@oaath/server 0.1.0 → 0.3.1

package/dist/index.d.ts

@@ -1,81 +1,7 @@
-import { i as RelayClock, n as RelayCaller, r as RelayCallerRole, t as RelayAuthentication } from "./authentication-HUYWk5Y2.js";
-import { a as AuthorizationDecisionRecord, c as OAATH_AUTHORIZATION_CODE_RECORD_VERSION, d as OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, i as AuthorizationDecisionOutcome, l as OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, n as RelayTransaction, o as AuthorizationRequestRecord, r as AuthorizationCodeRecord, s as EncryptedArtifactRecord, t as RelayStore, u as OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION } from "./interface-WwvwWs8e.js";
-import { a as RelayKms, i as submitAuthorizationDecision, n as SubmitAuthorizationDecisionInput, r as SubmittedAuthorizationDecision, t as AuthorizationDecisionCommand } from "./decision-dEe9n108.js";
-//#region src/relay/errors.d.ts
-/**
- * Closed relay failure codes and their stable HTTP projection.
- *
- * Machine decisions and wire responses use these codes only. `Error.message`
- * exists for local diagnostics and never reaches a response body.
- *
- * @author taek <leekt216@gmail.com>
- */
-type RelayErrorCode =
-/** Wire input is missing, malformed, oversized, or contains unknown fields. */
-"relay_request_invalid" |
-/** The deployment authentication port did not authenticate the caller. */
-"relay_unauthenticated" |
-/** Authenticated caller may not act in the required role. */
-"relay_forbidden" |
-/** Route, or a record the caller is entitled to see, does not exist. */
-"relay_not_found" |
-/** Route exists with a different method. */
-"relay_method_not_allowed" |
-/** The authorization request or code is past its injected-clock expiry. */
-"relay_expired" |
-/** The authorization request already reached a terminal decision. */
-"relay_already_decided" |
-/** The one-time authorization code was already consumed. */
-"relay_code_already_consumed" |
-/** The one-time encrypted artifact was already claimed. */
-"relay_artifact_already_claimed" |
-/**
- * Authorization code redemption failed. One code for every reason it can
- * fail — unknown code, another client's code, wrong redirect URI, wrong PKCE
- * verifier — so the endpoint never confirms that a guessed code was correct.
- * A code that existed is burned.
- */
-"relay_code_invalid" |
-/** The optional deployment limiter rejected the call. */
-"relay_rate_limited" |
-/** A durable record could not be read as the current schema version. */
-"relay_record_unreadable" |
-/** The KMS port was unavailable or returned an unusable result. */
-"relay_kms_unavailable" |
-/** The store failed before any state change could have been committed. */
-"relay_store_unavailable" |
-/**
- * The store could not prove whether a transition committed. The caller must
- * treat the transition as neither applied nor retryable: an ambiguous commit
- * never authorizes resubmission.
- */
-"relay_state_ambiguous" |
-/**
- * EXPERIMENTAL PREVIEW (`@oaath/server/apns`): the constructed APNs payload
- * exceeded Apple's 4096-byte limit, so nothing was sent.
- */
-"relay_apns_payload_too_large" |
-/**
- * EXPERIMENTAL PREVIEW (`@oaath/server/apns`): the injected Apple credential
- * capability is not a usable P-256 signing key, key id, team id, or topic.
- */
-"relay_apns_credentials_invalid" |
-/** A deployment-injected chain execution port failed or answered unusably. */
-"relay_chain_unavailable" |
-/** The Grant's capability is durably invalidated; nothing more executes here. */
-"relay_capability_invalidated" |
-/** An invariant the relay owns was violated. */
-"relay_internal";
-/**
- * Status projection. `relay_state_ambiguous` is deliberately 500 and not 503,
- * because 503 invites the retry that an ambiguous commit forbids.
