matrix-nodejs-homeserver 0.3.3 → 0.3.5

package/dist/core/ratelimit.js

@@ -32,6 +32,10 @@ const DEFAULT_RATE_LIMITS = {
 	keyQuery: {
 		perSecond: 5,
 		burst: 50
+	},
+	oauthClient: {
+		perSecond: .5,
+		burst: 10
 	}
 };
 /** In-process token bucket limiter. */

package/dist/core/rooms.js

@@ -731,6 +731,12 @@ var RoomService = class {
 			events: touched,
 			sharing: true
 		});
+		const changedMembers = /* @__PURE__ */ new Set();
+		for (const k of /* @__PURE__ */ new Set([...Object.keys(oldIds), ...Object.keys(newIds)])) {
+			const [type, userId] = splitStateKey(k);
+			if (type === M.ROOM.MEMBER && oldIds[k] !== newIds[k] && this.hs.isLocalUser(userId)) changedMembers.add(userId);
+		}
+		if (changedMembers.size) this.hs.notifier.notify([...changedMembers, ...await this.interestedUsers(roomId)]);
 		for (const k of Object.keys(oldIds)) {
 			const [type, userId] = splitStateKey(k);
 			if (type !== M.ROOM.MEMBER || this.hs.isLocalUser(userId) || oldIds[k] === newIds[k]) continue;
@@ -995,7 +1001,7 @@ var RoomService = class {
 				if (this.hs.appservices.registrations.length) await this.hs.appservices.onEvent(view, newState).catch((err) => this.hs.logger.warn("Appservice push failed", err));
 				if (isState) await this.hs.delayedEvents.onStateEvent(roomId, pdu.type, pdu.state_key, sender).catch(() => {});
 				wake = async () => {
-					this.hs.notifier.notify(await this.interestedUsers(roomId));
+					this.hs.notifier.notify(await this.interestedUsers(roomId), backfill ? void 0 : stream);
 					this.hs.emit("event", toClientEvent(view));
 					if (this.hs.adminRoom) this.hs.adminRoom.onEvent(view).catch((err) => this.hs.logger.error("Admin command failed", err));
 				};

package/dist/core/semaphore.js

@@ -14,7 +14,7 @@ var Semaphore = class {
 			return await fn();
 		} finally {
 			const next = this.waiting.shift();
-			if (next) next();
+			if (next) setImmediate(next);
 			else this.active--;
 		}
 	}

package/dist/core/sso.d.ts

@@ -1,15 +1,27 @@
 import { Homeserver } from "../homeserver.js";
 //#region src/core/sso.d.ts
-/** An upstream OpenID Connect provider for `m.login.sso`. */
+/**
+ * An upstream identity provider: OpenID Connect (found through `issuer`), or plain OAuth 2.0 with
+ * a user info endpoint (`endpoints`, e.g. GitHub; see `githubProvider`).
+ */
 export interface SsoProvider {
   /** Stable identifier, used in URLs and stored with linked accounts. */
   id: string;
   name: string;
-  issuer: string;
+  /** OpenID Connect issuer; its discovery document gives the endpoints. Required without `endpoints`. */
+  issuer?: string;
+  /** Endpoints of a provider without OpenID Connect discovery. */
+  endpoints?: {
+    authorization: string;
+    token: string;
+    userinfo?: string;
+  };
   clientId: string;
   clientSecret?: string;
-  /** Default: ["openid", "profile", "email"]. */
+  /** Default: ["openid", "profile", "email"] with `issuer`, none with `endpoints`. */
   scopes?: string[];
+  /** Claim that identifies the user at the provider. Default: "sub". */
+  subjectClaim?: string;
   icon?: string;
   brand?: string;
   /**
@@ -35,26 +47,50 @@ export interface SsoOptions {
    */
   clientAllowlist?: string[];
 }
-/** Where the browser goes after login, and whether the user has to confirm that client first. */
-export interface SsoResult {
-  url: string;
-  confirm: boolean;
-  /** The client as shown to the user: its host, or its scheme for app links. */
-  client: string;
-}
-/** Upstream OIDC login (authorization code + PKCE) issuing Matrix login tokens. */
+/**
+ * What a login through a provider is for: a client of the legacy API (`m.login.sso`, which gets a
+ * login token at `redirectUrl`), or the server's own web pages (OAuth 2.0 API), which continue
+ * at `next` in the browser session `sid`.
+ */
+export type SsoTarget = {
+  kind: "client";
+  redirectUrl: string;
+} | {
+  kind: "web";
+  next: string;
+  sid: string;
+};
+/**
+ * GitHub as an identity provider (an OAuth app or GitHub app; its callback URL is
+ * `{publicBaseUrl}/_matrix/client/v3/login/sso/callback/github`). Users are matched by their
+ * numeric GitHub ID, so renaming the GitHub account keeps the Matrix account; new accounts take
+ * the GitHub login as their localpart.
+ */
+export declare function githubProvider(opts: {
+  clientId: string;
+  clientSecret: string;
+  id?: string;
+  name?: string;
+  allowRegistration?: boolean;
+  mapUser?: SsoProvider["mapUser"];
+}): SsoProvider;
+/** Upstream login (authorization code + PKCE) for the legacy `m.login.sso` and the OAuth 2.0 API's web pages. */
 export declare class SsoService {
   private hs;
   readonly providers: SsoProvider[];
-  private clientAllowlist;
+  readonly clientAllowlist: string[];
   private discovery;
   constructor(hs: Homeserver, options: SsoOptions);
   private callbackUrl;
   private discover;
+  private scopes;
   /** URL to send the user's browser to. */
-  startLogin(providerId: string | null, redirectUrl: string): Promise<string>;
-  /** Handle the provider's redirect; returns the client URL carrying a login token. */
-  finishLogin(providerId: string, params: URLSearchParams): Promise<SsoResult>;
+  startLogin(providerId: string | null, target: SsoTarget): Promise<string>;
+  /** Handle the provider's redirect: the user who logged in, and what the login was for. */
+  finishLogin(providerId: string, params: URLSearchParams): Promise<{
+    userId: string;
+    target: SsoTarget;
+  }>;
   private resolveUser;
 }
 //#endregion

