@portel/photon 1.22.0 → 1.23.0

package/dist/serv/auth/well-known.js

@@ -51,37 +51,186 @@ export function generateAuthServerMetadata(config, tenant) {
             'client_secret_post',
             'none', // For public clients
         ],
+        // Draft extension: signals this AS accepts CIMD-style HTTPS client_ids.
+        // Not yet standardised in RFC 8414, but MCP-spec-aligned.
+        client_id_metadata_document_supported: true,
     };
 }
+const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1h fallback when no Cache-Control
 /**
- * Fetch and validate a Client ID Metadata Document
+ * Resolve a CIMD client_id to its metadata document with full validation,
+ * caching, and domain-allowlist enforcement.
  */
-export async function fetchClientMetadata(clientId) {
-    // Client ID should be a URL for CIMD
+export async function resolveClientMetadata(clientId, opts = {}) {
     if (!clientId.startsWith('https://')) {
-        return null;
+        return {
+            ok: false,
+            error: 'not_https',
+            errorDescription: 'client_id must be an HTTPS URL for CIMD resolution',
+        };
     }
+    let url;
     try {
-        const response = await fetch(clientId, {
-            headers: { Accept: 'application/json' },
+        url = new URL(clientId);
+    }
+    catch {
+        return {
+            ok: false,
+            error: 'not_https',
+            errorDescription: 'client_id is not a valid URL',
+        };
+    }
+    if (!isDomainAllowed(url.hostname, opts.allowedDomains)) {
+        return {
+            ok: false,
+            error: 'domain_not_allowed',
+            errorDescription: `client_id host '${url.hostname}' is not in tenant's allowed client domains`,
+        };
+    }
+    // Cache lookup (with ETag revalidation deferred to refresh path)
+    const cached = opts.cache?.get(clientId);
+    if (cached && cached.expiresAt > Date.now()) {
+        return { ok: true, metadata: cached.metadata, fromCache: true };
+    }
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    let response;
+    try {
+        const headers = { Accept: 'application/json' };
+        if (cached?.etag)
+            headers['If-None-Match'] = cached.etag;
+        response = await fetchImpl(clientId, {
+            headers,
             signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
         });
-        if (!response.ok)
-            return null;
-        const metadata = (await response.json());
-        // Validate required fields
-        if (!metadata.client_id || metadata.client_id !== clientId) {
-            return null;
+    }
+    catch (err) {
+        const isTimeout = err instanceof Error && err.name === 'TimeoutError';
+        return {
+            ok: false,
+            error: isTimeout ? 'timeout' : 'fetch_failed',
+            errorDescription: `CIMD fetch failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    // 304: cache is still valid, extend expiry
+    if (response.status === 304 && cached) {
+        cached.expiresAt = Date.now() + resolveTtlMs(response);
+        return { ok: true, metadata: cached.metadata, fromCache: true };
+    }
+    if (!response.ok) {
+        return {
+            ok: false,
+            error: 'http_error',
+            errorDescription: `CIMD fetch returned HTTP ${response.status}`,
+        };
+    }
+    let metadata;
+    try {
+        metadata = (await response.json());
+    }
+    catch {
+        return {
+            ok: false,
+            error: 'invalid_json',
+            errorDescription: 'CIMD response was not valid JSON',
+        };
+    }
+    if (!metadata.client_id || metadata.client_id !== clientId) {
+        return {
+            ok: false,
+            error: 'client_id_mismatch',
+            errorDescription: 'client_id in metadata document does not match requested URL',
+        };
+    }
+    if (!metadata.redirect_uris || metadata.redirect_uris.length === 0) {
+        return {
+            ok: false,
+            error: 'missing_redirect_uris',
+            errorDescription: 'CIMD metadata document must include at least one redirect_uri',
+        };
+    }
+    opts.cache?.set(clientId, {
+        metadata,
+        etag: response.headers.get('etag') ?? undefined,
+        expiresAt: Date.now() + resolveTtlMs(response),
+    });
+    return { ok: true, metadata };
+}
+/**
+ * @deprecated Use resolveClientMetadata for structured errors + caching.
+ * Retained for callers that only need the happy-path document.
+ */
+export async function fetchClientMetadata(clientId) {
+    const result = await resolveClientMetadata(clientId);
+    return result.ok ? (result.metadata ?? null) : null;
+}
+/**
+ * LRU cache for CIMD metadata. Eviction on insert past capacity.
+ */
+export class CimdCache {
+    capacity;
+    entries = new Map();
+    constructor(capacity = 500) {
+        this.capacity = capacity;
+    }
+    get(clientId) {
+        const entry = this.entries.get(clientId);
+        if (!entry)
+            return undefined;
+        // Re-insert to mark as most-recently-used
+        this.entries.delete(clientId);
+        this.entries.set(clientId, entry);
+        return entry;
+    }
+    set(clientId, entry) {
+        if (this.entries.has(clientId)) {
+            this.entries.delete(clientId);
         }
-        if (!metadata.redirect_uris || metadata.redirect_uris.length === 0) {
-            return null;
+        else if (this.entries.size >= this.capacity) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest)
+                this.entries.delete(oldest);
         }
-        return metadata;
+        this.entries.set(clientId, entry);
     }
-    catch {
-        return null; // discovery endpoint unreachable
+    clear() {
+        this.entries.clear();
     }
+    size() {
+        return this.entries.size;
+    }
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+function isDomainAllowed(hostname, allowlist) {
+    if (!allowlist || allowlist.length === 0)
+        return true;
+    const host = hostname.toLowerCase();
+    return allowlist.some((pattern) => {
+        const p = pattern.toLowerCase();
+        if (p.startsWith('*.')) {
+            const suffix = p.slice(1); // ".claude.ai"
+            return host.endsWith(suffix) && host.length > suffix.length;
+        }
+        return host === p;
+    });
+}
+function resolveTtlMs(response) {
+    const cacheControl = response.headers.get('cache-control');
+    if (!cacheControl)
+        return DEFAULT_CACHE_TTL_MS;
+    const match = /max-age=(\d+)/.exec(cacheControl);
+    if (!match)
+        return DEFAULT_CACHE_TTL_MS;
+    const seconds = parseInt(match[1], 10);
+    if (!Number.isFinite(seconds) || seconds < 0)
+        return DEFAULT_CACHE_TTL_MS;
+    return seconds * 1000;
 }
+/**
+ * Internal exports for tests only.
