codexgpt 1.0.0

package/dist/auth/tokenService.js

@@ -0,0 +1,631 @@
+import { createHmac, randomBytes as nodeRandomBytes, timingSafeEqual } from "node:crypto";
+import { SignJWT, createLocalJWKSet, jwtVerify } from "jose";
+import { clientRefForId } from "./clientStore.js";
+import { OAuthProtocolError, authConfigurationError } from "./errors.js";
+import { KNOWN_OAUTH_SCOPES } from "./types.js";
+export const OAUTH_ACCESS_TOKEN_TTL_SECONDS = 10 * 60;
+export const OAUTH_ACCESS_TOKEN_CLOCK_SKEW_SECONDS = 60;
+export const OAUTH_BEARER_MAX_BYTES = 8 * 1024;
+export const OAUTH_REFRESH_TOKEN_MAX_BYTES = 512;
+export const OAUTH_REFRESH_ENVELOPE_BYTES = 89;
+export const OAUTH_ES256_ACTIVE_LIMIT = 8;
+export const OAUTH_ES256_QUEUE_LIMIT = 32;
+export const OAUTH_ES256_RESERVED_ACTIVE = 2;
+export const OAUTH_ES256_RESERVED_QUEUE = 8;
+export const OAUTH_FAILED_BEARER_RATE_PER_MINUTE = 120;
+export const OAUTH_FAILED_BEARER_BURST = 30;
+const REFRESH_VERSION = 1;
+const REFRESH_PAYLOAD_BYTES = 1 + 16 + 8 + 32;
+const TOKEN_ID_PATTERN = /^token_[A-Za-z0-9_-]{43}$/;
+const GRANT_ID_PATTERN = /^grant_[a-f0-9]{32}$/;
+const CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]{43}$/;
+const KID_PATTERN = /^kid_[a-f0-9]{32}$/;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+const ACCESS_PAYLOAD_KEYS = Object.freeze([
+    "aud", "client_id", "exp", "grant_id", "grant_rev", "iat",
+    "iss", "jti", "nbf", "scope", "sub"
+]);
+export class OAuthBearerCapacityError extends Error {
+    retryAfterSeconds = 1;
+    constructor() {
+        super("OAuth bearer verification capacity is temporarily full.");
+        this.name = "OAuthBearerCapacityError";
+    }
+}
+export class OAuthEs256Admission {
+    #active = 0;
+    #ordinaryActive = 0;
+    #ordinaryQueued = 0;
+    #queue = [];
+    run(reserved, action) {
+        if (this.#canStart(reserved))
+            return this.#start(reserved, action);
+        if (this.#queue.length >= OAUTH_ES256_QUEUE_LIMIT ||
+            (!reserved && this.#ordinaryQueued >= OAUTH_ES256_QUEUE_LIMIT - OAUTH_ES256_RESERVED_QUEUE)) {
+            throw new OAuthBearerCapacityError();
+        }
+        if (!reserved)
+            this.#ordinaryQueued += 1;
+        return new Promise((resolve, reject) => {
+            this.#queue.push({
+                reserved,
+                action,
+                resolve: resolve,
+                reject
+            });
+        });
+    }
+    #canStart(reserved) {
+        if (this.#active >= OAUTH_ES256_ACTIVE_LIMIT)
+            return false;
+        return reserved || this.#ordinaryActive < OAUTH_ES256_ACTIVE_LIMIT - OAUTH_ES256_RESERVED_ACTIVE;
+    }
+    #start(reserved, action) {
+        this.#active += 1;
+        if (!reserved)
+            this.#ordinaryActive += 1;
+        return action().finally(() => {
+            this.#active -= 1;
+            if (!reserved)
+                this.#ordinaryActive -= 1;
+            this.#drain();
+        });
+    }
+    #drain() {
+        let progress = true;
+        while (progress && this.#queue.length > 0) {
+            progress = false;
+            const index = this.#queue.findIndex((entry) => this.#canStart(entry.reserved));
+            if (index < 0)
+                return;
+            const [entry] = this.#queue.splice(index, 1);
+            if (!entry.reserved)
+                this.#ordinaryQueued -= 1;
+            progress = true;
+            void this.#start(entry.reserved, entry.action).then(entry.resolve, entry.reject);
+        }
+    }
+}
+class FailedBearerBudget {
+    now;
+    #tokens = OAUTH_FAILED_BEARER_BURST;
+    #updatedAt;
+    constructor(now) {
+        this.now = now;
+        this.#updatedAt = now();
+    }
+    reserve() {
+        this.#refill();
+        if (this.#tokens < 1)
+            return false;
+        this.#tokens -= 1;
+        return true;
+    }
+    refund() {
+        this.#refill();
+        this.#tokens = Math.min(OAUTH_FAILED_BEARER_BURST, this.#tokens + 1);
