alepha 0.22.0 → 0.24.0

package/dist/api/oauth/index.d.ts

@@ -1,7 +1,7 @@
 import { Alepha, Static } from "alepha";
-import { DateTimeProvider } from "alepha/datetime";
 import { IssuerPrimitive, JwtProvider, UserAccount } from "alepha/security";
-
+import { CryptoProvider } from "alepha/crypto";
+import { DateTimeProvider } from "alepha/datetime";
 //#region ../../src/api/oauth/entities/oauthClientEntity.d.ts
 /**
  * A registered OAuth 2.1 client application.
@@ -11,28 +11,56 @@ import { IssuerPrimitive, JwtProvider, UserAccount } from "alepha/security";
  * client; for DCR it is always `"dcr"` and `createdByUserId` is null until
  * a user completes an authorization.
  */
-declare const oauthClientEntity: import("alepha/orm").EntityPrimitive<import("typebox").TObject<{
-  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-  clientId: import("typebox").TString;
-  clientName: import("typebox").TString;
-  redirectUris: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
-  scopes: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
-  realm: import("typebox").TString;
-  source: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_DEFAULT>;
-  createdByUserId: import("typebox").TOptional<import("typebox").TString>;
-  lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
-  revokedAt: import("typebox").TOptional<import("typebox").TString>;
-}>>;
+declare const oauthClientEntity: import("alepha/orm").EntityPrimitive<import("zod").ZodObject<{
+  id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+  createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+  clientId: import("zod").ZodString;
+  clientName: import("zod").ZodString;
+  redirectUris: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
+  scopes: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
+  realm: import("zod").ZodString;
+  type: import("alepha/orm").PgAttr<import("zod").ZodEnum<{
+    confidential: "confidential";
+    public: "public";
+  }>, typeof import("alepha/orm").PG_DEFAULT>;
+  trusted: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+  clientSecretHash: import("zod").ZodOptional<import("zod").ZodString>;
+  source: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_DEFAULT>;
+  createdByUserId: import("zod").ZodOptional<import("zod").ZodString>;
+  lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+  revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>>;
 type OAuthClientEntity = Static<typeof oauthClientEntity.schema>;
 //#endregion
 //#region ../../src/api/oauth/services/OAuthClientService.d.ts
+/**
+ * The user projection a realm's `loadUser` hands to the OAuth module —
+ * a `UserAccount` plus the OIDC profile extras the id_token mints
+ * (`email_verified`; `firstName`/`lastName` map to `given_name`/`family_name`).
+ */
+interface OidcIssuerUser extends UserAccount {
+  emailVerified?: boolean;
+}
 interface RegisterClientOptions {
   realm: string;
-  clientName: string;
+  /**
+   * Explicit client id (OIDC clients registered by Platform). When omitted,
+   * a `mcp_<uuid>` id is generated (Dynamic Client Registration).
+   */
+  clientId?: string;
+  clientName?: string;
   redirectUris: string[];
-  scopes: string[];
+  scopes?: string[];
+  /**
+   * `confidential` clients require a `secret` (stored hashed) and authenticate
+   * at the token endpoint. Defaults to `public` (PKCE only).
