@ractive-ch/tab-mcp 0.5.1 → 0.6.0

package/index.js

@@ -462,6 +462,7 @@ var MAX_JWT_BYTES = 8192;
 var MAX_JWKS_BYTES = 65536;
 var JWKS_TTL_MS = 10 * 60000;
 var JWKS_REFETCH_MS = 30000;
+var UNKNOWN_KID_REFETCH_MS = 5000;
 var JWKS_GRACE_MS = 60 * 60000;
 var FETCH_TIMEOUT_MS = 5000;
 
@@ -626,6 +627,7 @@ class HttpJsonError extends Error {
 class JwksCache {
   #url;
   #now;
+  #load;
   #keys = [];
   #fetchedAt = 0;
   #attemptedAt = Number.NEGATIVE_INFINITY;
@@ -634,14 +636,17 @@ class JwksCache {
   constructor(url, options = {}) {
     this.#url = typeof url === "string" ? () => Promise.resolve(url) : url;
     this.#now = options.now ?? Date.now;
+    this.#load = options.load ?? ((u) => fetchJson(u));
   }
   async keys(kid) {
+    const entered = this.#now();
     if (this.#inflight !== undefined)
       await this.#inflight.catch(() => {});
     const now = this.#now();
     const stale = now - this.#fetchedAt >= JWKS_TTL_MS;
-    const unknown = kid !== undefined && !this.#keys.some((k) => k.kid === kid);
-    if ((stale || unknown) && now - this.#attemptedAt >= JWKS_REFETCH_MS) {
+    const unknown = kid !== undefined && !this.#has(kid);
+    const floor = unknown && this.#lastError === undefined ? UNKNOWN_KID_REFETCH_MS : JWKS_REFETCH_MS;
+    if ((stale || unknown) && now - this.#attemptedAt >= floor) {
       try {
         await this.#refresh();
       } catch (error) {
@@ -651,13 +656,21 @@ class JwksCache {
     if (this.#now() - this.#fetchedAt >= JWKS_TTL_MS + JWKS_GRACE_MS) {
       throw this.#lastError ?? new Error("the JWKS could not be loaded");
     }
-    return kid === undefined ? this.#keys : this.#keys.filter((k) => k.kid === kid);
+    if (kid === undefined)
+      return this.#keys;
+    if (!this.#has(kid) && this.#fetchedAt < entered) {
+      throw this.#lastError ?? new Error("an unknown key id; the JWKS was fetched too recently");
+    }
+    return this.#keys.filter((k) => k.kid === kid);
+  }
+  #has(kid) {
+    return this.#keys.some((k) => k.kid === kid);
   }
   #refresh() {
     this.#inflight ??= (async () => {
       this.#attemptedAt = this.#now();
       try {
-        const doc = await fetchJson(await this.#url());
+        const doc = await this.#load(await this.#url());
         const keys = doc?.keys;
         if (!Array.isArray(keys))
           throw new Error("a JWKS needs keys");
@@ -1205,7 +1218,7 @@ function parseTabMessage(text) {
   }
 }
 // package.json
-var version = "0.5.1";
+var version = "0.6.0";
 
 // src/exchange.ts
 var RelayErrorCode = {
@@ -1682,6 +1695,142 @@ class RateLimiter {
   }
 }
 
+// src/store/memory.ts
+function copy(record) {
+  return { ...record, scopes: [...record.scopes] };
+}
+function matches(record, selector) {
+  return "grantId" in selector ? record.grantId === selector.grantId : record.addressId === selector.addressId;
+}
+function isLive(record, now) {
+  return record.expiresAt > now && (record.kind === "access" || record.usedAt === undefined);
+}
+function summarizeGrants(records, now) {
+  const grants = new Map;
+  for (const r of records) {
+    if (!isLive(r, now) || grants.has(r.grantId))
+      continue;
+    const summary = {
+      grantId: r.grantId,
+      clientId: r.clientId,
+      clientName: r.clientName,
+      scopes: [...r.scopes],
+      createdAt: r.grantCreatedAt
+    };
+    if (r.subject !== undefined)
+      summary.subject = r.subject;
+    grants.set(r.grantId, summary);
+  }
+  return [...grants.values()].sort((a, b) => a.createdAt - b.createdAt || a.grantId.localeCompare(b.grantId));
+}
+
+class NonceSet {
+  #until = new Map;
+  get size() {
+    return this.#until.size;
+  }
+  claim(key, expiresAt, now) {
+    const until = this.#until.get(key);
+    if (until !== undefined && until > now)
+      return false;
+    this.#until.set(key, expiresAt);
+    return true;
+  }
+  sweep(now) {
+    let n = 0;
+    for (const [key, until] of this.#until) {
+      if (until <= now) {
+        this.#until.delete(key);
+        n++;
+      }
+    }
+    return n;
+  }
+  clear() {
+    this.#until.clear();
+  }
+}
+
+class MemoryTokenStore {
+  #records = new Map;
+  #nonces = new NonceSet;
+  #revokedGrants = new Map;
+  #revokedAddresses = new Map;
+  async put(record) {
+    if (this.#revokedGrants.has(record.grantId))
+      return false;
+    const address = this.#revokedAddresses.get(record.addressId);
+    if (address !== undefined && record.grantCreatedAt <= address.at) {
+      return false;
+    }
+    this.#records.set(record.hash, copy(record));
+    return true;
+  }
+  async get(hash) {
+    const r = this.#records.get(hash);
+    return r === undefined ? undefined : copy(r);
+  }
+  async markUsed(hash, now, keepUntil) {
+    const r = this.#records.get(hash);
+    if (r === undefined || r.usedAt !== undefined)
+      return false;
+    r.usedAt = now;
+    r.expiresAt = Math.min(r.expiresAt, keepUntil);
+    return true;
+  }
+  async revoke(selector, options) {
+    if ("grantId" in selector) {
+      this.#revokedGrants.set(selector.grantId, options.keepUntil);
+    } else {
+      const old = this.#revokedAddresses.get(selector.addressId);
+      this.#revokedAddresses.set(selector.addressId, {
+        at: Math.max(old?.at ?? 0, options.now),
+        until: Math.max(old?.until ?? 0, options.keepUntil)
+      });
+    }
+    let n = 0;
+    for (const [hash, r] of this.#records) {
+      if (matches(r, selector)) {
+        this.#records.delete(hash);
+        n++;
+      }
+    }
+    return n;
+  }
+  async listGrants(addressId, now) {
+    const own = [...this.#records.values()].filter((r) => r.addressId === addressId);
+    return summarizeGrants(own, now);
+  }
+  async deleteExpired(now) {
+    for (const [id, until] of this.#revokedGrants) {
+      if (until <= now)
