@telecrypt-io/storage 0.4.0 → 0.5.8

package/dist/core/oidc.js

@@ -1,35 +1,644 @@
 /**
  * Shared OIDC/MAS login building blocks — used by BOTH the CLI (device-code
  * grant) and the web UI (authorization-code + PKCE). Browser-safe (no
- * node:fs/path/v8/process/commander/fake-indexeddb): the functions here only
- * ever call browser-only matrix-js-sdk OIDC helpers (window.crypto for PKCE)
- * when actually invoked from the browser adapter — importing this module
- * under Node is safe (nothing here touches `window` at import time), calling
- * the PKCE-only functions from Node is not (by design: the CLI never calls
- * them, only the device-code functions, which are plain `fetch` calls).
+ * node:fs/path/v8/process/commander/fake-indexeddb): browser state is only
+ * touched when the PKCE functions are called by the web adapter. Importing
+ * this module under Node is safe; the CLI uses the device-code functions,
+ * which are plain fetch calls.
  */
 import { createClient } from "matrix-js-sdk";
-import { registerOidcClient, generateScope, generateOidcAuthorizationUrl, completeAuthorizationCodeGrant, startDeviceAuthorization, waitForDeviceAuthorization, } from "matrix-js-sdk/lib/oidc/index.js";
-import { OidcClient, WebStorageStateStore } from "oidc-client-ts";
+import { generateScope, isValidDeviceAccessTokenResponse, normalizeBearerTokenResponseTokenType, validateBearerTokenResponse, validateDeviceAuthorizationResponse, validateRegistrationResponse, OAuthGrantType, OAuth2, } from "matrix-js-sdk/lib/oauth/index.js";
 import { StorageError } from "./errors.js";
+import { raceWithAbort, readBoundedResponseBody } from "./http.js";
+import { validateCanonicalMatrixUserId, validateMatrixDeviceId, } from "./constants.js";
+const AUTHORIZATION_CONTEXT_PREFIX = "telecrypt:oauth2:pkce:v1:";
+const AUTHORIZATION_CONTEXT_VERSION = 1;
+// The callback context is a short-lived transaction, not a durable login
+// session. Ten minutes covers normal redirects while limiting replay after a
+// stale browser tab or session-storage copy is recovered.
+const AUTHORIZATION_CONTEXT_MAX_AGE_MS = 10 * 60 * 1000;
+const AUTHORIZATION_CONTEXT_MAX_FUTURE_SKEW_MS = 30 * 1000;
+const MAX_AUTHORIZATION_CONTEXT_LENGTH = 64 * 1024;
+const PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+const DEVICE_ID_PATTERN = /^[A-Za-z0-9._~-]{1,128}$/;
+const STATE_PATTERN = /^[A-Za-z0-9._~-]{32,128}$/;
+const MAX_OAUTH_ERROR_BODY_BYTES = 16 * 1024;
+const MAX_OAUTH_SUCCESS_BODY_BYTES = 32 * 1024;
+const OIDC_REQUEST_TIMEOUT_MS = 30_000;
+const OIDC_REFRESH_TIMEOUT_MS = 30_000;
+const OIDC_CLEANUP_TIMEOUT_MS = 30_000;
+const MAX_OIDC_URL_LENGTH = 2048;
+const MAX_OIDC_METADATA_STRING_LENGTH = 4096;
+const MAX_OIDC_CLIENT_ID_LENGTH = 512;
+const MAX_OIDC_CODE_LENGTH = 4096;
+const MAX_OIDC_TOKEN_LENGTH = 8192;
+const MAX_OIDC_SCOPE_LENGTH = 4096;
+const MAX_OIDC_CONTACTS = 16;
+const MAX_OIDC_REDIRECT_URIS = 8;
+// MAS advertises a 20-minute device-code lifetime. Keep that provider window
+// as the hard upper bound while retaining a finite polling budget.
+const MAX_DEVICE_EXPIRES_IN_SECONDS = 20 * 60;
+const MAX_DEVICE_INTERVAL_SECONDS = 5 * 60;
+const MAX_DEVICE_POLL_DURATION_MS = MAX_DEVICE_EXPIRES_IN_SECONDS * 1000;
+const deviceAuthorizationDeviceIds = new WeakMap();
+const SAFE_OAUTH_ERROR_CODES = new Set([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "unauthorized_client",
+    "unsupported_grant_type",
+    "invalid_scope",
+    "invalid_token",
+    "temporarily_unavailable",
+    "server_error",
+    "authorization_pending",
+    "slow_down",
+    "access_denied",
+    "expired_token",
+    "expired",
+]);
+class OidcRequestTimeoutError extends Error {
+    operation;
+    constructor(operation) {
+        super(`OIDC ${operation} timed out`);
+        this.operation = operation;
+        this.name = "OidcRequestTimeoutError";
+    }
+}
+class OidcRequestCancelledError extends Error {
+    operation;
+    constructor(operation) {
+        super(`OIDC ${operation} cancelled`);
+        this.operation = operation;
+        this.name = "OidcRequestCancelledError";
+    }
+}
+/** A local response-consistency failure that must remain distinguishable from
+ * a sanitized provider/transport failure. The message is fixed and contains
+ * no provider-controlled data. */
+class OidcValidationError extends StorageError {
+    constructor(message) {
+        super(message);
+        this.name = "OidcValidationError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function randomHex(byteLength) {
+    const bytes = crypto.getRandomValues(new Uint8Array(byteLength));
+    return Array.from(bytes, (value) => value.toString(16).padStart(2, "0")).join("");
+}
+function requireString(value, name, pattern) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > MAX_OIDC_METADATA_STRING_LENGTH ||
+        /[\u0000-\u001f\u007f]/.test(value) ||
+        (pattern && !pattern.test(value))) {
+        throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+    }
+    return value;
+}
+function requireClientId(value) {
+    const clientId = requireString(value, "client ID");
+    if (clientId.length > MAX_OIDC_CLIENT_ID_LENGTH || /\s/.test(clientId)) {
+        throw new StorageError("OIDC authorization context has an invalid client ID");
+    }
+    return clientId;
+}
+function requireBoundedString(value, name, maxLength) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > maxLength ||
+        /[\s\u0000-\u001f\u007f]/.test(value)) {
+        throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+    }
+    return value;
+}
+function requireScope(value, name) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > MAX_OIDC_SCOPE_LENGTH ||
+        /[\u0000-\u001f\u007f]/.test(value) ||
+        value.trim() !== value ||
+        /\s{2,}/.test(value)) {
+        throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+    }
+    return value;
+}
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+function parseSafeRedirectUri(value, name) {
+    const text = requireBoundedString(value, name, MAX_OIDC_URL_LENGTH);
+    let parsed;
+    try {
+        parsed = new URL(text);
+    }
+    catch {
+        throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+    }
+    const isRootWithoutSlash = parsed.pathname === "/" && parsed.toString() === `${text}/`;
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") ||
+        (parsed.protocol === "http:" && !isLoopbackHostname(parsed.hostname)) ||
+        parsed.username !== "" ||
+        parsed.password !== "" ||
+        parsed.hash !== "" ||
+        (parsed.toString() !== text && !isRootWithoutSlash)) {
+        throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+    }
+    return parsed;
+}
+function requireMetadataString(value, name, maxLength = MAX_OIDC_METADATA_STRING_LENGTH) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > maxLength ||
+        /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new StorageError(`OIDC dynamic client registration has an invalid ${name}`);
+    }
+    return value;
+}
+function validateRegistrationMetadata(metadata) {
