@happyvertical/smrt-users 0.55.17 → 0.55.19

package/dist/models/OAuthAuthorization.d.ts

@@ -0,0 +1,70 @@
+/** Durable OAuth authorization-server state owned by smrt-users. */
+import { SmrtObject } from '@happyvertical/smrt-core';
+export type OAuthTokenClaims = Record<string, string | number | boolean>;
+export declare class UsersOAuthClient extends SmrtObject {
+    clientId: string;
+    redirectUris: string;
+    allowedScopes: string;
+    tokenEndpointAuthMethod: 'none' | 'client_secret_post';
+    secretHash: string | null;
+    allowedResources: string;
+    createdAt: Date;
+    getRedirectUris(): string[];
+    getAllowedScopes(): string[];
+    getAllowedResources(): string[] | undefined;
+}
+export declare class UsersOAuthAuthorizationCode extends SmrtObject {
+    authorizationId: string | null;
+    codeHash: string;
+    clientId: string;
+    subject: string;
+    tenantId: string | null;
+    claims: string;
+    redirectUri: string;
+    scopes: string;
+    resource: string | null;
+    codeChallenge: string;
+    expiresAt: Date;
+    consumedAt: Date | null;
+    getScopes(): string[];
+    getClaims(): OAuthTokenClaims;
+}
+export declare class UsersOAuthRefreshGrant extends SmrtObject {
+    authorizationId: string | null;
+    tokenHash: string;
+    familyId: string;
+    clientId: string;
+    subject: string;
+    tenantId: string | null;
+    claims: string;
+    scopes: string;
+    resource: string | null;
+    expiresAt: Date;
+    consumedAt: Date | null;
+    revokedAt: Date | null;
+    getScopes(): string[];
+    getClaims(): OAuthTokenClaims;
+}
+export declare class UsersOAuthAccessTokenRevocation extends SmrtObject {
+    jti: string;
+    expiresAt: Date;
+}
+/** A consent decision bound to a server-side session; never exposes its bearer. */
+export declare class UsersOAuthAuthorization extends SmrtObject {
+    subject: string;
+    sessionId: string;
+    clientId: string;
+    tenantId: string | null;
+    scopes: string;
+    permissionCeiling: string;
+    resource: string | null;
+    revokedAt: Date | null;
+    getPermissionCeiling(): string[];
+    getScopes(): string[];
+}
+/** Stable lock row: rotation and revocation always serialize on this family. */
+export declare class UsersOAuthRefreshFamily extends SmrtObject {
+    authorizationId: string | null;
+    revokedAt: Date | null;
+}
+//# sourceMappingURL=OAuthAuthorization.d.ts.map

package/dist/models/OAuthAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/OAuthAuthorization.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,OAAO,EAAS,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAoCzE,qBAOa,gBAAiB,SAAQ,UAAU;IACS,QAAQ,SAAM;IACrE,YAAY,SAAQ;IACpB,aAAa,SAAQ;IACrB,uBAAuB,EAAE,MAAM,GAAG,oBAAoB,CAAU;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAQ;IAC7E,gBAAgB,SAAU;IACG,SAAS,OAAc;IACpD,eAAe,IAAI,MAAM,EAAE;IAG3B,gBAAgB,IAAI,MAAM,EAAE;IAG5B,mBAAmB,IAAI,MAAM,EAAE,GAAG,SAAS;CAK5C;AAED,qBAOa,2BAA4B,SAAQ,UAAU;IACf,eAAe,EAAE,MAAM,GAAG,IAAI,CACjE;IAEP,QAAQ,SAAM;IAC0B,QAAQ,SAAM;IACd,OAAO,SAAM;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IACzE,MAAM,SAAQ;IACd,WAAW,SAAM;IACjB,MAAM,SAAQ;IACa,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAC1D,aAAa,SAAM;IACyB,SAAS,OAAc;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAQ;IAC5E,SAAS,IAAI,MAAM,EAAE;IAGrB,SAAS,IAAI,gBAAgB;CAG9B;AAED,qBAOa,sBAAuB,SAAQ,UAAU;IACV,eAAe,EAAE,MAAM,GAAG,IAAI,CACjE;IAEP,SAAS,SAAM;IACyB,QAAQ,SAAM;IACd,QAAQ,SAAM;IACd,OAAO,SAAM;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IACzE,MAAM,SAAQ;IACd,MAAM,SAAQ;IACa,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IACd,SAAS,OAAc;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAQ;IAE5E,SAAS,EAAE,IAAI,GAAG,IAAI,CAAQ;IAC9B,SAAS,IAAI,MAAM,EAAE;IAGrB,SAAS,IAAI,gBAAgB;CAG9B;AAED,qBAOa,+BAAgC,SAAQ,UAAU;IACW,GAAG,SACtE;IACuC,SAAS,OAAc;CACpE;AAED,mFAAmF;AACnF,qBAOa,uBAAwB,SAAQ,UAAU;IACb,OAAO,SAAM;IACX,SAAS,SAAM;IACjB,QAAQ,SAAM;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAC1D,MAAM,SAAQ;IACd,iBAAiB,SAAQ;IACE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IACb,SAAS,EAAE,IAAI,GAAG,IAAI,CAAQ;IAC3E,oBAAoB,IAAI,MAAM,EAAE;IAGhC,SAAS,IAAI,MAAM,EAAE;CAGtB;AAED,gFAAgF;AAChF,qBAOa,uBAAwB,SAAQ,UAAU;IACX,eAAe,EAAE,MAAM,GAAG,IAAI,CACjE;IACsC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAQ;CAC5E"}

