@enbox/dwn-server 0.0.3 → 0.0.5

package/dist/esm/src/registration/jwt-provider-auth-plugin.js

@@ -0,0 +1,90 @@
+import * as jose from 'jose';
+import log from 'loglevel';
+/**
+ * Built-in {@link ProviderAuthPlugin} that validates JWT registration tokens.
+ *
+ * Supports two modes:
+ * - **HMAC secret** (`DWN_PROVIDER_AUTH_JWT_SECRET`): symmetric HS256 verification.
+ * - **JWKS URL** (`DWN_PROVIDER_AUTH_JWT_JWKS_URL`): asymmetric verification via
+ *   a remote JWKS endpoint (RS256, ES256, EdDSA, etc.). Keys are cached and
+ *   rotated automatically by `jose`.
+ *
+ * The JWT payload may include:
+ * - `sub` — mapped to `accountId` in the validation result.
+ * - `metadata` — arbitrary provider-defined object stored with the tenant.
+ *
+ * This plugin ships with `@enbox/dwn-server` and requires no external code.
+ * Providers who need custom validation logic can implement their own
+ * {@link ProviderAuthPlugin} instead.
+ */
+export class JwtProviderAuthPlugin {
+    #getKey;
+    #issuer;
+    #audience;
+    constructor(getKey, issuer, audience) {
+        this.#getKey = getKey;
+        this.#issuer = issuer;
+        this.#audience = audience;
+    }
+    /**
+     * Create a {@link JwtProviderAuthPlugin} from options.
+     *
+     * @param options - Must include exactly one of `secret` or `jwksUrl`.
+     * @throws If neither `secret` nor `jwksUrl` is provided.
+     */
+    static async create(options) {
+        if (!options.secret && !options.jwksUrl) {
+            throw new Error('JwtProviderAuthPlugin: exactly one of `secret` or `jwksUrl` must be provided.');
+        }
+        let getKey;
+        if (options.secret) {
+            getKey = new TextEncoder().encode(options.secret);
+        }
+        else {
+            getKey = jose.createRemoteJWKSet(new URL(options.jwksUrl));
+        }
+        return new JwtProviderAuthPlugin(getKey, options.issuer, options.audience);
+    }
+    /**
+     * Create a {@link JwtProviderAuthPlugin} from environment variables.
+     *
+     * Reads `DWN_PROVIDER_AUTH_JWT_SECRET`, `DWN_PROVIDER_AUTH_JWT_JWKS_URL`,
+     * and optionally `DWN_PROVIDER_AUTH_JWT_ISSUER` / `DWN_PROVIDER_AUTH_JWT_AUDIENCE`.
+     */
+    static async fromEnv() {
+        return JwtProviderAuthPlugin.create({
+            secret: process.env.DWN_PROVIDER_AUTH_JWT_SECRET,
+            jwksUrl: process.env.DWN_PROVIDER_AUTH_JWT_JWKS_URL,
+            issuer: process.env.DWN_PROVIDER_AUTH_JWT_ISSUER,
+            audience: process.env.DWN_PROVIDER_AUTH_JWT_AUDIENCE,
+        });
+    }
+    /** @inheritdoc */
+    async validateRegistrationToken(token) {
+        try {
+            const verifyOptions = {};
+            if (this.#issuer !== undefined) {
+                verifyOptions.issuer = this.#issuer;
+            }
+            if (this.#audience !== undefined) {
+                verifyOptions.audience = this.#audience;
+            }
+            const { payload } = await jose.jwtVerify(token, this.#getKey, verifyOptions);
+            return {
+                isValid: true,
+                accountId: typeof payload.sub === 'string' ? payload.sub : undefined,
+                metadata: typeof payload.metadata === 'object' && payload.metadata !== null
+                    ? payload.metadata
+                    : undefined,
+            };
+        }
+        catch (error) {
+            log.debug('JWT validation failed:', error.message);
+            return {
+                isValid: false,
+                detail: error.message,
+            };
+        }
+    }
+}
+//# sourceMappingURL=jwt-provider-auth-plugin.js.map