- */
-declare const RELAY_ERROR_STATUS: Readonly<Record<RelayErrorCode, number>>;
-declare class OaathRelayError extends Error {
-  readonly code: RelayErrorCode;
-  constructor(code: RelayErrorCode, message: string);
-}
-//#endregion
+import { _ as OAATH_REVOCATION_REQUEST_RECORD_VERSION, a as AuthorizationDecisionRecord, b as RelayClock, c as EncryptedArtifactRecord, d as OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, f as OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, g as OAATH_REVOCATION_DECISION_RECORD_VERSION, h as RelayErrorCode, i as AuthorizationDecisionOutcome, l as OAATH_AUTHORIZATION_CODE_RECORD_VERSION, m as RELAY_ERROR_STATUS, n as RelayTransaction, o as AuthorizationOwnerRoute, p as OaathRelayError, r as AuthorizationCodeRecord, s as AuthorizationRequestRecord, t as RelayStore, u as OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, v as RevocationDecisionRecord, y as RevocationRequestRecord } from "./interface-DHpwP0wr.js";
+import { h as RelayCallerRole, m as RelayCaller, p as RelayAuthentication } from "./projection-B7IB9irs.js";
+import { t as RelayKms } from "./kms-BWkywdJM.js";
+import { $ as FetchAuthorizationRequestInput, G as DirectoryOwnerDevice, H as DirectoryAccount, J as OAATH_SERVICE_DIRECTORY_VERSION, K as DirectorySelection, Q as CreatedAuthorizationRequest, U as DirectoryApplication, W as DirectoryMembership, X as AuthorizationState, Y as ServiceDirectoryDocument, Z as CreateAuthorizationRequestInput, _ as SessionSignerIdentity, a as createMemoryServiceDirectoryStore, at as SubmittedAuthorizationDecision, b as RelayRateLimitInput, c as RelayBootstrapSelection, d as RelayPaymasterServiceConfiguration, et as RelayOwnerRouting, f as RelayPaymasterServiceProvider, g as RelaySessionSignerProvider, h as createRelayHandler, i as ServiceDirectoryStore, it as SubmitAuthorizationDecisionInput, l as RelayHandler, m as RelaySessionSignerConfiguration, n as ServiceDirectory, nt as fetchAuthorizationRequest, o as createServiceDirectory, ot as submitAuthorizationDecision, p as RelayPaymasterServiceRequest, q as DirectoryWorkspace, r as ServiceDirectorySnapshot, rt as AuthorizationDecisionCommand, s as RelayBootstrapConfiguration, t as EnrollOwnerDeviceInput, tt as createAuthorizationRequest, u as RelayHandlerOptions, v as SessionSignerSignRequest, x as RelayRateLimiter, y as createKmsSessionSignerProvider } from "./service-J51bOVe6.js";
 //#region src/artifact/claim.d.ts
 interface ClaimEncryptedArtifactInput {
   readonly store: RelayStore;
@@ -98,7 +24,10 @@ declare function claimEncryptedArtifact(input: ClaimEncryptedArtifactInput): Pro
  * A port that echoes plaintext is rejected: the store must never hold it.
  */
 declare function sealArtifact(kms: RelayKms, plaintext: string): Promise<string>;
-/** Opens a reference this KMS previously sealed. Called only after the claim commits. */
+/**
+ * Opens retained ciphertext for an authorized internal reader. Client release
+ * calls this only after claim commits; authority verification releases no bytes.
+ */
 declare function openArtifact(kms: RelayKms, ciphertextRef: string): Promise<string>;
 //#endregion
 //#region src/authorization/challenge.d.ts
@@ -127,44 +56,6 @@ interface ConsumedAuthorizationCode {
 }
 declare function consumeAuthorizationCode(input: ConsumeAuthorizationCodeInput): Promise<ConsumedAuthorizationCode>;
 //#endregion
-//#region src/authorization/request.d.ts
-interface CreateAuthorizationRequestInput {
-  readonly store: RelayStore;
-  readonly clock: RelayClock;
-  /** Authenticated `client` caller; it owns `clientId` and `subject`. */
-  readonly caller: RelayCaller;
-  readonly redirectUri: string;
-  readonly codeChallenge: string;
-  readonly requestedScope: string;
-  readonly requestTtlMs: number;
-}
-interface CreatedAuthorizationRequest {
-  readonly requestId: string;
-  readonly expiresAt: number;
-}
-interface AuthorizationState {
-  readonly requestId: string;
-  readonly clientId: string;
-  readonly redirectUri: string;
-  readonly requestedScope: string;
-  readonly expiresAt: number;
-  readonly expired: boolean;
-  readonly decision: Readonly<{
-    outcome: AuthorizationDecisionOutcome;
-    decidedAt: number;
-  }> | null;
-}
-declare function createAuthorizationRequest(input: CreateAuthorizationRequestInput): Promise<CreatedAuthorizationRequest>;
-interface FetchAuthorizationRequestInput {
-  readonly store: RelayStore;
-  readonly clock: RelayClock;
-  /** Authenticated `owner` caller; only the bound subject may read the request. */
-  readonly caller: RelayCaller;
-  readonly requestId: string;
-}
-/** Read for the approving owner. */
-declare function fetchAuthorizationRequest(input: FetchAuthorizationRequestInput): Promise<AuthorizationState>;
-//#endregion
 //#region src/authorization/resume.d.ts
 interface ResumeAuthorizationInput {
   readonly store: RelayStore;
@@ -175,143 +66,6 @@ interface ResumeAuthorizationInput {
 }
 declare function resumeAuthorization(input: ResumeAuthorizationInput): Promise<AuthorizationState>;
 //#endregion
-//#region src/security/rate-limit.d.ts
-/**
- * Optional deployment-owned limiter port.
