mcp-trellis 1.0.0 → 2.1.0

package/dist/oauth/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/oauth/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB,EAAE,oBAAoB;IACvC,YAAY,EAAE,eAAe;CACrB,CAAC;AAIX,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,cAAc,EAAE,iBAAiB;IACjC,YAAY,EAAE,eAAe;IAC7B,oBAAoB,EAAE,wBAAwB;IAC9C,kBAAkB,EAAE,sBAAsB;IAC1C,+EAA+E;IAC/E,aAAa,EAAE,gBAAgB;IAC/B,uFAAuF;IACvF,kBAAkB,EAAE,qBAAqB;IACzC,kGAAkG;IAClG,uBAAuB,EAAE,2BAA2B;IACpD,2DAA2D;IAC3D,YAAY,EAAE,eAAe;IAC7B,uDAAuD;IACvD,aAAa,EAAE,gBAAgB;IAC/B,iFAAiF;IACjF,WAAW,EAAE,cAAc;IAC3B,6DAA6D;IAC7D,YAAY,EAAE,eAAe;CACrB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,8CAA8C;IAC9C,IAAI,EAAE,MAAM;IACZ,+CAA+C;IAC/C,KAAK,EAAE,qBAAqB;IAC5B,uCAAuC;IACvC,IAAI,EAAE,oBAAoB;CAClB,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/oauth/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB,EAAE,oBAAoB;IACvC,YAAY,EAAE,eAAe;CACrB,CAAC;AAIX,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,cAAc,EAAE,iBAAiB;IACjC,YAAY,EAAE,eAAe;IAC7B,oBAAoB,EAAE,wBAAwB;IAC9C,kBAAkB,EAAE,sBAAsB;IAC1C,4FAA4F;IAC5F,qBAAqB,EAAE,yBAAyB;IAChD,+EAA+E;IAC/E,aAAa,EAAE,gBAAgB;IAC/B,uFAAuF;IACvF,kBAAkB,EAAE,qBAAqB;IACzC,kGAAkG;IAClG,uBAAuB,EAAE,2BAA2B;IACpD,2DAA2D;IAC3D,YAAY,EAAE,eAAe;IAC7B,uDAAuD;IACvD,aAAa,EAAE,gBAAgB;IAC/B,iFAAiF;IACjF,WAAW,EAAE,cAAc;IAC3B,6DAA6D;IAC7D,YAAY,EAAE,eAAe;CACrB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,8CAA8C;IAC9C,IAAI,EAAE,MAAM;IACZ,+CAA+C;IAC/C,KAAK,EAAE,qBAAqB;IAC5B,uCAAuC;IACvC,IAAI,EAAE,oBAAoB;CAClB,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC"}

package/dist/oauth/{base64url.d.ts → crypto/base64url.d.ts}

@@ -1,5 +1,4 @@
 /** Shared base64url helpers (WebCrypto / DOM — no Node Buffer). */
 export declare const bytesToBase64Url: (bytes: ArrayBuffer | Uint8Array) => string;
-export declare const textToBase64Url: (text: string) => string;
 export declare const fromBase64Url: (text: string) => Uint8Array<ArrayBuffer>;
 //# sourceMappingURL=base64url.d.ts.map

package/dist/oauth/crypto/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,eAAO,MAAM,gBAAgB,GAAI,OAAO,WAAW,GAAG,UAAU,KAAG,MAIlE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,UAAU,CAAC,WAAW,CAKlE,CAAC"}

package/dist/oauth/{base64url.js → crypto/base64url.js}

@@ -4,7 +4,6 @@ export const bytesToBase64Url = (bytes) => {
     const binary = Array.from(u8, (byte) => String.fromCharCode(byte)).join("");
     return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 };
-export const textToBase64Url = (text) => bytesToBase64Url(new TextEncoder().encode(text));
 export const fromBase64Url = (text) => {
     const padded = text.replace(/-/g, "+").replace(/_/g, "/");
     const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));

package/dist/oauth/crypto/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../../src/oauth/crypto/base64url.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAA+B,EAAU,EAAE;IAC1E,MAAM,EAAE,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAA2B,EAAE;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC"}

package/dist/oauth/crypto/clientauth.d.ts

@@ -0,0 +1,13 @@
+/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
+import { type TokenEndpointAuthMethod } from "../constants.js";
+import type { OAuthRouterOptions } from "../types.js";
+export type ClientAuth = {
+    clientId: string;
+    secret: string | null;
+    method: TokenEndpointAuthMethod;
+};
+/** Credentials from the Authorization header, else from the body. */
+export declare const readClientAuth: (request: Request, body: Record<string, string>) => ClientAuth | null;
+/** Enforce the registered auth method for known clients — see the helpers above for each branch. */
+export declare const firstClientAuthError: (auth: ClientAuth, options: OAuthRouterOptions, request: Request) => Promise<Response | null>;
+//# sourceMappingURL=clientauth.d.ts.map