package/dist/esm/src/registration/jwt-provider-auth-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-provider-auth-plugin.js","sourceRoot":"","sources":["../../../../src/registration/jwt-provider-auth-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAiB3B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,qBAAqB;IAChC,OAAO,CAAoC;IAC3C,OAAO,CAAqB;IAC5B,SAAS,CAAqB;IAE9B,YACE,MAAyC,EACzC,MAAe,EACf,QAAiB;QAEjB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAqC;QAC9D,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,MAAW,CAAC;QAChB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,OAAO;QACzB,OAAO,qBAAqB,CAAC,MAAM,CAAC;YAClC,MAAM,EAAK,OAAO,CAAC,GAAG,CAAC,4BAA4B;YACnD,OAAO,EAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B;YACrD,MAAM,EAAK,OAAO,CAAC,GAAG,CAAC,4BAA4B;YACnD,QAAQ,EAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B;SACtD,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,yBAAyB,CAAC,KAAa;QAClD,IAAI,CAAC;YACH,MAAM,aAAa,GAA0B,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/B,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;YACtC,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACjC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1C,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAc,EAAE,aAAa,CAAC,CAAC;YAEpF,OAAO;gBACL,OAAO,EAAK,IAAI;gBAChB,SAAS,EAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBACrE,QAAQ,EAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;oBAC3E,CAAC,CAAC,OAAO,CAAC,QAAmC;oBAC7C,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAG,KAAK;gBACf,MAAM,EAAK,KAAe,CAAC,OAAO;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/esm/src/registration/open-auth-handler.d.ts

@@ -0,0 +1,37 @@
+export declare class OpenAuthHandler {
+    #private;
+    private constructor();
+    /**
+     * Create an {@link OpenAuthHandler}.
+     *
+     * @param secret - HMAC shared secret (same as `DWN_PROVIDER_AUTH_JWT_SECRET`).
+     * @param issuer - JWT issuer claim (typically the DWN server's base URL).
+     * @param tokenTtlSeconds - Registration token lifetime in seconds. Default: 1 year.
+     */
+    static create(secret: string, issuer: string, tokenTtlSeconds?: number): OpenAuthHandler;
+    /**
+     * Handle `GET /provider-auth/authorize`.
+     *
+     * In open-auth mode this immediately generates a code and redirects back
+     * to the `redirect_uri` with `code` and `state` query parameters.
+     * No user interaction is required.
+     */
+    handleAuthorize(url: URL): Response;
+    /**
+     * Handle `POST /provider-auth/token`.
+     *
+     * Exchanges an authorization code for a JWT registration token.
+     * Request body: `{ code: string, redirectUri: string }`.
+     */
+    handleToken(req: Request): Promise<Response>;
+    /**
+     * Handle `POST /provider-auth/refresh`.
+     *
+     * Exchanges a refresh token for a new registration token.
+     * Request body: `{ refreshToken: string }`.
+     */
+    handleRefresh(req: Request): Promise<Response>;
+    /** Stops the periodic cleanup timer and clears all pending codes. */
+    destroy(): void;
+}
+//# sourceMappingURL=open-auth-handler.d.ts.map

package/dist/esm/src/registration/open-auth-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-auth-handler.d.ts","sourceRoot":"","sources":["../../../../src/registration/open-auth-handler.ts"],"names":[],"mappings":"AA6BA,qBAAa,eAAe;;IAU1B,OAAO;IAeP;;;;;;OAMG;WACW,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,SAAqB,GAAG,eAAe;IAQ3G;;;;;;OAMG;IACI,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,QAAQ;IAgD1C;;;;;OAKG;IACU,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqDzD;;;;;OAKG;IACU,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0D3D,qEAAqE;IAC9D,OAAO,IAAI,IAAI;CAcvB"}