package/dist/core/sso.js

@@ -39,7 +39,35 @@ function decodeJwtPayload(jwt) {
 	if (!part) throw new Error("Malformed ID token");
 	return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
 }
-/** Upstream OIDC login (authorization code + PKCE) issuing Matrix login tokens. */
+/**
+* GitHub as an identity provider (an OAuth app or GitHub app; its callback URL is
+* `{publicBaseUrl}/_matrix/client/v3/login/sso/callback/github`). Users are matched by their
+* numeric GitHub ID, so renaming the GitHub account keeps the Matrix account; new accounts take
+* the GitHub login as their localpart.
+*/
+function githubProvider(opts) {
+	return {
+		id: opts.id ?? "github",
+		name: opts.name ?? "GitHub",
+		brand: "github",
+		clientId: opts.clientId,
+		clientSecret: opts.clientSecret,
+		endpoints: {
+			authorization: "https://github.com/login/oauth/authorize",
+			token: "https://github.com/login/oauth/access_token",
+			userinfo: "https://api.github.com/user"
+		},
+		scopes: ["read:user"],
+		subjectClaim: "id",
+		mapUser: opts.mapUser ?? ((c) => ({
+			localpart: sanitizeLocalpart(String(c.login ?? c.id)),
+			displayname: c.name ?? c.login
+		})),
+		...opts.allowRegistration !== void 0 ? { allowRegistration: opts.allowRegistration } : {}
+	};
+}
+const USER_AGENT = "matrix-nodejs-homeserver";
+/** Upstream login (authorization code + PKCE) for the legacy `m.login.sso` and the OAuth 2.0 API's web pages. */
 var SsoService = class {
 	hs;
 	providers;
@@ -56,8 +84,18 @@ var SsoService = class {
 		return `${base.replace(/\/$/, "")}/_matrix/client/v3/login/sso/callback/${encodeURIComponent(provider.id)}`;
 	}
 	async discover(provider) {
+		if (provider.endpoints) {
+			const e = provider.endpoints;
+			return {
+				issuer: provider.issuer,
+				authorization_endpoint: e.authorization,
+				token_endpoint: e.token,
+				userinfo_endpoint: e.userinfo
+			};
+		}
 		const cached = this.discovery.get(provider.id);
 		if (cached) return cached;
+		if (!provider.issuer) throw new Error(`Identity provider ${provider.id} needs an issuer or endpoints`);
 		const res = await this.hs.fetch(`${provider.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(1e4) });
 		if (!res.ok) throw new Error(`OIDC discovery for ${provider.id} failed with ${res.status}`);
 		const meta = await res.json();
@@ -65,8 +103,15 @@ var SsoService = class {
 		this.discovery.set(provider.id, meta);
 		return meta;
 	}
+	scopes(provider) {
+		return provider.scopes ?? (provider.endpoints ? [] : [
+			"openid",
+			"profile",
+			"email"
+		]);
+	}
 	/** URL to send the user's browser to. */
-	async startLogin(providerId, redirectUrl) {
+	async startLogin(providerId, target) {
 		const provider = providerId ? this.providers.find((p) => p.id === providerId) : this.providers[0];
 		if (!provider) throw errors.notFound("Unknown identity provider");
 		const meta = await this.discover(provider);
@@ -75,7 +120,7 @@ var SsoService = class {
 		const nonce = randomToken(16);
 		await this.hs.cluster.set(`sso:${state}`, {
 			providerId: provider.id,
-			redirectUrl,
+			target,
 			verifier,
 			nonce,
 			expires: Date.now() + 6e5
@@ -84,18 +129,15 @@ var SsoService = class {
 		url.searchParams.set("response_type", "code");
 		url.searchParams.set("client_id", provider.clientId);
 		url.searchParams.set("redirect_uri", this.callbackUrl(provider));
-		url.searchParams.set("scope", (provider.scopes ?? [
-			"openid",
-			"profile",
-			"email"
-		]).join(" "));
+		const scopes = this.scopes(provider);
+		if (scopes.length) url.searchParams.set("scope", scopes.join(" "));
 		url.searchParams.set("state", state);
 		url.searchParams.set("nonce", nonce);
 		url.searchParams.set("code_challenge", urlSafeBase64(createHash("sha256").update(verifier).digest()));
 		url.searchParams.set("code_challenge_method", "S256");
 		return url.toString();
 	}
-	/** Handle the provider's redirect; returns the client URL carrying a login token. */
+	/** Handle the provider's redirect: the user who logged in, and what the login was for. */
 	async finishLogin(providerId, params) {
 		const state = params.get("state") ?? "";
 		const pending = await this.hs.cluster.get(`sso:${state}`);
@@ -115,7 +157,8 @@ var SsoService = class {
 		});
 		const headers = {
 			"content-type": "application/x-www-form-urlencoded",
-			accept: "application/json"
+			accept: "application/json",
+			"user-agent": USER_AGENT
 		};
