@37signals/basecamp 0.7.2 → 0.8.0

package/dist/oauth/discovery.js

@@ -1,78 +1,261 @@
 /**
  * OAuth 2.0 discovery for Basecamp SDK.
  *
- * Fetches OAuth server configuration from the well-known discovery endpoint.
+ * Two composable operations plus an orchestrator (SPEC.md §16, communique §2/§3):
+ *   - discover(issuerURL)                    — RFC 8414 AS metadata + issuer binding
+ *   - discoverProtectedResource(origin)      — RFC 9728 resource metadata
+ *   - discoverFromResource(origin, opts)     — resource-first selection + fallback
+ *
+ * All fetches are SSRF-hardened: HTTPS-only origins (localhost exempt), origin
+ * parsed/validated with the platform URL parser before any socket opens,
+ * redirects suppressed, timeouts bounded, and bodies read under a genuine
+ * bounded cap that aborts before the whole oversized body is buffered.
  */
-import { BasecampError } from "../errors.js";
+import { BasecampError, truncateErrorMessage } from "../errors.js";
 import { isLocalhost } from "../security.js";
+/** Default cap on a discovery response body (1 MiB) — discovery docs are tiny. */
+const MAX_DISCOVERY_BODY_BYTES = 1 * 1024 * 1024;
+/** True iff `value` is an array whose every element is a string. */
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+/**
+ * Resolves the caller-supplied body cap to a usable byte count. A finite,
+ * non-negative number is honored; anything else (Infinity, NaN, negative, a
+ * non-number) falls back to the default so the bounded read can never be
+ * silently disabled.
+ */
+function resolveMaxBodyBytes(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0
+        ? value
+        : MAX_DISCOVERY_BODY_BYTES;
+}
+/**
+ * Hard resource-first selection/validation failure. Thrown — never returned as a
+ * fallback — so no consumer can convert it into a Launchpad request.
+ */
+export class DiscoverySelectionError extends BasecampError {
+    reason;
+    constructor(reason, message, options) {
+        // Only capability_unavailable is consumer/usage-shaped (validation). Every
+        // other reason — including expected_issuer_unavailable — is an AS-metadata
+        // fault surfaced as api_error, matching the other four SDKs (an issuer the
+        // resource does not advertise is a metadata fault, not caller usage).
+        const code = reason === "capability_unavailable"
+            ? "validation"
+            : "api_error";
+        super(code, message, options);
+        this.name = "DiscoverySelectionError";
+        this.reason = reason;
+    }
+}
+/**
+ * Default Basecamp/Launchpad OAuth server URL.
+ */
+export const LAUNCHPAD_BASE_URL = "https://launchpad.37signals.com";
 /**
- * Discovers OAuth server configuration from the well-known endpoint.
+ * Parses a caller- or metadata-supplied origin and enforces the origin-root
+ * profile: https (or http+localhost), host present, optional valid port, path
+ * empty or exactly "/", and no query/fragment/userinfo. Uses the platform URL
+ * parser (never a regex) so bracketed IPv6 and ports agree with the host the
+ * client actually dials.
  *
- * Fetches the OAuth 2.0 Authorization Server Metadata from:
- * `{baseUrl}/.well-known/oauth-authorization-server`
+ * Throws `BasecampError("usage")` on violation — a bad *caller* origin is a
+ * usage error. Callers validating an *advertised* origin catch and reclassify.
  *
- * @param baseUrl - The OAuth server's base URL (e.g., "https://launchpad.37signals.com")
- * @param options - Optional configuration
- * @returns The OAuth server configuration
- * @throws BasecampError on network or parsing errors
+ * @returns the normalized origin (scheme://host[:port], no trailing slash)
+ */
+export function requireOriginRoot(raw, label = "origin") {
+    // A non-string runtime input (e.g. a Symbol) would throw a native TypeError in
+    // RegExp.test/new URL below; surface the documented usage error instead.
+    if (typeof raw !== "string") {
+        throw new BasecampError("usage", `Invalid ${label}: not a valid absolute URL: ${String(raw)}`);
+    }
+    // Reject C0 controls, space, and backslash up front: WHATWG URL silently strips
+    // tabs/newlines/surrounding spaces and converts backslashes to forward slashes
+    // for special schemes, so a malformed spelling ("https:\\host", "https://host\n")
+    // would be cleaned and accepted. None is legitimate in an origin root.
