@synoikia/core 0.9.0 → 0.10.0

package/dist/auth/mcp-auth.js

@@ -1,11 +1,13 @@
 import { eq } from 'drizzle-orm';
-import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';
 import { roleHasInstance } from '../catalog/role-levels.js';
 import { users } from '../db/schema.js';
 import { ConflictError, ValidationError } from '../errors.js';
 import { getSettings } from '../settings.js';
 import { McpTokenService, TOKEN_PREFIX } from './mcp-tokens.js';
 import { ACCESS_PREFIX, canonicalResource } from './oauth.js';
+import { effectiveAuthMethods } from '../instances/manager.js';
+import { externalProvider } from './external.js';
+import { claimedIssuer } from './external-cloudflare.js';
 import { requestOrigin } from '../http/common.js';
 /** The MCP listener's public origin: PUBLIC_MCP_URL, or the request's origin where no security decision
  * depends on it (the approval link back to the same client, sign-in redirects). */
@@ -13,78 +15,13 @@ export function publicMcpBase(ctx, c) {
     return (ctx.config.PUBLIC_MCP_URL ?? requestOrigin(c, ctx.config.TRUST_PROXY)).replace(/\/+$/, '');
 }
 export const resourceUrl = (base, slug) => canonicalResource(`${base}/${slug}`);
-export function effectiveAuthMode(ctx, instanceAuthMode) {
-    return instanceAuthMode ?? getSettings(ctx.db, 'mcp').defaultAuthMode;
-}
 /** The endpoints that accept OAuth (design §6.2), with their resource URLs under `base`. */
 export function oauthEndpoints(ctx, base) {
     return ctx.instances
         .list()
-        .filter((i) => {
-        const mode = effectiveAuthMode(ctx, i.authMode);
-        return mode === 'oauth' || mode === 'bearer+oauth';
-    })
+        .filter((i) => effectiveAuthMethods(ctx.db, i.authMethods).includes('oauth'))
         .map((i) => ({ resource: resourceUrl(base, i.slug), slug: i.slug, name: i.displayName, id: i.id }));
 }
-const jwksCache = new Map();
-const MAX_CLAIM = 120;
-const clip = (v) => (v.length > MAX_CLAIM ? `${v.slice(0, MAX_CLAIM)}…` : v);
-/** A JWT's claimed issuer and audience, unverified, only to explain a rejection: strings only, clipped. */
-function claimedIssuer(token) {
-    let payload;
-    try {
-        payload = decodeJwt(token);
-    }
-    catch {
-        return null;
-    }
-    const { iss, aud } = payload;
-    const auds = (Array.isArray(aud) ? aud : [aud]).filter((a) => typeof a === 'string');
-    return {
-        iss: typeof iss === 'string' ? clip(iss) : undefined,
-        aud: auds.length ? clip(auds.join(',')) : undefined,
-    };
-}
-/** Verifies a `Cf-Access-Jwt-Assertion` (signature, issuer, audience, expiry) and returns who it names
- * or why it was rejected. `keys` replaces the team's key set (tests). */
-export async function checkCloudflareAccess(teamDomain, aud, assertion, keys) {
-    const domain = teamDomain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
-    let jwks = keys ?? jwksCache.get(domain);
-    if (!jwks) {
-        const remote = createRemoteJWKSet(new URL(`https://${domain}/cdn-cgi/access/certs`));
-        jwksCache.set(domain, remote);
-        jwks = remote;
-    }
-    const issuer = `https://${domain}`;
-    try {
-        const { payload } = await jwtVerify(assertion, jwks, { issuer, audience: aud });
-        // A service token's assertion has an empty `sub` and names the token's client ID in `common_name`.
-        // An email must contain `@`, so it can't pose as a service token; one that names nobody is refused.
-        const named = (v) => (typeof v === 'string' && v ? v : undefined);
-        const email = named(payload.email);
-        const service = named(payload.common_name);
-        const who = (email?.includes('@') ? email : undefined) ?? (service && `service:${service}`) ?? named(payload.sub);
-        return who
-            ? { ok: true, who }
-            : { ok: false, reason: 'valid assertion that names nobody (no email, common_name or sub)' };
-    }
-    catch (err) {
-        const why = err instanceof Error ? err.message : String(err);
-        const claimed = claimedIssuer(assertion);
-        if (!claimed)
-            return { ok: false, reason: `${why} (not a JWT)` };
-        // The AUD tag and team domain are not secrets: every assertion Access issues carries them.
-        return {
-            ok: false,
-            reason: `${why} (assertion iss=${claimed.iss ?? '-'} aud=${claimed.aud ?? '-'}; expected iss=${issuer} aud=${aud})`,
-        };
-    }
-}
-/** {@link checkCloudflareAccess}, returning who the assertion names, or null. */
-export async function verifyCloudflareAccess(teamDomain, aud, assertion, keys) {
-    const result = await checkCloudflareAccess(teamDomain, aud, assertion, keys);
-    return result.ok ? result.who : null;
-}
 /** What kind of bearer token this is, for the log: never any part of its value. */
 function describeToken(token) {
     if (token.startsWith(TOKEN_PREFIX))
@@ -112,7 +49,7 @@ function owned(ctx, base, userId, instanceId) {
         return refuse(403, 'insufficient_scope', 'This endpoint is not available to your role', `${base.label}: role of ${user.username} does not include this endpoint`);
     return { ok: true, identity: { ...base, userId: user.id, roleId: user.roleId } };
 }
-/** A user named by the proxy: matched by username, else registered with the default role (design §6.5). */
+/** A user named by the external provider: matched by username, else registered with the default role (design §6.5). */
 async function externalUser(ctx, name) {
     const found = ctx.users.byExternalIdentity(name);
     if (found)
@@ -147,53 +84,49 @@ export function principalLive(ctx, principal, instanceId) {
     return true;
 }
 const unknownUser = (base) => refuse(403, 'forbidden', 'No account matches this identity', `${base.label}: no user has that username and self-registration is off or the name is not a valid username`);
-export async function authenticateMcp(ctx, oauth, c, instance) {
-    const mode = effectiveAuthMode(ctx, instance.authMode);
+/** The configured external provider names the caller, who must match an enabled user (design §6.2, §6.5). */
+async function authenticateExternal(ctx, c, instanceId) {
     const settings = getSettings(ctx.db, 'mcp');
-    if (mode === 'external') {
-        const { teamDomain, aud } = settings.cfAccess;
-        if (teamDomain && aud) {
-            const assertion = c.req.header('cf-access-jwt-assertion');
-            const checked = assertion ? await checkCloudflareAccess(teamDomain, aud, assertion) : null;
-            if (!checked?.ok)
-                return {
-                    ok: false,
-                    status: 401,
-                    error: 'unauthorized',
-                    message: 'Cloudflare Access assertion missing or invalid',
