@samebase/identity-broker 0.1.0 → 0.3.0

package/dist/client/protocol.d.ts

@@ -47,7 +47,8 @@ export type AuthorizeInput = {
 /**
  * The first half of /authorize validation: the parameters that identify the client and where to
  * send errors. Everything else is checked by `validateAuthorizeRest` once the client is known, so
- * those errors can go back to the registered redirect URI.
+ * those errors can go back to the registered redirect URI. A repeated parameter of any name is
+ * refused first, so an ambiguous `client_id` or `redirect_uri` never picks a redirect target.
  */
 export declare function validateAuthorizeTarget(params: URLSearchParams): Validation<{
     clientId: string;
@@ -67,7 +68,11 @@ export type TokenInput = {
         method: TokenEndpointAuthMethod;
     };
 };
-/** Client credentials from HTTP Basic (RFC 6749 section 2.3.1) or the form body. */
+/**
+ * Client credentials from HTTP Basic (RFC 6749 section 2.3.1) or the form body. The first look at a
+ * token request, so it also refuses a repeated parameter (RFC 6749 section 3.2) and a request that
+ * uses both methods (section 2.3).
+ */
 export declare function readClientAuthentication(authorization: string | null, params: URLSearchParams): Validation<TokenInput["client"]>;
 export declare function validateTokenRequest(params: URLSearchParams, client: TokenInput["client"]): Validation<TokenInput>;
 export declare function readBearerToken(authorization: string | null): string | null;

package/dist/client/protocol.js

@@ -18,6 +18,11 @@ export function asRecord(value) {
 function invalid(status, error, description) {
     return { ok: false, status, error, description };
 }
+/** RFC 6749 sections 3.1 and 3.2: a request parameter must not be included more than once. */
+function hasRepeatedParameter(params) {
+    const names = [...params.keys()];
+    return new Set(names).size !== names.length;
+}
 function isLoopbackHost(hostname) {
     return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 }
@@ -96,7 +101,8 @@ export function validateRegistration(payload) {
     if (deploymentType === undefined) {
         return invalid(400, "invalid_client_metadata", `deployment_type must be one of ${DEPLOYMENT_TYPES.join(", ")}.`);
     }
-    const authMethod = TOKEN_ENDPOINT_AUTH_METHODS.find((method) => method === (record["token_endpoint_auth_method"] ?? "client_secret_post"));
+    // RFC 7591 section 2: the default is client_secret_basic.
+    const authMethod = TOKEN_ENDPOINT_AUTH_METHODS.find((method) => method === (record["token_endpoint_auth_method"] ?? "client_secret_basic"));
     if (authMethod === undefined) {
         return invalid(400, "invalid_client_metadata", `token_endpoint_auth_method must be one of ${TOKEN_ENDPOINT_AUTH_METHODS.join(", ")}.`);
     }
@@ -126,9 +132,13 @@ export function validateRegistration(payload) {
 /**
  * The first half of /authorize validation: the parameters that identify the client and where to
  * send errors. Everything else is checked by `validateAuthorizeRest` once the client is known, so
- * those errors can go back to the registered redirect URI.
+ * those errors can go back to the registered redirect URI. A repeated parameter of any name is
+ * refused first, so an ambiguous `client_id` or `redirect_uri` never picks a redirect target.
  */
 export function validateAuthorizeTarget(params) {
+    if (hasRepeatedParameter(params)) {
+        return invalid(400, "invalid_request", "A parameter is repeated.");
+    }
     const clientId = params.get("client_id")?.trim() ?? "";
     if (clientId.length === 0) {
         return invalid(400, "invalid_request", "client_id is required.");
@@ -163,6 +173,9 @@ export function validateAuthorizeRest(params, target) {
         return invalid(400, "invalid_request", 'code_challenge_method must be "S256".');
     }
     const prompt = (params.get("prompt") ?? "").split(/\s+/).filter((value) => value.length > 0);
+    if (prompt.some((value) => value !== "none" && value !== "login")) {
+        return invalid(400, "invalid_request", "prompt value not supported");
+    }
     if (prompt.includes("none") && prompt.length > 1) {
         return invalid(400, "invalid_request", "prompt=none cannot be combined with other values.");
     }
@@ -190,9 +203,19 @@ export function validateAuthorizeRest(params, target) {
         },
     };
 }
-/** Client credentials from HTTP Basic (RFC 6749 section 2.3.1) or the form body. */
+/**
+ * Client credentials from HTTP Basic (RFC 6749 section 2.3.1) or the form body. The first look at a
+ * token request, so it also refuses a repeated parameter (RFC 6749 section 3.2) and a request that
+ * uses both methods (section 2.3).
+ */
 export function readClientAuthentication(authorization, params) {
+    if (hasRepeatedParameter(params)) {
+        return invalid(400, "invalid_request", "A parameter is repeated.");
+    }
     if (authorization !== null) {
+        if (params.has("client_secret")) {
+            return invalid(400, "invalid_request", "Use one client authentication method, not two.");
+        }
         const match = authorization.trim().match(/^basic\s+(.+)$/i);
         if (match === null || match[1] === undefined) {
             return invalid(401, "invalid_client", "Only HTTP Basic client authentication is supported.");
@@ -208,14 +231,19 @@ export function readClientAuthentication(authorization, params) {
         if (separator <= 0) {
             return invalid(401, "invalid_client", "The Authorization header must hold client_id:client_secret.");
         }
-        return {
-            ok: true,
-            value: {
-                clientId: decodeURIComponent(decoded.slice(0, separator)),
-                clientSecret: decodeURIComponent(decoded.slice(separator + 1)),
-                method: "client_secret_basic",
-            },
-        };
+        try {
+            return {
+                ok: true,
+                value: {
+                    clientId: decodeURIComponent(decoded.slice(0, separator)),
+                    clientSecret: decodeURIComponent(decoded.slice(separator + 1)),
+                    method: "client_secret_basic",
+                },
+            };
+        }
+        catch {
+            return invalid(401, "invalid_client", "The Authorization header is not valid form encoding.");
+        }
     }
     const clientId = params.get("client_id") ?? "";
     const clientSecret = params.get("client_secret") ?? "";