+   */
+  type?: "public" | "confidential";
+  /** First-party client — skip the consent screen (see the entity field). */
+  trusted?: boolean;
+  /** Raw secret for a confidential client; stored as a scrypt hash. */
+  secret?: string;
   source?: "dcr" | "user" | "admin";
   createdByUserId?: string;
 }
@@ -52,21 +80,28 @@ declare class OAuthClientService {
   protected readonly alepha: Alepha;
   protected readonly dateTime: DateTimeProvider;
   protected readonly log: import("alepha/logger").Logger;
-  protected readonly repo: import("alepha/orm").Repository<import("typebox").TObject<{
-    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
-    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
-    clientId: import("typebox").TString;
-    clientName: import("typebox").TString;
-    redirectUris: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
-    scopes: import("alepha/orm").PgAttr<import("typebox").TArray<import("typebox").TString>, typeof import("alepha/orm").PG_DEFAULT>;
-    realm: import("typebox").TString;
-    source: import("alepha/orm").PgAttr<import("typebox").TString, typeof import("alepha/orm").PG_DEFAULT>;
-    createdByUserId: import("typebox").TOptional<import("typebox").TString>;
-    lastUsedAt: import("typebox").TOptional<import("typebox").TString>;
-    revokedAt: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
+  protected readonly repo: import("alepha/orm").Repository<import("zod").ZodObject<{
+    id: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_PRIMARY_KEY>, typeof import("alepha/orm").PG_DEFAULT>;
+    createdAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_CREATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    updatedAt: import("alepha/orm").PgAttr<import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_UPDATED_AT>, typeof import("alepha/orm").PG_DEFAULT>;
+    clientId: import("zod").ZodString;
+    clientName: import("zod").ZodString;
+    redirectUris: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
+    scopes: import("alepha/orm").PgAttr<import("zod").ZodArray<import("zod").ZodString>, typeof import("alepha/orm").PG_DEFAULT>;
+    realm: import("zod").ZodString;
+    type: import("alepha/orm").PgAttr<import("zod").ZodEnum<{
+      confidential: "confidential";
+      public: "public";
+    }>, typeof import("alepha/orm").PG_DEFAULT>;
+    trusted: import("alepha/orm").PgAttr<import("zod").ZodBoolean, typeof import("alepha/orm").PG_DEFAULT>;
+    clientSecretHash: import("zod").ZodOptional<import("zod").ZodString>;
+    source: import("alepha/orm").PgAttr<import("zod").ZodString, typeof import("alepha/orm").PG_DEFAULT>;
+    createdByUserId: import("zod").ZodOptional<import("zod").ZodString>;
+    lastUsedAt: import("zod").ZodOptional<import("zod").ZodString>;
+    revokedAt: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
   protected readonly jwt: JwtProvider;
+  protected readonly crypto: CryptoProvider;
   /**
    * Codes already redeemed in this process. Single-use enforcement only
    * needs to cover the ~60s code lifetime, so a bounded in-memory set is
@@ -81,13 +116,13 @@ declare class OAuthClientService {
    */
   protected readonly issuers: Map<string, {
     issuer: IssuerPrimitive;
-    loadUser: (userId: string) => Promise<UserAccount>;
+    loadUser: (userId: string) => Promise<OidcIssuerUser>;
   }>;
   /**
    * Register a realm issuer and a user loader. Called by `$realm` so the
    * OAuth token endpoint can mint access tokens for that realm.
    */
-  registerIssuer(realm: string, issuer: IssuerPrimitive, loadUser: (userId: string) => Promise<UserAccount>): void;
+  registerIssuer(realm: string, issuer: IssuerPrimitive, loadUser: (userId: string) => Promise<OidcIssuerUser>): void;
   /**
    * Mint an access token for a consumed authorization-code grant, using the
    * issuer registered for `realm`. Throws if the realm has no issuer.
@@ -102,6 +137,19 @@ declare class OAuthClientService {
     expires_in?: number;
     refresh_token?: string;
   }>;
+  /**
+   * Mint an OIDC `id_token` for a consumed grant, signed by the realm's issuer
+   * key (asymmetric when configured). Claims: iss, sub, aud (client_id), exp,
+   * iat, nonce (when present), plus the standard profile claims the loader
+   * provides: email, email_verified, name, given_name, family_name,
+   * preferred_username, picture.
+   */
+  issueIdToken(realm: string, params: {
+    userId: string;
+    clientId: string;
+    issuer: string;
+    nonce?: string;
+  }): Promise<string>;
   /**
    * Exchange a refresh token for a fresh access token (OAuth 2.1
    * `refresh_token` grant), using the issuer registered for `realm`. Lets an
@@ -113,21 +161,55 @@ declare class OAuthClientService {
     access_token: string;
     expires_in?: number;
     refresh_token?: string;
+    /** Subject of the refreshed session — lets the token endpoint re-mint an
+     * OIDC `id_token` for relying parties that forward it as the Bearer. */
+    userId: string;
   }>;
   /**
    * Register a new OAuth client. Used by the RFC 7591 DCR endpoint and,
    * later, by user/admin UIs (via the `source` field).
    */
   register(options: RegisterClientOptions): Promise<OAuthClientEntity>;
+  /**
+   * Idempotently align a registered client's redirect_uri allowlist with the
+   * given list. No-op when the client is unknown or the list already matches —
+   * safe to call from post-deploy seeders (allowlist changes ship as code, and
+   * `register` alone would leave existing rows stale).
