@noodleseed/one 0.63.0 → 0.64.0

package/node_modules/@noodle-borg/service/dist/oauth/provider.d.ts

@@ -5,82 +5,77 @@ import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthToke
 import { type SigningKeyProvider, type VerifiedIdentity } from '@noodle-borg/auth';
 import { type Logger } from '@noodle-borg/transport-http';
 import type { Request, Response } from 'express';
-import type { SignupAuthorizer } from '../auth/deploy-gate.js';
+import type { ControlPlaneSignupMode, SignupAuthorizer } from '../auth/deploy-gate.js';
+import type { PlatformPrincipalResolver } from '../platform-identity.js';
 import type { SecretEnvelope, TenantBridgeAuthConfig } from '../store.js';
 import type { DeveloperGrantAuthorizer } from './developer-grant-authorizer.js';
 import { DeviceAuthorizationFlow } from './device-flow.js';
 import type { DeviceAuthorizationRecord, DeviceBrowserSessionRecord } from './device-store.js';
 import type { GoogleAuthenticator } from './google.js';
 import type { OAuthStore } from './store.js';
+import { handleUpstreamHumanCallback } from './upstream-callback-handler.js';
+import type { UpstreamHumanOAuthAuthenticator, UpstreamHumanRollout } from './upstream-human.js';
+import type { UpstreamHumanRolloutStore } from './upstream-rollout-store.js';
 export interface NoodleOAuthProviderConfig {
-    /** The authorization server issuer (its public origin, e.g. `https://cloud.noodleseed.dev`). */
     readonly issuer: string;
     readonly store: OAuthStore;
     readonly signer: SigningKeyProvider;
-    readonly google: GoogleAuthenticator;
-    /** When set, only users whose email ends with this domain may authorize (alpha gate, e.g. `@noodleseed.com`). */
+    readonly google?: GoogleAuthenticator;
+    readonly upstreamAuthenticators?: Readonly<{
+        readonly workos?: UpstreamHumanOAuthAuthenticator;
+    }>;
+    readonly upstreamRollout?: UpstreamHumanRollout;
+    readonly upstreamRolloutStore?: UpstreamHumanRolloutStore;
+    readonly platformPrincipalResolver?: PlatformPrincipalResolver;
     readonly allowedEmailDomain?: string;
+    readonly signupMode?: ControlPlaneSignupMode;
     readonly signupAuthorizer?: SignupAuthorizer;
+    readonly deniedSignupDomains?: readonly string[];
+    readonly deniedSignupSubjects?: readonly string[];
+    /** Idempotently establishes platform-owned account state before any Noodle credential is issued. */
+    readonly provisionPlatformPrincipal?: NoodlePlatformPrincipalProvisioner;
     readonly developerGrantAuthorizer?: DeveloperGrantAuthorizer;
-    /** Compatibility hook for OAuth clients that cannot send RFC 8707 `resource` during authorization. */
     readonly defaultResourceForClient?: (client: OAuthClientInformationFull) => string | undefined;
-    /** Resolve bridge auth for a resource-bound tenant MCP URL, when the deployment uses Noodle-managed bridge auth. */
     readonly customerBridgeAuthForResource?: (resource: string) => Promise<TenantBridgeAuthConfig | undefined>;
-    /** Verify the upstream customer credential returned by the tenant app before Noodle issues an MCP token. */
     readonly verifyCustomerBridgeToken?: (auth: TenantBridgeAuthConfig, token: string) => Promise<VerifiedIdentity | null>;
     readonly managedSecretForResource?: (resource: string, name: string) => Promise<string | undefined>;
     readonly sealCustomerCredential?: (credential: string) => Promise<SecretEnvelope>;
     readonly fetchImpl?: typeof fetch;
     readonly accessTokenTtlSeconds?: number;
     readonly refreshTokenTtlSeconds?: number;
-    /** Benign retry/concurrency window after refresh-token rotation. Default 30 seconds. */
     readonly refreshTokenGraceSeconds?: number;
-    /** Recovery window for stale refresh tokens when the successor was never used. */
     readonly refreshTokenRecoverySeconds?: number;
     readonly authCodeTtlSeconds?: number;
     readonly pendingTtlSeconds?: number;
     readonly consentTtlSeconds?: number;
     readonly logger?: Logger;
-    /** Clock injection (epoch ms), for deterministic time in tests. Defaults to `Date.now`. */
     readonly now?: () => number;
 }
-/** Self-hosted OAuth authorization server provider (OA-2, ADR 0042). */
 export declare class NoodleOAuthProvider implements OAuthServerProvider {
     #private;
     constructor(config: NoodleOAuthProviderConfig);
     get clientsStore(): OAuthRegisteredClientsStore;
     get deviceAuthorizationFlow(): DeviceAuthorizationFlow;
-    /** Begin authorization: persist the pending request and redirect the user to "Sign in with Google". */
     authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
-    /** Return the stored PKCE challenge for a code (non-destructive — the SDK validates the verifier against it). */
     challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
-    /** Redeem an authorization code (single-use) and mint the owner's tokens. PKCE was validated by the SDK. */
     exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
-    /** Complete the server-owned authorization-code bridge used by the RFC 8628 verification page. */
     completeDeviceAuthorization(session: DeviceBrowserSessionRecord, authorizationCode: string): Promise<boolean>;
-    /** Mint normal access/refresh tokens after the device authorization has been approved and consumed. */
     issueDeviceTokens(record: DeviceAuthorizationRecord): Promise<OAuthTokens>;
-    /** Rotate a refresh token with grace/recovery handling for concurrent or retried refreshes. */
     exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, _scopes?: string[], resource?: URL): Promise<OAuthTokens>;
-    /** Verify an access token (issuer/signature/expiry). Provided for interface completeness — the data-plane
-     * resource server verifies with its own audience-bound verifier; this is not on the AS request path. */
     verifyAccessToken(token: string): Promise<AuthInfo>;
-    /** RFC 7009 revocation also invalidates the exact developer grant bound to this client token. */
     revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
-    /** RFC 8414 authorization-server metadata (plus our `jwks_uri`), served at `/.well-known/oauth-authorization-server`. */
     metadata(): Record<string, unknown>;
-    /** The public JWKS the resource server (and external validators) read to verify access tokens. */
     jwks(): Promise<{
         keys: unknown[];
     }>;
-    /** Google callback: consume the pending auth, verify the Google identity, and render the consent page. */
     handleGoogleCallback(req: Request, res: Response): Promise<void>;
-    /** Consent decision: on approve, mint a PKCE-bound code and redirect to the client; on deny, redirect with an error. */
+    handleWorkOSCallback(req: Request, res: Response): Promise<void>;
+    handleUpstreamProviderChoice(req: Request, res: Response): Promise<void>;
     handleConsent(req: Request, res: Response): Promise<void>;
     handleDeveloperGrant(req: Request, res: Response): Promise<void>;
-    /** Customer bridge callback: verify the tenant app's customer token and issue a normal OAuth code. */
     handleFirebaseCustomerAuthorize(req: Request, res: Response): Promise<void>;
     handleFirebaseCustomerCallback(req: Request, res: Response): Promise<void>;
     handleMicrosoftCustomerCallback(req: Request, res: Response): Promise<void>;
 }
+export type NoodlePlatformPrincipalProvisioner = NonNullable<Parameters<typeof handleUpstreamHumanCallback>[0]['provisionPlatformPrincipal']>;
 //# sourceMappingURL=provider.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAMpG,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAE3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAU1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAkB,MAAM,aAAa,CAAC;AAkBvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAa7C,MAAM,WAAW,yBAAyB;IACxC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,iHAAiH;IACjH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D,sGAAsG;IACtG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/F,oHAAoH;IACpH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CACvC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,wFAAwF;IACxF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,wEAAwE;AACxE,qBAAa,mBAAoB,YAAW,mBAAmB;;gBAgBjD,MAAM,EAAE,yBAAyB;IAuC7C,IAAI,YAAY,IAAI,2BAA2B,CAQ9C;IAED,IAAI,uBAAuB,IAAI,uBAAuB,CAErD;IAED,uGAAuG;IACjG,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IA4ChB,iHAAiH;IAC3G,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAQlB,4GAA4G;IACtG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAsCvB,kGAAkG;IAC5F,2BAA2B,CAC/B,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,OAAO,CAAC;IASnB,uGAAuG;IACvG,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1E,+FAA+F;IACzF,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA4DvB;4GACwG;IAClG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAWzD,iGAAiG;IAC3F,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAiBhB,yHAAyH;IACzH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAmBnC,kGAAkG;IAClG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAIpC,0GAA0G;IACpG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2FtE,wHAAwH;IAClH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0CzD,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE,sGAAsG;IAChG,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3E,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0D1E,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAgJlF"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAMpG,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAU1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAmBvD,OAAO,KAAK,EAAE,UAAU,EAAoC,MAAM,YAAY,CAAC;AAG/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EACV,+BAA+B,EAE/B,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAU7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,QAAQ,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;IAClG,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IAC1D,QAAQ,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,oGAAoG;IACpG,QAAQ,CAAC,0BAA0B,CAAC,EAAE,kCAAkC,CAAC;IACzE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CACvC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,mBAAoB,YAAW,mBAAmB;;gBAgBjD,MAAM,EAAE,yBAAyB;IAsC7C,IAAI,YAAY,IAAI,2BAA2B,CAQ9C;IACD,IAAI,uBAAuB,IAAI,uBAAuB,CAErD;IACK,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAgCV,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAOZ,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAqCjB,2BAA2B,CAC/B,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,OAAO,CAAC;IAQnB,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;IAGpE,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAoEjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAUnD,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAchB,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAInC,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAG9B,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAGhE,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAGhE,4BAA4B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAmDxE,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCzD,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhE,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3E,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA4D1E,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAuHlF;AAED,MAAM,MAAM,kCAAkC,GAAG,WAAW,CAC1D,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAChF,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/provider.js

@@ -1,28 +1,29 @@
 import { InvalidGrantError, InvalidRequestError, InvalidTokenError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
-import { createOAuthMetadata } from '@modelcontextprotocol/sdk/server/auth/router.js';
 import { createJwtVerifier, } from '@noodle-borg/auth';
 import { noopLogger } from '@noodle-borg/transport-http';
-import { jwtVerify, SignJWT } from 'jose';
-import { renderConsentPage } from './consent.js';
-import { isConsentClaims } from './consent-claims.js';
-import { bridgeAuthorizeUrl, customerBridgeAuthorizeFields, customerBridgeCallbackFields, microsoftCallbackUrl, renderFirebaseAuthorizePage, } from './customer-bridge.js';
-import { DeveloperGrantOAuthFlow, isDeveloperResourceForIssuer } from './developer-grant-flow.js';
+import { initiateAuthorization } from './authorization-initiation.js';
+import { signConsentToken, verifyConsentToken } from './consent-token.js';
+import { customerBridgeAuthorizeFields, customerBridgeCallbackFields, microsoftCallbackUrl, renderFirebaseAuthorizePage, } from './customer-bridge.js';
+import { DeveloperGrantOAuthFlow } from './developer-grant-flow.js';
 import { DeviceAuthorizationFlow } from './device-flow.js';
 import { completeDeviceAuthorization, issueDeviceTokens } from './device-provider.js';
 import { storedOAuthOwnerPreferences, verifiedIdentityOwnerPreferences, } from './identity-preferences.js';
+import { noodleOAuthMetadata } from './metadata.js';
 import { exchangeMicrosoftAuthorizationCode, isConfiguredMicrosoftBridge, verifyMicrosoftIdToken, } from './microsoft.js';
-import { defaultResourceFromClient, hostOf, normalizeResource, resourcePath, trimTrailingSlash, } from './provider-util.js';
+import { assertPlatformRefreshPrincipal } from './platform-principal-guard.js';
+import { defaultResourceFromClient, normalizeResource, resourcePath, trimTrailingSlash, } from './provider-util.js';
 import { mintOAuthAccessToken, OAuthTokenIssuer } from './token-issuer.js';
 import { hashToken, randomToken } from './tokens.js';
+import { handleUpstreamHumanCallback } from './upstream-callback-handler.js';
+import { redirectPendingAuthorizationError } from './upstream-callback-support.js';
+import { continueUpstreamProviderChoice } from './upstream-provider-choice.js';
 const ONE_HOUR = 3600;
 const THIRTY_DAYS = 30 * 24 * 3600;
 const TEN_MINUTES = 600;
 const FIVE_MINUTES = 300;
 const REFRESH_GRACE = 30;
 const REFRESH_RECOVERY = 300;
-const CONSENT_PATH = '/oauth/consent';
 const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
-/** Self-hosted OAuth authorization server provider (OA-2, ADR 0042). */
 export class NoodleOAuthProvider {
     #config;
     #accessTtl;
@@ -85,42 +86,32 @@ export class NoodleOAuthProvider {
     get deviceAuthorizationFlow() {
         return this.#deviceFlow;
     }
-    /** Begin authorization: persist the pending request and redirect the user to "Sign in with Google". */
     async authorize(client, params, res) {
-        // RFC 8707: the client MUST bind the token to a resource. Owner-only tokens are audience-bound to the
-        // tenant MCP URL, so without it we cannot mint a usable token — fail before redirecting to Google.
