,QAAgB,EAChB,cAAsB,EACtB,OAAkF;IAElF,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,qEAAqE;QACrE,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,wCAAwC;QACxC,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC;YACH,YAAY,EAAE,IAAI,IAAI,EAAE;YACxB,GAAG,CAAC,OAAO,EAAE,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnF,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YACjE,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SAC5D,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;YACxC,MAAM;YACN,QAAQ;YACR,cAAc;YACd,iBAAiB,EAAE,OAAO,EAAE,iBAAiB;YAC7C,WAAW,EAAE,OAAO,EAAE,WAAW;YACjC,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,YAAY,EAAE,IAAI,IAAI,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAM,EACN,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;SACD,IAAI,CAAC,iBAAiB,CAAC;SACvB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SACxD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM;IAEN,OAAO,EAAE;SACN,MAAM,CAAC;QACN,EAAE,EAAE,YAAY,CAAC,EAAE;QACnB,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC;SACD,IAAI,CAAC,YAAY,CAAC,CAAC;AACxB,CAAC;AAED,sCAAsC;AAEtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAM,EACN,OAAwC;IAExC,MAAM,eAAe,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,0DAA0D;IAC1D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;SAC9D,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;IAC9E,CAAC;IAED,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AAEvD,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAM;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;SACtD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,MAAc;IAC7D,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO;IACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErB,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;SACtD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACnH,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAM,EAAE,MAAc;IAChE,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;IAEnD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,YAAY;IAE5D,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACpH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,MAAqF,EACrF,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9C,yBAAyB;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhE,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,4DAA4D;AAE5D,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAWxD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAyC;IAEzC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,kBAAkB,GAAG,UAAU,EAAE,CAAC;IAEjD,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;QACvC,GAAG;QACH,KAAK,EAAE;YACL,GAAG,KAAK;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;SAC3C;KACF,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,UAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,kBAAkB,GAAG,UAAU,EAAE,CAAC;IAEjD,gDAAgD;IAChD,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,gBAAgB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;SACpC,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAwB,CAAC;IAEnD,eAAe;IACf,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAsB,EACtB,IAAY;IAKZ,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAG/B,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAElD,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;gBAC1C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;gBACtC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,WAAW,KAAK,CAAC,cAAc,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;aAC9F;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,MAAc,EACd,SAAkB,EAClB,SAAkB;IAElB,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,qCAAqC;IAEvG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC/B,MAAM;QACN,KAAK,EAAE,YAAY;QACnB,SAAS;QACT,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;KAC7B,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,8BAA8B;AAE9B,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAWzD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,IAAwC;IAExC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,mBAAmB,GAAG,KAAK,EAAE,CAAC;IAE7C,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;QACvC,GAAG;QACH,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,EAAE;KAChE,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,mBAAmB,GAAG,KAAK,EAAE,CAAC;IAE7C,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,gBAAgB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;SACpC,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAwB,CAAC;IAClD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE7C,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/federation/oauth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,EAAE,EAAW,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,YAAY,EAEZ,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,2BAA2B,GAI5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,+EAA+E;AAC/E,SAAS,mBAAmB;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AA2BD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,MAA6B,EAC7B,MAAc,EACd,MAAc;IAEd,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,WAAW,GAAG,MAAM;QACxB,CAAC,CAAC;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAwB;YAC7C,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,uBAAuB;IACvB,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,8EAA8E;IAC9E,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3E,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,MAAyB,EACzB,MAAc;IAEd,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;SACjD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,WAAW,GAAG,MAAM;QACxB,CAAC,CAAC;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAwB;YAC7C,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,uBAAuB;IACvB,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,qCAAqC;IACrC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,uCAAuC,EAAE,CAAC;IAC/F,CAAC;IAED,mBAAmB;IACnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACvE,CAAC;IAED,mDAAmD;IACnD,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,WAAW,MAAM,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;IAE5D,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,cAAsB,EACtB,YAAsB;IAEtB,MAAM,QAAQ,GAAG,QAAQ,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9D,MAAM,YAAY,GAAG,SAAS,mBAAmB,EAAE,EAAE,CAAC;IAEtD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QACnC,QAAQ;QACR,YAAY;QACZ,YAAY;QACZ,cAAc;KACf,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAsBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,MAAc,EACd,QAAgB,EAChB,cAAsB,EACtB,OAAkF,EAClF,KAA6B;IAE7B,mEAAmE;IACnE,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3D,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,qEAAqE;QACrE,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,gEAAgE;QAChE,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC;YACH,YAAY,EAAE,IAAI,IAAI,EAAE;YACxB,GAAG,CAAC,OAAO,EAAE,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnF,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YACjE,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YAC3D,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;SACvB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;YACxC,MAAM;YACN,QAAQ;YACR,cAAc;YACd,iBAAiB,EAAE,OAAO,EAAE,iBAAiB;YAC7C,WAAW,EAAE,OAAO,EAAE,WAAW;YACjC,SAAS,EAAE,OAAO,EAAE,SAAS;YAC7B,YAAY,EAAE,IAAI,IAAI,EAAE;YACxB,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;SACvB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAA4B;IAQpD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,MAA+B,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,OAAO;QACL,qBAAqB,EAAE,GAAG,CAAC,UAAU;QACrC,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC;QACvB,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,IAAI,IAAI,EAAE;QAC1B,sEAAsE;QACtE,iDAAiD;QACjD,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAM,EACN,kBAA0B;IAE1B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,EAAE,EAAE,iBAAiB,CAAC,qBAAqB;QAC3C,EAAE,EAAE,iBAAiB,CAAC,aAAa;QACnC,SAAS,EAAE,iBAAiB,CAAC,SAAS;KACvC,CAAC;SACD,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;SACnD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,YAAY,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,EAAM,EACN,kBAA0B;IAE1B,MAAM,EAAE;SACL,MAAM,CAAC,iBAAiB,CAAC;SACzB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAM,EACN,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;SACD,IAAI,CAAC,iBAAiB,CAAC;SACvB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SACxD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC/C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM;IAEN,OAAO,EAAE;SACN,MAAM,CAAC;QACN,EAAE,EAAE,YAAY,CAAC,EAAE;QACnB,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC;SACD,IAAI,CAAC,YAAY,CAAC,CAAC;AACxB,CAAC;AAED,sCAAsC;AAEtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAM,EACN,OAAwC;IAExC,MAAM,eAAe,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,0DAA0D;IAC1D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;SAC9D,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;IAC9E,CAAC;IAED,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AAEvD,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAM;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;SACtD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,MAAc;IAC7D,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO;IACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErB,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;SACtD,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACnH,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAM,EAAE,MAAc;IAChE,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;IAEnD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,YAAY;IAE5D,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACpH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,MAAqF,EACrF,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9C,yBAAyB;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhE,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,4DAA4D;AAE5D,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAWxD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAyC;IAEzC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,kBAAkB,GAAG,UAAU,EAAE,CAAC;IAEjD,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;QACvC,GAAG;QACH,KAAK,EAAE;YACL,GAAG,KAAK;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;SAC3C;KACF,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,UAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,kBAAkB,GAAG,UAAU,EAAE,CAAC;IAEjD,gDAAgD;IAChD,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,gBAAgB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;SACpC,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAwB,CAAC;IAEnD,eAAe;IACf,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAsB,EACtB,IAAY;IAKZ,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAG/B,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAElD,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;gBAC1C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;gBACtC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,WAAW,KAAK,CAAC,cAAc,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;aAC9F;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,MAAc,EACd,SAAkB,EAClB,SAAkB;IAElB,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,qCAAqC;IAEvG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC/B,MAAM;QACN,KAAK,EAAE,YAAY;QACnB,SAAS;QACT,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;KAC7B,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,8BAA8B;AAE9B,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAWzD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,IAAwC;IAExC,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,mBAAmB,GAAG,KAAK,EAAE,CAAC;IAE7C,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;QACvC,GAAG;QACH,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,EAAE;KAChE,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,KAAa;IAEb,MAAM,GAAG,GAAG,GAAG,mBAAmB,GAAG,KAAK,EAAE,CAAC;IAE7C,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,gBAAgB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;SACpC,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAwB,CAAC;IAClD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE7C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/identity/__tests__/health.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=health.test.d.ts.map