 		if (provider.clientSecret) headers.authorization = `Basic ${Buffer.from(`${encodeURIComponent(provider.clientId)}:${encodeURIComponent(provider.clientSecret)}`).toString("base64")}`;
 		const res = await this.hs.fetch(meta.token_endpoint, {
@@ -126,8 +169,9 @@ var SsoService = class {
 		});
 		if (!res.ok) throw errors.forbidden("Code exchange failed");
 		const tokens = await res.json();
+		if (typeof tokens.error === "string") throw errors.forbidden("Code exchange failed");
 		let claims = {};
-		if ((provider.scopes ?? ["openid"]).includes("openid") && typeof tokens.id_token !== "string") throw errors.forbidden("The provider returned no ID token");
+		if (this.scopes(provider).includes("openid") && typeof tokens.id_token !== "string") throw errors.forbidden("The provider returned no ID token");
 		if (typeof tokens.id_token === "string") {
 			claims = decodeJwtPayload(tokens.id_token);
 			const aud = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
@@ -137,7 +181,11 @@ var SsoService = class {
 		}
 		if (meta.userinfo_endpoint && typeof tokens.access_token === "string") {
 			const info = await this.hs.fetch(meta.userinfo_endpoint, {
-				headers: { authorization: `Bearer ${tokens.access_token}` },
+				headers: {
+					authorization: `Bearer ${tokens.access_token}`,
+					accept: "application/json",
+					"user-agent": USER_AGENT
+				},
 				signal: AbortSignal.timeout(1e4)
 			});
 			if (info.ok) {
@@ -149,37 +197,35 @@ var SsoService = class {
 				};
 			}
 		}
-		if (typeof claims.sub !== "string") throw errors.forbidden("Provider did not return a subject");
-		const userId = await this.resolveUser(provider, claims);
-		const loginToken = await this.hs.auth.createLoginToken(userId);
+		const rawSubject = claims[provider.subjectClaim ?? "sub"];
+		const subject = typeof rawSubject === "number" ? String(rawSubject) : rawSubject;
+		if (typeof subject !== "string" || !subject) throw errors.forbidden("Provider did not return a subject");
+		const userId = await this.resolveUser(provider, subject, claims);
 		await this.hs.audit.record({
 			action: "sso_login",
 			actor: userId,
 			details: {
 				idp: provider.id,
-				subject: claims.sub
+				subject
 			}
 		});
-		const redirect = new URL(pending.redirectUrl);
-		redirect.searchParams.set("loginToken", loginToken);
 		return {
-			url: redirect.toString(),
-			confirm: !this.clientAllowlist.some((entry) => clientMatches(pending.redirectUrl, entry)),
-			client: redirect.host || redirect.protocol.replace(/:$/, "")
+			userId,
+			target: pending.target
 		};
 	}
-	async resolveUser(provider, claims) {
+	async resolveUser(provider, subject, claims) {
 		const link = await this.hs.db.findOne("sso_identities", [{
 			field: "idp_id",
 			value: provider.id
 		}, {
 			field: "subject",
-			value: claims.sub
+			value: subject
 		}]);
 		if (link) return link.user_id;
 		if (provider.allowRegistration === false) throw errors.forbidden("No account is linked to this identity");
 		const mapped = provider.mapUser ? await provider.mapUser(claims) : {
-			localpart: sanitizeLocalpart(claims.preferred_username ?? claims.sub),
+			localpart: sanitizeLocalpart(claims.preferred_username ?? subject),
 			displayname: claims.name
 		};
 		if (!mapped || !LOCALPART_RE.test(mapped.localpart)) throw errors.forbidden("Could not map identity to a Matrix user");
@@ -191,11 +237,25 @@ var SsoService = class {
 		const userId = await this.hs.admin.createUser(localpart, { displayname: mapped.displayname });
 		await this.hs.db.create("sso_identities", {
 			idp_id: provider.id,
-			subject: claims.sub,
+			subject,
 			user_id: userId
 		});
 		return userId;
 	}
 };
+/**
+* The legacy API's last step: the client URL carrying a login token for `userId`, and whether
+* the user confirms the client first (clients not on `sso.clientAllowlist`).
+*/
+async function legacyClientRedirect(hs, userId, redirectUrl) {
+	const loginToken = await hs.auth.createLoginToken(userId);
+	const redirect = new URL(redirectUrl);
+	redirect.searchParams.set("loginToken", loginToken);
+	return {
+		url: redirect.toString(),
+		confirm: !(hs.sso?.clientAllowlist ?? []).some((entry) => clientMatches(redirectUrl, entry)),
+		client: redirect.host || redirect.protocol.replace(/:$/, "")
+	};
+}
 //#endregion
-export { SsoService, checkRedirectUrl };
+export { SsoService, checkRedirectUrl, githubProvider, legacyClientRedirect, sanitizeLocalpart };