+        this.#revokedGrants.delete(id);
+    }
+    for (const [id, t] of this.#revokedAddresses) {
+      if (t.until <= now)
+        this.#revokedAddresses.delete(id);
+    }
+    this.#nonces.sweep(now);
+    let n = 0;
+    for (const [hash, r] of this.#records) {
+      if (r.expiresAt <= now) {
+        this.#records.delete(hash);
+        n++;
+      }
+    }
+    return n;
+  }
+  async claimNonce(key, expiresAt, now) {
+    return this.#nonces.claim(key, expiresAt, now);
+  }
+  async close() {
+    this.#nonces.clear();
+    this.#records.clear();
+    this.#revokedGrants.clear();
+    this.#revokedAddresses.clear();
+  }
+}
+
 // src/tokens.ts
 var PREFIX = {
   access: "tmcp_at_",
@@ -1711,7 +1860,8 @@ async function issueTokenPair(store, grant, options) {
     scopes: grant.scopes,
     grantCreatedAt: grant.grantCreatedAt,
     issuedAt: now,
-    ...grant.subject === undefined ? {} : { subject: grant.subject }
+    ...grant.subject === undefined ? {} : { subject: grant.subject },
+    ...grant.clientAuth === undefined ? {} : { clientAuth: grant.clientAuth }
   };
   const accessExpires = Math.min(now + options.accessTtlMs, options.grantEndsAt);
   const refreshStored = await store.put({
@@ -1737,6 +1887,75 @@ async function issueTokenPair(store, grant, options) {
   };
 }
 
+// src/oauth/domain-cache.ts
+class DomainCache {
+  #entries = new Map;
+  #counts = new Map;
+  #max;
+  #perDomain;
+  #isDead;
+  constructor(max, perDomain, isDead = () => false) {
+    this.#max = max;
+    this.#perDomain = perDomain;
+    this.#isDead = isDead;
+  }
+  get size() {
+    return this.#entries.size;
+  }
+  get(key) {
+    const entry = this.#entries.get(key);
+    if (entry === undefined)
+      return;
+    this.#entries.delete(key);
+    this.#entries.set(key, entry);
+    return entry.value;
+  }
+  delete(key) {
+    const entry = this.#entries.get(key);
+    if (entry === undefined)
+      return;
+    this.#entries.delete(key);
+    const left = (this.#counts.get(entry.domain) ?? 1) - 1;
+    if (left > 0)
+      this.#counts.set(entry.domain, left);
+    else
+      this.#counts.delete(entry.domain);
+  }
+  set(key, domain, value, now) {
+    this.delete(key);
+    if ((this.#counts.get(domain) ?? 0) >= this.#perDomain) {
+      this.#evictOldestOf(domain);
+    } else if (this.#entries.size >= this.#max) {
+      this.#evict(now);
+    }
+    this.#entries.set(key, { domain, value });
+    this.#counts.set(domain, (this.#counts.get(domain) ?? 0) + 1);
+  }
+  #evict(now) {
+    for (const [key, entry] of this.#entries) {
+      if (this.#isDead(entry.value, now)) {
+        this.delete(key);
+        return;
+      }
+    }
+    const most = Math.max(0, ...this.#counts.values());
+    for (const [key, entry] of this.#entries) {
+      if (this.#counts.get(entry.domain) === most) {
+        this.delete(key);
+        return;
+      }
+    }
+  }
+  #evictOldestOf(domain) {
+    for (const [key, entry] of this.#entries) {
+      if (entry.domain === domain) {
+        this.delete(key);
+        return;
+      }
+    }
+  }
+}
+
 // src/oauth/cimd.ts
 class ClientMetadataError extends Error {
   name = "ClientMetadataError";
@@ -1746,6 +1965,16 @@ class ClientMetadataError extends Error {
     this.reason = reason;
   }
 }
+var TRANSIENT_REASONS = new Set([
+  "rate_limited",
+  "fetch_failed",
+  "unresolvable",
+  "too_large"
+]);
+function isTransient(error) {
+  return TRANSIENT_REASONS.has(error.reason);
+}
+var STALE_GRACE_MS = 60 * 60000;
 var MAX_CLIENT_ID_LENGTH = 2048;
 var MAX_NAME_LENGTH = 64;
 var MAX_REDIRECT_URIS = 20;
@@ -1753,6 +1982,9 @@ var MIN_CACHE_MS = 5 * 60000;
 var DEFAULT_CACHE_MS = 60 * 60000;
 var MAX_CACHE_MS = 24 * 60 * 60000;
 var MAX_CACHE_ENTRIES = 1000;
+var MAX_CACHE_PER_DOMAIN = 100;
+var FAILURE_CACHE_MS = 60000;
+var MAX_FAILURES = 1000;
 async function defaultLookup(hostname) {
   const records = await Bun.dns.lookup(hostname, {});
   return records.map((r) => r.address);
@@ -1786,12 +2018,22 @@ function limitKey(hostname) {
     return h;
   return h.split(".").slice(-2).join(".");
 }
+function knownBudget() {
+  return {
+    perHost: new RateLimiter({ capacity: 5, refillPerSecond: 0.2 }),
+    perDomain: new RateLimiter({ capacity: 15, refillPerSecond: 0.6 }),
+    global: new RateLimiter({ capacity: 100, refillPerSecond: 10 })
+  };
+}
 
 class ClientMetadataFetcher {
-  #cache = new Map;
+  #cache = new DomainCache(MAX_CACHE_ENTRIES, MAX_CACHE_PER_DOMAIN, (entry, now) => entry.until + STALE_GRACE_MS <= now);
+  #failures = new Map;
   #perHost = new RateLimiter({ capacity: 5, refillPerSecond: 0.2 });
   #perDomain = new RateLimiter({ capacity: 15, refillPerSecond: 0.6 });
   #global = new RateLimiter({ capacity: 30, refillPerSecond: 1 });
+  #refreshes = knownBudget();
+  #keys = knownBudget();
   #allowedHosts;
   #logger;
   #timeoutMs;
@@ -1810,34 +2052,106 @@ class ClientMetadataFetcher {
     this.#testMode = options.testMode;
     this.#now = options.now ?? Date.now;
   }
-  async get(clientId) {
+  async get(clientId, options = {}) {
     const url = this.#checkUrl(clientId);
     const now = this.#now();
     const cached = this.#cache.get(clientId);
-    if (cached !== undefined && cached.until > now) {
-      this.#cache.delete(clientId);
-      this.#cache.set(clientId, cached);
+    if (cached !== undefined && cached.until > now)
       return cached.meta;
+    const known = cached !== undefined && now < cached.until + STALE_GRACE_MS;
+    const stale = options.allowStale === true && known ? cached?.meta : undefined;
+    try {
+      const failed = this.#failures.get(clientId);
+      if (failed !== undefined && failed.until > now)
+        throw failed.error;
+      return await this.#refresh(clientId, url, now, known);