-                    detail: checked
-                        ? `Cloudflare Access assertion rejected: ${checked.reason}`
-                        : 'no Cf-Access-Jwt-Assertion header: the request did not come through the Cloudflare Access application',
-                };
-            const who = checked.who;
-            const base = { kind: 'external', principal: `cf:${who}`, label: `external:${who}`, access: 'write' };
-            const userId = await externalUser(ctx, who);
-            if (!userId)
-                return unknownUser(base);
-            return owned(ctx, base, userId, instance.id);
-        }
-        const header = settings.trustedIdentityHeader;
-        const named = header && c.req.header(header)?.trim().slice(0, 200);
-        if (named) {
-            const base = {
-                kind: 'external',
-                principal: `ext:${named}`,
-                label: `external:${named}`,
-                access: 'write',
-            };
-            const userId = await externalUser(ctx, named);
-            if (!userId)
-                return unknownUser(base);
-            return owned(ctx, base, userId, instance.id);
-        }
-        // Every call belongs to a user (design §6.4): a caller the proxy didn't name is refused.
-        return refuse(401, 'unauthorized', 'The proxy did not identify the caller', header
-            ? `no ${header} header and no Cloudflare Access assertion: anonymous callers are refused`
-            : 'external mode without Cloudflare Access or a trusted identity header: anonymous callers are refused');
+    const provider = externalProvider(settings);
+    if (!provider.configured(settings))
+        return refuse(401, 'unauthorized', 'Authentication required', `${provider.name} is not configured`);
+    const found = await provider.identify(c.req.raw.headers, settings);
+    // Every call belongs to a user (design §6.4): a caller the provider didn't name is refused.
+    if (!found.ok)
+        return refuse(401, 'unauthorized', `${provider.name} did not identify the caller`, found.reason);
+    const who = found.identity;
+    const base = {
+        kind: 'external',
+        principal: `${provider.id}:${who}`,
+        label: `external:${who}`,
+        access: 'write',
+    };
+    const userId = await externalUser(ctx, who);
+    if (!userId)
+        return unknownUser(base);
+    return owned(ctx, base, userId, instanceId);
+}
+export async function authenticateMcp(ctx, oauth, c, instance) {
+    const methods = effectiveAuthMethods(ctx.db, instance.authMethods);
+    const auth = c.req.header('authorization');
+    if (!methods.length) {
+        const detail = 'no client auth method is both enabled globally and allowed on this endpoint';
+        const held = auth?.match(/^Bearer\s+(\S+)$/i)?.[1];
+        // Only a live credential learns why; anyone else gets the answer of an unknown slug.
+        if (held && (ctx.tokens.verify(held) || oauth.verifyAccess(held, '')))
+            return refuse(403, 'forbidden', 'This endpoint accepts no client auth method', detail);
+        return {
+            ok: false,
+            status: 401,
+            error: 'unauthorized',
+            message: 'Authentication required',
+            wwwAuthenticate: 'Bearer',
+            detail,
+        };
     }
-    const allowBearer = mode === 'bearer' || mode === 'bearer+oauth';
+    const allowBearer = methods.includes('bearer');
     // OAuth is off until PUBLIC_MCP_URL is set: its discovery documents must not come from the Host header.
-    const allowOauth = (mode === 'oauth' || mode === 'bearer+oauth') && !!ctx.config.PUBLIC_MCP_URL;
+    const allowOauth = methods.includes('oauth') && !!ctx.config.PUBLIC_MCP_URL;
     const base = publicMcpBase(ctx, c);
     const challenge = (error) => {
         const params = [];
@@ -203,13 +136,21 @@ export async function authenticateMcp(ctx, oauth, c, instance) {
             params.push(`error="${error}"`);
         return params.length ? `Bearer ${params.join(', ')}` : 'Bearer';
     };
-    // A proxy that authenticated the caller is the usual reason a client sends what this mode can't use.
-    const hint = c.req.header('cf-access-jwt-assertion')
-        ? '; the request carries a Cloudflare Access assertion: set the endpoint to External auth to accept it'
+    // A proxy that authenticated the caller is the usual reason a client sends what these methods can't use.
+    const hint = c.req.header('cf-access-jwt-assertion') && !methods.includes('external')
+        ? '; the request carries a Cloudflare Access assertion: enable External client auth for this endpoint to accept it'
         : '';
-    const oauthOff = (mode === 'oauth' || mode === 'bearer+oauth') && !allowOauth ? '; OAuth is off until PUBLIC_MCP_URL is set' : '';
-    const auth = c.req.header('authorization');
+    const oauthOff = methods.includes('oauth') && !allowOauth ? '; OAuth is off until PUBLIC_MCP_URL is set' : '';
+    const accepted = methods.join(', ');
     const token = auth?.match(/^Bearer\s+(\S+)$/i)?.[1];
+    let externalWhy = '';
+    if (!token && methods.includes('external')) {
+        const result = await authenticateExternal(ctx, c, instance.id);
+        // Unnamed, an endpoint that also takes tokens answers with the bearer challenge, so OAuth can start.
+        if (result.ok || result.status === 403 || !(allowBearer || methods.includes('oauth')))
+            return result;
+        externalWhy = `; ${result.detail}`;
+    }
     if (!token)
         return {
             ok: false,
@@ -217,7 +158,7 @@ export async function authenticateMcp(ctx, oauth, c, instance) {
             error: 'unauthorized',
             message: 'Authentication required',
             wwwAuthenticate: challenge(),
-            detail: `${auth ? 'Authorization header is not a bearer token' : 'no Authorization header'}${oauthOff}${hint}`,
+            detail: `${auth ? 'Authorization header is not a bearer token' : 'no Authorization header'}${externalWhy}${oauthOff}${hint}`,
         };
     if (allowBearer && token.startsWith(TOKEN_PREFIX)) {
         const row = ctx.tokens.verify(token);
@@ -274,7 +215,7 @@ export async function authenticateMcp(ctx, oauth, c, instance) {
         error: 'invalid_token',
         message: 'This endpoint does not accept that kind of token',
         wwwAuthenticate: challenge('invalid_token'),
-        detail: `got ${describeToken(token)}, which ${mode} auth does not accept${oauthOff}${hint}`,
+        detail: `got ${describeToken(token)}, which this endpoint's methods (${accepted}) do not accept${oauthOff}${hint}`,
     };
 }
 //# sourceMappingURL=mcp-auth.js.map