+    }
+    #refill() {
+        const current = this.now();
+        const elapsed = Math.max(0, current - this.#updatedAt);
+        this.#updatedAt = current;
+        this.#tokens = Math.min(OAUTH_FAILED_BEARER_BURST, this.#tokens + elapsed * (OAUTH_FAILED_BEARER_RATE_PER_MINUTE / 60_000));
+    }
+}
+function deriveKey(root, purpose) {
+    return createHmac("sha256", root).update(purpose, "utf8").digest();
+}
+function fixedEqual(left, right) {
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function oauthInvalidGrant() {
+    return new OAuthProtocolError("invalid_grant", "The OAuth grant is invalid.");
+}
+function accessInvalid() {
+    return new OAuthProtocolError("invalid_grant", "The access token is invalid.", 401);
+}
+function parseScopes(scope) {
+    if (typeof scope !== "string" || scope.length < 1 || scope.length > 256 || /\s{2,}|[^\x20-\x7e]/.test(scope)) {
+        throw accessInvalid();
+    }
+    const values = scope.split(" ");
+    if (new Set(values).size !== values.length || values.some((value) => !KNOWN_OAUTH_SCOPES.includes(value))) {
+        throw accessInvalid();
+    }
+    const normalized = KNOWN_OAUTH_SCOPES.filter((value) => values.includes(value));
+    if (normalized.length !== values.length || normalized.some((value, index) => value !== values[index])) {
+        throw accessInvalid();
+    }
+    return Object.freeze([...normalized]);
+}
+function numericClaim(payload, name) {
+    const value = payload[name];
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw accessInvalid();
+    return value;
+}
+function stringClaim(payload, name) {
+    const value = payload[name];
+    if (typeof value !== "string")
+        throw accessInvalid();
+    return value;
+}
+export class OAuthTokenService {
+    #identity;
+    #ownerSubject;
+    #ownerRef;
+    #store;
+    #grants;
+    #privateKey;
+    #activeKid;
+    #refreshEnvelopeKey;
+    #refreshStoreKey;
+    #authorizationCodeKey;
+    #bearerCacheKey;
+    #now;
+    #randomBytes;
+    #admission = new OAuthEs256Admission();
+    #failedBudget;
+    #positiveCache = new Map();
+    #negativeCache = new Map();
+    #validatedFingerprints = new Map();
+    constructor(input) {
+        this.#identity = Object.freeze({ ...input.identity });
+        this.#ownerSubject = input.ownerSubject;
+        this.#ownerRef = input.ownerRef;
+        this.#store = input.store;
+        this.#grants = input.grants;
+        this.#privateKey = input.privateKey;
+        this.#activeKid = input.state.activePublicJwk.kid;
+        this.#refreshEnvelopeKey = deriveKey(input.refreshPepper, "refresh-envelope-v1");
+        this.#refreshStoreKey = deriveKey(input.refreshPepper, "refresh-store-v1");
+        this.#authorizationCodeKey = deriveKey(input.refreshPepper, "authorization-code-store-v1");
+        this.#bearerCacheKey = this.#random(32, input.randomBytes ?? nodeRandomBytes);
+        input.refreshPepper.fill(0);
+        this.#now = input.now ?? Date.now;
+        this.#randomBytes = input.randomBytes ?? nodeRandomBytes;
+        this.#failedBudget = new FailedBearerBudget(this.#now);
+    }
+    static async create(options) {
+        if (options.state.bindingId !== options.identity.bindingId ||
+            options.state.incarnationId !== options.identity.incarnationId ||
+            options.state.ownerRef !== options.ownerRef ||
+            options.state.issuer !== options.identity.issuer ||
+            options.state.resource !== options.identity.resource) {
+            throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth token service identity does not match durable state.");
+        }
+        const [privateKey, refreshPepper] = await Promise.all([
+            options.keyManager.loadPrivateKey(options.state),
+            options.keyManager.loadRefreshPepper(options.state)
+        ]);
+        return new OAuthTokenService({ ...options, privateKey, refreshPepper });
+    }