-        const resource = params.resource?.href ??
-            defaultResourceFromClient(client) ??
-            normalizeResource(this.#config.defaultResourceForClient?.(client));
-        if (!resource) {
-            throw new InvalidRequestError('the resource parameter is required');
-        }
-        const nonce = randomToken();
-        await this.#config.store.createPendingAuthorization({
-            state: hashToken(nonce),
-            clientId: client.client_id,
-            redirectUri: params.redirectUri,
-            codeChallenge: params.codeChallenge,
-            ...(params.state !== undefined ? { clientState: params.state } : {}),
-            resource,
-            ...(params.scopes && params.scopes.length > 0 ? { scope: params.scopes.join(' ') } : {}),
-            expiresAt: this.#nowSeconds() + this.#pendingTtl,
+        await initiateAuthorization({
+            client,
+            params,
+            res,
+            issuer: this.#config.issuer,
+            store: this.#config.store,
+            ...(this.#config.google === undefined ? {} : { google: this.#config.google }),
+            ...(this.#config.upstreamAuthenticators?.workos === undefined
+                ? {}
+                : { workos: this.#config.upstreamAuthenticators.workos }),
+            ...(this.#config.upstreamRollout === undefined
+                ? {}
+                : { rollout: this.#config.upstreamRollout }),
+            ...(this.#config.upstreamRolloutStore === undefined
+                ? {}
+                : { rolloutStore: this.#config.upstreamRolloutStore }),
+            ...(this.#config.customerBridgeAuthForResource === undefined
+                ? {}
+                : { customerBridgeAuthForResource: this.#config.customerBridgeAuthForResource }),
+            ...(this.#config.defaultResourceForClient === undefined
+                ? {}
+                : { defaultResourceForClient: this.#config.defaultResourceForClient }),
+            pendingTtlSeconds: this.#pendingTtl,
+            nowSeconds: this.#nowSeconds(),
         });
-        const bridgeAuth = await this.#config.customerBridgeAuthForResource?.(resource);
-        if (bridgeAuth !== undefined) {
-            const authorizeUrl = bridgeAuthorizeUrl(bridgeAuth, {
-                issuer: this.#config.issuer,
-                state: nonce,
-                resource,
-                clientId: client.client_id,
-            });
-            if (authorizeUrl === undefined) {
-                throw new InvalidRequestError('customer bridge authorization is not configured');
-            }
-            res.redirect(302, authorizeUrl);
-            return;
-        }
-        res.redirect(302, this.#config.google.authorizationUrl(nonce));
     }
     #withDefaultResource(client) {
         const defaultResource = this.#config.defaultResourceForClient?.(client);
@@ -128,7 +119,6 @@ export class NoodleOAuthProvider {
             return client;
         return { ...client, default_resource: defaultResource };
     }
-    /** Return the stored PKCE challenge for a code (non-destructive — the SDK validates the verifier against it). */
     async challengeForAuthorizationCode(client, authorizationCode) {
         const record = await this.#config.store.getAuthorizationCode(hashToken(authorizationCode));
         if (!record || record.clientId !== client.client_id) {
@@ -136,7 +126,6 @@ export class NoodleOAuthProvider {
         }
         return record.codeChallenge;
     }
-    /** Redeem an authorization code (single-use) and mint the owner's tokens. PKCE was validated by the SDK. */
     async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
         const resolvedResource = resource?.href ??
             defaultResourceFromClient(client) ??