package/dist/identity/__tests__/health.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.test.d.ts","sourceRoot":"","sources":["../../../src/identity/__tests__/health.test.ts"],"names":[],"mappings":""}

package/dist/identity/__tests__/health.test.js

@@ -0,0 +1,113 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { checkIdentityConfig, assertIdentityConfig } from '../health.js';
+const VALID_KEY = '0'.repeat(64);
+// Minimal CommonPubConfig builder — kept inline (rather than importing
+// @commonpub/test-utils) so this test file doesn't add a workspace dep
+// that @commonpub/server otherwise doesn't need.
+function makeConfig(idOverrides = {}) {
+    return {
+        instance: {
+            domain: 'test.example.com',
+            name: 'Test',
+            description: 'Test instance',
+        },
+        features: {
+            content: true, social: true, hubs: true, docs: true, video: true,
+            contests: false, events: false, learning: true, explainers: true,
+            editorial: true, federation: false, seamlessFederation: false,
+            federateHubs: false, admin: false, emailNotifications: false,
+            publicApi: false,
+            identity: {
+                linkRemoteAccounts: false,
+                signInWithRemote: false,
+                actingAs: false,
+                remoteInteract: false,
+                remotePublish: false,
+                ...idOverrides,
+            },
+        },
+        auth: {
+            emailPassword: true,
+            magicLink: false,
+            passkeys: false,
+        },
+        docs: {
+            searchLanguage: 'english',
+        },
+    };
+}
+describe('checkIdentityConfig', () => {
+    let originalKey;
+    beforeEach(() => {
+        originalKey = process.env.CPUB_FED_TOKEN_KEY;
+    });
+    afterEach(() => {
+        if (originalKey === undefined)
+            delete process.env.CPUB_FED_TOKEN_KEY;
+        else
+            process.env.CPUB_FED_TOKEN_KEY = originalKey;
+    });
+    it('ok when no identity flags are enabled', () => {
+        delete process.env.CPUB_FED_TOKEN_KEY;
+        const result = checkIdentityConfig(makeConfig());
+        expect(result).toEqual({ ok: true, errors: [] });
+    });
+    it('ok when only `actingAs` is enabled (no token I/O)', () => {
+        delete process.env.CPUB_FED_TOKEN_KEY;
+        const result = checkIdentityConfig(makeConfig({ actingAs: true }));
+        expect(result.ok).toBe(true);
+    });
+    it('errors when linkRemoteAccounts is on without key', () => {
+        delete process.env.CPUB_FED_TOKEN_KEY;
+        const result = checkIdentityConfig(makeConfig({ linkRemoteAccounts: true }));
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]).toMatch(/CPUB_FED_TOKEN_KEY/);
+    });
+    it('errors when signInWithRemote is on without key', () => {
+        delete process.env.CPUB_FED_TOKEN_KEY;
+        const result = checkIdentityConfig(makeConfig({ signInWithRemote: true }));
+        expect(result.ok).toBe(false);
+    });
+    it('errors when remoteInteract is on without key', () => {
+        delete process.env.CPUB_FED_TOKEN_KEY;
+        const result = checkIdentityConfig(makeConfig({ remoteInteract: true }));
+        expect(result.ok).toBe(false);
+    });
+    it('errors when remotePublish is on without key', () => {
+        delete process.env.CPUB_FED_TOKEN_KEY;
+        const result = checkIdentityConfig(makeConfig({ remotePublish: true }));
+        expect(result.ok).toBe(false);
+    });
+    it('ok when token-using flag is on AND key is configured', () => {
+        process.env.CPUB_FED_TOKEN_KEY = VALID_KEY;
+        const result = checkIdentityConfig(makeConfig({ linkRemoteAccounts: true, remotePublish: true }));
+        expect(result.ok).toBe(true);
+    });
+    it('errors when key is malformed (wrong length)', () => {
+        process.env.CPUB_FED_TOKEN_KEY = '0'.repeat(63);
+        const result = checkIdentityConfig(makeConfig({ linkRemoteAccounts: true }));
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]).toMatch(/CPUB_FED_TOKEN_KEY/);
+    });
+});
+describe('assertIdentityConfig', () => {
+    let originalKey;
+    beforeEach(() => {
+        originalKey = process.env.CPUB_FED_TOKEN_KEY;
+    });
+    afterEach(() => {
+        if (originalKey === undefined)
+            delete process.env.CPUB_FED_TOKEN_KEY;
+        else
+            process.env.CPUB_FED_TOKEN_KEY = originalKey;
+    });
+    it('does not throw when ok', () => {
+        process.env.CPUB_FED_TOKEN_KEY = VALID_KEY;
+        expect(() => assertIdentityConfig(makeConfig({ linkRemoteAccounts: true }))).not.toThrow();
+    });
+    it('throws with all errors joined when not ok', () => {
+        delete process.env.CPUB_FED_TOKEN_KEY;
+        expect(() => assertIdentityConfig(makeConfig({ linkRemoteAccounts: true }))).toThrow(/misconfigured.*CPUB_FED_TOKEN_KEY/s);
+    });
+});
+//# sourceMappingURL=health.test.js.map