+    async exchangeAuthorizationCode(input) {
+        if (input.resource !== this.#identity.resource)
+            throw new OAuthProtocolError("invalid_target", "The OAuth resource is invalid.");
+        const familyHandle = `family_${this.#randomBytesExact(16).toString("hex")}`;
+        const grantId = `grant_${this.#randomBytesExact(16).toString("hex")}`;
+        const refreshToken = this.#createRefreshToken(familyHandle, 0n);
+        const accessToken = await this.#signAccessToken({
+            grantId,
+            clientId: input.clientId,
+            scopes: input.scopes,
+            grantRevision: 0
+        });
+        const grant = await this.#grants.create({
+            grantId,
+            clientId: input.clientId,
+            clientRef: clientRefForId(input.clientId),
+            scopes: input.scopes,
+            familyHandle,
+            refreshTokenHash: this.#refreshHash(refreshToken),
+            authorizationCodeHash: this.authorizationCodeHash(input.authorizationCode)
+        });
+        return await this.#tokensForGrant(grant, refreshToken, accessToken);
+    }
+    async exchangeRefreshToken(input) {
+        if (input.resource !== this.#identity.resource)
+            throw new OAuthProtocolError("invalid_target", "The OAuth resource is invalid.");
+        const envelope = this.#parseRefreshToken(input.refreshToken);
+        const current = this.#grants.getByFamily(envelope.familyHandle);
+        if (!current || current.clientId !== input.clientId || current.resource !== input.resource)
+            throw oauthInvalidGrant();
+        const scopes = input.scopes ?? current.scopes;
+        const nextToken = this.#createRefreshToken(envelope.familyHandle, envelope.generation + 1n);
+        const mutation = await this.#grants.rotateRefresh({
+            familyHandle: envelope.familyHandle,
+            generation: envelope.generation,
+            presentedTokenHash: envelope.tokenHash,
+            nextTokenHash: this.#refreshHash(nextToken),
+            clientId: input.clientId,
+            clientRef: clientRefForId(input.clientId),
+            resource: input.resource,
+            scopes
+        });
+        if (mutation.kind !== "rotated")
+            throw oauthInvalidGrant();
+        return await this.#tokensForGrant(mutation.grant, nextToken);
+    }
+    async verifyAccessToken(token, options = {}) {
+        const now = this.#now();
+        let header;
+        try {
+            header = this.#cheapBearerHeader(token);
+        }
+        catch (error) {
+            if (!this.#failedBudget.reserve())
+                throw new OAuthBearerCapacityError();
+            if (error instanceof OAuthProtocolError)
+                throw error;
+            throw accessInvalid();
+        }
+        const fingerprint = this.#tokenFingerprint(token);
+        this.#pruneCaches(now);
+        const negativeUntil = this.#negativeCache.get(fingerprint);
+        if (negativeUntil !== undefined && negativeUntil > now)
+            throw accessInvalid();
+        const cached = this.#positiveCache.get(fingerprint);
+        try {
+            let base;
+            const state = this.#currentState();
+            const keyRetained = header.kid === state.activePublicJwk.kid ||
+                state.previousPublicJwks.some((key) => key.kid === header.kid);
+            if (cached && cached.expiresAtMs > now && keyRetained) {
+                base = cached.verified;
+            }
+            else {
+                if (!this.#failedBudget.reserve())
+                    throw new OAuthBearerCapacityError();
+                const reserved = this.#validatedFingerprints.has(fingerprint) &&
+                    options.isEstablishedSession?.(fingerprint) === true;
+                try {
+                    base = await this.#admission.run(reserved, () => this.#verifyCryptographic(token, fingerprint, header));
+                    this.#failedBudget.refund();
+                }