- *
- * There is no default limiter: an unset port means no limiting, and the relay
- * never invents a policy the deployment did not choose. A limiter that fails is
- * treated as `limited`, because an unreadable limiter is not permission.
- *
- * @author taek <leekt216@gmail.com>
- */
-interface RelayRateLimitInput {
-  /** Stable route name, never a credential-bearing URL. */
-  readonly route: string;
-  readonly clientId: string | null;
-}
-interface RelayRateLimiter {
-  /** Resolves to `"allowed"` or `"limited"`. Anything else is `limited`. */
-  check(input: RelayRateLimitInput): Promise<unknown>;
-}
-//#endregion
-//#region src/session-signer/kms-provider.d.ts
-interface SessionSignerIdentity {
-  readonly clientId: string;
-  readonly subject: string;
-  readonly deviceId: string;
-}
-interface SessionSignerSignRequest extends SessionSignerIdentity {
-  /** The exact 32-byte hash to sign; never a message to interpret. */
-  readonly hash: `0x${string}`;
-}
-interface RelaySessionSignerProvider {
-  /**
-   * The operator credential for one authenticated identity, creating the key
-   * on first use. Idempotent: the same identity always answers the same
-   * credential.
-   */
-  readonly credential: (request: Readonly<SessionSignerIdentity>) => Promise<unknown>;
-  /** One ECDSA signature over one exact hash, under that identity's key. */
-  readonly sign: (request: Readonly<SessionSignerSignRequest>) => Promise<unknown>;
-}
-declare function createKmsSessionSignerProvider(input: {
-  readonly kms: RelayKms;
-}): RelaySessionSignerProvider;
-//#endregion
-//#region src/relay/handler.d.ts
-/**
- * One deployment-injected chain execution surface the relay serves to clients.
- * Each port takes exactly one captured request value and answers with the
- * evidence it owns; the relay never interprets the payload beyond exact wire
- * hygiene, so port meaning stays with its SDK owner.
- */
-interface RelayChainPort {
-  readonly chainId: number;
-  readonly reads: (request: unknown) => Promise<unknown>;
-  readonly observation: (request: unknown) => Promise<unknown>;
-  readonly bundler: (request: unknown) => Promise<unknown>;
-  readonly quote: (request: unknown) => Promise<unknown>;
-  /** Opens, sends, and settles one submission in one call; never retried here. */
-  readonly submission: (request: unknown) => Promise<unknown>;
-  /** Finalized per-grant usage evidence, or null when this chain serves none. */
-  readonly usage: ((request: unknown) => Promise<unknown>) | null;
-  readonly feePayer: Readonly<{
-    address: `0x${string}`;
-    balance: string;
-  }> | null;
-  /** Authenticated commitment to one exact ERC-7902 static paymaster, or null. */
-  readonly staticPaymasterConfigurationHash: `0x${string}` | null;
-}
-/** The identity facts `GET /bootstrap` serves; chains derive from `chains`. */
-interface RelayBootstrapConfiguration {
-  readonly application: unknown;
-  readonly userHandle: string;
-  readonly account: unknown;
-  readonly ownerValidator: `0x${string}` | null;
-}
-/**
- * Remote session-key custody, declared once for the deployment: the mode and
- * provider identity are served through the bootstrap document, and the same
- * provider answers the `/session-signers` routes. For `oaath_hosted` the
- * provider is typically `createKmsSessionSignerProvider`; for
- * `application_backend` it is the deployment's own authenticated port to the
- * integrating application's signer — never a client-supplied endpoint.
