@kya-os/mcp 1.6.1 → 1.9.0

package/CHANGELOG.md

@@ -7,6 +7,123 @@ Versioning: https://semver.org/spec/v2.0.0.html
 
 ## [Unreleased]
 
+## [1.9.0] - 2026-07-07
+
+Entity Card (`@kya-os/mcp/card`) — a typed, DID-anchored, per-request
+holder-of-key identity layer that rides existing rails (MCP server-card `_meta`,
+A2A extension, NANDA AgentFacts) instead of a new well-known doc. Additive.
+
+First npm release since 1.7.0 (the prepared 1.8.0 was never published). See the
+BREAKING status-list note below — persisted 1.x status lists MUST be
+regenerated on upgrade.
+
+### Added
+
+- **`./card`** — the `card()` builder, `withKyaOsCard` / `requireProof`
+  middleware, and `buildCard` / `resolveCard` / `verifyCard`. Conformance is
+  recomputed on verify, never self-claimed.
+- **Stateless proof (`org.kya-os/proof@1`)** and a **VC 2.0 / ZCAP-LD**
+  delegation profile with Bitstring Status List v1.0 revocation. Both run
+  alongside the legacy session proof + delegation for all of 1.x; the legacy
+  paths drop at 2.0.
+- **CIMD L1 on-ramp** — `client_id ⇄ did:web`, so an OAuth `private_key_jwt`
+  doubles as a DID-key proof (RFC 9449 `cnf.jkt` sender-constrains it).
+- Conformance vectors + a cross-language verifier folded into the existing
+  `conformance/` harness (new `card-proof` / `entity-card` categories).
+- **Proof crypto agility (`ES256`)** — the per-request proof now accepts an
+  ALLOW-LIST of two signing algorithms, `EdDSA` (Ed25519) and `ES256` (ECDSA
+  P-256, FIPS-eligible via HSM/KMS), never negotiated. `alg` is a signed covered
+  claim and the resolved key type MUST match it (`alg_key_mismatch`), so adding a
+  second curve introduces no algorithm-confusion surface. `es256SignerFromJwk`
+  ships alongside `ed25519SignerFromJwk`; the RFC 9421 sibling carries the
+  matching `ecdsa-p256-sha256` label. (CIMD DID-keyed JWKS extraction stays
+  Ed25519-only for now — a P-256 verifier supplies its own `resolveDidKeys`.)
+- **VC-JWT verification (`./delegation`)** — `DelegationCredentialVerifier.verifyDelegationJwt()`
+  verifies the JWT serialization of a Verifiable Credential (compact JWS, where
+  the envelope signature over `header.payload` IS the proof — no embedded
+  `proof` block), so credentials minted by browser / passkey wallets verify
+  without a hand-rolled path. `algorithms` is pinned to `EdDSA`, and the
+  credential `issuer` must equal the signed `iss`. Additive; the Data Integrity
+  path is unchanged.
+- **Multi-key did:web documents** — `buildDidWebDocument` now accepts
+  `Identity | Identity[]`, emitting one verification method per key under a
+  single controller DID. This is the basis for multi-device identity: a device
+  is added or removed by adding or removing a verification method, and a
+  verifier selects the signing key by `kid`. Backward-compatible — a lone
+  identity yields the same single-method document as before.
+
+### Changed — BREAKING for persisted status lists
+
+- **Status-list bit order corrected to W3C MSB-first.** `BitstringManager`
+  (StatusList2021 / Bitstring Status List) now reads and writes bits
+  most-significant-first (`0x80 >> i`), matching the W3C spec and the Digital
+  Bazaar reference — and the Entity Card revocation reader — so both code paths
+  read an identical `encodedList` to the same verdict. The prior LSB-first order
+  was self-consistent but non-interoperable with any standard tool.
+  - **⚠️ MIGRATION — READ THIS.** A status list generated by a 1.x release is
+    encoded LSB-first. Read by this release it is **misread silently**: a
+    **revoked credential can read as LIVE** (the bit mirrors within its byte, so
+    e.g. revoked index 42 → clear, and phantom index 45 → revoked). The W3C
+    credential carries no bit-order/version field, so old lists **cannot be
+    auto-detected**. You MUST **regenerate every persisted status list** on
+    upgrade; do not read 1.x-encoded lists with this release. (Tracking a
+    KYA-OS-side encoding-version marker + a bit-reverse migration helper as a
+    follow-up so future changes are detectable.)
+- **Fail-closed hardening.** `isIndexSet` / `BitstringManager.getBit` now throw
+  on an out-of-range or `NaN` index (were fail-open), `BitstringManager.decode`
+  caps the inflated bitstring at 16 MiB (decompression-bomb guard), and the card
+  `statusListIndex` must be a canonical decimal (a whitespace/hex value no longer
+  silently reads bit 0). IPv6 NAT64 / 6to4 / Teredo / site-local addresses are
+  now treated as non-public by the SSRF guard.