+    if (/[\u0000-\u0020\\]/.test(raw)) {
+        throw new BasecampError("usage", `${label} contains invalid characters: ${raw}`);
+    }
+    // WHATWG recovers a missing or extra-slash authority ("https:host",
+    // "https:///host") into a clean origin. Require an explicit "://" followed by a
+    // non-empty authority (a non-slash character) so those spellings are rejected.
+    const authoritySep = raw.indexOf("://");
+    if (authoritySep < 0 || raw[authoritySep + 3] === undefined || raw[authoritySep + 3] === "/") {
+        throw new BasecampError("usage", `${label} must be an origin root: ${raw}`);
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new BasecampError("usage", `Invalid ${label}: not a valid absolute URL: ${raw}`);
+    }
+    const isLocalhostHttp = url.protocol === "http:" && isLocalhost(url.hostname);
+    if (url.protocol !== "https:" && !isLocalhostHttp) {
+        throw new BasecampError("usage", `${label} must use HTTPS (or http on localhost): ${raw}`);
+    }
+    if (!url.hostname) {
+        throw new BasecampError("usage", `${label} has no host: ${raw}`);
+    }
+    // The WHATWG URL parser normalizes delimiter-only userinfo ("https://@host",
+    // "https://:@host") to EMPTY username/password and drops it from href, so the
+    // parsed fields alone cannot catch it — also inspect the raw authority (the
+    // scheme check above guarantees raw starts with http(s)://).
+    const rawAuthority = raw.slice(raw.indexOf("//") + 2).split(/[/?#]/, 1)[0] ?? "";
+    if (url.username || url.password || rawAuthority.includes("@")) {
+        throw new BasecampError("usage", `${label} must not contain userinfo: ${raw}`);
+    }
+    // WHATWG `URL` exposes a bare trailing "?" or "#" (e.g. "https://host?") as an
+    // EMPTY search/hash and normalizes it away from `origin`, so the parsed fields
+    // alone miss the delimiter. Also scan the raw input: any "?"/"#" past the
+    // scheme is a query/fragment delimiter here (host/port carry neither, and the
+    // path is constrained to ""/"/" below).
+    if (url.search || url.hash || raw.includes("?") || raw.includes("#")) {
+        throw new BasecampError("usage", `${label} must not contain a query or fragment: ${raw}`);
+    }
+    if (url.pathname !== "" && url.pathname !== "/") {
+        throw new BasecampError("usage", `${label} must be an origin root (no path): ${raw}`);
+    }
+    // WHATWG resolves dot-segments ("/a/..", "/%2e%2e") to "/", so url.pathname above
+    // misses a path that was present in the raw input. Scan the raw path (everything
+    // from the first "/" after the authority — "?"/"#" are already rejected above).
+    const afterAuthority = raw.slice(raw.indexOf("://") + 3);
+    const rawPathStart = afterAuthority.indexOf("/");
+    if (rawPathStart >= 0 && afterAuthority.slice(rawPathStart) !== "/") {
+        throw new BasecampError("usage", `${label} must be an origin root (no path): ${raw}`);
+    }
+    // `new URL("https://h:notaport")` throws above and WHATWG rejects ports > 65535,
+    // but it ACCEPTS port 0 and keeps it in the origin. The origin-root profile (like
+    // the other SDKs) rejects any port outside 1–65535, so a caller/advertised issuer
+    // using `:0` fails as usage / invalid_issuer_origin rather than proceeding to a fetch.
+    if (url.port !== "" && (Number(url.port) < 1 || Number(url.port) > 65535)) {
+        throw new BasecampError("usage", `${label} has an invalid port: ${raw}`);
+    }
+    // WHATWG normalizes a dangling port ("https://host:") to url.port === "", so the
+    // check above misses it; scan the raw authority for a trailing ":" (an IPv6
+    // authority ends with "]", so only a trailing ":" is a dangling port).
+    if (rawAuthority.endsWith(":")) {
+        throw new BasecampError("usage", `${label} has an invalid port: ${raw}`);
+    }
+    // Note: a surviving url has a structurally valid (possibly default) port. url.origin
+    // drops a default port and any trailing slash — exactly the normalized origin we want.
+    return url.origin;
+}
+/**
+ * True when an issuer string is a valid origin root equal to Launchpad's.