package/dist/identity/__tests__/health.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.test.js","sourceRoot":"","sources":["../../../src/identity/__tests__/health.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEjC,uEAAuE;AACvE,uEAAuE;AACvE,iDAAiD;AACjD,SAAS,UAAU,CAAC,cAAgE,EAAE;IACpF,OAAO;QACL,QAAQ,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,eAAe;SAC7B;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;YAChE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;YAChE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK;YAC7D,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK;YAC5D,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE;gBACR,kBAAkB,EAAE,KAAK;gBACzB,gBAAgB,EAAE,KAAK;gBACvB,QAAQ,EAAE,KAAK;gBACf,cAAc,EAAE,KAAK;gBACrB,aAAa,EAAE,KAAK;gBACpB,GAAG,WAAW;aACf;SACF;QACD,IAAI,EAAE;YACJ,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,IAAI,EAAE;YACJ,cAAc,EAAE,SAAS;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,WAA+B,CAAC;IAEpC,UAAU,CAAC,GAAG,EAAE;QACd,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;;YAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,WAAW,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC;QAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,WAA+B,CAAC;IAEpC,UAAU,CAAC,GAAG,EAAE;QACd,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;;YAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,WAAW,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/identity/__tests__/router.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=router.test.d.ts.map

package/dist/identity/__tests__/router.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.test.d.ts","sourceRoot":"","sources":["../../../src/identity/__tests__/router.test.ts"],"names":[],"mappings":""}

package/dist/identity/__tests__/router.test.js

@@ -0,0 +1,163 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { run, ActionUnavailable, InsufficientScopes, LinkedIdentityRevoked, } from '../router.js';
+import { setFediClientFactory, } from '../fediClient.js';
+// Reset the factory between tests so leakage between cases is impossible.
+afterEach(() => setFediClientFactory(null));
+const fakeEvent = {};
+const NATIVE = {
+    kind: 'native',
+    id: 'u1',
+    userId: 'u1',
+    username: 'moheeb',
+    instance: 'deveco.io',
+    actorUri: 'https://deveco.io/users/moheeb',
+    handle: '@moheeb@deveco.io',
+};
+function makeLinked(overrides = {}) {
+    return {
+        kind: 'linked',
+        id: 'fa1',
+        userId: 'u1',
+        username: 'moheeb',
+        instance: 'commonpub.io',
+        actorUri: 'https://commonpub.io/users/moheeb',
+        handle: '@moheeb@commonpub.io',
+        scopes: ['read', 'write'],
+        softwareKind: 'cpub',
+        revokedAt: null,
+        ...overrides,
+    };
+}
+function makeAction(opts = {}) {
+    return {
+        name: opts.name ?? 'test-action',
+        scopes: opts.scopes ?? [],
+        local: opts.local ?? vi.fn(async () => 'local-result'),
+        remote: opts.remote,
+    };
+}
+describe('run() — native identity', () => {
+    it('dispatches to action.local', async () => {
+        const local = vi.fn(async () => 'OK');
+        const action = makeAction({ local });
+        const result = await run(fakeEvent, NATIVE, action, undefined);
+        expect(result).toBe('OK');
+        expect(local).toHaveBeenCalledOnce();
+        expect(local).toHaveBeenCalledWith(fakeEvent, NATIVE, undefined);
+    });
+    it('passes input through unchanged', async () => {
+        const local = vi.fn(async (_e, _id, x) => x.hello);
+        const action = {
+            name: 'test',
+            scopes: [],
+            local,
+        };
+        const result = await run(fakeEvent, NATIVE, action, { hello: 'world' });
+        expect(result).toBe('world');
+    });
+    it('does NOT check scopes for native (scopes are linked-only)', async () => {
+        const action = makeAction({ scopes: ['publish'] });
+        // Native passes through even though "scopes: ['publish']" is declared.
+        const result = await run(fakeEvent, NATIVE, action, undefined);
+        expect(result).toBe('local-result');
+    });
+});
+describe('run() — linked identity', () => {
+    it('throws ActionUnavailable when the action has no remote half', async () => {
+        const action = makeAction(); // no remote
+        await expect(run(fakeEvent, makeLinked(), action, undefined))
+            .rejects.toBeInstanceOf(ActionUnavailable);
+        await expect(run(fakeEvent, makeLinked(), action, undefined))
+            .rejects.toMatchObject({ action: 'test-action', reason: 'not-proxiable' });
+    });
+    it('throws LinkedIdentityRevoked when the grant is revoked', async () => {
+        const remote = vi.fn(async () => 'remote-result');
+        const action = makeAction({ remote });
+        const revoked = makeLinked({ revokedAt: new Date() });
+        await expect(run(fakeEvent, revoked, action, undefined))
+            .rejects.toBeInstanceOf(LinkedIdentityRevoked);
+        expect(remote).not.toHaveBeenCalled();
+    });
+    it('throws InsufficientScopes when granted scopes do not cover required', async () => {
+        const remote = vi.fn(async () => 'remote-result');
+        const action = makeAction({ scopes: ['publish'], remote });
+        const linked = makeLinked({ scopes: ['read', 'write'] });
+        try {
+            await run(fakeEvent, linked, action, undefined);
+            throw new Error('expected throw');
+        }
+        catch (err) {
+            expect(err).toBeInstanceOf(InsufficientScopes);
+            expect(err.required).toEqual(['publish']);
+            expect(err.granted).toEqual(['read', 'write']);
+        }
+        expect(remote).not.toHaveBeenCalled();
+    });
+    it('throws when no FediClient factory is registered', async () => {
+        // Phase 1a default state: no factory. Reaching getFediClient must
+        // surface a clear, actionable error rather than silently no-op'ing.
+        const remote = vi.fn(async () => 'remote-result');
+        const action = makeAction({ scopes: ['read'], remote });
+        const linked = makeLinked({ scopes: ['read', 'write'] });
+        await expect(run(fakeEvent, linked, action, undefined))
+            .rejects.toThrow(/factory not registered/);
+        expect(remote).not.toHaveBeenCalled();
+    });
+    it('dispatches to action.remote with the factory-built client', async () => {
+        // The crucial chain-completeness test: Phase 1b plugs in a factory,
+        // and run() must thread the constructed client through to the
+        // action's remote handler with the linked identity unchanged.
+        const fakeClient = {
+            account: { verifyCredentials: vi.fn(async () => ({ id: '1', username: 'm', acct: 'm@host' })) },
+        };
+        const factory = vi.fn(async () => fakeClient);
+        setFediClientFactory(factory);
+        const remote = vi.fn(async (client, _id, _input) => {
+            // Verify it's actually the registered factory's client
+            expect(client).toBe(fakeClient);
+            return 'remote-result';
+        });
+        const action = makeAction({ scopes: ['read'], remote });
+        const linked = makeLinked({ scopes: ['read', 'write'] });
+        const result = await run(fakeEvent, linked, action, undefined);
+        expect(result).toBe('remote-result');
+        expect(factory).toHaveBeenCalledOnce();
+        expect(factory).toHaveBeenCalledWith(linked);
+        expect(remote).toHaveBeenCalledOnce();
+    });
+    it('propagates factory errors as-is (no silent swallow)', async () => {
+        setFediClientFactory(async () => { throw new Error('database unreachable'); });
+        const action = makeAction({ scopes: ['read'], remote: vi.fn() });
+        const linked = makeLinked({ scopes: ['read'] });
+        await expect(run(fakeEvent, linked, action, undefined))
+            .rejects.toThrow(/database unreachable/);
+    });
+});
+describe('error classes', () => {
+    it('ActionUnavailable carries action + reason', () => {
+        const e = new ActionUnavailable('publish', 'no-token');
+        expect(e.name).toBe('ActionUnavailable');
+        expect(e.action).toBe('publish');
+        expect(e.reason).toBe('no-token');
+        expect(e.message).toContain('publish');
+        expect(e.message).toContain('no-token');
+    });
+    it('InsufficientScopes carries required + granted', () => {
+        const e = new InsufficientScopes('publish', ['publish'], ['read']);
+        expect(e.required).toEqual(['publish']);
+        expect(e.granted).toEqual(['read']);
+        expect(e.message).toContain('publish');
+    });
+    it('LinkedIdentityRevoked carries identity reference', () => {
+        const id = makeLinked({ revokedAt: new Date() });
+        const e = new LinkedIdentityRevoked(id);
+        expect(e.identity).toBe(id);
+        expect(e.message).toContain(id.handle);
+    });
+    // Sanity: typeof Identity narrowing works at runtime
+    it('Identity union still includes both kinds', () => {
+        const ids = [NATIVE, makeLinked()];
+        expect(ids.map(i => i.kind).sort()).toEqual(['linked', 'native']);
+    });
+});
+//# sourceMappingURL=router.test.js.map