+   */
+  updateRedirectUris(clientId: string, redirectUris: string[]): Promise<void>;
+  /**
+   * Verify a confidential client's secret against its stored scrypt hash.
+   * Returns false for unknown/revoked/public (no-hash) clients.
+   */
+  verifySecret(clientId: string, secret: string): Promise<boolean>;
+  /**
+   * Validate a registered redirect_uri. https (or http://localhost) only, and
+   * at most a single `*` which must live inside the host (see
+   * `redirectUriMatches` for the matching rule).
+   */
+  protected assertValidRedirectUri(uri: string): void;
   /**
    * Look up a client by its public `clientId`. Returns null if unknown.
    */
   findByClientId(clientId: string): Promise<OAuthClientEntity | null>;
   /**
-   * Exact-match redirect_uri check. OAuth 2.1 forbids substring/prefix
-   * matching — the value must equal a registered URI byte-for-byte.
+   * Narrow the scopes a client asks for to those it is actually registered
+   * for. The requested scope string is attacker-controlled, so it must never
+   * be trusted verbatim — a client registered for `["mcp"]` that asks for
+   * `mcp admin` must only be granted `mcp`. When nothing (usable) is
+   * requested, the client's full registered set is the default grant.
+   * Requested order is preserved and duplicates are dropped.
+   */
+  intersectScopes(requested: string[] | undefined, allowed: string[]): string[];
+  /**
+   * Redirect_uri check. A registered pattern is matched byte-exact unless it
+   * contains a single `*`, which matches exactly ONE host label (no dots).
+   * E.g. `https://*.alepha.club/auth/callback` matches
+   * `https://b14.alepha.club/auth/callback` but NOT `https://alepha.club/...`
+   * nor `https://a.b.alepha.club/...`.
    */
   isRedirectUriAllowed(client: OAuthClientEntity, redirectUri: string): boolean;
+  protected redirectUriMatches(pattern: string, candidate: string): boolean;
   /**
    * Mint a stateless authorization code: a short-lived signed JWT
    * (`typ: "oauth_code"`) carrying the grant. No server-side code storage.
@@ -139,6 +221,7 @@ declare class OAuthClientService {
     codeChallenge: string;
     scopes: string[];
     resource?: string;
+    nonce?: string;
   }): Promise<string>;
   /**
    * Verify and atomically consume an authorization code. Throws on expiry,
@@ -152,6 +235,7 @@ declare class OAuthClientService {
     userId: string;
     scopes: string[];
     resource?: string;
+    nonce?: string;
   }>;
 }
 //#endregion
@@ -163,11 +247,11 @@ declare class OAuthClientService {
  * `loginPath` is the app-level login page unauthenticated users are
  * redirected to from the authorize endpoint.
  */
-declare const oauthOptions: import("alepha").Atom<import("typebox").TObject<{
-  realm: import("typebox").TString;
-  resource: import("typebox").TString;
-  loginPath: import("typebox").TString;
-}>, "alepha.api.oauth.options">;
+declare const oauthOptions: import("alepha").Atom<import("zod").ZodObject<{
+  realm: import("zod").ZodString;
+  resource: import("zod").ZodString;
+  loginPath: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, "alepha.api.oauth.options">;
 /**
  * OAuth 2.1 authorization server endpoints: discovery metadata and
  * RFC 7591 dynamic client registration. Authorize/token routes are added
@@ -181,20 +265,23 @@ declare class OAuthController {
     loginPath: string;
   }>;
   protected readonly clients: OAuthClientService;
+  protected readonly jwt: JwtProvider;
   /**
    * Absolute origin of the current request, e.g. https://app.com.
    */
   protected baseUrl(url: URL): string;
   metadata: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
   protectedResource: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
+  openidConfiguration: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
+  jwks: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
   register: import("alepha/server").RoutePrimitive<{
-    body: import("typebox").TObject<{
-      client_name: import("typebox").TOptional<import("typebox").TString>;
-      redirect_uris: import("typebox").TArray<import("typebox").TString>;
-      scope: import("typebox").TOptional<import("typebox").TString>;
-      grant_types: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-      token_endpoint_auth_method: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    body: import("zod").ZodObject<{
+      client_name: import("zod").ZodOptional<import("zod").ZodString>;
+      redirect_uris: import("zod").ZodArray<import("zod").ZodString>;
+      scope: import("zod").ZodOptional<import("zod").ZodString>;
+      grant_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+      token_endpoint_auth_method: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * GET /oauth/authorize — OAuth 2.1 authorization request. If the user
@@ -202,16 +289,18 @@ declare class OAuthController {
    * If authenticated, render the consent screen.
