@grest-ts/oauth 0.0.0-stage → 0.0.90

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Grest Games OÜ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,166 @@
-# Temporary Holding Version
+<!-- GREST-TS-BANNER-START -->
+> Part of the [grest-ts](https://github.com/grest-ts/grest-ts) framework.
+> [Documentation](https://github.com/grest-ts/grest-ts#readme) | [All packages](https://github.com/grest-ts/grest-ts#package-reference)
+<!-- GREST-TS-BANNER-END -->
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @grest-ts/oauth
+
+Make a grest-ts app its own **OAuth 2.1 authorization server** with this package. The token a
+client receives is your app's existing [`@grest-ts/auth`](../auth/README.md) access token: the same
+signer, audience and claims. Your wires and per-route permissions work unchanged for OAuth
+clients, whether that is your own SPA, an MCP connector (Claude, ChatGPT), a CLI or a script.
+
+The protocol is [panva/oidc-provider](https://github.com/panva/node-oidc-provider)
+(OpenID-certified). This package owns the grest-ts seams:
+
+- mounting on a `GGHttpServer`
+- storage
+- token claims
+- handing login and consent to your own UI
+
+| What you get | |
+|---|---|
+| Authorization code + PKCE (S256 only, required) | No implicit/hybrid, no ROPC |
+| Dynamic client registration (RFC 7591), Client ID Metadata Documents | Opt-in. CIMD is what MCP clients prefer |
+| Resource indicators (RFC 8707), `iss` in responses (RFC 9207) | What the MCP authorization spec requires |
+| Refresh rotation with reuse detection | Absolute lifetime: rotation never extends it |
+| Revocation, RFC 8414 + OIDC discovery, RP-initiated logout | |
+
+## Server
+
+A server issues tokens for one or more **resources** (RFC 8707). Each resource has its own token
+kind: audience, claims and TTL. A token for one resource is therefore rejected by another's wire.
+Every resource must set its own `audience` (the constructor refuses otherwise): with a shared signer,
+the audience is the only thing that tells the tokens apart.
+
+```ts
+import {GGOAuthServer, type GGOAuthResource} from "@grest-ts/oauth"
+import {DynamoOAuthStore} from "@grest-ts/oauth/dynamodb"
+
+// Your own app's API: its ordinary user token, only for your own clients.
+const api: GGOAuthResource<UserClaims> = {
+    resource: () => config.issuerUrl.get(),
+    accessToken: userTokenEngine.access,           // GGAuthAccessToken — signer must expose jwsKey()
+    scopes: ["app"],                               // at least one; what they permit is up to you
+    firstPartyOnly: true,
+    claims: async (subject, client) => claimsFor(subject), // at issue AND every refresh; undefined → invalid_grant
+}
+// An MCP endpoint for other apps (Claude, ChatGPT…): own audience, its own (smaller) claims.
+const mcp: GGOAuthResource<McpClaims> = {
+    resource: () => `${config.issuerUrl.get()}/mcp`,   // exactly the URL users enter
+    accessToken: mcpToken,                             // e.g. audience "app-mcp"
+    scopes: ["mcp"],
+    claims: async (subject) => ({permissions: []}),
+}
+
+const oauth = new GGOAuthServer({
+    issuer: () => config.issuerUrl.get(),          // public origin, no path
+    store: new DynamoOAuthStore(dynamo, "my-oauth"),
+    secret: () => config.tokenSecret.reveal(),     // derives cookie + JWKS keys
+    resources: [api, mcp],                         // first = default for first-party clients
+    interactionUrl: (uid, {firstParty, redirectUri}) => `${appUrl}/?oauthLogin=${uid}`,
+    firstPartyClients: () => [{clientId: "web", name: "My App", redirectUris: [`${appUrl}/oauth/callback`]}],
+    clientIdMetadataDocument: {allowedUrlPrefixes: () => ["https://claude.ai/oauth/", "https://chatgpt.com/oauth/"]},
+    // dynamicRegistration: true,                  // open RFC 7591 registration — anyone, any name
+})
+oauth.mount(httpServer)                            // /oauth/* + /.well-known/*, announced to discovery
+oauth.protect(httpServer, mcp, "/mcp", handleMcp)  // 401 + resource metadata, then your handler
+new GGHttp(httpServer).http(OAuthInteractionApi, oauth.interactionApi(() => USER.get()!.id))
+```
+
+`claims` works like the `resolve` callback of `GGAuthRefreshToken.refresh`: role changes apply on
+the next refresh, and a deleted or deactivated user's OAuth session ends there.
+
+`listGrants(subject)` and `revokeGrant(subject, grantId)` back a "connected apps" page.
+`revokeAll(subject)` is "log out everywhere"; call it next to `GGAuthRefreshToken.revokeAll`.
+
+### Protected resources (MCP)
+