package/dist/homeserver.d.ts

@@ -15,6 +15,7 @@ import { TypingService } from "./core/typing.js";
 import { PushService } from "./core/push.js";
 import { AdminService, ServerNoticesOptions } from "./core/admin.js";
 import { OAuthDelegation, OAuthDelegationOptions } from "./core/oauth.js";
+import { OAuthServer, OAuthServerOptions } from "./core/oauthserver.js";
 import { SsoOptions, SsoService } from "./core/sso.js";
 import { FederationOptions, FederationService } from "./federation/index.js";
 import { DelayedEventService, DelayedEventsOptions } from "./core/delayed.js";
@@ -26,6 +27,7 @@ import { SettingsService } from "./core/settings.js";
 import { AdminRoomOptions, AdminRoomService } from "./core/adminroom.js";
 import { ResolvedUserAuth, UserAuthAdapter } from "./adapters/auth.js";
 import { MediaAdapter, Thumbnailer } from "./adapters/media.js";
+import { ChangeTracker } from "./core/changes.js";
 import { AddressPolicy } from "./core/outbound.js";
 import { EventEmitter } from "node:events";
 //#region src/homeserver.d.ts
@@ -84,7 +86,7 @@ export interface HomeserverOptions {
   /** Maximum `/sync` long-poll duration in ms. Default: 30000. */
   maxSyncTimeoutMs?: number;
   /**
-   * How many `/sync` responses one process builds at once (default 4). Requests woken together
+   * How many `/sync` responses one process builds at once (default 16). Requests woken together
    * wait in the process instead of queueing their database reads ahead of everything else.
    */
   maxConcurrentSyncs?: number;
@@ -111,7 +113,16 @@ export interface HomeserverOptions {
    */
   /** Delegate authentication to an external OAuth 2.0 / OIDC provider (disables password login and registration). */
   oauth?: OAuthDelegationOptions;
-  /** Upstream OpenID Connect providers for `m.login.sso`. Requires `publicBaseUrl`. */
+  /**
+   * Serve the spec's OAuth 2.0 API: users log in on the server's own web pages, with a password
+   * and/or the upstream providers of `sso` (e.g. `githubProvider`). Requires `publicBaseUrl`.
+   * Cannot be combined with `oauth`.
+   */
+  oauthServer?: boolean | OAuthServerOptions;
+  /**
+   * Upstream identity providers (OpenID Connect, or OAuth 2.0 such as GitHub) for `m.login.sso`
+   * and the `oauthServer` login page. Requires `publicBaseUrl`.
+   */
   sso?: SsoOptions;
   /**
    * Coordination between instances. The default (`localCluster()`) supports one process;
@@ -176,6 +187,11 @@ export declare class Homeserver extends EventEmitter {
   readonly serverName: string;
   readonly config: ResolvedConfig;
   readonly db: DatabaseAdapter;
+  /**
+   * Where keys last changed, when this is the only instance on its database (no cluster
+   * adapter): /sync skips the reads that would find nothing new (#51). Null in a cluster.
+   */
+  readonly changes: ChangeTracker | null;
   readonly media: MediaAdapter;
   readonly userAuth: ResolvedUserAuth;
   readonly logger: Logger;
@@ -192,6 +208,7 @@ export declare class Homeserver extends EventEmitter {
   readonly rateLimits: RateLimits;
   readonly admin: AdminService;
   readonly oauth: OAuthDelegation | null;
+  readonly oauthServer: OAuthServer | null;
   readonly sso: SsoService | null;
   readonly federation: FederationService;
   readonly delayedEvents: DelayedEventService;

