@noodleseed/one 0.61.0 → 0.63.0

package/node_modules/@noodle-borg/service/dist/oauth/device-flow.js

@@ -0,0 +1,239 @@
+import { randomBytes } from 'node:crypto';
+import { renderOAuthPage } from './branding.js';
+import { hashToken, randomToken } from './tokens.js';
+export const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEVICE_TTL_SECONDS = 600;
+const DEVICE_POLL_INTERVAL_SECONDS = 5;
+/** RFC 8628 endpoints, backed by the existing authorization-code consent path in the browser. */
+export class DeviceAuthorizationFlow {
+    #issuer;
+    #store;
+    #provider;
+    #nowSeconds;
+    constructor(input) {
+        this.#issuer = input.issuer.replace(/\/+$/, '');
+        this.#store = input.store;
+        this.#provider = input.provider;
+        this.#nowSeconds = input.now ?? (() => Math.floor(Date.now() / 1000));
+    }
+    async handleAuthorization(req, res) {
+        const body = formBody(req);
+        const clientId = stringField(body, 'client_id');
+        const resource = stringField(body, 'resource');
+        const scope = optionalStringField(body, 'scope');
+        if (clientId === undefined || resource === undefined || !this.#validResource(resource)) {
+            sendOAuthError(res, 'invalid_request');
+            return;
+        }
+        const client = await this.#store.getClient(clientId);
+        const callback = this.#callbackUrl();
+        if (client === undefined ||
+            client.token_endpoint_auth_method !== 'none' ||
+            !client.grant_types?.includes(DEVICE_GRANT) ||
+            !client.redirect_uris.includes(callback)) {
+            sendOAuthError(res, 'invalid_client', 401);
+            return;
+        }
+        const rawDeviceCode = randomToken();
+        const rawUserCode = userCode();
+        const now = this.#nowSeconds();
+        await this.#store.createDeviceAuthorization({
+            deviceCode: hashToken(rawDeviceCode),
+            userCode: hashToken(normalizeUserCode(rawUserCode)),
+            clientId,
+            resource: normalizeUrl(resource),
+            ...(scope !== undefined ? { scope } : {}),
+            status: 'pending',
+            expiresAt: now + DEVICE_TTL_SECONDS,
+            nextPollAt: now,
+            intervalSeconds: DEVICE_POLL_INTERVAL_SECONDS,
+        });
+        const verificationUri = `${this.#issuer}/device`;
+        const complete = new URL(verificationUri);
+        complete.searchParams.set('user_code', rawUserCode);
+        res.setHeader('cache-control', 'no-store');
+        res.json({
+            device_code: rawDeviceCode,
+            user_code: rawUserCode,
+            verification_uri: verificationUri,
+            verification_uri_complete: complete.href,
+            expires_in: DEVICE_TTL_SECONDS,
+            interval: DEVICE_POLL_INTERVAL_SECONDS,
+        });
+    }
+    handleVerificationPage(req, res) {
+        const code = typeof req.query.user_code === 'string' ? req.query.user_code : '';
+        res.status(200).type('html').send(renderDeviceCodePage(code));
+    }
+    async handleVerification(req, res) {
+        const rawUserCode = stringField(formBody(req), 'user_code');
+        const normalized = rawUserCode === undefined ? undefined : normalizeUserCode(rawUserCode);
+        const device = normalized === undefined
+            ? undefined
+            : await this.#store.getDeviceAuthorizationByUserCode(hashToken(normalized));
+        if (device === undefined) {
+            res
+                .status(400)
+                .type('html')
+                .send(renderDeviceCodePage(rawUserCode ?? '', true));
+            return;
+        }
+        const rawState = randomToken();
+        const challenge = randomToken();
+        await this.#store.createDeviceBrowserSession({
+            state: hashToken(rawState),
+            deviceCode: device.deviceCode,
+            clientId: device.clientId,
+            resource: device.resource,
+            codeChallenge: challenge,
+            expiresAt: device.expiresAt,
+        });
+        const authorize = new URL(`${this.#issuer}/authorize`);
+        authorize.searchParams.set('client_id', device.clientId);
+        authorize.searchParams.set('redirect_uri', this.#callbackUrl());
+        authorize.searchParams.set('response_type', 'code');
+        authorize.searchParams.set('code_challenge', challenge);
+        authorize.searchParams.set('code_challenge_method', 'S256');
+        authorize.searchParams.set('state', rawState);
+        authorize.searchParams.set('resource', device.resource);
+        if (device.scope !== undefined)
+            authorize.searchParams.set('scope', device.scope);
+        res.redirect(302, authorize.href);
+    }
+    async handleCallback(req, res) {
+        const rawState = typeof req.query.state === 'string' ? req.query.state : undefined;
+        const session = rawState === undefined
+            ? undefined
+            : await this.#store.consumeDeviceBrowserSession(hashToken(rawState));
+        if (session === undefined) {
+            res.status(400).type('html').send(renderCompletionPage(false));