+    const clientUri = parseHttpUrl(metadata.clientUri, "client URI");
+    if (metadata.clientName !== undefined)
+        requireMetadataString(metadata.clientName, "client name");
+    for (const [name, value] of [
+        ["logo URI", metadata.logoUri],
+        ["terms URI", metadata.tosUri],
+        ["policy URI", metadata.policyUri],
+    ]) {
+        if (value !== undefined) {
+            const uri = parseHttpUrl(value, name);
+            if (uri.origin !== clientUri.origin) {
+                throw new StorageError("OIDC dynamic client registration has an untrusted metadata origin");
+            }
+        }
+    }
+    if (metadata.contacts !== undefined) {
+        if (!Array.isArray(metadata.contacts) || metadata.contacts.length > MAX_OIDC_CONTACTS) {
+            throw new StorageError("OIDC dynamic client registration has too many contacts");
+        }
+        metadata.contacts.forEach((contact) => requireMetadataString(contact, "contact", 512));
+    }
+    if (metadata.redirectUris === undefined)
+        return { clientUri };
+    if (!Array.isArray(metadata.redirectUris) ||
+        metadata.redirectUris.length === 0 ||
+        metadata.redirectUris.length > MAX_OIDC_REDIRECT_URIS) {
+        throw new StorageError("OIDC dynamic client registration has too many redirect URIs");
+    }
+    const redirectUris = metadata.redirectUris.map((value) => {
+        const uri = parseSafeRedirectUri(value, "redirect URI");
+        if (uri.origin !== clientUri.origin) {
+            throw new StorageError("OIDC dynamic client registration has an untrusted redirect origin");
+        }
+        return uri.toString();
+    });
+    return { clientUri, redirectUris };
+}
+async function readBoundedResponseText(response, maxBytes = MAX_OAUTH_ERROR_BODY_BYTES, signal) {
+    const body = await readBoundedResponseBody(response, maxBytes, signal);
+    return { text: new TextDecoder().decode(body.bytes), truncated: body.truncated };
+}
+async function readBoundedJsonResponse(response, operation, signal) {
+    const maxBytes = response.ok ? MAX_OAUTH_SUCCESS_BODY_BYTES : MAX_OAUTH_ERROR_BODY_BYTES;
+    const body = await readBoundedResponseText(response, maxBytes, signal);
+    if (body.truncated) {
+        throw new StorageError(`OIDC ${operation} returned an oversized response`);
+    }
+    try {
+        return JSON.parse(body.text);
+    }
+    catch {
+        throw new StorageError(`OIDC ${operation} returned an invalid response`);
+    }
+}
+function assertNoRedirect(response, endpoint, operation) {
+    // OAuth request bodies contain bearer credentials, refresh tokens, or
+    // authorization codes. Redirects must never be followed with those bodies.
+    // `redirect: "manual"` makes this a local rejection rather than a network
+    // hop, and the URL check protects callers that provide a non-canonical URL.
+    if ((response.status >= 300 && response.status < 400) ||
+        response.type === "opaqueredirect" ||
+        (response.url !== "" && response.url !== endpoint) ||
+        response.redirected) {
+        void response.body?.cancel().catch(() => undefined);
+        throw new StorageError(`OIDC ${operation} rejected an untrusted redirect`);
+    }
+}
+function exactEndpoint(value, name) {
+    return parseHttpUrl(value, name).toString();
+}
+function parseSafeOAuthError(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(parsed) || typeof parsed.error !== "string" || !SAFE_OAUTH_ERROR_CODES.has(parsed.error)) {
+        return undefined;
+    }
+    return { code: parsed.error };
+}
+function formatTokenRefreshFailure(status, body) {
+    if (body.truncated) {
+        return `OIDC token refresh failed (${status}): provider error response was too large`;
+    }
+    const oauthError = parseSafeOAuthError(body.text);
+    if (!oauthError) {
+        return `OIDC token refresh failed (${status}): provider returned an invalid OAuth error response`;
+    }
+    return `OIDC token refresh failed (${status}): OAuth error ${oauthError.code}`;
+}
+function providerErrorStatus(error) {
+    if (!isRecord(error) || typeof error.httpStatus !== "number")
+        return undefined;
+    return Number.isInteger(error.httpStatus) && error.httpStatus >= 100 && error.httpStatus <= 599
+        ? error.httpStatus
+        : undefined;
+}
+function formatProviderFailure(operation, error) {
+    if (error instanceof OidcRequestTimeoutError)
+        return error.message;
+    if (error instanceof OidcRequestCancelledError)
+        return error.message;
+    const status = providerErrorStatus(error);
+    return `OIDC ${operation} failed${status === undefined ? "" : ` (${status})`}`;
+}
+function ensureOidcNotCancelled(signal, operation) {
+    if (signal?.aborted)
+        throw new OidcRequestCancelledError(operation);
+}
+async function requestWithTimeout(input, init, operation, consume, timeoutMs = OIDC_REQUEST_TIMEOUT_MS, externalSignal) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, timeoutMs);
+    const abort = () => controller.abort();
+    const signals = [externalSignal, init.signal].filter((signal) => signal != null);
+    for (const signal of signals) {
+        if (signal.aborted)
+            controller.abort();
+        else
+            signal.addEventListener("abort", abort, { once: true });
+    }
+    try {
+        const response = await raceWithAbort(fetch(input, { ...init, signal: controller.signal }), controller.signal, () => undefined, () => timedOut
+            ? new OidcRequestTimeoutError(operation)
+            : new OidcRequestCancelledError(operation));
+        return await consume(response, controller.signal);
+    }
+    catch (error) {
+        if (timedOut)
+            throw new OidcRequestTimeoutError(operation);
+        if (signals.some((signal) => signal.aborted)) {
+            throw new OidcRequestCancelledError(operation);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+        for (const signal of signals)
+            signal.removeEventListener("abort", abort);
+    }
+}
+function abortableDelay(milliseconds, signal) {
+    if (signal?.aborted)
+        return Promise.reject(new OidcRequestCancelledError("device authorization"));
+    return new Promise((resolve, reject) => {
+        let timer;
+        const abort = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", abort);
+            reject(new OidcRequestCancelledError("device authorization"));
+        };
+        timer = setTimeout(() => {
+            signal?.removeEventListener("abort", abort);
+            resolve();
+        }, milliseconds);
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}
+function requestUrl(input) {
+    if (typeof input === "string")
+        return new URL(input).toString();
+    if (input instanceof URL)
+        return input.toString();
+    return input.url;
+}
+/**
+ * MatrixClient's OAuth helpers use the SDK HTTP layer for discovery and
+ * whoami. Supply a bounded/manual-redirect fetch implementation so those
+ * calls have the same body and credential boundary as the direct OAuth calls.