- */
-interface RelaySessionSignerConfiguration {
-  readonly mode: "application_backend" | "oaath_hosted";
-  readonly providerId: string;
-  readonly provider: Readonly<RelaySessionSignerProvider>;
-}
-/** Authenticated identity and one opaque ERC-7677 params tuple. */
-interface RelayPaymasterServiceRequest {
-  readonly caller: Readonly<{
-    clientId: string;
-    subject: string;
-  }>;
-  readonly params: unknown;
-  readonly signal: AbortSignal;
-}
-/**
- * One deployment-owned paymaster provider. The relay exposes only these two
- * closed ERC-7677 operations and invokes the selected method once.
- */
-interface RelayPaymasterServiceProvider {
-  readonly getPaymasterStubData: (request: Readonly<RelayPaymasterServiceRequest>) => Promise<unknown>;
-  readonly getPaymasterData: (request: Readonly<RelayPaymasterServiceRequest>) => Promise<unknown>;
-}
-interface RelayPaymasterServiceConfiguration {
-  readonly chainId: number;
-  readonly providerId: string;
-  /** Hard response deadline; the provider also receives its abort signal. */
-  readonly requestTimeoutMs: number;
-  readonly provider: Readonly<RelayPaymasterServiceProvider>;
-}
-interface RelayHandlerOptions {
-  readonly store: RelayStore;
-  readonly authentication: RelayAuthentication;
-  readonly kms: RelayKms;
-  readonly clock: RelayClock;
-  /** Optional. There is no default limiter. */
-  readonly rateLimit?: RelayRateLimiter;
-  readonly requestTtlMs?: number;
-  readonly codeTtlMs?: number;
-  readonly maxBodyBytes?: number;
-  /** Optional URL-only bootstrap surface; requires `chains` as well. */
-  readonly bootstrap?: Readonly<RelayBootstrapConfiguration>;
-  /** Optional chain execution relays; required when `bootstrap` is served. */
-  readonly chains?: readonly Readonly<RelayChainPort>[];
-  /** Optional remote session-key custody; requires `bootstrap` as well. */
-  readonly sessionSigner?: Readonly<RelaySessionSignerConfiguration>;
-  /**
-   * Optional deployment-owned paymaster services, at most one per chain.
-   * Configuration requires both bootstrap and a deployment rate limiter.
-   */
-  readonly paymasterServices?: readonly Readonly<RelayPaymasterServiceConfiguration>[];
-}
-type RelayHandler = (request: Request) => Promise<Response>;
-declare function createRelayHandler(options: RelayHandlerOptions): RelayHandler;
-//#endregion
 //#region src/security/redact.d.ts
 /**
  * Bounded credential and URL redaction for diagnostics only.