package/dist/esm/src/registration/open-auth-handler.js

@@ -0,0 +1,214 @@
+import * as jose from 'jose';
+import log from 'loglevel';
+/**
+ * Built-in "open auth" handler for DWN servers that want registration
+ * without any user authentication (open-to-all).
+ *
+ * Implements the provider-auth-v0 authorize / token / refresh endpoints
+ * locally on the DWN server. The authorize endpoint immediately returns
+ * an authorization code (no user interaction), the token endpoint exchanges
+ * it for a JWT registration token, and the refresh endpoint issues a new token.
+ *
+ * This is the simplest possible auth backend — suitable for free/public DWN
+ * providers. Providers who want real authentication (passkey, OIDC, etc.)
+ * host their own auth service and point `providerAuth.authorizeUrl` /
+ * `tokenUrl` to it instead.
+ *
+ * The JWTs issued here are verified by {@link JwtProviderAuthPlugin} using
+ * the same shared secret (`DWN_PROVIDER_AUTH_JWT_SECRET`).
+ */
+/**
+ * Maximum number of pending authorization codes held in memory.
+ * When the limit is reached, new authorize requests are rejected with 503.
+ */
+const MAX_PENDING_CODES = 10_000;
+/** Interval (ms) at which expired authorization codes are purged. */
+const CLEANUP_INTERVAL_MS = 60_000;
+export class OpenAuthHandler {
+    #secret;
+    #issuer;
+    /** Pending authorization codes. Maps code → { redirectUri, expiresAt }. */
+    #pendingCodes;
+    /** Registration token TTL in seconds. Default: 1 year. */
+    #tokenTtlSeconds;
+    /** Periodic cleanup timer for expired codes. */
+    #cleanupTimer;
+    constructor(secret, issuer, tokenTtlSeconds) {
+        this.#secret = secret;
+        this.#issuer = issuer;
+        this.#pendingCodes = new Map();
+        this.#tokenTtlSeconds = tokenTtlSeconds;
+        // Periodically purge expired codes so memory does not grow unbounded
+        // even when no new authorize requests arrive.
+        this.#cleanupTimer = setInterval(() => this.#cleanExpiredCodes(), CLEANUP_INTERVAL_MS);
+        // Allow the process to exit even if the timer is still running.
+        if (this.#cleanupTimer.unref) {
+            this.#cleanupTimer.unref();
+        }
+    }
+    /**
+     * Create an {@link OpenAuthHandler}.
+     *
+     * @param secret - HMAC shared secret (same as `DWN_PROVIDER_AUTH_JWT_SECRET`).
+     * @param issuer - JWT issuer claim (typically the DWN server's base URL).
+     * @param tokenTtlSeconds - Registration token lifetime in seconds. Default: 1 year.
+     */
+    static create(secret, issuer, tokenTtlSeconds = 365 * 24 * 60 * 60) {
+        return new OpenAuthHandler(new TextEncoder().encode(secret), issuer, tokenTtlSeconds);
+    }
+    /**
+     * Handle `GET /provider-auth/authorize`.
+     *
+     * In open-auth mode this immediately generates a code and redirects back
+     * to the `redirect_uri` with `code` and `state` query parameters.
+     * No user interaction is required.
+     */
+    handleAuthorize(url) {
+        const redirectUri = url.searchParams.get('redirect_uri');
+        const state = url.searchParams.get('state');
+        if (!redirectUri) {
+            return Response.json({ error: 'missing redirect_uri parameter' }, { status: 400 });
+        }
+        // Reject new codes when the map is at capacity to prevent memory exhaustion.
+        if (this.#pendingCodes.size >= MAX_PENDING_CODES) {
+            log.warn(`OpenAuthHandler: pending codes map is full (${MAX_PENDING_CODES}), rejecting authorize request`);
+            return Response.json({ error: 'server is busy, try again later' }, { status: 503 });
+        }
+        // Generate a random authorization code.
+        const code = crypto.randomUUID();
+        // Store the code with a 10-minute expiry.
+        this.#pendingCodes.set(code, {
+            redirectUri,
+            expiresAt: Date.now() + 10 * 60 * 1000,
+        });
+        // Periodically clean up expired codes (simple inline sweep).
+        this.#cleanExpiredCodes();
+        // Build redirect URL.
+        const redirect = new URL(redirectUri);
+        redirect.searchParams.set('code', code);
+        if (state) {
+            redirect.searchParams.set('state', state);
+        }
+        log.debug(`OpenAuthHandler: issued code ${code.slice(0, 8)}… for redirect to ${redirectUri}`);
+        return Response.json({
+            code,
+            state: state ?? undefined,
+            redirectUri: redirect.toString(),
+        });
+    }
+    /**