+ */
+function boundedMatrixFetch(operation, externalSignal) {
+    return async (input, init) => {
+        const endpoint = requestUrl(input);
+        return requestWithTimeout(input, { ...init, redirect: "manual" }, operation, async (response, requestSignal) => {
+            assertNoRedirect(response, endpoint, operation);
+            const maxBytes = response.ok ? MAX_OAUTH_SUCCESS_BODY_BYTES : MAX_OAUTH_ERROR_BODY_BYTES;
+            const body = await readBoundedResponseText(response, maxBytes, requestSignal);
+            if (body.truncated) {
+                if (response.ok) {
+                    throw new StorageError(`OIDC ${operation} returned an oversized response`);
+                }
+                return new Response(null, {
+                    status: response.status,
+                    statusText: response.statusText,
+                });
+            }
+            return new Response(body.text, {
+                status: response.status,
+                statusText: response.statusText,
+                headers: response.headers,
+            });
+        }, OIDC_REQUEST_TIMEOUT_MS, externalSignal);
+    };
+}
+function parseHttpUrl(value, name) {
+    const text = requireBoundedString(value, name, MAX_OIDC_URL_LENGTH);
+    let parsed;
+    try {
+        parsed = new URL(text);
+    }
+    catch {
+        throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+    }
+    const isRootWithoutSlash = parsed.pathname === "/" && parsed.toString() === `${text}/`;
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") ||
+        (parsed.protocol === "http:" && !isLoopbackHostname(parsed.hostname)) ||
+        parsed.username !== "" ||
+        parsed.password !== "" ||
+        parsed.search !== "" ||
+        parsed.hash !== "" ||
+        (parsed.toString() !== text && !isRootWithoutSlash)) {
+        throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+    }
+    return parsed;
+}
+function isWithinIssuerPath(issuer, endpoint) {
+    if (issuer.pathname === "/")
+        return true;
+    const prefix = issuer.pathname.endsWith("/") ? issuer.pathname : `${issuer.pathname}/`;
+    return endpoint.pathname === issuer.pathname || endpoint.pathname.startsWith(prefix);
+}
+function matrixAuthMetadataEndpoint(homeserver) {
+    const basePath = homeserver.pathname.replace(/\/+$/u, "");
+    return new URL(`${basePath}/_matrix/client/v1/auth_metadata`, homeserver.origin).toString();
+}
+function validateTokenEndpointMetadata(metadata) {
+    const issuer = parseHttpUrl(metadata.issuer, "issuer");
+    const tokenEndpoint = parseHttpUrl(metadata.token_endpoint, "token endpoint");
+    if (tokenEndpoint.origin !== issuer.origin || !isWithinIssuerPath(issuer, tokenEndpoint)) {
+        throw new StorageError("OIDC token endpoint is outside the validated issuer");
+    }
+    let revocationEndpoint;
+    if (metadata.revocation_endpoint !== undefined) {
+        const parsed = parseHttpUrl(metadata.revocation_endpoint, "revocation endpoint");
+        if (parsed.origin !== issuer.origin || !isWithinIssuerPath(issuer, parsed)) {
+            throw new StorageError("OIDC revocation endpoint is outside the validated issuer");
+        }
+        revocationEndpoint = parsed.toString();
+    }
+    return { tokenEndpoint: tokenEndpoint.toString(), revocationEndpoint };
+}
+function validateAuthMetadata(value) {
+    if (!isRecord(value)) {
+        throw new StorageError("OIDC authorization context has invalid auth metadata");
+    }
+    const metadata = value;
+    // Validate the stable Matrix auth-metadata contract locally. The Matrix SDK
+    // guard currently models revocation_endpoint as required even though the
+    // protocol makes it optional; substituting a fake endpoint there would turn
+    // malformed metadata into a trusted credential destination.
+    for (const name of [
+        "issuer",
+        "authorization_endpoint",
+        "registration_endpoint",
+        "token_endpoint",
+    ]) {
+        const field = metadata[name];
+        if (field !== undefined &&
+            (typeof field !== "string" ||
+                field.length === 0 ||
+                field.length > MAX_OIDC_URL_LENGTH ||
+                /[\u0000-\u001f\u007f]/.test(field))) {
+            throw new StorageError("OIDC authorization context has invalid auth metadata");
+        }
+    }
+    for (const name of ["issuer", "authorization_endpoint", "registration_endpoint", "token_endpoint"]) {
+        if (metadata[name] === undefined) {
+            throw new StorageError("OIDC authorization context has invalid auth metadata");
+        }
+    }
+    for (const name of [
+        "revocation_endpoint",
+        "device_authorization_endpoint",
+        "account_management_uri",
+    ]) {
+        const field = metadata[name];
+        if (field !== undefined &&
+            (typeof field !== "string" ||
+                field.length === 0 ||
+                field.length > MAX_OIDC_URL_LENGTH ||
+                /[\u0000-\u001f\u007f]/.test(field))) {
+            throw new StorageError("OIDC authorization context has invalid auth metadata");
+        }
+    }
+    for (const name of [
+        "response_modes_supported",
+        "response_types_supported",
+        "grant_types_supported",
+        "code_challenge_methods_supported",
+        "prompt_values_supported",
+        "account_management_actions_supported",
+    ]) {
+        const field = metadata[name];
+        if (field !== undefined &&
+            (!Array.isArray(field) || field.length > 32 || field.some((item) => typeof item !== "string" ||
+                item.length === 0 ||
+                item.length > MAX_OIDC_METADATA_STRING_LENGTH ||
+                /[\u0000-\u001f\u007f]/.test(item)))) {
+            throw new StorageError("OIDC authorization context has invalid auth metadata");
+        }
+    }
+    for (const name of ["response_types_supported", "grant_types_supported", "code_challenge_methods_supported"]) {
+        if (!Array.isArray(metadata[name]) || metadata[name].length === 0) {
+            throw new StorageError("OIDC authorization context has invalid auth metadata");
+        }
+    }
+    return value;
+}
+/** TeleCrypt's extra trust boundary for browser state rehydration. */
+function validateTrustedAuthMetadata(value) {
+    const metadata = validateAuthMetadata(value);
+    const issuer = parseHttpUrl(metadata.issuer, "issuer");
+    const endpoints = [
+        ["authorization endpoint", metadata.authorization_endpoint],
+        ["registration endpoint", metadata.registration_endpoint],
+        ["token endpoint", metadata.token_endpoint],
+    ];
+    if (metadata.revocation_endpoint !== undefined) {
+        endpoints.push(["revocation endpoint", metadata.revocation_endpoint]);
+    }
+    if (metadata.device_authorization_endpoint !== undefined) {
+        endpoints.push(["device authorization endpoint", metadata.device_authorization_endpoint]);
+    }
+    for (const [name, value] of endpoints) {
+        const endpoint = parseHttpUrl(value, name);
+        if (endpoint.origin !== issuer.origin || !isWithinIssuerPath(issuer, endpoint)) {
+            throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+        }
+    }
+    return metadata;
+}
+function validateDeviceAuthorizationSession(value) {
+    try {
+        validateDeviceAuthorizationResponse(value);
+    }
+    catch {
+        throw new StorageError("OIDC device authorization returned an invalid response");
+    }
+    const session = value;
+    requireBoundedString(session.device_code, "device code", MAX_OIDC_CODE_LENGTH);
+    requireBoundedString(session.user_code, "user code", MAX_OIDC_CODE_LENGTH);
+    parseSafeRedirectUri(session.verification_uri, "verification URI");
+    if (session.verification_uri_complete !== undefined) {
+        parseSafeRedirectUri(session.verification_uri_complete, "complete verification URI");
+    }
+    if (!Number.isInteger(session.expires_in) ||
+        session.expires_in <= 0 ||
+        session.expires_in > MAX_DEVICE_EXPIRES_IN_SECONDS) {
+        throw new StorageError("OIDC device authorization returned an invalid expiry");
+    }
+    if (session.interval !== undefined &&
+        (!Number.isInteger(session.interval) ||
+            session.interval <= 0 ||
+            session.interval > MAX_DEVICE_INTERVAL_SECONDS)) {
+        throw new StorageError("OIDC device authorization returned an invalid polling interval");
+    }
+    return session;
+}
+function validateDeviceAccessTokenResponse(value) {
+    if (!isValidDeviceAccessTokenResponse(value)) {
+        throw new StorageError("OIDC device authorization returned an invalid token response");
+    }
+    const response = value;
+    if (response.token_type.toLowerCase() !== "bearer") {
+        throw new StorageError("OIDC device authorization returned an invalid token type");
+    }
+    validateTokenBounds(response, "device authorization");
+    return response;
+}
+function validateTokenBounds(value, operation) {
+    try {
+        requireBoundedString(value.access_token, "access token", MAX_OIDC_TOKEN_LENGTH);
