@noodleseed/one 0.63.1 → 0.65.0

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-postgres.js

@@ -0,0 +1,49 @@
+export async function ensurePlatformPrincipalSuspensionRefreshTrigger(pool) {
+    await pool.query(`
+    CREATE OR REPLACE FUNCTION platform_principal_suspension_revokes_refresh_tokens() RETURNS trigger AS $$
+    BEGIN
+      IF OLD.status = 'active' AND NEW.status = 'suspended' THEN
+        DELETE FROM oauth_refresh_tokens
+          WHERE owner_subject = NEW.principal_id AND identity_kind IS DISTINCT FROM 'customer';
+      END IF;
+      RETURN NEW;
+    END;
+    $$ LANGUAGE plpgsql
+  `);
+    await pool.query(`
+    DO $platform_principal_refresh_trigger$
+    BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_trigger
+        WHERE tgname = 'platform_principal_suspension_revokes_refresh_tokens_trigger'
+          AND tgrelid = 'platform_principals'::regclass AND NOT tgisinternal) THEN
+        CREATE TRIGGER platform_principal_suspension_revokes_refresh_tokens_trigger
+          AFTER UPDATE OF status ON platform_principals
+          FOR EACH ROW EXECUTE FUNCTION platform_principal_suspension_revokes_refresh_tokens();
+      END IF;
+    EXCEPTION WHEN duplicate_object THEN NULL;
+    END
+    $platform_principal_refresh_trigger$
+  `);
+}
+/** Serialize a platform refresh with suspension, but leave missing legacy principals compatible. */
+export async function lockAndAssertPlatformRefreshPrincipal(client, input) {
+    const hinted = await client.query('SELECT owner_subject, identity_kind FROM oauth_refresh_tokens WHERE token = $1 AND client_id = $2', [input.oldTokenHash, input.clientId]);
+    const hint = hinted.rows[0];
+    if (hint === undefined || hint.identity_kind === 'customer')
+        return 'continue';
+    await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [
+        `platform-principal:${hint.owner_subject}`,
+    ]);
+    const current = await client.query('SELECT owner_subject, identity_kind FROM oauth_refresh_tokens WHERE token = $1 AND client_id = $2 FOR UPDATE', [input.oldTokenHash, input.clientId]);
+    if (current.rows[0] === undefined)
+        return 'unknown';
+    const relation = await client.query("SELECT to_regclass('platform_principals')::text AS relation");
+    if (relation.rows[0]?.relation === null)
+        return 'continue';
+    const principal = await client.query('SELECT status FROM platform_principals WHERE principal_id = $1 FOR SHARE', [hint.owner_subject]);
+    if (principal.rows[0]?.status !== 'suspended')
+        return 'continue';
+    await client.query("DELETE FROM oauth_refresh_tokens WHERE owner_subject = $1 AND identity_kind IS DISTINCT FROM 'customer'", [hint.owner_subject]);
+    return 'suspended';
+}
+//# sourceMappingURL=platform-principal-postgres.js.map

package/node_modules/@noodle-borg/service/dist/oauth/platform-principal-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-principal-postgres.js","sourceRoot":"","sources":["../../src/oauth/platform-principal-postgres.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,KAAK,UAAU,+CAA+C,CAAC,IAAU;IAC9E,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;GAUhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;GAahB,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,MAAkB,EAClB,KAAmE;IAEnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,mGAAmG,EACnG,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CACrC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC/E,MAAM,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;QAC1E,sBAAsB,IAAI,CAAC,aAAa,EAAE;KAC3C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,8GAA8G,EAC9G,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,6DAA6D,CAC9D,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,0EAA0E,EAC1E,CAAC,IAAI,CAAC,aAAa,CAAC,CACrB,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACjE,MAAM,MAAM,CAAC,KAAK,CAChB,yGAAyG,EACzG,CAAC,IAAI,CAAC,aAAa,CAAC,CACrB,CAAC;IACF,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/postgres-time.d.ts

@@ -0,0 +1,3 @@
+export declare function postgresEpochSeconds(date: Date): number;
+export declare function postgresTimestampIsLive(expiresAt: Date): boolean;
+//# sourceMappingURL=postgres-time.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/postgres-time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-time.d.ts","sourceRoot":"","sources":["../../src/oauth/postgres-time.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAEhE"}

package/node_modules/@noodle-borg/service/dist/oauth/postgres-time.js

@@ -0,0 +1,7 @@
+export function postgresEpochSeconds(date) {
+    return Math.floor(new Date(date).getTime() / 1000);
+}
+export function postgresTimestampIsLive(expiresAt) {
+    return new Date(expiresAt).getTime() > Date.now();
+}
+//# sourceMappingURL=postgres-time.js.map

package/node_modules/@noodle-borg/service/dist/oauth/postgres-time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-time.js","sourceRoot":"","sources":["../../src/oauth/postgres-time.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,IAAU;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAe;IACrD,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/provider.d.ts