+     * Handle `POST /provider-auth/token`.
+     *
+     * Exchanges an authorization code for a JWT registration token.
+     * Request body: `{ code: string, redirectUri: string }`.
+     */
+    async handleToken(req) {
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return Response.json({ error: 'invalid JSON body' }, { status: 400 });
+        }
+        const { code, redirectUri } = body;
+        if (!code || !redirectUri) {
+            return Response.json({ error: 'missing code or redirectUri' }, { status: 400 });
+        }
+        // Validate the authorization code.
+        const pending = this.#pendingCodes.get(code);
+        if (!pending) {
+            return Response.json({ error: 'invalid or expired code' }, { status: 400 });
+        }
+        if (pending.redirectUri !== redirectUri) {
+            return Response.json({ error: 'redirect_uri mismatch' }, { status: 400 });
+        }
+        if (Date.now() > pending.expiresAt) {
+            this.#pendingCodes.delete(code);
+            return Response.json({ error: 'code expired' }, { status: 400 });
+        }
+        // Consume the code (one-time use).
+        this.#pendingCodes.delete(code);
+        // Generate an account ID for this session (open auth = anonymous accounts).
+        const accountId = crypto.randomUUID();
+        // Issue JWT registration token.
+        const registrationToken = await this.#signToken(accountId, this.#tokenTtlSeconds);
+        // Issue refresh token with longer TTL (2x).
+        const refreshToken = await this.#signToken(accountId, this.#tokenTtlSeconds * 2, 'refresh');
+        log.debug(`OpenAuthHandler: exchanged code for account ${accountId.slice(0, 8)}…`);
+        return Response.json({
+            registrationToken,
+            refreshToken,
+            expiresIn: this.#tokenTtlSeconds,
+            tokenType: 'bearer',
+        });
+    }
+    /**
+     * Handle `POST /provider-auth/refresh`.
+     *
+     * Exchanges a refresh token for a new registration token.
+     * Request body: `{ refreshToken: string }`.
+     */
+    async handleRefresh(req) {
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return Response.json({ error: 'invalid JSON body' }, { status: 400 });
+        }
+        if (!body.refreshToken) {
+            return Response.json({ error: 'missing refreshToken' }, { status: 400 });
+        }
+        // Verify the refresh token.
+        let payload;
+        try {
+            const result = await jose.jwtVerify(body.refreshToken, this.#secret, {
+                issuer: this.#issuer,
+            });
+            payload = result.payload;
+        }
+        catch (error) {
+            return Response.json({ error: `invalid refresh token: ${error.message}` }, { status: 400 });
+        }
+        if (payload.purpose !== 'refresh') {
+            return Response.json({ error: 'token is not a refresh token' }, { status: 400 });
+        }
+        const accountId = payload.sub ?? crypto.randomUUID();
+        // Issue new tokens.
+        const registrationToken = await this.#signToken(accountId, this.#tokenTtlSeconds);
+        const refreshToken = await this.#signToken(accountId, this.#tokenTtlSeconds * 2, 'refresh');
+        log.debug(`OpenAuthHandler: refreshed token for account ${accountId.slice(0, 8)}…`);
+        return Response.json({
+            registrationToken,
+            refreshToken,
+            expiresIn: this.#tokenTtlSeconds,
+            tokenType: 'bearer',
+        });
+    }
+    /** Sign a JWT with the shared secret. */
+    async #signToken(accountId, ttlSeconds, purpose = 'registration') {
+        return new jose.SignJWT({ purpose })
+            .setProtectedHeader({ alg: 'HS256' })
+            .setIssuer(this.#issuer)
+            .setAudience(this.#issuer)
+            .setSubject(accountId)
+            .setIssuedAt()
+            .setExpirationTime(`${ttlSeconds}s`)
+            .sign(this.#secret);
+    }
+    /** Stops the periodic cleanup timer and clears all pending codes. */
+    destroy() {
+        clearInterval(this.#cleanupTimer);
+        this.#pendingCodes.clear();
+    }
+    /** Remove expired authorization codes from the pending map. */
+    #cleanExpiredCodes() {
+        const now = Date.now();
+        for (const [code, data] of this.#pendingCodes) {
+            if (now > data.expiresAt) {
+                this.#pendingCodes.delete(code);
+            }
+        }
+    }
+}
+//# sourceMappingURL=open-auth-handler.js.map