+            return;
+        }
+        if (typeof req.query.error === 'string') {
+            await this.#store.denyDeviceAuthorization(session.deviceCode);
+            res.status(200).type('html').send(renderCompletionPage(false));
+            return;
+        }
+        const code = typeof req.query.code === 'string' ? req.query.code : undefined;
+        const approved = code !== undefined && (await this.#provider.completeDeviceAuthorization(session, code));
+        res
+            .status(approved ? 200 : 400)
+            .type('html')
+            .send(renderCompletionPage(approved));
+    }
+    async handleToken(req, res) {
+        const body = formBody(req);
+        const clientId = stringField(body, 'client_id');
+        const rawDeviceCode = stringField(body, 'device_code');
+        const resource = optionalStringField(body, 'resource');
+        if (clientId === undefined || rawDeviceCode === undefined) {
+            sendOAuthError(res, 'invalid_request');
+            return;
+        }
+        const client = await this.#store.getClient(clientId);
+        if (client === undefined ||
+            client.token_endpoint_auth_method !== 'none' ||
+            !client.grant_types?.includes(DEVICE_GRANT)) {
+            sendOAuthError(res, 'invalid_client', 401);
+            return;
+        }
+        const result = await this.#store.pollDeviceAuthorization({
+            deviceCode: hashToken(rawDeviceCode),
+            clientId,
+            ...(resource !== undefined ? { resource: normalizeUrl(resource) } : {}),
+            nowSeconds: this.#nowSeconds(),
+        });
+        if (result.status !== 'approved') {
+            sendOAuthError(res, result.status);
+            return;
+        }
+        const tokens = await this.#provider.issueDeviceTokens(result.record);
+        if (!(await this.#store.completeDeviceTokenIssuance(result.record.deviceCode, result.record.clientId))) {
+            sendOAuthError(res, 'expired_token');
+            return;
+        }
+        res.setHeader('cache-control', 'no-store');
+        res.json(tokens);
+    }
+    #callbackUrl() {
+        return `${this.#issuer}/oauth/device/callback`;
+    }
+    #validResource(resource) {
+        try {
+            const normalized = normalizeUrl(resource);
+            return (normalized === normalizeUrl(this.#issuer) || normalized === `${this.#issuer}/developer/cli`);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+function formBody(req) {
+    return (req.body ?? {});
+}
+function stringField(body, name) {
+    const value = body[name];
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function optionalStringField(body, name) {
+    return stringField(body, name);
+}
+function normalizeUrl(value) {
+    const url = new URL(value);
+    url.hash = '';
+    url.search = '';
+    return url.href;
+}
+function normalizeUserCode(value) {
+    return value.toUpperCase().replace(/[^A-Z2-9]/g, '');
+}
+function userCode() {
+    const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+    const bytes = randomBytes(8);
+    let value = '';
+    for (let index = 0; index < 8; index += 1) {
+        value += alphabet[(bytes[index] ?? 0) % alphabet.length];
+    }
+    return `${value.slice(0, 4)}-${value.slice(4)}`;
+}
+function sendOAuthError(res, error, status = 400) {
+    res.setHeader('cache-control', 'no-store');
+    res.status(status).json({ error });
+}
+function renderDeviceCodePage(code, invalid = false) {
+    return renderOAuthPage({
+        title: 'Sign in — Noodle Seed',
+        kicker: 'CLI sign in',
+        heading: 'Enter your device code',
+        contentHtml: `${invalid ? '<p class="ns-lede">That code is invalid or expired. Try the code again.</p>' : ''}${code === ''
+            ? ''
+            : `<p class="ns-lede">Confirm <strong>${escapeHtml(code)}</strong> matches the code shown in your terminal.</p>`}<form method="post" action="/device">
+      <label for="user_code">Device code</label>
+      <input id="user_code" name="user_code" value="${escapeHtml(code)}" autocomplete="one-time-code" required />
+      <div class="btn-glow"><button class="btn btn-primary" type="submit">Continue</button></div>
+    </form>`,
+    });
+}
+function renderCompletionPage(approved) {
+    return renderOAuthPage({
+        title: `${approved ? 'Signed in' : 'Sign-in denied'} — Noodle Seed`,
+        kicker: approved ? 'Complete' : 'Not completed',
+        heading: approved ? 'You are signed in' : 'Sign-in was not completed',
+        contentHtml: approved
+            ? '<p class="ns-lede">You can return to your terminal. This window can now be closed.</p>'
+            : '<p class="ns-lede">Return to your terminal and start sign-in again if you still want to continue.</p>',
+    });
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (character) => {
+        const entities = {
+            '&': '&amp;',
+            '<': '&lt;',
+            '>': '&gt;',
+            '"': '&quot;',
+            "'": '&#39;',
+        };
+        return entities[character] ?? character;
+    });
+}
+//# sourceMappingURL=device-flow.js.map