+    } catch (error) {
+      const transient = error instanceof ClientMetadataError && isTransient(error);
+      if (!transient)
+        this.#cache.delete(clientId);
+      if (stale === undefined || !transient)
+        throw error;
+      this.#logger?.info("oauth.cimd_stale", {
+        host: url.host,
+        reason: error.reason
+      });
+      return stale;
+    }
+  }
+  async#refresh(clientId, url, now, known) {
+    this.#admit(url, now, known ? "refresh" : "new");
+    let meta;
+    let ttlMs;
+    try {
+      const address = await this.#vettedAddress(url);
+      const response = await this.#fetchJson(url, address, [
+        "application/json"
+      ]);
+      meta = validateDocument(response.doc, clientId, url, {
+        test: this.#testMode !== undefined,
+        onFallback: (reason) => this.#logger?.info("oauth.cimd_auth_fallback", {
+          host: url.host,
+          reason
+        })
+      });
+      ttlMs = cacheMs(response.cacheControl);
+    } catch (error) {
+      if (error instanceof ClientMetadataError) {
+        this.#rememberFailure(clientId, error, now);
+      }
+      throw error;
     }
+    this.#failures.delete(clientId);
+    this.#cache.set(clientId, limitKey(url.hostname), { meta, until: now + ttlMs }, now);
+    return meta;
+  }
+  #rememberFailure(clientId, error, now) {
+    this.#failures.delete(clientId);
+    if (this.#failures.size >= MAX_FAILURES) {
+      const oldest = this.#failures.keys().next().value;
+      if (oldest !== undefined)
+        this.#failures.delete(oldest);
+    }
+    this.#failures.set(clientId, { error, until: now + FAILURE_CACHE_MS });
+  }
+  async fetchJwks(jwksUri) {
+    const url = this.#checkJwksUri(jwksUri);
+    this.#admit(url, this.#now(), "keys");
+    const address = await this.#vettedAddress(url);
+    const response = await this.#fetchJson(url, address, [
+      "application/json",
+      "application/jwk-set+json"
+    ]);
+    return response.doc;
+  }
+  #admit(url, now, budget) {
+    const { perHost, perDomain, global } = budget === "refresh" ? this.#refreshes : budget === "keys" ? this.#keys : {
+      perHost: this.#perHost,
+      perDomain: this.#perDomain,
+      global: this.#global
+    };
     const key = limitKey(url.hostname);
-    if (!this.#perHost.available(url.host, now) || !this.#perDomain.available(key, now)) {
+    if (!perHost.available(url.host, now) || !perDomain.available(key, now)) {
       throw new ClientMetadataError("rate_limited", "Too many requests for this AI app's details. Try again in a minute.");
     }
-    if (!this.#global.take("all", now)) {
+    if (!global.take("all", now)) {
       throw new ClientMetadataError("rate_limited", "The relay is busy. Try again in a minute.");
     }
-    this.#perHost.take(url.host, now);
-    this.#perDomain.take(key, now);
-    const address = await this.#vettedAddress(url);
-    const { meta, ttlMs } = await this.#fetchDocument(url, clientId, address);
-    this.#cache.delete(clientId);
-    if (this.#cache.size >= MAX_CACHE_ENTRIES) {
-      const oldest = this.#cache.keys().next().value;
-      if (oldest !== undefined)
-        this.#cache.delete(oldest);
+    perHost.take(url.host, now);
+    perDomain.take(key, now);
+  }
+  #checkJwksUri(jwksUri) {
+    const url = parseJwksUri(jwksUri, this.#testMode !== undefined);
+    if (url === undefined) {
+      throw new ClientMetadataError("invalid_jwks_uri", "The AI app's jwks_uri is not accepted.");
     }
-    this.#cache.set(clientId, { meta, until: now + ttlMs });
-    return meta;
+    if (this.#allowedHosts.length > 0 && !this.#allowedHosts.includes(url.host)) {
+      throw new ClientMetadataError("host_not_allowed", `This relay does not accept AI apps from ${url.host}.`);
+    }
+    if (isIpLiteral(url.hostname) && !this.#addressAllowed(url.hostname)) {
+      throw this.#notLoaded("private_address", url);
+    }
+    return url;
   }
   #checkUrl(clientId) {
     const refuse = (message) => new ClientMetadataError("invalid_client_id", message);
@@ -1899,9 +2213,9 @@ class ClientMetadataFetcher {
     }
     return addresses.find((a) => parseIpv4(a) !== undefined) ?? addresses[0] ?? "";
   }
-  async#fetchDocument(url, clientId, address) {
+  async#fetchJson(url, address, types) {
     const fail = (detail) => this.#notLoaded("fetch_failed", url, detail);
-    const pinned = new URL(clientId);
+    const pinned = new URL(url.href);
     pinned.hostname = address.includes(":") ? `[${address}]` : address;
     const hostname = url.hostname.replace(/^\[|\]$/g, "");
     const tls = url.protocol === "https:" ? {
@@ -1926,8 +2240,9 @@ class ClientMetadataFetcher {
       if (response.status !== 200)
         throw fail(`status_${response.status}`);
       const type = (response.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase();
-      if (type !== "application/json")
+      if (type === undefined || !types.includes(type)) {
         throw fail("not_json");
+      }
       const text = await this.#readLimited(response, url);
       let doc;
       try {
@@ -1935,8 +2250,7 @@ class ClientMetadataFetcher {
       } catch {
         throw fail("bad_json");
       }
-      const meta = validateDocument(doc, clientId, url);
-      return { meta, ttlMs: cacheMs(response.headers.get("cache-control")) };
+      return { doc, cacheControl: response.headers.get("cache-control") };
     } finally {
       if (!response.bodyUsed)
         response.body?.cancel().catch(() => {});
@@ -1991,7 +2305,7 @@ function foreignDomain(name, hostname) {
   }
   return false;
 }
-function validateDocument(doc, clientId, url) {
+function validateDocument(doc, clientId, url, options = {}) {
   const invalid = (message) => new ClientMetadataError("invalid_metadata", message);