+
+## [1.7.0] - 2026-06-17
+
+Durable consent persistence. Pluggable `GrantStore` / `PendingFlowStore` /
+`SessionStore` seams so consent, grant, and PKCE state survive restarts and
+resolve across load-balanced instances — the holder-of-key (`getByAgent`)
+no-paste retry, with session-bearer (`getBySession`) as a fallback. The detached
+proof is namespaced under `_meta["org.kya-os/proof"]` and still dual-emitted
+under the legacy bare key (ON for all of 1.x, dropped at 2.0). Additive over
+1.6.x, with one documented behavioral change: a `strict` verifier now ignores
+MCP-reserved foreign `_meta` keys instead of rejecting them.
+
+### Added
+
+- **Durable consent persistence (optional, in-memory defaults — no breaking
+  change).** New pluggable seams so consent / grant / PKCE state survives
+  restarts and resolves across load-balanced instances: `grantStore` (the
+  no-paste retry — holder-of-key `getByAgent` first, then session-bearer
+  `getBySession`), `PendingFlowStore` (durable OAuth/OIDC PKCE state with an
+  atomic `consume()`), and an optional `SessionStore`. The detached proof is now
+  namespaced under `_meta["org.kya-os/proof"]`; the legacy bare `proof` key is
+  still accepted on verify and (by default) still emitted — toggle with
+  `emitLegacyProofKey`. The legacy mirror stays **ON by default for the entire
+  1.x line** (a pre-1.1 reader of bare `_meta.proof` would otherwise silently get
+  no proof; the cost is ~1.5 KB of `_meta`, which is outside the response hash)
+  and will be **dropped at 2.0**.
+
+### Changed
+
+- **BEHAVIORAL — `strict` `metaPolicy` now IGNORES foreign `_meta` keys instead
+  of rejecting them.** Previously a `strict` verifier rejected any `_meta` key
+  other than the proof. Under MCP 2026-07-28 (SEP-414) `_meta` legitimately
+  carries reserved `io.modelcontextprotocol/*` and W3C trace-context keys
+  (`traceparent`/`tracestate`/`baggage`), so `strict` now ignores every
+  non-KYA-OS key (never hashed, trusted, or rejected) and `allow-extensions`
+  additionally surfaces them. The zero-trust boundary is unchanged — only the
+  KYA-OS proof key is ever hashed or trusted. **Migration:** anyone relying on
+  `strict` to REJECT foreign `_meta` keys must now enforce that themselves; the
+  verifier no longer fails on them.
+
+### Fixed
+
+- **Appendix A error codes corrected** to match `src/errors.ts`, the single
+  source of truth. The table listed prefixed codes (`KYA_OS_EHANDSHAKE`,
+  `KYA_OS_EPROOF`, ...) that no part of the codebase emits; the runtime,
+  middleware, and session manager all return bare snake_case codes
+  (`handshake_failed`, `invalid_proof`, ...). Documentation only — no behaviour
+  change.
+
 ## [1.6.1] - 2026-06-10
 
 Releases the schema-host migration already merged on `main` (it was unshipped:

package/README.md

@@ -108,6 +108,44 @@ When an agent calls `checkout` without a delegation credential, it gets back a `
 
 ---
 
+## Typed, DID-anchored identity: the Entity Card
+
+Proofs answer *what an agent did*. The **Entity Card** answers *who is calling* — a typed, DID-anchored identity (`agent`, `mcp`, `client`, `verifier`, `human`) an entity publishes once and every discovery rail can index. It is claim-minimal: it asserts only identity, type, declared capabilities, and accountability locators. The trust **level** (L1/L2/L3) is never self-claimed — a verifier RECOMPUTES it from evidence. Three ergonomic calls, imported from the published `@kya-os/mcp/card` subpath:
+
+```typescript
+import { card, withKyaOsCard, requireProof, InMemoryNonceCache } from '@kya-os/mcp/card';
+
+// 1. BUILD — describe the agent, fluently. No conformanceLevel: a verifier derives it.
+const myCard = card({ did: 'did:web:acme.example:agents:pay', entityType: 'agent', name: 'Acme Pay' })
+  .capability('search')                                  // L1: bare-string, self-declared
+  .attestedCapability('payments.transfer', capabilityVc) // L2: VC-backed
+  .accountableTo('did:web:acme.example:org', { via: 'vc_root>del_123' })
+  .usesProof()
+  .build();
+
+// 2. EMIT — mount the three discovery artifacts (card.json, DID service entry, server.json _meta).