package/node_modules/@noodle-borg/service/dist/oauth/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/oauth/device-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAC3E,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAEvC,iGAAiG;AACjG,MAAM,OAAO,uBAAuB;IACzB,OAAO,CAAS;IAChB,MAAM,CAAa;IACnB,SAAS,CAAsB;IAC/B,WAAW,CAAe;IAEnC,YAAY,KAKX;QACC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvF,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IACE,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,0BAA0B,KAAK,MAAM;YAC5C,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC;YAC3C,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxC,CAAC;YACD,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC1C,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;YACpC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACnD,QAAQ;YACR,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;YAChC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG,GAAG,kBAAkB;YACnC,UAAU,EAAE,GAAG;YACf,eAAe,EAAE,4BAA4B;SAC9C,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,GAAG,IAAI,CAAC,OAAO,SAAS,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACpD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,WAAW,EAAE,aAAa;YAC1B,SAAS,EAAE,WAAW;YACtB,gBAAgB,EAAE,eAAe;YACjC,yBAAyB,EAAE,QAAQ,CAAC,IAAI;YACxC,UAAU,EAAE,kBAAkB;YAC9B,QAAQ,EAAE,4BAA4B;SACvC,CAAC,CAAC;IACL,CAAC;IAED,sBAAsB,CAAC,GAAY,EAAE,GAAa;QAChD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAY,EAAE,GAAa;QAClD,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC1F,MAAM,MAAM,GACV,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,oBAAoB,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC;YAC3C,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAChE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACxD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC5D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QAC9C,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,MAAM,QAAQ,GACZ,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1F,GAAG;aACA,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;aAC5B,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC1D,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,IACE,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,0BAA0B,KAAK,MAAM;YAC5C,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC3C,CAAC;YACD,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;YACvD,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;YACpC,QAAQ;YACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE;SAC/B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,EACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,CACvB,CAAC,EACF,CAAC;YACD,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAED,YAAY;QACV,OAAO,GAAG,IAAI,CAAC,OAAO,wBAAwB,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC1C,OAAO,CACL,UAAU,KAAK,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,KAAK,GAAG,IAAI,CAAC,OAAO,gBAAgB,CAC5F,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA6B,EAAE,IAAY;IACtE,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,GAAa,EAAE,KAAa,EAAE,MAAM,GAAG,GAAG;IAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,OAAO,GAAG,KAAK;IACzD,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,GACX,OAAO,CAAC,CAAC,CAAC,6EAA6E,CAAC,CAAC,CAAC,EAC5F,GACE,IAAI,KAAK,EAAE;YACT,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,sCAAsC,UAAU,CAAC,IAAI,CAAC,wDAC5D;;sDAEkD,UAAU,CAAC,IAAI,CAAC;;YAE1D;KACT,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAiB;IAC7C,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,gBAAgB;QACnE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe;QAC/C,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,2BAA2B;QACrE,WAAW,EAAE,QAAQ;YACnB,CAAC,CAAC,wFAAwF;YAC1F,CAAC,CAAC,uGAAuG;KAC5G,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAA2B;YACvC,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,OAAO;SACb,CAAC;QACF,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/device-provider.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { DeviceAuthorizationRecord, DeviceBrowserSessionRecord } from './device-store.js';
+import type { OAuthStore } from './store.js';
+import type { OAuthTokenIssuer } from './token-issuer.js';
+export declare function completeDeviceAuthorization(input: {
+    readonly store: OAuthStore;
+    readonly issuer: string;
+    readonly session: DeviceBrowserSessionRecord;
+    readonly authorizationCode: string;
+}): Promise<boolean>;
+export declare function issueDeviceTokens(input: {
+    readonly tokenIssuer: OAuthTokenIssuer;
+    readonly record: DeviceAuthorizationRecord;
+}): Promise<OAuthTokens>;
+//# sourceMappingURL=device-provider.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/device-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-provider.d.ts","sourceRoot":"","sources":["../../src/oauth/device-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBnB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBvB"}