+        if (value.refresh_token !== undefined) {
+            requireBoundedString(value.refresh_token, "refresh token", MAX_OIDC_TOKEN_LENGTH);
+        }
+        if (value.scope !== undefined)
+            requireScope(value.scope, "scope");
+    }
+    catch {
+        throw new StorageError(`OIDC ${operation} returned an invalid token response`);
+    }
+    if (value.expires_in !== undefined &&
+        (!Number.isInteger(value.expires_in) || value.expires_in < 0 || value.expires_in > 86400)) {
+        throw new StorageError(`OIDC ${operation} returned an invalid token expiry`);
+    }
+}
+function sessionStorage() {
+    if (typeof window === "undefined" || !window.sessionStorage) {
+        throw new StorageError("OIDC authorization requires browser session storage");
+    }
+    return window.sessionStorage;
+}
+function validateAuthorizationInputs(opts) {
+    const authMetadata = validateTrustedAuthMetadata(opts.authMetadata);
+    const issuer = new URL(authMetadata.issuer);
+    const homeserver = parseHttpUrl(opts.homeserverUrl, "homeserver URL");
+    const redirect = parseHttpUrl(opts.redirectUri, "redirect URI");
+    if (homeserver.origin !== issuer.origin || redirect.origin !== window.location.origin) {
+        throw new StorageError("OIDC authorization context origins are not trusted");
+    }
+    requireClientId(opts.clientId);
+    const deviceId = opts.deviceId ?? randomHex(5).toUpperCase();
+    requireString(deviceId, "device ID", DEVICE_ID_PATTERN);
+    return { authMetadata, homeserver, redirect, deviceId };
+}
+function parseAuthorizationContext(value, expectedState) {
+    if (!isRecord(value) || value.version !== AUTHORIZATION_CONTEXT_VERSION) {
+        throw new StorageError("OIDC authorization context is missing or invalid");
+    }
+    if (value.state !== expectedState) {
+        throw new StorageError("OIDC authorization context state does not match callback state");
+    }
+    if (typeof value.createdAtMs !== "number" || !Number.isSafeInteger(value.createdAtMs)) {
+        throw new StorageError("OIDC authorization context has an invalid creation time");
+    }
+    const ageMs = Date.now() - value.createdAtMs;
+    if (ageMs < -AUTHORIZATION_CONTEXT_MAX_FUTURE_SKEW_MS) {
+        throw new StorageError("OIDC authorization context is from the future");
+    }
+    if (ageMs > AUTHORIZATION_CONTEXT_MAX_AGE_MS) {
+        throw new StorageError("OIDC authorization context is expired");
+    }
+    const authMetadata = validateTrustedAuthMetadata(value.authMetadata);
+    const homeserver = parseHttpUrl(value.homeserverUrl, "homeserver URL");
+    const redirect = parseHttpUrl(value.redirectUri, "redirect URI");
+    if (homeserver.origin !== new URL(authMetadata.issuer).origin || redirect.origin !== window.location.origin) {
+        throw new StorageError("OIDC authorization context origins are not trusted");
+    }
+    return {
+        version: AUTHORIZATION_CONTEXT_VERSION,
+        createdAtMs: value.createdAtMs,
+        state: expectedState,
+        authMetadata,
+        clientId: requireClientId(value.clientId),
+        redirectUri: redirect.toString(),
+        homeserverUrl: homeserver.toString(),
+        deviceId: requireString(value.deviceId, "device ID", DEVICE_ID_PATTERN),
+        codeVerifier: requireString(value.codeVerifier, "PKCE verifier", PKCE_VERIFIER_PATTERN),
+    };
+}
 /**
  * Discovers the OIDC/MAS issuer and endpoints for a homeserver via the
- * Matrix client's authentication metadata endpoint.
- *
- * NODE CALLERS: this internally constructs oidc-client-ts state that
- * requires `window.sessionStorage`/`window.localStorage` to exist (a real
- * browser has both natively). A Node adapter may install those only around
- * this call: a permanent global `window` breaks rust-crypto WASM's own
- * environment detection. The functional-test-only adapter is kept in
- * `test/harness/oidcWindowShim.ts`, rather than in the production SDK.
+ * Matrix client's stable `/auth_metadata` endpoint. Matrix 42 performs this
+ * as a plain metadata fetch; discovery is safe for browser and Node callers.
  */
-export async function discoverOidcIssuer(homeserverBaseUrl) {
-    const client = createClient({ baseUrl: homeserverBaseUrl });
+export async function discoverOidcIssuer(homeserverBaseUrl, signal) {
     try {
-        return await client.getAuthMetadata();
+        const homeserver = parseHttpUrl(homeserverBaseUrl, "homeserver URL");
+        const endpoint = matrixAuthMetadataEndpoint(homeserver);
+        const { response, body } = await requestWithTimeout(endpoint, { method: "GET", headers: { Accept: "application/json" }, redirect: "manual" }, "discovery", async (response, requestSignal) => {
+            assertNoRedirect(response, endpoint, "discovery");
+            if (!response.ok) {
+                // Discovery only consumes metadata on success. Drain a bounded
+                // error body without parsing or surfacing provider-controlled text;
+                // the status remains the only caller-visible diagnostic.
+                await readBoundedResponseBody(response, MAX_OAUTH_ERROR_BODY_BYTES, requestSignal);
+                return { response, body: undefined };
+            }
+            return {
+                response,
+                body: await readBoundedJsonResponse(response, "discovery", requestSignal),
+            };
+        }, OIDC_REQUEST_TIMEOUT_MS, signal);
+        if (!response.ok) {
+            const failure = new StorageError("OIDC discovery failed");
+            failure.httpStatus = response.status;
+            throw failure;
+        }
+        ensureOidcNotCancelled(signal, "discovery");
+        return validateTrustedAuthMetadata(body);
     }
     catch (err) {
-        throw new StorageError(`OIDC discovery failed: ${err.message}`);
+        throw new StorageError(formatProviderFailure("discovery", err));
     }
 }
 /**
@@ -37,184 +646,634 @@ export async function discoverOidcIssuer(homeserverBaseUrl) {
  * host unless the issuer's policy allows a mismatch (our local dev/test MAS
  * does; a production issuer may not).
  */
-export async function registerClient(authMetadata, metadata) {
+export async function registerClient(authMetadata, metadata, signal) {
     try {
-        return await registerOidcClient(authMetadata, metadata);
+        const safeAuthMetadata = validateTrustedAuthMetadata(authMetadata);
+        const safeMetadata = validateRegistrationMetadata(metadata);
+        const defaultGrantTypes = [
+            OAuthGrantType.AuthorizationCode,
+            OAuthGrantType.RefreshToken,
+        ];
+        if (safeAuthMetadata.grant_types_supported.includes(OAuthGrantType.DeviceAuthorization)) {
+            defaultGrantTypes.push(OAuthGrantType.DeviceAuthorization);
+        }
+        const grantTypes = defaultGrantTypes;
+        if (grantTypes.some((grantType) => !safeAuthMetadata.grant_types_supported.includes(grantType))) {
+            throw new StorageError("OIDC dynamic client registration is not supported");
+        }
+        const registration = {
+            response_types: ["code"],
+            token_endpoint_auth_method: "none",
+            client_name: metadata.clientName,
+            client_uri: safeMetadata.clientUri.toString(),
+            grant_types: grantTypes,
+            logo_uri: metadata.logoUri,
+            application_type: metadata.applicationType,
+            redirect_uris: safeMetadata.redirectUris,
+            tos_uri: metadata.tosUri,
+            policy_uri: metadata.policyUri,
+        };
+        const endpoint = exactEndpoint(safeAuthMetadata.registration_endpoint, "registration endpoint");
+        const { response, body } = await requestWithTimeout(endpoint, {
+            method: "POST",
+            headers: { Accept: "application/json", "Content-Type": "application/json" },
+            body: JSON.stringify(registration),
+            redirect: "manual",
+        }, "dynamic client registration", async (response, requestSignal) => {
+            assertNoRedirect(response, endpoint, "dynamic client registration");
+            return {
+                response,
+                body: await readBoundedJsonResponse(response, "dynamic client registration", requestSignal),
+            };
+        }, OIDC_REQUEST_TIMEOUT_MS, signal);
+        if (!response.ok || !validateRegistrationResponse(body)) {
+            throw new StorageError("OIDC dynamic client registration failed");
+        }
+        ensureOidcNotCancelled(signal, "dynamic client registration");
+        return requireClientId(body.client_id);
     }
     catch (err) {
-        throw new StorageError(`OIDC dynamic client registration failed: ${err.message}`);
+        throw new StorageError(formatProviderFailure("dynamic client registration", err));
     }
 }
 // ---------------------------------------------------------------------------
 // Device-code grant (RFC 8628) — the CLI's login flow. Plain `fetch` calls
-// under the hood (matrix-js-sdk's `startDeviceAuthorization` /
-// `waitForDeviceAuthorization`), nothing browser-only.