package/dist/oauth/crypto/clientauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAU9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAIrB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AA6BF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAaf,CAAC;AA2LF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,EAC3B,SAAS,OAAO,KACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAMzB,CAAC"}

package/dist/oauth/crypto/clientauth.js

@@ -0,0 +1,195 @@
+/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
+import { auditLegacyKeyUsage, safeOAuthAudit } from "../audit.js";
+import { cimdFetchOpts, isCimdClientId, resolveCimdClient } from "../cimd/cimd.js";
+import { oauthError, registeredClientsRequired, resolveSecrets, unregisteredClientsAllowed, } from "../config.js";
+import { OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "../constants.js";
+import { unsealAny } from "./sealed.js";
+import { verifyClientSecretAny } from "./secrethash.js";
+/** RFC 7235 §2.1 — the auth-scheme token is case-insensitive. */
+const BASIC_SCHEME_RE = /^basic\s+/i;
+/** RFC 6749 §2.3.1 — id and secret are form-urlencoded, so `+` means a space. */
+const decodeFormComponent = (value) => decodeURIComponent(value.replace(/\+/g, " "));
+/** `Authorization: Basic base64(urlencode(id):urlencode(secret))`. */
+const parseBasicAuth = (header) => {
+    const scheme = header ? BASIC_SCHEME_RE.exec(header) : null;
+    if (!header || !scheme)
+        return null;
+    try {
+        const decoded = atob(header.slice(scheme[0].length).trim());
+        const separator = decoded.indexOf(":");
+        if (separator < 0)
+            return null;
+        const clientId = decodeFormComponent(decoded.slice(0, separator));
+        if (!clientId)
+            return null;
+        return {
+            clientId,
+            secret: decodeFormComponent(decoded.slice(separator + 1)),
+            method: TOKEN_ENDPOINT_AUTH_METHODS.basic,
+        };
+    }
+    catch {
+        return null;
+    }
+};
+/** Credentials from the Authorization header, else from the body. */
+export const readClientAuth = (request, body) => {
+    const basic = parseBasicAuth(request.headers.get("Authorization"));
+    if (basic)
+        return basic;
+    const clientId = body.client_id ?? "";
+    if (!clientId)
+        return null;
+    const secret = body.client_secret ?? "";
+    return {
+        clientId,
+        secret: secret.length > 0 ? secret : null,
+        method: secret.length > 0 ? TOKEN_ENDPOINT_AUTH_METHODS.post : TOKEN_ENDPOINT_AUTH_METHODS.none,
+    };
+};
+/**
+ * Every failure below returns the same code, status, and description.
+ * Distinguishable messages here ("client requires client_secret_basic" vs.
+ * "unknown client_id" vs. "client_secret required" vs. …) let an
+ * unauthenticated caller enumerate which client_ids this server actually
+ * knows about and how each is configured, just by reading error text —
+ * a real information leak on the one endpoint whose entire job is to
+ * reject an untrusted caller. `/authorize`'s `unauthorized_client` stays
+ * descriptive on purpose: it's a human debugging an OAuth flow in a
+ * browser, not a bare API response, and a locked-down server already
+ * announces the same fact by omitting `registration_endpoint` from its
+ * metadata.
+ */
+const CLIENT_AUTH_FAILED = "client authentication failed";
+/** The generic response every failure below returns to the caller. */
+const invalidClient = () => oauthError(OAUTH_ERRORS.invalidClient, 401, CLIENT_AUTH_FAILED);
+/** The response above, plus the real reason to `ports.audit` — never to the caller. */
+const invalidClientAudited = async ({ auth, options }, reason) => {
+    await safeOAuthAudit(options, { event: "client_auth_failed", clientId: auth.clientId, reason });
+    return invalidClient();
+};
+/**
+ * Never a real credential — exists only so the locked-down branch below
+ * does the same amount of comparison work whether or not a secret was
+ * actually presented, and whether or not a stored hash actually exists.
+ */
+const DUMMY_SECRET = "dummy-secret-for-constant-time-padding";
+const DUMMY_STORED_HASH = "hmac-sha256$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+/**
+ * Rejects with `reason`, but only after paying the same
+ * `verifyClientSecretAny` cost a real (wrong-secret) rejection would — a
+ * missing or empty secret is replaced by `DUMMY_SECRET`, so a caller who
+ * presented nothing can't be told apart, by timing, from a wrong secret.
+ */
+const rejectWithDummyCompare = async (context, reason) => {
+    const codeSecretValues = await resolveSecrets(context.options.ports, context.request);
+    const presented = context.auth.secret || DUMMY_SECRET;
+    await verifyClientSecretAny(presented, DUMMY_STORED_HASH, codeSecretValues);
+    return invalidClientAudited(context, reason);
+};
+/**
+ * True when `clientId` is this server's own sealed `/register` assertion or,
+ * with CIMD enabled, a resolvable CIMD document. URL-shaped ids are always