@@ -331,5 +85,5 @@ declare function redactForLog(value: unknown): unknown;
 //#region src/store/memory.d.ts
 declare function createMemoryRelayStore(): RelayStore;
 //#endregion
-export { type AuthorizationCodeRecord, type AuthorizationDecisionCommand, type AuthorizationDecisionOutcome, type AuthorizationDecisionRecord, type AuthorizationRequestRecord, type AuthorizationState, type ClaimEncryptedArtifactInput, type ClaimedEncryptedArtifact, type ConsumeAuthorizationCodeInput, type ConsumedAuthorizationCode, type CreateAuthorizationRequestInput, type CreatedAuthorizationRequest, type EncryptedArtifactRecord, type FetchAuthorizationRequestInput, OAATH_AUTHORIZATION_CODE_RECORD_VERSION, OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, OaathRelayError, REDACTED, RELAY_ERROR_STATUS, type RelayAuthentication, type RelayCaller, type RelayCallerRole, type RelayClock, type RelayErrorCode, type RelayHandler, type RelayHandlerOptions, type RelayKms, type RelayPaymasterServiceConfiguration, type RelayPaymasterServiceProvider, type RelayPaymasterServiceRequest, type RelayRateLimitInput, type RelayRateLimiter, type RelaySessionSignerConfiguration, type RelaySessionSignerProvider, type RelayStore, type RelayTransaction, type ResumeAuthorizationInput, type SessionSignerIdentity, type SessionSignerSignRequest, type SubmitAuthorizationDecisionInput, type SubmittedAuthorizationDecision, claimEncryptedArtifact, consumeAuthorizationCode, createAuthorizationRequest, createKmsSessionSignerProvider, createMemoryRelayStore, createRelayHandler, fetchAuthorizationRequest, isCodeChallengeS256, openArtifact, redactForLog, redactUrl, resumeAuthorization, sealArtifact, submitAuthorizationDecision, verifyPkceS256 };
+export { type AuthorizationCodeRecord, type AuthorizationDecisionCommand, type AuthorizationDecisionOutcome, type AuthorizationDecisionRecord, type AuthorizationOwnerRoute, type AuthorizationRequestRecord, type AuthorizationState, type ClaimEncryptedArtifactInput, type ClaimedEncryptedArtifact, type ConsumeAuthorizationCodeInput, type ConsumedAuthorizationCode, type CreateAuthorizationRequestInput, type CreatedAuthorizationRequest, type DirectoryAccount, type DirectoryApplication, type DirectoryMembership, type DirectoryOwnerDevice, type DirectorySelection, type DirectoryWorkspace, type EncryptedArtifactRecord, type EnrollOwnerDeviceInput, type FetchAuthorizationRequestInput, OAATH_AUTHORIZATION_CODE_RECORD_VERSION, OAATH_AUTHORIZATION_DECISION_RECORD_VERSION, OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION, OAATH_REVOCATION_DECISION_RECORD_VERSION, OAATH_REVOCATION_REQUEST_RECORD_VERSION, OAATH_SERVICE_DIRECTORY_VERSION, OaathRelayError, REDACTED, RELAY_ERROR_STATUS, type RelayAuthentication, type RelayBootstrapConfiguration, type RelayBootstrapSelection, type RelayCaller, type RelayCallerRole, type RelayClock, type RelayErrorCode, type RelayHandler, type RelayHandlerOptions, type RelayKms, type RelayOwnerRouting, type RelayPaymasterServiceConfiguration, type RelayPaymasterServiceProvider, type RelayPaymasterServiceRequest, type RelayRateLimitInput, type RelayRateLimiter, type RelaySessionSignerConfiguration, type RelaySessionSignerProvider, type RelayStore, type RelayTransaction, type ResumeAuthorizationInput, type RevocationDecisionRecord, type RevocationRequestRecord, type ServiceDirectory, type ServiceDirectoryDocument, type ServiceDirectorySnapshot, type