package/dist/client/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/client/protocol.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,CAAU,CAAC;AAGlG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAGlF,iGAAiG;AACjG,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAI,MAAc,EAAE,KAAa,EAAE,WAAmB;IACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,YAA+B;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,KAAK,OAAO,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,SAAS,UAAU,CAAC,KAAc,EAAE,SAAiB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CACZ,GAAG,EACH,sBAAsB,EACtB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,OAAO,CACZ,GAAG,EACH,sBAAsB,EACtB,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC3F,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,OAAO,CACZ,GAAG,EACH,yBAAyB,EACzB,kCAAkC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,2BAA2B,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,CAAC,IAAI,oBAAoB,CAAC,CACtF,CAAC;IACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,GAAG,EACH,yBAAyB,EACzB,6CAA6C,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YACzB,UAAU,CAAC,MAAM,KAAK,CAAC;YACvB,UAAU,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,EACzC,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,6CAA6C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IACE,aAAa,KAAK,SAAS;QAC3B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAC5F,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;IACrF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,WAAW;YACX,UAAU;YACV,eAAe;YACf,cAAc;YACd,uBAAuB,EAAE,UAAU;SACpC;KACF,CAAC;AACJ,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAuB,EACvB,MAAiD;IAEjD,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE,2BAA2B,EAAE,+BAA+B,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,8BAA8B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,gBAAgB,cAAc,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,gBAAgB,cAAc,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CACZ,GAAG,EACH,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM;YACN,KAAK;YACL,KAAK;YACL,aAAa;YACb,MAAM;YACN,MAAM;YACN,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AASD,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CACtC,aAA4B,EAC5B,MAAuB;IAEvB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,qDAAqD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,CACZ,GAAG,EACH,gBAAgB,EAChB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACzD,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;gBAC9D,MAAM,EAAE,qBAAqB;aAC9B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAuB,EACvB,MAA4B;IAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE,0CAA0C,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAC5D,IAAI,WAAW,KAAK,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,OAAO,OAAO,CACZ,GAAG,EACH,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,aAA4B;IAC1D,MAAM,KAAK,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/client/protocol.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,CAAU,CAAC;AAGlG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAGlF,iGAAiG;AACjG,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAI,MAAc,EAAE,KAAa,EAAE,WAAmB;IACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,8FAA8F;AAC9F,SAAS,oBAAoB,CAAC,MAAuB;IACnD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,YAA+B;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,KAAK,OAAO,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,SAAS,UAAU,CAAC,KAAc,EAAE,SAAiB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CACZ,GAAG,EACH,sBAAsB,EACtB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,OAAO,CACZ,GAAG,EACH,sBAAsB,EACtB,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC3F,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,OAAO,CACZ,GAAG,EACH,yBAAyB,EACzB,kCAAkC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjE,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,UAAU,GAAG,2BAA2B,CAAC,IAAI,CACjD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,CAAC,IAAI,qBAAqB,CAAC,CACvF,CAAC;IACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,GAAG,EACH,yBAAyB,EACzB,6CAA6C,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YACzB,UAAU,CAAC,MAAM,KAAK,CAAC;YACvB,UAAU,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,EACzC,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,6CAA6C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IACE,aAAa,KAAK,SAAS;QAC3B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAC5F,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;IACrF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,WAAW;YACX,UAAU;YACV,eAAe;YACf,cAAc;YACd,uBAAuB,EAAE,UAAU;SACpC;KACF,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAuB;IAEvB,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAuB,EACvB,MAAiD;IAEjD,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,EAAE,2BAA2B,EAAE,+BAA+B,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,8BAA8B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,gBAAgB,cAAc,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,gBAAgB,cAAc,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CACZ,GAAG,EACH,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM;YACN,KAAK;YACL,KAAK;YACL,aAAa;YACb,MAAM;YACN,MAAM;YACN,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAA4B,EAC5B,MAAuB;IAEvB,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,qDAAqD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,CACZ,GAAG,EACH,gBAAgB,EAChB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBACzD,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;oBAC9D,MAAM,EAAE,qBAAqB;iBAC9B;aACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAuB,EACvB,MAA4B;IAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE,0CAA0C,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;IAC5D,IAAI,WAAW,KAAK,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,OAAO,OAAO,CACZ,GAAG,EACH,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,aAA4B;IAC1D,MAAM,KAAK,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/client/responses.d.ts