package/dist/identity/__tests__/router.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.test.js","sourceRoot":"","sources":["../../../src/identity/__tests__/router.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAO7D,OAAO,EACL,GAAG,EACH,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,GAGrB,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,SAAS,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;AAK5C,MAAM,SAAS,GAAc,EAAE,CAAC;AAEhC,MAAM,MAAM,GAAmB;IAC7B,IAAI,EAAE,QAAQ;IACd,EAAE,EAAE,IAAI;IACR,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,gCAAgC;IAC1C,MAAM,EAAE,mBAAmB;CAC5B,CAAC;AAEF,SAAS,UAAU,CAAC,YAAqC,EAAE;IACzD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,mCAAmC;QAC7C,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAY;QACpC,YAAY,EAAE,MAAM;QACpB,SAAS,EAAE,IAAI;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAA4B,OAK3C,EAAE;IACJ,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,aAAa;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAK,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,cAAsB,CAA2D;QACzH,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAa,EAAE,GAAG,EAAE,CAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjF,MAAM,MAAM,GAAsD;YAChE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,EAAE;YACV,KAAK;SACN,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnD,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,CAAC,YAAY;QACzC,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;aAC1D,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;aAC1D,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;aACrD,OAAO,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;YAC/C,MAAM,CAAE,GAA0B,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAClE,MAAM,CAAE,GAA0B,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;aACpD,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,oEAAoE;QACpE,8DAA8D;QAC9D,8DAA8D;QAC9D,MAAM,UAAU,GAAe;YAC7B,OAAO,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE;SAChG,CAAC;QACF,MAAM,OAAO,GAAsB,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QACjE,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,MAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YAC7D,uDAAuD;YACvD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChC,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,oBAAoB,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;aACpD,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,IAAI,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,IAAI,kBAAkB,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAe,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/identity/fediClient.d.ts