+`protect(server, resource, path, handler)` puts `path` behind the resource's token. It also
+provides the discovery handshake MCP clients run:
+
+- A request without a valid token gets `401 WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource{path}", scope="…"`.
+- That metadata (RFC 9728) names this server and the resource's scopes.
+- Your handler receives the verified token payload. For example, run the official MCP SDK's
+  `StreamableHTTPServerTransport` on the raw `req`/`res`.
+
+### Which clients may sign in
+
+| Client | How it's known | Consent |
+|---|---|---|
+| First-party (`firstPartyClients`) | Pre-registered | None; silent while the login session lives |
+| Client ID Metadata Document under `allowedUrlPrefixes` (https, default port) | `client_id` is its document URL, fetched by the server | Once per grant |
+| Loopback / CLI (no `application_type` declared → native) | Any port on `localhost`/`127.0.0.1` matches | **Every** authorization: any local process could claim the redirect |
+| Dynamic registration (opt-in) | `POST /oauth/register` | Once per grant |
+
+### Login and consent stay in your app
+
+`/oauth/authorize` sends the browser to `interactionUrl(uid)`. That page uses your normal login,
+then calls `GGOAuthInteractionContract`. Bind the contract with **your** user wire, so the
+signed-in user becomes the OAuth subject:
+
+```ts
+export const OAuthInteractionApi = new GGHttpSchema({
+    contract: GGOAuthInteractionContract, pathPrefix: "api/oauth/interaction", use: [USER_WIRE],
+    routes: {get: GGRpc.GET("get"), approve: GGRpc.POST("approve"), deny: GGRpc.POST("deny")},
+})
+```
+
+The page works like this:
+
+1. `get({uid})` returns the client (name, `firstParty`, redirect hosts, `loopbackOnly`) and the
+   requested scopes.
+2. For a first-party client, call `approve` right away. For any other client, show a consent
+   screen first. Display the redirect hosts, and warn when `loopbackOnly` is set.
+3. `approve`/`deny` return `redirectUrl` for the browser to follow. The result applies only in
+   the browser holding the flow's interaction cookie, so a user approving someone else's flow
+   can't hand them a code.
+
+A first-party client re-authorizes silently while the login session lives.
+
+### Storage
+
+`GGOAuthStore` is a small key/value interface over oidc-provider's models. Two implementations
+ship:
+
+- `InMemoryOAuthStore`: single process only (tests, local dev).
+- `DynamoOAuthStore` (`@grest-ts/oauth/dynamodb`). Its table needs:
+  - HASH key `pk` (S)
+  - TTL attribute `expiresAtSec`
+  - GSIs projecting ALL: `grantId-index`, `uid-index`, `accountId-index`
+
+## Browser client
+
+```ts
+import {GGOAuthClient, decodeAccessToken} from "@grest-ts/oauth"
+
+const oauth = new GGOAuthClient({
+    server: apiBase, clientId: "web", scope: "app",
+    redirectUri: `${location.origin}/oauth/callback`, postLogoutRedirectUri: `${location.origin}/`,
+    identity: (token) => toUser(decodeAccessToken(token)),   // session.get() data; UI-only, unverified
+})
+const session = GGAuthSession.withToken(USER_WIRE, {localStorageKey: "auth", refresh: oauth.refresh})
+
+if (oauth.isCallback(location.href)) session.start((await oauth.handleCallback(location.href)).result)
+else if (!session.isLoggedIn()) await oauth.authorize({returnTo: location.pathname + location.search})
+
+oauth.logout(undefined)   // ends the authorization server's login session too
+```
+
+- `iss` is checked against the issuer in the server's metadata.
+- `resource` defaults to that issuer.
+- `invalid_grant` on refresh surfaces as `NOT_AUTHORIZED`, which ends the session.
+
+## Notes
+
+- The issuer, first-party clients, keys and resources are handed to oidc-provider when the first
+  OAuth request arrives. Changing them takes a restart; `allowedUrlPrefixes` is read on every fetch.
+- A sign-in finishes on the origin it started on only if that is the issuer or one of `origins`.
+  Request hosts are client-controlled, so anything else falls back to the issuer.
+- The issuer is an origin. Clients bind to it, so changing it disconnects them.
+- Endpoints in the metadata follow the request host. Serve the issuer host directly or keep
+  `Host` through your proxy, and pass `proxy: true` behind a TLS-terminating load balancer (it trusts
+  `X-Forwarded-Proto`; `X-Forwarded-Host` is always ignored — clients can send it).
+- oidc-provider's CIMD support is experimental (draft-02). The version is pinned exactly.
+- The OAuth endpoints use the standard form-encoded protocol, not grest-ts contracts. That is the
+  one place this package speaks raw HTTP.