package/dist/auth/mcp-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../../src/auth/mcp-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGhE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI9D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA+BlD;mFACmF;AACnF,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,CAAU;IACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAEhG,MAAM,UAAU,iBAAiB,CAAC,GAAe,EAAE,gBAA+B;IAChF,OAAQ,gBAAoC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC;AAC7F,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,IAAY;IAC1D,OAAO,GAAG,CAAC,SAAS;SACjB,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC;IACrD,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAErF,2GAA2G;AAC3G,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACpD,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC;AACJ,CAAC;AAED;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,IAAsB;IAEtB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,GAAG,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,MAAM,uBAAuB,CAAC,CAAC,CAAC;QACrF,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,MAAM,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAChF,mGAAmG;QACnG,oGAAoG;QACpG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,WAAW,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClH,OAAO,GAAG;YACR,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,cAAc,EAAE,CAAC;QACjE,2FAA2F;QAC3F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,GAAG,mBAAmB,OAAO,CAAC,GAAG,IAAI,GAAG,QAAQ,OAAO,CAAC,GAAG,IAAI,GAAG,kBAAkB,MAAM,QAAQ,GAAG,GAAG;SACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,IAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,kCAAkC,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC;IAC5E,OAAO,mCAAmC,CAAC;AAC7C,CAAC;AAID,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IACpG,EAAE,EAAE,KAAK;IACT,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,mGAAmG;AACnG,SAAS,KAAK,CAAC,GAAe,EAAE,IAAa,EAAE,MAAiC,EAAE,UAAkB;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QACxB,OAAO,MAAM,CACX,GAAG,EACH,WAAW,EACX,gDAAgD,EAChD,GAAG,IAAI,CAAC,KAAK,oBAAoB,CAClC,CAAC;IACJ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;QACnD,OAAO,MAAM,CACX,GAAG,EACH,oBAAoB,EACpB,6CAA6C,EAC7C,GAAG,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,QAAQ,iCAAiC,CACzE,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,YAAY,CAAC,GAAe,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mGAAmG;QACnG,2BAA2B;QAC3B,IAAI,GAAG,YAAY,aAAa;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAChF,IAAI,GAAG,YAAY,eAAe;YAAE,OAAO,SAAS,CAAC;QACrD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,QAAqB,EAAE,UAAkB;IAClF,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpF,OAAO,CACL,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAChH,CAAC;AACJ,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,SAAiB,EAAE,UAAkB;IAClF,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5G,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,EAAE,CACpC,MAAM,CACJ,GAAG,EACH,WAAW,EACX,kCAAkC,EAClC,GAAG,IAAI,CAAC,KAAK,8FAA8F,CAC5G,CAAC;AAEJ,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,KAAmB,EACnB,CAAU,EACV,QAA+D;IAE/D,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAE5C,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC9C,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3F,IAAI,CAAC,OAAO,EAAE,EAAE;gBACd,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,gDAAgD;oBACzD,MAAM,EAAE,OAAO;wBACb,CAAC,CAAC,yCAAyC,OAAO,CAAC,MAAM,EAAE;wBAC3D,CAAC,CAAC,uGAAuG;iBAC5G,CAAC;YACJ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9G,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,qBAAqB,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAY;gBACpB,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,OAAO,KAAK,EAAE;gBACzB,KAAK,EAAE,YAAY,KAAK,EAAE;gBAC1B,MAAM,EAAE,OAAO;aAChB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM;gBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,yFAAyF;QACzF,OAAO,MAAM,CACX,GAAG,EACH,cAAc,EACd,uCAAuC,EACvC,MAAM;YACJ,CAAC,CAAC,MAAM,MAAM,2EAA2E;YACzF,CAAC,CAAC,qGAAqG,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,cAAc,CAAC;IACjE,wGAAwG;IACxG,MAAM,UAAU,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IAChG,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,yCAAyC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACjH,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC,CAAC;IAEF,qGAAqG;IACrG,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC;QAClD,CAAC,CAAC,qGAAqG;QACvG,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GACZ,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QACR,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,yBAAyB;YAClC,eAAe,EAAE,SAAS,EAAE;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,yBAAyB,GAAG,QAAQ,GAAG,IAAI,EAAE;SAC/G,CAAC;IAEJ,IAAI,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YACN,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;gBAC3C,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,2CAA2C;gBACpD,MAAM,EAAE,iBAAiB,GAAG,CAAC,IAAI,kCAAkC;aACpE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CACV,GAAG,EACH,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/F,GAAG,CAAC,SAAS,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;gBAC3C,MAAM,EAAE,mDAAmD;aAC5D,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,8CAA8C;gBACvD,MAAM,EAAE,0BAA0B,KAAK,CAAC,MAAM,CAAC,IAAI,kCAAkC;aACtF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CACV,GAAG,EACH;YACE,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE;YACnC,KAAK,EAAE,SAAS,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG;YAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,kDAAkD;QAC3D,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,IAAI,wBAAwB,QAAQ,GAAG,IAAI,EAAE;KAC5F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../../src/auth/mcp-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA+BlD;mFACmF;AACnF,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,CAAU;IACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AAEhG,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,IAAY;IAC1D,OAAO,GAAG,CAAC,SAAS;SACjB,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,kCAAkC,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC;IAC5E,OAAO,mCAAmC,CAAC;AAC7C,CAAC;AAID,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC;IACpG,EAAE,EAAE,KAAK;IACT,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,mGAAmG;AACnG,SAAS,KAAK,CAAC,GAAe,EAAE,IAAa,EAAE,MAAiC,EAAE,UAAkB;IAClG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QACxB,OAAO,MAAM,CACX,GAAG,EACH,WAAW,EACX,gDAAgD,EAChD,GAAG,IAAI,CAAC,KAAK,oBAAoB,CAClC,CAAC;IACJ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;QACnD,OAAO,MAAM,CACX,GAAG,EACH,oBAAoB,EACpB,6CAA6C,EAC7C,GAAG,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,QAAQ,iCAAiC,CACzE,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,uHAAuH;AACvH,KAAK,UAAU,YAAY,CAAC,GAAe,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mGAAmG;QACnG,2BAA2B;QAC3B,IAAI,GAAG,YAAY,aAAa;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAChF,IAAI,GAAG,YAAY,eAAe;YAAE,OAAO,SAAS,CAAC;QACrD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,QAAqB,EAAE,UAAkB;IAClF,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpF,OAAO,CACL,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAChH,CAAC;AACJ,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,aAAa,CAAC,GAAe,EAAE,SAAiB,EAAE,UAAkB;IAClF,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5G,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,EAAE,CACpC,MAAM,CACJ,GAAG,EACH,WAAW,EACX,kCAAkC,EAClC,GAAG,IAAI,CAAC,KAAK,8FAA8F,CAC5G,CAAC;AAEJ,6GAA6G;AAC7G,KAAK,UAAU,oBAAoB,CAAC,GAAe,EAAE,CAAU,EAAE,UAAkB;IACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;QAChC,OAAO,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,yBAAyB,EAAE,GAAG,QAAQ,CAAC,IAAI,oBAAoB,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,4FAA4F;IAC5F,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC,IAAI,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChH,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC3B,MAAM,IAAI,GAAY;QACpB,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,GAAG,QAAQ,CAAC,EAAE,IAAI,GAAG,EAAE;QAClC,KAAK,EAAE,YAAY,GAAG,EAAE;QACxB,MAAM,EAAE,OAAO;KAChB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,KAAmB,EACnB,CAAU,EACV,QAA4D;IAE5D,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAE3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,6EAA6E,CAAC;QAC7F,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,qFAAqF;QACrF,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,6CAA6C,EAAE,MAAM,CAAC,CAAC;QACzF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,yBAAyB;YAClC,eAAe,EAAE,QAAQ;YACzB,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,wGAAwG;IACxG,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,yCAAyC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACjH,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,CAAC,CAAC;IAEF,yGAAyG;IACzG,MAAM,IAAI,GACR,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QACtE,CAAC,CAAC,iHAAiH;QACnH,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/D,qGAAqG;QACrG,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC;QACrG,WAAW,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,KAAK;QACR,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,yBAAyB;YAClC,eAAe,EAAE,SAAS,EAAE;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,yBAAyB,GAAG,WAAW,GAAG,QAAQ,GAAG,IAAI,EAAE;SAC7H,CAAC;IAEJ,IAAI,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YACN,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;gBAC3C,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,2CAA2C;gBACpD,MAAM,EAAE,iBAAiB,GAAG,CAAC,IAAI,kCAAkC;aACpE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CACV,GAAG,EACH,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/F,GAAG,CAAC,SAAS,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YACR,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,0BAA0B;gBACnC,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;gBAC3C,MAAM,EAAE,mDAAmD;aAC5D,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,8CAA8C;gBACvD,MAAM,EAAE,0BAA0B,KAAK,CAAC,MAAM,CAAC,IAAI,kCAAkC;aACtF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CACV,GAAG,EACH;YACE,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,SAAS,KAAK,CAAC,OAAO,EAAE;YACnC,KAAK,EAAE,SAAS,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG;YAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,EACD,KAAK,CAAC,IAAI,CAAC,EAAE,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,kDAAkD;QAC3D,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC,oCAAoC,QAAQ,kBAAkB,QAAQ,GAAG,IAAI,EAAE;KACnH,CAAC;AACJ,CAAC"}