package/dist/homeserver.js

@@ -14,7 +14,9 @@ import { Notifier } from "./core/notifier.js";
 import { StreamManager, localCluster, newInstanceId } from "./core/cluster.js";
 import { TypingService } from "./core/typing.js";
 import { coalesceReads } from "./storage/batch.js";
+import { ChangeTracker } from "./core/changes.js";
 import { PushService } from "./core/push.js";
+import { OAuthServer } from "./core/oauthserver.js";
 import { SsoService } from "./core/sso.js";
 import { AdminService } from "./core/admin.js";
 import { OAuthDelegation } from "./core/oauth.js";
@@ -53,6 +55,11 @@ var Homeserver = class extends EventEmitter {
 	serverName;
 	config;
 	db;
+	/**
+	* Where keys last changed, when this is the only instance on its database (no cluster
+	* adapter): /sync skips the reads that would find nothing new (#51). Null in a cluster.
+	*/
+	changes;
 	media;
 	userAuth;
 	logger;
@@ -69,6 +76,7 @@ var Homeserver = class extends EventEmitter {
 	rateLimits;
 	admin;
 	oauth;
+	oauthServer;
 	sso;
 	federation;
 	delayedEvents;
@@ -115,7 +123,7 @@ var Homeserver = class extends EventEmitter {
 			defaultRoomVersion,
 			accessTokenLifetimeMs: options.accessTokenLifetimeMs ?? null,
 			maxSyncTimeoutMs: options.maxSyncTimeoutMs ?? 3e4,
-			maxConcurrentSyncs: Math.max(1, options.maxConcurrentSyncs ?? 4),
+			maxConcurrentSyncs: Math.max(1, options.maxConcurrentSyncs ?? 16),
 			urlPreviews: options.urlPreviews ? { allowPrivateAddresses: typeof options.urlPreviews === "object" && !!options.urlPreviews.allowPrivateAddresses } : null,
 			thumbnailer: options.thumbnailer ?? null,
 			rtc: options.rtc ?? {},
@@ -125,19 +133,21 @@ var Homeserver = class extends EventEmitter {
 				roomName: options.serverNotices?.roomName ?? "Server Notices"
 			}
 		};
-		const db = options.databaseAdapter;
-		if (db && typeof db.findOne === "function") this.db = coalesceReads(db);
-		else {
+		this.changes = options.cluster ? null : new ChangeTracker();
+		let db = options.databaseAdapter;
+		if (!db || typeof db.findOne !== "function") {
 			this.logger.warn("No database adapter given; using in-memory storage (data is lost on restart)");
-			this.db = memoryAdapter();
+			db = memoryAdapter();
 		}
+		this.db = coalesceReads(this.changes ? this.changes.wrap(db) : db);
 		const media = options.mediaAdapter;
 		this.media = media && typeof media.put === "function" ? media : memoryMedia();
 		this.userAuth = resolveUserAuth(options.userAuthAdapter);
 		this.cluster = options.cluster ?? localCluster();
 		this.instanceId = newInstanceId();
-		this.streams = new StreamManager(this.cluster, this.instanceId);
-		this.notifier = new Notifier(this.cluster, this.instanceId);
+		this.streams = new StreamManager(this.cluster, this.instanceId, (...args) => this.logger.warn(...args));
+		this.notifier = new Notifier(this.cluster, this.instanceId, () => this.streams.lastAllocated, (fresh) => this.streams.position(fresh));
+		this.streams.onAdvance = () => this.notifier.advanced();
 		this.auth = new AuthService(this);