package/dist/src/_dedupCheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=_dedupCheck.d.ts.map

package/dist/src/_dedupCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_dedupCheck.d.ts","sourceRoot":"","sources":["../../src/_dedupCheck.ts"],"names":[],"mappings":""}

package/dist/src/_dedupCheck.js

@@ -0,0 +1,28 @@
+// =============================================================================
+// THIS FILE IS GENERATED - DO NOT EDIT
+//
+// Detects duplicate loads of @grest-ts/oauth. Two copies of a grest-ts
+// framework package in the same process break async context, validation
+// registries, and service discovery. Throw with both paths so the packaging
+// mistake is immediately diagnosable.
+//
+// Generated by scripts/packager — re-run `npm run generate` to refresh.
+// =============================================================================
+const __KEY = Symbol.for("grest-ts:dedup:@grest-ts/oauth");
+const __slot = globalThis;
+const __existing = __slot[__KEY];
+const __here = { path: import.meta.url, version: "0.0.90" };
+// Same path + same version means the same physical package is being
+// re-evaluated by a different ESM runner (e.g. vitest projects share one
+// process but each project has its own module cache). That isn't a true
+// duplicate package — only differing paths or versions are.
+if (__existing && (__existing.path !== __here.path || __existing.version !== __here.version)) {
+    throw new Error("[@grest-ts/oauth] Duplicate package load detected.\n" +
+        "  Already loaded: " + __existing.path + " (v" + __existing.version + ")\n" +
+        "  Now loading:    " + __here.path + " (v" + __here.version + ")\n" +
+        "Two copies of grest-ts framework packages in one process break\n" +
+        "async context, validation, and service discovery. Fix the packaging.");
+}
+__slot[__KEY] = __here;
+export {};
+//# sourceMappingURL=_dedupCheck.js.map

package/dist/src/_dedupCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_dedupCheck.js","sourceRoot":"","sources":["../../src/_dedupCheck.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,uCAAuC;AACvC,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,4EAA4E;AAC5E,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,gFAAgF;AAEhF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAC3D,MAAM,MAAM,GAAG,UAAqC,CAAC;AACrD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAkD,CAAC;AAClF,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC5D,oEAAoE;AACpE,yEAAyE;AACzE,wEAAwE;AACxE,4DAA4D;AAC5D,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,KAAK,CACX,sDAAsD;QACtD,oBAAoB,GAAG,UAAU,CAAC,IAAI,GAAG,KAAK,GAAG,UAAU,CAAC,OAAO,GAAG,KAAK;QAC3E,oBAAoB,GAAG,MAAM,CAAC,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC,OAAO,GAAG,KAAK;QACnE,kEAAkE;QAClE,sEAAsE,CACzE,CAAC;AACN,CAAC;AACD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC"}

package/dist/src/browser/GGOAuthClient.d.ts

@@ -0,0 +1,50 @@
+export interface GGOAuthResult<I> {
+    tokens: {
+        access: {
+            token: string;
+            expiresAt: number;
+        };
+        refresh?: {
+            token: string;
+            expiresAt: number;
+        };
+    };
+    data: I;
+}
+export interface GGOAuthClientConfig<I> {
+    server: string;
+    clientId: string;
+    redirectUri: string;
+    postLogoutRedirectUri?: string;
+    resource?: string;
+    scope?: string;
+    identity: (accessToken: string) => I;
+    refreshTtlMs?: number;
+}
+export declare class GGOAuthClient<I = unknown> {
+    private metadata;
+    private leaving;
+    private readonly config;
+    constructor(config: GGOAuthClientConfig<I>);
+    authorize: (opts?: {
+        returnTo?: string;
+    }) => Promise<void>;
+    isCallback: (href: string) => boolean;
+    handleCallback: (href: string) => Promise<{
+        result: GGOAuthResult<I>;
+        returnTo?: string;
+    }>;
+    refresh: ({ refreshToken }: {
+        refreshToken: string;
+    }) => Promise<GGOAuthResult<I>>;
+    logout: (refreshToken: string | undefined) => Promise<void>;
+    private leave;
+    private token;
+    private discover;
+}
+export declare function decodeAccessToken<T>(accessToken: string): {
+    sub: string;
+    exp: number;
+    data: T;
+};
+//# sourceMappingURL=GGOAuthClient.d.ts.map