package/dist/models/index.d.ts

@@ -13,6 +13,7 @@ export { type LoginAuditOutcome, UsersLoginAuditEvent, } from './LoginAuditEvent
 export { DEFAULT_TOKEN_EXPIRY_SECONDS, MagicLinkToken, UsersMagicLinkToken, } from './MagicLinkToken.js';
 export { Membership } from './Membership.js';
 export { MembershipOverride } from './MembershipOverride.js';
+export { type OAuthTokenClaims, UsersOAuthAccessTokenRevocation, UsersOAuthAuthorization, UsersOAuthAuthorizationCode, UsersOAuthClient, UsersOAuthRefreshFamily, UsersOAuthRefreshGrant, } from './OAuthAuthorization.js';
 export { UsersPasswordCredential } from './PasswordCredential.js';
 export { isValidPermissionSlug, type ParsedPermissionSlug, Permission, parsePermissionSlug, } from './Permission.js';
 export { UsersPinCredential } from './PinCredential.js';

package/dist/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/models/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACL,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,UAAU,EACV,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,EACP,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/models/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACL,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,KAAK,gBAAgB,EACrB,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,UAAU,EACV,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,EACP,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}

package/dist/retention.d.ts

@@ -34,8 +34,10 @@ export declare const LOGIN_ATTEMPTS_RETENTION_TASK = "users-login-attempts";
 export declare const LOGIN_AUDIT_RETENTION_TASK = "users-login-audit-events";
 /** How long login audit events are kept by default. */
 export declare const DEFAULT_LOGIN_AUDIT_RETENTION_DAYS = 90;
+/** Retention task for OAuth codes, refresh history/families and revocations. */
+export declare const OAUTH_CREDENTIALS_RETENTION_TASK = "users-oauth-credentials";
 /** Every task name {@link registerUserRetentionTasks} installs. */
-export declare const USER_RETENTION_TASKS: readonly ["users-sessions", "users-magic-link-tokens", "users-cli-auth-requests", "users-login-attempts", "users-login-audit-events"];
+export declare const USER_RETENTION_TASKS: readonly ["users-oauth-credentials", "users-sessions", "users-magic-link-tokens", "users-cli-auth-requests", "users-login-attempts", "users-login-audit-events"];
 /**
  * Register session and token expiry with the framework retention sweep.
  *

package/dist/retention.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAYH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,uEAAuE;AACvE,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAEpE,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE,uDAAuD;AACvD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,uIAMvB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAmDjD;AAED,sEAAsE;AACtE,wBAAgB,4BAA4B,IAAI,IAAI,CAInD"}
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAaH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,uEAAuE;AACvE,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAEpE,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE,uDAAuD;AACvD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD,gFAAgF;AAChF,eAAO,MAAM,gCAAgC,4BAA4B,CAAC;AAE1E,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,kKAOvB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CA0DjD;AAED,sEAAsE;AACtE,wBAAgB,4BAA4B,IAAI,IAAI,CAInD"}

