@jeffjassky/oauth-host 0.1.0

package/dist/index.js

@@ -0,0 +1,2773 @@
+import mongoose from 'mongoose';
+import express2 from 'express';
+import { createHash, randomBytes, createPrivateKey, createPublicKey, generateKeyPairSync, timingSafeEqual, sign, createHmac } from 'crypto';
+
+// src/server/models.ts
+var DEFAULT_NAMES = {
+  client: "OAuthClient",
+  grant: "OAuthGrant",
+  code: "OAuthCode",
+  token: "OAuthToken",
+  request: "OAuthRequest",
+  key: "OAuthKey",
+  audit: "OAuthAudit"
+};
+function compile(connection, name, build, collection) {
+  const existing = connection.models?.[name];
+  if (existing) return existing;
+  return connection.model(name, build(), collection);
+}
+function clientSchema() {
+  const schema = new mongoose.Schema(
+    {
+      clientId: { type: String, required: true, unique: true },
+      name: { type: String, required: true },
+      // `public` exists for CIMD clients, which hold no secret and are bound by
+      // PKCE instead. The enum was written with this widening in mind, so it
+      // was one member rather than a migration.
+      type: { type: String, enum: ["confidential", "public"], default: "confidential" },
+      // How the row got here. A `cimd` row is re-derived from the client's own
+      // metadata document, so this is what tells the re-fetch path which fields
+      // it owns — and `status` is deliberately not one of them.
+      registration: { type: String, enum: ["manual", "cimd"], default: "manual" },
+      metadataUrl: String,
+      metadataFetchedAt: Date,
+      metadataEtag: String,
+      trusted: { type: Boolean, default: false },
+      // An array, not a string: rotation needs two live secrets at once or it
+      // cannot be deployed without downtime.
+      secrets: [
+        {
+          _id: false,
+          hash: { type: String, required: true },
+          label: String,
+          createdAt: { type: Date, default: Date.now },
+          lastUsedAt: Date,
+          retiresAt: Date
+        }
+      ],
+      redirectUris: { type: [String], default: [] },
+      allowedScopes: { type: [String], default: [] },
+      allowedResources: { type: [String], default: [] },
+      branding: {
+        _id: false,
+        logoUrl: String,
+        publisher: String,
+        homepageUrl: String,
+        tosUrl: String,
+        privacyUrl: String
+      },
+      status: { type: String, enum: ["active", "disabled"], default: "active" },
+      // Pairwise subjects live on the client, not in a collection of their own:
+      // they are per-(client, user) and are read on every token issuance for
+      // that client. A Map keyed by user id keeps that a single document read.
+      pairwiseSubjects: { type: Map, of: String }
+    },
+    { timestamps: true }
+  );
+  return schema;
+}
+function grantSchema() {
+  const schema = new mongoose.Schema(
+    {
+      userId: { type: mongoose.Schema.Types.Mixed, required: true },
+      clientId: { type: String, required: true },
+      // `null`, never absent. A missing field and a null field index
+      // differently, and the unique index below has to see one consistent
+      // value for single-subject mode.
+      contextId: { type: String, default: null },
+      scopes: { type: [String], default: [] },
+      resources: { type: [String], default: [] },
+      version: { type: Number, default: 1 },
+      lastUsedAt: Date,
+      revokedAt: { type: Date, default: null },
+      revokedBy: { type: String, enum: ["user", "admin", "system", "client"] }
+    },
+    { timestamps: true }
+  );
+  schema.index(
+    { clientId: 1, userId: 1, contextId: 1 },
+    { unique: true, partialFilterExpression: { revokedAt: null } }
+  );
+  schema.index({ userId: 1 });
+  schema.index({ clientId: 1 });
+  return schema;
+}
+function codeSchema() {
+  const schema = new mongoose.Schema(
+    {
+      codeHash: { type: String, required: true, unique: true },
+      clientId: { type: String, required: true },
+      userId: { type: mongoose.Schema.Types.Mixed, required: true },
+      grantId: { type: mongoose.Schema.Types.ObjectId, required: true },
+      contextId: { type: String, default: null },
+      scopes: { type: [String], default: [] },
+      resources: { type: [String], default: [] },
+      redirectUri: { type: String, required: true },
+      codeChallenge: { type: String, required: true },
+      codeChallengeMethod: { type: String, enum: ["S256"], default: "S256" },
+      nonce: String,
+      authTime: Date,
+      // Set, not deleted, on redemption. A consumed code has to stay readable
+      // long enough to detect the replay — see `tokens.ts`.
+      consumedAt: { type: Date, default: null },
+      expiresAt: { type: Date, required: true }
+    },
+    { timestamps: { createdAt: true, updatedAt: false } }
+  );
+  schema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  return schema;
+}
+function tokenSchema() {
+  const schema = new mongoose.Schema(
+    {
+      kind: { type: String, enum: ["access", "refresh"], required: true },
+      tokenHash: { type: String, required: true, unique: true },
+      clientId: { type: String, required: true },
+      userId: { type: mongoose.Schema.Types.Mixed, required: true },
+      grantId: { type: mongoose.Schema.Types.ObjectId, required: true },
+      contextId: { type: String, default: null },
+      scopes: { type: [String], default: [] },
+      audience: { type: [String], default: [] },
+      familyId: { type: String, required: true },
+      parentId: { type: mongoose.Schema.Types.ObjectId, default: null },
+      consumedAt: { type: Date, default: null },
+      revokedAt: { type: Date, default: null },
+      familyExpiresAt: Date,
+      expiresAt: { type: Date, required: true }
+    },
+    { timestamps: { createdAt: true, updatedAt: false } }
+  );
+  schema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  schema.index({ familyId: 1 });
+  schema.index({ grantId: 1 });
+  schema.index({ userId: 1, clientId: 1 });
+  return schema;
+}
+function requestSchema() {
+  const schema = new mongoose.Schema(
+    {
+      requestId: { type: String, required: true, unique: true },
+      clientId: { type: String, required: true },
+      userId: { type: mongoose.Schema.Types.Mixed, required: true },
+      redirectUri: { type: String, required: true },
+      scopes: { type: [String], default: [] },
+      resources: { type: [String], default: [] },
+      state: String,
+      nonce: String,
+      codeChallenge: { type: String, required: true },
+      codeChallengeMethod: { type: String, enum: ["S256"], default: "S256" },
+      prompt: String,
+      maxAge: Number,
+      decision: { type: String, enum: ["approved", "denied"] },
+      decidedAt: Date,
+      expiresAt: { type: Date, required: true }
+    },
+    { timestamps: { createdAt: true, updatedAt: false } }
+  );
+  schema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+  return schema;
+}
+function keySchema() {
+  const schema = new mongoose.Schema(
+    {
+      kid: { type: String, required: true, unique: true },
+      alg: { type: String, enum: ["ES256"], default: "ES256" },
+      publicJwk: { type: mongoose.Schema.Types.Mixed, required: true },
+      // Retiring keys stay published in JWKS so tokens signed by them still
+      // validate; only `active` is used to sign.
+      privateJwk: { type: mongoose.Schema.Types.Mixed, required: true },
+      status: { type: String, enum: ["active", "retiring"], default: "active" }
+    },
+    { timestamps: { createdAt: true, updatedAt: false } }
+  );
+  return schema;
+}
+function auditSchema(retentionDays) {
+  const schema = new mongoose.Schema(
+    {
+      type: { type: String, required: true },
+      actor: { type: String, enum: ["user", "client", "admin", "system"] },
+      clientId: String,
+      userId: mongoose.Schema.Types.Mixed,
+      grantId: mongoose.Schema.Types.ObjectId,
+      ip: String,
+      meta: mongoose.Schema.Types.Mixed
+    },
+    { timestamps: { createdAt: true, updatedAt: false } }
+  );
+  schema.index({ createdAt: 1 }, { expireAfterSeconds: retentionDays * 86400 });
+  schema.index({ clientId: 1, createdAt: -1 });
+  schema.index({ userId: 1, createdAt: -1 });
+  return schema;
+}
+function createModels({
+  connection = mongoose,
+  modelNames = {},
+  collectionPrefix = "oauth_",
+  auditRetentionDays = 400
+} = {}) {
+  const names = { ...DEFAULT_NAMES, ...modelNames };
+  const c = (suffix) => `${collectionPrefix}${suffix}`;
+  return {
+    Client: compile(connection, names.client, clientSchema, c("clients")),
+    Grant: compile(connection, names.grant, grantSchema, c("grants")),
+    Code: compile(connection, names.code, codeSchema, c("codes")),
+    Token: compile(connection, names.token, tokenSchema, c("tokens")),
+    Request: compile(connection, names.request, requestSchema, c("requests")),
+    Key: compile(connection, names.key, keySchema, c("keys")),
+    Audit: compile(
+      connection,
+      names.audit,
+      () => auditSchema(auditRetentionDays),
+      c("audit")
+    )
+  };
+}
+async function syncModelIndexes(models) {
+  await Promise.all(Object.values(models).map((m) => m.init()));
+}
+
+// src/server/config.ts
+var NOOP_LOGGER = {
+  debug() {
+  },
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  }
+};
+var DEFAULT_TTL = {
+  code: 60,
+  accessToken: 3600,
+  refreshToken: 60 * 86400,
+  refreshAbsolute: 180 * 86400,
+  authorizationRequest: 600
+};
+var OIDC_SCOPES = /* @__PURE__ */ new Set(["openid", "profile", "email"]);
+function defaultResolveUser(req) {
+  const { authUserId, user } = req;
+  const id = user?._id ?? user?.id ?? authUserId;
+  if (!id) return null;
+  return {
+    id,
+    email: user?.email,
+    displayName: user?.displayName ?? null,
+    avatarUrl: user?.avatarUrl ?? null,
+    authTime: user?.authTime,
+    isAdmin: Boolean(user?.isAdmin)
+  };
+}
+function createUserAdapter({ resolveUser = defaultResolveUser, loadUser } = {}) {
+  if (typeof resolveUser !== "function") {
+    throw new TypeError("oauth-host: user adapter `resolveUser` must be a function");
+  }
+  if (loadUser !== void 0 && typeof loadUser !== "function") {
+    throw new TypeError("oauth-host: user adapter `loadUser` must be a function");
+  }
+  return { resolveUser, ...loadUser ? { loadUser } : {} };
+}
+function normalizeScopes(input) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError("oauth-host: `scopes` must be a non-empty array");
+  }
+  return input.map((s) => {
+    const spec = typeof s === "string" ? { id: s } : { ...s };
+    if (!spec.id || typeof spec.id !== "string") {
+      throw new TypeError(`oauth-host: every scope needs a string \`id\` (got ${JSON.stringify(s)})`);
+    }
+    if (/[\s"\\]/.test(spec.id)) {
+      throw new TypeError(`oauth-host: scope id must not contain whitespace or quotes: '${spec.id}'`);
+    }
+    return {
+      ...spec,
+      label: spec.label ?? spec.id,
+      oidc: spec.oidc ?? OIDC_SCOPES.has(spec.id)
+    };
+  });
+}
+function normalizeDefaultScopes(input, scopeIndex) {
+  if (input === void 0) return void 0;
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError(
+      "oauth-host: `defaultScopes`, when given, must be a non-empty array of catalog scope ids. Omit the key entirely to require every client to send `scope`."
+    );
+  }
+  for (const id of input) {
+    if (typeof id !== "string" || !scopeIndex.has(id)) {
+      throw new TypeError(
+        `oauth-host: defaultScopes contains '${String(id)}', which is not in the configured scope catalog`
+      );
+    }
+  }
+  return [...input];
+}
+function normalizeResources(input) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError(
+      "oauth-host: `resources` must list at least one API. MCP clients send `resource` on every request (RFC 8707) and tokens are audience-bound to it."
+    );
+  }
+  return input.map((r) => {
+    const spec = typeof r === "string" ? { id: r } : { ...r };
+    let url;
+    try {
+      url = new URL(spec.id);
+    } catch {
+      throw new TypeError(`oauth-host: resource id must be an absolute URI: '${spec.id}'`);
+    }
+    if (url.hash) {
+      throw new TypeError(`oauth-host: resource id must not contain a fragment: '${spec.id}'`);
+    }
+    return { ...spec, label: spec.label ?? spec.id };
+  });
+}
+function memoryStore() {
+  const buckets = /* @__PURE__ */ new Map();
+  return {
+    async hit(key, windowMs) {
+      const now = Date.now();
+      const found = buckets.get(key);
+      if (!found || found.resetAt <= now) {
+        const fresh = { count: 1, resetAt: now + windowMs };
+        buckets.set(key, fresh);
+        if (buckets.size > 1e4) {
+          for (const [k, v] of buckets) if (v.resetAt <= now) buckets.delete(k);
+        }
+        return fresh;
+      }
+      found.count += 1;
+      return found;
+    }
+  };
+}
+function parseCimdHost(raw) {
+  if (typeof raw !== "string" || !raw.trim()) {
+    throw new TypeError(
+      `oauth-host: clientIdMetadata.allowedHosts entries must be non-empty strings (got ${JSON.stringify(raw)})`
+    );
+  }
+  const entry = raw.trim().toLowerCase();
+  if (/[/\\?#@\s]/.test(entry) || entry.includes("://")) {
+    throw new TypeError(
+      `oauth-host: clientIdMetadata.allowedHosts takes a host, not a URL: '${raw}'. Write 'claude.ai' for that host exactly, or '.claude.ai' to include subdomains.`
+    );
+  }
+  const subdomains = entry.startsWith(".");
+  const bare = subdomains ? entry.slice(1) : entry;
+  const parts = /^([^:]+)(?::(\d+))?$/.exec(bare);
+  if (!parts || !parts[1]) {
+    throw new TypeError(`oauth-host: clientIdMetadata.allowedHosts entry is not a hostname: '${raw}'`);
+  }
+  if (parts[1].includes("*")) {
+    throw new TypeError(
+      `oauth-host: clientIdMetadata.allowedHosts does not accept wildcards: '${raw}'. Use a leading dot ('.claude.ai') to admit subdomains of one host.`
+    );
+  }
+  return { host: parts[1], port: parts[2] ?? "", subdomains };
+}
+function resolveCimd(input, scopeIndex) {
+  const off = {
+    enabled: false,
+    allowedHosts: [],
+    cacheTtlMs: 36e5,
+    fetchTimeoutMs: 5e3,
+    maxBytes: 65536,
+    allowedScopes: [],
+    failures: /* @__PURE__ */ new Map()
+  };
+  if (!input || !input.enabled) return off;
+  if (!Array.isArray(input.allowedHosts) || input.allowedHosts.length === 0) {
+    throw new TypeError(
+      'oauth-host: `clientIdMetadata.allowedHosts` must list at least one host when clientIdMetadata is enabled. There is no implicit "any host": the server fetches these URLs itself, on an unauthenticated request parameter.'