  *
- * @example
- * ```ts
- * const config = await discover("https://launchpad.37signals.com");
- * console.log(config.tokenEndpoint);
- * // => "https://launchpad.37signals.com/authorization/token"
- * ```
+ * The comparison runs both sides through {@link requireOriginRoot}, so an
+ * advertised look-alike that is *not* a clean origin root — e.g.
+ * `https://launchpad.37signals.com/path` (path), userinfo, or a query — is not
+ * treated as Launchpad. It stays a non-Launchpad candidate and later fails hard
+ * (`ambiguous_issuers` / `invalid_issuer_origin`) rather than being silently
+ * excluded from selection. A trailing-slash-only origin root still matches
+ * because `requireOriginRoot` normalizes it away.
+ *
+ * Exported so the login orchestrator derives the legacy-token decision from the
+ * same predicate the selection heuristic uses.
  */
-export async function discover(baseUrl, options = {}) {
-    const { fetch: customFetch = globalThis.fetch, timeoutMs = 10000 } = options;
-    // Validate HTTPS before making any network request (allow localhost for testing)
+export function isLaunchpadIssuer(issuer) {
     try {
-        const parsed = new URL(baseUrl);
-        if (parsed.protocol !== "https:" && !isLocalhost(parsed.hostname)) {
-            throw new BasecampError("validation", `OAuth discovery base URL must use HTTPS: ${baseUrl}`);
+        return requireOriginRoot(issuer, "issuer") === requireOriginRoot(LAUNCHPAD_BASE_URL, "issuer");
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Reads a Response body under a bounded, streaming cap. Aborts (cancels the
+ * stream) the moment the accumulated size exceeds `maxBytes`, so an oversized
+ * body is never fully buffered — real memory bounding, not a post-hoc check.
+ *
+ * Exported for reuse by the device-flow transport (same bounding, different
+ * `label` in the error message); not re-exported from the package index.
+ */
+export async function readBodyBounded(response, maxBytes, label = "OAuth discovery") {
+    const body = response.body;
+    if (!body) {
+        // No readable stream available (some mock transports): guard the buffered
+        // length instead. Real runtimes always expose response.body.
+        const text = await response.text();
+        if (new TextEncoder().encode(text).length > maxBytes) {
+            throw new BasecampError("api_error", `${label} response exceeds size cap`);
         }
+        return text;
     }
-    catch (err) {
-        if (err instanceof BasecampError)
-            throw err;
-        throw new BasecampError("validation", `Invalid OAuth discovery base URL: ${baseUrl}`);
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    let exceeded = false;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (value) {
+            total += value.byteLength;
+            if (total > maxBytes) {
+                exceeded = true;
+                break;
+            }
+            chunks.push(value);
+        }
+    }
+    // Release the stream without blocking on cancellation (some transports hang on
+    // an awaited cancel()); the point is that we stopped reading past the cap.
+    void reader.cancel().catch(() => { });
+    if (exceeded) {
+        throw new BasecampError("api_error", `${label} response exceeds size cap`);
     }
-    // Normalize base URL (remove trailing slash)
-    const normalizedBase = baseUrl.replace(/\/$/, "");
-    const discoveryUrl = `${normalizedBase}/.well-known/oauth-authorization-server`;
-    // Create abort controller for timeout
+    const merged = new Uint8Array(total);
+    let offset = 0;
+    for (const c of chunks) {
+        merged.set(c, offset);
+        offset += c.byteLength;
+    }
+    return new TextDecoder().decode(merged);
+}
+/**
+ * SSRF-hardened GET of a discovery document. The origin must already be
+ * validated (via {@link requireOriginRoot}); this suppresses redirects, bounds
+ * the timeout, reads the body under a bounded cap, and maps non-2xx → api_error.
+ */
+async function fetchDiscoveryDocument(url, options) {
+    const { fetch: customFetch = globalThis.fetch, timeoutMs = 10000 } = options;
+    const maxBodyBytes = resolveMaxBodyBytes(options.maxBodyBytes);
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await customFetch(discoveryUrl, {
+        const response = await customFetch(url, {
             method: "GET",
-            headers: {
-                Accept: "application/json",
-            },
+            headers: { Accept: "application/json" },
             signal: controller.signal,
+            // Suppress redirects: never chase an attacker-influenced Location. A 3xx
+            // surfaces below as a non-2xx api_error rather than a followed request.