package/dist/services/OAuthAuthorizationService.d.ts

@@ -0,0 +1,52 @@
+/** Session-backed consent and live authorization for the SDK OAuth server. */
+import { type OAuthAuthorizationRequest, type OAuthAuthorizationServer, type OAuthConsentContext, type OAuthIdentityProvider } from '@happyvertical/auth/server';
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { JWTPayload } from 'jose';
+import { type SessionContext } from './SessionService.js';
+/** Every scope needs an explicit permission mapping; empty mappings allow any live session. */
+export interface SmrtOAuthAuthorizationServiceOptions extends SmrtClassOptions {
+    scopePermissions: Readonly<Record<string, readonly string[]>>;
+}
+/** Safe account-settings projection; excludes session credentials and token hashes. */
+export interface SmrtOAuthGrantSummary {
+    id: string;
+    clientId: string;
+    tenantId: string | null;
+    scopes: string[];
+    resource: string | null;
+    createdAt: Date | null;
+    revokedAt: Date | null;
+}
+/** Durable consent follows the existing session, including its ceiling and parent. */
+export declare class SmrtOAuthAuthorizationService {
+    private readonly options;
+    private readonly sessions;
+    private readonly grants;
+    private constructor();
+    static create(options: SmrtOAuthAuthorizationServiceOptions): Promise<SmrtOAuthAuthorizationService>;
+    /** Suitable for createAuthorizationServer({ identity: service.identity }). */
+    readonly identity: OAuthIdentityProvider & {
+        revalidateConsent: (context: OAuthConsentContext, grant: {
+            clientId: string;
+            subject: string;
+            tenantId?: string;
+            scopes: readonly string[];
+            resource?: string;
+        }) => Promise<OAuthConsentContext | null>;
+    };
+    private liveSession;
+    private permits;
+    /** Call only after an explicit user consent action; the session is loaded again. */
+    approve(server: OAuthAuthorizationServer, request: OAuthAuthorizationRequest, sessionId: string): Promise<import("@happyvertical/auth/server").OAuthAuthorizationRedirect>;
+    private resolve;
+    private revalidateConsent;
+    /** Call after SDK signature/audience/revocation verification, never on decoded-only JWTs. */
+    validateAccessTokenClaims(payload: JWTPayload): Promise<SessionContext | null>;
+    /** Lists only the current authenticated user's consent decisions. */
+    listGrants(sessionId: string): Promise<SmrtOAuthGrantSummary[]>;
+    /** Revocation is idempotent and confined to the authenticated subject. */
+    revokeGrant(sessionId: string, grantId: string): Promise<boolean>;
+    private revokeOwned;
+    private summary;
+}
+//# sourceMappingURL=OAuthAuthorizationService.d.ts.map

package/dist/services/OAuthAuthorizationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthAuthorizationService.d.ts","sourceRoot":"","sources":["../../src/services/OAuthAuthorizationService.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAE3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAMvC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,+FAA+F;AAC/F,MAAM,WAAW,oCAAqC,SAAQ,gBAAgB;IAC5E,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAC/D;AACD,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,sFAAsF;AACtF,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHzB,OAAO;WAKM,MAAM,CACjB,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,6BAA6B,CAAC;IAazC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,GAAG;QACzC,iBAAiB,EAAE,CACjB,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC;YACjB,OAAO,EAAE,MAAM,CAAC;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;YAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,KACE,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;KAC1C,CAIC;YACY,WAAW;IAYzB,OAAO,CAAC,OAAO;IASf,oFAAoF;IAC9E,OAAO,CACX,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,yBAAyB,EAClC,SAAS,EAAE,MAAM;YA4BL,OAAO;YAiDP,iBAAiB;IAwB/B,6FAA6F;IACvF,yBAAyB,CAC7B,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAWjC,qEAAqE;IAC/D,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAiBrE,0EAA0E;IACpE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAMzD,WAAW;IAmCzB,OAAO,CAAC,OAAO;CAWhB"}