+    );
+  }
+  const allowedScopes = input.allowedScopes ?? [...scopeIndex.keys()];
+  if (!Array.isArray(allowedScopes) || allowedScopes.length === 0) {
+    throw new TypeError("oauth-host: `clientIdMetadata.allowedScopes`, when given, must be non-empty");
+  }
+  for (const id of allowedScopes) {
+    if (typeof id !== "string" || !scopeIndex.has(id)) {
+      throw new TypeError(
+        `oauth-host: clientIdMetadata.allowedScopes contains '${String(id)}', which is not in the configured scope catalog`
+      );
+    }
+  }
+  const positive = (value, key, fallback) => {
+    if (value === void 0) return fallback;
+    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+      throw new TypeError(`oauth-host: \`clientIdMetadata.${key}\` must be a positive number`);
+    }
+    return value;
+  };
+  return {
+    enabled: true,
+    allowedHosts: input.allowedHosts.map(parseCimdHost),
+    cacheTtlMs: positive(input.cacheTtlMs, "cacheTtlMs", 36e5),
+    fetchTimeoutMs: positive(input.fetchTimeoutMs, "fetchTimeoutMs", 5e3),
+    maxBytes: positive(input.maxBytes, "maxBytes", 65536),
+    allowedScopes: [...allowedScopes],
+    failures: /* @__PURE__ */ new Map()
+  };
+}
+function resolveConfig(config) {
+  if (!config || typeof config !== "object") {
+    throw new TypeError("oauth-host: createOAuthHost(config) requires a config object");
+  }
+  const {
+    connection,
+    issuer,
+    mountPath = "/oauth",
+    consentUrl,
+    loginUrl,
+    returnParam = "next",
+    userAdapter,
+    resolveUser,
+    loadUser,
+    grantContext,
+    claims,
+    subjectMode = "public",
+    pairwiseSalt,
+    signing = {},
+    rateLimits = {},
+    tokenCache = {},
+    modelNames,
+    collectionPrefix,
+    audit = {},
+    cors = {},
+    clockSkewMs = 0,
+    clientIdMetadata,
+    logger = NOOP_LOGGER,
+    track = () => {
+    }
+  } = config;
+  if (typeof issuer !== "string" || !/^https?:\/\//.test(issuer)) {
+    throw new TypeError(`oauth-host: \`issuer\` must be an absolute http(s) URL (got ${JSON.stringify(issuer)})`);
+  }
+  if (issuer.endsWith("/")) {
+    throw new TypeError(`oauth-host: \`issuer\` must not end with a slash: '${issuer}'`);
+  }
+  if (!consentUrl || typeof consentUrl !== "string") {
+    throw new TypeError("oauth-host: `consentUrl` is required \u2014 it is where /authorize sends the user");
+  }
+  if (subjectMode === "pairwise" && !pairwiseSalt) {
+    throw new TypeError(
+      'oauth-host: `pairwiseSalt` is required when subjectMode is "pairwise". It is permanent: changing it changes every `sub` a partner has stored.'
+    );
+  }
+  if (userAdapter && (resolveUser || loadUser)) {
+    throw new TypeError(
+      "oauth-host: pass either `userAdapter` or the `resolveUser`/`loadUser` shorthands, not both"
+    );
+  }
+  if (typeof track !== "function") {
+    throw new TypeError("oauth-host: `track` must be a function");
+  }
+  if (grantContext && (typeof grantContext.list !== "function" || typeof grantContext.verify !== "function")) {
+    throw new TypeError("oauth-host: `grantContext` needs both `list()` and `verify()`");
+  }
+  const scopes = normalizeScopes(config.scopes);
+  const resources = normalizeResources(config.resources);
+  const scopeIndex = new Map(scopes.map((s) => [s.id, s]));
+  for (const r of resources) {
+    for (const s of r.scopes ?? []) {
+      if (!scopeIndex.has(s)) {
+        throw new TypeError(`oauth-host: resource '${r.id}' lists scope '${s}' which is not in the catalog`);
+      }
+    }
+  }
+  const defaultScopes = normalizeDefaultScopes(config.defaultScopes, scopeIndex);
+  const models = createModels({
+    connection,
+    modelNames,
+    collectionPrefix,
+    auditRetentionDays: audit.retentionDays ?? 400
+  });
+  const adapter = userAdapter ? createUserAdapter(userAdapter) : createUserAdapter({ resolveUser, loadUser });
+  if (!adapter.loadUser) {
+    logger.warn?.(
+      "oauth-host: no `loadUser` adapter \u2014 `profile`/`email` claims on /userinfo and the id_token will be empty, because those endpoints have no host session to read."
+    );
+  }
+  const store = rateLimits.store ?? memoryStore();
+  const normalizedMount = `/${String(mountPath).replace(/^\/+|\/+$/g, "")}`;
+  const ctx = {
+    models,
+    issuer,
+    mountPath: normalizedMount === "/" ? "" : normalizedMount,
+    resources,
+    scopes,
+    scopeIndex,
+    defaultScopes,
+    consentUrl,
+    loginUrl,
+    returnParam,
+    resolveUser: adapter.resolveUser,
+    async loadUser(userId) {
+      return await adapter.loadUser?.(userId) ?? { id: userId };
+    },
+    grantContext,
+    claims,
+    ttl: { ...DEFAULT_TTL, ...config.ttl },
+    subjectMode,
+    pairwiseSalt,
+    signing,
+    rateLimits: {
+      token: rateLimits.token ?? { max: 60, windowMs: 6e4 },
+      authorize: rateLimits.authorize ?? { max: 60, windowMs: 6e4 },
+      consent: rateLimits.consent ?? { max: 60, windowMs: 6e4 },
+      hit: (key, windowMs) => store.hit(key, windowMs)
+    },
+    tokenCacheTtlMs: tokenCache.ttlMs ?? 0,
+    cors: { tokenEndpoint: cors.tokenEndpoint ?? false, origins: cors.origins ?? [] },
+    clockSkewMs,
+    cimd: resolveCimd(clientIdMetadata, scopeIndex),
+    logger,
+    track,
+    async audit(entry) {
+      try {
+        await models.Audit.create(entry);
+      } catch (err) {
+        logger.error?.({ err, entry }, "oauth-host: audit write failed");
+      }
+    }
+  };
+  return ctx;
+}
+
+// src/server/errors.ts
+var OAuthError = class extends Error {
+  status;
+  code;
+  description;
+  /** e.g. `WWW-Authenticate` on a 401 from the resource server. */
+  headers;
+  constructor(status, code, description, opts) {
+    super(description ? `${code}: ${description}` : code);
+    this.name = "OAuthError";
+    this.status = status;
+    this.code = code;
+    this.description = description;
+    this.headers = opts?.headers;
+  }
+  toBody() {
+    return {
+      error: this.code,
+      ...this.description ? { error_description: this.description } : {}
+    };
+  }
+};
+var invalidRequest = (d) => new OAuthError(400, "invalid_request", d);
+var invalidGrant = (d) => new OAuthError(400, "invalid_grant", d);
+var invalidScope = (d) => new OAuthError(400, "invalid_scope", d);
+var unsupportedGrantType = (d) => new OAuthError(400, "unsupported_grant_type", d);
+var accessDenied = (d) => new OAuthError(403, "access_denied", d);
+var UnredirectableError = class extends OAuthError {
+  constructor(code, description) {
+    super(400, code, description);
+    this.name = "UnredirectableError";
+  }
+};
+var RedirectableAuthError = class extends OAuthError {
+  redirectUri;
+  state;
+  constructor(code, description, redirectUri, state) {
+    super(400, code, description);
+    this.name = "RedirectableAuthError";
+    this.redirectUri = redirectUri;
+    this.state = state;
+  }
+  /** The full `redirect_uri` to 302 to, error parameters attached. */
+  toRedirect(issuer) {
+    const url = new URL(this.redirectUri);
+    url.searchParams.set("error", this.code);
+    if (this.description) url.searchParams.set("error_description", this.description);
+    if (this.state !== void 0) url.searchParams.set("state", this.state);
+    url.searchParams.set("iss", issuer);
+    return url.toString();
+  }
+};
+function wrap(logger, handler) {
+  return async (req, res, next) => {
+    try {
+      await handler(req, res, next);
+    } catch (err) {
+      if (err instanceof OAuthError) {
+        if (res.headersSent) return next(err);
+        if (err.headers) res.set(err.headers);
+        return res.status(err.status).json(err.toBody());
+      }
+      logger.error?.({ err, path: req.originalUrl }, "oauth-host: request failed");
+      if (res.headersSent) return next(err);
+      res.status(500).json({ error: "server_error" });
+    }
+  };
+}
+var ENDPOINTS = [
+  ["authorization_endpoint", "/authorize"],
+  ["token_endpoint", "/token"],
+  ["revocation_endpoint", "/revoke"],
+  ["userinfo_endpoint", "/userinfo"],
+  ["jwks_uri", "/jwks"]
+];
+var WELL_KNOWN_AS = "/.well-known/oauth-authorization-server";
+var WELL_KNOWN_OIDC = "/.well-known/openid-configuration";
+var WELL_KNOWN_RESOURCE = "/.well-known/oauth-protected-resource";
+function protectedResourceMetadataUrl(issuer, resourceId) {
+  return `${issuer}${WELL_KNOWN_RESOURCE}${identifierPath(resourceId)}`;
+}
+function identifierPath(identifier) {
+  const { pathname } = new URL(identifier);
+  return pathname === "/" ? "" : pathname.replace(/\/+$/, "");
+}
+function escapeRe(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function wellKnownPattern(wellKnown) {
+  return new RegExp(`^${escapeRe(wellKnown)}(?:/.*)?$`);
+}
+function wellKnownHandler(ctx, wellKnown, bare, bySuffix, describeMiss) {
+  return wrap(ctx.logger, (req, res) => {
+    const suffix = req.path.slice(wellKnown.length).replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!suffix) return res.json(bare);
+    const doc = bySuffix.get(suffix);
+    if (!doc) {
+      return res.status(404).json({ error: "not_found", error_description: describeMiss(suffix) });
+    }
+    return res.json(doc);
+  });
+}
+function authorizationServerMetadata(ctx, mountPath) {
+  const base = `${ctx.issuer}${mountPath === "/" ? "" : mountPath}`;
+  const endpoints = Object.fromEntries(ENDPOINTS.map(([key, path]) => [key, `${base}${path}`]));
+  return {
+    issuer: ctx.issuer,
+    ...endpoints,
+    scopes_supported: ctx.scopes.map((s) => s.id),
+    response_types_supported: ["code"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    // S256 only. `plain` is not implemented anywhere in this package, so
+    // advertising it would be a lie a client would discover at redemption.
+    code_challenge_methods_supported: ["S256"],
+    // `none` is advertised only when CIMD is on. Listing it unconditionally
+    // would tell every client that secretless authentication is available here,
+    // and the only clients that can use it are the ones this server would then
+    // refuse to register.
+    token_endpoint_auth_methods_supported: [
+      "client_secret_basic",
+      "client_secret_post",
+      ...ctx.cimd.enabled ? ["none"] : []
+    ],
+    // What tells Claude and ChatGPT to skip registration entirely and send
+    // their metadata document URL as `client_id`.
+    ...ctx.cimd.enabled ? { client_id_metadata_document_supported: true } : {},
+    subject_types_supported: [ctx.subjectMode],
+    id_token_signing_alg_values_supported: ["ES256"],
+    // RFC 9207. Advertising it is what lets a client REQUIRE `iss` on the
+    // authorization response and so refuse a mix-up attack.