@@ -0,0 +1,82 @@
+/**
+ * FediClient — opaque, protocol-agnostic facade for calling a remote
+ * Fediverse instance as a linked identity. Phase 1a defines the
+ * interface; Phase 1b plumbs in the megalodon-backed implementation.
+ *
+ * Why opaque: callers (action handlers) should never see the bearer
+ * token, never call `fetch` directly, never know whether the remote
+ * is Mastodon vs Pleroma vs CommonPub. They write `client.statuses.create({ ... })`
+ * and the wrapper handles authentication, software-specific quirks,
+ * 401-detection-as-revocation, audit logging, and rate-limit backoff.
+ *
+ * The interface is intentionally narrow — only the actions we proxy.
+ * Add methods as Phase 4 (delegated actions) opens specific surfaces.
+ *
+ * See docs/sessions/136-cross-instance-identity-plan.md.
+ */
+import type { LinkedIdentity } from '@commonpub/auth';
+/**
+ * The minimal account shape returned by a verify-credentials call. All
+ * Mastodon-API-compatible servers expose this at GET /api/v1/accounts/verify_credentials.
+ * CommonPub instances expose the same shape via the OAuth token-exchange
+ * response (per existing `processTokenExchange`).
+ */
+export interface VerifiedAccount {
+    /** Stable id at the remote (string for Mastodon API compat). */
+    id: string;
+    /** Bare username, no @host. */
+    username: string;
+    /** Full handle: `user@host`. Mastodon-API field name. */
+    acct: string;
+    /** Display name (optional). */
+    displayName?: string;
+    /** Avatar URL (optional). */
+    avatar?: string;
+    /** Canonical AP actor URI when known. */
+    url?: string;
+}
+export interface FediClient {
+    /** Phase 1: only the verification call lands here. Phase 4 expands. */
+    account: {
+        verifyCredentials(): Promise<VerifiedAccount>;
+    };
+}
+/**
+ * A FediClient factory. Phase 1b will register a real implementation
+ * via `setFediClientFactory` at app init; the factory closes over the
+ * DB handle, decryption key, audit logger, and any other dependencies
+ * a real client needs without forcing those onto `run()`'s call sites.
+ *
+ * Tests register mock factories per-case via `setFediClientFactory`
+ * and clear with `setFediClientFactory(null)` in afterEach.
+ */
+export type FediClientFactory = (identity: LinkedIdentity) => Promise<FediClient>;
+/**
+ * Register the FediClient factory. Called once at app init by Phase 1b's
+ * Nitro plugin (something like `setFediClientFactory(makeMastodonFactory(useDB(), tokenKey))`).
+ *
+ * Pass `null` to clear (used in tests).
+ *
+ * Why factory-registration instead of explicit DI through `run()`:
+ *   - keeps `run()`'s signature simple — no DB / audit-logger cruft
+ *     leaking into every call site
+ *   - keeps `@commonpub/server` framework-agnostic — no h3 / Nuxt
+ *     specific globals
+ *   - app init is the natural place to wire dependencies once
+ */
+export declare function setFediClientFactory(factory: FediClientFactory | null): void;
+/**
+ * Construct a FediClient for a linked identity. Delegates to the
+ * registered factory; throws if no factory has been registered (i.e.,
+ * Phase 1b plumbing isn't in place yet, or the test forgot to call
+ * `setFediClientFactory`).
+ *
+ * The Phase 1b factory will:
+ *   1. Read federated_accounts row for `identity.id`
+ *   2. Decrypt access_token via `decryptToken` (@commonpub/infra)
+ *   3. Construct megalodon client based on `identity.softwareKind`
+ *   4. Wrap with 401-detection (mark revoked_at on auth failure),
+ *      audit logging, and rate-limit handling
+ */
+export declare function getFediClient(identity: LinkedIdentity): Promise<FediClient>;
+//# sourceMappingURL=fediClient.d.ts.map

package/dist/identity/fediClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fediClient.d.ts","sourceRoot":"","sources":["../../src/identity/fediClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,OAAO,EAAE;QACP,iBAAiB,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;KAC/C,CAAC;CAKH;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAIlF;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAE5E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAUjF"}

package/dist/identity/fediClient.js

@@ -0,0 +1,40 @@
+let registeredFactory = null;
+/**
+ * Register the FediClient factory. Called once at app init by Phase 1b's
+ * Nitro plugin (something like `setFediClientFactory(makeMastodonFactory(useDB(), tokenKey))`).
+ *
+ * Pass `null` to clear (used in tests).
+ *
+ * Why factory-registration instead of explicit DI through `run()`:
+ *   - keeps `run()`'s signature simple — no DB / audit-logger cruft
+ *     leaking into every call site
+ *   - keeps `@commonpub/server` framework-agnostic — no h3 / Nuxt
+ *     specific globals
+ *   - app init is the natural place to wire dependencies once
+ */
+export function setFediClientFactory(factory) {
+    registeredFactory = factory;
+}
+/**
+ * Construct a FediClient for a linked identity. Delegates to the
+ * registered factory; throws if no factory has been registered (i.e.,
+ * Phase 1b plumbing isn't in place yet, or the test forgot to call
+ * `setFediClientFactory`).
+ *
+ * The Phase 1b factory will:
+ *   1. Read federated_accounts row for `identity.id`
+ *   2. Decrypt access_token via `decryptToken` (@commonpub/infra)
+ *   3. Construct megalodon client based on `identity.softwareKind`
+ *   4. Wrap with 401-detection (mark revoked_at on auth failure),
+ *      audit logging, and rate-limit handling
+ */
+export async function getFediClient(identity) {
+    if (!registeredFactory) {
+        throw new Error(`FediClient factory not registered. ` +
+            `Phase 1b: call setFediClientFactory(...) at app init. ` +
+            `Tests: register a mock via setFediClientFactory(async () => mockClient). ` +
+            `See docs/sessions/136-cross-instance-identity-plan.md.`);
+    }
+    return registeredFactory(identity);
+}
+//# sourceMappingURL=fediClient.js.map

package/dist/identity/fediClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fediClient.js","sourceRoot":"","sources":["../../src/identity/fediClient.ts"],"names":[],"mappings":"AA6DA,IAAI,iBAAiB,GAA6B,IAAI,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,iBAAiB,GAAG,OAAO,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAwB;IAC1D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,qCAAqC;YACrC,wDAAwD;YACxD,2EAA2E;YAC3E,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC"}

package/dist/identity/health.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Identity-configuration startup invariants.
+ *
+ * Cross-instance delegated authorization stores OAuth bearer tokens at
+ * rest under a symmetric key (`CPUB_FED_TOKEN_KEY`). If any feature
+ * flag that *uses* tokens is enabled but the key is missing, the
+ * operator has misconfigured the deploy — better to refuse to start
+ * than to fail at first OAuth callback when a real user is mid-sign-in.
+ *
+ * Phase 1b plugs this into a Nitro plugin that runs at app init:
+ *
+ *     // layers/base/server/plugins/identity-startup.ts
+ *     export default defineNitroPlugin(() => {
+ *       assertIdentityConfig(useConfig());
+ *     });
+ *
+ * `actingAs` does NOT need the key — it's purely a UI identity-context
+ * switcher and doesn't store tokens. Listed exclusion below.
+ */
+import type { CommonPubConfig } from '@commonpub/config';
+export interface IdentityConfigCheckResult {
+    ok: boolean;
+    errors: ReadonlyArray<string>;
+}
+/**
+ * Inspect the config; return the list of identity-related
+ * misconfigurations. Empty errors → `ok: true`.
+ *
+ * Pure function: no env mutation, no I/O beyond reading the env var
+ * (which `isTokenKeyConfigured` does without logging the key).
+ */
+export declare function checkIdentityConfig(config: CommonPubConfig): IdentityConfigCheckResult;
+/**
+ * Same as `checkIdentityConfig` but throws on any error. Use at
+ * Nitro-plugin startup so a misconfigured deploy fails to boot rather
+ * than 500-ing on first user OAuth attempt.
+ *
+ * Error message lists ALL detected problems (not just the first) so
+ * operators can fix everything in one go.
+ */
+export declare function assertIdentityConfig(config: CommonPubConfig): void;
+//# sourceMappingURL=health.d.ts.map