    */
   authorize: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      response_type: import("typebox").TString;
-      client_id: import("typebox").TString;
-      redirect_uri: import("typebox").TString;
-      code_challenge: import("typebox").TString;
-      code_challenge_method: import("typebox").TString;
-      scope: import("typebox").TOptional<import("typebox").TString>;
-      state: import("typebox").TOptional<import("typebox").TString>;
-      resource: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      response_type: import("zod").ZodString;
+      client_id: import("zod").ZodString;
+      redirect_uri: import("zod").ZodString;
+      code_challenge: import("zod").ZodString;
+      code_challenge_method: import("zod").ZodString;
+      scope: import("zod").ZodOptional<import("zod").ZodString>;
+      state: import("zod").ZodOptional<import("zod").ZodString>;
+      resource: import("zod").ZodOptional<import("zod").ZodString>;
+      prompt: import("zod").ZodOptional<import("zod").ZodString>;
+      nonce: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * POST /oauth/authorize — consent decision. On "allow", mint an
@@ -224,17 +313,18 @@ declare class OAuthController {
    * attacker cannot redeem it without the matching code_verifier.
    */
   authorizeDecision: import("alepha/server").RoutePrimitive<{
-    body: import("typebox").TObject<{
-      decision: import("typebox").TString;
-      response_type: import("typebox").TString;
-      client_id: import("typebox").TString;
-      redirect_uri: import("typebox").TString;
-      code_challenge: import("typebox").TString;
-      code_challenge_method: import("typebox").TString;
-      scope: import("typebox").TOptional<import("typebox").TString>;
-      state: import("typebox").TOptional<import("typebox").TString>;
-      resource: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    body: import("zod").ZodObject<{
+      decision: import("zod").ZodString;
+      response_type: import("zod").ZodString;
+      client_id: import("zod").ZodString;
+      redirect_uri: import("zod").ZodString;
+      code_challenge: import("zod").ZodString;
+      code_challenge_method: import("zod").ZodString;
+      scope: import("zod").ZodOptional<import("zod").ZodString>;
+      state: import("zod").ZodOptional<import("zod").ZodString>;
+      resource: import("zod").ZodOptional<import("zod").ZodString>;
+      nonce: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * POST /oauth/token — supports the `authorization_code` grant (verifies
@@ -243,17 +333,39 @@ declare class OAuthController {
    * token, so a client stays connected without re-running the flow).
    */
   token: import("alepha/server").RoutePrimitive<{
-    body: import("typebox").TObject<{
-      grant_type: import("typebox").TOptional<import("typebox").TString>;
-      code: import("typebox").TOptional<import("typebox").TString>;
-      client_id: import("typebox").TOptional<import("typebox").TString>;
-      redirect_uri: import("typebox").TOptional<import("typebox").TString>;
-      code_verifier: import("typebox").TOptional<import("typebox").TString>;
-      refresh_token: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    body: import("zod").ZodObject<{
+      grant_type: import("zod").ZodOptional<import("zod").ZodString>;
+      code: import("zod").ZodOptional<import("zod").ZodString>;
+      client_id: import("zod").ZodOptional<import("zod").ZodString>;
+      redirect_uri: import("zod").ZodOptional<import("zod").ZodString>;
+      code_verifier: import("zod").ZodOptional<import("zod").ZodString>;
+      refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+      client_secret: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
 }
 //#endregion
+//#region ../../src/api/oauth/helpers/oidcMetadata.d.ts
+/**
+ * OpenID Connect Discovery 1.0 — provider metadata document
+ * (`/.well-known/openid-configuration`). `baseUrl` is the absolute origin of
+ * the OIDC provider (e.g. https://alepha.club).