+    authorization_response_iss_parameter_supported: true
+  };
+}
+function protectedResourceMetadata(ctx, resource) {
+  return {
+    resource: resource.id,
+    authorization_servers: [ctx.issuer],
+    scopes_supported: resource.scopes ?? ctx.scopes.map((s) => s.id),
+    bearer_methods_supported: ["header"]
+  };
+}
+function createDiscoveryRouter(ctx, mountPath = "/oauth") {
+  const router = express2.Router();
+  const asMetadata = authorizationServerMetadata(ctx, mountPath);
+  const issuerSuffix = identifierPath(ctx.issuer).replace(/^\//, "");
+  const asBySuffix = new Map(issuerSuffix ? [[issuerSuffix, asMetadata]] : []);
+  const notThisIssuer = (suffix) => `This authorization server's issuer is '${ctx.issuer}', which does not publish at '${suffix}'`;
+  const serveAs = wrap(ctx.logger, (_req, res) => res.json(asMetadata));
+  router.get(
+    wellKnownPattern(WELL_KNOWN_AS),
+    wellKnownHandler(ctx, WELL_KNOWN_AS, asMetadata, asBySuffix, notThisIssuer)
+  );
+  router.get(
+    wellKnownPattern(WELL_KNOWN_OIDC),
+    wellKnownHandler(ctx, WELL_KNOWN_OIDC, asMetadata, asBySuffix, notThisIssuer)
+  );
+  if (issuerSuffix) {
+    router.get(new RegExp(`^${escapeRe(`/${issuerSuffix}${WELL_KNOWN_OIDC}`)}/?$`), serveAs);
+  }
+  const bySuffix = new Map(
+    ctx.resources.map((r) => [identifierPath(r.id).replace(/^\//, ""), protectedResourceMetadata(ctx, r)])
+  );
+  const firstResource = protectedResourceMetadata(ctx, ctx.resources[0]);
+  router.get(
+    wellKnownPattern(WELL_KNOWN_RESOURCE),
+    wellKnownHandler(
+      ctx,
+      WELL_KNOWN_RESOURCE,
+      firstResource,
+      bySuffix,
+      (suffix) => `No resource is registered at '${suffix}'`
+    )
+  );
+  return router;
+}
+function randomToken(bytes = 32) {
+  return randomBytes(bytes).toString("base64url");
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("base64url");
+}
+function safeEqual(a, b) {
+  const bufA = Buffer.from(sha256(a));
+  const bufB = Buffer.from(sha256(b));
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+function verifyPkce(verifier, challenge2) {
+  if (verifier.length < 43 || verifier.length > 128) return false;
+  if (!/^[A-Za-z0-9\-._~]+$/.test(verifier)) return false;
+  return safeEqual(sha256(verifier), challenge2);
+}
+function pairwiseSubject(userId, clientId, salt) {
+  return createHmac("sha256", salt).update(`${clientId}:${userId}`).digest("base64url");
+}
+function generateClientId() {
+  return randomToken(16);
+}
+function generateClientSecret() {
+  return randomToken(32);
+}
+
+// src/server/redirect-uris.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function redirectUriMatches(registered, presented) {
+  if (registered === presented) return true;
+  let a;
+  let b;
+  try {
+    a = new URL(registered);
+    b = new URL(presented);
+  } catch {
+    return false;
+  }
+  if (!LOOPBACK_HOSTS.has(a.hostname) || !LOOPBACK_HOSTS.has(b.hostname)) return false;
+  return a.protocol === b.protocol && a.hostname === b.hostname && a.username === b.username && a.password === b.password && a.pathname === b.pathname && a.search === b.search && a.hash === b.hash;
+}
+function redirectUriRegistered(registered, presented) {
+  return registered.some((entry) => redirectUriMatches(entry, presented));
+}
+
+// src/server/services/tokens.ts
+function familyFor(codeHash) {
+  return sha256(`family:${codeHash}`);
+}
+var parseScopes = (scope) => (scope ?? "").split(/\s+/).filter(Boolean);
+var invalidTarget = (d) => new OAuthError(400, "invalid_target", d);
+async function liveGrant(ctx, grantId) {
+  const grant = await ctx.models.Grant.findById(grantId);
+  if (!grant || grant.revokedAt) {
+    throw invalidGrant("the authorization behind this token has been revoked");
+  }
+  return grant;
+}
+async function consumeCode(ctx, rawCode, opts) {
+  const codeHash = sha256(rawCode);
+  const now = /* @__PURE__ */ new Date();
+  const code = await ctx.models.Code.findOneAndUpdate(
+    { codeHash, consumedAt: null },
+    { $set: { consumedAt: now } },
+    { returnDocument: "after" }
+  );
+  if (!code) {
+    const replayed = await ctx.models.Code.findOne({ codeHash });
+    if (replayed) {
+      const familyId = familyFor(codeHash);
+      const revoked = await revokeFamily(ctx, familyId, "code_replay");
+      await ctx.audit({
+        type: "code_replay",
+        actor: "client",
+        clientId: opts.clientId,
+        userId: replayed.userId,
+        grantId: replayed.grantId,
+        meta: { familyId, tokensRevoked: revoked }
+      });
+      ctx.logger.warn?.(
+        { clientId: opts.clientId, familyId },
+        "oauth-host: authorization code replayed \u2014 family revoked"
+      );
+    }
+    throw invalidGrant("authorization code is invalid, expired, or already used");
+  }
+  if (code.expiresAt.getTime() <= now.getTime()) {
+    throw invalidGrant("authorization code has expired");
+  }
+  if (code.clientId !== opts.clientId) {
+    throw invalidGrant("authorization code was issued to a different client");
+  }
+  if (!redirectUriMatches(code.redirectUri, opts.redirectUri)) {
+    throw invalidGrant("redirect_uri does not match the one the code was issued for");
+  }
+  if (!verifyPkce(opts.codeVerifier ?? "", code.codeChallenge)) {
+    throw invalidGrant("PKCE verification failed");
+  }
+  return code;
+}
+async function mintPair(ctx, args) {
+  const now = Date.now();
+  const accessToken = randomToken();
+  const refreshToken = randomToken();
+  const common = {
+    clientId: args.clientId,
+    userId: args.userId,
+    grantId: args.grant._id,
+    contextId: args.contextId,
+    scopes: args.scopes,
+    audience: args.audience,
+    familyId: args.familyId
+  };
+  await ctx.models.Token.create({
+    ...common,
+    kind: "access",
+    tokenHash: sha256(accessToken),
+    expiresAt: new Date(now + ctx.ttl.accessToken * 1e3)
+  });
+  await ctx.models.Token.create({
+    ...common,
+    kind: "refresh",
+    tokenHash: sha256(refreshToken),
+    parentId: args.parentId ?? null,
+    // `expiresAt` is the SLIDING window and is what the TTL index reaps;
+    // `familyExpiresAt` is the absolute ceiling and is copied unchanged onto
+    // every rotation, so no amount of refreshing extends it.
+    expiresAt: new Date(now + ctx.ttl.refreshToken * 1e3),
+    familyExpiresAt: args.familyExpiresAt
+  });
+  await ctx.models.Grant.updateOne({ _id: args.grant._id }, { $set: { lastUsedAt: new Date(now) } });
+  return {
+    accessToken,
+    refreshToken,
+    expiresIn: ctx.ttl.accessToken,
+    scopes: args.scopes,
+    audience: args.audience,
+    grantId: String(args.grant._id),
+    familyId: args.familyId,
+    userId: args.userId,
+    contextId: args.contextId
+  };
+}
+async function issueForCode(ctx, code) {
+  const grant = await liveGrant(ctx, code.grantId);
+  const issued = await mintPair(ctx, {
+    grant,
+    clientId: code.clientId,
+    userId: code.userId,
+    contextId: code.contextId,
+    scopes: code.scopes,
+    // Audience comes from the resources bound at /authorize, which were already
+    // checked against the client's registration. Never from the token request.
+    audience: code.resources,
+    familyId: familyFor(code.codeHash),
+    familyExpiresAt: new Date(Date.now() + ctx.ttl.refreshAbsolute * 1e3)
+  });
+  ctx.track({
+    type: "oauth.token_issued",
+    userId: issued.userId,
+    clientId: code.clientId,
+    grantId: issued.grantId,
+    contextId: issued.contextId ?? void 0,
+    scopes: issued.scopes
+  });
+  await ctx.audit({
+    type: "token_issued",
+    actor: "client",
+    clientId: code.clientId,
+    userId: code.userId,
+    grantId: grant._id,
+    meta: { familyId: issued.familyId, scopes: issued.scopes, audience: issued.audience }
+  });
+  return issued;
+}
+async function rotateRefresh(ctx, rawRefresh, opts) {
+  const tokenHash = sha256(rawRefresh);
+  const now = /* @__PURE__ */ new Date();
+  const token = await ctx.models.Token.findOneAndUpdate(
+    { tokenHash, kind: "refresh", consumedAt: null, revokedAt: null },
+    { $set: { consumedAt: now } },
+    { returnDocument: "after" }
+  );
+  if (!token) {
+    const known = await ctx.models.Token.findOne({ tokenHash, kind: "refresh" });
+    if (known?.consumedAt) {
+      const revoked = await revokeFamily(ctx, known.familyId, "refresh_reuse_detected");
+      ctx.track({
+        type: "oauth.refresh_reuse_detected",
+        userId: known.userId,
+        clientId: known.clientId,
+        grantId: String(known.grantId),
+        contextId: known.contextId ?? void 0,
+        scopes: known.scopes,
+        meta: { familyId: known.familyId, tokensRevoked: revoked }
+      });
+      await ctx.audit({
+        type: "refresh_reuse_detected",
+        actor: "client",
+        clientId: known.clientId,
+        userId: known.userId,
+        grantId: known.grantId,
+        meta: { familyId: known.familyId, tokensRevoked: revoked }
+      });
+      ctx.logger.warn?.(
+        { clientId: known.clientId, familyId: known.familyId },
+        "oauth-host: rotated refresh token reused \u2014 family revoked"
+      );
+    }
+    throw invalidGrant("refresh token is invalid, expired, or already used");
+  }
+  if (token.clientId !== opts.clientId) {
+    await revokeFamily(ctx, token.familyId, "refresh_wrong_client");
+    await ctx.audit({
+      type: "refresh_wrong_client",
+      actor: "client",
+      clientId: opts.clientId,
+      userId: token.userId,
+      grantId: token.grantId,
+      meta: { familyId: token.familyId, issuedTo: token.clientId }
+    });
+    throw invalidGrant("refresh token was issued to a different client");
+  }
+  if (token.expiresAt.getTime() <= now.getTime()) {
+    throw invalidGrant("refresh token has expired");
+  }
+  if (token.familyExpiresAt && token.familyExpiresAt.getTime() <= now.getTime()) {
+    await revokeFamily(ctx, token.familyId, "family_absolute_expiry");
+    throw invalidGrant("refresh token family has reached its absolute lifetime; re-authorization is required");
+  }
+  const grant = await liveGrant(ctx, token.grantId);
+  if (ctx.grantContext && token.contextId !== null) {
+    const stillAllowed = await ctx.grantContext.verify(
+      await ctx.loadUser(token.userId),
+      token.contextId
+    );
+    if (!stillAllowed) {
+      await ctx.models.Grant.updateOne(
+        { _id: grant._id, revokedAt: null },
+        { $set: { revokedAt: now, revokedBy: "system" } }
+      );
+      await revokeFamily(ctx, token.familyId, "context_membership_ended");
+      await ctx.audit({
+        type: "grant_revoked",
+        actor: "system",
+        clientId: token.clientId,
+        userId: token.userId,
+        grantId: token.grantId,
+        meta: { reason: "context_membership_ended", contextId: token.contextId }
+      });
+      throw invalidGrant("the context this authorization was granted for is no longer available");
+    }
+  }
+  const ceiling = token.scopes.filter((s) => grant.scopes.includes(s));
+  const requested = parseScopes(opts.scope);
+  const scopes = requested.length ? requested : ceiling;
+  for (const s of scopes) {
+    if (!ceiling.includes(s)) {
+      throw invalidScope(`scope '${s}' was not granted; a refresh may only narrow the scope set`);
+    }
+  }
+  const audience = opts.resources?.length ? opts.resources : token.audience;
+  for (const r of audience) {
+    if (!token.audience.includes(r)) {
+      throw invalidTarget(`resource '${r}' is not one this authorization is bound to`);
+    }
+  }
+  const issued = await mintPair(ctx, {
+    grant,
+    clientId: token.clientId,
+    userId: token.userId,
+    contextId: token.contextId,
+    scopes,
+    audience,
+    familyId: token.familyId,
+    familyExpiresAt: token.familyExpiresAt ?? new Date(now.getTime() + ctx.ttl.refreshAbsolute * 1e3),
+    parentId: token._id
+  });
+  ctx.track({
+    type: "oauth.token_refreshed",
+    userId: issued.userId,
+    clientId: token.clientId,
+    grantId: issued.grantId,
+    contextId: issued.contextId ?? void 0,
+    scopes: issued.scopes
+  });
+  return issued;
+}
+async function revokeFamily(ctx, familyId, reason) {
+  const { modifiedCount = 0 } = await ctx.models.Token.updateMany(
+    { familyId, revokedAt: null },
+    { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+  );
+  if (modifiedCount) {
+    ctx.logger.info?.({ familyId, reason, tokensRevoked: modifiedCount }, "oauth-host: token family revoked");
+  }
+  return modifiedCount;
+}
+var CACHE_MAX_ENTRIES = 1e4;
+var introspectionCache = /* @__PURE__ */ new Map();
+function cacheGet(ctx, hash) {
+  if (ctx.tokenCacheTtlMs <= 0) return null;
+  const hit = introspectionCache.get(hash);
+  if (!hit) return null;
+  if (hit.until <= Date.now()) {
+    introspectionCache.delete(hash);
+    return null;
+  }
+  return hit.doc;
+}
+function cachePut(ctx, hash, doc) {
+  if (ctx.tokenCacheTtlMs <= 0) return;
+  if (introspectionCache.size >= CACHE_MAX_ENTRIES) {
+    const oldest = introspectionCache.keys().next().value;
+    if (oldest !== void 0) introspectionCache.delete(oldest);
+  }
+  const until = Math.min(Date.now() + ctx.tokenCacheTtlMs, doc.expiresAt.getTime());
+  introspectionCache.set(hash, { doc, until });
+}
+function forgetCachedToken(tokenHash) {
+  introspectionCache.delete(tokenHash);
+}
+async function introspectAccessToken(ctx, raw) {
+  const hash = sha256(raw);
+  const cached = cacheGet(ctx, hash);