+                catch (error) {
+                    if (error instanceof OAuthBearerCapacityError)
+                        this.#failedBudget.refund();
+                    throw error;
+                }
+            }
+            const grant = await this.#grants.validateAccess({
+                grantId: base.grantId,
+                clientId: base.clientId,
+                ownerRef: base.ownerRef,
+                resource: base.resource,
+                grantRevision: base.grantRevision,
+                scopes: base.scopes
+            });
+            if (grant.familyHandle.length === 0)
+                throw accessInvalid();
+            const authInfo = {
+                token,
+                clientId: base.clientId,
+                scopes: [...base.scopes],
+                expiresAt: base.expiresAt,
+                resource: new URL(base.resource),
+                extra: {
+                    ownerSubject: base.ownerSubject,
+                    ownerRef: base.ownerRef,
+                    bindingId: base.bindingId,
+                    incarnationId: base.incarnationId,
+                    grantId: base.grantId,
+                    grantRevision: base.grantRevision,
+                    tokenId: base.tokenId,
+                    tokenFingerprint: base.fingerprint
+                }
+            };
+            return Object.freeze({ ...base, authInfo });
+        }
+        catch (error) {
+            if (error instanceof OAuthBearerCapacityError)
+                throw error;
+            this.#rememberNegative(fingerprint, now);
+            if (error instanceof OAuthProtocolError)
+                throw error;
+            throw accessInvalid();
+        }
+    }
+    async revoke(input) {
+        let familyHandle;
+        try {
+            familyHandle = this.#parseRefreshToken(input.token).familyHandle;
+        }
+        catch {
+            try {
+                const header = this.#cheapBearerHeader(input.token);
+                const verified = await this.#verifyCryptographic(input.token, this.#tokenFingerprint(input.token), header);
+                const grant = this.#grants.getByGrantId(verified.grantId);
+                if (grant && verified.clientId === input.clientId)
+                    familyHandle = grant.familyHandle;
+            }
+            catch {
+                return;
+            }
+        }
+        if (!familyHandle)
+            return;
+        await this.#grants.revokeFamily({
+            familyHandle,
+            clientRef: clientRefForId(input.clientId),
+            reason: "public"
+        });
+    }
+    authorizationCodeHash(code) {
+        if (!/^[A-Za-z0-9_-]{43}$/.test(code))
+            throw oauthInvalidGrant();
+        return `hmac-sha256:${createHmac("sha256", this.#authorizationCodeKey).update(code, "utf8").digest("hex")}`;
+    }
+    refreshTokenFamily(token) {
+        return this.#parseRefreshToken(token).familyHandle;
+    }
+    dispose() {
+        this.#refreshEnvelopeKey.fill(0);
+        this.#refreshStoreKey.fill(0);
+        this.#authorizationCodeKey.fill(0);
+        this.#bearerCacheKey.fill(0);
+        this.#positiveCache.clear();
+        this.#negativeCache.clear();
+        this.#validatedFingerprints.clear();
+    }
+    async #tokensForGrant(grant, refreshToken, preSignedAccessToken) {
+        const accessToken = preSignedAccessToken ?? await this.#signAccessToken(grant);
+        return Object.freeze({
+            access_token: accessToken,
+            token_type: "Bearer",
+            expires_in: OAUTH_ACCESS_TOKEN_TTL_SECONDS,
+            refresh_token: refreshToken,
+            scope: grant.scopes.join(" ")
+        });
+    }
+    async #signAccessToken(grant) {
+        const current = this.#currentState();
+        if (current.activePublicJwk.kid !== this.#activeKid) {
+            throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth signing authority changed during the current token-service lifecycle.");