package/dist/auth/oauth.d.ts

@@ -147,7 +147,7 @@ export declare class OAuthService {
             lastLoginAt: Date | null;
             disabled: boolean;
             roleId: string;
-            registeredVia: "oidc" | "external" | "signup" | null;
+            registeredVia: "external" | "oidc" | "signup" | null;
         };
         grantId: string;
         access: "read" | "write";

package/dist/auth/oidc.d.ts

@@ -9,7 +9,7 @@ declare const OidcSettingsSchema: z.ZodObject<{
     scopes: z.ZodDefault<z.ZodString>;
     label: z.ZodDefault<z.ZodString>;
     allowPolicy: z.ZodPrefault<z.ZodObject<{
-        emails: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        emails: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>]>>>;
         subjects: z.ZodDefault<z.ZodArray<z.ZodString>>;
         group: z.ZodDefault<z.ZodString>;
         groupsClaim: z.ZodDefault<z.ZodString>;

package/dist/auth/oidc.js

@@ -8,9 +8,15 @@ import { ServiceError, ValidationError } from '../errors.js';
 import { signPayload, verifyPayload } from './tokens.js';
 /** Optional OIDC sign-in (design §6.1): code + PKCE, state and nonce; the identity must pass the allow
  * policy and be linked unless auto-provisioning. Used by the admin and MCP-port logins. */
+/** `*@example.com`: any verified address in that exact domain, never its subdomains. */
+const DomainEntrySchema = z
+    .string()
+    .regex(/^\*@(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i, 'Invalid domain entry')
+    .transform((e) => e.toLowerCase());
 const AllowPolicySchema = z
     .object({
-    emails: z.array(z.string().email()).default([]),
+    /** Exact addresses or `*@domain` entries. */
+    emails: z.array(z.union([z.string().email(), DomainEntrySchema])).default([]),
     subjects: z.array(z.string().min(1)).default([]),
     /** Required value in the groups claim (`groupsClaim`, default `groups`). */
     group: z.string().default(''),
@@ -27,6 +33,14 @@ const OidcSettingsSchema = z.object({
     autoProvision: z.boolean().default(false),
 });
 const STATE_TTL_MS = 10 * 60_000;
+function emailAllowed(entries, email) {
+    const address = email.toLowerCase();
+    const domain = address.slice(address.lastIndexOf('@') + 1);
+    return entries.some((e) => {
+        const entry = e.toLowerCase();
+        return entry.startsWith('*@') ? entry.slice(2) === domain : entry === address;
+    });
+}
 const policyIsEmpty = (p) => !p.emails.length && !p.subjects.length && !p.group;
 class OidcError extends ServiceError {
     constructor(code, message) {
@@ -186,7 +200,7 @@ export class OidcService {
             return true; // linking alone decides
         if (policy.subjects.includes(identity.subject))
             return true;
-        if (identity.email && policy.emails.map((e) => e.toLowerCase()).includes(identity.email.toLowerCase()))
+        if (identity.email && emailAllowed(policy.emails, identity.email))
             return true;
         if (policy.group && identity.groups.includes(policy.group))
             return true;