@@ -173,7 +162,6 @@ export class NoodleOAuthProvider {
                 : {}),
         });
     }
-    /** Complete the server-owned authorization-code bridge used by the RFC 8628 verification page. */
     async completeDeviceAuthorization(session, authorizationCode) {
         return completeDeviceAuthorization({
             store: this.#config.store,
@@ -182,11 +170,9 @@ export class NoodleOAuthProvider {
             authorizationCode,
         });
     }
-    /** Mint normal access/refresh tokens after the device authorization has been approved and consumed. */
     issueDeviceTokens(record) {
         return issueDeviceTokens({ tokenIssuer: this.#tokenIssuer, record });
     }
-    /** Rotate a refresh token with grace/recovery handling for concurrent or retried refreshes. */
     async exchangeRefreshToken(client, refreshToken, _scopes, resource) {
         const resolvedResource = resource?.href ??
             defaultResourceFromClient(client) ??
@@ -194,9 +180,14 @@ export class NoodleOAuthProvider {
         if (resolvedResource === undefined) {
             throw new InvalidRequestError('the resource parameter is required');
         }
+        const oldTokenHash = hashToken(refreshToken);
+        await assertPlatformRefreshPrincipal(this.#config.store, this.#config.platformPrincipalResolver, {
+            oldTokenHash,
+            client,
+        });
         const rawRefresh = randomToken();
         const rotation = await this.#config.store.rotateRefreshToken({
-            oldTokenHash: hashToken(refreshToken),
+            oldTokenHash,
             clientId: client.client_id,
             newTokenHash: hashToken(rawRefresh),
             newExpiresAt: this.#nowSeconds() + this.#refreshTtl,
@@ -204,7 +195,7 @@ export class NoodleOAuthProvider {
             recoverySeconds: this.#refreshRecoveryTtl,
             nowSeconds: this.#nowSeconds(),
         });
-        if (rotation.status === 'reuse' || rotation.status === 'unknown') {
+        if (!('identity' in rotation)) {
             this.#logRefresh(rotation.status, client.client_id, resolvedResource);
             throw new InvalidGrantError('invalid refresh token');
         }
@@ -245,8 +236,6 @@ export class NoodleOAuthProvider {
             ...(identity.scope !== undefined ? { scope: identity.scope } : {}),
         };
     }
-    /** Verify an access token (issuer/signature/expiry). Provided for interface completeness — the data-plane
-     * resource server verifies with its own audience-bound verifier; this is not on the AS request path. */
     async verifyAccessToken(token) {
         const identity = await this.#verify()(token);
         if (!identity)
@@ -258,7 +247,6 @@ export class NoodleOAuthProvider {
             ...(identity.expiresAt !== undefined ? { expiresAt: identity.expiresAt } : {}),
         };
     }
-    /** RFC 7009 revocation also invalidates the exact developer grant bound to this client token. */
     async revokeToken(client, request) {
         try {
             const identity = await this.#verify()(request.token);
@@ -272,120 +260,67 @@ export class NoodleOAuthProvider {
                 at: new Date(this.#now()).toISOString(),
             });
         }
-        catch {
-            // RFC 7009 requires invalid and already-revoked tokens to be indistinguishable no-ops.
-        }
+        catch { }
     }
-    /** RFC 8414 authorization-server metadata (plus our `jwks_uri`), served at `/.well-known/oauth-authorization-server`. */
     metadata() {
         const issuer = trimTrailingSlash(this.#config.issuer);
-        const base = createOAuthMetadata({ provider: this, issuerUrl: new URL(issuer) });
-        // The SDK emits `issuer` as `URL.href`, which appends a trailing slash for a path-less origin
-        // (`https://h` → `https://h/`). RFC 8414 §3.3 requires the metadata `issuer` to be identical to the
-        // issuer used to build the well-known URL, and our token `iss` + the PRM `authorization_servers` entry
-        // use the no-slash form — so normalize it back for consistency across all three.