+ * re-resolved, never accepted by shape alone.
+ */
+const isSelfRegisteredOrCimdClient = async ({ auth, options, request, }) => {
+    const codeSecretValues = await resolveSecrets(options.ports, request);
+    const unsealed = await unsealAny(codeSecretValues, "client", auth.clientId);
+    if (unsealed) {
+        await auditLegacyKeyUsage(options, {
+            clientId: auth.clientId,
+            keyIndex: unsealed.keyIndex,
+            source: "client assertion unsealed",
+        });
+        return true;
+    }
+    if (options.cimd !== true || !isCimdClientId(auth.clientId))
+        return false;
+    if (await resolveCimdClient(auth.clientId, cimdFetchOpts(options)))
+        return true;
+    // Without `cimdCache` every refresh/revoke re-fetches — a flaky document
+    // host logs users out. Surface that distinctly.
+    await safeOAuthAudit(options, {
+        event: "cimd_resolve_failed",
+        clientId: auth.clientId,
+        reason: "CIMD document could not be resolved at token/revoke time",
+    });
+    return false;
+};
+/**
+ * An unknown client_id is treated as public — PKCE is its only proof —
+ * unless `allowUnregisteredClients` is false, in which case it is rejected.
+ * On that locked-down path a dummy secret comparison runs even for a
+ * client_id this server has never heard of, so timing can't distinguish
+ * "unknown" from "known, wrong secret". Public clients never pay that cost.
+ *
+ * Under `requireRegisteredClients`, a client_id resolved by neither
+ * `clientStore`, this server's own sealed `/register` assertion, nor CIMD is
+ * rejected — the same rule `/authorize` enforces. It lives in this shared
+ * gate so the `refresh_token` grant and `/revoke` cannot be reached with an
+ * invented id that never went through `/authorize`.
+ */
+const unregisteredClientAuthError = async (context) => {
+    if (!unregisteredClientsAllowed(context.options)) {
+        return rejectWithDummyCompare(context, "unknown client_id");
+    }
+    if (!registeredClientsRequired(context.options))
+        return null;
+    if (await isSelfRegisteredOrCimdClient(context))
+        return null;
+    return invalidClientAudited(context, "client_id must come from clientStore or this server's own /register");
+};
+/** Compare against `ClientStore.secretHash` — the same cost whether a hash is on file or not. */
+const secretHashAuthError = async (context, secret, secretHash) => {
+    const { auth, options, request } = context;
+    const codeSecretValues = await resolveSecrets(options.ports, request);
+    const stored = await secretHash(auth.clientId);
+    const { ok, keyIndex } = await verifyClientSecretAny(secret, stored ?? DUMMY_STORED_HASH, codeSecretValues);
+    if (ok && stored !== null) {
+        await auditLegacyKeyUsage(options, {
+            clientId: auth.clientId,
+            keyIndex,
+            source: "client_secret_hash verified",
+        });
+        return null;
+    }
+    return invalidClientAudited(context, stored === null ? "no secretHash on file for this client" : "secretHash mismatch");
+};
+/** Delegate the comparison to the host's `ClientStore.verifySecret`. */
+const verifySecretAuthError = async (context, secret, verifySecret) => {
+    if (!verifySecret) {
+        return invalidClientAudited(context, "clientStore.verifySecret is not configured");
+    }
+    if (!(await verifySecret(context.auth.clientId, secret))) {
+        return invalidClientAudited(context, "verifySecret returned false");
+    }
+    return null;
+};
+/** Enforce a known client's own `tokenEndpointAuthMethod`. */
+const registeredClientAuthError = async (context, registered) => {
+    const { auth, options } = context;
+    const expected = registered.tokenEndpointAuthMethod;
+    if (expected === TOKEN_ENDPOINT_AUTH_METHODS.none)
+        return null;
+    // A wrong method or a missing secret pays the same comparison cost as a
+    // wrong secret, so neither branch leaks "this client exists and needs a
+    // secret" through response timing.
+    if (auth.method !== expected) {
+        return rejectWithDummyCompare(context, `client requires ${expected}, got ${auth.method}`);
+    }
+    if (!auth.secret)
+        return rejectWithDummyCompare(context, "client_secret required");
+    const store = options.ports.clientStore;
+    return store?.secretHash
+        ? secretHashAuthError(context, auth.secret, store.secretHash)
+        : verifySecretAuthError(context, auth.secret, store?.verifySecret);
+};
+/** Enforce the registered auth method for known clients — see the helpers above for each branch. */
+export const firstClientAuthError = async (auth, options, request) => {
+    const context = { auth, options, request };
+    const registered = (await options.ports.clientStore?.get(auth.clientId)) ?? null;
+    return registered
+        ? registeredClientAuthError(context, registered)
+        : unregisteredClientAuthError(context);
+};
+//# sourceMappingURL=clientauth.js.map