@@ -1,7 +1,7 @@
 /** Response helpers shared by the endpoints. */
 export declare function json(body: unknown, status?: number, headers?: Record<string, string>): Response;
 /** An OAuth error body (RFC 6749 section 5.2), for the endpoints that answer the client directly. */
-export declare function oauthError(status: number, error: string, description: string): Response;
+export declare function oauthError(status: number, error: string, description: string, headers?: Record<string, string>): Response;
 export declare function redirect(location: string): Response;
 /**
  * The authorization response (OAuth 2.1 section 4.1.2): parameters on the registered redirect URI,
@@ -11,12 +11,18 @@ export declare function authorizationResponse(args: {
     redirectUri: string;
     issuer: string;
     state: string | undefined;
+    /**
+     * The Set-Cookie value that deletes the request's transaction cookie, when the browser holds
+     * one: sending the browser back to the client ends the request there.
+     */
+    clearCookie: string | undefined;
     params: Record<string, string>;
 }): Response;
 export declare function authorizationError(args: {
     redirectUri: string;
     issuer: string;
     state: string | undefined;
+    clearCookie: string | undefined;
     error: string;
     description: string;
 }): Response;

package/dist/client/responses.js

@@ -11,8 +11,8 @@ export function json(body, status = 200, headers = {}) {
     });
 }
 /** An OAuth error body (RFC 6749 section 5.2), for the endpoints that answer the client directly. */
-export function oauthError(status, error, description) {
-    return json({ error, error_description: description }, status);
+export function oauthError(status, error, description, headers = {}) {
+    return json({ error, error_description: description }, status, headers);
 }
 export function redirect(location) {
     return new Response(null, {
@@ -33,13 +33,18 @@ export function authorizationResponse(args) {
         url.searchParams.set("state", args.state);
     }
     url.searchParams.set("iss", args.issuer);
-    return redirect(url.toString());
+    const response = redirect(url.toString());
+    if (args.clearCookie !== undefined) {
+        response.headers.append("Set-Cookie", args.clearCookie);
+    }
+    return response;
 }
 export function authorizationError(args) {
     return authorizationResponse({
         redirectUri: args.redirectUri,
         issuer: args.issuer,
         state: args.state,
+        clearCookie: args.clearCookie,
         params: { error: args.error, error_description: args.description },
     });
 }

package/dist/client/responses.js.map

@@ -1 +1 @@
-{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/client/responses.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAEhD,MAAM,UAAU,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,GAA2B,EAAE;IACpF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,eAAe,EAAE,UAAU;YAC3B,MAAM,EAAE,UAAU;YAClB,GAAG,OAAO;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,WAAmB;IAC3E,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAKrC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAMlC;IACC,OAAO,qBAAqB,CAAC;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7E,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/client/responses.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAEhD,MAAM,UAAU,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,GAA2B,EAAE;IACpF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,eAAe,EAAE,UAAU;YAC3B,MAAM,EAAE,UAAU;YAClB,GAAG,OAAO;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,KAAa,EACb,WAAmB,EACnB,OAAO,GAA2B,EAAE;IAEpC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAUrC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAOlC;IACC,OAAO,qBAAqB,CAAC;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE;KACnE,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7E,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/component/_generated/component.d.ts