+  if (cached) return cached;
+  const token = await ctx.models.Token.findOne({ tokenHash: hash, kind: "access" });
+  if (!token) return null;
+  if (token.revokedAt) return null;
+  if (token.expiresAt.getTime() <= Date.now()) return null;
+  const grant = await ctx.models.Grant.findById(token.grantId, { revokedAt: 1 });
+  if (!grant || grant.revokedAt) return null;
+  cachePut(ctx, hash, token);
+  return token;
+}
+async function revokeToken(ctx, raw, clientId) {
+  const token = await ctx.models.Token.findOne({ tokenHash: sha256(raw) });
+  if (!token) return;
+  forgetCachedToken(token.tokenHash);
+  if (token.clientId !== clientId) return;
+  if (token.kind === "refresh") {
+    await revokeFamily(ctx, token.familyId, "client_revocation");
+  } else {
+    await ctx.models.Token.updateOne(
+      { _id: token._id, revokedAt: null },
+      { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+    );
+  }
+  await ctx.audit({
+    type: "token_revoked",
+    actor: "client",
+    clientId,
+    userId: token.userId,
+    grantId: token.grantId,
+    meta: { kind: token.kind, familyId: token.familyId }
+  });
+}
+
+// src/server/protect.ts
+function createProtect(ctx) {
+  const declared = new Set(ctx.resources.map((r) => r.id));
+  return function protect(scopes, opts = {}) {
+    const required = scopes === void 0 ? [] : Array.isArray(scopes) ? scopes : [scopes];
+    const resource = opts.resource ?? ctx.resources[0].id;
+    const mode = opts.mode ?? "all";
+    if (!declared.has(resource)) {
+      throw new TypeError(
+        `oauth-host: protect({ resource: '${resource}' }) is not one of the configured resources (${[...declared].join(", ")})`
+      );
+    }
+    for (const s of required) {
+      if (!ctx.scopeIndex.has(s)) {
+        throw new TypeError(`oauth-host: protect() requires scope '${s}', which is not in the scope catalog`);
+      }
+    }
+    const metadataUrl = protectedResourceMetadataUrl(ctx.issuer, resource);
+    return wrap(ctx.logger, async (req, res, next) => {
+      const raw = bearerFromHeader(req);
+      if (!raw) return challenge(res, 401, metadataUrl);
+      const token = await introspectAccessToken(ctx, raw);
+      if (!token) {
+        return challenge(res, 401, metadataUrl, {
+          error: "invalid_token",
+          error_description: "The access token is expired, revoked or unknown"
+        });
+      }
+      if (!token.audience.includes(resource)) {
+        return challenge(res, 401, metadataUrl, {
+          error: "invalid_token",
+          error_description: "The access token was not issued for this resource"
+        });
+      }
+      const held = new Set(token.scopes);
+      const ok = mode === "any" ? required.length === 0 || required.some((s) => held.has(s)) : required.every((s) => held.has(s));
+      if (!ok) {
+        return challenge(res, 403, metadataUrl, {
+          error: "insufficient_scope",
+          error_description: `Requires ${mode === "any" ? "one of" : "all of"}: ${required.join(" ")}`,
+          scope: required.join(" ")
+        });
+      }
+      req.oauth = {
+        userId: token.userId,
+        clientId: token.clientId,
+        contextId: token.contextId ?? null,
+        scopes: token.scopes,
+        grantId: String(token.grantId),
+        tokenId: String(token._id),
+        audience: token.audience
+      };
+      return next();
+    });
+  };
+}
+function bearerFromHeader(req) {
+  const header = req.headers.authorization;
+  if (!header) return null;
+  const match = /^Bearer +([^\s]+)$/i.exec(header);
+  return match ? match[1] : null;
+}
+function challenge(res, status, metadataUrl, params = {}) {
+  const parts = [
+    ...Object.entries(params).map(([k, v]) => `${k}="${String(v).replace(/"/g, "")}"`),
+    `resource_metadata="${metadataUrl}"`
+  ];
+  res.set("WWW-Authenticate", `Bearer ${parts.join(", ")}`);
+  return res.status(status).json({
+    error: params.error ?? "invalid_request",
+    error_description: params.error_description ?? "Missing bearer token"
+  });
+}
+
+// src/server/rate-limit.ts
+function rateLimit(ctx, bucket, keyOf) {
+  const rule = ctx.rateLimits[bucket];
+  if (rule === false) return (_req, _res, next) => next();
+  return (req, res, next) => {
+    void (async () => {
+      let hit;
+      try {
+        hit = await ctx.rateLimits.hit(`${bucket}:${keyOf(req)}`, rule.windowMs);
+      } catch (err) {
+        ctx.logger.error?.({ err, bucket }, "oauth-host: rate limit store failed, allowing request");
+        next();
+        return;
+      }
+      if (hit.count <= rule.max) {
+        next();
+        return;
+      }
+      const retryAfter = Math.max(1, Math.ceil((hit.resetAt - Date.now()) / 1e3));
+      res.set("Retry-After", String(retryAfter));
+      res.status(429).json({
+        error: "too_many_requests",
+        error_description: `Rate limit exceeded for ${bucket}. Retry in ${retryAfter}s.`
+      });
+    })();
+  };
+}
+function thumbprint(jwk) {
+  return sha256(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }));
+}
+function toJwk(key) {
+  return key.export({ format: "jwk" });
+}
+function publicHalf(jwk, kid) {
+  const { d, ...rest } = jwk;
+  return { ...rest, kid, alg: "ES256", use: "sig" };
+}
+function normalizeConfigured(specs) {
+  if (!specs?.length) return [];
+  return specs.map((spec) => {
+    if (spec.alg && spec.alg !== "ES256") {
+      throw new TypeError(`oauth-host: signing key '${spec.kid}' has alg '${spec.alg}'; only ES256 is supported`);
+    }
+    let privateKey;
+    try {
+      privateKey = createPrivateKey(spec.privateKeyPem);
+    } catch (err) {
+      throw new TypeError(
+        `oauth-host: signing key '${spec.kid}' is not a readable PKCS#8 PEM (${err.message})`
+      );
+    }
+    if (privateKey.asymmetricKeyType !== "ec") {
+      throw new TypeError(`oauth-host: signing key '${spec.kid}' must be an EC (P-256) key`);
+    }
+    const jwk = toJwk(createPublicKey(privateKey));
+    if (jwk.crv !== "P-256") {
+      throw new TypeError(`oauth-host: signing key '${spec.kid}' uses curve ${String(jwk.crv)}; ES256 requires P-256`);
+    }
+    const kid = spec.kid || thumbprint(jwk);
+    return { kid, status: spec.status ?? "active", privateKey, publicJwk: publicHalf(jwk, kid) };
+  });
+}
+var MISSING_KEY = "oauth-host: no signing key. Set `signing.keys` to a PKCS#8 ES256 PEM, or `signing.autoGenerate: true` to generate and persist one (development only \u2014 it stores the private key in the same database as the tokens it signs).";
+function createKeyManager(ctx) {
+  const configured = normalizeConfigured(ctx.signing.keys);
+  const imported = /* @__PURE__ */ new Map();
+  let generating = null;
+  function importPrivate(kid, jwk) {
+    const cached = imported.get(kid);
+    if (cached) return cached;
+    const key = createPrivateKey({ key: jwk, format: "jwk" });
+    imported.set(kid, key);
+    return key;
+  }
+  async function generateAndPersist() {
+    const { privateKey } = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+    const privateJwk = toJwk(privateKey);
+    const kid = thumbprint(privateJwk);
+    const doc = {
+      kid,
+      alg: "ES256",
+      publicJwk: publicHalf(privateJwk, kid),
+      privateJwk,
+      status: "active"
+    };
+    try {
+      return await ctx.models.Key.create(doc);
+    } catch (err) {
+      if (err.code !== 11e3) throw err;
+      const existing = await ctx.models.Key.findOne({ kid });
+      if (!existing) throw err;
+      return existing;
+    }
+  }
+  return {
+    async getSigningKey() {
+      const active = configured.find((k) => k.status === "active");
+      if (active) return { kid: active.kid, alg: "ES256", privateKey: active.privateKey };
+      if (configured.length) {
+        throw new Error("oauth-host: every configured signing key is `retiring`; one must be `active` to sign with");
+      }
+      if (!ctx.signing.autoGenerate) throw new Error(MISSING_KEY);
+      const doc = await ctx.models.Key.findOne({ status: "active" }).sort({ createdAt: 1, kid: 1 }) ?? await (generating ??= generateAndPersist().finally(() => {
+        generating = null;
+      }));
+      return { kid: doc.kid, alg: "ES256", privateKey: importPrivate(doc.kid, doc.privateJwk) };
+    },
+    async jwks() {
+      if (configured.length) {
+        return { keys: configured.map((k) => k.publicJwk) };
+      }
+      const docs = await ctx.models.Key.find({ status: { $in: ["active", "retiring"] } }).sort({ createdAt: 1, kid: 1 });
+      return { keys: docs.map((d) => ({ ...d.publicJwk, kid: d.kid, alg: d.alg, use: "sig" })) };
+    }
+  };
+}
+
+// src/server/services/admin.ts
+var MAX_LIST = 200;
+var DEFAULT_LIST = 50;
+function clampLimit(requested) {
+  const n = typeof requested === "number" && Number.isFinite(requested) ? Math.floor(requested) : DEFAULT_LIST;
+  if (n < 1) return 1;
+  return Math.min(n, MAX_LIST);
+}
+function clampSkip(requested) {
+  const n = typeof requested === "number" && Number.isFinite(requested) ? Math.floor(requested) : 0;
+  return n > 0 ? n : 0;
+}
+function notFound(clientId) {
+  return new Error(`oauth-host: no client registered with clientId '${clientId}'`);
+}
+function toPublicClient(doc) {
+  return {
+    clientId: doc.clientId,
+    name: doc.name,
+    type: doc.type,
+    // Defaulted rather than read straight through: rows written before the
+    // field existed have no value, and `undefined` here would read as "unknown
+    // provenance" on a client that plainly was registered by hand.
+    registration: doc.registration ?? "manual",
+    ...doc.metadataUrl ? { metadataUrl: doc.metadataUrl } : {},
+    trusted: Boolean(doc.trusted),
+    redirectUris: [...doc.redirectUris ?? []],
+    allowedScopes: [...doc.allowedScopes ?? []],
+    allowedResources: [...doc.allowedResources ?? []],
+    branding: { ...doc.branding ?? {} },
+    status: doc.status,
+    createdAt: doc.createdAt
+  };
+}
+function assertRedirectUri(value) {
+  if (typeof value !== "string" || !value) {
+    throw new TypeError(`oauth-host: every redirectUri must be a string (got ${JSON.stringify(value)})`);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError(`oauth-host: redirectUri must be an absolute URI: '${value}'`);
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new TypeError(
+      `oauth-host: redirectUri must be https (http is allowed only on localhost/127.0.0.1): '${value}'`
+    );
+  }
+  if (url.hash) {
+    throw new TypeError(`oauth-host: redirectUri must not contain a fragment: '${value}'`);
+  }
+  return value;
+}
+function assertRedirectUris(input) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError("oauth-host: a client needs at least one redirectUri");
+  }
+  return input.map(assertRedirectUri);
+}
+function assertScopes(ctx, input) {
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError("oauth-host: a client needs at least one entry in allowedScopes");
+  }
+  for (const id of input) {
+    if (typeof id !== "string" || !ctx.scopeIndex.has(id)) {
+      throw new TypeError(
+        `oauth-host: allowedScopes contains '${String(id)}', which is not in the configured scope catalog`
+      );
+    }
+  }
+  return [...input];
+}
+function assertResources(ctx, input) {
+  const declared = new Set(ctx.resources.map((r) => r.id));
+  if (input === void 0) return ctx.resources.map((r) => r.id);
+  if (!Array.isArray(input) || input.length === 0) {
+    throw new TypeError("oauth-host: allowedResources, when given, must list at least one resource");
+  }
+  for (const id of input) {
+    if (typeof id !== "string" || !declared.has(id)) {
+      throw new TypeError(
+        `oauth-host: allowedResources contains '${String(id)}', which is not a configured resource`
+      );
+    }
+  }
+  return [...input];
+}
+function assertName(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new TypeError("oauth-host: a client needs a non-empty `name` \u2014 it is what the consent screen shows");
+  }
+  return value.trim();
+}
+async function revokeGrantsMatching(ctx, filter, by) {
+  const res = await ctx.models.Grant.updateMany(
+    { ...filter, revokedAt: null },
+    { $set: { revokedAt: /* @__PURE__ */ new Date(), revokedBy: by } }
+  );
+  return { grantsRevoked: res.modifiedCount ?? 0 };
+}
+async function revokeTokensMatching(ctx, filter) {
+  const res = await ctx.models.Token.updateMany(
+    { ...filter, revokedAt: null },
+    { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+  );
+  return res.modifiedCount ?? 0;
+}
+function createClientsApi(ctx) {
+  return {
+    async create(spec) {
+      if (!spec || typeof spec !== "object") {
+        throw new TypeError("oauth-host: clients.create(spec) requires a spec object");
+      }
+      const name = assertName(spec.name);
+      const redirectUris = assertRedirectUris(spec.redirectUris);
+      const allowedScopes = assertScopes(ctx, spec.allowedScopes);
+      const allowedResources = assertResources(ctx, spec.allowedResources);
+      const clientId = spec.clientId ?? generateClientId();
+      const clientSecret = generateClientSecret();
+      const doc = await ctx.models.Client.create({
+        clientId,
+        name,
+        type: "confidential",
+        registration: "manual",
+        trusted: Boolean(spec.trusted),
+        // Only the digest is stored. `clientSecret` below is the only time the
+        // raw value exists outside the caller's variable.