package/dist/esm/src/registration/open-auth-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-auth-handler.js","sourceRoot":"","sources":["../../../../src/registration/open-auth-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,eAAe;IAC1B,OAAO,CAAa;IACpB,OAAO,CAAS;IAChB,2EAA2E;IAC3E,aAAa,CAA0D;IACvE,0DAA0D;IAC1D,gBAAgB,CAAS;IACzB,gDAAgD;IAChD,aAAa,CAAiC;IAE9C,YAAoB,MAAkB,EAAE,MAAc,EAAE,eAAuB;QAC7E,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;QAExC,qEAAqE;QACrE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACvF,gEAAgE;QAChE,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,MAAM,CAAC,MAAc,EAAE,MAAc,EAAE,eAAe,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QACvF,OAAO,IAAI,eAAe,CACxB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,MAAM,EACN,eAAe,CAChB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,eAAe,CAAC,GAAQ;QAC7B,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAC3C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,+CAA+C,iBAAiB,gCAAgC,CAAC,CAAC;YAC3G,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAC5C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEjC,0CAA0C;QAC1C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE;YAC3B,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SACvC,CAAC,CAAC;QAEH,6DAA6D;QAC7D,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,sBAAsB;QACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAC;QAE9F,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,KAAK,EAAS,KAAK,IAAI,SAAS;YAChC,WAAW,EAAG,QAAQ,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,WAAW,CAAC,GAAY;QACnC,IAAI,IAA6C,CAAC;QAClD,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA6C,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEhC,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEtC,gCAAgC;QAChC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAElF,4CAA4C;QAC5C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QAE5F,GAAG,CAAC,KAAK,CAAC,+CAA+C,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAEnF,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,iBAAiB;YACjB,YAAY;YACZ,SAAS,EAAG,IAAI,CAAC,gBAAgB;YACjC,SAAS,EAAG,QAAQ;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,aAAa,CAAC,GAAY;QACrC,IAAI,IAA+B,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA+B,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,0BAA2B,KAAe,CAAC,OAAO,EAAE,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAErD,oBAAoB;QACpB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QAE5F,GAAG,CAAC,KAAK,CAAC,gDAAgD,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAEpF,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,iBAAiB;YACjB,YAAY;YACZ,SAAS,EAAG,IAAI,CAAC,gBAAgB;YACjC,SAAS,EAAG,QAAQ;SACrB,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,UAAkB,EAAE,OAAO,GAAG,cAAc;QAC9E,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;aACjC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;aACzB,UAAU,CAAC,SAAS,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC;aACnC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,qEAAqE;IAC9D,OAAO;QACZ,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,kBAAkB;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9C,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/esm/src/registration/proof-of-work-manager.d.ts