+const mount = withKyaOsCard(myCard);
+const serverJson = mount.mountServerJson({ name: 'acme-mcp', version: '1.0.0' });
+
+// 3. GUARD — verify a per-request holder-of-key proof, fail-closed.
+const nonces = new InMemoryNonceCache();     // ATOMIC replay defense — never hand-roll this seam
+const guard = requireProof({
+  resolveKey,                                // resolve the signing key from its kid (DID document)
+  expectedAudience: 'did:web:acme.example:mcp:server',
+  consumeNonceIfFresh: nonces.consume,       // test-AND-set; a replayed nonce is rejected
+});
+
+// Pass the EXACT body the client signed (without _meta) plus the _meta that carried the proof.
+const { _meta, ...signedBody } = incomingRequest;
+const verdict = await guard(signedBody, _meta); // { ok: true, did, level } or a 401-shaped reject
+```
+
+Miss the proof, replay a nonce, or tamper the body and `requireProof` fails closed. To go the other direction — DISCOVER and verify another entity's card — use `resolveCard` + `verifyCard` (the verifier recomputes the conformance floor rather than trusting the card).
+
+> Run the full 10-minute path end-to-end: [examples/entity-card](./examples/entity-card/) — `npm run example:entity-card:server` (build → emit → guard, with a valid proof accepted and a replay + tamper rejected) and `npm run example:entity-card` (the discover → resolve → verify walkthrough). See [SPEC-ENTITY-CARD.md](./SPEC-ENTITY-CARD.md) for normative detail.
+
+---
+
 ## See it in action
 
 ```bash
@@ -125,7 +163,7 @@ This starts all example servers and opens [MCP Inspector](https://github.com/mod
 | 3003 | [consent-full](./examples/consent-full/) | Production consent UI ([@kya-os/consent](https://www.npmjs.com/package/@kya-os/consent)) |
 | 3004 | [context7-with-kya-os](./examples/context7-with-kya-os/) | 2-line migration of a real MCP server |
 
-Also available: [outbound-delegation](./examples/outbound-delegation/) (gateway pattern), [verify-proof](./examples/verify-proof/) (standalone verification), [statuslist](./examples/statuslist/) (revocation lifecycle).
+Also available: [outbound-delegation](./examples/outbound-delegation/) (gateway pattern), [verify-proof](./examples/verify-proof/) (standalone verification), [statuslist](./examples/statuslist/) (revocation lifecycle), [cheqd-dlr](./examples/cheqd-dlr/) (operator DID linkage + DLR publishing).
 
 ---
 
@@ -133,18 +171,205 @@ Also available: [outbound-delegation](./examples/outbound-delegation/) (gateway
 
 | Capability | How it works |
 |-----------|-------------|
-| **Cryptographic identity** | Ed25519 key pairs, `did:key` and `did:web` resolution |
+| **Cryptographic identity** | Ed25519 (EdDSA) and P-256 (ES256, FIPS-eligible) key pairs, `did:key` / `did:web` resolution, optional `did:cheqd` resolver support |
+| **Entity Card** | Typed, DID-anchored identity: fluent `card()` builder, `withKyaOsCard` discovery projections, `requireProof` per-request holder-of-key guard |
 | **Signed proofs** | Detached JWS over JCS-canonicalized request/response hashes |
 | **Delegation credentials** | W3C Verifiable Credentials with scope constraints, rooted at a Responsible Party |
 | **Revocation** | StatusList2021 bitstring with cascading revocation |
 | **Replay prevention** | Nonce-based handshake with timestamp skew validation |
 | **Extensible** | Bring your own KMS, HSM, nonce cache (Redis, DynamoDB, KV), or DID method |
 
+### Multi-instance deployments
+
+The in-memory defaults are **single-process only**. For a load-balanced /
+multi-instance deployment, inject a durable Redis / Durable Object / DB-backed
+implementation for **every** runtime-state seam — the nonce cache
+(`NonceCacheProvider`) together with the consent stores (`GrantStore`,
+`PendingFlowStore`, `SessionStore`) — so replay protection, grants, pending OAuth
+flows, and sessions are shared across instances and survive restarts.
+
 ---
 
+## Optional did:cheqd and DID-Linked Resources
+
+`did:cheqd` support is additive and opt-in. Existing `did:key` and `did:web`
+flows remain unchanged, and operators can keep `did:web` as their canonical
+identifier while linking to a cheqd DID over time.