package/dist/src/browser/GGOAuthClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGOAuthClient.d.ts","sourceRoot":"","sources":["../../../src/browser/GGOAuthClient.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa,CAAC,CAAC;IAC5B,MAAM,EAAE;QAAC,MAAM,EAAE;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAC,CAAC;QAAC,OAAO,CAAC,EAAE;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAC,CAAA;KAAC,CAAA;IAClG,IAAI,EAAE,CAAC,CAAA;CACV;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC;IAGlC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAI9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,CAAA;IAGpC,YAAY,CAAC,EAAE,MAAM,CAAA;CACxB;AASD,qBAAa,aAAa,CAAC,CAAC,GAAG,OAAO;IAElC,OAAO,CAAC,QAAQ,CAA+B;IAG/C,OAAO,CAAC,OAAO,CAA2B;IAE1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEnC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAKnC,SAAS,GAAI,OAAO;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB5D;IAEK,UAAU,GAAI,MAAM,MAAM,KAAG,OAAO,CAI1C;IAEM,cAAc,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,CAkBnG;IAEM,OAAO,GAAU,kBAAgB;QAAC,YAAY,EAAE,MAAM,CAAA;KAAC,KAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAChB;IAInE,MAAM,GAAI,cAAc,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB/D;YAEY,KAAK;YAkBL,KAAK;IAuBnB,OAAO,CAAC,QAAQ;CAQnB;AAID,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAC,CAE7F"}