package/dist/oauth/crypto/clientauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientauth.js","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQxD,iEAAiE;AACjE,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAU,EAAE,CACpD,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEhD,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAqB,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACzD,MAAM,EAAE,2BAA2B,CAAC,KAAK;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAgB,EAChB,IAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI;KAChG,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAS1D,sEAAsE;AACtE,MAAM,aAAa,GAAG,GAAa,EAAE,CACnC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;AAElE,uFAAuF;AACvF,MAAM,oBAAoB,GAAG,KAAK,EAChC,EAAE,IAAI,EAAE,OAAO,EAAqB,EACpC,MAAc,EACK,EAAE;IACrB,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA0B,EAC1B,MAAc,EACK,EAAE;IACrB,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IACtD,MAAM,qBAAqB,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,EAAE,EAC1C,IAAI,EACJ,OAAO,EACP,OAAO,GACW,EAAoB,EAAE;IACxC,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7F,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1E,IAAI,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,cAAc,CAAC,OAAO,EAAE;QAC5B,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,0DAA0D;KACnE,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,2BAA2B,GAAG,KAAK,EACvC,OAA0B,EACA,EAAE;IAC5B,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,MAAM,4BAA4B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,oBAAoB,CACzB,OAAO,EACP,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,KAAK,EAC/B,OAA0B,EAC1B,MAAc,EACd,UAAkD,EACxB,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,CAClD,MAAM,EACN,MAAM,IAAI,iBAAiB,EAC3B,gBAAgB,CACjB,CAAC;IACF,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CACzB,OAAO,EACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,qBAAqB,CAClF,CAAC;AACJ,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA0B,EAC1B,MAAc,EACd,YAAyC,EACf,EAAE;IAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,oBAAoB,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,oBAAoB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,yBAAyB,GAAG,KAAK,EACrC,OAA0B,EAC1B,UAA4B,EACF,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,IAAI,QAAQ,KAAK,2BAA2B,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,wEAAwE;IACxE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,OAAO,KAAK,EAAE,UAAU;QACtB,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC;QAC7D,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAA2B,EAC3B,OAAgB,EACU,EAAE;IAC5B,MAAM,OAAO,GAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IACjF,OAAO,UAAU;QACf,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,CAAC;QAChD,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC"}

package/dist/oauth/crypto/codes.d.ts

@@ -0,0 +1,65 @@
+export type AuthCodeRecord = {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    /** Consenting user id — required so minted tokens are bound. */
+    userId: string;
+    /** RFC 8707 resource indicator — audience for the eventual access token. */
+    resource: string;
+    /** Space-delimited scope granted at authorize time. */
+    scope: string;
+    exp: number;
+};
+export type CodeStore = {
+    /**
+     * Mark a code jti as consumed; return false if already used.
+     * `expMs` is the code expiry (ms since epoch) for TTL-backed stores.
+     */
+    consume: (jti: string, expMs: number) => Promise<boolean> | boolean;
+};
+/**
+ * Process-local jti → expMs map when no shared codeStore is provided.
+ * ponytail: single-process only; multi-instance → pass ports.codeStore (KV/Redis SET NX EX).
+ */
+export declare const createMemoryCodeStore: () => CodeStore;
+/**
+ * The one process-wide in-memory store. Shared rather than per router: an
+ * app built per request (`buildApp(env).fetch(req)`) would otherwise get a
+ * fresh map each time and lose single-use entirely. `createOAuthRouter`
+ * resolves it into `ports.codeStore` only when `allowInMemoryCodeStore` is
+ * set; endpoint handlers never fall back on their own.
+ */
+export declare const processCodeStore: CodeStore;
+/**
+ * Issue an AES-GCM sealed auth code (v2). Single-use via codeStore, or
+ * pruning in-memory Map when omitted.
+ */
+export declare const issueAuthCode: (secret: string, record: Omit<AuthCodeRecord, "exp">, nowMs?: number) => Promise<string>;
+/**
+ * Rotation-aware `consumeAuthCode`, also reporting which `secret` entry
+ * actually unsealed the code — used only by `token.ts` to audit
+ * `"legacy_code_secret_used"` without a second decrypt pass. Not part of
+ * the public API; `consumeAuthCode` below is the stable, exported surface.
+ */
+export declare const consumeAuthCodeDetailed: (secret: string | readonly string[], code: string, options?: {
+    codeStore?: CodeStore | undefined;
+    nowMs?: number | undefined;
+}) => Promise<{
+    record: AuthCodeRecord;
+    keyIndex: number;
+} | null>;
+/**
+ * `secret` may be a single key or a list — every entry is tried, so a code
+ * sealed under an older `codeSecret` keeps redeeming during rotation. See
+ * `resolveSecrets`/`OAuthPorts.codeSecret` for the rotation contract.
+ *
+ * Omitting `options.codeStore` is deprecated: it falls back to a
+ * process-local map that cannot enforce single use across instances, and
+ * `codeStore` becomes required in 3.0.
+ */
+export declare const consumeAuthCode: (secret: string | readonly string[], code: string, options?: {
+    codeStore?: CodeStore | undefined;
+    nowMs?: number | undefined;
+}) => Promise<AuthCodeRecord | null>;
+export declare const newClientId: () => string;
+//# sourceMappingURL=codes.d.ts.map