-        const grants = Array.isArray(base.grant_types_supported)
-            ? base.grant_types_supported
-            : ['authorization_code', 'refresh_token'];
-        return {
-            ...base,
-            issuer,
-            grant_types_supported: [...new Set([...grants, DEVICE_GRANT])],
-            device_authorization_endpoint: `${issuer}/device_authorization`,
-            jwks_uri: `${issuer}/.well-known/jwks.json`,
-        };
+        return noodleOAuthMetadata(this, issuer, DEVICE_GRANT);
     }
-    /** The public JWKS the resource server (and external validators) read to verify access tokens. */
     jwks() {
         return this.#config.signer.publicJwks();
     }
-    /** Google callback: consume the pending auth, verify the Google identity, and render the consent page. */
     async handleGoogleCallback(req, res) {
-        if (typeof req.query.error === 'string') {
-            res.status(400).type('text/plain').send(`Google sign-in failed: ${req.query.error}`);
-            return;
-        }
-        const code = typeof req.query.code === 'string' ? req.query.code : undefined;
-        const state = typeof req.query.state === 'string' ? req.query.state : undefined;
-        if (!code || !state) {
-            res.status(400).type('text/plain').send('missing authorization code or state');
-            return;
-        }
-        const pending = await this.#config.store.consumePendingAuthorization(hashToken(state));
-        if (!pending) {
-            res.status(400).type('text/plain').send('unknown or expired authorization request');
-            return;
-        }
-        let identity;
-        try {
-            identity = await this.#config.google.exchange(code);
-        }
-        catch {
-            res.status(400).type('text/plain').send('Google authentication failed');
-            return;
-        }
-        if (this.#config.allowedEmailDomain &&
-            !identity.email.toLowerCase().endsWith(this.#config.allowedEmailDomain.toLowerCase()) &&
-            !(await this.#config.signupAuthorizer?.isSignupAllowed({
-                subject: identity.subject,
-                email: identity.email.toLowerCase(),
-            }))) {
-            res.status(403).type('text/plain').send('this Google account is not permitted');
-            return;
-        }
-        const preferences = storedOAuthOwnerPreferences(identity);
-        if (isDeveloperResourceForIssuer(pending.resource, this.#config.issuer)) {
-            if (this.#developerGrantFlow === undefined) {
-                res.status(400).type('text/plain').send('developer access is not configured');
-                return;
-            }
-            await this.#developerGrantFlow.renderSelection(pending, identity, res);
-            return;
-        }
-        // Remembered consent: if this human already approved this (client, subject, resource), skip the
-        // interstitial and issue the code directly — a re-authorizing client (e.g. ChatGPT, which does not persist
-        // its MCP session) never re-prompts the user. A new client or resource has no grant and still consents
-        // (ADR 0042 confused-deputy guard intact).