@@ -1,4 +1,4 @@
-import type { ProofOfWorkChallengeModel } from './proof-of-work-types.js';
+import type { ProofOfWorkChallengeModel } from '@enbox/dwn-clients';
 /**
  * Manages proof-of-work challenge difficulty and lifecycle based on solve rate.
  * Can have multiple instances each having their own desired solve rate and difficulty.

package/dist/esm/src/registration/proof-of-work-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof-of-work-manager.d.ts","sourceRoot":"","sources":["../../../../src/registration/proof-of-work-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAK1E;;;GAGG;AACH,qBAAa,kBAAkB;IAE7B,gBAAuB,8BAA8B,sEAAsE;IAG3H,OAAO,CAAC,eAAe,CAIrB;IAIF,OAAO,CAAC,uBAAuB,CAAkC;IAGjE,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,4BAA4B,CAAS;IAC7C,OAAO,CAAC,sCAAsC,CAAS;IACvD,OAAO,CAAC,sCAAsC,CAAS;IACvD,OAAO,CAAC,0BAA0B,CAAS;IAE3C;;OAEG;IACI,kCAAkC,EAAE,MAAM,CAAC;IAElD;;OAEG;IACI,wCAAwC,EAAE,MAAM,CAAC;IAExD;;OAEG;IACH,IAAW,8BAA8B,IAAI,MAAM,CAElD;IAED;;OAEG;IACH,IAAW,0BAA0B,IAAI,MAAM,CAE9C;IAED,OAAO;IAoBP;;;;;;;OAOG;WACiB,MAAM,CAAC,KAAK,EAAE;QAChC,0BAA0B,EAAE,MAAM,CAAC;QACnC,SAAS,EAAE,OAAO,CAAC;QACnB,8BAA8B,CAAC,EAAE,MAAM,CAAC;QACxC,4BAA4B,CAAC,EAAE,MAAM,CAAC;QACtC,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kCAAkC,CAAC,EAAE,MAAM,CAAC;QAC5C,wCAAwC,CAAC,EAAE,MAAM,CAAA;KAClD,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAwB/B;;OAEG;IACI,KAAK,IAAI,IAAI;IAKb,uBAAuB,IAAI,yBAAyB;IAO3D;;OAEG;IACU,iBAAiB,CAAC,WAAW,EAAE;QAC1C,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjB;;;OAGG;IACU,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,OAAO,CAAC,iCAAiC;IAUzC,OAAO,CAAC,wCAAwC;IAUhD,OAAO,CAAC,mCAAmC;IAS3C,OAAO,CAAC,qBAAqB;IAoB7B;;;;;;;OAOG;YACW,8BAA8B;IAyD5C;;OAEG;IACH,OAAO,CAAC,+BAA+B,CAAa;IAEpD;;OAEG;WACW,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAK/C;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;CAQjC"}
+{"version":3,"file":"proof-of-work-manager.d.ts","sourceRoot":"","sources":["../../../../src/registration/proof-of-work-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAKpE;;;GAGG;AACH,qBAAa,kBAAkB;IAE7B,gBAAuB,8BAA8B,sEAAsE;IAG3H,OAAO,CAAC,eAAe,CAIrB;IAIF,OAAO,CAAC,uBAAuB,CAAkC;IAGjE,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,4BAA4B,CAAS;IAC7C,OAAO,CAAC,sCAAsC,CAAS;IACvD,OAAO,CAAC,sCAAsC,CAAS;IACvD,OAAO,CAAC,0BAA0B,CAAS;IAE3C;;OAEG;IACI,kCAAkC,EAAE,MAAM,CAAC;IAElD;;OAEG;IACI,wCAAwC,EAAE,MAAM,CAAC;IAExD;;OAEG;IACH,IAAW,8BAA8B,IAAI,MAAM,CAElD;IAED;;OAEG;IACH,IAAW,0BAA0B,IAAI,MAAM,CAE9C;IAED,OAAO;IAoBP;;;;;;;OAOG;WACiB,MAAM,CAAC,KAAK,EAAE;QAChC,0BAA0B,EAAE,MAAM,CAAC;QACnC,SAAS,EAAE,OAAO,CAAC;QACnB,8BAA8B,CAAC,EAAE,MAAM,CAAC;QACxC,4BAA4B,CAAC,EAAE,MAAM,CAAC;QACtC,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kCAAkC,CAAC,EAAE,MAAM,CAAC;QAC5C,wCAAwC,CAAC,EAAE,MAAM,CAAA;KAClD,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAwB/B;;OAEG;IACI,KAAK,IAAI,IAAI;IAKb,uBAAuB,IAAI,yBAAyB;IAO3D;;OAEG;IACU,iBAAiB,CAAC,WAAW,EAAE;QAC1C,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjB;;;OAGG;IACU,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,OAAO,CAAC,iCAAiC;IAUzC,OAAO,CAAC,wCAAwC;IAUhD,OAAO,CAAC,mCAAmC;IAS3C,OAAO,CAAC,qBAAqB;IAoB7B;;;;;;;OAOG;YACW,8BAA8B;IAyD5C;;OAEG;IACH,OAAO,CAAC,+BAA+B,CAAa;IAEpD;;OAEG;WACW,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAK/C;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;CAQjC"}

package/dist/esm/src/registration/provider-auth-plugin.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Interface for validating provider auth registration tokens.
+ * DWN server operators implement this to integrate with their auth service.
+ *
+ * The token is intentionally opaque — it could be a JWT, blind RSA token,
+ * ecash token, or any other format. The plugin is responsible for all
+ * validation logic.
+ */
+export interface ProviderAuthPlugin {
+    /**
+     * Validate a registration token presented during DID registration.
+     *
+     * @param token - The opaque registration token from the client
+     * @returns Validation result with optional account metadata
+     */
+    validateRegistrationToken(token: string): Promise<ProviderAuthValidationResult>;
+}
+/**
+ * Result of validating a provider auth registration token.
+ */
+export type ProviderAuthValidationResult = {
+    /** Whether the token is valid and the registration should proceed. */
+    isValid: boolean;
+    /**
+     * Optional account identifier that this DID registration is associated with.
+     * Omit for privacy-preserving providers where DID-to-account correlation
+     * should not be stored.
+     */
+    accountId?: string;
+    /**
+     * Optional provider-defined metadata to store with the tenant registration.
+     * Can include plan details, quotas, or any other provider-specific data.
+     * Stored as JSON in the registeredTenants table.
+     */
+    metadata?: Record<string, unknown>;
+    /** Error detail message when isValid is false. */
+    detail?: string;
+};
+/**
+ * Load a ProviderAuthPlugin from a file path.
+ * The module must export a default class or object that implements ProviderAuthPlugin.
+ *
+ * Follows the same pattern as the existing PluginLoader.
+ */
+export declare function loadProviderAuthPlugin(pluginPath: string): Promise<ProviderAuthPlugin>;
+//# sourceMappingURL=provider-auth-plugin.d.ts.map