+            redirect: "manual",
         });
-        if (!response.ok) {
-            const body = await response.text().catch(() => "");
-            throw new BasecampError("network", `OAuth discovery failed with status ${response.status}: ${body}`, { httpStatus: response.status });
+        if (!response.ok || (response.status >= 300 && response.status < 400)) {
+            // Drain-and-cap defensively; body is unused on the error path. Truncate
+            // before embedding: the bounded read still permits up to maxBodyBytes (1 MiB
+            // default), and interpolating that whole body into the error string risks log
+            // spam / memory pressure and could echo sensitive server content. Cap it to
+            // 500 chars to match Go/Python/Ruby's truncated discovery error messages.
+            const body = await readBodyBounded(response, maxBodyBytes).catch(() => "");
+            throw new BasecampError("api_error", `OAuth discovery failed with status ${response.status}: ${truncateErrorMessage(body)}`, { httpStatus: response.status });
         }
-        const data = (await response.json());
-        // Validate required fields
-        if (!data.issuer || !data.authorization_endpoint || !data.token_endpoint) {
-            throw new BasecampError("api_error", "Invalid OAuth discovery response: missing required fields");
+        const text = await readBodyBounded(response, maxBodyBytes);
+        try {
+            return JSON.parse(text);
+        }
+        catch (err) {
+            throw new BasecampError("api_error", "Failed to parse OAuth discovery response", {
+                cause: err instanceof Error ? err : undefined,
+            });
         }
-        return {
-            issuer: data.issuer,
-            authorizationEndpoint: data.authorization_endpoint,
-            tokenEndpoint: data.token_endpoint,
-            registrationEndpoint: data.registration_endpoint,
-            scopesSupported: data.scopes_supported,
-            codeChallengeMethodsSupported: data.code_challenge_methods_supported,
-        };
     }
     catch (err) {
-        if (err instanceof BasecampError) {
+        if (err instanceof BasecampError)
             throw err;
-        }
         if (err instanceof Error) {
             if (err.name === "AbortError") {
                 throw new BasecampError("network", "OAuth discovery request timed out", {
@@ -94,23 +277,232 @@ export async function discover(baseUrl, options = {}) {
     }
 }
 /**
- * Default Basecamp/Launchpad OAuth server URL.
- */
-export const LAUNCHPAD_BASE_URL = "https://launchpad.37signals.com";
-/**
- * Discovers OAuth configuration from Basecamp's Launchpad server.
- *
- * Convenience function that calls discover() with the Launchpad base URL.
+ * Discovers OAuth 2.0 Authorization Server Metadata (RFC 8414) from
+ * `{issuerURL}/.well-known/oauth-authorization-server`, and binds it: the
+ * returned `issuer` must equal the requested issuer by code-point (no
+ * normalization beyond origin-root parsing). `token_endpoint` is required;
+ * `authorization_endpoint` is optional (device-only servers omit it).
  *
- * @param options - Optional configuration
- * @returns The OAuth server configuration
+ * @param baseUrl - The OAuth server's issuer origin (e.g. "https://launchpad.37signals.com")
+ * @throws BasecampError("usage") on a malformed origin, api_error on invalid metadata
  *
  * @example
  * ```ts
- * const config = await discoverLaunchpad();
- * // Use config.authorizationEndpoint to start OAuth flow
+ * const config = await discover("https://launchpad.37signals.com");
+ * console.log(config.tokenEndpoint);
  * ```
  */
+export async function discover(baseUrl, options = {}) {
+    const issuerOrigin = requireOriginRoot(baseUrl, "OAuth discovery base URL");
+    // Bind against the caller's raw baseUrl (RFC 8414 §3.3, SPEC.md §16 "NO
+    // normalization"); the normalized origin is only for the fetch URL.
+    return discoverAndBind(issuerOrigin, baseUrl, options);
+}
+/**
+ * Fetch AS metadata from `issuerOrigin`'s well-known URL but bind the returned
+ * `issuer` against `bindIssuer` by code-point. Routing and binding are distinct:
+ * fetch from the normalized origin, bind against the caller's raw identifier
+ * (which may spell a trailing slash or explicit default port). Public `discover`
+ * passes its raw `baseUrl` as `bindIssuer`; `discoverFromResource` passes the
+ * advertised issuer. Not exported — no public binding override.