-        if (await this.#config.store.hasConsentGrant(pending.clientId, identity.subject, pending.resource)) {
-            await this.#tokenIssuer.issueAuthorizationCode(res, {
-                clientId: pending.clientId,
-                codeChallenge: pending.codeChallenge,
-                redirectUri: pending.redirectUri,
-                resource: pending.resource,
-                ownerSubject: identity.subject,
-                ownerEmail: identity.email,
-                ...preferences,
-                ...(pending.clientState !== undefined ? { clientState: pending.clientState } : {}),
-                ...(pending.scope !== undefined ? { scope: pending.scope } : {}),
-            });
-            return;
-        }
-        const consentToken = await this.#signConsent({
-            kind: 'consent',
-            clientId: pending.clientId,
-            redirectUri: pending.redirectUri,
-            codeChallenge: pending.codeChallenge,
-            resource: pending.resource,
-            ownerSubject: identity.subject,
-            ownerEmail: identity.email,
-            ...preferences,
-            ...(pending.clientState !== undefined ? { clientState: pending.clientState } : {}),
-            ...(pending.scope !== undefined ? { scope: pending.scope } : {}),
+        await this.#handleUpstreamCallback('google', req, res);
+    }
+    async handleWorkOSCallback(req, res) {
+        await this.#handleUpstreamCallback('workos', req, res);
+    }
+    async handleUpstreamProviderChoice(req, res) {
+        await continueUpstreamProviderChoice({
+            req,
+            res,
+            store: this.#config.store,
+            ...(this.#config.google === undefined ? {} : { google: this.#config.google }),
+            ...(this.#config.upstreamAuthenticators?.workos === undefined
+                ? {}
+                : { workos: this.#config.upstreamAuthenticators.workos }),
+        });
+    }
+    async #handleUpstreamCallback(upstreamProvider, req, res) {
+        await handleUpstreamHumanCallback({
+            provider: upstreamProvider,
+            req,
+            res,
+            store: this.#config.store,
+            issuer: this.#config.issuer,
+            ...(this.#config.google === undefined ? {} : { google: this.#config.google }),
+            ...(this.#config.upstreamAuthenticators?.workos === undefined
+                ? {}
+                : { workos: this.#config.upstreamAuthenticators.workos }),
+            ...(this.#config.platformPrincipalResolver === undefined
+                ? {}
+                : { resolver: this.#config.platformPrincipalResolver }),
+            ...(this.#config.signupAuthorizer === undefined
+                ? {}
+                : { signupAuthorizer: this.#config.signupAuthorizer }),
+            signupMode: this.#config.signupMode ?? 'restricted',
+            ...(this.#config.allowedEmailDomain === undefined
+                ? {}
+                : { allowedEmailDomain: this.#config.allowedEmailDomain }),
+            deniedSignupDomains: this.#config.deniedSignupDomains ?? [],
+            deniedSignupSubjects: this.#config.deniedSignupSubjects ?? [],
+            ...(this.#config.provisionPlatformPrincipal === undefined
+                ? {}
+                : { provisionPlatformPrincipal: this.#config.provisionPlatformPrincipal }),
+            ...(this.#developerGrantFlow === undefined
+                ? {}
+                : { developerGrantFlow: this.#developerGrantFlow }),
+            tokenIssuer: this.#tokenIssuer,
+            signConsent: (claims) => signConsentToken(claims, this.#config.signer, this.#config.issuer, this.#consentTtl),
+            logger: this.#logger,
+            now: this.#now,
         });
-        const client = await this.#config.store.getClient(pending.clientId);
-        res
-            .status(200)
-            .type('html')
-            .send(renderConsentPage({
-            clientName: client?.client_name ?? pending.clientId,
-            resourceHost: hostOf(pending.resource),
-            redirectHost: hostOf(pending.redirectUri),
-            userEmail: identity.email,
-            consentToken,
-            consentAction: CONSENT_PATH,
-        }));
     }
-    /** Consent decision: on approve, mint a PKCE-bound code and redirect to the client; on deny, redirect with an error. */
     async handleConsent(req, res) {
         const body = (req.body ?? {});
         const consentToken = typeof body.consent_token === 'string' ? body.consent_token : undefined;
@@ -396,7 +331,7 @@ export class NoodleOAuthProvider {
         }
         let claims;
         try {
-            claims = await this.#verifyConsent(consentToken);
+            claims = await verifyConsentToken(consentToken, this.#config.signer, this.#config.issuer);
         }
         catch {
             res.status(400).type('text/plain').send('invalid or expired consent');
@@ -410,7 +345,6 @@ export class NoodleOAuthProvider {
             res.redirect(302, redirect.href);
             return;
         }
-        // Remember this approval so a later authorization for the same (client, subject, resource) is silent.