+ */
+export const __test__ = { isDomainAllowed, resolveTtlMs };
 // ============================================================================
 // URI Builders
 // ============================================================================

package/dist/serv/auth/well-known.js.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../../src/serv/auth/well-known.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,uCAAuC;AACvC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAenC,+EAA+E;AAC/E,yCAAyC;AACzC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAuB,EACvB,MAAc;IAEd,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,qBAAqB,EAAE,CAAC,aAAa,CAAC;QACtC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,sBAAsB,EAAE,MAAM,CAAC,gBAAgB;KAChD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,2CAA2C;AAC3C,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAuB,EACvB,MAAc;IAEd,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO;QACL,MAAM,EAAE,OAAO;QACf,sBAAsB,EAAE,GAAG,OAAO,YAAY;QAC9C,cAAc,EAAE,GAAG,OAAO,QAAQ;QAClC,qBAAqB,EAAE,GAAG,OAAO,WAAW;QAC5C,QAAQ,EAAE,GAAG,MAAM,CAAC,OAAO,wBAAwB;QACnD,gBAAgB,EAAE,MAAM,CAAC,eAAe,IAAI;YAC1C,QAAQ;YACR,SAAS;YACT,OAAO;YACP,UAAU;YACV,WAAW;YACX,WAAW;SACZ;QACD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC;QACpF,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE;YACrC,qBAAqB;YACrB,oBAAoB;YACpB,MAAM,EAAE,qBAAqB;SAC9B;KACF,CAAC;AACJ,CAAC;AAoBD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB;IAEhB,qCAAqC;IACrC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;QAEnE,2BAA2B;QAC3B,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,iCAAiC;IAChD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAAc;IACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,MAAM,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,OAAO,WAAW,MAAM,CAAC,IAAI,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAc;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,MAAc;IACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAuB,EACvB,MAAc;IAEd,MAAM,QAAQ,GAAG,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnE,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,sBAAsB;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAuB,EACvB,MAAc;IAEd,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5D,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,sBAAsB;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,MAAc,EACd,KAAc,EACd,gBAAyB;IAEzB,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,UAAU,MAAM,CAAC,IAAI,GAAG;QACxB,sBAAsB,OAAO,wCAAwC;KACtE,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC/B,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,sBAAsB,gBAAgB,GAAG,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../../src/serv/auth/well-known.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,uCAAuC;AACvC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAenC,+EAA+E;AAC/E,yCAAyC;AACzC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAuB,EACvB,MAAc;IAEd,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,qBAAqB,EAAE,CAAC,aAAa,CAAC;QACtC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,sBAAsB,EAAE,MAAM,CAAC,gBAAgB;KAChD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,2CAA2C;AAC3C,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAuB,EACvB,MAAc;IAEd,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO;QACL,MAAM,EAAE,OAAO;QACf,sBAAsB,EAAE,GAAG,OAAO,YAAY;QAC9C,cAAc,EAAE,GAAG,OAAO,QAAQ;QAClC,qBAAqB,EAAE,GAAG,OAAO,WAAW;QAC5C,QAAQ,EAAE,GAAG,MAAM,CAAC,OAAO,wBAAwB;QACnD,gBAAgB,EAAE,MAAM,CAAC,eAAe,IAAI;YAC1C,QAAQ;YACR,SAAS;YACT,OAAO;YACP,UAAU;YACV,WAAW;YACX,WAAW;SACZ;QACD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC;QACpF,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE;YACrC,qBAAqB;YACrB,oBAAoB;YACpB,MAAM,EAAE,qBAAqB;SAC9B;QACD,wEAAwE;QACxE,0DAA0D;QAC1D,qCAAqC,EAAE,IAAI;KACb,CAAC;AACnC,CAAC;AAmDD,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oCAAoC;AAEjF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,OAAyB,EAAE;IAE3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,WAAW;YAClB,gBAAgB,EAAE,oDAAoD;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,WAAW;YAClB,gBAAgB,EAAE,8BAA8B;SACjD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB;YAC3B,gBAAgB,EAAE,mBAAmB,GAAG,CAAC,QAAQ,6CAA6C;SAC/F,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvE,IAAI,MAAM,EAAE,IAAI;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACzD,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;YACnC,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC;QACtE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;YAC7C,gBAAgB,EAAE,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3F,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,EAAE,CAAC;QACtC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,YAAY;YACnB,gBAAgB,EAAE,4BAA4B,QAAQ,CAAC,MAAM,EAAE;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,QAAgC,CAAC;IACrC,IAAI,CAAC;QACH,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,cAAc;YACrB,gBAAgB,EAAE,kCAAkC;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB;YAC3B,gBAAgB,EAAE,6DAA6D;SAChF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB;YAC9B,gBAAgB,EAAE,+DAA+D;SAClF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE;QACxB,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;QAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;KAC/C,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAYD;;GAEG;AACH,MAAM,OAAO,SAAS;IAEA;IADZ,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,YAAoB,WAAW,GAAG;QAAd,aAAQ,GAAR,QAAQ,CAAM;IAAG,CAAC;IAEtC,GAAG,CAAC,QAAgB;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,0CAA0C;QAC1C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,GAAG,CAAC,QAAgB,EAAE,KAAqB;QACzC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAChD,IAAI,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,SAAS,eAAe,CAAC,QAAgB,EAAE,SAAoB;IAC7D