@@ -5,82 +5,77 @@ import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthToke
 import { type SigningKeyProvider, type VerifiedIdentity } from '@noodle-borg/auth';
 import { type Logger } from '@noodle-borg/transport-http';
 import type { Request, Response } from 'express';
-import type { SignupAuthorizer } from '../auth/deploy-gate.js';
+import type { ControlPlaneSignupMode, SignupAuthorizer } from '../auth/deploy-gate.js';
+import type { PlatformPrincipalResolver } from '../platform-identity.js';
 import type { SecretEnvelope, TenantBridgeAuthConfig } from '../store.js';
 import type { DeveloperGrantAuthorizer } from './developer-grant-authorizer.js';
 import { DeviceAuthorizationFlow } from './device-flow.js';
 import type { DeviceAuthorizationRecord, DeviceBrowserSessionRecord } from './device-store.js';
 import type { GoogleAuthenticator } from './google.js';
 import type { OAuthStore } from './store.js';
+import { handleUpstreamHumanCallback } from './upstream-callback-handler.js';
+import type { UpstreamHumanOAuthAuthenticator, UpstreamHumanRollout } from './upstream-human.js';
+import type { UpstreamHumanRolloutStore } from './upstream-rollout-store.js';
 export interface NoodleOAuthProviderConfig {
-    /** The authorization server issuer (its public origin, e.g. `https://cloud.noodleseed.dev`). */
     readonly issuer: string;
     readonly store: OAuthStore;
     readonly signer: SigningKeyProvider;
-    readonly google: GoogleAuthenticator;
-    /** When set, only users whose email ends with this domain may authorize (alpha gate, e.g. `@noodleseed.com`). */
+    readonly google?: GoogleAuthenticator;
+    readonly upstreamAuthenticators?: Readonly<{
+        readonly workos?: UpstreamHumanOAuthAuthenticator;
+    }>;
+    readonly upstreamRollout?: UpstreamHumanRollout;
+    readonly upstreamRolloutStore?: UpstreamHumanRolloutStore;
+    readonly platformPrincipalResolver?: PlatformPrincipalResolver;
     readonly allowedEmailDomain?: string;
+    readonly signupMode?: ControlPlaneSignupMode;
     readonly signupAuthorizer?: SignupAuthorizer;
+    readonly deniedSignupDomains?: readonly string[];
+    readonly deniedSignupSubjects?: readonly string[];
+    /** Idempotently establishes platform-owned account state before any Noodle credential is issued. */
+    readonly provisionPlatformPrincipal?: NoodlePlatformPrincipalProvisioner;
     readonly developerGrantAuthorizer?: DeveloperGrantAuthorizer;
-    /** Compatibility hook for OAuth clients that cannot send RFC 8707 `resource` during authorization. */
     readonly defaultResourceForClient?: (client: OAuthClientInformationFull) => string | undefined;
-    /** Resolve bridge auth for a resource-bound tenant MCP URL, when the deployment uses Noodle-managed bridge auth. */
     readonly customerBridgeAuthForResource?: (resource: string) => Promise<TenantBridgeAuthConfig | undefined>;
-    /** Verify the upstream customer credential returned by the tenant app before Noodle issues an MCP token. */
     readonly verifyCustomerBridgeToken?: (auth: TenantBridgeAuthConfig, token: string) => Promise<VerifiedIdentity | null>;
     readonly managedSecretForResource?: (resource: string, name: string) => Promise<string | undefined>;
     readonly sealCustomerCredential?: (credential: string) => Promise<SecretEnvelope>;
     readonly fetchImpl?: typeof fetch;
     readonly accessTokenTtlSeconds?: number;
     readonly refreshTokenTtlSeconds?: number;
-    /** Benign retry/concurrency window after refresh-token rotation. Default 30 seconds. */
     readonly refreshTokenGraceSeconds?: number;
-    /** Recovery window for stale refresh tokens when the successor was never used. */
     readonly refreshTokenRecoverySeconds?: number;
     readonly authCodeTtlSeconds?: number;
     readonly pendingTtlSeconds?: number;
     readonly consentTtlSeconds?: number;
     readonly logger?: Logger;
-    /** Clock injection (epoch ms), for deterministic time in tests. Defaults to `Date.now`. */
     readonly now?: () => number;
 }
-/** Self-hosted OAuth authorization server provider (OA-2, ADR 0042). */
 export declare class NoodleOAuthProvider implements OAuthServerProvider {
     #private;
     constructor(config: NoodleOAuthProviderConfig);
     get clientsStore(): OAuthRegisteredClientsStore;
     get deviceAuthorizationFlow(): DeviceAuthorizationFlow;
-    /** Begin authorization: persist the pending request and redirect the user to "Sign in with Google". */
     authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
-    /** Return the stored PKCE challenge for a code (non-destructive — the SDK validates the verifier against it). */
     challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
-    /** Redeem an authorization code (single-use) and mint the owner's tokens. PKCE was validated by the SDK. */
     exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
-    /** Complete the server-owned authorization-code bridge used by the RFC 8628 verification page. */
     completeDeviceAuthorization(session: DeviceBrowserSessionRecord, authorizationCode: string): Promise<boolean>;
-    /** Mint normal access/refresh tokens after the device authorization has been approved and consumed. */
     issueDeviceTokens(record: DeviceAuthorizationRecord): Promise<OAuthTokens>;
-    /** Rotate a refresh token with grace/recovery handling for concurrent or retried refreshes. */
     exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, _scopes?: string[], resource?: URL): Promise<OAuthTokens>;
-    /** Verify an access token (issuer/signature/expiry). Provided for interface completeness — the data-plane
-     * resource server verifies with its own audience-bound verifier; this is not on the AS request path. */
     verifyAccessToken(token: string): Promise<AuthInfo>;