+        secrets: [{ hash: sha256(clientSecret), label: "initial", createdAt: /* @__PURE__ */ new Date() }],
+        redirectUris,
+        allowedScopes,
+        allowedResources,
+        branding: spec.branding ?? {},
+        status: "active"
+      });
+      await ctx.audit({ type: "oauth.client_created", actor: "admin", clientId });
+      return { client: toPublicClient(doc), clientId, clientSecret };
+    },
+    async rotateSecret(clientId, opts = {}) {
+      const doc = await ctx.models.Client.findOne({ clientId });
+      if (!doc) throw notFound(clientId);
+      if (doc.type === "public") {
+        throw new Error(
+          `oauth-host: client '${clientId}' is a public client and has no secret to rotate. Public clients authenticate with client_id and PKCE.`
+        );
+      }
+      const retireAfter = typeof opts.retireAfter === "number" && opts.retireAfter > 0 ? opts.retireAfter : 0;
+      const retiresAt = new Date(Date.now() + retireAfter);
+      for (const record of doc.secrets) {
+        record.retiresAt = record.retiresAt && record.retiresAt < retiresAt ? record.retiresAt : retiresAt;
+      }
+      const clientSecret = generateClientSecret();
+      doc.secrets.push({
+        hash: sha256(clientSecret),
+        label: opts.label ?? `rotated-${(/* @__PURE__ */ new Date()).toISOString()}`,
+        createdAt: /* @__PURE__ */ new Date()
+      });
+      doc.markModified("secrets");
+      await doc.save();
+      ctx.track({ type: "oauth.client_secret_rotated", clientId });
+      await ctx.audit({
+        type: "oauth.client_secret_rotated",
+        actor: "admin",
+        clientId,
+        meta: { retireAfter, retiresAt }
+      });
+      return { client: toPublicClient(doc), clientId, clientSecret };
+    },
+    async update(clientId, patch) {
+      const doc = await ctx.models.Client.findOne({ clientId });
+      if (!doc) throw notFound(clientId);
+      if (patch.name !== void 0) doc.name = assertName(patch.name);
+      if (patch.redirectUris !== void 0) doc.redirectUris = assertRedirectUris(patch.redirectUris);
+      if (patch.allowedScopes !== void 0) doc.allowedScopes = assertScopes(ctx, patch.allowedScopes);
+      if (patch.allowedResources !== void 0) {
+        doc.allowedResources = assertResources(ctx, patch.allowedResources);
+      }
+      if (patch.branding !== void 0) doc.branding = patch.branding;
+      if (patch.trusted !== void 0) doc.trusted = Boolean(patch.trusted);
+      await doc.save();
+      await ctx.audit({ type: "oauth.client_updated", actor: "admin", clientId });
+      return toPublicClient(doc);
+    },
+    async list(query = {}) {
+      const limit = clampLimit(query.limit);
+      const skip = clampSkip(query.skip);
+      const filter = {};
+      if (query.status) filter.status = query.status;
+      const docs = await ctx.models.Client.find(filter).sort({ createdAt: -1 }).skip(skip).limit(limit).lean();
+      return { items: docs.map(toPublicClient), limit };
+    },
+    async get(clientId) {
+      const doc = await ctx.models.Client.findOne({ clientId }).lean();
+      return doc ? toPublicClient(doc) : null;
+    },
+    async disable(clientId) {
+      const doc = await ctx.models.Client.findOne({ clientId });
+      if (!doc) throw notFound(clientId);
+      doc.status = "disabled";
+      await doc.save();
+      const { grantsRevoked } = await revokeGrantsMatching(ctx, { clientId }, "admin");
+      const tokensRevoked = await revokeTokensMatching(ctx, { clientId });
+      await ctx.models.Code.deleteMany({ clientId });
+      await ctx.models.Request.deleteMany({ clientId });
+      await ctx.audit({
+        type: "oauth.client_disabled",
+        actor: "admin",
+        clientId,
+        meta: { grantsRevoked, tokensRevoked }
+      });
+      return { grantsRevoked, tokensRevoked };
+    }
+  };
+}
+function formUrlDecode(value) {
+  try {
+    return decodeURIComponent(value.replace(/\+/g, " "));
+  } catch {
+    return value;
+  }
+}
+function readCredentials(req) {
+  const header = req.headers?.authorization;
+  if (typeof header === "string" && /^Basic /i.test(header)) {
+    const decoded = Buffer.from(header.slice(6).trim(), "base64").toString("utf8");
+    const sep = decoded.indexOf(":");
+    const clientId = formUrlDecode(sep < 0 ? decoded : decoded.slice(0, sep));
+    const secret = sep < 0 ? "" : formUrlDecode(decoded.slice(sep + 1));
+    return { clientId, clientSecret: secret === "" ? null : secret, viaBasic: true };
+  }
+  const body = req.body ?? {};
+  if (typeof body.client_id === "string" && body.client_id) {
+    return {
+      clientId: body.client_id,
+      clientSecret: typeof body.client_secret === "string" && body.client_secret ? body.client_secret : null,
+      viaBasic: false
+    };
+  }
+  return null;
+}
+function authFailure(viaBasic) {
+  return new OAuthError(401, "invalid_client", "client authentication failed", {
+    // RFC 6749 §5.2 — a 401 answering a Basic credential MUST carry the challenge.
+    headers: viaBasic ? { "WWW-Authenticate": 'Basic realm="oauth", charset="UTF-8"' } : {}
+  });
+}
+async function authenticateClient(ctx, req) {
+  const creds = readCredentials(req);
+  if (!creds || !creds.clientId) throw authFailure(Boolean(creds?.viaBasic));
+  const client = await ctx.models.Client.findOne({ clientId: creds.clientId });
+  if (!client || client.status !== "active") throw authFailure(creds.viaBasic);
+  if (client.type === "public") {
+    if (creds.clientSecret !== null) throw authFailure(creds.viaBasic);
+    return client;
+  }
+  if (creds.clientSecret === null) throw authFailure(creds.viaBasic);
+  const now = Date.now();
+  let matched;
+  for (const record of client.secrets) {
+    if (record.retiresAt && record.retiresAt.getTime() <= now) continue;
+    if (safeEqual(sha256(creds.clientSecret), record.hash)) matched = record;
+  }
+  if (!matched) throw authFailure(creds.viaBasic);
+  const usedAt = /* @__PURE__ */ new Date();
+  matched.lastUsedAt = usedAt;
+  await ctx.models.Client.updateOne(
+    { clientId: client.clientId, "secrets.hash": matched.hash },
+    { $set: { "secrets.$.lastUsedAt": usedAt } }
+  );
+  return client;
+}
+function describeGrantScopes(ctx, ids) {
+  return ids.map((id) => ctx.scopeIndex.get(id) ?? { id, label: id });
+}
+function createGrantsApi(ctx) {
+  return {
+    async list(query) {
+      const limit = clampLimit(query?.limit);
+      const skip = clampSkip(query?.skip);
+      const filter = { revokedAt: null };
+      if (query?.userId !== void 0) filter.userId = query.userId;
+      if (query?.clientId !== void 0) filter.clientId = query.clientId;
+      const grants = await ctx.models.Grant.find(filter).sort({ createdAt: -1 }).skip(skip).limit(limit).lean();
+      if (grants.length === 0) return { items: [], limit };
+      const clientIds = [...new Set(grants.map((g) => g.clientId))];
+      const clients = await ctx.models.Client.find({ clientId: { $in: clientIds } }).lean();
+      const byId = new Map(clients.map((c) => [c.clientId, toPublicClient(c)]));
+      const contextCache = /* @__PURE__ */ new Map();
+      const items = [];
+      for (const grant of grants) {
+        const client = byId.get(grant.clientId);
+        const summary = {
+          id: String(grant._id),
+          client: client ? { clientId: client.clientId, name: client.name, branding: client.branding } : { clientId: grant.clientId, name: grant.clientId, branding: {} },
+          scopes: describeGrantScopes(ctx, grant.scopes ?? []),
+          createdAt: grant.createdAt,
+          ...grant.lastUsedAt ? { lastUsedAt: grant.lastUsedAt } : {}
+        };
+        if (ctx.grantContext && grant.contextId) {
+          const cacheKey = `${String(grant.userId)}:${grant.clientId}`;
+          let available = contextCache.get(cacheKey);
+          if (!available) {
+            const user = { id: grant.userId };
+            available = client ? await ctx.grantContext.list(user, { client, scopes: grant.scopes ?? [] }) : [];
+            contextCache.set(cacheKey, available);
+          }
+          summary.context = available.find((c) => c.id === grant.contextId) ?? { id: grant.contextId, label: grant.contextId };
+        }
+        items.push(summary);
+      }
+      return { items, limit };
+    },
+    async revoke(grantId, opts = {}) {
+      const by = opts.by ?? "admin";
+      const grant = await ctx.models.Grant.findById(grantId).catch(() => null);
+      if (!grant) return { tokensRevoked: 0 };
+      const alreadyRevoked = Boolean(grant.revokedAt);
+      if (!alreadyRevoked) {
+        grant.revokedAt = /* @__PURE__ */ new Date();
+        grant.revokedBy = by;
+        await grant.save();
+      }
+      const tokensRevoked = await revokeTokensMatching(ctx, { grantId: grant._id });
+      if (!alreadyRevoked) {
+        ctx.track({
+          type: "oauth.grant_revoked",
+          userId: grant.userId,
+          clientId: grant.clientId,
+          grantId: String(grant._id),
+          ...grant.contextId ? { contextId: grant.contextId } : {},
+          scopes: grant.scopes
+        });
+        await ctx.audit({
+          type: "oauth.grant_revoked",
+          actor: by,
+          clientId: grant.clientId,
+          userId: grant.userId,
+          grantId: grant._id,
+          meta: { tokensRevoked }
+        });
+      }
+      return { tokensRevoked };
+    }
+  };
+}
+function pairwiseKey(userId) {
+  const key = String(userId);
+  if (!key || key.includes(".") || key.startsWith("$")) return null;
+  return key;
+}
+function createUsersApi(ctx) {
+  return {
+    /**
+     * Erasure. The user is gone and every trace of them has to go with them.
+     *
+     * This is the destructive twin of `revokeAll`, and the difference is the
+     * whole reason both exist: `forget` DELETES the grant documents and the
+     * user's audit rows, `revokeAll` keeps both. A password change must leave a
+     * history an operator can read; a deletion request must not.
+     *
+     * Idempotent — it will be called twice, by a retry or by a host that wires
+     * it to both a soft-delete and a hard-delete hook.
+     */
+    async forget(userId) {
+      const grantsResult = await ctx.models.Grant.deleteMany({ userId });
+      const tokensResult = await ctx.models.Token.deleteMany({ userId });
+      await ctx.models.Code.deleteMany({ userId });
+      await ctx.models.Request.deleteMany({ userId });
+      const key = pairwiseKey(userId);
+      if (key) {
+        await ctx.models.Client.updateMany(
+          { [`pairwiseSubjects.${key}`]: { $exists: true } },
+          { $unset: { [`pairwiseSubjects.${key}`]: "" } }
+        );
+      }
+      await ctx.models.Audit.deleteMany({ userId });
+      const grants = grantsResult.deletedCount ?? 0;
+      const tokens = tokensResult.deletedCount ?? 0;
+      await ctx.audit({ type: "oauth.user_forgotten", actor: "system", meta: { grants, tokens } });
+      return { grants, tokens };
+    },
+    /**
+     * Password change, deactivation, suspected compromise.
+     *
+     * Kills live access and KEEPS everything else: the grant documents stay so
+     * the audit trail still resolves and so the user's connected apps remain
+     * visible, and the audit rows stay because that is the record the operator
+     * called this to create. See `forget` above for the destructive twin.
+     */
+    async revokeAll(userId, opts = {}) {
+      const live = await ctx.models.Grant.find({ userId, revokedAt: null }).limit(MAX_LIST).lean();
+      const { grantsRevoked } = await revokeGrantsMatching(ctx, { userId }, "system");
+      const tokensRevoked = await revokeTokensMatching(ctx, { userId });
+      await ctx.models.Code.deleteMany({ userId });
+      await ctx.models.Request.deleteMany({ userId });
+      for (const grant of live) {
+        ctx.track({
+          type: "oauth.grant_revoked",
+          userId,
+          clientId: grant.clientId,
+          grantId: String(grant._id),
+          ...grant.contextId ? { contextId: grant.contextId } : {},
+          scopes: grant.scopes
+        });
+      }
+      await ctx.audit({
+        type: "oauth.user_access_revoked",
+        actor: "system",
+        userId,
+        meta: { grantsRevoked, tokensRevoked, ...opts.reason ? { reason: opts.reason } : {} }
+      });
+      return { grantsRevoked, tokensRevoked };
+    }
+  };
+}
+function createContextsApi(ctx) {
+  return {
+    /**
+     * A grant made as an employee has to die when the employment does.
+     *
+     * `grantContext.verify()` catches this on the next refresh, but an access
+     * token already issued is valid for its full hour and nothing re-checks it.
+     * This is the push half of that pair, and it is why the adapter has an
+     * outbound direction at all.