package/dist/src/browser/GGOAuthClient.js

@@ -0,0 +1,152 @@
+/// <reference lib="dom" />
+import { decodeJwt } from "jose";
+import { NOT_AUTHORIZED } from "@grest-ts/schema";
+const PENDING_KEY = "gg-oauth-pending";
+// Browser OAuth client (authorization code + PKCE S256), the `refresh` of a GGAuthSession — see README.
+// The token/revocation endpoints are OAuth protocol endpoints (form-encoded), not grest-ts contracts.
+export class GGOAuthClient {
+    metadata;
+    // The redirect away being prepared: a second one (e.g. a signed-out view starting sign-in while
+    // logout redirects) waits for it — forever if it navigates, and takes over if it fails.
+    leaving;
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    // Redirects the browser to the authorization server; resolves never (the page unloads).
+    authorize = (opts) => this.leave(async () => {
+        const meta = await this.discover();
+        const verifier = randomString();
+        const pending = { state: randomString(), verifier, returnTo: opts?.returnTo };
+        sessionStorage.setItem(PENDING_KEY, JSON.stringify(pending));
+        const url = new URL(meta.authorization_endpoint);
+        url.search = new URLSearchParams({
+            response_type: "code",
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            state: pending.state,
+            code_challenge: await s256(verifier),
+            code_challenge_method: "S256",
+            resource: this.config.resource ?? meta.issuer,
+            ...(this.config.scope ? { scope: this.config.scope } : {}),
+        }).toString();
+        return url.href;
+    });
+    isCallback = (href) => {
+        const url = new URL(href);
+        return url.origin + url.pathname === new URL(this.config.redirectUri).href.replace(/[?#].*$/, "")
+            && (url.searchParams.has("code") || url.searchParams.has("error"));
+    };
+    handleCallback = async (href) => {
+        const params = new URL(href).searchParams;
+        const raw = sessionStorage.getItem(PENDING_KEY);
+        sessionStorage.removeItem(PENDING_KEY);
+        const pending = raw ? JSON.parse(raw) : undefined;
+        if (!pending || params.get("state") !== pending.state)
+            throw new NOT_AUTHORIZED({ debugMessage: "OAuth state mismatch" });
+        // RFC 9207: reject a response from a different authorization server (mix-up attack).
+        const iss = params.get("iss");
+        if (iss !== null && iss !== (await this.discover()).issuer)
+            throw new NOT_AUTHORIZED({ debugMessage: "OAuth issuer mismatch" });
+        const error = params.get("error");
+        if (error)
+            throw new NOT_AUTHORIZED({ debugMessage: `OAuth ${error}: ${params.get("error_description") ?? ""}` });
+        const result = await this.token({
+            grant_type: "authorization_code",
+            code: params.get("code") ?? "",
+            redirect_uri: this.config.redirectUri,
+            code_verifier: pending.verifier,
+        });
+        return { result, returnTo: pending.returnTo };
+    };
+    refresh = async ({ refreshToken }) => this.token({ grant_type: "refresh_token", refresh_token: refreshToken });
+    // Revokes the refresh token and ends the authorization server's login session (redirects away
+    // when the server supports it).
+    logout = (refreshToken) => this.leave(async () => {
+        const meta = await this.discover();
+        const revoke = refreshToken && meta.revocation_endpoint
+            ? fetch(meta.revocation_endpoint, { method: "POST", keepalive: true, signal: AbortSignal.timeout(5000), body: new URLSearchParams({ token: refreshToken, client_id: this.config.clientId }) }).then(() => undefined, () => undefined)
+            : Promise.resolve();
+        if (!meta.end_session_endpoint) {
+            await revoke;
+            return undefined;
+        }
+        // Revocation not awaited (keepalive outlives the navigation): the sooner the redirect, the
+        // shorter the window in which other tabs could still sign in silently.
+        const url = new URL(meta.end_session_endpoint);
+        url.search = new URLSearchParams({
+            client_id: this.config.clientId,
+            ...(this.config.postLogoutRedirectUri ? { post_logout_redirect_uri: this.config.postLogoutRedirectUri } : {}),
+        }).toString();
+        return url.href;
+    });
+    async leave(target) {
+        while (this.leaving)
+            await this.leaving.catch(() => undefined);
+        const run = (async () => {
+            const url = await target();
+            if (url === undefined)
+                return;
+            // Back from the back/forward cache (navigation undone): the redirect is over.
+            window.addEventListener("pageshow", () => { if (this.leaving === run)
+                this.leaving = undefined; }, { once: true });
+            window.location.assign(url);
+            await new Promise(() => undefined);
+        })();
+        this.leaving = run;
+        try {
+            await run;
+        }
+        finally {
+            if (this.leaving === run)
+                this.leaving = undefined;
+        }
+    }
+    async token(body) {
+        const meta = await this.discover();
+        const res = await fetch(meta.token_endpoint, {
+            method: "POST",
+            body: new URLSearchParams({ ...body, client_id: this.config.clientId, resource: this.config.resource ?? meta.issuer }),
+        });
+        const json = await res.json().catch(() => ({}));
+        if (!res.ok) {
+            // invalid_grant = the refresh/code is dead → fatal for the session; anything else may be transient.
+            if (res.status === 400 || res.status === 401)
+                throw new NOT_AUTHORIZED({ debugMessage: `OAuth ${String(json.error)}` });
+            throw new Error(`OAuth token endpoint ${res.status}`);
+        }
+        const now = Date.now();
+        const access = String(json.access_token);
+        return {
+            tokens: {
+                access: { token: access, expiresAt: now + Number(json.expires_in) * 1000 },
+                ...(json.refresh_token ? { refresh: { token: String(json.refresh_token), expiresAt: now + (this.config.refreshTtlMs ?? 30 * 24 * 3600 * 1000) } } : {}),
+            },
+            data: this.config.identity(access),
+        };
+    }
+    discover() {
+        this.metadata ??= fetch(`${this.config.server}/.well-known/oauth-authorization-server`).then(async (res) => {
+            if (!res.ok)
+                throw new Error(`OAuth discovery failed: ${res.status}`);
+            return await res.json();
+        });
+        this.metadata.catch(() => { this.metadata = undefined; });
+        return this.metadata;
+    }
+}
+// A grest-ts access token's payload, unverified — for UI identity only; the server re-verifies
+// every request.
+export function decodeAccessToken(accessToken) {
+    return decodeJwt(accessToken);
+}
+function randomString() {
+    return base64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+async function s256(verifier) {
+    return base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+}
+function base64url(bytes) {
+    return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//# sourceMappingURL=GGOAuthClient.js.map