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;YAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB;IACtC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY;QAAE,OAAO,oBAAoB,CAAC;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,oBAAoB,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC1E,OAAO,OAAO,GAAG,IAAI,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAE1D,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAAc;IACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,MAAM,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,OAAO,WAAW,MAAM,CAAC,IAAI,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAc;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,MAAc;IACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjC,OAAO,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAuB,EACvB,MAAc;IAEd,MAAM,QAAQ,GAAG,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnE,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,sBAAsB;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAuB,EACvB,MAAc;IAEd,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5D,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,sBAAsB;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,MAAc,EACd,KAAc,EACd,gBAAyB;IAEzB,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,UAAU,MAAM,CAAC,IAAI,GAAG;QACxB,sBAAsB,OAAO,wCAAwC;KACtE,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC/B,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,sBAAsB,gBAAgB,GAAG,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/serv/index.d.ts

@@ -14,7 +14,12 @@ export { OAuthProviderRegistry, OAuthFlowHandler, MemoryElicitationStore, Memory
 export { type TokenVault, LocalTokenVault, KmsTokenVault, createTokenVault, initTokenVault, getTokenVault, } from './vault/token-vault.js';
 export { TenantResolver, MemoryTenantStore, RequestContextBuilder, extractTenantSlug, buildTenantUrl, buildResourceUri, type TenantStore, } from './middleware/tenant.js';
 export { AuthMiddleware, hasPermission, parseMcpSessionId, generateClientFingerprint, type UserStore, type MembershipStore, } from './middleware/auth.js';
-export { generateProtectedResourceMetadata, generateAuthServerMetadata, handleProtectedResourceRequest, handleAuthServerRequest, generateWwwAuthenticate, fetchClientMetadata, type WellKnownConfig, type ClientMetadataDocument, } from './auth/well-known.js';
+export { generateProtectedResourceMetadata, generateAuthServerMetadata, handleProtectedResourceRequest, handleAuthServerRequest, generateWwwAuthenticate, fetchClientMetadata, resolveClientMetadata, CimdCache, type WellKnownConfig, type ClientMetadataDocument, type CimdError, type CimdResult, type CimdFetchOptions, } from './auth/well-known.js';
+export { handleAuthorize, handleToken, handleRegister, handleConsent, handleRevoke, handleIntrospect, DEFAULT_ENDPOINT_CONFIG, type AuthRequest, type AuthResponse, type EndpointConfig, type EndpointDeps, } from './auth/endpoints.js';
+export { handleAuthServerHTTP, type AuthServerHTTPOptions } from './auth/http-adapter.js';
+export { openAuthDatabase, SqliteAuthCodeStore, SqliteRefreshTokenStore, SqliteClientRegistry, SqliteConsentStore, SqlitePendingAuthorizationStore, } from './auth/sqlite-stores.js';
+export { openOauthDatabase, SqliteElicitationStore, SqliteGrantStore, } from './auth/oauth-sqlite-stores.js';
+export { MemoryAuthCodeStore, MemoryRefreshTokenStore, MemoryClientRegistry, MemoryConsentStore, MemoryPendingAuthorizationStore, generateSecureToken, hashClientSecret, verifyClientSecret, normalizeScopes, type AuthCodeStore, type RefreshTokenStore, type ClientRegistry, type ConsentStore, type PendingAuthorizationStore, type PendingAuthorization, } from './auth/auth-store.js';
 export { OAuthContext, OAuthElicitationRequired, createOAuthInputProvider, PhotonExecutor, isOAuthElicitationError, formatElicitationToolResponse, type OAuthAsk, type OAuthResponse, type OAuthContextConfig, type OAuthInputProvider, type ExecutorConfig, type ExecutionContext, type ExecutionResult, } from './runtime/index.js';
 import type { Tenant, Session, SessionCreateOptions } from './types/index.js';
 import { type SessionStore } from './session/store.js';
@@ -23,7 +28,9 @@ import { type TokenVault } from './vault/token-vault.js';
 import { TenantResolver, type TenantStore } from './middleware/tenant.js';
 import { AuthMiddleware, type UserStore, type MembershipStore } from './middleware/auth.js';
 import { OAuthProviderRegistry, OAuthFlowHandler } from './auth/oauth.js';
-import type { WellKnownConfig } from './auth/well-known.js';
+import { CimdCache, type WellKnownConfig } from './auth/well-known.js';
+import { type AuthCodeStore, type RefreshTokenStore, type ClientRegistry, type ConsentStore, type PendingAuthorizationStore } from './auth/auth-store.js';
+import { type EndpointConfig, type EndpointDeps } from './auth/endpoints.js';
 import { PhotonExecutor, type ExecutionContext } from './runtime/index.js';
 export interface ServConfig {
     /** Base URL (e.g., 'https://serv.example.com') */
@@ -46,6 +53,25 @@ export interface ServConfig {
     membershipStore?: MembershipStore;
     /** Token vault (optional, defaults to local) */
     tokenVault?: TokenVault;
+    /** Authorization-server code store (optional, defaults to memory). */
+    authCodeStore?: AuthCodeStore;
+    /** Refresh-token store (optional, defaults to memory). */
+    refreshTokenStore?: RefreshTokenStore;
+    /** DCR client registry (optional, defaults to memory). */
+    clientRegistry?: ClientRegistry;
+    /** Remembered-consent store (optional, defaults to memory). */
+    consentStore?: ConsentStore;
+    /** Paused-authorization-request store (optional, defaults to memory). */
+    pendingAuthStore?: PendingAuthorizationStore;
+    /**
+     * Overrides for endpoint config (TTLs, first-party allowlist, loginUrl).