+ */
+declare const buildOpenIdConfiguration: (baseUrl: string) => {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  jwks_uri: string;
+  registration_endpoint: string;
+  response_types_supported: string[];
+  grant_types_supported: string[];
+  subject_types_supported: string[];
+  id_token_signing_alg_values_supported: string[];
+  code_challenge_methods_supported: string[];
+  token_endpoint_auth_methods_supported: string[];
+  scopes_supported: string[];
+};
+//#endregion
 //#region ../../src/api/oauth/index.d.ts
 /**
  * OAuth 2.1 authorization server module for MCP.
@@ -278,5 +390,5 @@ declare class OAuthController {
  */
 declare const AlephaOAuth: import("alepha").Service<import("alepha").Module>;
 //#endregion
-export { AlephaOAuth, type OAuthClientEntity, OAuthClientService, OAuthController, type RegisterClientOptions, oauthClientEntity, oauthOptions };
+export { AlephaOAuth, type OAuthClientEntity, OAuthClientService, OAuthController, type RegisterClientOptions, buildOpenIdConfiguration, oauthClientEntity, oauthOptions };
 //# sourceMappingURL=index.d.ts.map

package/dist/api/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/api/oauth/entities/oauthClientEntity.ts","../../../src/api/oauth/services/OAuthClientService.ts","../../../src/api/oauth/controllers/OAuthController.ts","../../../src/api/oauth/index.ts"],"mappings":";;;;;;;;;AAWA;;;;cAAa,iBAAA,uBAAiB,eAAA,mBAAA,OAAA;;;;;;;;;;;;;;KAmBlB,iBAAA,GAAoB,MAAM,QAAQ,iBAAA,CAAkB,MAAA;;;UCf/C,qBAAA;EACf,KAAA;EACA,UAAA;EACA,YAAA;EACA,MAAA;EACA,MAAA;EACA,eAAA;AAAA;;;;;;;;;;;;;cAeW,kBAAA;EAAA,mBACQ,MAAA,EAAM,MAAA;EAAA,mBACN,QAAA,EAAQ,gBAAA;EAAA,mBACR,GAAA,0BAAG,MAAA;EAAA,mBACH,IAAA,uBAAI,UAAA,mBAAA,OAAA;;;;;;;;;;;;;;qBACJ,GAAA,EAAG,WAAA;;;;;;;qBAQH,SAAA,EAAS,GAAA;;;;;;qBAOT,OAAA,EAAO,GAAA;YAGd,eAAA;eACG,MAAA,aAAmB,OAAA,CAAQ,WAAA;EAAA;;AD9B5C;;;ECsCS,cAAA,CACL,KAAA,UACA,MAAA,EAAQ,eAAA,EACR,QAAA,GAAW,MAAA,aAAmB,OAAA,CAAQ,WAAA;EDzCV;;;;ECkDjB,gBAAA,CACX,KAAA,UACA,KAAA;IACE,MAAA;IACA,MAAA;IACA,QAAA;IACA,QAAA;EAAA,IAED,OAAA;IACD,YAAA;IACA,UAAA;IACA,aAAA;EAAA;EAzEF;;;;;AAGe;AAejB;EAiFe,kBAAA,CACX,KAAA,UACA,YAAA,WACC,OAAA;IACD,YAAA;IACA,UAAA;IACA,aAAA;EAAA;EA1E0B;;;;EA4Ff,QAAA,CACX,OAAA,EAAS,qBAAA,GACR,OAAA,CAAQ,iBAAA;EAzED;;;EAwGG,cAAA,CACX,QAAA,WACC,OAAA,CAAQ,iBAAA;EAxDR;;;;EAmEI,oBAAA,CACL,MAAA,EAAQ,iBAAA,EACR,WAAA;EAbC;;;;EAsBU