+ */
+async function discoverAndBind(issuerOrigin, bindIssuer, options) {
+    const discoveryUrl = `${issuerOrigin}/.well-known/oauth-authorization-server`;
+    const data = (await fetchDiscoveryDocument(discoveryUrl, options));
+    if (typeof data !== "object" || data === null) {
+        throw new BasecampError("api_error", "OAuth discovery response is not a JSON object");
+    }
+    return parseAndBindAsMetadata(data, bindIssuer);
+}
+/**
+ * Module-private structural marker for an RFC 8414 issuer-binding failure: the
+ * AS metadata's `issuer` did not equal the requested issuer by code-point.
+ *
+ * `discoverFromResource` branches on this via `instanceof` to classify
+ * `issuer_mismatch` vs `as_fetch_failed` — a structured tag, never a match on
+ * the message text. Kept private to this module and NOT re-exported from the
+ * package index: to any external caller of `discover`, this is an ordinary
+ * `api_error` `BasecampError`.
+ */
+class IssuerBindingError extends BasecampError {
+    constructor(message) {
+        super("api_error", message);
+        this.name = "IssuerBindingError";
+    }
+}
+/**
+ * Validates AS metadata and binds `issuer` to `expectedIssuerOrigin` by
+ * code-point. Universal validation only: `issuer`+`token_endpoint` present and
+ * non-empty; any present endpoint field non-empty. Per-grant endpoint checks
+ * are the consumer's responsibility.
+ */
+function parseAndBindAsMetadata(data, expectedIssuerOrigin) {
+    if (typeof data.issuer !== "string" || !data.issuer) {
+        throw new BasecampError("api_error", "Invalid OAuth discovery response: missing required fields (issuer)");
+    }
+    // RFC 8414 §3.3/§4: issuer identical by code-point. No normalization. Thrown
+    // as the structural IssuerBindingError so discoverFromResource can classify it
+    // without matching the message text.
+    if (data.issuer !== expectedIssuerOrigin) {
+        throw new IssuerBindingError(`OAuth issuer mismatch: metadata issuer "${data.issuer}" does not equal "${expectedIssuerOrigin}"`);
+    }
+    if (typeof data.token_endpoint !== "string" || !data.token_endpoint) {
+        throw new BasecampError("api_error", "Invalid OAuth discovery response: missing required fields (token_endpoint)");
+    }
+    // Every present endpoint field must be a non-empty string (reject "", arrays,
+    // numbers, etc. — a non-string endpoint is malformed, not merely empty).
+    for (const [key, value] of Object.entries(data)) {
+        if (key.endsWith("_endpoint") && value !== undefined && (typeof value !== "string" || value === "")) {
+            throw new BasecampError("api_error", `Invalid OAuth discovery response: invalid ${key}`);
+        }
+    }
+    // grant_types_supported, when present, must be an array of strings — never a
+    // bare string (substring-matching it would falsely enable a grant).
+    if (data.grant_types_supported !== undefined && !isStringArray(data.grant_types_supported)) {
+        throw new BasecampError("api_error", "Invalid OAuth discovery response: grant_types_supported must be an array of strings");
+    }
+    // code_challenge_methods_supported, when present, must likewise be an array of
+    // strings — a bare string would be substring-matched during PKCE negotiation
+    // and could falsely appear to advertise "S256".
+    if (data.code_challenge_methods_supported !== undefined &&
+        !isStringArray(data.code_challenge_methods_supported)) {
+        throw new BasecampError("api_error", "Invalid OAuth discovery response: code_challenge_methods_supported must be an array of strings");
+    }
+    // scopes_supported, when present, must be an array of strings — a bare string
+    // ("read write") or null would otherwise reach callers typed as an array and
+    // yield substring/null behavior instead of an api_error.
+    if (data.scopes_supported !== undefined && !isStringArray(data.scopes_supported)) {
+        throw new BasecampError("api_error", "Invalid OAuth discovery response: scopes_supported must be an array of strings");
+    }
+    return {
+        issuer: data.issuer,
+        authorizationEndpoint: data.authorization_endpoint,
+        tokenEndpoint: data.token_endpoint,
+        deviceAuthorizationEndpoint: data.device_authorization_endpoint,
+        registrationEndpoint: data.registration_endpoint,
+        scopesSupported: data.scopes_supported,
+        grantTypesSupported: data.grant_types_supported,
+        codeChallengeMethodsSupported: data.code_challenge_methods_supported,
+    };
+}
+/**
+ * Discovers RFC 9728 protected-resource metadata from
+ * `{resourceOrigin}/.well-known/oauth-protected-resource`. `resource` is
+ * required and must equal the requested origin by code-point.