+
+### Resolver configuration
+
+```typescript
+import { RuntimeFetchProvider, withKyaOs, NodeCryptoProvider } from '@kya-os/mcp';
+import { cheqdResolver } from '@kya-os/mcp/cheqd';
+
+const crypto = new NodeCryptoProvider();
+const fetchProvider = new RuntimeFetchProvider();
+const didResolvers = {
+  cheqd: cheqdResolver({ resolverUrl: 'https://resolver.cheqd.net' }),
+};
+
+await withKyaOs(server, {
+  crypto,
+  delegation: {
+    fetchProvider,
+    didResolvers,
+  },
+});
+```
+
+`did:cheqd` is resolved only when a resolver for the `cheqd` DID method is
+explicitly supplied. The core middleware and fetch provider use the generic
+`didResolvers` registry; cheqd-specific URL/cache/header options live in the
+`cheqdResolver()` factory from `@kya-os/mcp/cheqd`.
+`RuntimeFetchProvider` accepts the same registry when it is used directly by a
+standalone verifier or operator script.
+Unsupported methods, malformed DIDs, fetch failures, invalid JSON, malformed DID
+Documents, and DID id mismatches fail closed by returning `null`. The resolver
+accepts both raw DID Documents and Universal Resolver-style DID Resolution
+Results (`{ didDocument: ... }`).
+
+### Registrar writes
+
+Registrar writes are explicit operator/admin actions. The package exposes
+`CheqdDidRegistrarClient` for cheqd DID Registrar `/create`, `/update`, and
+`/{did}/create-resource` flows, using cheqd's client-managed-secret pattern:
+the registrar returns a serialized payload, your signer signs it, and the
+signature is submitted back. Private keys are not sent to the registrar.
+
+```typescript
+import {
+  CheqdDidRegistrarClient,
+  createLocalEd25519CheqdRegistrarSigner,
+} from '@kya-os/mcp/cheqd';
+import {
+  NodeCryptoProvider,
+} from '@kya-os/mcp';
+
+const crypto = new NodeCryptoProvider();
+const registrar = new CheqdDidRegistrarClient({
+  registrarUrl: 'https://did-registrar-staging.cheqd.net/1.0',
+  fetchProvider,
+  // Optional static or async auth headers for private registrar deployments.
+  // headers: async () => ({ Authorization: `Bearer ${token}` }),
+});
+
+const signer = createLocalEd25519CheqdRegistrarSigner({
+  cryptoProvider: crypto,
+  privateKey: process.env.CHEQD_DID_PRIVATE_KEY_BASE64!,
+  verificationMethodId: 'did:cheqd:testnet:...#key-1',
+  signatureEncoding: 'base64url',
+});
+```
+
+For mainnet, run or contract against your own fee-payer registrar deployment and
+provide the signer hook from your KMS/HSM boundary. The local Ed25519 helper is
+for simple controlled deployments and tests; it still signs locally and sends
+only signatures to the registrar.
+
+Runtime proof generation does not perform registrar writes. Create/update/DLR
+publishing should be triggered by an explicit operator workflow, deployment
+step, or admin tool.
+
+### DID linkage
+
+For `did:web` <-> `did:cheqd` binding, publish reciprocal `alsoKnownAs` values
+and verify both DID Documents with `verifyDidLinkage()`. `buildDidWebDocument`
+can include the `did:cheqd` reference on the `did:web` side, while
+`updateCheqdAlsoKnownAs()` updates the cheqd side through the registrar.
+
+```typescript
+import { verifyDidLinkage } from '@kya-os/mcp';
+import { updateCheqdAlsoKnownAs } from '@kya-os/mcp/cheqd';
+
+await updateCheqdAlsoKnownAs({
+  didWeb: 'did:web:agent.example.com',
+  didCheqd: 'did:cheqd:testnet:...',
+  resolver: cheqdResolver,
+  registrar,
+  signer,
+  verificationMethodId: 'did:cheqd:testnet:...#key-1',
+});
+
+const linkage = verifyDidLinkage({
+  primaryDid: 'did:web:agent.example.com',
+  secondaryDid: 'did:cheqd:testnet:...',
+  primaryDidDocument: didWebDocument,
+  secondaryDidDocument: didCheqdDocument,
+});
+```
+
+### DID-Linked Resource helpers
+
+DID-Linked Resource helpers are intended for durable manifests only. Supported
+artifact types are:
+
+- `CapabilityManifest`
+- `ConformanceManifest`
+- `AccessHashManifest`
+- `TrustConfigManifest`
+
+`prepareCheqdDlrResource()` validates the artifact, canonicalizes its `content`
+with JSON Canonicalization Scheme, computes or validates a `sha256:<64 hex>`
+content hash, and returns a registrar resource body. Updates are modeled as new
+resource versions under the same resource `name` and `type`; prior resources are
+not overwritten. Do not write high-volume tool calls, raw operational logs, or
+normal runtime proof events to cheqd; keep those in your normal audit/hash
+stores.