   if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
     throw invalid("The AI app's details are not a JSON object.");
@@ -2017,11 +2331,7 @@ function validateDocument(doc, clientId, url) {
   if (!Array.isArray(uris) || uris.length === 0 || uris.length > MAX_REDIRECT_URIS || !uris.every((u) => typeof u === "string" && isRedirectUri(u))) {
     throw invalid("The AI app's details have no valid redirect_uris.");
   }
-  const method = d["token_endpoint_auth_method"];
-  const supported = d["token_endpoint_auth_methods_supported"];
-  if (method !== undefined && method !== "none" && !(Array.isArray(supported) && supported.includes("none"))) {
-    throw invalid('The AI app must use token_endpoint_auth_method "none" with this relay, or list "none" in token_endpoint_auth_methods_supported.');
-  }
+  const auth = clientAuth(d, url, options, invalid);
   const grants = d["grant_types"];
   if (grants !== undefined && (!Array.isArray(grants) || !grants.includes("authorization_code"))) {
     throw invalid("The AI app's details do not allow the authorization code grant.");
@@ -2034,9 +2344,81 @@ function validateDocument(doc, clientId, url) {
     clientId,
     name: displayName(name),
     host: url.host,
-    redirectUris: uris
+    redirectUris: uris,
+    auth
   };
 }
+function clientAuth(d, url, options, invalid) {
+  const method = d["token_endpoint_auth_method"];
+  const supported = d["token_endpoint_auth_methods_supported"];
+  const listsNone = Array.isArray(supported) && supported.includes("none");
+  if (method === undefined || method === "none")
+    return { method: "none" };
+  const checked = method === "private_key_jwt" ? privateKeyJwt(d, url, options.test === true) : {
+    problem: "unsupported_method",
+    message: 'The AI app must use token_endpoint_auth_method "none" or "private_key_jwt" with this relay, or list "none" in token_endpoint_auth_methods_supported.'
+  };
+  if ("jwksUri" in checked) {
+    return { method: "private_key_jwt", ...checked, publicAllowed: listsNone };
+  }
+  if (listsNone) {
+    options.onFallback?.(checked.problem);
+    return { method: "none" };
+  }
+  throw invalid(checked.message);
+}
+function privateKeyJwt(d, url, test) {
+  const jwksUri = d["jwks_uri"];
+  if (jwksUri === undefined) {
+    return {
+      problem: "no_jwks_uri",
+      message: "The AI app uses private_key_jwt but publishes no jwks_uri (an inline jwks is not accepted)."
+    };
+  }
+  if (d["jwks"] !== undefined) {
+    return {
+      problem: "jwks_and_jwks_uri",
+      message: "The AI app's details have both jwks and jwks_uri."
+    };
+  }
+  const parsed = typeof jwksUri === "string" ? parseJwksUri(jwksUri, test) : undefined;
+  if (parsed === undefined || parsed.protocol !== url.protocol || parsed.host !== url.host) {
+    return {
+      problem: "bad_jwks_uri",
+      message: "The AI app's jwks_uri must be an https:// URL on the host of its client_id."
+    };
+  }
+  const alg = d["token_endpoint_auth_signing_alg"];
+  if (alg !== undefined && !isAlgorithm(alg)) {
+    return {
+      problem: "signing_alg",
+      message: "The AI app's token_endpoint_auth_signing_alg is not one this relay accepts."
+    };
+  }
+  return {
+    jwksUri: parsed.href,
+    algorithms: alg === undefined ? JWT_ALGORITHMS : [alg]
+  };
+}
+function parseJwksUri(value, test) {
+  if (value.length > MAX_CLIENT_ID_LENGTH)
+    return;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return;
+  }
+  const scheme = url.protocol === "https:" || test && url.protocol === "http:";
+  if (!scheme || url.href !== value)
+    return;
+  if (url.username !== "" || url.password !== "" || url.hash !== "") {
+    return;
+  }
+  if (url.port !== "" && !test)
+    return;
+  return url;
+}
 var PRIVATE_USE_SCHEME = /^[a-z][a-z0-9+-]*(\.[a-z0-9+-]+)+:$/;
 function isRedirectUri(value) {
   if (value.length > 2048 || value.includes("#"))
@@ -2080,6 +2462,151 @@ function redirectUriMatches(requested, registered) {
   return a.href === b.href;
 }
 
+// src/oauth/client-auth.ts
+var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var CLIENT_ASSERTION_MAX_LIFETIME_MS = 60 * 60000;
+var CLIENT_ASSERTION_MAX_AGE_MS = 5 * 60000;
+var CLIENT_ASSERTION_LEEWAY_MS = 30000;
+var MAX_JTI2 = 256;
+var MAX_KEY_SETS = 1000;
+var MAX_KEY_SETS_PER_DOMAIN = 100;
+var SWEEP_INTERVAL_MS = 1000;
+var ACCEPTED_TYPES = new Set(["jwt", "client-authentication+jwt"]);
+function assertionSubject(assertion) {
+  try {
+    const sub = decodeJwt(assertion).payload["sub"];
+    return typeof sub === "string" && sub !== "" ? sub : undefined;
+  } catch {
+    return;
+  }
+}
+function nonceKey(clientId, jti) {
+  return hashToken(JSON.stringify(["client_assertion", clientId, jti]));
+}
+async function verifyClientAssertion(assertion, check) {
+  const { header, payload } = await verifyJwt(assertion, check.keys, {
+    algorithms: check.auth.algorithms
+  });
+  const typ = header["typ"];
+  if (typ !== undefined && (typeof typ !== "string" || !ACCEPTED_TYPES.has(typ.toLowerCase()))) {
+    throw new JwtError("typ", "the assertion's type is not a client assertion");
+  }
+  if (payload["iss"] !== check.clientId) {
+    throw new JwtError("iss", "the assertion's issuer is not the client");
+  }
+  if (payload["sub"] !== check.clientId) {
+    throw new JwtError("sub", "the assertion's subject is not the client");
+  }
+  if (!audiences(payload).some((a) => check.audiences.includes(a))) {
+    throw new JwtError("aud", "the assertion is not for this relay");
+  }
+  const usableUntil = checkTimes(payload, check.now);
+  const jti = payload["jti"];
+  if (typeof jti !== "string" || jti === "" || jti.length > MAX_JTI2) {
+    throw new JwtError("jti", "the assertion needs a jti");
+  }
+  const key = nonceKey(check.clientId, jti);