+ * `authorization_servers` is preserved distinctly as absent vs `[]`.
+ *
+ * @throws BasecampError("usage") on a malformed caller origin, api_error on
+ *   invalid metadata
+ */
+export async function discoverProtectedResource(resourceOrigin, options = {}) {
+    const origin = requireOriginRoot(resourceOrigin, "resource origin");
+    const url = `${origin}/.well-known/oauth-protected-resource`;
+    const data = (await fetchDiscoveryDocument(url, options));
+    if (typeof data !== "object" || data === null) {
+        throw new BasecampError("api_error", "Resource metadata response is not a JSON object");
+    }
+    if (typeof data.resource !== "string" || !data.resource) {
+        throw new BasecampError("api_error", "Invalid resource metadata: missing required field (resource)");
+    }
+    // Bind the resource identifier to the requested identifier (the raw caller
+    // origin), code-point exact, NO normalization (RFC 9728 §3.3, SPEC.md §16): the
+    // well-known URL is built from the normalized origin, but doc.resource must be
+    // identical to what the caller supplied.
+    if (data.resource !== resourceOrigin) {
+        throw new BasecampError("api_error", `Resource identifier mismatch: metadata resource "${data.resource}" does not equal "${resourceOrigin}"`);
+    }
+    // authorization_servers, when present, MUST be an array of strings. A bare
+    // string slipped through and was iterated char-by-char during selection; a
+    // present JSON null is likewise malformed (an array is required when the key is
+    // present) — not a present-empty list. Reject every present non-array value so
+    // the orchestrator classifies it as resource_discovery_failed rather than
+    // silently taking no_as_advertised.
+    let authorizationServers;
+    if (Object.prototype.hasOwnProperty.call(data, "authorization_servers")) {
+        const raw = data.authorization_servers;
+        if (isStringArray(raw)) {
+            authorizationServers = raw;
+        }
+        else {
+            throw new BasecampError("api_error", "Invalid resource metadata: authorization_servers must be an array of strings when present");
+        }
+    }
+    return { resource: data.resource, authorizationServers };
+}
+/**
+ * Resource-first discovery orchestrator (SPEC.md §16). Composes RFC 9728 + RFC
+ * 8414 and applies the stage-sensitive fallback state machine.
+ *
+ * Returns `{ kind: "selected", config, issuer }` or `{ kind: "fallback", reason }`
+ * where `reason ∈ {resource_discovery_failed, no_as_advertised}`. Every hard
+ * failure throws {@link DiscoverySelectionError} — callers MUST NOT convert a
+ * throw into a Launchpad request.
+ */
+export async function discoverFromResource(resourceOrigin, options = {}) {
+    const { expectedIssuer, ...discoverOptions } = options;
+    // --- Hop 1: resource metadata. Failure here is soft (before selection). ---
+    // Pass the RAW resourceOrigin so binding is code-point-exact against the caller's
+    // identifier (SPEC.md §16); discoverProtectedResource normalizes only its fetch
+    // URL. A malformed caller origin surfaces as usage (re-raised below), not a fallback.
+    let resource;
+    try {
+        resource = await discoverProtectedResource(resourceOrigin, discoverOptions);
+    }
+    catch (err) {
+        if (err instanceof BasecampError && err.code === "usage")
+            throw err;
+        return { kind: "fallback", reason: "resource_discovery_failed" };
+    }
+    const advertised = resource.authorizationServers ?? [];
+    // --- Selection ---
+    let selectedIssuer;
+    if (expectedIssuer !== undefined) {
+        const match = advertised.find((s) => s === expectedIssuer);
+        if (!match) {
+            throw new DiscoverySelectionError("expected_issuer_unavailable", `Expected issuer "${expectedIssuer}" is not advertised by the resource`);
+        }
+        selectedIssuer = match;
+    }
+    else {
+        // Deduplicate exact issuer strings first: a resource that advertises the same
+        // non-Launchpad issuer more than once denotes ONE issuer, not an ambiguous set.