+
+```typescript
+import { prepareCheqdDlrResource } from '@kya-os/mcp/cheqd';
+
+const prepared = await prepareCheqdDlrResource({
+  type: 'TrustConfigManifest',
+  subjectDid: 'did:cheqd:testnet:...',
+  name: 'agent-trust-config',
+  resourceType: 'TrustConfigManifest',
+  version: '2026-06-01',
+  content: {
+    acceptedDidMethods: ['did:web', 'did:key', 'did:cheqd'],
+    requiredLinkage: { type: 'alsoKnownAs', bidirectional: true },
+  },
+}, crypto);
+
+await registrar.createResource({
+  did: 'did:cheqd:testnet:...',
+  resource: prepared.resource,
+  signer,
+  verificationMethodId: 'did:cheqd:testnet:...#key-1',
+});
+```
+
+See [examples/cheqd-dlr](./examples/cheqd-dlr/) for a complete operator flow.
+
+### Live cheqd registrar E2E tests
+
+Live registrar coverage is opt-in because it performs real writes to cheqd
+testnet. The default endpoint is the cheqd-published testnet staging registrar;
+override it only with another testnet registrar. The live test creates a testnet
+DID, adds a realistic `did:web` alias via `alsoKnownAs`, then publishes one
+resource for each supported KYA DLR artifact type.
+
+```powershell
+$env:KYA_OS_CHEQD_E2E = '1'
+npm run test:e2e:cheqd:testnet
+Remove-Item Env:\KYA_OS_CHEQD_E2E
+```
+
+Optional environment variables:
+
+| Variable | Default |
+| --- | --- |
+| `KYA_OS_CHEQD_TESTNET_REGISTRAR_URL` | `https://did-registrar-staging.cheqd.net/1.0` |
+| `KYA_OS_CHEQD_TESTNET_RESOLVER_URL` | `https://resolver.cheqd.net` |
+| `KYA_OS_CHEQD_E2E_TIMEOUT_MS` | `180000` |
+
+Out of scope for this package: replacing `did:web` as the canonical identity,
+writing runtime proof events on-chain, KYC/KYB issuance, reputation VC snapshot
+publication, status-list backend hosting, and external registry changes.
+
 ## Links
 
-- [Spec](./SPEC.md) | [Changelog](./CHANGELOG.md) | [DIF TAAWG](https://identity.foundation/working-groups/agent-and-authorization.html) | [npm](https://www.npmjs.com/package/@kya-os/mcp)
+- [Spec](./SPEC.md) | [Card Profile](./SPEC-ENTITY-CARD.md) | [Changelog](./CHANGELOG.md) | [DIF TAAWG](https://identity.foundation/working-groups/agent-and-authorization.html) | [npm](https://www.npmjs.com/package/@kya-os/mcp)
 - [CONTRIBUTING.md](./CONTRIBUTING.md) | [CONFORMANCE.md](./CONFORMANCE.md) | [SECURITY.md](./SECURITY.md) | [GOVERNANCE.md](./GOVERNANCE.md)
 
 ## License

package/dist/authz/index.d.ts

@@ -14,6 +14,7 @@ export { buildAuthorizeUrl, type AuthorizeUrlParams } from './oidc/authorize.js'
 export { buildAuthorizationServerMetadata, buildProtectedResourceMetadata, type AuthorizationServerMetadata, type AuthorizationServerMetadataInput, type ProtectedResourceMetadata, type ProtectedResourceMetadataInput, } from './oidc/metadata.js';
 export { isS256ChallengeMethod, computeS256Challenge, verifyS256Challenge, type S256, } from './oidc/pkce.js';
 export { GenericOidcAdapter, type GenericOidcAdapterConfig, type FetchImpl, } from './oidc/oidc-adapter.js';
+export { PendingFlowStore, MemoryPendingFlowStore, type PendingFlow, type MemoryPendingFlowStoreOptions, } from './oidc/pending-flow-store.js';
 export { AuthorizationServerRegistry } from './registry.js';
 export { projectAccountability, accountabilityToPolicyPrincipal, type AccountabilityContext, } from './accountability.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/authz/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,GACpC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,IAAI,GACV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,SAAS,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,GACpC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,IAAI,GACV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,SAAS,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,6BAA6B,GACnC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC"}

package/dist/authz/index.js

@@ -14,6 +14,7 @@ export { buildAuthorizeUrl } from './oidc/authorize.js';
 export { buildAuthorizationServerMetadata, buildProtectedResourceMetadata, } from './oidc/metadata.js';
 export { isS256ChallengeMethod, computeS256Challenge, verifyS256Challenge, } from './oidc/pkce.js';
 export { GenericOidcAdapter, } from './oidc/oidc-adapter.js';
+export { PendingFlowStore, MemoryPendingFlowStore, } from './oidc/pending-flow-store.js';
 export { AuthorizationServerRegistry } from './registry.js';
 export { projectAccountability, accountabilityToPolicyPrincipal, } from './accountability.js';
 //# sourceMappingURL=index.js.map