package/dist/identity/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/identity/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/B;AAeD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,yBAAyB,CAatF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAOlE"}

package/dist/identity/health.js

@@ -0,0 +1,43 @@
+import { isTokenKeyConfigured } from '@commonpub/infra';
+/**
+ * True iff this flag set requires an active `CPUB_FED_TOKEN_KEY`.
+ * `actingAs` alone is fine — it's UI state, not token I/O.
+ */
+function requiresTokenKey(id) {
+    return (id.linkRemoteAccounts ||
+        id.signInWithRemote ||
+        id.remoteInteract ||
+        id.remotePublish);
+}
+/**
+ * Inspect the config; return the list of identity-related
+ * misconfigurations. Empty errors → `ok: true`.
+ *
+ * Pure function: no env mutation, no I/O beyond reading the env var
+ * (which `isTokenKeyConfigured` does without logging the key).
+ */
+export function checkIdentityConfig(config) {
+    const errors = [];
+    const id = config.features.identity;
+    if (requiresTokenKey(id) && !isTokenKeyConfigured()) {
+        errors.push('CPUB_FED_TOKEN_KEY env var must be set when any of ' +
+            'features.identity.{linkRemoteAccounts, signInWithRemote, remoteInteract, remotePublish} ' +
+            'is enabled. Generate with: openssl rand -hex 32');
+    }
+    return { ok: errors.length === 0, errors };
+}
+/**
+ * Same as `checkIdentityConfig` but throws on any error. Use at
+ * Nitro-plugin startup so a misconfigured deploy fails to boot rather
+ * than 500-ing on first user OAuth attempt.
+ *
+ * Error message lists ALL detected problems (not just the first) so
+ * operators can fix everything in one go.
+ */
+export function assertIdentityConfig(config) {
+    const result = checkIdentityConfig(config);
+    if (!result.ok) {
+        throw new Error(`Cross-instance identity misconfigured:\n  - ${result.errors.join('\n  - ')}`);
+    }
+}
+//# sourceMappingURL=health.js.map

package/dist/identity/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/identity/health.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAOxD;;;GAGG;AACH,SAAS,gBAAgB,CAAC,EAA2C;IACnE,OAAO,CACL,EAAE,CAAC,kBAAkB;QACrB,EAAE,CAAC,gBAAgB;QACnB,EAAE,CAAC,cAAc;QACjB,EAAE,CAAC,aAAa,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAEpC,IAAI,gBAAgB,CAAC,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CACT,qDAAqD;YACrD,0FAA0F;YAC1F,iDAAiD,CAClD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,+CAA+C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @commonpub/server / identity — cross-instance delegated authorization.
+ *
+ * Phase 1a foundation: types + action router + FediClient interface.
+ * Phase 1b lands the OAuth flow + FediClient implementation.
+ * Phase 3 lands resolveIdentityContext middleware.
+ * Phase 4 lands ActionRoute declarations for publish/like/follow/comment.
+ *
+ * See docs/sessions/136-cross-instance-identity-plan.md.
+ */
+export type { ActionRoute } from './router.js';
+export { run, ActionUnavailable, InsufficientScopes, LinkedIdentityRevoked, } from './router.js';
+export type { FediClient, VerifiedAccount, FediClientFactory } from './fediClient.js';
+export { getFediClient, setFediClientFactory } from './fediClient.js';
+export type { IdentityConfigCheckResult } from './health.js';
+export { checkIdentityConfig, assertIdentityConfig } from './health.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,GAAG,EACH,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEtE,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/dist/identity/index.js

@@ -0,0 +1,14 @@
+/**
+ * @commonpub/server / identity — cross-instance delegated authorization.
+ *
+ * Phase 1a foundation: types + action router + FediClient interface.
+ * Phase 1b lands the OAuth flow + FediClient implementation.
+ * Phase 3 lands resolveIdentityContext middleware.
+ * Phase 4 lands ActionRoute declarations for publish/like/follow/comment.
+ *
+ * See docs/sessions/136-cross-instance-identity-plan.md.
+ */
+export { run, ActionUnavailable, InsufficientScopes, LinkedIdentityRevoked, } from './router.js';
+export { getFediClient, setFediClientFactory } from './fediClient.js';
+export { checkIdentityConfig, assertIdentityConfig } from './health.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,GAAG,EACH,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAGtE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/dist/identity/router.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Action router — the only place that branches on `active.kind === 'linked'`.
+ *
+ * Every user-facing action gets one ActionRoute declaration with two
+ * halves: `local` (run against this instance's DB as the session user)
+ * and `remote` (proxied via FediClient to the linked identity's home).
+ * The `run()` helper picks the right half based on which identity is
+ * currently active in the request context.
+ *
+ * Adding a new proxiable action = one new file with an ActionRoute.
+ * Existing controllers don't grow `if (linked)` branches.
+ *
+ * See docs/sessions/136-cross-instance-identity-plan.md.
+ */
+import type { Identity, LinkedIdentity, NativeIdentity, Scope } from '@commonpub/auth';
+import type { FediClient } from './fediClient.js';
+/**
+ * Event-type generic. The router doesn't care what event/context shape
+ * the caller's framework uses — it passes the event through to the
+ * `local` handler unchanged. Layer-side code (Nitro/h3) will instantiate
+ * `ActionRoute<H3Event, ...>`; framework-agnostic tests use `unknown`.
+ *
+ * This keeps `@commonpub/server` framework-agnostic (no h3 dep) while
+ * still flowing strong types into layer-side controllers.
+ */
+export interface ActionRoute<TEvent, TIn, TOut> {
+    /** Stable name — used for audit logs, scope-error messages, metrics. */
+    name: string;
+    /** Required scopes when running via a linked identity. Ignored for native. */
+    scopes: ReadonlyArray<Scope>;
+    /** Handler when the active identity is the session's native user. */
+    local(event: TEvent, identity: NativeIdentity, input: TIn): Promise<TOut>;
+    /**
+     * Handler when the active identity is a linked OAuth grant. Optional —
+     * actions that should never be proxied (admin, settings, identity
+     * management itself) leave this undefined and `run()` throws
+     * `ActionUnavailable` if a linked identity tries to invoke.
+     */
+    remote?(client: FediClient, identity: LinkedIdentity, input: TIn): Promise<TOut>;
+}
+export declare class ActionUnavailable extends Error {
+    readonly action: string;
+    readonly reason: string;
+    constructor(action: string, reason: string);
+}
+export declare class InsufficientScopes extends Error {
+    readonly action: string;
+    readonly required: ReadonlyArray<Scope>;
+    readonly granted: ReadonlyArray<Scope>;
+    constructor(action: string, required: ReadonlyArray<Scope>, granted: ReadonlyArray<Scope>);
+}
+export declare class LinkedIdentityRevoked extends Error {
+    readonly identity: LinkedIdentity;
+    constructor(identity: LinkedIdentity);
+}
+/**
+ * Dispatch an action against the currently active identity.
+ *
+ * The active identity is *passed in* rather than read from request
+ * context here — this keeps `run()` a pure function of its inputs and
+ * makes it trivially unit-testable. The middleware that resolves
+ * IdentityContext (Phase 3+) will read `event.context.identity.active`
+ * and forward it.
+ *
+ * Behaviour:
+ *   - `active.kind === 'native'`  → call `action.local(event, active, input)`
+ *   - `active.kind === 'linked'`  → check scopes + revocation, then call
+ *                                   `action.remote(client, active, input)`
+ *
+ * Throws `ActionUnavailable` if the action has no `remote` half but a
+ * linked identity tries it. Throws `LinkedIdentityRevoked` if the
+ * grant is revoked. Throws `InsufficientScopes` if the grant doesn't
+ * cover what the action needs.
+ *
+ * Phase 1a: `getFediClient` is unimplemented; the linked path will
+ * throw at client construction. Phase 1b plumbs it in.
+ */
+export declare function run<TEvent, TIn, TOut>(event: TEvent, active: Identity, action: ActionRoute<TEvent, TIn, TOut>, input: TIn): Promise<TOut>;
+//# sourceMappingURL=router.d.ts.map