+        const nonLaunchpad = [...new Set(advertised.filter((s) => !isLaunchpadIssuer(s)))];
+        if (nonLaunchpad.length >= 2) {
+            throw new DiscoverySelectionError("ambiguous_issuers", `Multiple non-Launchpad issuers advertised; pass expectedIssuer to disambiguate: ${nonLaunchpad.join(", ")}`);
+        }
+        if (nonLaunchpad.length === 0) {
+            // Valid resource metadata omits BC5 — soft fallback (before selection).
+            return { kind: "fallback", reason: "no_as_advertised" };
+        }
+        selectedIssuer = nonLaunchpad[0];
+    }
+    // --- BC5 is now committed: every subsequent failure is fatal (no Launchpad). ---
+    let issuerOrigin;
+    try {
+        issuerOrigin = requireOriginRoot(selectedIssuer, "advertised issuer");
+    }
+    catch (err) {
+        throw new DiscoverySelectionError("invalid_issuer_origin", `Advertised issuer "${selectedIssuer}" is not a valid origin root`, { cause: err instanceof Error ? err : undefined });
+    }
+    let config;
+    try {
+        // Fetch from the normalized origin, but bind against the exact advertised
+        // issuer string (selectedIssuer), not the normalized origin.
+        config = await discoverAndBind(issuerOrigin, selectedIssuer, discoverOptions);
+    }
+    catch (err) {
+        // Distinguish issuer-binding mismatch from a generic fetch failure via the
+        // structural marker (never the message text).
+        if (err instanceof IssuerBindingError) {
+            throw new DiscoverySelectionError("issuer_mismatch", err.message, { cause: err });
+        }
+        throw new DiscoverySelectionError("as_fetch_failed", `AS metadata fetch failed for committed issuer "${issuerOrigin}": ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : undefined });
+    }
+    return { kind: "selected", config, issuer: config.issuer };
+}
+/**
+ * Discovers OAuth configuration from Basecamp's Launchpad server.
+ */
 export async function discoverLaunchpad(options = {}) {
     return discover(LAUNCHPAD_BASE_URL, options);
 }

package/dist/oauth/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/oauth/discovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAyB7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,UAA2B,EAAE;IAE7B,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE7E,iFAAiF;IACjF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,4CAA4C,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa;YAAE,MAAM,GAAG,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,qCAAqC,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,6CAA6C;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,cAAc,yCAAyC,CAAC;IAEhF,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;aAC3B;YACD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,aAAa,CACrB,SAAS,EACT,sCAAsC,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,EAChE,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAChC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAE7D,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzE,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,qBAAqB,EAAE,IAAI,CAAC,sBAAsB;YAClD,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,oBAAoB,EAAE,IAAI,CAAC,qBAAqB;YAChD,eAAe,EAAE,IAAI,CAAC,gBAAgB;YACtC,6BAA6B,EAAE,IAAI,CAAC,gCAAgC;SACrE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,mCAAmC,EAAE;oBACtE,KAAK,EAAE,GAAG;oBACV,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,2BAA2B,GAAG,CAAC,OAAO,EAAE,EAAE;gBAC3E,KAAK,EAAE,GAAG;gBACV,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,2CAA2C,EAAE;YAC9E,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAA2B,EAAE;IAE7B,OAAO,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/oauth/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA2B7C,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,oEAAoE;AACpE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAyB;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QACtE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,wBAAwB,CAAC;AAC/B,CAAC;AA+BD;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,aAAa;IAC/C,MAAM,CAAgC;IAE/C,YACE,MAAqC,EACrC,OAAe,EACf,OAAgD;QAEhD,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,IAAI,GACR,MAAM,KAAK,wBAAwB;YACjC,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,WAAW,CAAC;QAClB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAK,GAAG,QAAQ;IAC7D,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,WAAW,KAAK,+BAA+B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,kFAAkF;IAClF,uEAAuE;IACvE,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,iCAAiC,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,oEAAoE;IACpE,gFAAgF;IAChF,+EAA+E;IAC/E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC7F,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,WAAW,KAAK,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,2CAA2C,