 		this.rooms = new RoomService(this, !options.cluster);
 		this.keys = new KeyService(this);
@@ -145,6 +155,9 @@ var Homeserver = class extends EventEmitter {
 		this.push = new PushService(this);
 		this.admin = new AdminService(this);
 		this.oauth = options.oauth ? new OAuthDelegation(this, options.oauth) : null;
+		if (options.oauthServer && options.oauth) throw new Error("`oauthServer` and `oauth` (delegated OAuth) cannot be used together");
+		if (options.oauthServer && !options.publicBaseUrl) throw new Error("`publicBaseUrl` is required for `oauthServer`");
+		this.oauthServer = options.oauthServer ? new OAuthServer(this, options.oauthServer === true ? {} : options.oauthServer, options.publicBaseUrl) : null;
 		this.fetch = options.fetch ?? globalThis.fetch;
 		this.addressPolicy = addressPolicy(options.allowPrivateAddresses);
 		this.publicFetch = policyFetch(this.addressPolicy, options.fetch);
@@ -159,7 +172,7 @@ var Homeserver = class extends EventEmitter {
 		this.identityServers = new IdentityServers(this);
 		const adminRoom = options.adminRoom === true ? {} : options.adminRoom || null;
 		this.adminRoom = adminRoom && adminRoom.enabled !== false ? new AdminRoomService(this, adminRoom) : null;
-		this.sso = options.sso?.providers.length ? new SsoService(this, options.sso) : null;
+		this.sso = options.sso && (options.sso.providers.length || options.oauthServer) ? new SsoService(this, options.sso) : null;
 		if (this.sso && !options.publicBaseUrl) throw new Error("`publicBaseUrl` is required when SSO is configured");
 		this.rateLimits = options.rateLimits === false ? new RateLimits(null) : new RateLimits(options.rateLimits?.limiter ?? memoryRateLimiter(), options.rateLimits?.rules);
 		const cleanupEvery = options.cleanupIntervalMs ?? 6e5;
@@ -197,6 +210,7 @@ var Homeserver = class extends EventEmitter {
 		}
 		const snap = await this.db.max("state_snapshots", "id");
 		if (snap !== null) await this.streams.advanceTo(snap);
+		this.changes?.start(await this.streams.position(true));
 		const oldest = await this.db.findMany("events", {
 			sortBy: {
 				field: "stream",
@@ -213,7 +227,13 @@ var Homeserver = class extends EventEmitter {
 			limit: 1
 		});
 		if (oldestSnap[0] && oldestSnap[0].id < 0) await this.streams.lowerBackfillTo(oldestSnap[0].id);
-		await this.cluster.advance("federation_outbox", await this.db.max("federation_outbox", "id") ?? 0);
+		for (const model of [
+			"federation_outbox",
+			"audit_log",
+			"event_reports",
+			"user_reports",
+			"appservice_outbox"
+		]) await this.cluster.advance(model, await this.db.max(model, "id") ?? 0);
 		if (this.federation.enabled) this.federation.sender.start();
 		this.delayedEvents.start();
 		this.appservices.start();
@@ -226,7 +246,11 @@ var Homeserver = class extends EventEmitter {
 			field: "expires_ts",
 			operator: "lt",
 			value: now - 6048e5
+		}, {
+			field: "refresh_used",
+			value: true
 		}]);
+		await this.oauthServer?.prune();
 		await this.db.delete("login_tokens", [{
 			field: "expires_ts",
 			operator: "lt",