package/dist/src/browser/GGOAuthClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGOAuthClient.js","sourceRoot":"","sources":["../../../src/browser/GGOAuthClient.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAC,SAAS,EAAC,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAA;AA8B/C,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAEtC,wGAAwG;AACxG,sGAAsG;AACtG,MAAM,OAAO,aAAa;IAEd,QAAQ,CAA+B;IAC/C,gGAAgG;IAChG,wFAAwF;IAChF,OAAO,CAA2B;IAEzB,MAAM,CAAwB;IAE/C,YAAY,MAA8B;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACxB,CAAC;IAED,wFAAwF;IACjF,SAAS,GAAG,CAAC,IAA0B,EAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;QACpF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAA;QAC/B,MAAM,OAAO,GAAY,EAAC,KAAK,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAC,CAAA;QACpF,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;QAChD,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;YAC7B,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;YACpC,qBAAqB,EAAE,MAAM;YAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM;YAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC,QAAQ,EAAE,CAAA;QACb,OAAO,GAAG,CAAC,IAAI,CAAA;IACnB,CAAC,CAAC,CAAA;IAEK,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;eAC1F,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1E,CAAC,CAAA;IAEM,cAAc,GAAG,KAAK,EAAE,IAAY,EAA0D,EAAE;QACnG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAA;QACzC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/C,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5D,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,cAAc,CAAC,EAAC,YAAY,EAAE,sBAAsB,EAAC,CAAC,CAAA;QACvH,qFAAqF;QACrF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,EAAC,YAAY,EAAE,uBAAuB,EAAC,CAAC,CAAA;QAC7H,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,KAAK;YAAE,MAAM,IAAI,cAAc,CAAC,EAAC,YAAY,EAAE,SAAS,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAC,CAAC,CAAA;QAC/G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YAC5B,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;YAC9B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,OAAO,CAAC,QAAQ;SAClC,CAAC,CAAA;QACF,OAAO,EAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAC,CAAA;IAC/C,CAAC,CAAA;IAEM,OAAO,GAAG,KAAK,EAAE,EAAC,YAAY,EAAyB,EAA6B,EAAE,CACzF,IAAI,CAAC,KAAK,CAAC,EAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAC,CAAC,CAAA;IAE1E,8FAA8F;IAC9F,gCAAgC;IACzB,MAAM,GAAG,CAAC,YAAgC,EAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,YAAY,IAAI,IAAI,CAAC,mBAAmB;YACnD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,CAAC,EAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC;YACjO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;QACvB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAA;YACZ,OAAO,SAAS,CAAA;QACpB,CAAC;QACD,2FAA2F;QAC3F,uEAAuE;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QAC9C,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;YAC7B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAC,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9G,CAAC,CAAC,QAAQ,EAAE,CAAA;QACb,OAAO,GAAG,CAAC,IAAI,CAAA;IACnB,CAAC,CAAC,CAAA;IAEM,KAAK,CAAC,KAAK,CAAC,MAAyC;QACzD,OAAO,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC9D,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAM;YAC7B,8EAA8E;YAC9E,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA,CAAC,CAAC,EAAE,EAAC,IAAI,EAAE,IAAI,EAAC,CAAC,CAAA;YAC/G,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACtC,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,OAAO,GAAG,GAAG,CAAA;QAClB,IAAI,CAAC;YACD,MAAM,GAAG,CAAA;QACb,CAAC;gBAAS,CAAC;YACP,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;QACtD,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAA4B;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC,EAAC,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAC,CAAC;SACvH,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAA;QAC1E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,oGAAoG;YACpG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,cAAc,CAAC,EAAC,YAAY,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAC,CAAC,CAAA;YACrH,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACzD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACxC,OAAO;YACH,MAAM,EAAE;gBACJ,MAAM,EAAE,EAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,EAAC;gBACxE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,EAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACtJ;YACD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;SACrC,CAAA;IACL,CAAC;IAEO,QAAQ;QACZ,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,yCAAyC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;YACrG,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YACrE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAc,CAAA;QACvC,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA,CAAC,CAAC,CAAC,CAAA;QACxD,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;CACJ;AAED,+FAA+F;AAC/F,iBAAiB;AACjB,MAAM,UAAU,iBAAiB,CAAI,WAAmB;IACpD,OAAO,SAAS,CAAC,WAAW,CAAmD,CAAA;AACnF,CAAC;AAED,SAAS,YAAY;IACjB,OAAO,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,QAAgB;IAChC,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC/G,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAChC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACzG,CAAC"}

package/dist/src/index-browser.d.ts

@@ -0,0 +1,6 @@
+import "./_dedupCheck";
+export { GGOAuthClient, decodeAccessToken } from "./browser/GGOAuthClient";
+export type { GGOAuthClientConfig, GGOAuthResult } from "./browser/GGOAuthClient";
+export { GGOAuthInteractionContract, IsGGOAuthInteraction, IsGGOAuthInteractionClient } from "./shared/interactionContract";
+export type { GGOAuthInteraction, GGOAuthInteractionClient } from "./shared/interactionContract";
+//# sourceMappingURL=index-browser.d.ts.map