package/dist/esm/src/registration/provider-auth-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth-plugin.d.ts","sourceRoot":"","sources":["../../../../src/registration/provider-auth-plugin.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CACjF;AAED;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,sEAAsE;IACtE,OAAO,EAAG,OAAO,CAAC;IAElB;;;;OAIG;IACH,SAAS,CAAC,EAAG,MAAM,CAAC;IAEpB;;;;OAIG;IACH,QAAQ,CAAC,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpC,kDAAkD;IAClD,MAAM,CAAC,EAAG,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgC5F"}

package/dist/esm/src/registration/provider-auth-plugin.js

@@ -0,0 +1,29 @@
+import { DwnServerError, DwnServerErrorCode } from '../dwn-error.js';
+/**
+ * Load a ProviderAuthPlugin from a file path.
+ * The module must export a default class or object that implements ProviderAuthPlugin.
+ *
+ * Follows the same pattern as the existing PluginLoader.
+ */
+export async function loadProviderAuthPlugin(pluginPath) {
+    let module;
+    try {
+        module = await import(pluginPath);
+    }
+    catch (error) {
+        throw new DwnServerError(DwnServerErrorCode.ProviderAuthPluginLoadFailed, `Failed to load provider auth plugin at ${pluginPath}: ${error.message}`);
+    }
+    const plugin = module.default;
+    if (plugin === undefined) {
+        throw new DwnServerError(DwnServerErrorCode.ProviderAuthPluginLoadFailed, `Provider auth plugin at ${pluginPath} does not have a default export.`);
+    }
+    // Support both class (instantiate) and plain object exports.
+    const instance = typeof plugin === 'function'
+        ? new plugin()
+        : plugin;
+    if (typeof instance.validateRegistrationToken !== 'function') {
+        throw new DwnServerError(DwnServerErrorCode.ProviderAuthPluginLoadFailed, `Provider auth plugin at ${pluginPath} does not implement validateRegistrationToken().`);
+    }
+    return instance;
+}
+//# sourceMappingURL=provider-auth-plugin.js.map

package/dist/esm/src/registration/provider-auth-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth-plugin.js","sourceRoot":"","sources":["../../../../src/registration/provider-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AA6CrE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB;IAC7D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,cAAc,CACtB,kBAAkB,CAAC,4BAA4B,EAC/C,0CAA0C,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,cAAc,CACtB,kBAAkB,CAAC,4BAA4B,EAC/C,2BAA2B,UAAU,kCAAkC,CACxE,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,MAAM,QAAQ,GAAuB,OAAO,MAAM,KAAK,UAAU;QAC/D,CAAC,CAAC,IAAI,MAAM,EAAwB;QACpC,CAAC,CAAC,MAA4B,CAAC;IAEjC,IAAI,OAAO,QAAQ,CAAC,yBAAyB,KAAK,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,cAAc,CACtB,kBAAkB,CAAC,4BAA4B,EAC/C,2BAA2B,UAAU,kDAAkD,CACxF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/esm/src/registration/registration-manager.d.ts