package/dist/oauth/crypto/codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/codes.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACrE,CAAC;AAQF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAO,SAiBxC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAmC,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,QAAQ,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EACnC,cAAkB,KACjB,OAAO,CAAC,MAAM,CAOhB,CAAC;AAmCF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,QAAQ,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,MAAM,MAAM,EACZ,UAAS;IAAE,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,KAC9E,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAqB7D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,MAAM,MAAM,EACZ,UAAS;IAAE,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,KAC9E,OAAO,CAAC,cAAc,GAAG,IAAI,CAG/B,CAAC;AAEF,eAAO,MAAM,WAAW,QAAO,MAA6B,CAAC"}

package/dist/oauth/crypto/codes.js

@@ -0,0 +1,121 @@
+import { randomBase64Url } from "./pkce.js";
+import { seal, unsealAny } from "./sealed.js";
+const CODE_TTL_MS = 600_000;
+/** AES-GCM sealed auth codes — authenticated and encrypted (see `sealed.ts`). */
+const SEALED_PREFIX = "v2.";
+/**
+ * Prune the in-memory store at most this often: a full `Map` scan on every
+ * `consume` would run for every code and consent-ticket redemption.
+ */
+const PRUNE_INTERVAL_MS = 60_000;
+/**
+ * Process-local jti → expMs map when no shared codeStore is provided.
+ * ponytail: single-process only; multi-instance → pass ports.codeStore (KV/Redis SET NX EX).
+ */
+export const createMemoryCodeStore = () => {
+    const used = new Map();
+    let lastPrunedAtMs = 0;
+    return {
+        consume: (jti, expMs) => {
+            const nowMs = Date.now();
+            if (nowMs - lastPrunedAtMs >= PRUNE_INTERVAL_MS) {
+                lastPrunedAtMs = nowMs;
+                for (const [key, exp] of used) {
+                    if (exp < nowMs)
+                        used.delete(key);
+                }
+            }
+            if (used.has(jti))
+                return false;
+            used.set(jti, expMs);
+            return true;
+        },
+    };
+};
+/**
+ * The one process-wide in-memory store. Shared rather than per router: an
+ * app built per request (`buildApp(env).fetch(req)`) would otherwise get a
+ * fresh map each time and lose single-use entirely. `createOAuthRouter`
+ * resolves it into `ports.codeStore` only when `allowInMemoryCodeStore` is
+ * set; endpoint handlers never fall back on their own.
+ */
+export const processCodeStore = createMemoryCodeStore();
+/**
+ * Issue an AES-GCM sealed auth code (v2). Single-use via codeStore, or
+ * pruning in-memory Map when omitted.
+ */
+export const issueAuthCode = async (secret, record, nowMs = Date.now()) => {
+    const body = {
+        ...record,
+        exp: nowMs + CODE_TTL_MS,
+        jti: randomBase64Url(12),
+    };
+    return `${SEALED_PREFIX}${await seal(secret, "code", body)}`;
+};
+const shapeCheckedRecord = (data, nowMs) => {
+    if (typeof data.clientId !== "string" ||
+        typeof data.redirectUri !== "string" ||
+        typeof data.codeChallenge !== "string" ||
+        typeof data.userId !== "string" ||
+        typeof data.resource !== "string" ||
+        data.resource.length === 0 ||
+        typeof data.scope !== "string" ||
+        typeof data.exp !== "number" ||
+        data.exp < nowMs ||
+        typeof data.jti !== "string" ||
+        data.jti.length === 0) {
+        return null;
+    }
+    return {
+        clientId: data.clientId,
+        redirectUri: data.redirectUri,
+        codeChallenge: data.codeChallenge,
+        userId: data.userId,
+        resource: data.resource,
+        scope: data.scope,
+        exp: data.exp,
+        jti: data.jti,
+    };
+};
+/**
+ * Rotation-aware `consumeAuthCode`, also reporting which `secret` entry
+ * actually unsealed the code — used only by `token.ts` to audit
+ * `"legacy_code_secret_used"` without a second decrypt pass. Not part of