package/node_modules/@noodle-borg/service/dist/oauth/device-provider.js

@@ -0,0 +1,45 @@
+import { InvalidGrantError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { storedOAuthOwnerPreferences } from './identity-preferences.js';
+import { hashToken } from './tokens.js';
+export async function completeDeviceAuthorization(input) {
+    const record = await input.store.redeemAuthorizationCode(hashToken(input.authorizationCode));
+    if (record === undefined ||
+        record.clientId !== input.session.clientId ||
+        record.redirectUri !== `${input.issuer.replace(/\/+$/, '')}/oauth/device/callback` ||
+        record.resource !== input.session.resource ||
+        record.codeChallenge !== input.session.codeChallenge) {
+        return false;
+    }
+    return input.store.approveDeviceAuthorization(input.session.deviceCode, {
+        ownerSubject: record.ownerSubject,
+        ...(record.ownerEmail !== undefined ? { ownerEmail: record.ownerEmail } : {}),
+        ...storedOAuthOwnerPreferences({
+            locale: record.ownerLocale,
+            timeZone: record.ownerTimeZone,
+        }),
+        ...(record.identityKind !== undefined ? { identityKind: record.identityKind } : {}),
+        ...(record.identityProvider !== undefined ? { identityProvider: record.identityProvider } : {}),
+        ...(record.developerGrantId !== undefined ? { developerGrantId: record.developerGrantId } : {}),
+    });
+}
+export function issueDeviceTokens(input) {
+    const record = input.record;
+    if (record.ownerSubject === undefined) {
+        throw new InvalidGrantError('device authorization is missing an approved identity');
+    }
+    return input.tokenIssuer.issueTokens({
+        clientId: record.clientId,
+        ownerSubject: record.ownerSubject,
+        resource: record.resource,
+        ...(record.ownerEmail !== undefined ? { ownerEmail: record.ownerEmail } : {}),
+        ...storedOAuthOwnerPreferences({
+            locale: record.ownerLocale,
+            timeZone: record.ownerTimeZone,
+        }),
+        ...(record.scope !== undefined ? { scope: record.scope } : {}),
+        ...(record.identityKind !== undefined ? { identityKind: record.identityKind } : {}),
+        ...(record.identityProvider !== undefined ? { identityProvider: record.identityProvider } : {}),
+        ...(record.developerGrantId !== undefined ? { developerGrantId: record.developerGrantId } : {}),
+    });
+}
+//# sourceMappingURL=device-provider.js.map