         await this.#config.store.createConsentGrant({
             clientId: claims.clientId,
             ownerSubject: claims.ownerSubject,
@@ -436,7 +370,6 @@ export class NoodleOAuthProvider {
         }
         await this.#developerGrantFlow.handleDecision(req, res);
     }
-    /** Customer bridge callback: verify the tenant app's customer token and issue a normal OAuth code. */
     async handleFirebaseCustomerAuthorize(req, res) {
         const input = customerBridgeAuthorizeFields(req);
         const auth = input.resource !== undefined
@@ -456,7 +389,7 @@ export class NoodleOAuthProvider {
         const input = customerBridgeCallbackFields(req);
         const state = input.state;
         if (input.error !== undefined) {
-            await this.#redirectPendingError(res, state, input.error);
+            await this.#redirectPendingError(res, state, input.error, 'customer_firebase');
             return;
         }
         const idToken = input.id_token;
@@ -464,7 +397,7 @@ export class NoodleOAuthProvider {
             res.status(400).type('text/plain').send('missing state or id_token');
             return;
         }
-        const pending = await this.#config.store.consumePendingAuthorization(hashToken(state));
+        const pending = await this.#config.store.consumePendingAuthorization(hashToken(state), 'customer_firebase');
         if (!pending) {
             res.status(400).type('text/plain').send('unknown or expired authorization request');
             return;
@@ -511,7 +444,7 @@ export class NoodleOAuthProvider {
         const input = customerBridgeCallbackFields(req);
         const state = input.state;
         if (input.error !== undefined) {
-            await this.#redirectPendingError(res, state, input.error);
+            await this.#redirectPendingError(res, state, input.error, 'customer_microsoft');
             return;
         }
         const code = input.code;
@@ -519,7 +452,7 @@ export class NoodleOAuthProvider {
             res.status(400).type('text/plain').send('missing state or code');
             return;
         }
-        const pending = await this.#config.store.consumePendingAuthorization(hashToken(state));
+        const pending = await this.#config.store.consumePendingAuthorization(hashToken(state), 'customer_microsoft');
         if (!pending) {
             res.status(400).type('text/plain').send('unknown or expired authorization request');
             return;
@@ -585,22 +518,6 @@ export class NoodleOAuthProvider {
             identityProvider: 'microsoft',
         });
     }
-    async #signConsent(claims) {
-        const key = await this.#config.signer.signingKey();
-        return new SignJWT({ ...claims })
-            .setProtectedHeader({ alg: key.alg, kid: key.kid })
-            .setIssuer(this.#config.issuer)
-            .setIssuedAt()
-            .setExpirationTime(`${this.#consentTtl}s`)
-            .sign(key.privateKey);
-    }
-    async #verifyConsent(token) {
-        const getKey = await this.#config.signer.verifierKey();
-        const { payload } = await jwtVerify(token, getKey, { issuer: this.#config.issuer });
-        if (!isConsentClaims(payload))
-            throw new Error('not a consent token');
-        return payload;
-    }
     #verify() {
         if (!this.#verifier) {
             this.#verifier = createJwtVerifier({
@@ -610,7 +527,6 @@ export class NoodleOAuthProvider {
         }
         return this.#verifier;
     }
-    // A resolver that defers to the signer's public key on first use (the signer's key set is stable).
     #lazyKey = async (header, input) => {
         const getKey = await this.#config.signer.verifierKey();
         return getKey(header, input);
@@ -624,21 +540,14 @@ export class NoodleOAuthProvider {
             resourcePath: resourcePath(resource),
         });
     }
-    async #redirectPendingError(res, state, error) {
-        if (state === undefined) {
-            res.status(400).type('text/plain').send(`customer authorization failed: ${error}`);
-            return;
-        }
-        const pending = await this.#config.store.consumePendingAuthorization(hashToken(state));
-        if (!pending) {
-            res.status(400).type('text/plain').send('unknown or expired authorization request');
-            return;
-        }
-        const redirect = new URL(pending.redirectUri);
-        redirect.searchParams.set('error', error);
-        if (pending.clientState !== undefined)
-            redirect.searchParams.set('state', pending.clientState);
-        res.redirect(302, redirect.href);
+    async #redirectPendingError(res, state, error, callbackKind) {
+        return redirectPendingAuthorizationError({
+            store: this.#config.store,
+            res,
+            state,
+            error,
+            callbackKind,
+        });
     }
 }
 //# sourceMappingURL=provider.js.map