+     * `issuer` / `authorizeUrl` / `consentUrl` are derived from the tenant
+     * and can't be overridden; `loginUrl` is left open because the AS
+     * adapter doesn't serve a `/login` handler — embedders MUST point it at
+     * whatever login flow they actually serve (federated login, custom HTML,
+     * PHOTON_SINGLE_USER short-circuit, etc.).
+     */
+    endpointConfig?: Partial<Omit<EndpointConfig, 'issuer' | 'authorizeUrl' | 'consentUrl'>>;
 }
 export declare class Serv {
     readonly config: ServConfig;
@@ -58,9 +84,26 @@ export declare class Serv {
     readonly oauthProviders: OAuthProviderRegistry;
     readonly oauthFlow: OAuthFlowHandler;
     readonly wellKnownConfig: WellKnownConfig;
+    /** Authorization-server state (see /authorize, /token, /register). */
+    readonly authCodeStore: AuthCodeStore;
+    readonly refreshTokenStore: RefreshTokenStore;
+    readonly clientRegistry: ClientRegistry;
+    readonly consentStore: ConsentStore;
+    readonly pendingAuthStore: PendingAuthorizationStore;
+    readonly cimdCache: CimdCache;
     private elicitationStore;
     private grantStore;
     constructor(config: ServConfig);
+    /**
+     * Build per-tenant endpoint dependencies for the OAuth 2.1 authorization
+     * server handlers. Callers pass the resulting `EndpointDeps` to
+     * `handleAuthorize` / `handleToken` / `handleRegister` / `handleConsent`.
+     *
+     * URLs are derived from the tenant slug unless overridden; Serv owns the
+     * stores and JWT service so multiple tenants share them without coupling
+     * to any HTTP framework.
+     */
+    buildEndpointDeps(tenant: Tenant): EndpointDeps;
     /**
      * Register an OAuth provider
      */

package/dist/serv/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/serv/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,KAAK,UAAU,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,aAAa,GACd,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAqB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAGjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3E,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,kDAAkD;IAClD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,4BAA4B;IAC5B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,kCAAkC;IAClC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,gDAAgD;IAChD,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,qBAAa,IAAI;IACf,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C,OAAO,CAAC,gBAAgB,CAAgC;IACxD,OAAO,CAAC,UAAU,CAA0B;gBAEhC,MAAM,EAAE,UAAU;IAiD9B;;OAEG;IACH,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAIvF;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ/B;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpE;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAIvD;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAIlD;;OAEG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI9C;;OAEG;IACH,cAAc,IAAI,cAAc;IAOhC;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB;IAI5F;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAMD;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/serv/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,KAAK,UAAU,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,aAAa,GACd,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAI1F,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAqB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAGjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3E,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,kDAAkD;IAClD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,4BAA4B;IAC5B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,kCAAkC;IAClC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,gDAAgD;IAChD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,sEAAsE;IACtE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,0DAA0D;IAC1D,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC;CAC1F;AAED,qBAAa,IAAI;IACf,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B,OAAO,CAAC,gBAAgB,CAAgC;IACxD,OAAO,CAAC,UAAU,CAA0B;gBAEhC,MAAM,EAAE,UAAU;IAyD9B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY;IA6B/C;;OAEG;IACH,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAIvF;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ/B;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpE;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAIvD;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAIlD;;OAEG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI9C;;OAEG;IACH,cAAc,IAAI,cAAc;IAOhC;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB;IAI5F;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAMD;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB"}

package/dist/serv/index.js

@@ -24,7 +24,17 @@ export { LocalTokenVault, KmsTokenVault, createTokenVault, initTokenVault, getTo
 export { TenantResolver, MemoryTenantStore, RequestContextBuilder, extractTenantSlug, buildTenantUrl, buildResourceUri, } from './middleware/tenant.js';
 export { AuthMiddleware, hasPermission, parseMcpSessionId, generateClientFingerprint, } from './middleware/auth.js';
 // Well-Known Endpoints
-export { generateProtectedResourceMetadata, generateAuthServerMetadata, handleProtectedResourceRequest, handleAuthServerRequest, generateWwwAuthenticate, fetchClientMetadata, } from './auth/well-known.js';
+export { generateProtectedResourceMetadata, generateAuthServerMetadata, handleProtectedResourceRequest, handleAuthServerRequest, generateWwwAuthenticate, fetchClientMetadata, resolveClientMetadata, CimdCache, } from './auth/well-known.js';
+// Authorization Server Endpoints (OAuth 2.1)
+export { handleAuthorize, handleToken, handleRegister, handleConsent, handleRevoke, handleIntrospect, DEFAULT_ENDPOINT_CONFIG, } from './auth/endpoints.js';
+// HTTP adapter for the AS endpoints (Node http compatible)
+export { handleAuthServerHTTP } from './auth/http-adapter.js';
+// SQLite-backed stores (requires optional better-sqlite3 on Node; uses
+// bun:sqlite natively under Bun)
+export { openAuthDatabase, SqliteAuthCodeStore, SqliteRefreshTokenStore, SqliteClientRegistry, SqliteConsentStore, SqlitePendingAuthorizationStore, } from './auth/sqlite-stores.js';
+export { openOauthDatabase, SqliteElicitationStore, SqliteGrantStore, } from './auth/oauth-sqlite-stores.js';