package/node_modules/@noodle-borg/service/dist/oauth/device-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-provider.js","sourceRoot":"","sources":["../../src/oauth/device-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7F,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC1C,MAAM,CAAC,WAAW,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;QAClF,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ;QAC1C,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,OAAO,CAAC,aAAa,EACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;QACtE,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,2BAA2B,CAAC;YAC7B,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,QAAQ,EAAE,MAAM,CAAC,aAAa;SAC/B,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAGjC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,2BAA2B,CAAC;YAC7B,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,QAAQ,EAAE,MAAM,CAAC,aAAa;SAC/B,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-schema.d.ts

@@ -0,0 +1,3 @@
+import type { Pool } from 'pg';
+export declare function ensureDeviceAuthorizationSchema(pool: Pool): Promise<void>;
+//# sourceMappingURL=device-store-postgres-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-store-postgres-schema.d.ts","sourceRoot":"","sources":["../../src/oauth/device-store-postgres-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/E"}

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-schema.js

@@ -0,0 +1,33 @@
+export async function ensureDeviceAuthorizationSchema(pool) {
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_device_authorizations (
+      device_code text PRIMARY KEY,
+      user_code text UNIQUE NOT NULL,
+      client_id text NOT NULL,
+      resource text NOT NULL,
+      scope text,
+      status text NOT NULL,
+      owner_subject text,
+      owner_email text,
+      owner_locale text,
+      owner_time_zone text,
+      identity_kind text,
+      identity_provider text,
+      developer_grant_id text,
+      expires_at timestamptz NOT NULL,
+      next_poll_at timestamptz NOT NULL,
+      interval_seconds integer NOT NULL
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_device_browser_sessions (
+      state text PRIMARY KEY,
+      device_code text NOT NULL,
+      client_id text NOT NULL,
+      resource text NOT NULL,
+      code_challenge text NOT NULL,
+      expires_at timestamptz NOT NULL
+    )
+  `);
+}
+//# sourceMappingURL=device-store-postgres-schema.js.map

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-store-postgres-schema.js","sourceRoot":"","sources":["../../src/oauth/device-store-postgres-schema.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,IAAU;IAC9D,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;GAmBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;GAShB,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-types.d.ts

@@ -0,0 +1,30 @@
+import type { DeviceAuthorizationRecord, DeviceBrowserSessionRecord } from './device-store.js';
+export interface DeviceAuthorizationRow {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly client_id: string;
+    readonly resource: string;
+    readonly scope: string | null;
+    readonly status: 'pending' | 'approved' | 'denied';
+    readonly owner_subject: string | null;
+    readonly owner_email: string | null;
+    readonly owner_locale: string | null;
+    readonly owner_time_zone: string | null;
+    readonly identity_kind: 'platform' | 'customer' | null;
+    readonly identity_provider: string | null;
+    readonly developer_grant_id: string | null;
+    readonly expires_at: Date;
+    readonly next_poll_at: Date;
+    readonly interval_seconds: number;
+}
+export interface DeviceBrowserSessionRow {
+    readonly state: string;
+    readonly device_code: string;
+    readonly client_id: string;
+    readonly resource: string;
+    readonly code_challenge: string;
+    readonly expires_at: Date;
+}
+export declare function deviceRowToRecord(row: DeviceAuthorizationRow): DeviceAuthorizationRecord;
+export declare function deviceBrowserRowToRecord(row: DeviceBrowserSessionRow): DeviceBrowserSessionRecord;
+//# sourceMappingURL=device-store-postgres-types.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-store-postgres-types.d.ts","sourceRoot":"","sources":["../../src/oauth/device-store-postgres-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,sBAAsB,GAAG,yBAAyB,CAmBxF;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,uBAAuB,GAAG,0BAA0B,CASjG"}