@@ -59,7 +59,9 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             state?: string;
         } | null, Name>;
         claimUpstream: FunctionReference<"mutation", "internal", {
+            connector: string;
             now: number;
+            txnCookieHashes: Array<string>;
             upstreamStateHash: string;
         }, {
             connector: string;
@@ -72,8 +74,11 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             upstreamNonce?: string;
         } | {
             redirectUri: string;
+            requestId: string;
             state?: string;
             status: "expired";
+        } | {
+            status: "unbound";
         } | {
             status: "missing";
         }, Name>;
@@ -116,6 +121,7 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             requestId: string;
             scope: string;
             state?: string;
+            txnCookieHash?: string;
         }, null, Name>;
         exchangeCode: FunctionReference<"mutation", "internal", {
             clientId: string;
@@ -157,6 +163,7 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             scope: string;
             state?: string;
             status: "pending";
+            txnCookieHash?: string;
         } | {
             appId: string;
             clientId: string;
@@ -171,6 +178,7 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             scope: string;
             state?: string;
             status: "upstream";
+            txnCookieHash?: string;
             upstreamCodeVerifier: string;
             upstreamNonce?: string;
             upstreamStateHash: string;
@@ -188,6 +196,7 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             scope: string;
             state?: string;
             status: "claimed";
+            txnCookieHash?: string;
         } | {
             appId: string;
             clientId: string;
@@ -198,6 +207,8 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             emailAttempts: number;
             emailCodeExpiresAt: number;
             emailCodeHash: string;
+            emailLastSentAt: number;
+            emailSends: number;
             expiresAt: number;
             freshLogin: boolean;
             nonce?: string;
@@ -206,6 +217,7 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             scope: string;
             state?: string;
             status: "emailSent";
+            txnCookieHash?: string;
         } | {
             appId: string;
             authTime: number;
@@ -228,12 +240,15 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             scope: string;
             state?: string;
             status: "completed";
+            txnCookieHash?: string;
         } | null, Name>;
         startEmail: FunctionReference<"mutation", "internal", {
             connector: string;
             email: string;
             emailCodeExpiresAt: number;
             emailCodeHash: string;
+            emailHash: string;
+            maxAttempts: number;
             now: number;
             requestId: string;
         }, {
@@ -241,7 +256,7 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             redirectUri: string;
             state?: string;
         } | {
-            error: "expired" | "wrong_status";
+            error: "expired" | "wrong_status" | "locked" | "too_soon" | "request_limit" | "address_limit" | "global_limit";
             ok: false;
             redirectUri: string;
             state?: string;
@@ -342,11 +357,20 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
         }, {
             authRequests: number;
             authorizationCodes: number;
+            emailSends: number;
             previewClients: number;
+            registrationTokens: number;
             signIns: number;
         }, Name>;
     };
     registration: {
+        listTokens: FunctionReference<"query", "internal", {
+            appId: string;
+        }, Array<{
+            createdAt: number;
+            expiresAt: number;
+            tokenHash: string;
+        }>, Name>;
         mintToken: FunctionReference<"mutation", "internal", {
             appId: string;
             createdAt: number;
@@ -362,6 +386,9 @@ export type ComponentApi<Name extends string | undefined = string | undefined> =
             firstParty: boolean;
             name: string;
         } | null, Name>;
+        revokeToken: FunctionReference<"mutation", "internal", {
+            tokenHash: string;
+        }, null, Name>;
     };
     signIns: {
         record: FunctionReference<"mutation", "internal", {