package/dist/identity/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/identity/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EACV,QAAQ,EACR,cAAc,EACd,cAAc,EACd,KAAK,EACN,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGlD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI;IAC5C,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,qEAAqE;IACrE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;;;OAKG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3C;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;CAO1F;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;gBACtB,QAAQ,EAAE,cAAc;CAKrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EACzC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,EACtC,KAAK,EAAE,GAAG,GACT,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/identity/router.js

@@ -0,0 +1,72 @@
+import { hasAllScopes, isUsableLinkedIdentity } from '@commonpub/auth';
+import { getFediClient } from './fediClient.js';
+export class ActionUnavailable extends Error {
+    action;
+    reason;
+    constructor(action, reason) {
+        super(`Action "${action}" unavailable: ${reason}`);
+        this.name = 'ActionUnavailable';
+        this.action = action;
+        this.reason = reason;
+    }
+}
+export class InsufficientScopes extends Error {
+    action;
+    required;
+    granted;
+    constructor(action, required, granted) {
+        super(`Action "${action}" needs scopes [${required.join(', ')}]; have [${granted.join(', ')}]`);
+        this.name = 'InsufficientScopes';
+        this.action = action;
+        this.required = required;
+        this.granted = granted;
+    }
+}
+export class LinkedIdentityRevoked extends Error {
+    identity;
+    constructor(identity) {
+        super(`Linked identity ${identity.handle} is revoked; user must re-link`);
+        this.name = 'LinkedIdentityRevoked';
+        this.identity = identity;
+    }
+}
+/**
+ * Dispatch an action against the currently active identity.
+ *
+ * The active identity is *passed in* rather than read from request
+ * context here — this keeps `run()` a pure function of its inputs and
+ * makes it trivially unit-testable. The middleware that resolves
+ * IdentityContext (Phase 3+) will read `event.context.identity.active`
+ * and forward it.
+ *
+ * Behaviour:
+ *   - `active.kind === 'native'`  → call `action.local(event, active, input)`
+ *   - `active.kind === 'linked'`  → check scopes + revocation, then call
+ *                                   `action.remote(client, active, input)`
+ *
+ * Throws `ActionUnavailable` if the action has no `remote` half but a
+ * linked identity tries it. Throws `LinkedIdentityRevoked` if the
+ * grant is revoked. Throws `InsufficientScopes` if the grant doesn't
+ * cover what the action needs.
+ *
+ * Phase 1a: `getFediClient` is unimplemented; the linked path will
+ * throw at client construction. Phase 1b plumbs it in.
+ */
+export async function run(event, active, action, input) {
+    if (active.kind === 'native') {
+        return action.local(event, active, input);
+    }
+    // active.kind === 'linked'
+    if (!action.remote) {
+        throw new ActionUnavailable(action.name, 'not-proxiable');
+    }
+    if (!isUsableLinkedIdentity(active)) {
+        throw new LinkedIdentityRevoked(active);
+    }
+    if (!hasAllScopes(active.scopes, action.scopes)) {
+        throw new InsufficientScopes(action.name, action.scopes, active.scopes);
+    }
+    const client = await getFediClient(active);
+    return action.remote(client, active, input);
+}
+//# sourceMappingURL=router.js.map

package/dist/identity/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/identity/router.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA2BhD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,MAAc;QACxC,KAAK,CAAC,WAAW,MAAM,kBAAkB,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAS;IACf,QAAQ,CAAuB;IAC/B,OAAO,CAAuB;IACvC,YAAY,MAAc,EAAE,QAA8B,EAAE,OAA6B;QACvF,KAAK,CAAC,WAAW,MAAM,mBAAmB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,QAAQ,CAAiB;IAClC,YAAY,QAAwB;QAClC,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,gCAAgC,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,KAAa,EACb,MAAgB,EAChB,MAAsC,EACtC,KAAU;IAEV,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,2BAA2B;IAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/dist/index.d.ts