package/dist/index.d.ts

@@ -5,7 +5,8 @@ import { DatabaseAdapter, FieldDef, FindManyOptions, ModelDef, Operator, Row, Sc
 import { ClusterAdapter, localCluster } from "./core/cluster.js";
 import { AdminService, ServerNoticesOptions } from "./core/admin.js";
 import { OAuthDelegationOptions } from "./core/oauth.js";
-import { SsoOptions, SsoProvider } from "./core/sso.js";
+import { OAuthServerOptions } from "./core/oauthserver.js";
+import { SsoOptions, SsoProvider, githubProvider } from "./core/sso.js";
 import { MatrixError } from "./core/errors.js";
 import { FederationOptions } from "./federation/index.js";
 import { DelayedEventsOptions } from "./core/delayed.js";
@@ -23,4 +24,4 @@ import { MysqlPoolLike, PgPoolLike, SqlAdapterOptions, SqlDialect, SqlExecutor,
 import { schema } from "./storage/schema.js";
 import { S3MediaOptions, s3Media } from "./adapters/s3.js";
 import { PgClusterPoolLike, postgresCluster } from "./adapters/cluster.js";
-export { type AdminRoomOptions, type AdminService, type AppServiceRegistration, type AuditAction, type AuditEntry, type AuditOptions, type ClusterAdapter, type DatabaseAdapter, type DelayedEventsOptions, type FederationOptions, type FieldDef, type FindManyOptions, Homeserver, type HomeserverOptions, type Logger, M, MatrixError, type MediaAdapter, type MediaMetadata, type ModelDef, type MysqlPoolLike, type NodeHandler, type OAuthDelegationOptions, type Operator, type PasswordCheckContext, type PgClusterPoolLike, type PgPoolLike, type RateLimitAction, type RateLimitRule, type RateLimiter, type Row, type RtcOptions, type S3MediaOptions, type Schema, type ServerNoticesOptions, type SqlAdapterOptions, type SqlDialect, type SqlExecutor, type SqliteDatabaseLike, type SsoOptions, type SsoProvider, type ThreepidEmail, type ThreepidOptions, type ThreepidPurpose, type ThreepidSms, type ThumbnailRequest, type Thumbnailer, type TurnOptions, UNSTABLE, type UserAuthAdapter, type WhereClause, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };
+export { type AdminRoomOptions, type AdminService, type AppServiceRegistration, type AuditAction, type AuditEntry, type AuditOptions, type ClusterAdapter, type DatabaseAdapter, type DelayedEventsOptions, type FederationOptions, type FieldDef, type FindManyOptions, Homeserver, type HomeserverOptions, type Logger, M, MatrixError, type MediaAdapter, type MediaMetadata, type ModelDef, type MysqlPoolLike, type NodeHandler, type OAuthDelegationOptions, type OAuthServerOptions, type Operator, type PasswordCheckContext, type PgClusterPoolLike, type PgPoolLike, type RateLimitAction, type RateLimitRule, type RateLimiter, type Row, type RtcOptions, type S3MediaOptions, type Schema, type ServerNoticesOptions, type SqlAdapterOptions, type SqlDialect, type SqlExecutor, type SqliteDatabaseLike, type SsoOptions, type SsoProvider, type ThreepidEmail, type ThreepidOptions, type ThreepidPurpose, type ThreepidSms, type ThumbnailRequest, type Thumbnailer, type TurnOptions, UNSTABLE, type UserAuthAdapter, type WhereClause, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, githubProvider, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };

package/dist/index.js

@@ -1,6 +1,7 @@
 import { M, UNSTABLE } from "./core/m.js";
 import { MatrixError } from "./core/errors.js";
 import { localCluster } from "./core/cluster.js";
+import { githubProvider } from "./core/sso.js";
 import { loadAppServiceRegistrations, parseAppServiceRegistration } from "./core/appservices.js";
 import { memoryRateLimiter } from "./core/ratelimit.js";
 import { filesystemMedia, memoryMedia, sharpThumbnailer } from "./adapters/media.js";
@@ -12,4 +13,4 @@ import { getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, g
 import { mysqlAdapter, postgresAdapter, sqlAdapter, sqliteAdapter } from "./storage/sql.js";
 import { s3Media } from "./adapters/s3.js";
 import { postgresCluster } from "./adapters/cluster.js";
-export { Homeserver, M, MatrixError, UNSTABLE, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };
+export { Homeserver, M, MatrixError, UNSTABLE, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, githubProvider, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };

package/dist/storage/schema.js

@@ -48,10 +48,28 @@ const schema = {
 			user_id: s,
 			device_id: s,
 			refresh_token: sn,
-			expires_ts: nn
+			expires_ts: nn,
+			client_id: sn,
+			scope: sn,
+			refresh_parent: sn,
+			refresh_used: bn
 		},
 		primaryKey: ["token"],
-		indexes: [["user_id"], ["refresh_token"]]
+		indexes: [
+			["user_id"],
+			["refresh_token"],
+			["client_id"],
+			["refresh_parent"]
+		]
+	},
+	oauth_clients: {
+		fields: {
+			client_id: s,
+			metadata: j,
+			created_ts: n
+		},
+		primaryKey: ["client_id"],
+		indexes: [["created_ts"]]
 	},
 	rooms: {
 		fields: {

package/dist/storage/sql.js

@@ -207,8 +207,8 @@ function sqlAdapter({ dialect, executor: rootExecutor, tablePrefix = "", transac
 	};
 	return build(rootExecutor, false);
 }
-/** How long SQLite statements may run back to back before yielding to the event loop (#47). */
-const YIELD_AFTER_MS = 10;
+/** How long SQLite statements may run back to back before yielding to the event loop (#47, #52). */
+const YIELD_AFTER_MS = 50;
 /** Prepared statements an SQLite adapter keeps (#40). */
 const STATEMENT_CACHE = 500;
 /** SQLite adapter for `node:sqlite` (`new DatabaseSync(path)`) or `better-sqlite3`. */

package/dist/vendor/zod/v4/classic/errors.js

@@ -1,7 +1,7 @@
 import { jsonStringifyReplacer } from "../core/util.js";
 import { $constructor } from "../core/core.js";
 import { $ZodError, flattenError, formatError } from "../core/errors.js";
-//#region node_modules/zod/v4/classic/errors.js
+//#region ../../node_modules/zod/v4/classic/errors.js
 const _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
 	Object.defineProperty(proto, key, {

package/dist/vendor/zod/v4/classic/parse.js

@@ -1,6 +1,6 @@
 import { _decode, _decodeAsync, _encode, _encodeAsync, _parse, _parseAsync, _safeDecode, _safeDecodeAsync, _safeEncode, _safeEncodeAsync, _safeParse, _safeParseAsync } from "../core/parse.js";
 import { ZodRealError } from "./errors.js";
-//#region node_modules/zod/v4/classic/parse.js
+//#region ../../node_modules/zod/v4/classic/parse.js
 const parse = /* @__PURE__ */ _parse(ZodRealError);
 const parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 const safeParse = /* @__PURE__ */ _safeParse(ZodRealError);

package/dist/vendor/zod/v4/classic/schemas.js

@@ -9,7 +9,7 @@ import { _array, _base64, _base64url, _boolean, _cidrv4, _cidrv6, _cuid, _cuid2,
 import { createStandardJSONSchemaMethod, createToJSONSchemaMethod } from "../core/to-json-schema.js";
 import { aggregateChecks, arrayProcessor, booleanProcessor, catchProcessor, customProcessor, defaultProcessor, enumProcessor, intersectionProcessor, neverProcessor, nonoptionalProcessor, nullableProcessor, numberProcessor, objectProcessor, optionalProcessor, pipeProcessor, prefaultProcessor, readonlyProcessor, recordProcessor, stringProcessor, transformProcessor, unionProcessor, unknownProcessor } from "../core/json-schema-processors.js";
 import { decode, decodeAsync, encode, encodeAsync, parse, parseAsync, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync } from "./parse.js";
-//#region node_modules/zod/v4/classic/schemas.js
+//#region ../../node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
 	if (!globalConfig.localeError) config(en_default());
 }

package/dist/vendor/zod/v4/core/api.js

@@ -1,6 +1,6 @@
 import { issue, normalizeParams, slugify } from "./util.js";
 import { $ZodCheck, $ZodCheckEndsWith, $ZodCheckGreaterThan, $ZodCheckIncludes, $ZodCheckLengthEquals, $ZodCheckLessThan, $ZodCheckLowerCase, $ZodCheckMaxLength, $ZodCheckMinLength, $ZodCheckMultipleOf, $ZodCheckOverwrite, $ZodCheckRegex, $ZodCheckStartsWith, $ZodCheckUpperCase } from "./checks.js";
-//#region node_modules/zod/v4/core/api.js
+//#region ../../node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
 	if (def.checks) def.checks = [...def.checks];
 	return def;