+        }
+        const issuedAt = Math.floor(this.#now() / 1000);
+        const tokenId = `token_${this.#randomBytesExact(32).toString("base64url")}`;
+        return await new SignJWT({
+            client_id: grant.clientId,
+            scope: grant.scopes.join(" "),
+            grant_id: grant.grantId,
+            grant_rev: grant.grantRevision
+        })
+            .setProtectedHeader({ alg: "ES256", typ: "at+jwt", kid: this.#activeKid })
+            .setIssuer(this.#identity.issuer)
+            .setAudience(this.#identity.resource)
+            .setSubject(this.#ownerSubject)
+            .setIssuedAt(issuedAt)
+            .setNotBefore(issuedAt)
+            .setExpirationTime(issuedAt + OAUTH_ACCESS_TOKEN_TTL_SECONDS)
+            .setJti(tokenId)
+            .sign(this.#privateKey);
+    }
+    async #verifyCryptographic(token, fingerprint, header = this.#cheapBearerHeader(token)) {
+        const state = this.#currentState();
+        if (header.kid !== state.activePublicJwk.kid && !state.previousPublicJwks.some((key) => key.kid === header.kid)) {
+            throw accessInvalid();
+        }
+        const jwks = createLocalJWKSet({ keys: [state.activePublicJwk, ...state.previousPublicJwks] });
+        let verified;
+        try {
+            verified = await jwtVerify(token, jwks, {
+                algorithms: ["ES256"],
+                issuer: this.#identity.issuer,
+                audience: this.#identity.resource,
+                clockTolerance: OAUTH_ACCESS_TOKEN_CLOCK_SKEW_SECONDS,
+                currentDate: new Date(this.#now())
+            });
+        }
+        catch {
+            throw accessInvalid();
+        }
+        if (verified.protectedHeader.alg !== "ES256" || verified.protectedHeader.typ !== "at+jwt" || verified.protectedHeader.kid !== header.kid) {
+            throw accessInvalid();
+        }
+        const payload = verified.payload;
+        const payloadKeys = Object.keys(payload).sort();
+        if (payloadKeys.length !== ACCESS_PAYLOAD_KEYS.length ||
+            payloadKeys.some((key, index) => key !== ACCESS_PAYLOAD_KEYS[index])) {
+            throw accessInvalid();
+        }
+        const subject = stringClaim(payload, "sub");
+        const clientId = stringClaim(payload, "client_id");
+        const tokenId = stringClaim(payload, "jti");
+        const grantId = stringClaim(payload, "grant_id");
+        const grantRevision = numericClaim(payload, "grant_rev");
+        const issuedAt = numericClaim(payload, "iat");
+        const notBefore = numericClaim(payload, "nbf");
+        const expiresAt = numericClaim(payload, "exp");
+        const scopes = parseScopes(payload.scope);
+        const nowSeconds = Math.floor(this.#now() / 1000);
+        if (payload.iss !== this.#identity.issuer ||
+            payload.aud !== this.#identity.resource ||
+            subject !== this.#ownerSubject ||
+            !CLIENT_ID_PATTERN.test(clientId) ||
+            !TOKEN_ID_PATTERN.test(tokenId) ||
+            !GRANT_ID_PATTERN.test(grantId) ||
+            notBefore !== issuedAt ||
+            notBefore > nowSeconds ||
+            issuedAt > nowSeconds + OAUTH_ACCESS_TOKEN_CLOCK_SKEW_SECONDS ||
+            nowSeconds - issuedAt > OAUTH_ACCESS_TOKEN_TTL_SECONDS + OAUTH_ACCESS_TOKEN_CLOCK_SKEW_SECONDS ||
+            expiresAt !== issuedAt + OAUTH_ACCESS_TOKEN_TTL_SECONDS ||
+            expiresAt <= nowSeconds - OAUTH_ACCESS_TOKEN_CLOCK_SKEW_SECONDS ||
+            state.bindingId !== this.#identity.bindingId ||
+            state.incarnationId !== this.#identity.incarnationId) {
+            throw accessInvalid();
+        }
+        const base = Object.freeze({
+            ownerSubject: subject,
+            ownerRef: this.#ownerRef,
+            clientId,
+            clientRef: clientRefForId(clientId),
+            resource: this.#identity.resource,
+            bindingId: this.#identity.bindingId,
+            incarnationId: this.#identity.incarnationId,