+  if (!await check.claimNonce(key, usableUntil, check.now)) {
+    throw new JwtError("replayed", "the assertion was already used");
+  }
+}
+function checkTimes(payload, now) {
+  const leeway = CLIENT_ASSERTION_LEEWAY_MS;
+  const exp = numericDate(payload, "exp");
+  if (exp === undefined)
+    throw new JwtError("exp", "the assertion has no exp");
+  if (exp <= now - leeway) {
+    throw new JwtError("expired", "the assertion has expired");
+  }
+  if (exp > now + CLIENT_ASSERTION_MAX_LIFETIME_MS + leeway) {
+    throw new JwtError("lifetime", "the assertion lives longer than an hour");
+  }
+  const iat = numericDate(payload, "iat");
+  let end = exp;
+  if (iat === undefined) {
+    if (exp > now + CLIENT_ASSERTION_MAX_AGE_MS + leeway) {
+      throw new JwtError("lifetime", "an assertion without iat may live five minutes");
+    }
+  } else {
+    if (iat > now + leeway) {
+      throw new JwtError("iat", "the assertion was issued in the future");
+    }
+    if (iat + CLIENT_ASSERTION_MAX_AGE_MS <= now - leeway) {
+      throw new JwtError("too_old", "the assertion was issued too long ago");
+    }
+    end = Math.min(exp, iat + CLIENT_ASSERTION_MAX_AGE_MS);
+  }
+  const nbf = numericDate(payload, "nbf");
+  if (nbf !== undefined && nbf > now + leeway) {
+    throw new JwtError("nbf", "the assertion is not valid yet");
+  }
+  return end + leeway;
+}
+function quotaKey(clientId) {
+  return ipPrefixKey(new URL(clientId).hostname.replace(/\.$/, ""));
+}
+
+class NonceQuota {
+  #until = new Map;
+  #perDomain;
+  #max;
+  #total = 0;
+  #sweptAt = Number.NEGATIVE_INFINITY;
+  constructor(perDomain, max) {
+    this.#perDomain = perDomain;
+    this.#max = max;
+  }
+  refusal(domain, now) {
+    this.sweep(now);
+    if ((this.#until.get(domain)?.length ?? 0) >= this.#perDomain) {
+      return "domain_full";
+    }
+    return this.#total >= this.#max ? "full" : undefined;
+  }
+  add(domain, until) {
+    const list = this.#until.get(domain);
+    if (list === undefined)
+      this.#until.set(domain, [until]);
+    else
+      list.push(until);
+    this.#total++;
+  }
+  sweep(now) {
+    if (now - this.#sweptAt < SWEEP_INTERVAL_MS)
+      return false;
+    this.#sweptAt = now;
+    this.#total = 0;
+    for (const [domain, list] of this.#until) {
+      const live = list.filter((until) => until > now);
+      if (live.length === 0)
+        this.#until.delete(domain);
+      else
+        this.#until.set(domain, live);
+      this.#total += live.length;
+    }
+    return true;
+  }
+}
+
+class ClientKeySets {
+  #sets = new DomainCache(MAX_KEY_SETS, MAX_KEY_SETS_PER_DOMAIN);
+  #load;
+  #now;
+  constructor(load, now = Date.now) {
+    this.#load = load;
+    this.#now = now;
+  }
+  for(jwksUri) {
+    const known = this.#sets.get(jwksUri);
+    if (known !== undefined)
+      return known;
+    const set = new JwksCache(jwksUri, { load: this.#load, now: this.#now });
+    const domain = limitKey(new URL(jwksUri).hostname);
+    this.#sets.set(jwksUri, domain, set, this.#now());
+    return set;
+  }
+}
+
 // src/oauth/html.ts
 var ESCAPES = {
   "&": "&amp;",
@@ -2649,6 +3176,12 @@ var REFRESH_REUSE_WINDOW_MS = 24 * 60 * 60000;
 var MAX_CODES = 1e4;
 var MAX_FORM_BYTES = 8192;
 var MAX_STATE_LENGTH = 1024;
+var MAX_NONCES_PER_HOST = 1e4;
+var MAX_NONCES = 1e5;
+var CLIENT_AUTH_FAILED = "client authentication failed";
+function assertionRequired(auth) {
+  return auth.method === "private_key_jwt" && !auth.publicAllowed;
+}
 
 class OAuthError extends Error {
   status;
@@ -2698,10 +3231,16 @@ function hostOf(url) {
     return url;
   }
 }
+function logHost(clientId) {
+  return clientId !== undefined && URL.canParse(clientId) ? hostOf(clientId).slice(0, 100) : "(not a URL)";
+}
 
 class AuthorizationServer {
   #host;
   #cimd;
+  #clientKeys;
+  #nonces = new NonceSet;
+  #nonceQuota = new NonceQuota(MAX_NONCES_PER_HOST, MAX_NONCES);
   #pending = new Map;
   #pendingPerIp = new Map;
   #pendingPerAddress = new Map;
@@ -2752,6 +3291,8 @@ class AuthorizationServer {
       logger: host.logger,
       ...testMode?.cimd === undefined ? {} : { testMode: testMode.cimd }
     });
+    const cimd = this.#cimd;
+    this.#clientKeys = new ClientKeySets((url) => cimd.fetchJwks(url));
   }
   get #issuer() {
     return this.#host.publicUrl();
@@ -2805,8 +3346,10 @@ class AuthorizationServer {
       response_modes_supported: ["query"],
       grant_types_supported: ["authorization_code", "refresh_token"],
       code_challenge_methods_supported: ["S256"],
-      token_endpoint_auth_methods_supported: ["none"],
-      revocation_endpoint_auth_methods_supported: ["none"],
+      token_endpoint_auth_methods_supported: ["none", "private_key_jwt"],
+      token_endpoint_auth_signing_alg_values_supported: JWT_ALGORITHMS,
+      revocation_endpoint_auth_methods_supported: ["none", "private_key_jwt"],
+      revocation_endpoint_auth_signing_alg_values_supported: JWT_ALGORITHMS,
       scopes_supported: [SCOPE],
       client_id_metadata_document_supported: true,
       authorization_response_iss_parameter_supported: true,
@@ -3305,20 +3848,21 @@ ${cancel}
         "code_verifier",
         "refresh_token",
         "resource",
-        "scope"
+        "scope",
+        "client_assertion",
+        "client_assertion_type"
       ]);
       if ("duplicate" in p) {
         throw new OAuthError(400, "invalid_request", `${p.duplicate} was sent more than once`);
       }
-      const clientId = p["client_id"];
-      if (clientId === undefined) {
-        throw new OAuthError(400, "invalid_request", "client_id is required");
-      }
+      const client = await this.#authenticateClient(p, [
+        `${this.#issuer}/token`
+      ]);
       let body;
       if (p["grant_type"] === "authorization_code") {