+// under the hood (matrix-js-sdk's supported OAuth helpers), nothing
+// browser-only.
 // ---------------------------------------------------------------------------
 /**
  * Starts a device-code authorization session. `deviceId` is caller-chosen
  * (unlike the authorization-code flow, where the SDK picks a random one) so
  * it can be reused as this Matrix device's `device_id` throughout —
- * `generateScope(deviceId)` embeds it in the requested scope per MSC2967.
+ * `generateScope(deviceId)` embeds it in the requested stable Matrix OAuth
+ * scope.
  */
-export async function startDeviceCodeLogin(authMetadata, clientId, deviceId) {
-    const scope = generateScope(deviceId);
-    return startDeviceAuthorization({ clientId, scope, metadata: authMetadata });
+export async function startDeviceCodeLogin(authMetadata, clientId, deviceId, signal) {
+    try {
+        const safeAuthMetadata = validateTrustedAuthMetadata(authMetadata);
+        const safeClientId = requireClientId(clientId);
+        requireString(deviceId, "device ID", DEVICE_ID_PATTERN);
+        const scope = generateScope(deviceId);
+        const endpoint = safeAuthMetadata.device_authorization_endpoint;
+        if (!endpoint)
+            throw new StorageError("OIDC device authorization is not supported");
+        const trustedEndpoint = exactEndpoint(endpoint, "device authorization endpoint");
+        const { response, body } = await requestWithTimeout(trustedEndpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ client_id: safeClientId, scope }).toString(),
+            redirect: "manual",
+        }, "device authorization", async (response, requestSignal) => {
+            assertNoRedirect(response, trustedEndpoint, "device authorization");
+            return {
+                response,
+                body: await readBoundedJsonResponse(response, "device authorization", requestSignal),
+            };
+        }, OIDC_REQUEST_TIMEOUT_MS, signal);
+        if (!response.ok)
+            throw new StorageError("OIDC device authorization failed");
+        const session = validateDeviceAuthorizationSession(body);
+        ensureOidcNotCancelled(signal, "device authorization");
+        // Keep the requested device binding attached to this in-memory session
+        // without changing the RFC response shape or serializing it into logs.
+        deviceAuthorizationDeviceIds.set(session, deviceId);
+        return session;
+    }
+    catch (err) {
+        throw new StorageError(formatProviderFailure("device authorization", err));
+    }
 }
 /**
  * Polls the token endpoint until the device-code session is approved (or
  * denied/expired) — see matrix-js-sdk's `waitForDeviceAuthorization` for the
  * RFC 8628 polling semantics (honours `interval`/`expires_in`,
- * `authorization_pending`/`slow_down`).
+ * `authorization_pending`/`slow_down`). Sessions returned by
+ * startDeviceCodeLogin carry their binding in memory; reconstructed sessions
+ * must provide expectedDeviceId and are rejected before polling when no
+ * binding is available.
  */
-export async function waitForDeviceCodeLogin(authMetadata, clientId, session) {
-    return waitForDeviceAuthorization({ session, metadata: authMetadata, clientId });
+export async function waitForDeviceCodeLogin(authMetadata, clientId, session, signal, expectedDeviceId) {
+    try {
+        if (signal?.aborted)
+            throw new OidcRequestCancelledError("device authorization");
+        const safeAuthMetadata = validateTrustedAuthMetadata(authMetadata);
+        const safeClientId = requireClientId(clientId);
+        const safeSession = validateDeviceAuthorizationSession(session);
+        const requestedDeviceId = expectedDeviceId ?? deviceAuthorizationDeviceIds.get(session);
+        if (requestedDeviceId === undefined) {
+            throw new StorageError("OIDC device authorization requires an expected device ID");
+        }
+        requireString(requestedDeviceId, "device ID", DEVICE_ID_PATTERN);
+        const endpoint = exactEndpoint(safeAuthMetadata.token_endpoint, "token endpoint");
+        let interval = (safeSession.interval ?? 5) * 1000;
+        const expiration = Date.now() + Math.min(safeSession.expires_in * 1000, MAX_DEVICE_POLL_DURATION_MS);
+        do {
+            const remaining = expiration - Date.now();
+            if (remaining <= 0) {
+                ensureOidcNotCancelled(signal, "device authorization");
+                return { error: "expired" };
+            }
+            const { response, body } = await requestWithTimeout(endpoint, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({
+                    device_code: safeSession.device_code,
+                    grant_type: OAuthGrantType.DeviceAuthorization,
+                    client_id: safeClientId,
+                }).toString(),
+                redirect: "manual",
+            }, "device authorization", async (response, requestSignal) => {
+                assertNoRedirect(response, endpoint, "device authorization");
+                return {
+                    response,
+                    body: await readBoundedJsonResponse(response, "device authorization", requestSignal),
+                };
+            }, Math.min(OIDC_REQUEST_TIMEOUT_MS, remaining), signal);
+            if (response.ok && isValidDeviceAccessTokenResponse(body)) {
+                const tokenResponse = validateDeviceAccessTokenResponse(body);
+                if (!requestedDeviceId || tokenResponse.scope !== generateScope(requestedDeviceId)) {
+                    throw new OidcValidationError("OIDC device authorization returned an unexpected granted scope");
+                }
+                ensureOidcNotCancelled(signal, "device authorization");
+                return tokenResponse;
+            }
+            const error = isRecord(body) && typeof body.error === "string" ? body.error : undefined;
+            switch (error) {
+                case "authorization_pending":
+                    break;
+                case "slow_down":
+                    interval += 5000;
+                    break;
+                case "access_denied":
+                case "expired_token":
+                    ensureOidcNotCancelled(signal, "device authorization");
+                    return { error: SAFE_OAUTH_ERROR_CODES.has(error) ? error : "provider_error" };
+                default:
+                    ensureOidcNotCancelled(signal, "device authorization");
+                    return { error: "provider_error" };
+            }
+            await abortableDelay(Math.min(interval, Math.max(0, expiration - Date.now())), signal);
+        } while (Date.now() < expiration);
+        ensureOidcNotCancelled(signal, "device authorization");
+        return { error: "expired" };
+    }
+    catch (err) {
+        if (err instanceof OidcValidationError)
+            throw err;
+        throw new StorageError(formatProviderFailure("device authorization", err));
+    }
 }
 export function isDeviceAccessTokenError(result) {
     return typeof result.error === "string";
 }
 // ---------------------------------------------------------------------------
 // Authorization code + PKCE — the web UI's login flow. Browser-only when
-// actually called (uses window.crypto/window.sessionStorage internally via
-// oidc-client-ts) — never called from the CLI.
+// actually called because its one-time context is held in sessionStorage —
+// never called from the CLI.
 // ---------------------------------------------------------------------------
 /**
- * Builds the authorization URL to redirect the browser to. PKCE
- * verifier/state/nonce are generated and persisted to `window.sessionStorage`
- * internally by matrix-js-sdk/oidc-client-ts (`mx_oidc_`-prefixed keys) — the
- * caller does not need to manage them; `completeAuthorizationCodeFlow` reads
- * them back after the redirect.
- *
- * `deviceId` is optional: when supplied, it is embedded in the requested
- * scope (MSC2967) so MAS grants THAT device instead of minting a fresh one —
- * the web UI passes a stable per-browser device id so repeated logins reuse
- * the same Matrix device instead of accumulating one device per login.