package/dist/authz/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,GAGrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,GAG1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EACL,gCAAgC,EAChC,8BAA8B,GAK/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,GAGnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,GAGrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,GAG1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EACL,gCAAgC,EAChC,8BAA8B,GAK/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,GAGnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAGvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC"}

package/dist/authz/oidc/oidc-adapter.d.ts

@@ -2,6 +2,7 @@ import { type NeedsAuthorizationError } from '../../types/protocol.js';
 import type { VerifyDelegationResult } from '../../auth/types.js';
 import type { AuthorizationServerAdapter, FlowParams } from '../adapter.js';
 import type { ToolProtection } from '../requirement.js';
+import { type PendingFlowStore } from './pending-flow-store.js';
 /** A minimal fetch signature — the injectable seam for IdP HTTP calls. */
 export type FetchImpl = (url: string, init?: {
     method?: string;
@@ -22,6 +23,13 @@ export interface GenericOidcAdapterConfig {
     resumeTokenTtlMs?: number;
     /** Injected fetch seam; defaults to the runtime global fetch. */
     fetchImpl?: FetchImpl;
+    /**
+     * Pluggable store for in-flight PKCE state. Defaults to an in-memory store
+     * (single-process only). Inject a durable {@link PendingFlowStore} (Redis /
+     * Durable Object / DB) so an authorization callback that lands on another
+     * instance — or after a restart — can still complete the token exchange.
+     */
+    pendingFlowStore?: PendingFlowStore;
 }
 /**
  * Reference generic-OIDC authorization-server adapter.
@@ -40,13 +48,13 @@ export interface GenericOidcAdapterConfig {
 export declare class GenericOidcAdapter implements AuthorizationServerAdapter {
     private readonly config;
     readonly type: "oauth";
-    private readonly pending;
+    private readonly pendingFlowStore;
     private readonly fetchImpl;
     constructor(config: GenericOidcAdapterConfig);
     isRequired(protection: ToolProtection): boolean;
     initiateFlow(params: FlowParams): Promise<NeedsAuthorizationError>;
     verifyAuthorization(flowState: string, result: unknown): Promise<VerifyDelegationResult>;
     /** Test/inspection seam: the pending code verifier for a resume token, if any. */
-    pendingVerifierFor(resumeToken: string): string | undefined;
+    pendingVerifierFor(resumeToken: string): Promise<string | undefined>;
 }
 //# sourceMappingURL=oidc-adapter.d.ts.map

package/dist/authz/oidc/oidc-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-adapter.d.ts","sourceRoot":"","sources":["../../../src/authz/oidc/oidc-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACxE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAUD;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,0BAA0B;IAKvD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAET,MAAM,EAAE,wBAAwB;IAI7D,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO;IAIzC,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsClE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAqD9F,kFAAkF;IAClF,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG5D"}
+{"version":3,"file":"oidc-adapter.d.ts","sourceRoot":"","sources":["../../../src/authz/oidc/oidc-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACxE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAKD;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,0BAA0B;IAKvD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAET,MAAM,EAAE,wBAAwB;IAK7D,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO;IAIzC,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA2ClE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwD9F,kFAAkF;IAC5E,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAG3E"}

package/dist/authz/oidc/oidc-adapter.js

@@ -3,6 +3,9 @@ import { createNeedsAuthorizationError, } from '../../types/protocol.js';
 import { requirementMatchesAdapter } from '../adapter.js';
 import { buildAuthorizeUrl } from './authorize.js';
 import { computeS256Challenge } from './pkce.js';
+import { MemoryPendingFlowStore, } from './pending-flow-store.js';
+/** Default resume-token / pending-flow lifetime (10 minutes). */
+const DEFAULT_RESUME_TOKEN_TTL_MS = 600_000;
 /**
  * Reference generic-OIDC authorization-server adapter.