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-types.js

@@ -0,0 +1,31 @@
+export function deviceRowToRecord(row) {
+    return {
+        deviceCode: row.device_code,
+        userCode: row.user_code,
+        clientId: row.client_id,
+        resource: row.resource,
+        ...(row.scope !== null ? { scope: row.scope } : {}),
+        status: row.status,
+        ...(row.owner_subject !== null ? { ownerSubject: row.owner_subject } : {}),
+        ...(row.owner_email !== null ? { ownerEmail: row.owner_email } : {}),
+        ...(row.owner_locale !== null ? { ownerLocale: row.owner_locale } : {}),
+        ...(row.owner_time_zone !== null ? { ownerTimeZone: row.owner_time_zone } : {}),
+        ...(row.identity_kind !== null ? { identityKind: row.identity_kind } : {}),
+        ...(row.identity_provider !== null ? { identityProvider: row.identity_provider } : {}),
+        ...(row.developer_grant_id !== null ? { developerGrantId: row.developer_grant_id } : {}),
+        expiresAt: Math.floor(new Date(row.expires_at).getTime() / 1000),
+        nextPollAt: Math.floor(new Date(row.next_poll_at).getTime() / 1000),
+        intervalSeconds: row.interval_seconds,
+    };
+}
+export function deviceBrowserRowToRecord(row) {
+    return {
+        state: row.state,
+        deviceCode: row.device_code,
+        clientId: row.client_id,
+        resource: row.resource,
+        codeChallenge: row.code_challenge,
+        expiresAt: Math.floor(new Date(row.expires_at).getTime() / 1000),
+    };
+}
+//# sourceMappingURL=device-store-postgres-types.js.map

package/node_modules/@noodle-borg/service/dist/oauth/device-store-postgres-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-store-postgres-types.js","sourceRoot":"","sources":["../../src/oauth/device-store-postgres-types.ts"],"names":[],"mappings":"AA8BA,MAAM,UAAU,iBAAiB,CAAC,GAA2B;IAC3D,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAChE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QACnE,eAAe,EAAE,GAAG,CAAC,gBAAgB;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAA4B;IACnE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/device-store.d.ts

@@ -0,0 +1,66 @@
+/** RFC 8628 state stored by the authorization server. All codes are stored as hashes. */
+export interface DeviceAuthorizationRecord {
+    readonly deviceCode: string;
+    readonly userCode: string;
+    readonly clientId: string;
+    readonly resource: string;
+    readonly scope?: string;
+    readonly status: 'pending' | 'approved' | 'denied';
+    readonly ownerSubject?: string;
+    readonly ownerEmail?: string;
+    readonly ownerLocale?: string;
+    readonly ownerTimeZone?: string;
+    readonly identityKind?: 'platform' | 'customer';
+    readonly identityProvider?: string;
+    readonly developerGrantId?: string;
+    readonly expiresAt: number;
+    readonly nextPollAt: number;
+    readonly intervalSeconds: number;
+}
+export interface DeviceBrowserSessionRecord {
+    readonly state: string;
+    readonly deviceCode: string;
+    readonly clientId: string;
+    readonly resource: string;
+    readonly codeChallenge: string;
+    readonly expiresAt: number;
+}
+export interface DeviceAuthorizationIdentity {
+    readonly ownerSubject: string;
+    readonly ownerEmail?: string;
+    readonly ownerLocale?: string;
+    readonly ownerTimeZone?: string;
+    readonly identityKind?: 'platform' | 'customer';
+    readonly identityProvider?: string;
+    readonly developerGrantId?: string;
+}
+export type DeviceAuthorizationPoll = {
+    readonly status: 'authorization_pending';
+} | {
+    readonly status: 'slow_down';
+} | {
+    readonly status: 'access_denied';
+} | {
+    readonly status: 'expired_token';
+} | {
+    readonly status: 'invalid_grant';
+} | {
+    readonly status: 'approved';
+    readonly record: DeviceAuthorizationRecord;
+};
+export interface DeviceAuthorizationStore {
+    createDeviceAuthorization(record: DeviceAuthorizationRecord): Promise<void>;
+    getDeviceAuthorizationByUserCode(userCode: string): Promise<DeviceAuthorizationRecord | undefined>;
+    createDeviceBrowserSession(record: DeviceBrowserSessionRecord): Promise<void>;
+    consumeDeviceBrowserSession(state: string): Promise<DeviceBrowserSessionRecord | undefined>;
+    approveDeviceAuthorization(deviceCode: string, identity: DeviceAuthorizationIdentity): Promise<boolean>;
+    denyDeviceAuthorization(deviceCode: string): Promise<boolean>;
+    pollDeviceAuthorization(input: {
+        readonly deviceCode: string;
+        readonly clientId: string;
+        readonly resource?: string;
+        readonly nowSeconds: number;
+    }): Promise<DeviceAuthorizationPoll>;
+    completeDeviceTokenIssuance(deviceCode: string, clientId: string): Promise<boolean>;
+}
+//# sourceMappingURL=device-store.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/device-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-store.d.ts","sourceRoot":"","sources":["../../src/oauth/device-store.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,wBAAwB;IACvC,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,gCAAgC,CAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAC;IAClD,0BAA0B,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IAC5F,0BAA0B,CACxB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,uBAAuB,CAAC,KAAK,EAAE;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrF"}