package/dist/auth/oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzD;2FAC2F;AAE3F,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC1C,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAuBH,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,MAAM,aAAa,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7G,MAAM,SAAU,SAAQ,YAAY;IAClC,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IACA;IAEA;IAPX,MAAM,CAA+C;IAE7D,YACmB,EAAM,EACN,GAAc,EACd,QAAgB;IACjC,gEAAgE;IAC/C,gBAAgB,KAAK;QAJrB,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEI,GAAG;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBAClC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,KAAK,EAAG,GAAG,CAAC,WAAyC,EAAE,KAAK,IAAI,KAAK;aACtE,CAAC;YACF,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,cAAc,CAAC,KAA+D,EAAE,QAA6B,EAAE;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,eAAe,GAAG,IAAI,CAAC;aACnD,IAAI,KAAK,CAAC,YAAY;YACzB,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,eAAe;YACf,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;YACjD,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;aACxE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACnB,GAAG,CAAC,QAAQ,EACZ,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EACpD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,KAAK,CAAC,KAAwF;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC7C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;YAC/D,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC9F,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,QAAQ,CACZ,WAAgB,EAChB,UAA8B;QAE9B,MAAM,KAAK,GAAG,aAAa,CAAY,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE;gBACpE,gBAAgB,EAAE,KAAK,CAAC,QAAQ;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,SAAS,GAAI,MAAkC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,mGAAmG;YACnG,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACpG,QAAQ,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAC/F,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACpH,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,QAAsB;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,qFAAqF;QACrF,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9G,MAAM,IAAI,GACR,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzD;2FAC2F;AAE3F,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,KAAK,CACJ,uFAAuF,EACvF,sBAAsB,CACvB;KACA,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAErC,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,6CAA6C;IAC7C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC1C,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAuBH,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,SAAS,YAAY,CAAC,OAAiB,EAAE,KAAa;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7G,MAAM,SAAU,SAAQ,YAAY;IAClC,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAIH;IACA;IACA;IAEA;IAPX,MAAM,CAA+C;IAE7D,YACmB,EAAM,EACN,GAAc,EACd,QAAgB;IACjC,gEAAgE;IAC/C,gBAAgB,KAAK;QAJrB,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAAW;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEI,GAAG;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,GAAG,kBAAkB,CAAC,KAAK,CAAC;gBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBAClC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,KAAK,EAAG,GAAG,CAAC,WAAyC,EAAE,KAAK,IAAI,KAAK;aACtE,CAAC;YACF,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,cAAc,CAAC,KAA+D,EAAE,QAA6B,EAAE;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,uBAAuB,EACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,eAAe,GAAG,IAAI,CAAC;aACnD,IAAI,KAAK,CAAC,YAAY;YACzB,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,eAAe;YACf,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;YACjD,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YACzB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtG,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,uBAAuB;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;aACxE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EACnB,GAAG,CAAC,QAAQ,EACZ,MAAM,EACN,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EACpD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,KAAK,CAAC,KAAwF;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC7C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,cAAc,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC;YAC/D,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC9F,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,QAAQ,CACZ,WAAgB,EAChB,UAA8B;QAE9B,MAAM,KAAK,GAAG,aAAa,CAAY,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE;gBACpE,gBAAgB,EAAE,KAAK,CAAC,QAAQ;gBAChC,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,aAAa,EAAE,KAAK,CAAC,KAAK;gBAC1B,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAG,CAAC;QACrC,MAAM,SAAS,GAAI,MAAkC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAiB;YAC7B,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,mGAAmG;YACnG,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACpG,QAAQ,EAAE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAC/F,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,QAAsB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,QAAQ,CAAC,KAAK,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/E,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,QAAsB;QAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,qFAAqF;QACrF,IAAI,CAAC,QAAQ,EAAE,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9G,MAAM,IAAI,GACR,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5G,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YAAE,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/auth/sessions.d.ts