package/dist/component/authRequests.d.ts

@@ -11,6 +11,7 @@ export declare const create: import("convex/server").RegisteredMutation<"public"
     requestId: string;
     scope: string;
     state?: string;
+    txnCookieHash?: string;
 }, Promise<null>>;
 export declare const get: import("convex/server").RegisteredQuery<"public", {
     requestId: string;
@@ -27,6 +28,7 @@ export declare const get: import("convex/server").RegisteredQuery<"public", {
     scope: string;
     state?: string;
     status: "pending";
+    txnCookieHash?: string;
 } | {
     appId: string;
     clientId: string;
@@ -41,6 +43,7 @@ export declare const get: import("convex/server").RegisteredQuery<"public", {
     scope: string;
     state?: string;
     status: "upstream";
+    txnCookieHash?: string;
     upstreamCodeVerifier: string;
     upstreamNonce?: string;
     upstreamStateHash: string;
@@ -58,6 +61,7 @@ export declare const get: import("convex/server").RegisteredQuery<"public", {
     scope: string;
     state?: string;
     status: "claimed";
+    txnCookieHash?: string;
 } | {
     appId: string;
     clientId: string;
@@ -68,6 +72,8 @@ export declare const get: import("convex/server").RegisteredQuery<"public", {
     emailAttempts: number;
     emailCodeExpiresAt: number;
     emailCodeHash: string;
+    emailLastSentAt: number;
+    emailSends: number;
     expiresAt: number;
     freshLogin: boolean;
     nonce?: string;
@@ -76,6 +82,7 @@ export declare const get: import("convex/server").RegisteredQuery<"public", {
     scope: string;
     state?: string;
     status: "emailSent";
+    txnCookieHash?: string;
 } | {
     appId: string;
     authTime: number;
@@ -98,6 +105,7 @@ export declare const get: import("convex/server").RegisteredQuery<"public", {
     scope: string;
     state?: string;
     status: "completed";
+    txnCookieHash?: string;
 } | null>>;
 /** The user chose an OAuth or OIDC connector; the request now waits for that connector's callback. */
 export declare const startUpstream: import("convex/server").RegisteredMutation<"public", {
@@ -121,11 +129,16 @@ export declare const startUpstream: import("convex/server").RegisteredMutation<"
     ok: false;
 }>>;
 /**
- * The connector callback arrived with its state. Claiming moves the request to `claimed` in the
- * same mutation that finds it, so a replayed or raced callback finds nothing to claim.
+ * The callback of `connector` arrived with its state. Claiming moves the request to `claimed` in
+ * the same mutation that finds it, so a replayed or raced callback finds nothing to claim. A
+ * request started for another connector is not claimed: its state cannot finish elsewhere. A
+ * request that went through the chooser is claimed only from the browser that holds its
+ * transaction cookie; any other browser gets `unbound` and the request keeps waiting.
  */
 export declare const claimUpstream: import("convex/server").RegisteredMutation<"public", {
+    connector: string;
     now: number;
+    txnCookieHashes: string[];
     upstreamStateHash: string;
 }, Promise<{
     connector: string;
@@ -138,17 +151,30 @@ export declare const claimUpstream: import("convex/server").RegisteredMutation<"
     upstreamNonce?: string;
 } | {
     redirectUri: string;
+    requestId: string;
     state?: string;
     status: "expired";
+} | {
+    status: "unbound";
 } | {
     status: "missing";
 }>>;
-/** The user chose the email connector and typed an address; a code was sent to it. */
+/** The rolling window of the per-address count; `lifecycle.cleanup` drops older `emailSends` rows. */
+export declare const EMAIL_SEND_WINDOW_MS: number;
+/**
+ * The user chose the email connector and typed an address; a code may be sent to it. A request
+ * sends at most `EMAIL_SENDS_PER_REQUEST` codes, `EMAIL_SEND_INTERVAL_MS` apart, an address
+ * receives at most `EMAIL_SENDS_PER_ADDRESS` codes per `EMAIL_SEND_WINDOW_MS`, and the broker sends
+ * at most `EMAIL_SENDS_GLOBAL` in that window. A resend replaces the code and keeps the attempt
+ * count, so a request locked by `maxAttempts` wrong codes stays locked.
+ */
 export declare const startEmail: import("convex/server").RegisteredMutation<"public", {
     connector: string;
     email: string;
     emailCodeExpiresAt: number;
     emailCodeHash: string;
+    emailHash: string;
+    maxAttempts: number;
     now: number;
     requestId: string;
 }, Promise<{
@@ -156,7 +182,7 @@ export declare const startEmail: import("convex/server").RegisteredMutation<"pub
     redirectUri: string;
     state?: string;
 } | {
-    error: "expired" | "wrong_status";
+    error: "address_limit" | "expired" | "global_limit" | "locked" | "request_limit" | "too_soon" | "wrong_status";
     ok: false;
     redirectUri: string;
     state?: string;