package/dist/src/index-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-browser.d.ts","sourceRoot":"","sources":["../../src/index-browser.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAC,aAAa,EAAE,iBAAiB,EAAC,MAAM,yBAAyB,CAAA;AACxE,YAAY,EAAC,mBAAmB,EAAE,aAAa,EAAC,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EAAC,0BAA0B,EAAE,oBAAoB,EAAE,0BAA0B,EAAC,MAAM,8BAA8B,CAAA;AACzH,YAAY,EAAC,kBAAkB,EAAE,wBAAwB,EAAC,MAAM,8BAA8B,CAAA"}

package/dist/src/index-browser.js

@@ -0,0 +1,4 @@
+import "./_dedupCheck.js";
+export { GGOAuthClient, decodeAccessToken } from "./browser/GGOAuthClient.js";
+export { GGOAuthInteractionContract, IsGGOAuthInteraction, IsGGOAuthInteractionClient } from "./shared/interactionContract.js";
+//# sourceMappingURL=index-browser.js.map

package/dist/src/index-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-browser.js","sourceRoot":"","sources":["../../src/index-browser.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAC,aAAa,EAAE,iBAAiB,EAAC,MAAM,yBAAyB,CAAA;AAExE,OAAO,EAAC,0BAA0B,EAAE,oBAAoB,EAAE,0BAA0B,EAAC,MAAM,8BAA8B,CAAA"}

package/dist/src/index-node.d.ts

@@ -0,0 +1,8 @@
+import "./_dedupCheck";
+export { GGOAuthServer } from "./node/GGOAuthServer";
+export type { GGOAuthServerOptions, GGOAuthFirstPartyClient, GGOAuthResource } from "./node/GGOAuthServer";
+export type { GGOAuthStore, GGOAuthPayload } from "./node/store/GGOAuthStore";
+export { InMemoryOAuthStore } from "./node/store/InMemoryOAuthStore";
+export { GGOAuthInteractionContract, IsGGOAuthInteraction, IsGGOAuthInteractionClient } from "./shared/interactionContract";
+export type { GGOAuthInteraction, GGOAuthInteractionClient } from "./shared/interactionContract";
+//# sourceMappingURL=index-node.d.ts.map

package/dist/src/index-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-node.d.ts","sourceRoot":"","sources":["../../src/index-node.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAA;AAClD,YAAY,EAAC,oBAAoB,EAAE,uBAAuB,EAAE,eAAe,EAAC,MAAM,sBAAsB,CAAA;AACxG,YAAY,EAAC,YAAY,EAAE,cAAc,EAAC,MAAM,2BAA2B,CAAA;AAC3E,OAAO,EAAC,kBAAkB,EAAC,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAC,0BAA0B,EAAE,oBAAoB,EAAE,0BAA0B,EAAC,MAAM,8BAA8B,CAAA;AACzH,YAAY,EAAC,kBAAkB,EAAE,wBAAwB,EAAC,MAAM,8BAA8B,CAAA"}

package/dist/src/index-node.js

@@ -0,0 +1,5 @@
+import "./_dedupCheck.js";
+export { GGOAuthServer } from "./node/GGOAuthServer.js";
+export { InMemoryOAuthStore } from "./node/store/InMemoryOAuthStore.js";
+export { GGOAuthInteractionContract, IsGGOAuthInteraction, IsGGOAuthInteractionClient } from "./shared/interactionContract.js";
+//# sourceMappingURL=index-node.js.map

package/dist/src/index-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-node.js","sourceRoot":"","sources":["../../src/index-node.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAA;AAGlD,OAAO,EAAC,kBAAkB,EAAC,MAAM,iCAAiC,CAAA;AAClE,OAAO,EAAC,0BAA0B,EAAE,oBAAoB,EAAE,0BAA0B,EAAC,MAAM,8BAA8B,CAAA"}