,uBAAA,CACX,KAAA,UACA,KAAA;IACE,MAAA;IACA,QAAA;IACA,WAAA;IACA,aAAA;IACA,MAAA;IACA,QAAA;EAAA,IAED,OAAA;EAxKgB;;;;EA+LN,wBAAA,CACX,KAAA,UACA,IAAA,UACA,KAAA;IAAS,QAAA;IAAkB,WAAA;IAAqB,YAAA;EAAA,IAC/C,OAAA;IAAU,MAAA;IAAgB,MAAA;IAAkB,QAAA;EAAA;AAAA;;;;;;;ADhOjD;;;cEUa,YAAA,mBAAY,IAAA,mBAAA,OAAA;;;;;;;;;;cAgBZ,eAAA;EAAA,mBACQ,GAAA,0BAAG,MAAA;EAAA,mBACH,OAAA,EAAO,QAAA;;;;;qBACP,OAAA,EAAO,kBAAA;;;;YAKhB,OAAA,CAAQ,GAAA,EAAK,GAAA;EAIvB,QAAA,0BAAQ,cAAA,yBAAA,mBAAA;EAWR,iBAAA,0BAAiB,cAAA,yBAAA,mBAAA;EAYjB,QAAA,0BAAQ,cAAA;;;;;;;;;;;;;;EAgCR,SAAA,0BAAS,cAAA;;;;;;;;;;;;;;AF1EX;;;;;;;;EE0IE,iBAAA,0BAAiB,cAAA;;;;;;;;;;;;;EDnJjB;;AAAe;AAejB;;;ECuLE,KAAA,0BAAK,cAAA;;;;;;;;;;;;;AFhNP;;;;;;;;;;;;;;;;;;;;;AAAA,cGuBa,WAAA,mBAAW,OAAA,kBAAA,MAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/api/oauth/entities/oauthClientEntity.ts","../../../src/api/oauth/services/OAuthClientService.ts","../../../src/api/oauth/controllers/OAuthController.ts","../../../src/api/oauth/helpers/oidcMetadata.ts","../../../src/api/oauth/index.ts"],"mappings":";;;;;;;;;;;;;cAWa,wCAAiB,8BAAA;;;;;;;;;;;;;;;;;;;;KAoClB,oBAAoB,cAAc,kBAAkB;;;;;;;;UC1B/C,uBAAuB;EACtC;;UAGe;EACf;;;;;EAKA;EACA;EACA;EACA;;;;;EAKA;;EAEA;;EAEA;EACA;EACA;;;;;;;;;;;;;;cAeW;qBACQ,QAAM;qBACN,UAAQ;qBACR,6BAAG;qBACH,2BAAI,yBAAA;;;;;;;;;;;;;;;;;;;;qBACJ,KAAG;qBACH,QAAM;;;;;;;qBAQN,WAAS;;;;;;qBAOT,SAAO;YAGd;eACG,mBAAmB,QAAQ;;;;;;EAQnC,eACL,eACA,QAAQ,iBACR,WAAW,mBAAmB,QAAQ;;;;;EAS3B,iBACX,eACA;IACE;IACA;IACA;IACA;MAED;IACD;IACA;IACA;;;;;;;;;EA0BW,aACX,eACA;IACE;IACA;IACA;IACA;MAED;;;;;;;;EAsCU,mBACX,eACA,uBACC;IACD;IACA;IACA;;;IAGA;;;;;;EAmBW,SACX,SAAS,wBACR,QAAQ;;;;;;;EA8CE,mBACX,kBACA,yBACC;;;;;EA4BU,aACX,kBACA,iBACC;;;;;;YAaO,uBAAuB;;;;EA2BpB,eACX,mBACC,QAAQ;;;;;;;;;EAeJ,gBACL,iCACA;;;;;;;;EAsBK,qBACL,QAAQ,mBACR;YAOQ,mBAAmB,iBAAiB;;;;;EAejC,wBACX,eACA;IACE;IACA;IACA;IACA;IACA;IACA;IACA;MAED;;;;;EAwBU,yBACX,eACA,cACA;IAAS;IAAkB;IAAqB;MAC/C;IACD;IACA;IACA;IACA;;;;;;;;;;;;cCvaS,+BAAY,mBAAA;;;;;;;;;;cAgBZ;qBACQ,6BAAG;qBACH,SAAO;;;;;qBACP,SAAO;qBACP,KAAG;;;;YAKZ,QAAQ,KAAK;EAIvB,kCAAQ,uCAAA;EAWR,2CAAiB,uCAAA;EAYjB,6CAAmB,uCAAA;EASnB,8BAAI,uCAAA;EASJ,kCAAQ;;;;;;;;;;;;;;EAgCR,mCAAS;;;;;;;;;;;;;;;;;;;;;;;;EA+GT,2CAAiB;;;;;;;;;;;;;;;;;;;;EAuDjB,+BAAK;;;;;;;;;;;;;;;;;;;cC9RM,2BAAwB;EACnC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;;;;;;;;;;;;;;;;;;;;cCkBW,8BAAW,yBAAA"}