-    /** RFC 7009 revocation also invalidates the exact developer grant bound to this client token. */
     revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
-    /** RFC 8414 authorization-server metadata (plus our `jwks_uri`), served at `/.well-known/oauth-authorization-server`. */
     metadata(): Record<string, unknown>;
-    /** The public JWKS the resource server (and external validators) read to verify access tokens. */
     jwks(): Promise<{
         keys: unknown[];
     }>;
-    /** Google callback: consume the pending auth, verify the Google identity, and render the consent page. */
     handleGoogleCallback(req: Request, res: Response): Promise<void>;
-    /** Consent decision: on approve, mint a PKCE-bound code and redirect to the client; on deny, redirect with an error. */
+    handleWorkOSCallback(req: Request, res: Response): Promise<void>;
+    handleUpstreamProviderChoice(req: Request, res: Response): Promise<void>;
     handleConsent(req: Request, res: Response): Promise<void>;
     handleDeveloperGrant(req: Request, res: Response): Promise<void>;
-    /** Customer bridge callback: verify the tenant app's customer token and issue a normal OAuth code. */
     handleFirebaseCustomerAuthorize(req: Request, res: Response): Promise<void>;
     handleFirebaseCustomerCallback(req: Request, res: Response): Promise<void>;
     handleMicrosoftCustomerCallback(req: Request, res: Response): Promise<void>;
 }
+export type NoodlePlatformPrincipalProvisioner = NonNullable<Parameters<typeof handleUpstreamHumanCallback>[0]['provisionPlatformPrincipal']>;
 //# sourceMappingURL=provider.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAMpG,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAE3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAU1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAkB,MAAM,aAAa,CAAC;AAkBvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAa7C,MAAM,WAAW,yBAAyB;IACxC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,iHAAiH;IACjH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D,sGAAsG;IACtG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/F,oHAAoH;IACpH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CACvC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,wFAAwF;IACxF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,wEAAwE;AACxE,qBAAa,mBAAoB,YAAW,mBAAmB;;gBAgBjD,MAAM,EAAE,yBAAyB;IAuC7C,IAAI,YAAY,IAAI,2BAA2B,CAQ9C;IAED,IAAI,uBAAuB,IAAI,uBAAuB,CAErD;IAED,uGAAuG;IACjG,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IA4ChB,iHAAiH;IAC3G,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAQlB,4GAA4G;IACtG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAsCvB,kGAAkG;IAC5F,2BAA2B,CAC/B,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,OAAO,CAAC;IASnB,uGAAuG;IACvG,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;IAI1E,+FAA+F;IACzF,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA4DvB;4GACwG;IAClG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAWzD,iGAAiG;IAC3F,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAiBhB,yHAAyH;IACzH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAmBnC,kGAAkG;IAClG,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAIpC,0GAA0G;IACpG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2FtE,wHAAwH;IAClH,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0CzD,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE,sGAAsG;IAChG,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3E,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0D1E,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAgJlF"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oauth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAMpG,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAU1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAmBvD,OAAO,KAAK,EAAE,UAAU,EAAoC,MAAM,YAAY,CAAC;AAG/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EACV,+BAA+B,EAE/B,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAU7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,QAAQ,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAA;KAAE,CAAC,CAAC;IAClG,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IAC1D,QAAQ,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,oGAAoG;IACpG,QAAQ,CAAC,0BAA0B,CAAC,EAAE,kCAAkC,CAAC;IACzE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CACvC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CACnC,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,mBAAoB,YAAW,mBAAmB;;gBAgBjD,MAAM,EAAE,yBAAyB;IAsC7C,IAAI,YAAY,IAAI,2BAA2B,CAQ9C;IACD,IAAI,uBAAuB,IAAI,uBAAuB,CAErD;IACK,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAgCV,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAOZ,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAqCjB,2BAA2B,CAC/B,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,OAAO,CAAC;IAQnB,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,WAAW,CAAC;IAGpE,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAoEjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAUnD,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAchB,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAInC,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAG9B,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAGhE,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAGhE,4BAA4B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAmDxE,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCzD,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhE,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3E,8BAA8B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA4D1E,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAuHlF;AAED,MAAM,MAAM,kCAAkC,GAAG,WAAW,CAC1D,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAChF,CAAC"}