-        body = await this.#codeGrant(p, clientId);
+        body = await this.#codeGrant(p, client);
       } else if (p["grant_type"] === "refresh_token") {
-        body = await this.#refreshGrant(p, clientId);
+        body = await this.#refreshGrant(p, client);
       } else if (p["grant_type"] === undefined) {
         throw new OAuthError(400, "invalid_request", "grant_type is required");
       } else {
@@ -3352,19 +3896,96 @@ ${cancel}
       throw new OAuthError(400, "invalid_request", "the body must be application/x-www-form-urlencoded");
     }
     if (req.headers.get("authorization") !== null) {
-      throw new OAuthError(401, "invalid_client", "client authentication is not supported (token_endpoint_auth_method none)");
+      throw new OAuthError(401, "invalid_client", "HTTP authentication is not supported (token_endpoint_auth_method none or private_key_jwt)");
     }
     const text = await this.#readForm(req);
     if (text === undefined) {
       throw new OAuthError(413, "invalid_request", "the request is too large");
     }
     const params = new URLSearchParams(text);
-    if (params.has("client_secret") || params.has("client_assertion")) {
-      throw new OAuthError(400, "invalid_client", "client authentication is not supported (token_endpoint_auth_method none)");
+    if (params.has("client_secret")) {
+      throw new OAuthError(400, "invalid_client", "client secrets are not supported (token_endpoint_auth_method none or private_key_jwt)");
     }
     return params;
   }
-  async#codeGrant(p, clientId) {
+  async#authenticateClient(p, endpoints) {
+    const assertion = p["client_assertion"];
+    const type = p["client_assertion_type"];
+    if (assertion === undefined && type === undefined) {
+      const clientId = p["client_id"];
+      if (clientId === undefined) {
+        throw new OAuthError(400, "invalid_request", "client_id is required");
+      }
+      return { clientId, assertion: false };
+    }
+    if (assertion === undefined || type === undefined) {
+      throw new OAuthError(400, "invalid_request", "client_assertion and client_assertion_type go together");
+    }
+    const clientId = p["client_id"] ?? assertionSubject(assertion);
+    if (type !== CLIENT_ASSERTION_TYPE) {
+      throw this.#clientAuthFailed(clientId, "assertion_type");
+    }
+    if (clientId === undefined) {
+      throw this.#clientAuthFailed(clientId, "no_client_id");
+    }
+    let client;
+    try {
+      client = await this.#cimd.get(clientId, { allowStale: true });
+    } catch (error) {
+      if (!(error instanceof ClientMetadataError))
+        throw error;
+      const reason = `metadata_${error.reason}`;
+      throw isTransient(error) || error.reason === "private_address" ? this.#clientAuthUnavailable(clientId, reason) : this.#clientAuthFailed(clientId, reason);
+    }
+    if (client.auth.method !== "private_key_jwt") {
+      throw this.#clientAuthFailed(clientId, "not_private_key_jwt");
+    }
+    const domain = quotaKey(clientId);
+    try {
+      await verifyClientAssertion(assertion, {
+        clientId,
+        auth: client.auth,
+        keys: this.#clientKeys.for(client.auth.jwksUri),
+        audiences: [this.#issuer, ...endpoints],
+        claimNonce: (key, until, now) => this.#claimNonce(clientId, domain, key, until, now),
+        now: Date.now()
+      });
+    } catch (error) {
+      if (!(error instanceof JwtError))
+        throw error;
+      throw error.reason === "jwks_unavailable" ? this.#clientAuthUnavailable(clientId, error.reason) : this.#clientAuthFailed(clientId, error.reason);
+    }
+    return { clientId, assertion: true };
+  }
+  #clientAuthFailed(clientId, reason) {
+    this.#host.logger.info("oauth.client_auth_failed", {
+      client: logHost(clientId),
+      reason
+    });
+    return new OAuthError(401, "invalid_client", CLIENT_AUTH_FAILED);
+  }
+  #clientAuthUnavailable(clientId, reason) {
+    this.#host.logger.warn("oauth.client_auth_unavailable", {
+      client: logHost(clientId),
+      reason
+    });
+    return new OAuthError(503, "temporarily_unavailable", "the client cannot be authenticated right now; try again shortly");
+  }
+  async#claimNonce(clientId, domain, key, until, now) {
+    if (this.#nonceQuota.sweep(now))
+      this.#nonces.sweep(now);
+    const refusal = this.#nonceQuota.refusal(domain, now);
+    if (refusal !== undefined) {
+      throw this.#clientAuthUnavailable(clientId, `nonces_${refusal}`);
+    }
+    const store = this.#host.store;
+    const claimed = store.claimNonce === undefined ? this.#nonces.claim(key, until, now) : await store.claimNonce(key, until, now);
+    if (claimed)
+      this.#nonceQuota.add(domain, until);
+    return claimed;
+  }
+  async#codeGrant(p, client) {
+    const clientId = client.clientId;
     const code = p["code"];
     const redirectUri = p["redirect_uri"];
     const verifier = p["code_verifier"];
@@ -3376,6 +3997,12 @@ ${cancel}
     const invalid = (why) => new OAuthError(400, "invalid_grant", why);
     if (issued === undefined)
       throw invalid("the code is not valid");
+    if (!constantTimeEqual(clientId, issued.client.clientId)) {
+      throw invalid("the code was issued to another client");
+    }
+    if (assertionRequired(issued.client.auth) && !client.assertion) {
+      throw this.#clientAuthFailed(clientId, "assertion_required");
+    }
     if (issued.used) {
       if (issued.grantId !== undefined) {
         await this.#revokeGrant(issued.addressId, issued.grantId, "reuse_detected");
@@ -3385,9 +4012,6 @@ ${cancel}
     issued.used = true;
     if (issued.expiresAt <= Date.now())
       throw invalid("the code has expired");
-    if (!constantTimeEqual(clientId, issued.client.clientId)) {