+     */
+    async revoked(userId, contextId) {
+      const live = await ctx.models.Grant.find({ userId, contextId, revokedAt: null }).limit(MAX_LIST).lean();
+      const { grantsRevoked } = await revokeGrantsMatching(ctx, { userId, contextId }, "system");
+      const tokensRevoked = await revokeTokensMatching(ctx, { userId, contextId });
+      await ctx.models.Code.deleteMany({ userId, contextId });
+      for (const grant of live) {
+        ctx.track({
+          type: "oauth.grant_revoked",
+          userId,
+          clientId: grant.clientId,
+          grantId: String(grant._id),
+          contextId,
+          scopes: grant.scopes
+        });
+        await ctx.audit({
+          type: "oauth.grant_revoked",
+          actor: "system",
+          clientId: grant.clientId,
+          userId,
+          grantId: grant._id,
+          meta: { contextId, reason: "context_membership_ended" }
+        });
+      }
+      return { grantsRevoked, tokensRevoked };
+    }
+  };
+}
+
+// src/server/services/cimd.ts
+var NEGATIVE_TTL_MS = 6e4;
+var MAX_REMEMBERED_FAILURES = 1e3;
+function refuse(description) {
+  return new UnredirectableError("invalid_client", description);
+}
+function isMetadataUrl(clientId) {
+  return /^https:\/\//i.test(clientId);
+}
+function hostAllowed(rules, url) {
+  const hostname = url.hostname.toLowerCase();
+  return rules.some((rule) => {
+    if (url.port !== rule.port) return false;
+    if (hostname === rule.host) return true;
+    return rule.subdomains && hostname.endsWith(`.${rule.host}`);
+  });
+}
+function assertFetchableUrl(ctx, clientId) {
+  let url;
+  try {
+    url = new URL(clientId);
+  } catch {
+    throw refuse(`client_id is not a valid URL: '${clientId}'`);
+  }
+  if (url.protocol !== "https:") {
+    throw refuse(`client_id metadata must be served over https (got '${url.protocol}')`);
+  }
+  if (url.username || url.password) {
+    throw refuse("client_id must not contain URL credentials");
+  }
+  if (url.hash) {
+    throw refuse("client_id must not contain a fragment");
+  }
+  if (!hostAllowed(ctx.cimd.allowedHosts, url)) {
+    throw refuse(`client_id host '${url.host}' is not in clientIdMetadata.allowedHosts`);
+  }
+  return url;
+}
+var JSON_CONTENT_TYPE = /^application\/(?:[\w.+-]+\+)?json\s*(?:;|$)/i;
+async function readCapped(res, maxBytes) {
+  const body = res.body;
+  if (!body) throw refuse("client_id metadata document was empty");
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      void reader.cancel();
+      throw refuse(`client_id metadata document exceeds ${maxBytes} bytes`);
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function fetchMetadata(ctx, url, etag) {
+  let res;
+  try {
+    res = await fetch(url.toString(), {
+      method: "GET",
+      // The single most important line in this file. A 3xx is a failure below,
+      // not a hop: following redirects would let an allowlisted host forward us
+      // to any address it likes, allowlist intact.
+      redirect: "manual",
+      headers: {
+        accept: "application/json",
+        ...etag ? { "if-none-match": etag } : {}
+      },
+      signal: AbortSignal.timeout(ctx.cimd.fetchTimeoutMs)
+    });
+  } catch (err) {
+    const name = err?.name;
+    if (name === "TimeoutError" || name === "AbortError") {
+      throw refuse(`client_id metadata fetch timed out after ${ctx.cimd.fetchTimeoutMs}ms`);
+    }
+    throw refuse(`client_id metadata could not be fetched: ${err?.message ?? "network error"}`);
+  }
+  if (res.status === 304) return { document: null };
+  if (res.status >= 300 && res.status < 400) {
+    throw refuse(
+      `client_id metadata returned a ${res.status} redirect, which is not followed \u2014 serve the document at the client_id URL itself`
+    );
+  }
+  if (res.status !== 200) {
+    throw refuse(`client_id metadata returned HTTP ${res.status}`);
+  }
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!JSON_CONTENT_TYPE.test(contentType)) {
+    throw refuse(`client_id metadata must be JSON (got content-type '${contentType || "none"}')`);
+  }
+  const text = await readCapped(res, ctx.cimd.maxBytes);
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw refuse("client_id metadata document is not valid JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw refuse("client_id metadata document must be a JSON object");
+  }
+  return {
+    document: parsed,
+    ...res.headers.get("etag") ? { etag: res.headers.get("etag") } : {}
+  };
+}
+function requireString(doc, field) {
+  const value = doc[field];
+  if (typeof value !== "string" || !value.trim()) {
+    throw refuse(`client_id metadata field '${field}' must be a non-empty string`);
+  }
+  return value.trim();
+}
+function optionalHttpsUri(doc, field) {
+  const value = doc[field];
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "string" || !value.trim()) {
+    throw refuse(`client_id metadata field '${field}' must be a string`);
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw refuse(`client_id metadata field '${field}' must be an absolute URL: '${value}'`);
+  }
+  if (url.protocol !== "https:") {
+    throw refuse(`client_id metadata field '${field}' must be https (got '${url.protocol}')`);
+  }
+  return value;
+}
+function assertRedirectUris2(doc) {
+  const value = doc.redirect_uris;
+  if (!Array.isArray(value) || value.length === 0) {
+    throw refuse("client_id metadata field 'redirect_uris' must be a non-empty array");
+  }
+  return value.map((entry) => {
+    if (typeof entry !== "string" || !entry) {
+      throw refuse(`client_id metadata 'redirect_uris' entries must be strings (got ${JSON.stringify(entry)})`);
+    }
+    let url;
+    try {
+      url = new URL(entry);
+    } catch {
+      throw refuse(`client_id metadata 'redirect_uris' entry must be an absolute URI: '${entry}'`);
+    }
+    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+      throw refuse(
+        `client_id metadata 'redirect_uris' entry must be https (http is allowed only on localhost/127.0.0.1): '${entry}'`
+      );
+    }
+    if (url.hash) {
+      throw refuse(`client_id metadata 'redirect_uris' entry must not contain a fragment: '${entry}'`);
+    }
+    return entry;
+  });
+}
+function validateMetadataDocument(ctx, url, doc) {
+  const declared = requireString(doc, "client_id");
+  let declaredUrl;
+  try {
+    declaredUrl = new URL(declared);
+  } catch {
+    throw refuse(`client_id metadata field 'client_id' is not a URL: '${declared}'`);
+  }
+  if (declaredUrl.href !== url.href) {
+    throw refuse(
+      `client_id metadata field 'client_id' is '${declared}', which is not the URL it was fetched from ('${url.href}')`
+    );
+  }
+  const method = doc.token_endpoint_auth_method;
+  if (method !== void 0 && method !== "none") {
+    throw refuse(
+      `client_id metadata field 'token_endpoint_auth_method' must be 'none' (got ${JSON.stringify(method)}) \u2014 a CIMD client holds no secret`
+    );
+  }
+  const name = requireString(doc, "client_name");
+  const redirectUris = assertRedirectUris2(doc);
+  const permitted = new Set(ctx.cimd.allowedScopes.filter((id) => ctx.scopeIndex.has(id)));
+  let allowedScopes;
+  if (doc.scope === void 0 || doc.scope === null) {
+    allowedScopes = [...permitted];
+  } else {
+    if (typeof doc.scope !== "string") {
+      throw refuse("client_id metadata field 'scope' must be a space-delimited string");
+    }
+    const requested = new Set(doc.scope.split(/\s+/).filter(Boolean));
+    allowedScopes = [...permitted].filter((id) => requested.has(id));
+  }
+  if (allowedScopes.length === 0) {
+    throw refuse(
+      "client_id metadata field 'scope' has no overlap with what this server offers \u2014 there is nothing this client could be granted"
+    );
+  }
+  const branding = {};
+  const logoUrl = optionalHttpsUri(doc, "logo_uri");
+  const homepageUrl = optionalHttpsUri(doc, "client_uri");
+  const tosUrl = optionalHttpsUri(doc, "tos_uri");
+  const privacyUrl = optionalHttpsUri(doc, "policy_uri");
+  if (logoUrl) branding.logoUrl = logoUrl;
+  if (homepageUrl) branding.homepageUrl = homepageUrl;
+  if (tosUrl) branding.tosUrl = tosUrl;
+  if (privacyUrl) branding.privacyUrl = privacyUrl;
+  return { name, redirectUris, allowedScopes, branding };
+}
+function rememberFailure(ctx, key, message) {
+  const { failures } = ctx.cimd;
+  if (failures.size >= MAX_REMEMBERED_FAILURES) {
+    const oldest = failures.keys().next();
+    if (!oldest.done) failures.delete(oldest.value);
+  }
+  failures.set(key, { until: Date.now() + NEGATIVE_TTL_MS, message });
+}
+function rememberedFailure(ctx, key) {
+  const found = ctx.cimd.failures.get(key);
+  if (!found) return null;
+  if (found.until <= Date.now()) {
+    ctx.cimd.failures.delete(key);
+    return null;
+  }
+  return found.message;
+}
+function isFresh(ctx, client) {
+  const fetchedAt = client.metadataFetchedAt?.getTime();
+  if (fetchedAt === void 0) return false;
+  return Date.now() - fetchedAt < ctx.cimd.cacheTtlMs;
+}
+async function persist(ctx, clientId, url, registration, etag) {
+  const doc = await ctx.models.Client.findOneAndUpdate(
+    { clientId },
+    {
+      $set: {
+        name: registration.name,
+        redirectUris: registration.redirectUris,
+        allowedScopes: registration.allowedScopes,
+        // Every declared resource. A CIMD client cannot express an audience
+        // preference, and RFC 8707 validation at `/authorize` narrows it anyway.
+        allowedResources: ctx.resources.map((r) => r.id),
+        branding: registration.branding,
+        metadataUrl: url.href,
+        metadataFetchedAt: /* @__PURE__ */ new Date(),
+        ...etag ? { metadataEtag: etag } : {}
+      },
+      $setOnInsert: {
+        type: "public",
+        registration: "cimd",
+        trusted: false,
+        secrets: [],
+        status: "active"
+      }
+    },
+    { upsert: true, returnDocument: "after", setDefaultsOnInsert: false }
+  ).exec();
+  return doc;
+}
+async function resolveCimdClient(ctx, clientId) {
+  const url = assertFetchableUrl(ctx, clientId);
+  const existing = await ctx.models.Client.findOne({ clientId }).exec();
+  if (existing) {
+    if (existing.status !== "active") {
+      throw refuse(`client '${clientId}' is disabled`);
+    }
+    if (existing.registration !== "cimd") return existing;
+    if (isFresh(ctx, existing)) return existing;
+  }
+  const remembered = rememberedFailure(ctx, url.href);
+  if (remembered) throw refuse(remembered);
+  try {
+    const { document, etag } = await fetchMetadata(ctx, url, existing?.metadataEtag);
+    if (!document) {
+      if (existing) {
+        existing.metadataFetchedAt = /* @__PURE__ */ new Date();
+        await existing.save();
+        return existing;
+      }
+      throw refuse("client_id metadata returned 304 with nothing cached to answer from");
+    }
+    const registration = validateMetadataDocument(ctx, url, document);
+    const client = await persist(ctx, clientId, url, registration, etag);
+    ctx.logger.debug?.({ clientId }, "oauth-host: client_id metadata document resolved");
+    return client;
+  } catch (err) {
+    const message = err instanceof UnredirectableError ? err.description ?? "client_id metadata could not be resolved" : "client_id metadata could not be resolved";
+    rememberFailure(ctx, url.href, message);
+    ctx.logger.warn?.({ clientId, err }, "oauth-host: client_id metadata resolution failed");
+    throw err instanceof UnredirectableError ? err : refuse(message);
+  }
+}
+
+// src/server/services/scopes.ts
+function parseScope(raw) {
+  if (typeof raw !== "string") return [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of raw.split(/\s+/)) if (id) seen.add(id);
+  return [...seen];
+}
+function validateScopes(ctx, requested, client) {
+  const allowed = new Set(client.allowedScopes);
+  for (const id of requested) {
+    if (!ctx.scopeIndex.has(id)) {
+      throw invalidScope(`unknown scope '${id}'`);
+    }
+    if (!allowed.has(id)) {
+      throw invalidScope(`client '${client.clientId}' is not allowed the scope '${id}'`);
+    }
+  }
+  return [...requested];
+}
+function resolveDefaultScopes(ctx, client) {
+  if (!ctx.defaultScopes) {
+    throw invalidScope(
+      "no `scope` was requested and no `defaultScopes` is configured. Send `scope` on /authorize, or configure `defaultScopes` on createOAuthHost \u2014 an empty scope set would issue a token that can do nothing."