+ * the public API; `consumeAuthCode` below is the stable, exported surface.
+ */
+export const consumeAuthCodeDetailed = async (secret, code, options = {}) => {
+    const secrets = (Array.isArray(secret) ? secret : [secret]).filter((candidate) => Boolean(candidate));
+    if (!code || secrets.length === 0)
+        return null;
+    // Only AES-GCM sealed (`v2.`) codes redeem.
+    if (!code.startsWith(SEALED_PREFIX))
+        return null;
+    const nowMs = options.nowMs ?? Date.now();
+    const unsealed = await unsealAny(secrets, "code", code.slice(SEALED_PREFIX.length));
+    if (!unsealed)
+        return null;
+    const record = shapeCheckedRecord(unsealed.value, nowMs);
+    if (!record)
+        return null;
+    const store = options.codeStore ?? processCodeStore;
+    const fresh = await store.consume(record.jti, record.exp);
+    if (!fresh)
+        return null;
+    const { jti: _jti, ...rest } = record;
+    return { record: rest, keyIndex: unsealed.keyIndex };
+};
+/**
+ * `secret` may be a single key or a list — every entry is tried, so a code
+ * sealed under an older `codeSecret` keeps redeeming during rotation. See
+ * `resolveSecrets`/`OAuthPorts.codeSecret` for the rotation contract.
+ *
+ * Omitting `options.codeStore` is deprecated: it falls back to a
+ * process-local map that cannot enforce single use across instances, and
+ * `codeStore` becomes required in 3.0.
+ */
+export const consumeAuthCode = async (secret, code, options = {}) => {
+    const result = await consumeAuthCodeDetailed(secret, code, options);
+    return result?.record ?? null;
+};
+export const newClientId = () => randomBase64Url(16);
+//# sourceMappingURL=codes.js.map

package/dist/oauth/crypto/codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../../src/oauth/crypto/codes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,iFAAiF;AACjF,MAAM,aAAa,GAAG,KAAK,CAAC;AAuB5B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAc,EAAE;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,KAAK,GAAG,cAAc,IAAI,iBAAiB,EAAE,CAAC;gBAChD,cAAc,GAAG,KAAK,CAAC;gBACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oBAC9B,IAAI,GAAG,GAAG,KAAK;wBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc,qBAAqB,EAAE,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAc,EACd,MAAmC,EACnC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EACD,EAAE;IACnB,MAAM,IAAI,GAAqC;QAC7C,GAAG,MAAM;QACT,GAAG,EAAE,KAAK,GAAG,WAAW;QACxB,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;KACzB,CAAC;IACF,OAAO,GAAG,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AAIF,MAAM,kBAAkB,GAAG,CACzB,IAAiB,EACjB,KAAa,EAC8B,EAAE;IAC7C,IACE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QACtC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAC5B,IAAI,CAAC,GAAG,GAAG,KAAK;QAChB,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EACrB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC1C,MAAkC,EAClC,IAAY,EACZ,UAA6E,EAAE,EACjB,EAAE;IAChE,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAChE,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CACvD,CAAC;IACF,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,4CAA4C;IAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAc,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACtC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAkC,EAClC,IAAY,EACZ,UAA6E,EAAE,EAC/C,EAAE;IAClC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC"}

package/dist/oauth/crypto/hkdf.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Purpose-bound keys derived from `codeSecret` with HKDF-SHA256, cached so
+ * rotation (`unsealAny`, `verifyClientSecretAny`) doesn't re-run
+ * `importKey` + `deriveKey` for every entry on every request.
+ */
+/** What a derived key is for. `info` is the domain separator: one value per purpose. */
+export type HkdfKeyPurpose = {
+    info: string;
+    algorithm: AesKeyGenParams | HmacKeyGenParams;
+    usage: KeyUsage;
+};
+export declare const hkdfKey: (secret: string, purpose: HkdfKeyPurpose) => Promise<CryptoKey>;
+//# sourceMappingURL=hkdf.d.ts.map