@@ -17,8 +17,6 @@ export declare class SessionService {
     private readonly db;
     private readonly pepper;
     private readonly now;
-    /** When each MCP-port session last proved TOTP (design §5.3); in memory, so a restart asks again. */
-    private readonly totpProofs;
     constructor(db: Db, pepper: Buffer, now?: () => Date);
     hashId(raw: string): string;
     create(userId: string, kind: SessionKind, limits: SessionLimits, meta?: {
@@ -39,9 +37,5 @@ export declare class SessionService {
     revokeKind(userId: string, kind: SessionKind): number;
     /** The user signs out every approval browser at once (Profile page, design §5.3). */
     revokeApprovalBrowsers(userId: string): number;
-    /** Proofs older than `maxAgeMs` are dropped on the way. */
-    recordTotpProof(idHash: string, maxAgeMs: number): void;
-    /** Milliseconds since this session last proved TOTP, or Infinity if it never did. */
-    sinceTotpProof(idHash: string): number;
     purgeExpired(): number;
 }

package/dist/auth/sessions.js

@@ -8,8 +8,6 @@ export class SessionService {
     db;
     pepper;
     now;
-    /** When each MCP-port session last proved TOTP (design §5.3); in memory, so a restart asks again. */
-    totpProofs = new Map();
     constructor(db, pepper, now = () => new Date()) {
         this.db = db;
         this.pepper = pepper;
@@ -112,19 +110,6 @@ export class SessionService {
             return count;
         });
     }
-    /** Proofs older than `maxAgeMs` are dropped on the way. */
-    recordTotpProof(idHash, maxAgeMs) {
-        const now = this.now().getTime();
-        for (const [k, at] of this.totpProofs)
-            if (now - at > maxAgeMs)
-                this.totpProofs.delete(k);
-        this.totpProofs.set(idHash, now);
-    }
-    /** Milliseconds since this session last proved TOTP, or Infinity if it never did. */
-    sinceTotpProof(idHash) {
-        const at = this.totpProofs.get(idHash);
-        return at === undefined ? Infinity : this.now().getTime() - at;
-    }
     purgeExpired() {
         return this.db.delete(sessions).where(lt(sessions.expiresAt, this.now())).run().changes;
     }

package/dist/auth/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAoB1C,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,OAAO,cAAc;IAKN;IACA;IACA;IANnB,qGAAqG;IACpF,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,YACmB,EAAM,EACN,MAAc,EACd,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,OAAE,GAAF,EAAE,CAAI;QACN,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,MAAM,CAAC,GAAW;QAChB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CACJ,MAAc,EACd,IAAiB,EACjB,MAAqB,EACrB,OAA4C,EAAE;QAE9C,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB,MAAM;YACN,IAAI;YACJ,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;SACjD,CAAC;aACD,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sGAAsG;IACtG,QAAQ,CAAC,GAAuB,EAAE,IAAiB,EAAE,MAAqB;QACxE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,QAAQ,CAAC;aACd,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC/C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3E,sFAAsF;QACtF,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACzE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,WAAW,IAAI,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;YACzF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;YAC5D,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;iBAClC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAClC,GAAG,EAAE,CAAC;QACX,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,GAAuB;QAC5B,IAAI,GAAG;YACL,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC5C,GAAG,EAAE,CAAC;IACb,CAAC;IAED,0GAA0G;IAC1G,UAAU,CAAC,MAAc,EAAE,OAAgB;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;aAClE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,uGAAuG;IACvG,QAAQ,CAAC,MAAc,EAAE,IAAiB;QACxC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;aACzG,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aACpG,GAAG,EAAE,CAAC;IACX,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAiB;QAC1C,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC,OAAO,CAAC;IACnB,CAAC;IAED,qFAAqF;IACrF,sBAAsB,CAAC,MAAc;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,EAAE;iBACb,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;iBACzE,GAAG,EAAE,CAAC,OAAO,CAAC;YACjB,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,2BAA2B;gBACrC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,KAAK,EAAE;aAClB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,eAAe,CAAC,MAAc,EAAE,QAAgB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,GAAG,GAAG,EAAE,GAAG,QAAQ;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,qFAAqF;IACrF,cAAc,CAAC,MAAc;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;IACjE,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1F,CAAC;CACF"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAoB1C,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,OAAO,cAAc;IAEN;IACA;IACA;IAHnB,YACmB,EAAM,EACN,MAAc,EACd,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,OAAE,GAAF,EAAE,CAAI;QACN,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,MAAM,CAAC,GAAW;QAChB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CACJ,MAAc,EACd,IAAiB,EACjB,MAAqB,EACrB,OAA4C,EAAE;QAE9C,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB,MAAM;YACN,IAAI;YACJ,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;SACjD,CAAC;aACD,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sGAAsG;IACtG,QAAQ,CAAC,GAAuB,EAAE,IAAiB,EAAE,MAAqB;QACxE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,QAAQ,CAAC;aACd,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC/C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3E,sFAAsF;QACtF,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;QACzE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,WAAW,IAAI,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;YACzF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;YAC5D,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;iBAClC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBAClC,GAAG,EAAE,CAAC;QACX,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,GAAuB;QAC5B,IAAI,GAAG;YACL,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;iBAC5C,GAAG,EAAE,CAAC;IACb,CAAC;IAED,0GAA0G;IAC1G,UAAU,CAAC,MAAc,EAAE,OAAgB;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;aAClE,GAAG,EAAE,CAAC;IACX,CAAC;IAED,uGAAuG;IACvG,QAAQ,CAAC,MAAc,EAAE,IAAiB;QACxC,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;aACzG,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aACpG,GAAG,EAAE,CAAC;IACX,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAiB;QAC1C,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAChE,GAAG,EAAE,CAAC,OAAO,CAAC;IACnB,CAAC;IAED,qFAAqF;IACrF,sBAAsB,CAAC,MAAc;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,EAAE;iBACb,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;iBACzE,GAAG,EAAE,CAAC,OAAO,CAAC;YACjB,UAAU,CAAC,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,2BAA2B;gBACrC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,EAAE,KAAK,EAAE;aAClB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1F,CAAC;CACF"}