-      throw invalid("the code was issued to another client");
-    }
     if (redirectUri !== issued.redirectUri) {
       throw invalid("redirect_uri does not match the authorization request");
     }
@@ -3411,7 +4035,8 @@ ${cancel}
       clientName: issued.client.name,
       scopes: issued.scopes,
       grantCreatedAt: now,
-      ...issued.subject === undefined ? {} : { subject: issued.subject }
+      ...issued.subject === undefined ? {} : { subject: issued.subject },
+      ...client.assertion ? { clientAuth: "private_key_jwt" } : {}
     }, {
       accessTtlMs: config.accessTokenTtlMs,
       refreshTtlMs: config.refreshTokenTtlMs,
@@ -3445,7 +4070,8 @@ ${cancel}
       scope: scopes.join(" ")
     };
   }
-  async#refreshGrant(p, clientId) {
+  async#refreshGrant(p, client) {
+    const clientId = client.clientId;
     const token = p["refresh_token"];
     if (token === undefined) {
       throw new OAuthError(400, "invalid_request", "refresh_token is required");
@@ -3459,6 +4085,9 @@ ${cancel}
     if (!constantTimeEqual(clientId, record.clientId)) {
       throw invalid("the refresh token was issued to another client");
     }
+    if (record.clientAuth === "private_key_jwt" && !client.assertion) {
+      throw this.#clientAuthFailed(clientId, "assertion_required");
+    }
     const now = Date.now();
     if (record.expiresAt <= now)
       throw invalid("the refresh token has expired");
@@ -3490,7 +4119,8 @@ ${cancel}
       clientName: record.clientName,
       scopes: record.scopes,
       grantCreatedAt: record.grantCreatedAt,
-      ...record.subject === undefined ? {} : { subject: record.subject }
+      ...record.subject === undefined ? {} : { subject: record.subject },
+      ...record.clientAuth === "private_key_jwt" || client.assertion ? { clientAuth: "private_key_jwt" } : {}
     }, {
       accessTtlMs: this.#host.config.accessTokenTtlMs,
       refreshTtlMs: this.#host.config.refreshTokenTtlMs,
@@ -3526,24 +4156,36 @@ ${cancel}
         throw new OAuthError(429, "temporarily_unavailable", "too many requests; try again shortly");
       }
       const params = await this.#formParams(req);
-      const p = single(params, ["token", "client_id", "token_type_hint"]);
+      const p = single(params, [
+        "token",
+        "client_id",
+        "token_type_hint",
+        "client_assertion",
+        "client_assertion_type"
+      ]);
       if ("duplicate" in p) {
         throw new OAuthError(400, "invalid_request", `${p.duplicate} was sent more than once`);
       }
       const token = p["token"];
-      const clientId = p["client_id"];
-      if (token === undefined || clientId === undefined) {
-        throw new OAuthError(400, "invalid_request", "token and client_id are required");
+      if (token === undefined) {
+        throw new OAuthError(400, "invalid_request", "token is required");
       }
+      const client = await this.#authenticateClient(p, [
+        `${this.#issuer}/revoke`,
+        `${this.#issuer}/token`
+      ]);
       const record = await this.#host.store.get(hashToken(token));
       if (record === undefined)
         return new Response(null, {
           status: 200,
           headers: { ...this.#cors(), ...noStore }
         });
-      if (!constantTimeEqual(clientId, record.clientId)) {
+      if (!constantTimeEqual(client.clientId, record.clientId)) {
         throw new OAuthError(400, "invalid_client", "the token was issued to another client");
       }
+      if (record.clientAuth === "private_key_jwt" && !client.assertion) {
+        throw this.#clientAuthFailed(client.clientId, "assertion_required");
+      }
       await this.#revokeGrant(record.addressId, record.grantId, "revoked");
       this.#host.logger.info("oauth.revoked", {
         address: shortAddress(record.addressId),
@@ -3589,6 +4231,7 @@ ${cancel}
     this.#guessesPerAddress.sweep(now);
     this.#tokenPerIp.sweep(now);
     this.#refreshesPerGrant.sweep(now);
+    this.#nonces.sweep(now);
   }
 }
 
@@ -3997,112 +4640,10 @@ class TabSession {
   }
 }
 
-// src/store/memory.ts
-function copy(record) {
-  return { ...record, scopes: [...record.scopes] };
-}
-function matches(record, selector) {
-  return "grantId" in selector ? record.grantId === selector.grantId : record.addressId === selector.addressId;
-}
-function isLive(record, now) {
-  return record.expiresAt > now && (record.kind === "access" || record.usedAt === undefined);
-}
-function summarizeGrants(records, now) {
-  const grants = new Map;
-  for (const r of records) {
-    if (!isLive(r, now) || grants.has(r.grantId))
-      continue;
-    const summary = {
-      grantId: r.grantId,
-      clientId: r.clientId,
-      clientName: r.clientName,
-      scopes: [...r.scopes],
-      createdAt: r.grantCreatedAt
-    };
-    if (r.subject !== undefined)
-      summary.subject = r.subject;
-    grants.set(r.grantId, summary);
-  }
-  return [...grants.values()].sort((a, b) => a.createdAt - b.createdAt || a.grantId.localeCompare(b.grantId));
-}
-
-class MemoryTokenStore {
-  #records = new Map;
-  #revokedGrants = new Map;
-  #revokedAddresses = new Map;
-  async put(record) {
-    if (this.#revokedGrants.has(record.grantId))
-      return false;
-    const address = this.#revokedAddresses.get(record.addressId);
-    if (address !== undefined && record.grantCreatedAt <= address.at) {
-      return false;
-    }
-    this.#records.set(record.hash, copy(record));
-    return true;
-  }
-  async get(hash) {
-    const r = this.#records.get(hash);
-    return r === undefined ? undefined : copy(r);
-  }
-  async markUsed(hash, now, keepUntil) {
-    const r = this.#records.get(hash);
-    if (r === undefined || r.usedAt !== undefined)
-      return false;
-    r.usedAt = now;
-    r.expiresAt = Math.min(r.expiresAt, keepUntil);
-    return true;