  *
@@ -20,11 +23,12 @@ import { computeS256Challenge } from './pkce.js';
 export class GenericOidcAdapter {
     config;
     type = 'oauth';
-    pending = new Map();
+    pendingFlowStore;
     fetchImpl;
     constructor(config) {
         this.config = config;
         this.fetchImpl = config.fetchImpl ?? ((url, init) => fetch(url, init));
+        this.pendingFlowStore = config.pendingFlowStore ?? new MemoryPendingFlowStore();
     }
     isRequired(protection) {
         return requirementMatchesAdapter(this.type, protection);
@@ -37,13 +41,14 @@ export class GenericOidcAdapter {
         const codeVerifier = randomToken(32);
         const codeChallenge = await computeS256Challenge(codeVerifier);
         const resumeToken = randomToken(24);
-        this.pending.set(resumeToken, {
+        const ttlMs = this.config.resumeTokenTtlMs ?? DEFAULT_RESUME_TOKEN_TTL_MS;
+        await this.pendingFlowStore.put(resumeToken, {
             agentDid: params.agentDid,
             scopes,
             state: params.state,
             codeVerifier,
             redirectUri: params.redirectUri,
-        });
+        }, ttlMs);
         const authorizationUrl = buildAuthorizeUrl({
             authorizationEndpoint: this.config.authorizationEndpoint,
             clientId: this.config.clientId,
@@ -57,12 +62,17 @@ export class GenericOidcAdapter {
             message: `Authorization required for "${params.protection.toolName}".`,
             authorizationUrl,
             resumeToken,
-            expiresAt: nowMs() + (this.config.resumeTokenTtlMs ?? 600_000),
+            expiresAt: nowMs() + ttlMs,
             scopes,
         });
     }
     async verifyAuthorization(flowState, result) {
-        const pending = this.pending.get(flowState);
+        // Atomically consume the pending flow up front: one-time use, so two
+        // concurrent callbacks for the same resume token can't both reach the token
+        // exchange (closes the replay window). The trade-off is that a transient IdP
+        // failure burns the token and the user re-initiates — acceptable, and the
+        // authorization code is itself one-time-use at the IdP.
+        const pending = await this.pendingFlowStore.consume(flowState);
         if (!pending) {
             return { valid: false, reason: 'unknown or expired resume token' };
         }
@@ -99,8 +109,7 @@ export class GenericOidcAdapter {
         catch (error) {
             return { valid: false, reason: `token exchange failed: ${error.message}` };
         }
-        // One-time use: a resume token is consumed on verification.
-        this.pending.delete(flowState);
+        // The flow was already atomically consumed above (one-time use).
         const grantedScopes = token.scope ? token.scope.split(' ') : pending.scopes;
         return {
             valid: true,
@@ -113,8 +122,8 @@ export class GenericOidcAdapter {
         };
     }
     /** Test/inspection seam: the pending code verifier for a resume token, if any. */
-    pendingVerifierFor(resumeToken) {
-        return this.pending.get(resumeToken)?.codeVerifier;
+    async pendingVerifierFor(resumeToken) {
+        return (await this.pendingFlowStore.get(resumeToken))?.codeVerifier;
     }
 }
 function randomToken(byteLength) {

package/dist/authz/oidc/oidc-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-adapter.js","sourceRoot":"","sources":["../../../src/authz/oidc/oidc-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,6BAA6B,GAE9B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAiCjD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAKA;IAJpB,IAAI,GAAG,OAAgB,CAAC;IAChB,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzC,SAAS,CAAY;IAEtC,YAA6B,MAAgC;QAAhC,WAAM,GAAN,MAAM,CAA0B;QAC3D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,UAAU,CAAC,UAA0B;QACnC,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAkB;QACnC,MAAM,cAAc,GAClB,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;YAC5C,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAEpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;YAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;YACzC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;YACxD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa;YACb,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,6BAA6B,CAAC;YACnC,OAAO,EAAE,+BAA+B,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAI;YACtE,gBAAgB;YAChB,WAAW;YACX,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,MAAe;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAsC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAElF,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC/D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChF,CAAC;YACD,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA2B,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE/B,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE;gBACV,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,aAAa;gBACrB,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE;aAC3D;SACF,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,kBAAkB,CAAC,WAAmB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACrD,CAAC;CACF;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC"}
+{"version":3,"file":"oidc-adapter.js","sourceRoot":"","sources":["../../../src/authz/oidc/oidc-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,6BAA6B,GAE9B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AA+BjC,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,OAAO,CAAC;AAE5C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAKA;IAJpB,IAAI,GAAG,OAAgB,CAAC;IAChB,gBAAgB,CAAmB;IACnC,SAAS,CAAY;IAEtC,YAA6B,MAAgC;QAAhC,WAAM,GAAN,MAAM,CAA0B;QAC3D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,sBAAsB,EAAE,CAAC;IAClF,CAAC;IAED,UAAU,CAAC,UAA0B;QACnC,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAkB;QACnC,MAAM,cAAc,GAClB,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;YAC5C,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,2BAA2B,CAAC;QAE1E,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,WAAW,EACX;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,KAAK,CACN,CAAC;QAEF,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;YACzC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;YACxD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa;YACb,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,6BAA6B,CAAC;YACnC,OAAO,EAAE,+BAA+B,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAI;YACtE,gBAAgB;YAChB,WAAW;YACX,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK;YAC1B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,MAAe;QAC1D,qEAAqE;QACrE,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAsC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAElF,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC/D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChF,CAAC;YACD,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA2B,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,iEAAiE;QACjE,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE;gBACV,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,aAAa;gBACrB,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE;aAC3D;SACF,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,kBAAkB,CAAC,WAAmB;QAC1C,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC;IACtE,CAAC;CACF;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC"}

package/dist/authz/oidc/pending-flow-store.d.ts

@@ -0,0 +1,80 @@
+/**
+ * PendingFlowStore — the provider seam for in-flight OAuth/OIDC PKCE state.