+    );
+  }
+  const allowed = new Set(client.allowedScopes);
+  const granted = ctx.defaultScopes.filter((id) => allowed.has(id));
+  if (granted.length === 0) {
+    throw invalidScope(
+      `no \`scope\` was requested and client '${client.clientId}' is allowed none of the configured defaultScopes (${ctx.defaultScopes.join(" ")}). Send \`scope\` explicitly, or add one of those scopes to the client's allowedScopes.`
+    );
+  }
+  return granted;
+}
+function describeScopes(ctx, ids, opts = {}) {
+  const granted = new Set(opts.previouslyGranted ?? []);
+  return ids.map((id) => {
+    const spec = ctx.scopeIndex.get(id) ?? { label: id };
+    return {
+      id,
+      label: spec.label ?? id,
+      ...spec.description ? { description: spec.description } : {},
+      ...spec.sensitive ? { sensitive: true } : {},
+      isNew: !granted.has(id)
+    };
+  });
+}
+function validateResources(ctx, requested, client) {
+  const declared = new Set(ctx.resources.map((r) => r.id));
+  const allowed = client.allowedResources.length ? new Set(client.allowedResources) : declared;
+  if (requested.length === 0) {
+    const fallback = client.allowedResources[0] ?? ctx.resources[0]?.id;
+    return fallback ? [fallback] : [];
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of requested) {
+    if (!declared.has(id)) {
+      throw new OAuthError(400, "invalid_target", `unknown resource '${id}'`);
+    }
+    if (!allowed.has(id)) {
+      throw new OAuthError(
+        400,
+        "invalid_target",
+        `client '${client.clientId}' is not allowed the resource '${id}'`
+      );
+    }
+    seen.add(id);
+  }
+  return [...seen];
+}
+
+// src/server/services/authorize.ts
+function one(query, name) {
+  const value = query[name];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function many(query, name) {
+  const value = query[name];
+  if (typeof value === "string") return value ? [value] : [];
+  if (!Array.isArray(value)) return [];
+  return value.filter((v) => typeof v === "string" && v.length > 0);
+}
+async function resolveClient(ctx, clientId) {
+  if (ctx.cimd.enabled && isMetadataUrl(clientId)) {
+    return resolveCimdClient(ctx, clientId);
+  }
+  const client = await ctx.models.Client.findOne({ clientId }).exec();
+  if (!client) {
+    throw new UnredirectableError("invalid_client", `unknown client_id '${clientId}'`);
+  }
+  return client;
+}
+async function validateAuthorizationRequest(ctx, query) {
+  const clientId = one(query, "client_id");
+  if (!clientId) {
+    throw new UnredirectableError("invalid_request", "`client_id` is required");
+  }
+  const client = await resolveClient(ctx, clientId);
+  if (client.status !== "active") {
+    throw new UnredirectableError("invalid_client", `client '${clientId}' is disabled`);
+  }
+  const redirectUri = one(query, "redirect_uri");
+  if (!redirectUri) {
+    throw new UnredirectableError("invalid_request", "`redirect_uri` is required");
+  }
+  if (!redirectUriRegistered(client.redirectUris, redirectUri)) {
+    throw new UnredirectableError(
+      "invalid_request",
+      `redirect_uri is not registered for client '${clientId}'`
+    );
+  }
+  const state = one(query, "state");
+  const fail = (code, description) => new RedirectableAuthError(code, description, redirectUri, state);
+  const responseType = one(query, "response_type");
+  if (responseType !== "code") {
+    throw new RedirectableAuthError(
+      "unsupported_response_type",
+      "only `response_type=code` is supported",
+      redirectUri,
+      state
+    );
+  }
+  const codeChallenge = one(query, "code_challenge");
+  if (!codeChallenge) {
+    throw fail("invalid_request", "`code_challenge` is required (PKCE, RFC 7636)");
+  }
+  if (one(query, "code_challenge_method") !== "S256") {
+    throw fail("invalid_request", "`code_challenge_method` must be `S256`");
+  }
+  let scopes;
+  let resources;
+  try {
+    const requested = parseScope(one(query, "scope"));
+    scopes = requested.length ? validateScopes(ctx, requested, client) : resolveDefaultScopes(ctx, client);
+    resources = validateResources(ctx, many(query, "resource"), client);
+  } catch (err) {
+    if (err instanceof OAuthError) throw fail(err.code, err.description ?? err.code);
+    throw err;
+  }
+  let maxAge;
+  const rawMaxAge = one(query, "max_age");
+  if (rawMaxAge !== void 0) {
+    const parsed = Number(rawMaxAge);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+      throw fail("invalid_request", "`max_age` must be a non-negative integer");
+    }
+    maxAge = parsed;
+  }
+  return {
+    client,
+    redirectUri,
+    scopes,
+    resources,
+    ...state !== void 0 ? { state } : {},
+    ...one(query, "nonce") ? { nonce: one(query, "nonce") } : {},
+    codeChallenge,
+    ...one(query, "prompt") ? { prompt: one(query, "prompt") } : {},
+    ...maxAge !== void 0 ? { maxAge } : {}
+  };
+}
+async function createAuthorizationRequest(ctx, validated, user) {
+  const doc = await ctx.models.Request.create({
+    requestId: randomToken(),
+    clientId: validated.client.clientId,
+    userId: user.id,
+    redirectUri: validated.redirectUri,
+    scopes: validated.scopes,
+    resources: validated.resources,
+    state: validated.state,
+    nonce: validated.nonce,
+    codeChallenge: validated.codeChallenge,
+    codeChallengeMethod: "S256",
+    prompt: validated.prompt,
+    maxAge: validated.maxAge,
+    expiresAt: new Date(Date.now() + ctx.ttl.authorizationRequest * 1e3)
+  });
+  ctx.track({
+    type: "oauth.authorization_requested",
+    userId: user.id,
+    clientId: validated.client.clientId,
+    scopes: validated.scopes,
+    meta: { resources: validated.resources }
+  });
+  return doc;
+}
+function withParam(configured, name, value) {
+  const absolute = /^https?:\/\//i.test(configured);
+  const url = new URL(configured, "http://oauth-host.invalid");
+  url.searchParams.set(name, value);
+  return absolute ? url.toString() : `${url.pathname}${url.search}${url.hash}`;
+}
+function consentRedirectUrl(ctx, requestId) {
+  return withParam(ctx.consentUrl, "request_id", requestId);
+}
+function loginRedirectUrl(ctx, returnTo) {
+  if (!ctx.loginUrl) return null;
+  return withParam(ctx.loginUrl, ctx.returnParam, returnTo);
+}
+
+// src/server/services/consent.ts
+var CONSENT_CONTEXT_LIMIT = 50;
+function sameUser(a, b) {
+  return String(a) === String(b);
+}
+async function loadPending(ctx, requestId, user) {
+  const request = await ctx.models.Request.findOne({ requestId }).exec();
+  if (!request || request.expiresAt.getTime() <= Date.now() || request.decision) {
+    throw new OAuthError(404, "invalid_request", "unknown or expired authorization request");
+  }
+  if (!sameUser(request.userId, user.id)) {
+    throw accessDenied("this authorization request belongs to another user");
+  }
+  const client = await ctx.models.Client.findOne({ clientId: request.clientId }).exec();
+  if (!client || client.status !== "active") {
+    throw new OAuthError(404, "invalid_request", "unknown or expired authorization request");
+  }
+  return { request, client };
+}
+async function alreadyGranted(ctx, clientId, userId) {
+  const grants = await ctx.models.Grant.find({ clientId, userId, revokedAt: null }).select("scopes").lean().exec();
+  return [...new Set(grants.flatMap((g) => g.scopes))];
+}
+async function getConsentPayload(ctx, requestId, user) {
+  const { request, client } = await loadPending(ctx, requestId, user);
+  const previouslyGranted = await alreadyGranted(ctx, request.clientId, request.userId);
+  const branding = client.branding ?? {};
+  const payload = {
+    client: {
+      name: client.name,
+      ...branding.logoUrl ? { logoUrl: branding.logoUrl } : {},
+      ...branding.publisher ? { publisher: branding.publisher } : {},
+      ...branding.homepageUrl ? { homepageUrl: branding.homepageUrl } : {},
+      ...branding.tosUrl ? { tosUrl: branding.tosUrl } : {},
+      ...branding.privacyUrl ? { privacyUrl: branding.privacyUrl } : {}
+    },
+    scopes: describeScopes(ctx, request.scopes, { previouslyGranted }),
+    user: {
+      displayName: user.displayName ?? null,
+      ...user.email ? { email: user.email } : {}
+    },
+    expiresAt: request.expiresAt
+  };
+  if (ctx.grantContext) {
+    const all = await ctx.grantContext.list(user, {
+      client: toPublicClient(client),
+      scopes: request.scopes
+    });
+    payload.contexts = all.slice(0, CONSENT_CONTEXT_LIMIT);
+    payload.contextsHasMore = all.length > CONSENT_CONTEXT_LIMIT;
+  }
+  return payload;
+}
+function authorizationResponse(ctx, redirectUri, state, params) {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);
+  if (state !== void 0) url.searchParams.set("state", state);
+  url.searchParams.set("iss", ctx.issuer);
+  return url.toString();
+}
+async function decideConsent(ctx, requestId, user, decision) {
+  const { request, client } = await loadPending(ctx, requestId, user);
+  const approvedScopes = decision.approve ? [...new Set(decision.scopes ?? request.scopes)] : [];
+  for (const id of approvedScopes) {
+    if (!request.scopes.includes(id)) {
+      throw invalidRequest(`scope '${id}' was not part of this authorization request`);
+    }
+  }
+  let contextId = null;
+  if (decision.approve) {
+    if (ctx.grantContext) {
+      if (!decision.contextId) {
+        throw invalidRequest("`contextId` is required \u2014 this host configured a grant context");
+      }
+      if (!await ctx.grantContext.verify(user, decision.contextId)) {
+        throw accessDenied(`not a member of context '${decision.contextId}'`);
+      }
+      contextId = decision.contextId;
+    } else if (decision.contextId) {
+      throw invalidRequest("`contextId` is not accepted \u2014 this host has no grant context");
+    }
+  }
+  const claimed = await ctx.models.Request.findOneAndUpdate(
+    { requestId, decision: null },
+    { $set: { decision: decision.approve ? "approved" : "denied", decidedAt: /* @__PURE__ */ new Date() } },
+    { returnDocument: "after" }
+  ).exec();
+  if (!claimed) {
+    throw invalidRequest("this authorization request has already been decided");
+  }
+  if (!decision.approve) {
+    ctx.track({
+      type: "oauth.consent_denied",
+      userId: user.id,
+      clientId: request.clientId,
+      scopes: request.scopes
+    });
+    await ctx.audit({
+      type: "oauth.consent_denied",
+      actor: "user",
+      clientId: request.clientId,
+      userId: user.id
+    });
+    return {
+      redirectTo: authorizationResponse(ctx, request.redirectUri, request.state, {
+        error: "access_denied",
+        error_description: "the user denied the request"
+      })
+    };
+  }
+  const now = /* @__PURE__ */ new Date();
+  const existing = await ctx.models.Grant.findOne({
+    clientId: request.clientId,
+    userId: request.userId,
+    contextId,
+    revokedAt: null
+  }).exec();
+  const scopes = [.../* @__PURE__ */ new Set([...existing?.scopes ?? [], ...approvedScopes])];
+  const resources = [.../* @__PURE__ */ new Set([...existing?.resources ?? [], ...request.resources])];
+  const grew = Boolean(existing) && scopes.length > (existing?.scopes.length ?? 0);
+  const grant = await ctx.models.Grant.findOneAndUpdate(
+    { clientId: request.clientId, userId: request.userId, contextId, revokedAt: null },
+    {
+      $set: { scopes, resources, lastUsedAt: now },
+      // Mongo rejects an update that touches one path through two operators,
+      // even when only one of them can apply — and `grew` already implies an
+      // existing document, so the two branches are genuinely exclusive.
+      ...grew ? { $inc: { version: 1 } } : { $setOnInsert: { version: 1 } }
+    },
+    { returnDocument: "after", upsert: true, setDefaultsOnInsert: true }
+  ).exec();
+  const code = randomToken();
+  await ctx.models.Code.create({
+    codeHash: sha256(code),
+    clientId: request.clientId,
+    userId: request.userId,
+    grantId: grant._id,
+    contextId,
+    // What was approved now, not the grant's union: the token issued from this
+    // code answers for this authorization, not for the history of the grant.