package/node_modules/@noodle-borg/service/dist/oauth/device-store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-store.js.map

package/node_modules/@noodle-borg/service/dist/oauth/device-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-store.js","sourceRoot":"","sources":["../../src/oauth/device-store.ts"],"names":[],"mappings":""}

package/node_modules/@noodle-borg/service/dist/oauth/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/oauth/paths.ts"],"names":[],"mappings":"AAoBA,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/oauth/paths.ts"],"names":[],"mappings":"AAuBA,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/node_modules/@noodle-borg/service/dist/oauth/paths.js

@@ -5,10 +5,13 @@
  */
 const AUTH_SERVER_PATHS = new Set([
     '/authorize',
+    '/device_authorization',
+    '/device',
     '/token',
     '/revoke',
     '/register',
     '/oauth/google/callback',
+    '/oauth/device/callback',
     '/oauth/consent',
     '/oauth/developer-grant',
     '/oauth/customer/firebase/authorize',

package/node_modules/@noodle-borg/service/dist/oauth/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/oauth/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,WAAW;IACX,wBAAwB;IACxB,gBAAgB;IAChB,wBAAwB;IACxB,oCAAoC;IACpC,mCAAmC;IACnC,oCAAoC;IACpC,yCAAyC;IACzC,wBAAwB;CACzB,CAAC,CAAC;AAEH,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/oauth/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,YAAY;IACZ,uBAAuB;IACvB,SAAS;IACT,QAAQ;IACR,SAAS;IACT,WAAW;IACX,wBAAwB;IACxB,wBAAwB;IACxB,gBAAgB;IAChB,wBAAwB;IACxB,oCAAoC;IACpC,mCAAmC;IACnC,oCAAoC;IACpC,yCAAyC;IACzC,wBAAwB;CACzB,CAAC,CAAC;AAEH,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/provider.d.ts