package/dist/oauth/crypto/hkdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hkdf.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/hkdf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,wFAAwF;AACxF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,eAAe,GAAG,gBAAgB,CAAC;IAC9C,KAAK,EAAE,QAAQ,CAAC;CACjB,CAAC;AAgCF,eAAO,MAAM,OAAO,GAAU,QAAQ,MAAM,EAAE,SAAS,cAAc,KAAG,OAAO,CAAC,SAAS,CAGxF,CAAC"}

package/dist/oauth/crypto/hkdf.js

@@ -0,0 +1,30 @@
+/**
+ * Purpose-bound keys derived from `codeSecret` with HKDF-SHA256, cached so
+ * rotation (`unsealAny`, `verifyClientSecretAny`) doesn't re-run
+ * `importKey` + `deriveKey` for every entry on every request.
+ */
+import { bytesToBase64Url } from "./base64url.js";
+import { createBoundedCache, settleCached } from "./keycache.js";
+const deriveKey = async (secret, purpose) => {
+    const encoder = new TextEncoder();
+    const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, [
+        "deriveKey",
+    ]);
+    return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: encoder.encode(purpose.info) }, material, purpose.algorithm, false, [purpose.usage]);
+};
+/**
+ * SHA-256 fingerprint of `secret` for the cache key — not a KDF. Keeps the
+ * plaintext secret out of Map key space (material still lives inside the
+ * derived CryptoKey).
+ */
+const secretFingerprint = async (secret) => {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`mcp-trellis:cache-key:${secret}`));
+    return bytesToBase64Url(digest);
+};
+const KEY_CACHE_LIMIT = 64;
+const keyCache = createBoundedCache(KEY_CACHE_LIMIT);
+export const hkdfKey = async (secret, purpose) => {
+    const cacheKey = `${purpose.info}:${purpose.usage}:${await secretFingerprint(secret)}`;
+    return settleCached(keyCache, cacheKey, () => deriveKey(secret, purpose));
+};
+//# sourceMappingURL=hkdf.js.map

package/dist/oauth/crypto/hkdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hkdf.js","sourceRoot":"","sources":["../../../src/oauth/crypto/hkdf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AASjE,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,OAAuB,EAAsB,EAAE;IACtF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QAC3F,WAAW;KACZ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAC9F,QAAQ,EACR,OAAO,CAAC,SAAS,EACjB,KAAK,EACL,CAAC,OAAO,CAAC,KAAK,CAAC,CAChB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAC5D,CAAC;IACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,QAAQ,GAAG,kBAAkB,CAAqB,eAAe,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,OAAuB,EAAsB,EAAE;IAC3F,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;IACvF,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC"}

package/dist/oauth/crypto/keycache.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A small bounded cache, used by `hkdf.ts` for derived `CryptoKey`s.
+ *
+ * Insertion-order eviction, not true LRU — simpler, and the expected key
+ * count (a handful of rotation entries, rarely changing at runtime) stays
+ * well under the cap in ordinary use, so eviction order rarely matters in
+ * practice. The cap itself exists for the discouraged-but-possible case of
+ * a function-form `codeSecret` returning a different value on every call,
+ * which would otherwise grow this cache without bound.
+ */
+export type BoundedCache<V> = {
+    get: (key: string) => V | undefined;
+    set: (key: string, value: V) => void;
+    delete: (key: string) => void;
+};
+export declare const createBoundedCache: <V>(limit: number) => BoundedCache<V>;
+/** Cache a promise; drop the entry if it rejects so the slot is not poisoned. */
+export declare const settleCached: <T>(cache: BoundedCache<Promise<T>>, key: string, create: () => Promise<T>) => Promise<T>;
+//# sourceMappingURL=keycache.d.ts.map

package/dist/oauth/crypto/keycache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycache.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/keycache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI;IAC5B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,SAAS,CAAC;IACpC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;IACrC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,CAAC,EAAE,OAAO,MAAM,KAAG,YAAY,CAAC,CAAC,CAenE,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,YAAY,GAAU,CAAC,EAClC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAC/B,KAAK,MAAM,EACX,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC,KACvB,OAAO,CAAC,CAAC,CAWX,CAAC"}