+ *
+ * Between {@link GenericOidcAdapter.initiateFlow} (which mints a resume token and
+ * the PKCE `codeVerifier`) and the authorization callback (which exchanges the
+ * code), the verifier must be held server-side keyed by the resume token — it is
+ * never placed on the wire. Holding it in a per-process `Map` breaks the moment a
+ * second instance or a restart enters the picture: if the callback lands on
+ * another instance the verifier is gone, the token exchange fails closed, and no
+ * grant is ever minted.
+ *
+ * This seam mirrors {@link GrantStore} / `NonceCacheProvider`: the in-memory
+ * implementation here is the dev/reference impl; production injects a Redis /
+ * Durable Object / database-backed store behind the same interface so
+ * `initiateFlow` on instance A and the callback on instance B share one verifier.
+ *
+ * `get` (non-consuming read) and `delete` (consume) are kept separate so the
+ * adapter can preserve its one-time-use ordering: it reads the pending flow,
+ * validates `state`, performs the token exchange, and deletes ONLY after the
+ * exchange succeeds — so a transient IdP error does not burn the resume token.
+ *
+ * Production note: a durable backing SHOULD make `delete`-after-exchange atomic
+ * (e.g. Redis `GETDEL`, or a compare-and-set) to close the one-time-use replay
+ * window across instances.
+ */
+/** In-flight authorization state held between initiateFlow and the callback. */
+export interface PendingFlow {
+    agentDid: string;
+    scopes: string[];
+    state: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+/**
+ * Store for pending (awaiting-callback) OAuth/OIDC PKCE flows. Implementations
+ * persist a flow under a resume token with a TTL, read it back (non-consuming),
+ * consume it after a successful exchange, and sweep expired entries.
+ */
+export declare abstract class PendingFlowStore {
+    /** Persist (or replace) a pending flow under `token`, expiring after `ttlMs`. */
+    abstract put(token: string, flow: PendingFlow, ttlMs: number): Promise<void>;
+    /** Read the pending flow without consuming it (e.g. inspection). */
+    abstract get(token: string): Promise<PendingFlow | undefined>;
+    /**
+     * Atomically read AND remove the pending flow — the one-time-use gate for the
+     * token exchange. Returns the flow if it existed and was not expired, else
+     * undefined; either way the token is gone afterward, so two concurrent
+     * callbacks for the same token can never both proceed (closes the replay
+     * window). Durable backings (Redis / Durable Object / DB) MUST implement this
+     * atomically (e.g. Redis `GETDEL`, or a compare-and-set) — a non-atomic
+     * read-then-delete reopens the window across instances.
+     */
+    abstract consume(token: string): Promise<PendingFlow | undefined>;
+    /** Remove a pending flow without reading it. */
+    abstract delete(token: string): Promise<void>;
+    /** Drop expired entries. */
+    abstract cleanup(): Promise<void>;
+}
+export interface MemoryPendingFlowStoreOptions {
+    /** Clock injection for tests; defaults to Date.now. */
+    now?: () => number;
+}
+/**
+ * In-memory {@link PendingFlowStore} — the dev/reference implementation.
+ *
+ * NOT for production: pending flows are lost on restart and are invisible to a
+ * sibling instance, so a callback that lands elsewhere cannot complete. Inject a
+ * Redis / Durable Object / database-backed store for multi-instance deployments.
+ */
+export declare class MemoryPendingFlowStore extends PendingFlowStore {
+    private readonly pending;
+    private readonly now;
+    constructor(options?: MemoryPendingFlowStoreOptions);
+    put(token: string, flow: PendingFlow, ttlMs: number): Promise<void>;
+    get(token: string): Promise<PendingFlow | undefined>;
+    consume(token: string): Promise<PendingFlow | undefined>;
+    delete(token: string): Promise<void>;
+    cleanup(): Promise<void>;
+}
+//# sourceMappingURL=pending-flow-store.d.ts.map