-  }
-  async revoke(selector, options) {
-    if ("grantId" in selector) {
-      this.#revokedGrants.set(selector.grantId, options.keepUntil);
-    } else {
-      const old = this.#revokedAddresses.get(selector.addressId);
-      this.#revokedAddresses.set(selector.addressId, {
-        at: Math.max(old?.at ?? 0, options.now),
-        until: Math.max(old?.until ?? 0, options.keepUntil)
-      });
-    }
-    let n = 0;
-    for (const [hash, r] of this.#records) {
-      if (matches(r, selector)) {
-        this.#records.delete(hash);
-        n++;
-      }
-    }
-    return n;
-  }
-  async listGrants(addressId, now) {
-    const own = [...this.#records.values()].filter((r) => r.addressId === addressId);
-    return summarizeGrants(own, now);
-  }
-  async deleteExpired(now) {
-    for (const [id, until] of this.#revokedGrants) {
-      if (until <= now)
-        this.#revokedGrants.delete(id);
-    }
-    for (const [id, t] of this.#revokedAddresses) {
-      if (t.until <= now)
-        this.#revokedAddresses.delete(id);
-    }
-    let n = 0;
-    for (const [hash, r] of this.#records) {
-      if (r.expiresAt <= now) {
-        this.#records.delete(hash);
-        n++;
-      }
-    }
-    return n;
-  }
-  async close() {
-    this.#records.clear();
-    this.#revokedGrants.clear();
-    this.#revokedAddresses.clear();
-  }
-}
-
 // src/store/sqlite.ts
 import { Database } from "bun:sqlite";
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 5;
+var MIN_READER_VERSION = 5;
 var REUSE_WINDOW_MS = 86400000;
 function toRecord(row) {
   const record = {
@@ -4121,6 +4662,8 @@ function toRecord(row) {
     record.usedAt = row.used_at;
   if (row.subject !== null)
     record.subject = row.subject;
+  if (row.client_auth === "private_key_jwt")
+    record.clientAuth = "private_key_jwt";
   return record;
 }
 
@@ -4131,7 +4674,24 @@ class SqliteTokenStore {
     this.#db.run("PRAGMA busy_timeout = 5000");
     if (path !== ":memory:")
       this.#db.run("PRAGMA journal_mode = WAL");
+    this.#checkReader();
     this.#migrate();
+    this.#db.run(`CREATE TABLE IF NOT EXISTS meta (
+			key TEXT PRIMARY KEY,
+			value INTEGER NOT NULL
+		) STRICT`);
+    this.#db.query(`INSERT INTO meta (key, value) VALUES ('min_reader_version', $v)
+				ON CONFLICT (key) DO UPDATE SET value = max(value, excluded.value)`).run({ v: MIN_READER_VERSION });
+  }
+  #checkReader() {
+    const table = this.#db.query("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'meta'").get();
+    if (table === null)
+      return;
+    const row = this.#db.query("SELECT value FROM meta WHERE key = 'min_reader_version'").get();
+    if (row !== null && row.value > SCHEMA_VERSION) {
+      this.#db.close();
+      throw new Error(`the token store file needs a newer relay (schema ${row.value}; this relay knows ${SCHEMA_VERSION})`);
+    }
   }
   #migrate() {
     const row = this.#db.query("PRAGMA user_version").get();
@@ -4157,12 +4717,20 @@ class SqliteTokenStore {
 				issued_at INTEGER NOT NULL,
 				expires_at INTEGER NOT NULL,
 				used_at INTEGER,
-				subject TEXT
+				subject TEXT,
+				client_auth TEXT
 			) STRICT`);
       const columns = this.#db.query("PRAGMA table_info(tokens)").all();
       if (!columns.some((c) => c.name === "subject")) {
         this.#db.run("ALTER TABLE tokens ADD COLUMN subject TEXT");
       }
+      if (!columns.some((c) => c.name === "client_auth")) {
+        this.#db.run("ALTER TABLE tokens ADD COLUMN client_auth TEXT");
+      }
+      this.#db.run(`CREATE TABLE IF NOT EXISTS nonces (
+				key TEXT PRIMARY KEY,
+				expires_at INTEGER NOT NULL
+			) STRICT`);
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_grant ON tokens (grant_id)");
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_address ON tokens (address_id)");
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_expires ON tokens (expires_at)");
@@ -4187,9 +4755,11 @@ class SqliteTokenStore {
   }
   #insert(r) {
     this.#db.query(`INSERT OR REPLACE INTO tokens (hash, kind, grant_id, address_id, client_id,
-				client_name, scopes, grant_created_at, issued_at, expires_at, used_at, subject)
+				client_name, scopes, grant_created_at, issued_at, expires_at, used_at, subject,
+				client_auth)
 				VALUES ($hash, $kind, $grant_id, $address_id, $client_id, $client_name,
-				$scopes, $grant_created_at, $issued_at, $expires_at, $used_at, $subject)`).run({
+				$scopes, $grant_created_at, $issued_at, $expires_at, $used_at, $subject,
+				$client_auth)`).run({
       hash: r.hash,
       kind: r.kind,
       grant_id: r.grantId,
@@ -4201,7 +4771,8 @@ class SqliteTokenStore {
       issued_at: r.issuedAt,
       expires_at: r.expiresAt,
       used_at: r.usedAt ?? null,
-      subject: r.subject ?? null
+      subject: r.subject ?? null,
+      client_auth: r.clientAuth ?? null
     });
   }
   async get(hash) {
@@ -4237,8 +4808,15 @@ class SqliteTokenStore {
   }
   async deleteExpired(now) {
     this.#db.query("DELETE FROM revocations WHERE keep_until <= $now").run({ now });
+    this.#db.query("DELETE FROM nonces WHERE expires_at <= $now").run({ now });
     return this.#db.query("DELETE FROM tokens WHERE expires_at <= $now").run({ now }).changes;
   }
+  async claimNonce(key, expiresAt, now) {
+    const result = this.#db.query(`INSERT INTO nonces (key, expires_at) VALUES ($key, $expires_at)
+				ON CONFLICT (key) DO UPDATE SET expires_at = excluded.expires_at
+				WHERE nonces.expires_at <= $now`).run({ key, expires_at: expiresAt, now });
+    return result.changes === 1;
+  }
   async close() {
     this.#db.close();
   }
@@ -5206,5 +5784,5 @@ export {
   resolveConfig
 };
 
-//# debugId=BA745D07E3DF06AF64756E2164756E21
+//# debugId=61513056506259C164756E2164756E21
 //# sourceMappingURL=index.js.map