+    scopes: approvedScopes,
+    resources: request.resources,
+    redirectUri: request.redirectUri,
+    codeChallenge: request.codeChallenge,
+    codeChallengeMethod: "S256",
+    nonce: request.nonce,
+    authTime: user.authTime,
+    expiresAt: new Date(now.getTime() + ctx.ttl.code * 1e3)
+  });
+  ctx.track({
+    type: "oauth.consent_granted",
+    userId: user.id,
+    clientId: request.clientId,
+    grantId: String(grant._id),
+    ...contextId ? { contextId } : {},
+    scopes: approvedScopes
+  });
+  await ctx.audit({
+    type: "oauth.consent_granted",
+    actor: "user",
+    clientId: request.clientId,
+    userId: user.id,
+    grantId: grant._id,
+    meta: { scopes: approvedScopes, contextId, version: grant.version }
+  });
+  return {
+    redirectTo: authorizationResponse(ctx, request.redirectUri, request.state, { code })
+  };
+}
+var b64u = (value) => Buffer.from(value).toString("base64url");
+var RESERVED_ID_TOKEN_CLAIMS = /* @__PURE__ */ new Set(["iss", "sub", "aud", "exp", "iat", "nonce", "at_hash"]);
+function signJws(key, payload) {
+  const header = { alg: key.alg, typ: "JWT", kid: key.kid };
+  const data = `${b64u(JSON.stringify(header))}.${b64u(JSON.stringify(payload))}`;
+  const signature = sign("sha256", Buffer.from(data), {
+    key: key.privateKey,
+    dsaEncoding: "ieee-p1363"
+  });
+  return `${data}.${signature.toString("base64url")}`;
+}
+function atHash(accessToken) {
+  const digest = createHash("sha256").update(accessToken, "ascii").digest();
+  return digest.subarray(0, digest.length / 2).toString("base64url");
+}
+var publicClient = toPublicClient;
+function storedSubject(client, key) {
+  const map = client.pairwiseSubjects;
+  if (map instanceof Map) return map.get(key);
+  if (map && typeof map === "object") return map[key];
+  return void 0;
+}
+async function subjectFor(ctx, client, userId) {
+  const key = String(userId);
+  if (ctx.subjectMode !== "pairwise") return key;
+  if (!ctx.pairwiseSalt) {
+    throw new Error('oauth-host: subjectMode is "pairwise" but no `pairwiseSalt` is configured');
+  }
+  const existing = storedSubject(client, key);
+  if (existing) return existing;
+  const subject = pairwiseSubject(key, client.clientId, ctx.pairwiseSalt);
+  await ctx.models.Client.updateOne(
+    { clientId: client.clientId, [`pairwiseSubjects.${key}`]: { $exists: false } },
+    { $set: { [`pairwiseSubjects.${key}`]: subject } }
+  );
+  const stored = await ctx.models.Client.findOne(
+    { clientId: client.clientId },
+    { pairwiseSubjects: 1 }
+  );
+  return stored && storedSubject(stored, key) || subject;
+}
+function standardClaims(user, scopes) {
+  const out = {};
+  const granted = new Set(scopes);
+  if (granted.has("profile")) {
+    if (user.displayName) out.name = user.displayName;
+    if (user.avatarUrl) out.picture = user.avatarUrl;
+  }
+  if (granted.has("email") && user.email) out.email = user.email;
+  return out;
+}
+async function hostClaims(ctx, args) {
+  if (!ctx.claims) return {};
+  return await ctx.claims(args.user, {
+    scopes: args.scopes,
+    contextId: args.contextId ?? void 0,
+    client: publicClient(args.client)
+  });
+}
+async function buildIdToken(ctx, keys, args) {
+  const key = await keys.getSigningKey();
+  const now = Date.now();
+  const skew = ctx.clockSkewMs;
+  const payload = {
+    ...standardClaims(args.user, args.scopes),
+    ...await hostClaims(ctx, args)
+  };
+  for (const claim of RESERVED_ID_TOKEN_CLAIMS) delete payload[claim];
+  payload.iss = ctx.issuer;
+  payload.sub = await subjectFor(ctx, args.client, args.user.id);
+  payload.aud = args.client.clientId;
+  payload.iat = Math.floor(now / 1e3);
+  payload.nbf = Math.floor((now - skew) / 1e3);
+  payload.exp = Math.floor((now + ctx.ttl.accessToken * 1e3 + skew) / 1e3);
+  const authTime = args.authTime ?? args.user.authTime;
+  if (authTime) payload.auth_time = Math.floor(authTime.getTime() / 1e3);
+  if (args.nonce) payload.nonce = args.nonce;
+  if (args.accessToken) payload.at_hash = atHash(args.accessToken);
+  return signJws(key, payload);
+}
+async function buildUserInfo(ctx, args) {
+  const claims = {
+    ...standardClaims(args.user, args.scopes),
+    ...await hostClaims(ctx, args)
+  };
+  delete claims.sub;
+  return { sub: await subjectFor(ctx, args.client, args.user.id), ...claims };
+}
+
+// src/server/routes/oauth.ts
+function createOAuthRouter(ctx) {
+  const router = express2.Router();
+  const w = (h) => wrap(ctx.logger, h);
+  const keys = createKeyManager(ctx);
+  const form = express2.urlencoded({ extended: false, limit: "10kb" });
+  const ipKey = (req) => req.ip ?? "unknown";
+  const clientKey = (req) => clientIdFromRequest(req) ?? ipKey(req);
+  const cors = corsMiddleware(ctx);
+  router.get(
+    "/authorize",
+    rateLimit(ctx, "authorize", ipKey),
+    w(async (req, res) => {
+      let validated;
+      try {
+        validated = await validateAuthorizationRequest(ctx, req.query);
+      } catch (err) {
+        if (err instanceof RedirectableAuthError) {
+          return res.redirect(302, err.toRedirect(ctx.issuer));
+        }
+        throw err;
+      }
+      const user = await ctx.resolveUser(req);
+      if (!user) {
+        const to = loginRedirectUrl(ctx, `${ctx.issuer}${req.originalUrl}`);
+        if (!to) {
+          throw new OAuthError(
+            401,
+            "login_required",
+            "No user is signed in and no `loginUrl` is configured to send them to"
+          );
+        }
+        return res.redirect(302, to);
+      }
+      const request = await createAuthorizationRequest(ctx, validated, user);
+      return res.redirect(302, consentRedirectUrl(ctx, request.requestId));
+    })
+  );
+  router.get(
+    "/me/grants",
+    w(async (req, res) => {
+      const user = await requireUser(ctx, req);
+      const limit = Math.min(Math.max(Number(req.query.limit) || 20, 1), 100);
+      const skip = Math.max(Number(req.query.skip) || 0, 0);
+      const grants = await ctx.models.Grant.find({ userId: user.id, revokedAt: null }).sort({ createdAt: -1 }).skip(skip).limit(limit).lean();
+      const clients = await ctx.models.Client.find({ clientId: { $in: grants.map((g) => g.clientId) } }).lean();
+      const byId = new Map(clients.map((c) => [c.clientId, c]));
+      res.json({
+        limit,
+        items: grants.map((g) => ({
+          // The grant id is the ONLY identifier that leaves: the DELETE below
+          // needs it. No user id, no client _id, no token ids.
+          id: String(g._id),
+          client: {
+            clientId: g.clientId,
+            name: byId.get(g.clientId)?.name ?? g.clientId,
+            branding: byId.get(g.clientId)?.branding ?? {}
+          },
+          scopes: g.scopes.map((id) => ctx.scopeIndex.get(id) ?? { id, label: id }),
+          ...g.contextId ? { contextId: g.contextId } : {},
+          createdAt: g.createdAt,
+          lastUsedAt: g.lastUsedAt
+        }))
+      });
+    })
+  );
+  router.post(
+    "/token",
+    cors,
+    form,
+    rateLimit(ctx, "token", clientKey),
+    w(async (req, res) => {
+      res.set("Cache-Control", "no-store");
+      res.set("Pragma", "no-cache");
+      const client = await authenticateClient(ctx, req);
+      const body = req.body ?? {};
+      const grantType = str(body.grant_type);
+      if (grantType === "authorization_code") {
+        const code = await consumeCode(ctx, str(body.code), {
+          clientId: client.clientId,
+          redirectUri: str(body.redirect_uri),
+          codeVerifier: str(body.code_verifier)
+        });
+        const issued = await issueForCode(ctx, code);
+        const idToken = issued.scopes.includes("openid") ? await buildIdToken(ctx, keys, {
+          client,
+          user: await ctx.loadUser(issued.userId),
+          scopes: issued.scopes,
+          contextId: issued.contextId,
+          nonce: code.nonce,
+          authTime: code.authTime,
+          accessToken: issued.accessToken
+        }) : void 0;
+        return res.json(tokenResponse(issued, idToken));
+      }
+      if (grantType === "refresh_token") {
+        const issued = await rotateRefresh(ctx, str(body.refresh_token), {
+          clientId: client.clientId,
+          scope: body.scope === void 0 ? void 0 : str(body.scope),
+          resources: list(body.resource)
+        });
+        const idToken = issued.scopes.includes("openid") ? await buildIdToken(ctx, keys, {
+          client,
+          user: await ctx.loadUser(issued.userId),
+          scopes: issued.scopes,
+          contextId: issued.contextId,
+          accessToken: issued.accessToken
+        }) : void 0;
+        return res.json(tokenResponse(issued, idToken));
+      }
+      throw unsupportedGrantType(
+        `'${grantType}' is not supported. This server issues authorization_code and refresh_token only.`
+      );
+    })
+  );
+  router.post(
+    "/revoke",
+    cors,
+    form,
+    rateLimit(ctx, "token", clientKey),
+    w(async (req, res) => {
+      res.set("Cache-Control", "no-store");
+      const client = await authenticateClient(ctx, req);
+      const body = req.body ?? {};
+      await revokeToken(ctx, str(body.token), client.clientId);
+      res.status(200).json({});
+    })
+  );
+  router.get(
+    "/userinfo",
+    w(async (req, res) => {
+      const raw = /^Bearer +([^\s]+)$/i.exec(req.headers.authorization ?? "")?.[1];
+      if (!raw) throw bearerChallenge("invalid_request", "A bearer access token is required");
+      const token = await introspectAccessToken(ctx, raw);
+      if (!token) throw bearerChallenge("invalid_token", "The access token is expired, revoked or unknown");
+      if (!token.scopes.includes("openid")) {
+        throw new OAuthError(403, "insufficient_scope", "The `openid` scope is required", {
+          headers: { "WWW-Authenticate": 'Bearer error="insufficient_scope", scope="openid"' }
+        });
+      }
+      const client = await ctx.models.Client.findOne({ clientId: token.clientId });
+      if (!client) throw bearerChallenge("invalid_token", "The client this token was issued to no longer exists");
+      res.set("Cache-Control", "no-store");
+      res.json(await buildUserInfo(ctx, {
+        client,
+        user: await ctx.loadUser(token.userId),
+        scopes: token.scopes,
+        contextId: token.contextId
+      }));
+    })
+  );
+  router.get("/jwks", w(async (_req, res) => {
+    res.set("Cache-Control", "public, max-age=300");
+    res.json(await keys.jwks());
+  }));
+  if (ctx.cors.tokenEndpoint) {
+    router.options("/token", cors, (_req, res) => {
+      res.sendStatus(204);
+    });
+    router.options("/revoke", cors, (_req, res) => {
+      res.sendStatus(204);
+    });
+  }
+  router.get(
+    "/consent/:requestId",
+    rateLimit(ctx, "consent", ipKey),
+    w(async (req, res) => {
+      const user = await requireUser(ctx, req);
+      res.json(await getConsentPayload(ctx, pathParam(req, "requestId"), user));
+    })
+  );
+  router.post(
+    "/consent/:requestId",
+    rateLimit(ctx, "consent", ipKey),
+    w(async (req, res) => {
+      const user = await requireUser(ctx, req);
+      const body = req.body ?? {};
+      if (typeof body.approve !== "boolean") {
+        throw invalidRequest("`approve` must be a boolean");
+      }
+      res.json(await decideConsent(ctx, pathParam(req, "requestId"), user, {
+        approve: body.approve,
+        scopes: Array.isArray(body.scopes) ? body.scopes.map(String) : void 0,
+        contextId: body.contextId === void 0 ? void 0 : String(body.contextId)
+      }));
+    })
+  );
+  router.delete(
+    "/me/grants/:id",
+    w(async (req, res) => {
+      const user = await requireUser(ctx, req);
+      const id = pathParam(req, "id");
+      if (!mongoose.Types.ObjectId.isValid(id)) {
+        throw new OAuthError(404, "not_found", "No such grant");
+      }
+      const grant = await ctx.models.Grant.findOneAndUpdate(
+        { _id: id, userId: user.id, revokedAt: null },
+        { $set: { revokedAt: /* @__PURE__ */ new Date(), revokedBy: "user" } }
+      );
+      if (!grant) throw new OAuthError(404, "not_found", "No such grant");
+      const { modifiedCount } = await ctx.models.Token.updateMany(
+        { grantId: grant._id, revokedAt: null },
+        { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+      );
+      ctx.track({ type: "oauth.grant_revoked", userId: user.id, clientId: grant.clientId, grantId: String(grant._id) });
+      void ctx.audit({ type: "oauth.grant_revoked", actor: "user", userId: user.id, clientId: grant.clientId, grantId: grant._id });
+      res.json({ revoked: true, tokensRevoked: modifiedCount ?? 0 });
+    })
+  );
+  return router;
+}
+async function requireUser(ctx, req) {
+  const user = await ctx.resolveUser(req);
+  if (!user) {
+    throw new OAuthError(401, "login_required", "No user is signed in for this request");
+  }
+  return user;
+}
+function bearerChallenge(code, description) {
+  return new OAuthError(401, code, description, {
+    headers: { "WWW-Authenticate": `Bearer error="${code}", error_description="${description}"` }
+  });
+}
+function tokenResponse(issued, idToken) {
+  return {
+    access_token: issued.accessToken,
+    token_type: "Bearer",
+    expires_in: issued.expiresIn,
+    ...issued.refreshToken ? { refresh_token: issued.refreshToken } : {},
+    scope: issued.scopes.join(" "),
+    // Only when `openid` was granted. Minting one unasked hands a client an
+    // identity assertion it never requested consent for.
+    ...idToken ? { id_token: idToken } : {}
+  };
+}
+function pathParam(req, name) {
+  const value = req.params[name];
+  return Array.isArray(value) ? value[0] ?? "" : value ?? "";
+}
+function str(value) {
+  return typeof value === "string" ? value : "";
+}
+function list(value) {
+  if (value === void 0) return void 0;
+  return Array.isArray(value) ? value.map(String) : [String(value)];
+}
+function clientIdFromRequest(req) {
+  const header = req.headers.authorization;
+  if (header?.startsWith("Basic ")) {
+    const decoded = Buffer.from(header.slice(6), "base64").toString("utf8");
+    const id = decoded.split(":")[0];
+    if (id) return decodeURIComponent(id);
+  }
+  const body = req.body ?? {};
+  return typeof body.client_id === "string" ? body.client_id : null;
+}
+function corsMiddleware(ctx) {
+  if (!ctx.cors.tokenEndpoint) return (_req, _res, next) => next();
+  const allowed = new Set(ctx.cors.origins);
+  return (req, res, next) => {
+    const origin = req.headers.origin;
+    if (allowed.size === 0) {
+      res.set("Access-Control-Allow-Origin", "*");
+    } else if (origin && allowed.has(origin)) {
+      res.set("Access-Control-Allow-Origin", origin);
+      res.set("Vary", "Origin");
+    }
+    res.set("Access-Control-Allow-Headers", "Authorization, Content-Type");
+    res.set("Access-Control-Allow-Methods", "POST, OPTIONS");
+    res.set("Access-Control-Max-Age", "600");
+    next();
+  };
+}
+
+// src/server/index.ts
+function createOAuthHost(config) {
+  const ctx = resolveConfig(config);
+  return {
+    routes: {
+      // The discovery document publishes ABSOLUTE endpoint URLs, so it has to be
+      // told where the oauth router lives. A router cannot learn its own mount
+      // until a request arrives, by which time the metadata is already built.
+      discovery: createDiscoveryRouter(ctx, ctx.mountPath),
+      oauth: createOAuthRouter(ctx)
+    },
+    protect: createProtect(ctx),
+    clients: createClientsApi(ctx),
+    grants: createGrantsApi(ctx),
+    users: createUsersApi(ctx),
+    contexts: createContextsApi(ctx),
+    /**
+     * Build every index before the first write.
+     *
+     * Not optional and not lazy: the unique partial index on grants is what
+     * stops one user holding two live grants for the same client, and mongoose
+     * builds indexes in the background — a cold database will happily serve
+     * the write that violates it first. See standards/traps.md #3.
+     */
+    syncIndexes: () => syncModelIndexes(ctx.models),
+    /** Escape hatch. Prefer the APIs above; these carry no invariants. */
+    models: ctx.models
+  };
+}
+
+export { OAuthError, RedirectableAuthError, UnredirectableError, createModels, createOAuthHost, createUserAdapter, defaultResolveUser, syncModelIndexes };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map