+// Authorization Server Stores
+export { MemoryAuthCodeStore, MemoryRefreshTokenStore, MemoryClientRegistry, MemoryConsentStore, MemoryPendingAuthorizationStore, generateSecureToken, hashClientSecret, verifyClientSecret, normalizeScopes, } from './auth/auth-store.js';
 // Runtime (OAuth-aware execution)
 export { OAuthContext, OAuthElicitationRequired, createOAuthInputProvider, PhotonExecutor, isOAuthElicitationError, formatElicitationToolResponse, } from './runtime/index.js';
 import { MemorySessionStore } from './session/store.js';
@@ -33,6 +43,9 @@ import { LocalTokenVault } from './vault/token-vault.js';
 import { TenantResolver, MemoryTenantStore } from './middleware/tenant.js';
 import { AuthMiddleware } from './middleware/auth.js';
 import { OAuthProviderRegistry, OAuthFlowHandler, MemoryElicitationStore, MemoryGrantStore, } from './auth/oauth.js';
+import { CimdCache } from './auth/well-known.js';
+import { MemoryAuthCodeStore, MemoryRefreshTokenStore, MemoryClientRegistry, MemoryConsentStore, MemoryPendingAuthorizationStore, } from './auth/auth-store.js';
+import { DEFAULT_ENDPOINT_CONFIG, } from './auth/endpoints.js';
 import { PhotonExecutor } from './runtime/index.js';
 export class Serv {
     config;
@@ -45,6 +58,13 @@ export class Serv {
     oauthProviders;
     oauthFlow;
     wellKnownConfig;
+    /** Authorization-server state (see /authorize, /token, /register). */
+    authCodeStore;
+    refreshTokenStore;
+    clientRegistry;
+    consentStore;
+    pendingAuthStore;
+    cimdCache;
     elicitationStore = new MemoryElicitationStore();
     grantStore = new MemoryGrantStore();
     constructor(config) {
@@ -88,6 +108,50 @@ export class Serv {
         this.wellKnownConfig = {
             baseUrl: config.baseUrl,
         };
+        // Authorization-server stores (in-memory defaults; callers override for prod)
+        this.authCodeStore = config.authCodeStore ?? new MemoryAuthCodeStore();
+        this.refreshTokenStore = config.refreshTokenStore ?? new MemoryRefreshTokenStore();
+        this.clientRegistry = config.clientRegistry ?? new MemoryClientRegistry();
+        this.consentStore = config.consentStore ?? new MemoryConsentStore();
+        this.pendingAuthStore = config.pendingAuthStore ?? new MemoryPendingAuthorizationStore();
+        this.cimdCache = new CimdCache();
+    }
+    /**
+     * Build per-tenant endpoint dependencies for the OAuth 2.1 authorization
+     * server handlers. Callers pass the resulting `EndpointDeps` to
+     * `handleAuthorize` / `handleToken` / `handleRegister` / `handleConsent`.
+     *
+     * URLs are derived from the tenant slug unless overridden; Serv owns the
+     * stores and JWT service so multiple tenants share them without coupling
+     * to any HTTP framework.
+     */
+    buildEndpointDeps(tenant) {
+        const baseUri = `${this.config.baseUrl}/tenant/${tenant.slug}`;
+        // The login URL is the embedder's responsibility — the AS adapter
+        // doesn't serve a `/login` handler, it only knows how to redirect
+        // there. Default to a tenant-scoped path so multi-tenant embeds that
+        // rely on the default wiring point users at the per-tenant login
+        // (typically `/tenant/<slug>/login`). Embedders override via
+        // endpointConfig.loginUrl if their login lives elsewhere.
+        const defaultLoginUrl = this.config.endpointConfig?.loginUrl ?? `${baseUri}/login`;
+        return {
+            tenant,
+            config: {
+                ...DEFAULT_ENDPOINT_CONFIG,
+                issuer: baseUri,
+                authorizeUrl: `${baseUri}/authorize`,
+                consentUrl: `${baseUri}/consent`,
+                loginUrl: defaultLoginUrl,
+                ...this.config.endpointConfig,
+            },
+            codeStore: this.authCodeStore,
+            refreshTokenStore: this.refreshTokenStore,
+            clientRegistry: this.clientRegistry,
+            consentStore: this.consentStore,
+            pendingStore: this.pendingAuthStore,
+            jwtService: this.jwtService,
+            cimdCache: this.cimdCache,
+        };
     }
     /**
      * Register an OAuth provider

package/dist/serv/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/serv/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,qBAAqB;AACrB,OAAO,EAGL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,8BAA8B;AAC9B,OAAO,EAAE,cAAc,EAAoB,MAAM,uBAAuB,CAAC;AAEzE,yBAAyB;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS,EAAmB,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,wCAAwC;AACxC,OAAO,EACL,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,YAAY,GAEb,MAAM,YAAY,CAAC;AAEpB,aAAa;AACb,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,QAAQ;AACR,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAEzB,cAAc;AACd,OAAO,EAEL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,aAAa,GACd,MAAM,wBAAwB,CAAC;AAEhC,aAAa;AACb,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GAEjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAG1B,MAAM,sBAAsB,CAAC;AAE9B,uBAAuB;AACvB,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAE9B,kCAAkC;AAClC,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,GAQ9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAmB,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAoB,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAwC,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAyB,MAAM,oBAAoB,CAAC;AAyB3E,MAAM,OAAO,IAAI;IACN,MAAM,CAAa;IACnB,YAAY,CAAe;IAC3B,WAAW,CAAc;IACzB,UAAU,CAAa;IACvB,UAAU,CAAa;IACvB,cAAc,CAAiB;IAC/B,cAAc,CAAiB;IAC/B,cAAc,CAAwB;IACtC,SAAS,CAAmB;IAC5B,eAAe,CAAkB;IAElC,gBAAgB,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAChD,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAE5C,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,oBAAoB;QACpB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACjE,IAAI,CAAC,UAAU;YACb,MAAM,CAAC,UAAU;gBACjB,IAAI,eAAe,CAAC;oBAClB,SAAS,EAAE,MAAM,CAAC,aAAa;iBAChC,CAAC,CAAC;QAEL,yBAAyB;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC,CAAC;QAEH,6BAA6B;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC;YACvC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,IAAI,CAAC,WAAW;SACxB,CAAC,CAAC;QAEH,6BAA6B;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,mBAAmB;QACnB,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QAEH,oBAAoB;QACpB,IAAI,CAAC,eAAe,GAAG;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,UAAkB,EAAE,QAAgB,EAAE,YAAoB;QAC9E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAc;QACtB,IAAI,IAAI,CAAC,WAAW,YAAY,iBAAiB,EAAE,CAAC;YAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,OAA6B;QAC/C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAgB,EAAE,MAAc;QAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAgB,EAChB,QAAgB,EAChB,QAAgB,EAChB,MAAgB;QAEhB,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,QAAgB,EAChB,QAAgB,EAChB,cAAwB,EACxB,MAAe;QAEf,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,cAAc,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAgB,EAAE,MAAc,EAAE,QAAgB;QACvE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAGnC;IACC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC,mBAAmB;IAChF,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,WAAW,CAAC;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC;QACd,OAAO;QACP,UAAU;QACV,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1C,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/serv/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,qBAAqB;AACrB,OAAO,EAGL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,8BAA8B;AAC9B,OAAO,EAAE,cAAc,EAAoB,MAAM,uBAAuB,CAAC;AAEzE,yBAAyB;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,SAAS,EAAmB,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,wCAAwC;AACxC,OAAO,EACL,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,YAAY,GAEb,MAAM,YAAY,CAAC;AAEpB,aAAa;AACb,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,QAAQ;AACR,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAEzB,cAAc;AACd,OAAO,EAEL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,aAAa,GACd,MAAM,wBAAwB,CAAC;AAEhC,aAAa;AACb,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GAEjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAG1B,MAAM,sBAAsB,CAAC;AAE9B,uBAAuB;AACvB,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,SAAS,GAMV,MAAM,sBAAsB,CAAC;AAE9B,6CAA6C;AAC7C,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,GAKxB,MAAM,qBAAqB,CAAC;AAE7B,2DAA2D;AAC3D,OAAO,EAAE,oBAAoB,EAA8B,MAAM,wBAAwB,CAAC;AAE1F,uEAAuE;AACvE,iCAAiC;AACjC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AAEvC,8BAA8B;AAC9B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAOhB,MAAM,sBAAsB,CAAC;AAE9B,kCAAkC;AAClC,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,GAQ9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAmB,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAoB,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAwC,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAwB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,GAMhC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAyB,MAAM,oBAAoB,CAAC;AA4C3E,MAAM,OAAO,IAAI;IACN,MAAM,CAAa;IACnB,YAAY,CAAe;IAC3B,WAAW,CAAc;IACzB,UAAU,CAAa;IACvB,UAAU,CAAa;IACvB,cAAc,CAAiB;IAC/B,cAAc,CAAiB;IAC/B,cAAc,CAAwB;IACtC,SAAS,CAAmB;IAC5B,eAAe,CAAkB;IAE1C,sEAAsE;IAC7D,aAAa,CAAgB;IAC7B,iBAAiB,CAAoB;IACrC,cAAc,CAAiB;IAC/B,YAAY,CAAe;IAC3B,gBAAgB,CAA4B;IAC5C,SAAS,CAAY;IAEtB,gBAAgB,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAChD,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAE5C,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,oBAAoB;QACpB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACjE,IAAI,CAAC,UAAU;YACb,MAAM,CAAC,UAAU;gBACjB,IAAI,eAAe,CAAC;oBAClB,SAAS,EAAE,MAAM,CAAC,aAAa;iBAChC,CAAC,CAAC;QAEL,yBAAyB;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC,CAAC;QAEH,6BAA6B;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC;YACvC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,IAAI,CAAC,WAAW;SACxB,CAAC,CAAC;QAEH,6BAA6B;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,mBAAmB;QACnB,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QAEH,oBAAoB;QACpB,IAAI,CAAC,eAAe,GAAG;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,8EAA8E;QAC9E,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,uBAAuB,EAAE,CAAC;QACnF,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,oBAAoB,EAAE,CAAC;QAC1E,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACpE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,+BAA+B,EAAE,CAAC;QACzF,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,iBAAiB,CAAC,MAAc;QAC9B,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,6DAA6D;QAC7D,0DAA0D;QAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,IAAI,GAAG,OAAO,QAAQ,CAAC;QACnF,OAAO;YACL,MAAM;YACN,MAAM,EAAE;gBACN,GAAG,uBAAuB;gBAC1B,MAAM,EAAE,OAAO;gBACf,YAAY,EAAE,GAAG,OAAO,YAAY;gBACpC,UAAU,EAAE,GAAG,OAAO,UAAU;gBAChC,QAAQ,EAAE,eAAe;gBACzB,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc;aAC9B;YACD,SAAS,EAAE,IAAI,CAAC,aAAa;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,gBAAgB;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,UAAkB,EAAE,QAAgB,EAAE,YAAoB;QAC9E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAc;QACtB,IAAI,IAAI,CAAC,WAAW,YAAY,iBAAiB,EAAE,CAAC;YAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,OAA6B;QAC/C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAgB,EAAE,MAAc;QAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAgB,EAChB,QAAgB,EAChB,QAAgB,EAChB,MAAgB;QAEhB,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,QAAgB,EAChB,QAAgB,EAChB,cAAwB,EACxB,MAAe;QAEf,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,cAAc,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAgB,EAAE,MAAc,EAAE,QAAgB;QACvE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAGnC;IACC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC,mBAAmB;IAChF,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,WAAW,CAAC;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC;QACd,OAAO;QACP,UAAU;QACV,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1C,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC"}

package/dist/serv/types/index.d.ts

@@ -21,6 +21,12 @@ export interface TenantSettings {
         requestsPerMinute: number;
         requestsPerDay: number;
     };
+    /**
+     * Hostnames this tenant accepts CIMD client_ids from. Supports exact match
+     * (`claude.ai`) or leading wildcard (`*.claude.ai`). Empty / undefined = allow all.