+            grantId,
+            grantRevision,
+            scopes,
+            tokenId,
+            expiresAt,
+            fingerprint
+        });
+        this.#rememberPositive(fingerprint, base, expiresAt * 1000);
+        return base;
+    }
+    #cheapBearerHeader(token) {
+        if (typeof token !== "string" || token.length < 32 || Buffer.byteLength(token, "utf8") > OAUTH_BEARER_MAX_BYTES ||
+            /[^\x21-\x7e]/.test(token)) {
+            throw accessInvalid();
+        }
+        const parts = token.split(".");
+        if (parts.length !== 3 || parts.some((part) => part.length === 0 || !BASE64URL_PATTERN.test(part)))
+            throw accessInvalid();
+        let parsed;
+        try {
+            const decoded = parts.map((part) => Buffer.from(part, "base64url"));
+            if (decoded.some((bytes, index) => bytes.toString("base64url") !== parts[index]))
+                throw new Error("non-canonical");
+            if (decoded[0].length < 2 || decoded[0].length > 1024)
+                throw new Error("header-size");
+            if (decoded[1].length < 2 || decoded[1].length > 4096)
+                throw new Error("payload-size");
+            if (decoded[2].length !== 64)
+                throw new Error("signature-size");
+            const rawHeader = decoded[0].toString("utf8");
+            const rawPayload = decoded[1].toString("utf8");
+            parsed = JSON.parse(rawHeader);
+            const parsedPayload = JSON.parse(rawPayload);
+            const serializedKeys = [...rawHeader.matchAll(/"([^"\\]+)"\s*:/g)].map((match) => match[1]);
+            if (serializedKeys.length !== 3 || new Set(serializedKeys).size !== 3)
+                throw new Error("header-keys");
+            if (!parsedPayload || Array.isArray(parsedPayload) || typeof parsedPayload !== "object")
+                throw new Error("payload-object");
+            const serializedPayloadKeys = [...rawPayload.matchAll(/"([^"\\]+)"\s*:/g)].map((match) => match[1]);
+            const parsedPayloadKeys = Object.keys(parsedPayload).sort();
+            if (serializedPayloadKeys.length !== ACCESS_PAYLOAD_KEYS.length ||
+                new Set(serializedPayloadKeys).size !== ACCESS_PAYLOAD_KEYS.length ||
+                parsedPayloadKeys.length !== ACCESS_PAYLOAD_KEYS.length ||
+                parsedPayloadKeys.some((key, index) => key !== ACCESS_PAYLOAD_KEYS[index])) {
+                throw new Error("payload-keys");
+            }
+        }
+        catch {
+            throw accessInvalid();
+        }
+        if (!parsed || Array.isArray(parsed) || typeof parsed !== "object")
+            throw accessInvalid();
+        const header = parsed;
+        const headerKeys = Object.keys(header).sort();
+        if (headerKeys.length !== 3 || headerKeys[0] !== "alg" || headerKeys[1] !== "kid" || headerKeys[2] !== "typ" ||
+            header.alg !== "ES256" || header.typ !== "at+jwt" || typeof header.kid !== "string" || !KID_PATTERN.test(header.kid)) {
+            throw accessInvalid();
+        }
+        return { kid: header.kid };
+    }
+    #createRefreshToken(familyHandle, generation) {
+        if (!/^family_[a-f0-9]{32}$/.test(familyHandle) || generation < 0n || generation > 0xffffffffffffffffn) {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth refresh envelope input is invalid.");
+        }
+        const payload = Buffer.alloc(REFRESH_PAYLOAD_BYTES);
+        payload[0] = REFRESH_VERSION;
+        Buffer.from(familyHandle.slice("family_".length), "hex").copy(payload, 1);
+        payload.writeBigUInt64BE(generation, 17);
+        this.#randomBytesExact(32).copy(payload, 25);
+        const mac = createHmac("sha256", this.#refreshEnvelopeKey).update(payload).digest();
+        return Buffer.concat([payload, mac]).toString("base64url");
+    }
+    #parseRefreshToken(token) {
+        if (typeof token !== "string" || token.length < 1 || Buffer.byteLength(token, "utf8") > OAUTH_REFRESH_TOKEN_MAX_BYTES ||