package/dist/catalog/rules.d.ts

@@ -51,14 +51,14 @@ export declare function listRules(db: Db, instanceId: string): {
     reason: string;
     id: string;
     match: unknown;
-    createdAt: Date;
-    updatedAt: Date | null;
-    expiresAt: Date | null;
     enabled: boolean;
+    createdAt: Date;
     instanceId: string;
+    updatedAt: Date | null;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
+    expiresAt: Date | null;
     createdBy: string | null;
     ownerUserId: string | null;
     lastTriggeredAt: Date | null;
@@ -85,14 +85,14 @@ export declare function createRule(db: Db, manifest: Manifest, instanceId: strin
     reason: string;
     id: string;
     match: unknown;
-    createdAt: Date;
-    updatedAt: Date | null;
-    expiresAt: Date | null;
     enabled: boolean;
+    createdAt: Date;
     instanceId: string;
+    updatedAt: Date | null;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
+    expiresAt: Date | null;
     createdBy: string | null;
     ownerUserId: string | null;
     lastTriggeredAt: Date | null;
@@ -119,14 +119,14 @@ export declare function updateRule(db: Db, manifest: Manifest, instanceId: strin
     reason: string;
     id: string;
     match: unknown;
-    createdAt: Date;
-    updatedAt: Date | null;
-    expiresAt: Date | null;
     enabled: boolean;
+    createdAt: Date;
     instanceId: string;
+    updatedAt: Date | null;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
+    expiresAt: Date | null;
     createdBy: string | null;
     ownerUserId: string | null;
     lastTriggeredAt: Date | null;
@@ -161,14 +161,14 @@ export declare function listOwnRules(db: Db, instanceId: string, owner: RuleOwne
     reason: string;
     id: string;
     match: unknown;
-    createdAt: Date;
-    updatedAt: Date | null;
-    expiresAt: Date | null;
     enabled: boolean;
+    createdAt: Date;
     instanceId: string;
+    updatedAt: Date | null;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
+    expiresAt: Date | null;
     createdBy: string | null;
     ownerUserId: string | null;
     lastTriggeredAt: Date | null;
@@ -192,14 +192,14 @@ export declare function createOwnRule(db: Db, manifest: () => Manifest, instance
     reason: string;
     id: string;
     match: unknown;
-    createdAt: Date;
-    updatedAt: Date | null;
-    expiresAt: Date | null;
     enabled: boolean;
+    createdAt: Date;
     instanceId: string;
+    updatedAt: Date | null;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
+    expiresAt: Date | null;
     createdBy: string | null;
     ownerUserId: string | null;
     lastTriggeredAt: Date | null;
@@ -223,14 +223,14 @@ export declare function updateOwnRule(db: Db, manifest: () => Manifest, instance
     reason: string;
     id: string;
     match: unknown;
-    createdAt: Date;
-    updatedAt: Date | null;
-    expiresAt: Date | null;
     enabled: boolean;
+    createdAt: Date;
     instanceId: string;
+    updatedAt: Date | null;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
+    expiresAt: Date | null;
     createdBy: string | null;
     ownerUserId: string | null;
     lastTriggeredAt: Date | null;

package/dist/config/env.d.ts

@@ -22,8 +22,8 @@ declare const EnvSchema: z.ZodObject<{
     }>>, z.ZodTransform<boolean, "" | "0" | "1" | "true" | "false" | undefined>>;
     LOG_LEVEL: z.ZodDefault<z.ZodEnum<{
         error: "error";
-        debug: "debug";
         info: "info";
+        debug: "debug";
         warn: "warn";
     }>>;
 }, z.core.$strip>;

package/dist/db/schema.d.ts

@@ -355,7 +355,7 @@ export declare const users: import("drizzle-orm/sqlite-core").SQLiteTableWithCol
             tableName: "users";
             dataType: "string";
             columnType: "SQLiteText";
-            data: "oidc" | "external" | "signup";
+            data: "external" | "oidc" | "signup";
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -1278,24 +1278,24 @@ export declare const pluginInstances: import("drizzle-orm/sqlite-core").SQLiteTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        authMode: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-            name: "auth_mode";
+        authMethods: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
             tableName: "plugin_instances";
-            dataType: "string";
-            columnType: "SQLiteText";
-            data: "external" | "bearer" | "oauth" | "bearer+oauth";
+            dataType: "json";
+            columnType: "SQLiteTextJson";
+            data: ("bearer" | "oauth" | "external")[];
             driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["external", "bearer", "oauth", "bearer+oauth"];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {
-            length: number | undefined;
+            $type: ("bearer" | "oauth" | "external")[];
         }>;
         settings: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: string;