+ * Builds the authorization URL to redirect the browser to. The Matrix 42
+ * OAuth2 helper owns PKCE challenge generation and URL construction; this
+ * SDK owns only the minimal context needed to recreate that helper after the
+ * redirect. The context is keyed by a one-time random state in sessionStorage.
  */
 export async function beginAuthorizationCodeFlow(opts) {
-    const nonce = crypto.randomUUID();
-    if (opts.deviceId) {
-        // matrix-js-sdk's generateOidcAuthorizationUrl hardcodes
-        // generateScope() with no device id, so every login would mint a fresh
-        // Matrix device. Build the URL ourselves with the stable device id in
-        // the requested scope (MSC2967) so MAS grants THAT device — mirroring
-        // matrix-js-sdk's construction exactly (same state store, same user
-        // state shape) so completeAuthorizationCodeFlow still works unchanged.
-        const scope = generateScope(opts.deviceId);
-        const oidcClient = new OidcClient({
-            ...opts.authMetadata,
-            signingKeys: opts.authMetadata.signingKeys ?? undefined,
-            metadata: opts.authMetadata,
-            client_id: opts.clientId,
-            redirect_uri: opts.redirectUri,
-            authority: opts.authMetadata.issuer,
-            response_mode: "query",
-            response_type: "code",
-            scope,
-            stateStore: new WebStorageStateStore({ prefix: "mx_oidc_", store: window.sessionStorage }),
-        });
-        const userState = { homeserverUrl: opts.homeserverUrl, nonce };
-        const request = await oidcClient.createSigninRequest({
-            state: userState,
-            nonce,
-        });
-        return request.url;
-    }
-    return generateOidcAuthorizationUrl({
-        metadata: opts.authMetadata,
+    if (opts.signal?.aborted)
+        throw new StorageError("OIDC authorization cancelled");
+    const { authMetadata, homeserver, redirect, deviceId } = validateAuthorizationInputs(opts);
+    const createdAtMs = Date.now();
+    const state = randomHex(32);
+    const codeVerifier = randomHex(64);
+    const oauth = new OAuth2(authMetadata, {
         clientId: opts.clientId,
-        homeserverUrl: opts.homeserverUrl,
-        redirectUri: opts.redirectUri,
-        nonce,
+        deviceId,
+        codeVerifier,
+        redirectUri: redirect.toString(),
     });
+    const url = await oauth.generateAuthorizationCodeGrantUrl(state, "query");
+    if (opts.signal?.aborted)
+        throw new StorageError("OIDC authorization cancelled");
+    let generated;
+    try {
+        generated = new URL(url);
+    }
+    catch {
+        throw new StorageError("OIDC authorization URL is invalid");
+    }
+    const expectedEndpoint = parseHttpUrl(authMetadata.authorization_endpoint, "authorization endpoint");
+    const stateValues = generated.searchParams.getAll("state");
+    if (generated.origin !== expectedEndpoint.origin ||
+        generated.pathname !== expectedEndpoint.pathname ||
+        generated.username !== "" ||
+        generated.password !== "" ||
+        generated.hash !== "" ||
+        stateValues.length !== 1 ||
+        stateValues[0] !== state ||
+        generated.searchParams.getAll("redirect_uri").length !== 1 ||
+        generated.searchParams.get("redirect_uri") !== redirect.toString()) {
+        throw new StorageError("OIDC authorization URL is not bound to the validated request");
+    }
+    const context = {
+        version: AUTHORIZATION_CONTEXT_VERSION,
+        createdAtMs,
+        state,
+        authMetadata,
+        clientId: opts.clientId,
+        redirectUri: redirect.toString(),
+        homeserverUrl: homeserver.toString(),
+        deviceId,
+        codeVerifier,
+    };
+    sessionStorage().setItem(`${AUTHORIZATION_CONTEXT_PREFIX}${state}`, JSON.stringify(context));
+    return url;
 }
 /** Completes the authorization-code exchange after the `?code&state` redirect. */
-export async function completeAuthorizationCodeFlow(code, state) {
-    return completeAuthorizationCodeGrant(code, state);
+export async function completeAuthorizationCodeFlow(code, state, signal) {
+    requireString(state, "authorization state", STATE_PATTERN);
+    const store = sessionStorage();
+    const key = `${AUTHORIZATION_CONTEXT_PREFIX}${state}`;
+    const serialized = store.getItem(key);
+    if (!serialized)
+        throw new StorageError("OIDC authorization context is missing or expired");
+    if (serialized.length > MAX_AUTHORIZATION_CONTEXT_LENGTH) {
+        store.removeItem(key);
+        throw new StorageError("OIDC authorization context is too large");
+    }
+    let context;
+    try {
+        context = parseAuthorizationContext(JSON.parse(serialized), state);
+    }
+    catch (error) {
+        if (error instanceof StorageError)
+            throw error;
+        throw new StorageError("OIDC authorization context is missing or invalid");
+    }
+    finally {
+        // Consume the state before any network exchange. A retry must not replay
+        // the authorization code, even if the exchange fails.
+        store.removeItem(key);
+    }
+    try {
+        requireBoundedString(code, "authorization code", MAX_OIDC_CODE_LENGTH);
+        const endpoint = exactEndpoint(context.authMetadata.token_endpoint, "token endpoint");
+        const params = new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: context.clientId,
+            code_verifier: context.codeVerifier,
+            redirect_uri: context.redirectUri,
+            code,
+        });
+        const { response, body } = await requestWithTimeout(endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+            body: params.toString(),
+            redirect: "manual",
+        }, "authorization code exchange", async (response, requestSignal) => {
+            assertNoRedirect(response, endpoint, "authorization code exchange");
+            return {
+                response,
+                body: await readBoundedJsonResponse(response, "authorization code exchange", requestSignal),
+            };
+        }, OIDC_REQUEST_TIMEOUT_MS, signal);
+        if (!response.ok)
+            throw new StorageError("OIDC authorization code exchange failed");
+        validateBearerTokenResponse(body);
+        validateTokenBounds(body, "authorization code exchange");
+        const normalized = normalizeBearerTokenResponseTokenType(body);
+        const expectedScope = generateScope(context.deviceId);
+        const grantedScope = normalized.scope;
+        if (typeof grantedScope !== "string" || grantedScope !== expectedScope) {
+            throw new StorageError("OIDC authorization code exchange returned an unexpected granted scope");
+        }
+        const tokenResponse = {
+            ...normalized,
+            scope: grantedScope,
+        };
+        ensureOidcNotCancelled(signal, "authorization code exchange");
+        return {
+            tokenResponse,
+            oidcClientSettings: { clientId: context.clientId, issuer: context.authMetadata.issuer },
+            homeserverUrl: context.homeserverUrl,
+        };
+    }
+    catch (err) {
+        if (err instanceof StorageError)
+            throw err;
+        throw new StorageError(formatProviderFailure("authorization code exchange", err));
+    }
 }
 // ---------------------------------------------------------------------------
 // Shared helpers
 // ---------------------------------------------------------------------------
-/** The device_id granted is embedded in the token response's `scope`
- * (`urn:matrix:org.matrix.msc2967.client:device:<id>`), per MSC2967 — the
- * authorization-code flow doesn't return it any other way (the SDK
- * auto-generates it when the caller doesn't request a specific one). */
+/** The device_id granted is embedded in the token response's stable Matrix
+ * OAuth scope. */
 export function extractDeviceIdFromScope(scope) {
-    const match = scope.match(/urn:matrix:org\.matrix\.msc2967\.client:device:(\S+)/);
-    return match ? match[1] : null;
+    if (typeof scope !== "string" ||
+        scope.length > MAX_OIDC_SCOPE_LENGTH ||
+        /[\u0000-\u001f\u007f]/.test(scope) ||
+        scope.trim() !== scope) {
+        return null;
+    }
+    const tokens = scope.split(/\s+/);
+    const deviceTokens = tokens.filter((token) => token.startsWith("urn:matrix:client:device:"));
+    if (deviceTokens.length !== 1)