package/dist/services/OAuthAuthorizationStorage.d.ts

@@ -0,0 +1,39 @@
+/** Durable OAuth state; all rotation and revocation writes use one executor. */
+import type { OAuthAuthorizationCodeGrant, OAuthAuthorizationStorage, OAuthClient, OAuthCodeConsumeResult, OAuthRefreshGrant, OAuthRefreshRotateResult } from '@happyvertical/auth/server';
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { DatabaseInterface } from '@happyvertical/sql';
+/** Non-secret reference carried in access tokens; session credentials stay in storage. */
+export declare const SMRT_OAUTH_GRANT_CLAIM = "smrt_grant_id";
+/** Factory-created storage connections must reapply all required per-connection settings. */
+export interface SmrtOAuthAuthorizationStorageOptions extends SmrtClassOptions {
+    recoverDatabase?: () => Promise<DatabaseInterface>;
+}
+/** Maps SDK storage operations to atomic SQLite/PostgreSQL persistence. */
+export declare class SmrtOAuthAuthorizationStorage implements OAuthAuthorizationStorage {
+    private db;
+    private readonly recoverDatabase?;
+    private constructor();
+    private recovering;
+    private execute;
+    static create(options: SmrtOAuthAuthorizationStorageOptions): Promise<SmrtOAuthAuthorizationStorage>;
+    private lockAuthorization;
+    private revokeAuthorization;
+    getClient(clientId: string): Promise<OAuthClient | null>;
+    registerClient(client: OAuthClient): Promise<void>;
+    createAuthorizationCode(grant: OAuthAuthorizationCodeGrant): Promise<void>;
+    consumeAuthorizationCode(input: Parameters<OAuthAuthorizationStorage['consumeAuthorizationCode']>[0]): Promise<OAuthCodeConsumeResult>;
+    createRefreshGrant(grant: OAuthRefreshGrant): Promise<void>;
+    rotateRefreshGrant(input: Parameters<OAuthAuthorizationStorage['rotateRefreshGrant']>[0]): Promise<OAuthRefreshRotateResult>;
+    /** Persist a narrowed replacement before the SDK exposes it to a caller. */
+    narrowRefreshGrant(input: {
+        id: string;
+        tokenHash: string;
+        scopes: readonly string[];
+        claims: OAuthRefreshGrant['claims'];
+    }): Promise<void>;
+    revokeRefreshGrant(input: Parameters<OAuthAuthorizationStorage['revokeRefreshGrant']>[0]): Promise<void>;
+    revokeAccessToken(input: Parameters<OAuthAuthorizationStorage['revokeAccessToken']>[0]): Promise<void>;
+    isAccessTokenRevoked(jti: string, now: Date): Promise<boolean>;
+    private saveRefresh;
+}
+//# sourceMappingURL=OAuthAuthorizationStorage.d.ts.map

package/dist/services/OAuthAuthorizationStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthAuthorizationStorage.d.ts","sourceRoot":"","sources":["../../src/services/OAuthAuthorizationStorage.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAIhF,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,WAAW,EACX,sBAAsB,EACtB,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAc5D,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAuCtD,6FAA6F;AAC7F,MAAM,WAAW,oCAAqC,SAAQ,gBAAgB;IAC5E,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACpD;AAED,2EAA2E;AAC3E,qBAAa,6BACX,YAAW,yBAAyB;IAGlC,OAAO,CAAC,EAAE;IAEV,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAHnC,OAAO;IAKP,OAAO,CAAC,UAAU,CAA8B;YAClC,OAAO;WAqCR,MAAM,CACjB,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,6BAA6B,CAAC;YAc3B,iBAAiB;YAajB,mBAAmB;IA6B3B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAoBxD,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBlD,uBAAuB,CAC3B,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,IAAI,CAAC;IAiCV,wBAAwB,CAC5B,KAAK,EAAE,UAAU,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,GAC1E,OAAO,CAAC,sBAAsB,CAAC;IAyC5B,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B3D,kBAAkB,CACtB,KAAK,EAAE,UAAU,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,GACpE,OAAO,CAAC,wBAAwB,CAAC;IAoDpC,4EAA4E;IACtE,kBAAkB,CAAC,KAAK,EAAE;QAC9B,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;KACrC,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCX,kBAAkB,CACtB,KAAK,EAAE,UAAU,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC;IAkBV,iBAAiB,CACrB,KAAK,EAAE,UAAU,CAAC,yBAAyB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,GACnE,OAAO,CAAC,IAAI,CAAC;IAcV,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;YAQtD,WAAW;CAuB1B"}