+     * Tightening this is the primary defense against CIMD phishing.
+     */
+    allowedClientDomains?: string[];
 }
 export interface User {
     id: string;
@@ -137,6 +143,80 @@ export interface AuthorizationServerMetadata {
     grant_types_supported?: string[];
     code_challenge_methods_supported?: string[];
     token_endpoint_auth_methods_supported?: string[];
+    /** Draft extension: this AS resolves client_ids that are HTTPS URLs (CIMD). */
+    client_id_metadata_document_supported?: boolean;
+}
+/**
+ * A single-use authorization code issued by `/authorize`, exchanged at `/token`.
+ * TTL is short (60s per RFC 6749 §4.1.2); codes are deleted on consumption.
+ */
+export interface AuthorizationCode {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    userId: string;
+    tenantId: string;
+    codeChallenge: string;
+    codeChallengeMethod: 'S256';
+    /** OIDC nonce from the authorize request; echoed into id_token at /token. */
+    nonce?: string;
+    expiresAt: Date;
+    createdAt: Date;
+}
+/**
+ * Long-lived refresh token. Rotated on every use per OAuth 2.1.
+ */
+export interface RefreshToken {
+    token: string;
+    clientId: string;
+    userId: string;
+    tenantId: string;
+    scope: string;
+    expiresAt: Date;
+    createdAt: Date;
+    /** Previous refresh token hash, for replay detection on rotation. */
+    supersedes?: string;
+}
+/**
+ * A client registered via RFC 7591 Dynamic Client Registration.
+ * CIMD clients are NOT stored here, their metadata lives on the client's
+ * own HTTPS URL and is fetched/cached per request.
+ */
+export interface RegisteredClient {
+    clientId: string;
+    clientSecretHash?: string;
+    clientName: string;
+    redirectUris: string[];
+    grantTypes: string[];
+    responseTypes: string[];
+    scope: string;
+    contacts?: string[];
+    logoUri?: string;
+    tosUri?: string;
+    policyUri?: string;
+    isPublic: boolean;
+    createdAt: Date;
+    /** TTL eviction: unused registrations drop after 30 days. Touched on use. */
+    lastUsedAt: Date;
+    /** User-Agent + IP at registration, for audit/deprecation-tracking. */
+    registrationContext?: {
+        userAgent?: string;
+        ipAddress?: string;
+    };
+}
+/**
+ * A remembered user consent for (client_id, scope_set). Skip consent screen
+ * on subsequent requests unless scopes expand beyond remembered set.
+ */
+export interface ConsentRecord {
+    userId: string;
+    tenantId: string;
+    clientId: string;
+    /** Sorted, space-joined scope list for stable key comparison. */
+    scopes: string;
+    expiresAt: Date;
+    createdAt: Date;
 }
 export interface RequestContext {
     tenant: Tenant;

package/dist/serv/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/serv/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE;QACV,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAMD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAMD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAE3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IAGZ,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAGD,eAAO,MAAM,0BAA0B,SAAS,CAAC;AAMjD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;CAClD;AAMD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/serv/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE;QACV,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAMD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAE3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IAGZ,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAGD,eAAO,MAAM,0BAA0B,SAAS,CAAC;AAMjD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,+EAA+E;IAC/E,qCAAqC,CAAC,EAAE,OAAO,CAAC;CACjD;AAMD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,6EAA6E;IAC7E,UAAU,EAAE,IAAI,CAAC;IACjB,uEAAuE;IACvE,mBAAmB,CAAC,EAAE;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAMD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB"}

package/dist/serv/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/serv/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwJH,yCAAyC;AACzC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,KAAK,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/serv/types/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8JH,yCAAyC;AACzC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,KAAK,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAuBnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG5E,OAAO,EAAgB,MAAM,EAAE,aAAa,EAAY,MAAM,oBAAoB,CAAC;AAanF,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,sBAAsB,CAAC;AAc9B,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,eAAe,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,CAAC;QAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IACvD,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,GAAG,CACzB,MAAM,EACN;QAAE,MAAM,EAAE;YAAE,OAAO,EAAE,GAAG,CAAC;YAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CACnF,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAGD,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AA8QhG,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,GAAG,CAAoC;IAC/C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,gBAAgB,CAAoC;IAC5D,OAAO,CAAC,UAAU,CAAgD;IAClE,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAC,CAKtB;IACF,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,UAAU,CAAuB;IACzC,mEAAmE;IACnE,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,uEAAuE;IACvE,OAAO,CAAC,gBAAgB,CAA6B;IACrD,kFAAkF;IAClF,OAAO,CAAC,wBAAwB,CAAS;IACzC,kDAAkD;IAClD,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,wGAAwG;IACxG,OAAO,CAAC,YAAY,CAAoC;IAExD,wFAAwF;IACjF,qBAAqB,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAE1C;IACxB,mDAAmD;IACnD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAQnB;IACF,OAAO,CAAC,MAAM,CAAS;IAEvB,sDAAsD;IACtD,eAAe,IAAI,mBAAmB,GAAG,IAAI;IAI7C,gFAAgF;IAChF,SAAS,IAAI,YAAY;gBAIb,OAAO,EAAE,mBAAmB;IAiIjC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIzC,SAAS,IAAI,MAAM;IAI1B,OAAO,CAAC,GAAG;IAIX;;;OAGG;IACI,mBAAmB,CAAC,QAAQ,EAAE,yBAAyB;IAI9D;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgB7B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IA6C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA8HzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,qGAAqG;IACrG,OAAO,CAAC,eAAe,CAA+D;IACtF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAEvD;;;OAGG;YACW,uBAAuB;YA2DvB,eAAe;YAgGf,cAAc;IA+Q5B,OAAO,CAAC,iBAAiB;YAqBX,eAAe;IAkB7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAkNrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAoBpB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAuB5B;;;OAGG;IACI,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAInC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAItD,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIpE,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAIvD,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIzC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAM7D;;;OAGG;IACH,OAAO,CAAC,WAAW;IA2CnB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;;;OAKG;YACW,uBAAuB;IAqDrC;;OAEG;YACW,qBAAqB;IA2BnC;;OAEG;YACW,wBAAwB;IAoFtC;;OAEG;IACG,KAAK;IA+GX;;OAEG;YACW,UAAU;IAsBxB;;OAEG;YACW,QAAQ;IA6ftB;;OAEG;YACW,cAAc;IAiC5B;;OAEG;YACW,iBAAiB;IAK/B;;OAEG;YACW,mBAAmB;IAiFjC;;OAEG;YACW,gBAAgB;IAgC9B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA+C5B;;OAEG;IACG,IAAI;IA4CV,OAAO,CAAC,mBAAmB;IA+B3B,OAAO,CAAC,kBAAkB;YAqBZ,qBAAqB;IAyBnC,OAAO,CAAC,gBAAgB;IAOxB;;OAEG;IACH,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAK;IACzC,OAAO,CAAC,kBAAkB,CAAC,CAAiB;IAEtC,MAAM;IAgGZ;;;OAGG;YACW,kBAAkB;CAyBjC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAuBnE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG5E,OAAO,EAAgB,MAAM,EAAE,aAAa,EAAY,MAAM,oBAAoB,CAAC;AAanF,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,sBAAsB,CAAC;AAc9B,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,eAAe,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,CAAC;QAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IACvD,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,GAAG,CACzB,MAAM,EACN;QAAE,MAAM,EAAE;YAAE,OAAO,EAAE,GAAG,CAAC;YAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CACnF,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAGD,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AA8QhG,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,GAAG,CAAoC;IAC/C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,gBAAgB,CAAoC;IAC5D,OAAO,CAAC,UAAU,CAAgD;IAClE,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAC,CAKtB;IACF,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,UAAU,CAAuB;IACzC,mEAAmE;IACnE,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,uEAAuE;IACvE,OAAO,CAAC,gBAAgB,CAA6B;IACrD,kFAAkF;IAClF,OAAO,CAAC,wBAAwB,CAAS;IACzC,kDAAkD;IAClD,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,wGAAwG;IACxG,OAAO,CAAC,YAAY,CAAoC;IAExD,wFAAwF;IACjF,qBAAqB,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAE1C;IACxB,mDAAmD;IACnD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAQnB;IACF,OAAO,CAAC,MAAM,CAAS;IAEvB,sDAAsD;IACtD,eAAe,IAAI,mBAAmB,GAAG,IAAI;IAI7C,gFAAgF;IAChF,SAAS,IAAI,YAAY;gBAIb,OAAO,EAAE,mBAAmB;IAiIjC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIzC,SAAS,IAAI,MAAM;IAI1B,OAAO,CAAC,GAAG;IAIX;;;OAGG;IACI,mBAAmB,CAAC,QAAQ,EAAE,yBAAyB;IAI9D;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgB7B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IA6C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA8HzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,qGAAqG;IACrG,OAAO,CAAC,eAAe,CAA+D;IACtF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAEvD;;;OAGG;YACW,uBAAuB;YA2DvB,eAAe;YAgGf,cAAc;IA+Q5B,OAAO,CAAC,iBAAiB;YAqBX,eAAe;IAkB7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAkNrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAoBpB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAuB5B;;;OAGG;IACI,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAInC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAItD,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIpE,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAIvD,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIzC,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAM7D;;;OAGG;IACH,OAAO,CAAC,WAAW;IA2CnB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;;;;OAKG;YACW,uBAAuB;IAqDrC;;OAEG;YACW,qBAAqB;IA2BnC;;OAEG;YACW,wBAAwB;IAoFtC;;OAEG;IACG,KAAK;IA+GX;;OAEG;YACW,UAAU;IAsBxB;;OAEG;YACW,QAAQ;IA6ftB;;OAEG;YACW,cAAc;IAiC5B;;OAEG;YACW,iBAAiB;IAK/B;;OAEG;YACW,mBAAmB;IAiFjC;;OAEG;YACW,gBAAgB;IAgC9B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA+C5B;;OAEG;IACG,IAAI;IA6CV,OAAO,CAAC,mBAAmB;IA+B3B,OAAO,CAAC,kBAAkB;YAqBZ,qBAAqB;IAyBnC,OAAO,CAAC,gBAAgB;IAOxB;;OAEG;IACH,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAK;IACzC,OAAO,CAAC,kBAAkB,CAAC,CAAiB;IAEtC,MAAM;IAoJZ;;;OAGG;YACW,kBAAkB;CAyBjC"}