@@ -8,6 +8,8 @@ import type { Request, Response } from 'express';
 import type { SignupAuthorizer } from '../auth/deploy-gate.js';
 import type { SecretEnvelope, TenantBridgeAuthConfig } from '../store.js';
 import type { DeveloperGrantAuthorizer } from './developer-grant-authorizer.js';
+import { DeviceAuthorizationFlow } from './device-flow.js';
+import type { DeviceAuthorizationRecord, DeviceBrowserSessionRecord } from './device-store.js';
 import type { GoogleAuthenticator } from './google.js';
 import type { OAuthStore } from './store.js';
 export interface NoodleOAuthProviderConfig {
@@ -47,12 +49,17 @@ export declare class NoodleOAuthProvider implements OAuthServerProvider {
     #private;
     constructor(config: NoodleOAuthProviderConfig);
     get clientsStore(): OAuthRegisteredClientsStore;
+    get deviceAuthorizationFlow(): DeviceAuthorizationFlow;
     /** Begin authorization: persist the pending request and redirect the user to "Sign in with Google". */
     authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
     /** Return the stored PKCE challenge for a code (non-destructive — the SDK validates the verifier against it). */
     challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
     /** Redeem an authorization code (single-use) and mint the owner's tokens. PKCE was validated by the SDK. */
     exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    /** Complete the server-owned authorization-code bridge used by the RFC 8628 verification page. */
+    completeDeviceAuthorization(session: DeviceBrowserSessionRecord, authorizationCode: string): Promise<boolean>;
+    /** Mint normal access/refresh tokens after the device authorization has been approved and consumed. */
+    issueDeviceTokens(record: DeviceAuthorizationRecord): Promise<OAuthTokens>;
     /** Rotate a refresh token with grace/recovery handling for concurrent or retried refreshes. */
     exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, _scopes?: string[], resource?: URL): Promise<OAuthTokens>;
     /** Verify an access token (issuer/signature/expiry). Provided for interface completeness — the data-plane

package/node_modules/@noodle-borg/service/dist/oauth/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAMpG,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAE3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAU1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,KAAK,EAAE,mBAAmB,EAAkB,MAAM,aAAa,CAAC;AAkBvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAY7C,MAAM,WAAW,yBAAyB;IACxC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,iHAAiH;IACjH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D,sGAAsG;IACtG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/F,oHAAoH;IACpH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CACvC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,wFAAwF;IACxF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,wEAAwE;AACxE,qBAAa,mBAAoB,YAAW,mBAAmB;;gBAejD,MAAM,EAAE,yBAAyB;IAiC7C,IAAI,YAAY,IAAI,2BAA2B,CAQ9C;IAED,uGAAuG;IACjG,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IA4ChB,iHAAiH;IAC3G,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAQlB,4GAA4G;IACtG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAsCvB,+FAA+F;IACzF,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA4DvB;4GACwG;IAClG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAWzD,iGAAiG;IAC3F,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAiBhB,yHAAyH;IACzH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAUnC,kGAAkG;IAClG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAIpC,0GAA0G;IACpG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2FtE,wHAAwH;IAClH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0CzD,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE,sGAAsG;IAChG,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3E,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0D1E,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAgJlF"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAMpG,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAE3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAU1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAkB,MAAM,aAAa,CAAC;AAkBvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAa7C,MAAM,WAAW,yBAAyB;IACxC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,iHAAiH;IACjH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D,sGAAsG;IACtG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/F,oHAAoH;IACpH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CACvC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,wFAAwF;IACxF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,wEAAwE;AACxE,qBAAa,mBAAoB,YAAW,mBAAmB;;gBAgBjD,MAAM,EAAE,yBAAyB;IAuC7C,IAAI,YAAY,IAAI,2BAA2B,CAQ9C;IAED,IAAI,uBAAuB,IAAI,uBAAuB,CAErD;IAED,uGAAuG;IACjG,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IA4ChB,iHAAiH;IAC3G,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAQlB,4GAA4G;IACtG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAsCvB,kGAAkG;IAC5F,2BAA2B,CAC/B,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,OAAO,CAAC;IASnB,uGAAuG;IACvG,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1E,+FAA+F;IACzF,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA4DvB;4GACwG;IAClG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAWzD,iGAAiG;IAC3F,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAiBhB,yHAAyH;IACzH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAmBnC,kGAAkG;IAClG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAIpC,0GAA0G;IACpG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2FtE,wHAAwH;IAClH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0CzD,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE,sGAAsG;IAChG,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3E,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0D1E,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAgJlF"}