package/dist/oauth/crypto/keycache.js

@@ -0,0 +1,44 @@
+/**
+ * A small bounded cache, used by `hkdf.ts` for derived `CryptoKey`s.
+ *
+ * Insertion-order eviction, not true LRU — simpler, and the expected key
+ * count (a handful of rotation entries, rarely changing at runtime) stays
+ * well under the cap in ordinary use, so eviction order rarely matters in
+ * practice. The cap itself exists for the discouraged-but-possible case of
+ * a function-form `codeSecret` returning a different value on every call,
+ * which would otherwise grow this cache without bound.
+ */
+export const createBoundedCache = (limit) => {
+    const map = new Map();
+    return {
+        get: (key) => map.get(key),
+        set: (key, value) => {
+            if (!map.has(key) && map.size >= limit) {
+                const oldest = map.keys().next().value;
+                if (oldest !== undefined)
+                    map.delete(oldest);
+            }
+            map.set(key, value);
+        },
+        delete: (key) => {
+            map.delete(key);
+        },
+    };
+};
+/** Cache a promise; drop the entry if it rejects so the slot is not poisoned. */
+export const settleCached = async (cache, key, create) => {
+    const cached = cache.get(key);
+    if (cached)
+        return cached;
+    const pending = create();
+    cache.set(key, pending);
+    try {
+        return await pending;
+    }
+    catch (caught) {
+        if (cache.get(key) === pending)
+            cache.delete(key);
+        throw caught;
+    }
+};
+//# sourceMappingURL=keycache.js.map

package/dist/oauth/crypto/keycache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycache.js","sourceRoot":"","sources":["../../../src/oauth/crypto/keycache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAI,KAAa,EAAmB,EAAE;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAClB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACvC,IAAI,MAAM,KAAK,SAAS;oBAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,KAA+B,EAC/B,GAAW,EACX,MAAwB,EACZ,EAAE;IACd,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC;IACf,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/crypto/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/pkce.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAGnE,CAAC;AAEF,eAAO,MAAM,cAAc,GAAU,UAAU,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CAIzF,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,KAAG,MAGjD,CAAC"}

package/dist/oauth/{pkce.js → crypto/pkce.js}

@@ -1,4 +1,4 @@
-import { timingSafeEqual } from "../auth/bearer.js";
+import { timingSafeEqual } from "../../auth/bearer.js";
 import { bytesToBase64Url } from "./base64url.js";
 export const sha256Base64Url = async (input) => {
     const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));

package/dist/oauth/crypto/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/oauth/crypto/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAmB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,SAAiB,EAAoB,EAAE;IAC5F,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC,CAAC"}

package/dist/oauth/{sealed.d.ts → crypto/sealed.d.ts}

@@ -1,7 +1,6 @@
 /**
- * AES-GCM sealing for short-lived, self-describing tokens derived from the
- * same `codeSecret` as auth codes (HMAC today, AES-GCM from Phase 2 —
- * see `codes.ts`).
+ * AES-GCM sealing for short-lived, self-describing tokens (auth codes,
+ * consent tickets, DCR client assertions), all keyed from `codeSecret`.
  *
  * Domain separation is mandatory, not a nice-to-have: a consent ticket must
  * never unseal as a client-id assertion, and neither must ever unseal as an
@@ -14,4 +13,14 @@ export type SealedType = "consent" | "client" | "code";
 export declare const seal: <T>(secret: string, type: SealedType, payload: T) => Promise<string>;
 /** Unseals a string sealed with the same `secret` and `type`; `null` on any mismatch or tamper. */
 export declare const unseal: <T>(secret: string, type: SealedType, sealed: string) => Promise<T | null>;
+/**
+ * Rotation-aware unseal: tries each `secrets` entry in order, returning the
+ * index of the one that actually worked so a caller can audit "sealed under
+ * a non-primary key" without a second decrypt pass. `secrets` is expected
+ * non-empty (callers resolve it via `resolveSecrets`, which enforces that).
+ */
+export declare const unsealAny: <T>(secrets: readonly string[], type: SealedType, sealed: string) => Promise<{
+    value: T;
+    keyIndex: number;
+} | null>;
 //# sourceMappingURL=sealed.d.ts.map

package/dist/oauth/crypto/sealed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/sealed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAevD,uDAAuD;AACvD,eAAO,MAAM,IAAI,GAAU,CAAC,EAAE,QAAQ,MAAM,EAAE,MAAM,UAAU,EAAE,SAAS,CAAC,KAAG,OAAO,CAAC,MAAM,CAW1F,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,MAAM,GAAU,CAAC,EAC5B,QAAQ,MAAM,EACd,MAAM,UAAU,EAChB,QAAQ,MAAM,KACb,OAAO,CAAC,CAAC,GAAG,IAAI,CAsBlB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,GAAU,CAAC,EAC/B,SAAS,SAAS,MAAM,EAAE,EAC1B,MAAM,UAAU,EAChB,QAAQ,MAAM,KACb,OAAO,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM/C,CAAC"}