+            !BASE64URL_PATTERN.test(token)) {
+            throw oauthInvalidGrant();
+        }
+        let decoded;
+        try {
+            decoded = Buffer.from(token, "base64url");
+        }
+        catch {
+            throw oauthInvalidGrant();
+        }
+        if (decoded.toString("base64url") !== token ||
+            decoded.length !== OAUTH_REFRESH_ENVELOPE_BYTES ||
+            decoded[0] !== REFRESH_VERSION) {
+            throw oauthInvalidGrant();
+        }
+        const payload = decoded.subarray(0, REFRESH_PAYLOAD_BYTES);
+        const suppliedMac = decoded.subarray(REFRESH_PAYLOAD_BYTES);
+        const expectedMac = createHmac("sha256", this.#refreshEnvelopeKey).update(payload).digest();
+        if (!fixedEqual(suppliedMac, expectedMac))
+            throw oauthInvalidGrant();
+        const familyHandle = `family_${payload.subarray(1, 17).toString("hex")}`;
+        const generation = payload.readBigUInt64BE(17);
+        return Object.freeze({ familyHandle, generation, tokenHash: this.#refreshHash(token) });
+    }
+    #refreshHash(token) {
+        return `hmac-sha256:${createHmac("sha256", this.#refreshStoreKey).update(token, "utf8").digest("hex")}`;
+    }
+    #tokenFingerprint(token) {
+        return createHmac("sha256", this.#bearerCacheKey).update(token, "utf8").digest("hex");
+    }
+    #rememberPositive(fingerprint, verified, expiresAtMs) {
+        const boundedExpiry = Math.min(expiresAtMs, this.#now() + OAUTH_ACCESS_TOKEN_TTL_SECONDS * 1000);
+        this.#positiveCache.delete(fingerprint);
+        this.#positiveCache.set(fingerprint, {
+            verified,
+            expiresAtMs: boundedExpiry
+        });
+        this.#validatedFingerprints.delete(fingerprint);
+        this.#validatedFingerprints.set(fingerprint, boundedExpiry);
+        while (this.#positiveCache.size > 128) {
+            const oldest = this.#positiveCache.keys().next().value;
+            if (!oldest)
+                break;
+            this.#positiveCache.delete(oldest);
+        }
+        while (this.#validatedFingerprints.size > 128) {
+            const oldest = this.#validatedFingerprints.keys().next().value;
+            if (!oldest)
+                break;
+            this.#validatedFingerprints.delete(oldest);
+        }
+    }
+    #rememberNegative(fingerprint, now) {
+        this.#negativeCache.delete(fingerprint);
+        this.#negativeCache.set(fingerprint, now + 60_000);
+        while (this.#negativeCache.size > 256) {
+            const oldest = this.#negativeCache.keys().next().value;
+            if (!oldest)
+                break;
+            this.#negativeCache.delete(oldest);
+        }
+    }
+    #pruneCaches(now) {
+        for (const [key, value] of this.#positiveCache)
+            if (value.expiresAtMs <= now)
+                this.#positiveCache.delete(key);
+        for (const [key, until] of this.#negativeCache)
+            if (until <= now)
+                this.#negativeCache.delete(key);
+        for (const [key, until] of this.#validatedFingerprints)
+            if (until <= now)
+                this.#validatedFingerprints.delete(key);
+    }
+    #currentState() {
+        const state = this.#store.readDeployment(this.#identity.bindingId, this.#identity.incarnationId);
+        if (state.bindingId !== this.#identity.bindingId || state.incarnationId !== this.#identity.incarnationId) {
+            throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth token state identity changed.");
+        }
+        return state;
+    }
+    #randomBytesExact(size) {
+        return this.#random(size, this.#randomBytes);
+    }
+    #random(size, source) {
+        const value = source(size);
+        if (!Buffer.isBuffer(value) || value.length !== size) {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth token random source is invalid.");
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=tokenService.js.map