@@ -64,4 +64,8 @@ export type { SafeFetchOptions } from './import/ssrf.js';
 export { SmtpEmailAdapter, ResendEmailAdapter, ConsoleEmailAdapter, emailTemplates, } from './email.js';
 export type { EmailAdapter, EmailMessage } from './email.js';
 export * from './publicApi/index.js';
+export type { ActionRoute, FediClient, VerifiedAccount, FediClientFactory, IdentityConfigCheckResult, } from './identity/index.js';
+export { run, getFediClient, setFediClientFactory, ActionUnavailable, InsufficientScopes, LinkedIdentityRevoked, checkIdentityConfig, assertIdentityConfig, } from './identity/index.js';
+export type { FederatedAccountGrant } from './federation/oauth.js';
+export { getDecryptedAccessToken, revokeFederatedAccountGrant, } from './federation/oauth.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGvE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,SAAS,EACT,UAAU,EACV,aAAa,EACb,WAAW,EACX,cAAc,EACd,YAAY,EACZ,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,UAAU,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EACV,aAAa,EACb,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGxE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,6BAA6B,EAC7B,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjD,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,WAAW,EACX,OAAO,EACP,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,UAAU,EACV,OAAO,EACT,YAAY,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,MAAM,EACN,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1G,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGpE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGlF,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClH,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGjF,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,KAAK,YAAY,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,cAAc,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EAEjB,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtF,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGvG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAG1E,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGjF,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAGrF,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,UAAU,EACV,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAG1D,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,WAAW,GACZ,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5E,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGzD,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG7D,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGvE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,SAAS,EACT,UAAU,EACV,aAAa,EACb,WAAW,EACX,cAAc,EACd,YAAY,EACZ,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,UAAU,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EACV,aAAa,EACb,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGxE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,6BAA6B,EAC7B,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjD,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,WAAW,EACX,OAAO,EACP,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,UAAU,EACV,OAAO,EACT,YAAY,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtE,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,MAAM,EACN,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1G,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGpE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGlF,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAClH,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGjF,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,KAAK,YAAY,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,cAAc,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EAEjB,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtF,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGvG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAG1E,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGjF,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAGrF,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,UAAU,EACV,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAG1D,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,WAAW,GACZ,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5E,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGzD,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG7D,cAAc,sBAAsB,CAAC;AAQrC,YAAY,EACV,WAAW,EACX,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,GAAG,EACH,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -69,4 +69,6 @@ export { isPrivateUrl, safeFetch, safeFetchBinary } from './import/ssrf.js';
 export { SmtpEmailAdapter, ResendEmailAdapter, ConsoleEmailAdapter, emailTemplates, } from './email.js';
 // Public API (admin-scoped Bearer keys for external consumers)
 export * from './publicApi/index.js';
+export { run, getFediClient, setFediClientFactory, ActionUnavailable, InsufficientScopes, LinkedIdentityRevoked, checkIdentityConfig, assertIdentityConfig, } from './identity/index.js';
+export { getDecryptedAccessToken, revokeFederatedAccountGrant, } from './federation/oauth.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA2ErE,YAAY;AACZ,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExE,gBAAgB;AAChB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,6BAA6B,EAC7B,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,UAAU;AACV,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,qBAAqB;AACrB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO;AACP,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,WAAW,EACX,OAAO,EACP,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,UAAU,GACX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,WAAW;AACX,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAQ5B,SAAS;AACT,OAAO,EACL,UAAU,EACV,OAAO,EACT,YAAY,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,WAAW;AACX,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,MAAM,EACN,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO;AACP,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,yBAAyB;AACzB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAY1B,UAAU;AACV,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAG1G,WAAW;AACX,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AAGvB,2DAA2D;AAC3D,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,4CAA4C;AAC5C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGlH,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEjF,aAAa;AACb,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EAET,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EASf,2BAA2B,EAI3B,0BAA0B,EAC1B,kBAAkB,EAElB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB;AACjB,gBAAgB;AAChB,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,cAAc;AACd,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtF,UAAU;AACV,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAM7B,eAAe;AACf,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAGjC,YAAY;AACZ,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAG9B,QAAQ;AACR,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO;AACP,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAGtB,mBAAmB;AACnB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,WAAW;AACX,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAGhC,SAAS;AACT,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,UAAU,EACV,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAa5B,SAAS;AACT,OAAO,EACL,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAQ5B,aAAa;AACb,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAGpC,SAAS;AACT,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAOnC,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAG5E,QAAQ;AACR,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,+DAA+D;AAC/D,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA2ErE,YAAY;AACZ,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExE,gBAAgB;AAChB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,6BAA6B,EAC7B,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,UAAU;AACV,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,qBAAqB;AACrB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO;AACP,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,QAAQ,EACR,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,WAAW,EACX,OAAO,EACP,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,UAAU,GACX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,WAAW;AACX,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAQ5B,SAAS;AACT,OAAO,EACL,UAAU,EACV,OAAO,EACT,YAAY,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,WAAW;AACX,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,MAAM,EACN,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO;AACP,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,yBAAyB;AACzB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAY1B,UAAU;AACV,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAG1G,WAAW;AACX,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AAGvB,2DAA2D;AAC3D,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,4CAA4C;AAC5C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGlH,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEjF,aAAa;AACb,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EAET,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EASf,2BAA2B,EAI3B,0BAA0B,EAC1B,kBAAkB,EAElB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB;AACjB,gBAAgB;AAChB,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,cAAc;AACd,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtF,UAAU;AACV,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAM7B,eAAe;AACf,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAGjC,YAAY;AACZ,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAG9B,QAAQ;AACR,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO;AACP,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAGtB,mBAAmB;AACnB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,WAAW;AACX,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAGhC,SAAS;AACT,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,UAAU,EACV,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAa5B,SAAS;AACT,OAAO,EACL,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAQ5B,aAAa;AACb,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAGpC,SAAS;AACT,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAOnC,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAG5E,QAAQ;AACR,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,+DAA+D;AAC/D,cAAc,sBAAsB,CAAC;AAerC,OAAO,EACL,GAAG,EACH,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/server",
-  "version": "2.48.0",
+  "version": "2.49.0",
   "type": "module",
   "description": "Framework-agnostic business logic for CommonPub instances",
   "license": "AGPL-3.0-or-later",
@@ -107,14 +107,14 @@
     "isomorphic-dompurify": "^3.3.0",
     "linkedom": "^0.18.12",
     "turndown": "^7.2.4",
-    "@commonpub/infra": "0.6.3",
-    "@commonpub/auth": "0.5.1",
-    "@commonpub/config": "0.11.0",
+    "@commonpub/config": "0.12.0",
     "@commonpub/editor": "0.7.9",
-    "@commonpub/schema": "0.15.0",
-    "@commonpub/docs": "0.6.2",
+    "@commonpub/learning": "0.5.2",
     "@commonpub/protocol": "0.9.9",
-    "@commonpub/learning": "0.5.2"
+    "@commonpub/infra": "0.7.0",
+    "@commonpub/schema": "0.16.0",
+    "@commonpub/auth": "0.6.0",
+    "@commonpub/docs": "0.6.2"
   },
   "peerDependencies": {
     "drizzle-orm": "^0.45.1"