package/dist/services/index.d.ts

@@ -8,6 +8,8 @@ export { type ClearPinInput, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_PIN_MAN
 export { DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DurableLoginAuditSink, InvalidCredentialsError, type LoginAttemptDecision, type LoginAttemptDenied, type LoginAttemptLease, LoginAttemptLimiter, type LoginAttemptLimiterOptions, type LoginAuditEntry, type LoginAuditSink, type LoginFailureOutcome, type LoginLockoutOptions, LoginRateLimitError, type ReserveLoginAttemptOptions, } from './LoginAttemptLimiter.js';
 export { MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, } from './MagicLinkService.js';
 export { MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, readMobileBearerToken, validateMobileRedirectUri, } from './MobileAuthService.js';
+export { SmrtOAuthAuthorizationService, type SmrtOAuthAuthorizationServiceOptions, type SmrtOAuthGrantSummary, } from './OAuthAuthorizationService.js';
+export { SMRT_OAUTH_GRANT_CLAIM, SmrtOAuthAuthorizationStorage, type SmrtOAuthAuthorizationStorageOptions, } from './OAuthAuthorizationStorage.js';
 export { type CreateAuthorizationUrlOptions, decodeOidcTransaction, encodeOidcTransaction, getUsersOidcConfig, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type ResolvedOidcProviderConfig, resolveOidcProviderConfig, type UsersOidcConfig, } from './OidcLoginService.js';
 export { assertOperationPermission, checkOperationPermission, hasOperationPermission, type OperationPermissionAllowReason, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, } from './OperationPermissionService.js';
 export { type ChangePasswordInput, type ClearPasswordInput, DEFAULT_PASSWORD_DENYLIST, DEFAULT_PASSWORD_MANAGE_PERMISSION, DEFAULT_PASSWORD_MAX_LENGTH, DEFAULT_PASSWORD_MIN_LENGTH, ensurePasswordPermissionsRegistered, PASSWORD_LOGIN_KIND, PASSWORD_MAX_LENGTH_CEILING, PASSWORD_PERMISSION_DEFINITIONS, PasswordCredentialError, PasswordCredentialForbiddenError, PasswordCredentialService, type PasswordCredentialServiceOptions, type PasswordPolicyContext, PasswordPolicyError, type PasswordPolicyOptions, type PasswordSignInInput, type PasswordSignInResult, type ResetPasswordInput, type SetPasswordInput, } from './PasswordCredentialService.js';

package/dist/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,aAAa,EAClB,kCAAkC,EAClC,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,8BAA8B,EAC9B,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,6BAA6B,EAClC,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,2BAA2B,EAC3B,2BAA2B,EAC3B,mCAAmC,EACnC,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,kCAAkC,EAClC,KAAK,kCAAkC,EACvC,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,WAAW,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,GACvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,KAAK,mCAAmC,EACxC,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,GACpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,mCAAmC,EACnC,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,+CAA+C,EAC/C,qCAAqC,EACrC,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,EAC3B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,+BAA+B,EAC/B,+BAA+B,EAC/B,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,aAAa,EAClB,kCAAkC,EAClC,6BAA6B,EAC7B,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,8BAA8B,EAC9B,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,6BAA6B,EAC7B,KAAK,oCAAoC,EACzC,KAAK,qBAAqB,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,oCAAoC,GAC1C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,KAAK,6BAA6B,EAClC,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,GAChC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,2BAA2B,EAC3B,2BAA2B,EAC3B,mCAAmC,EACnC,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,6BAA6B,EAC7B,kCAAkC,EAClC,KAAK,kCAAkC,EACvC,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,WAAW,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,GACvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,KAAK,mCAAmC,EACxC,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,GACpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,mCAAmC,EACnC,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,+CAA+C,EAC/C,qCAAqC,EACrC,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,EAC3B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC"}

package/dist/services/oauth-retention.d.ts

@@ -0,0 +1,14 @@
+import type { DatabaseInterface } from '@happyvertical/sql';
+/** Keep expired refresh hashes for another 30 days to detect late replay. */
+export declare const OAUTH_REFRESH_REPLAY_RETENTION_MS: number;
+/**
+ * Reap expired OAuth credentials without removing a live family's lock row.
+ * Refresh history survives token expiry plus the replay grace period, including
+ * consumed/revoked grants. Clients and consent decisions are not credentials.
+ * Dry runs perform no writes; their counts may race concurrent rotation.
+ */
+export declare function pruneOAuthCredentials(db: DatabaseInterface, options?: {
+    dryRun?: boolean;
+    now?: Date;
+}): Promise<number>;
+//# sourceMappingURL=oauth-retention.d.ts.map

package/dist/services/oauth-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-retention.d.ts","sourceRoot":"","sources":["../../src/services/oauth-retention.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAS5D,6EAA6E;AAC7E,eAAO,MAAM,iCAAiC,QAA2B,CAAC;AAE1E;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC7C,OAAO,CAAC,MAAM,CAAC,CA8EjB"}

package/dist/services/oauth-transaction.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseInterface } from '@happyvertical/sql';
+/** Retry only rolled-back contention failures; never retry external side effects. */
+export declare function withOAuthTransaction<T>(db: DatabaseInterface, action: (tx: DatabaseInterface) => Promise<T>): Promise<T>;
+//# sourceMappingURL=oauth-transaction.d.ts.map

package/dist/services/oauth-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-transaction.d.ts","sourceRoot":"","sources":["../../src/services/oauth-transaction.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,qFAAqF;AACrF,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,CAAC,EAAE,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAiCZ"}