@@ -1,12 +1,14 @@
-import type { ProofOfWorkChallengeModel } from './proof-of-work-types.js';
+import type { ProviderAuthPlugin } from './provider-auth-plugin.js';
 import type { ActiveTenantCheckResult, TenantGate } from '@enbox/dwn-sdk-js';
-import type { RegistrationData, RegistrationRequest } from './registration-types.js';
+import type { ProofOfWorkChallengeModel, RegistrationRequest } from '@enbox/dwn-clients';
+import { RegistrationStore } from './registration-store.js';
 /**
  * The RegistrationManager is responsible for managing the registration of tenants.
  * It handles tenant registration requests and provides the corresponding `TenantGate` implementation.
  */
 export declare class RegistrationManager implements TenantGate {
     private proofOfWorkManager;
+    private providerAuthPlugin?;
     private registrationStore;
     private termsOfServiceHash?;
     private termsOfService?;
@@ -33,23 +35,44 @@ export declare class RegistrationManager implements TenantGate {
         termsOfServiceFilePath?: string;
         proofOfWorkChallengeNonceSeed?: string;
         proofOfWorkInitialMaximumAllowedHash?: string;
+        providerAuthPlugin?: ProviderAuthPlugin;
     }): Promise<RegistrationManager>;
     /**
      * Gets the proof-of-work challenge.
      */
     getProofOfWorkChallenge(): ProofOfWorkChallengeModel;
     /**
-     * Handles a registration request.
+     * Handles a registration request by dispatching to the appropriate handler
+     * based on the credentials provided.
      */
     handleRegistrationRequest(registrationRequest: RegistrationRequest): Promise<void>;
+    /**
+     * Handles a provider-auth registration request.
+     */
+    private handleProviderAuthRegistration;
+    /**
+     * Handles a proof-of-work registration request.
+     */
+    private handleProofOfWorkRegistration;
     /**
      * Records the given registration data in the database.
      * Exposed as a public method for testing purposes.
      */
-    recordTenantRegistration(registrationData: RegistrationData): Promise<void>;
+    recordTenantRegistration(registrationData: {
+        did: string;
+        termsOfServiceHash?: string;
+        accountId?: string;
+        registrationType?: string;
+        metadata?: string;
+    }): Promise<void>;
     /**
      * The TenantGate implementation.
      */
     isActiveTenant(tenant: string): Promise<ActiveTenantCheckResult>;
+    /**
+     * Returns the underlying RegistrationStore, if initialized.
+     * Used by the admin API to access tenant data.
+     */
+    getRegistrationStore(): RegistrationStore | undefined;
 }
 //# sourceMappingURL=registration-manager.d.ts.map

package/dist/esm/src/registration/registration-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration-manager.d.ts","sourceRoot":"","sources":["../../../../src/registration/registration-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAUrF;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,UAAU;IACpD,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,iBAAiB,CAAoB;IAE7C,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,cAAc,CAAC,CAAS;IAEhC;;OAEG;IACI,iBAAiB,IAAI,MAAM,GAAG,SAAS;IAI9C;;OAEG;IACI,qBAAqB,IAAI,MAAM,GAAG,SAAS;IAIlD;;OAEG;IACI,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAKzD;;;;;OAKG;WACiB,MAAM,CAAC,KAAK,EAAE;QAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAA;QAC/B,6BAA6B,CAAC,EAAE,MAAM,CAAC;QACvC,oCAAoC,CAAC,EAAE,MAAM,CAAC;KAC/C,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAgChC;;OAEG;IACI,uBAAuB,IAAI,yBAAyB;IAK3D;;OAEG;IACU,yBAAyB,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/F;;;OAGG;IACU,wBAAwB,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF;;OAEG;IACU,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAwB9E"}
+{"version":3,"file":"registration-manager.d.ts","sourceRoot":"","sources":["../../../../src/registration/registration-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAOzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,UAAU;IACpD,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,iBAAiB,CAAoB;IAE7C,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,cAAc,CAAC,CAAS;IAEhC;;OAEG;IACI,iBAAiB,IAAI,MAAM,GAAG,SAAS;IAI9C;;OAEG;IACI,qBAAqB,IAAI,MAAM,GAAG,SAAS;IAIlD;;OAEG;IACI,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAKzD;;;;;OAKG;WACiB,MAAM,CAAC,KAAK,EAAE;QAChC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,6BAA6B,CAAC,EAAE,MAAM,CAAC;QACvC,oCAAoC,CAAC,EAAE,MAAM,CAAC;QAC9C,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;KACzC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAqChC;;OAEG;IACI,uBAAuB,IAAI,yBAAyB;IAK3D;;;OAGG;IACU,yBAAyB,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/F;;OAEG;YACW,8BAA8B;IAuC5C;;OAEG;YACW,6BAA6B;IA2B3C;;;OAGG;IACU,wBAAwB,CAAC,gBAAgB,EAAE;QACtD,GAAG,EAAE,MAAM,CAAC;QACZ,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjB;;OAEG;IACU,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkC7E;;;OAGG;IACI,oBAAoB,IAAI,iBAAiB,GAAG,SAAS;CAG7D"}