+        return null;
+    const deviceId = deviceTokens[0].slice("urn:matrix:client:device:".length);
+    return DEVICE_ID_PATTERN.test(deviceId) ? deviceId : null;
+}
+function validateMatrixUserId(userId, serverName) {
+    try {
+        return validateCanonicalMatrixUserId(userId, serverName);
+    }
+    catch {
+        throw new StorageError("OIDC identity confirmation returned an invalid or foreign user ID");
+    }
 }
 /** Confirms {userId, deviceId} for a freshly-obtained access token via
  * `GET /_matrix/client/v3/account/whoami` — needed because neither the
  * device-code nor authorization-code token response includes the Matrix
  * user ID. */
-export async function whoAmI(homeserverUrl, accessToken) {
-    const client = createClient({ baseUrl: homeserverUrl, accessToken });
-    const res = await client.whoami();
-    return { userId: res.user_id, deviceId: res.device_id ?? null };
+export async function whoAmI(homeserverUrl, accessToken, serverName, signal) {
+    try {
+        const homeserver = parseHttpUrl(homeserverUrl, "homeserver URL");
+        const baseUrl = homeserver.toString();
+        requireBoundedString(accessToken, "access token", MAX_OIDC_TOKEN_LENGTH);
+        const client = createClient({
+            baseUrl,
+            accessToken,
+            localTimeoutMs: OIDC_REQUEST_TIMEOUT_MS,
+            fetchFn: boundedMatrixFetch("identity confirmation", signal),
+        });
+        const res = await client.whoami();
+        const userId = validateMatrixUserId(res?.user_id, serverName);
+        if (res.device_id !== undefined && res.device_id !== null) {
+            try {
+                validateMatrixDeviceId(res.device_id);
+            }
+            catch {
+                throw new StorageError("OIDC identity confirmation returned an invalid device ID");
+            }
+        }
+        if (signal?.aborted)
+            throw new OidcRequestCancelledError("identity confirmation");
+        return { userId, deviceId: res.device_id ?? null };
+    }
+    catch (err) {
+        if (signal?.aborted) {
+            throw new StorageError("OIDC identity confirmation cancelled");
+        }
+        if (err instanceof StorageError)
+            throw err;
+        throw new StorageError(formatProviderFailure("identity confirmation", err));
+    }
 }
 /**
  * Refreshes an access token via a plain RFC 6749 `grant_type=refresh_token`
- * POST to the token endpoint — deliberately NOT matrix-js-sdk's
- * `OidcTokenRefresher`/oidc-client-ts, which unconditionally construct an
- * internal `OidcClient` requiring `window.sessionStorage`/`window.
- * localStorage` even though a plain refresh never actually reads or writes
- * them (confirmed by direct testing: `ReferenceError: window is not
- * defined` under plain Node; see test/functional/oidc.test.ts O.2). A public client (`token_endpoint_auth_method:
+ * POST to the token endpoint. A public client (`token_endpoint_auth_method:
  * "none"`, what `registerClient` above registers) authenticates a refresh
- * with just `client_id` in the body, no secret — this is the whole request.
- * Works identically in Node and the browser (plain `fetch`), so both
- * adapters share it with zero platform-specific code.
+ * with just `client_id` in the body, no secret. This narrow request remains
+ * local because Matrix 42's `OAuth2.performRefreshTokenGrant` parses every
+ * non-success body with unbounded `response.json()`; this path bounds the
+ * body and exposes only an allowlisted OAuth error code.
  */
-export async function refreshOidcToken(tokenEndpoint, clientId, refreshToken) {
-    const res = await fetch(tokenEndpoint, {
+async function refreshOidcToken(tokenEndpoint, clientId, refreshToken, expectedDeviceId, signal) {
+    const endpoint = exactEndpoint(tokenEndpoint, "token endpoint");
+    const safeClientId = requireClientId(clientId);
+    const safeRefreshToken = requireBoundedString(refreshToken, "refresh token", MAX_OIDC_TOKEN_LENGTH);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), OIDC_REFRESH_TIMEOUT_MS);
+    const abortExternal = () => controller.abort(signal?.reason);
+    if (signal?.aborted)
+        abortExternal();
+    else
+        signal?.addEventListener("abort", abortExternal, { once: true });
+    try {
+        const res = await raceWithAbort(fetch(endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                refresh_token: safeRefreshToken,
+                client_id: safeClientId,
+            }).toString(),
+            signal: controller.signal,
+            redirect: "manual",
+        }), controller.signal, () => undefined, () => signal?.aborted
+            ? new StorageError("OIDC token refresh cancelled")
+            : new StorageError("OIDC token refresh timed out"));
+        assertNoRedirect(res, endpoint, "token refresh");
+        if (!res.ok) {
+            let body;
+            try {
+                body = await readBoundedResponseText(res, MAX_OAUTH_ERROR_BODY_BYTES, controller.signal);
+            }
+            catch (error) {
+                if (signal?.aborted || controller.signal.aborted)
+                    throw error;
+                body = { text: "", truncated: false };
+            }
+            throw new StorageError(formatTokenRefreshFailure(res.status, body));
+        }
+        const body = await readBoundedResponseText(res, MAX_OAUTH_SUCCESS_BODY_BYTES, controller.signal);
+        if (body.truncated) {
+            throw new StorageError("OIDC token refresh returned an oversized response");
+        }
+        let data;
+        try {
+            data = JSON.parse(body.text);
+        }
+        catch {
+            throw new StorageError("OIDC token refresh returned an invalid response");
+        }
+        if (!data || typeof data !== "object") {
+            throw new StorageError("OIDC token refresh returned an invalid response");
+        }
+        const record = data;
+        const accessToken = record.access_token;
+        const nextRefreshToken = record.refresh_token;
+        const grantedScope = record.scope;
+        const expiresIn = record.expires_in;
+        if (typeof accessToken !== "string" ||
+            accessToken.trim() === "" ||
+            accessToken.length > MAX_OIDC_TOKEN_LENGTH ||
+            /[\s\u0000-\u001f\u007f]/.test(accessToken)) {
+            throw new StorageError("OIDC token refresh returned no access token");
+        }
+        const tokenType = record.token_type;
+        if (typeof tokenType !== "string" || tokenType.toLowerCase() !== "bearer") {
+            throw new StorageError("OIDC token refresh returned an invalid token type");
+        }
+        if (nextRefreshToken !== undefined &&
+            (typeof nextRefreshToken !== "string" ||
+                nextRefreshToken.trim() === "" ||
+                nextRefreshToken.length > MAX_OIDC_TOKEN_LENGTH ||
+                /[\s\u0000-\u001f\u007f]/.test(nextRefreshToken))) {
+            throw new StorageError("OIDC token refresh returned an invalid refresh token");
+        }
+        if (grantedScope !== undefined) {
+            if (typeof grantedScope !== "string") {
+                throw new StorageError("OIDC token refresh returned an invalid scope");
+            }
+            try {
+                requireScope(grantedScope, "scope");
+            }
+            catch {
+                throw new StorageError("OIDC token refresh returned an invalid scope");
+            }
+            if (extractDeviceIdFromScope(grantedScope) === null ||
+                grantedScope !== generateScope(expectedDeviceId)) {
+                throw new StorageError("OIDC token refresh returned an unexpected granted scope");
+            }
+        }
+        else {
+            throw new StorageError("OIDC token refresh returned no device-bound scope");
+        }
+        if (expiresIn !== undefined &&
+            (typeof expiresIn !== "number" ||
+                !Number.isInteger(expiresIn) ||
+                expiresIn < 0 ||
+                expiresIn > 86400)) {
+            throw new StorageError("OIDC token refresh returned an invalid expiry");
+        }
+        ensureOidcNotCancelled(signal, "token refresh");
+        return {
+            accessToken,
+            // RFC 6749 permits the provider to omit refresh_token when it remains
+            // valid. Preserve the token that authorized this grant in that case.