package/dist/src/node/GGOAuthServer.d.ts

@@ -0,0 +1,72 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { GGHttpServer } from "@grest-ts/http";
+import type { GGAccessPayload, GGAuthAccessToken } from "@grest-ts/auth";
+import { GGOAuthInteractionContract } from "../shared/interactionContract";
+import { type GGOAuthStore } from "./store/GGOAuthStore";
+export interface GGOAuthFirstPartyClient {
+    clientId: string;
+    name: string;
+    redirectUris: string[];
+    postLogoutRedirectUris?: string[];
+}
+export interface GGOAuthResource<C extends object> {
+    resource: () => string;
+    accessToken: GGAuthAccessToken<C>;
+    scopes: [string, ...string[]];
+    claims: (subject: string, client: {
+        clientId: string;
+        name: string;
+    }) => Promise<C | undefined>;
+    firstPartyOnly?: boolean;
+}
+export interface GGOAuthServerOptions {
+    issuer: () => string;
+    origins?: () => string[];
+    store: GGOAuthStore;
+    secret: () => string;
+    resources: [GGOAuthResource<any>, ...GGOAuthResource<any>[]];
+    interactionUrl: (uid: string, request: {
+        redirectUri: string;
+        firstParty: boolean;
+    }) => string;
+    firstPartyClients?: () => GGOAuthFirstPartyClient[];
+    dynamicRegistration?: boolean;
+    clientIdMetadataDocument?: {
+        allowedUrlPrefixes: () => string[];
+    };
+    refreshTtlSec?: number;
+    sessionTtlSec?: number;
+    proxy?: boolean;
+}
+export declare class GGOAuthServer {
+    private _provider;
+    private _callback;
+    private _firstParty;
+    private readonly options;
+    constructor(options: GGOAuthServerOptions);
+    private get firstParty();
+    mount(server: GGHttpServer): void;
+    protect<C extends object>(server: GGHttpServer, resource: GGOAuthResource<C>, path: string, handle: (req: IncomingMessage, res: ServerResponse, token: GGAccessPayload<C>) => Promise<void>): void;
+    interactionApi(subject: () => string): typeof GGOAuthInteractionContract.infer;
+    listGrants: (subject: string) => Promise<Array<{
+        grantId: string;
+        clientId: string;
+        clientName: string;
+        createdAt: number;
+    }>>;
+    revokeGrant: (subject: string, grantId: string) => Promise<void>;
+    revokeAll: (subject: string) => Promise<void>;
+    private describeInteraction;
+    private approve;
+    private findInteraction;
+    private ticket;
+    private finishInteraction;
+    private grantRequested;
+    private requestedResource;
+    private resource;
+    private clientOf;
+    private usableResource;
+    private defaultResource;
+    private provider;
+}
+//# sourceMappingURL=GGOAuthServer.d.ts.map

package/dist/src/node/GGOAuthServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GGOAuthServer.d.ts","sourceRoot":"","sources":["../../../src/node/GGOAuthServer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,eAAe,EAAE,cAAc,EAAC,MAAM,WAAW,CAAA;AAG9D,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAC,eAAe,EAAE,iBAAiB,EAAC,MAAM,gBAAgB,CAAA;AACtE,OAAO,EAAC,0BAA0B,EAA0B,MAAM,+BAA+B,CAAA;AACjG,OAAO,EAAgB,KAAK,YAAY,EAAC,MAAM,sBAAsB,CAAA;AAErE,MAAM,WAAW,uBAAuB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;CACpC;AAGD,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,MAAM;IAE7C,QAAQ,EAAE,MAAM,MAAM,CAAA;IAGtB,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAA;IAEjC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IAG7B,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IAE7F,cAAc,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,oBAAoB;IAEjC,MAAM,EAAE,MAAM,MAAM,CAAA;IAGpB,OAAO,CAAC,EAAE,MAAM,MAAM,EAAE,CAAA;IACxB,KAAK,EAAE,YAAY,CAAA;IAGnB,MAAM,EAAE,MAAM,MAAM,CAAA;IAEpB,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAG5D,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAC,KAAK,MAAM,CAAA;IAG5F,iBAAiB,CAAC,EAAE,MAAM,uBAAuB,EAAE,CAAA;IAEnD,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAI7B,wBAAwB,CAAC,EAAE;QAAC,kBAAkB,EAAE,MAAM,MAAM,EAAE,CAAA;KAAC,CAAA;IAE/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;IAGtB,KAAK,CAAC,EAAE,OAAO,CAAA;CAClB;AAaD,qBAAa,aAAa;IAEtB,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,WAAW,CAAkD;IACrE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;gBAElC,OAAO,EAAE,oBAAoB;IAUzC,OAAO,KAAK,UAAU,GAGrB;IAEM,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAiCjC,OAAO,CAAC,CAAC,SAAS,MAAM,EAC3B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,GAChG,IAAI;IAgCA,cAAc,CAAC,OAAO,EAAE,MAAM,MAAM,GAAG,OAAO,0BAA0B,CAAC,KAAK;IAQ9E,UAAU,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC,CAYtI;IAGM,WAAW,GAAU,SAAS,MAAM,EAAE,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;IAGM,SAAS,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC,CAOxD;YAEa,mBAAmB;YAoBnB,OAAO;YAWP,eAAe;YAQf,MAAM;YAWN,iBAAiB;IAkB/B,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,QAAQ;CAiKnB"}