ServiceDirectoryStore, type SessionSignerIdentity, type SessionSignerSignRequest, type SubmitAuthorizationDecisionInput, type SubmittedAuthorizationDecision, claimEncryptedArtifact, consumeAuthorizationCode, createAuthorizationRequest, createKmsSessionSignerProvider, createMemoryRelayStore, createMemoryServiceDirectoryStore, createRelayHandler, createServiceDirectory, fetchAuthorizationRequest, isCodeChallengeS256, openArtifact, redactForLog, redactUrl, resumeAuthorization, sealArtifact, submitAuthorizationDecision, verifyPkceS256 };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/relay/errors.ts","../src/artifact/claim.ts","../src/artifact/encrypt.ts","../src/authorization/challenge.ts","../src/authorization/code.ts","../src/authorization/request.ts","../src/authorization/resume.ts","../src/security/rate-limit.ts","../src/session-signer/kms-provider.ts","../src/relay/handler.ts","../src/security/redact.ts","../src/store/memory.ts"],"mappings":";;;;;;;;;;;;KASY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6DC,oBAAoB,SAAS,OAAO;cAyBpC,wBAAwB;WAC1B,MAAM;EAEf,YAAY,MAAM,gBAAgB;;;;UC1EnB;WACN,OAAO;WACP,OAAO;WACP,KAAK;;WAEL,QAAQ;;WAER;;UAGM;WACN;WACA;;iBAGW,uBACpB,OAAO,8BACN,QAAQ;;;;;;;iBCzBW,aAAa,KAAK,UAAU,oBAAoB;;iBAoBhD,aAAa,KAAK,UAAU,wBAAwB;;;;;;;iBCgBpD,eACpB,sBACA,8BACC;;iBAMa,oBAAoB;;;UChCnB;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;WACA;WACA;;UAGM;WACN;;WAEA;;iBAOW,yBACpB,OAAO,gCACN,QAAQ;;;UC9BM;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;WACA;WACA;WACA;;UAGM;WACN;WACA;;UAGM;WACN;WACA;WACA;WACA;WACA;WACA;WACA,UAAU;IACjB,SAAS;IACT;;;iBAIkB,2BACpB,OAAO,kCACN,QAAQ;UA8DM;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;;;iBAIK,0BACd,OAAO,iCACN,QAAQ;;;UC7GM;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;;iBAGK,oBAAoB,OAAO,2BAA2B,QAAQ;;;;;;;;;;;;UCZ7D;;WAEN;WACA;;UAGM;;EAEf,MAAM,OAAO,sBAAsB;;;;UCWpB;WACN;WACA;WACA;;UAGM,iCAAiC;;WAEvC;;UAGM;;;;;;WAMN,aAAa,SAAS,SAAS,2BAA2B;;WAE1D,OAAO,SAAS,SAAS,8BAA8B;;iBAkBlD,+BAA+B;WACpC,KAAK;IACZ;;;;;;;;;UC6Ba;WACN;WACA,QAAQ,qBAAqB;WAC7B,cAAc,qBAAqB;WACnC,UAAU,qBAAqB;WAC/B,QAAQ,qBAAqB;;WAE7B,aAAa,qBAAqB;;WAElC,SAAS,qBAAqB;WAC9B,UAAU;IAAW;IAAwB;;;WAE7C;;;UAIM;WACN;WACA;WACA;WACA;;;;;;;;;;UAWM;WACN;WACA;WACA,UAAU,SAAS;;;UAIb;WACN,QAAQ;IAAW;IAAkB;;WACrC;WACA,QAAQ;;;;;;UAOF;WACN,uBACP,SAAS,SAAS,kCACf;WACI,mBAAmB,SAAS,SAAS,kCAAkC;;UAGjE;WACN;WACA;;WAEA;WACA,UAAU,SAAS;;UAGb;WACN,OAAO;WACP,gBAAgB;WAChB,KAAK;WACL,OAAO;;WAEP,YAAY;WACZ;WACA;WACA;;WAEA,YAAY,SAAS;;WAErB,kBAAkB,SAAS;;WAE3B,gBAAgB,SAAS;;;;;WAKzB,6BAA6B,SAAS;;KAGrC,gBAAgB,SAAS,YAAY,QAAQ;iBAoazC,mBAAmB,SAAS,sBAAsB;;;;;;;;;;;;cCnlBrD;;iBAiDG,UAAU;;iBA+DV,aAAa;;;iBCnDb,0BAA0B"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/artifact/claim.ts","../src/artifact/encrypt.ts","../src/authorization/challenge.ts","../src/authorization/code.ts","../src/authorization/resume.ts","../src/security/redact.ts","../src/store/memory.ts"],"mappings":";;;;;UAwBiB;WACN,OAAO;WACP,OAAO;WACP,KAAK;;WAEL,QAAQ;;WAER;;UAGM;WACN;WACA;;iBAGW,uBACpB,OAAO,8BACN,QAAQ;;;;;;;iBCzBW,aAAa,KAAK,UAAU,oBAAoB;;;;;iBAuBhD,aAAa,KAAK,UAAU,wBAAwB;;;;;;;iBCapD,eACpB,sBACA,8BACC;;iBAMa,oBAAoB;;;UChCnB;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;WACA;WACA;;UAGM;WACN;;WAEA;;iBAOW,yBACpB,OAAO,gCACN,QAAQ;;;UCnCM;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;;iBAGK,oBAAoB,OAAO,2BAA2B,QAAQ;;;;;;;;;;;;cCdjE;;iBAiDG,UAAU;;iBA+DV,aAAa;;;iBC7Bb,0BAA0B"}