+            refreshToken: nextRefreshToken === undefined ? safeRefreshToken : nextRefreshToken,
+            expiry: expiresIn === undefined
+                ? undefined
+                : new Date(Date.now() + expiresIn * 1000),
+        };
+    }
+    catch (error) {
+        if (error instanceof StorageError)
+            throw error;
+        if (signal?.aborted) {
+            throw new StorageError("OIDC token refresh cancelled");
+        }
+        if (controller.signal.aborted) {
+            throw new StorageError("OIDC token refresh timed out");
+        }
+        throw new StorageError("OIDC token refresh failed");
+    }
+    finally {
+        clearTimeout(timeout);
+        signal?.removeEventListener("abort", abortExternal);
+    }
+}
+/** Revokes a token after a caller-side session commit fails or becomes stale. */
+async function revokeOidcToken(revocationEndpoint, clientId, token, tokenTypeHint = "access_token", signal) {
+    const endpoint = exactEndpoint(revocationEndpoint, "revocation endpoint");
+    const safeClientId = requireClientId(clientId);
+    const safeToken = requireBoundedString(token, "token", MAX_OIDC_TOKEN_LENGTH);
+    const { response } = await requestWithTimeout(endpoint, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
-            grant_type: "refresh_token",
-            refresh_token: refreshToken,
-            client_id: clientId,
+            client_id: safeClientId,
+            token: safeToken,
+            token_type_hint: tokenTypeHint,
         }).toString(),
-    });
-    if (!res.ok) {
-        const body = await res.text();
-        throw new StorageError(`OIDC token refresh failed (${res.status}): ${body}`);
-    }
-    const data = await res.json();
-    if (!data || typeof data !== "object") {
-        throw new StorageError("OIDC token refresh returned an invalid response");
-    }
-    const record = data;
-    const accessToken = record.access_token;
-    const nextRefreshToken = record.refresh_token;
-    const expiresIn = record.expires_in;
-    if (typeof accessToken !== "string" || accessToken.trim() === "") {
-        throw new StorageError("OIDC token refresh returned no access token");
+        redirect: "manual",
+    }, "token revocation", async (res, requestSignal) => {
+        assertNoRedirect(res, endpoint, "token revocation");
+        if (!res.ok) {
+            await readBoundedResponseText(res, MAX_OAUTH_ERROR_BODY_BYTES, requestSignal);
+        }
+        else {
+            await readBoundedResponseText(res, MAX_OAUTH_SUCCESS_BODY_BYTES, requestSignal);
+        }
+        return { response: res };
+    }, OIDC_REQUEST_TIMEOUT_MS, signal);
+    if (!response.ok)
+        throw new StorageError("OIDC token revocation failed");
+}
+async function persistOidcTokens(onPersist, tokens, externalSignal) {
+    if (externalSignal?.aborted)
+        throw new OidcRequestCancelledError("token persistence");
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, OIDC_REFRESH_TIMEOUT_MS);
+    const abortExternal = () => controller.abort(externalSignal?.reason);
+    if (externalSignal?.aborted)
+        abortExternal();
+    else
+        externalSignal?.addEventListener("abort", abortExternal, { once: true });
+    try {
+        // Promise.resolve().then() also observes synchronous callback throws and
+        // lets raceWithAbort attach a rejection handler before a late adapter
+        // rejection can become unhandled after the bounded call has settled.
+        await raceWithAbort(Promise.resolve().then(() => onPersist(tokens, controller.signal)), controller.signal, () => undefined, () => timedOut
+            ? new OidcRequestTimeoutError("token persistence")
+            : new OidcRequestCancelledError("token persistence"));
+        // The persistence promise and the caller signal can settle in either
+        // order. Never report success from the narrow window where persistence
+        // won the promise race but the caller has already cancelled.
+        if (externalSignal?.aborted)
+            throw new OidcRequestCancelledError("token persistence");
     }
-    if (nextRefreshToken !== undefined &&
-        (typeof nextRefreshToken !== "string" || nextRefreshToken.trim() === "")) {
-        throw new StorageError("OIDC token refresh returned an invalid refresh token");
+    catch (error) {
+        if (timedOut)
+            throw new OidcRequestTimeoutError("token persistence");
+        if (externalSignal?.aborted)
+            throw new OidcRequestCancelledError("token persistence");
+        throw error;
     }
-    if (expiresIn !== undefined &&
-        (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn < 0)) {
-        throw new StorageError("OIDC token refresh returned an invalid expiry");
+    finally {
+        clearTimeout(timeout);
+        externalSignal?.removeEventListener("abort", abortExternal);
     }
-    return {
-        accessToken,
-        refreshToken: nextRefreshToken,
-        expiry: expiresIn === undefined
-            ? undefined
-            : new Date(Date.now() + expiresIn * 1000),
-    };
+}
+function createOidcCleanupSignal() {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), OIDC_CLEANUP_TIMEOUT_MS);
+    return { signal: controller.signal, close: () => clearTimeout(timeout) };
 }
 /**
  * Builds the `tokenRefreshFunction` `TeleCryptIOStorage.createFromOidc`
- * expects: refreshes via `refreshOidcToken`, then calls `onPersist` with the
- * new tokens before returning them — so a caller's adapter-specific
+ * expects: refreshes via the internal OAuth request, then calls `onPersist`
+ * with the new tokens before returning them — so a caller's adapter-specific
  * persistence (CLI: profile file; UI: localStorage) always sees a refresh
  * that just happened, not just ones it initiated itself.
  */
-export function buildTokenRefreshFunction(tokenEndpoint, clientId, onPersist) {
-    return async (refreshToken) => {
-        const tokens = await refreshOidcToken(tokenEndpoint, clientId, refreshToken);
-        await onPersist({ accessToken: tokens.accessToken, refreshToken: tokens.refreshToken });
+export function buildTokenRefreshFunction(metadata, clientId, onPersist, expectedDeviceId) {
+    // Store canonical endpoints bound to the same validated issuer for the
+    // lifetime of this callback. Callers cannot provide an arbitrary HTTPS
+    // endpoint and cause a refresh or revocation token to leave that issuer.
+    const { tokenEndpoint: endpoint, revocationEndpoint } = validateTokenEndpointMetadata(metadata);
+    const safeClientId = requireClientId(clientId);
+    const safeExpectedDeviceId = requireString(expectedDeviceId, "device ID", DEVICE_ID_PATTERN);
+    return async (refreshToken, signal) => {
+        const tokens = await refreshOidcToken(endpoint, safeClientId, refreshToken, safeExpectedDeviceId, signal);
+        try {
+            await persistOidcTokens(onPersist, { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken }, signal);
+        }
+        catch {
+            if (revocationEndpoint) {
+                // Cleanup must remain possible even when the caller's signal is
+                // already aborted. Use a separate bounded signal so persistence
+                // failure cannot strand freshly-issued tokens merely because the
+                // original request was cancelled.
+                const cleanup = createOidcCleanupSignal();
+                try {
+                    await revokeOidcToken(revocationEndpoint, safeClientId, tokens.accessToken, "access_token", cleanup.signal);
+                    if (tokens.refreshToken) {
+                        await revokeOidcToken(revocationEndpoint, safeClientId, tokens.refreshToken, "refresh_token", cleanup.signal);
+                    }
+                }
+                catch {
+                    cleanup.close();
+                    throw new StorageError("OIDC token persistence failed and session cleanup was incomplete");
+                }
+                cleanup.close();
+            }
+            throw new StorageError("OIDC token persistence failed; discard the refreshed session");
+        }
+        ensureOidcNotCancelled(signal, "token refresh");
         return tokens;
     };
 }