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,iBAAiB,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,wCAAwC;IACxC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,sCAAsC,GAAG,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,YAAY,IAAI,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;QACpE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,sCAAsC,GAAG,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,uFAAuF;IACvF,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,iFAAiF;IACjF,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,qFAAqF;IACrF,uFAAuF;IACvF,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,iBAAiB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAkB,EAClB,QAAgB,EAChB,KAAK,GAAG,iBAAiB;IAEzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,2EAA2E;IAC3E,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,GAAW,EACX,OAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,yEAAyE;YACzE,wEAAwE;YACxE,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YACtE,wEAAwE;YACxE,6EAA6E;YAC7E,8EAA8E;YAC9E,4EAA4E;YAC5E,0EAA0E;YAC1E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,sCAAsC,QAAQ,CAAC,MAAM,KAAK,oBAAoB,CAAC,IAAI,CAAC,EAAE,EACtF,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAChC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,0CAA0C,EAAE;gBAC/E,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa;YAAE,MAAM,GAAG,CAAC;QAC5C,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,mCAAmC,EAAE;oBACtE,KAAK,EAAE,GAAG;oBACV,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,2BAA2B,GAAG,CAAC,OAAO,EAAE,EAAE;gBAC3E,KAAK,EAAE,GAAG;gBACV,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,2CAA2C,EAAE;YAC9E,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,UAA2B,EAAE;IAE7B,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IAC5E,wEAAwE;IACxE,oEAAoE;IACpE,OAAO,eAAe,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC5B,YAAoB,EACpB,UAAkB,EAClB,OAAwB;IAExB,MAAM,YAAY,GAAG,GAAG,YAAY,yCAAyC,CAAC;IAE9E,MAAM,IAAI,GAAG,CAAC,MAAM,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAyB,CAAC;IAC3F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,+CAA+C,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,sBAAsB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,kBAAmB,SAAQ,aAAa;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,IAA0B,EAC1B,oBAA4B;IAE5B,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,oEAAoE,CAAC,CAAC;IAC7G,CAAC;IACD,6EAA6E;IAC7E,+EAA+E;IAC/E,qCAAqC;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,kBAAkB,CAC1B,2CAA2C,IAAI,CAAC,MAAM,qBAAqB,oBAAoB,GAAG,CACnG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,4EAA4E,CAAC,CAAC;IACrH,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,6CAA6C,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,gDAAgD;IAChD,IACE,IAAI,CAAC,gCAAgC,KAAK,SAAS;QACnD,CAAC,aAAa,CAAC,IAAI,CAAC,gCAAgC,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,qBAAqB,EAAE,IAAI,CAAC,sBAAsB;QAClD,aAAa,EAAE,IAAI,CAAC,cAAc;QAClC,2BAA2B,EAAE,IAAI,CAAC,6BAA6B;QAC/D,oBAAoB,EAAE,IAAI,CAAC,qBAAqB;QAChD,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,mBAAmB,EAAE,IAAI,CAAC,qBAAqB;QAC/C,6BAA6B,EAAE,IAAI,CAAC,gCAAgC;KACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,cAAsB,EACtB,UAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,GAAG,MAAM,uCAAuC,CAAC;IAE7D,MAAM,IAAI,GAAG,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAwB,CAAC;IACjF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,iDAAiD,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,8DAA8D,CAAC,CAAC;IACvG,CAAC;IACD,2EAA2E;IAC3E,gFAAgF;IAChF,+EAA+E;IAC/E,yCAAyC;IACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,oDAAoD,IAAI,CAAC,QAAQ,qBAAqB,cAAc,GAAG,CACxG,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,+EAA+E;IAC/E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,oBAA0C,CAAC;IAC/C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACxE,MAAM,GAAG,GAAa,IAAgC,CAAC,qBAAqB,CAAC;QAC7E,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,GAAG,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,2FAA2F,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,cAAsB,EACtB,UAAuC,EAAE;IAEzC,MAAM,EAAE,cAAc,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC;IAEvD,6EAA6E;IAC7E,kFAAkF;IAClF,gFAAgF;IAChF,sFAAsF;IACtF,IAAI,QAAmC,CAAC;IACxC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,yBAAyB,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,GAAG,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAEvD,oBAAoB;IACpB,IAAI,cAAsB,CAAC;IAC3B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,uBAAuB,CAC/B,6BAA6B,EAC7B,oBAAoB,cAAc,qCAAqC,CACxE,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,8EAA8E;QAC9E,gFAAgF;QAChF,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,mFAAmF,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,wEAAwE;YACxE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QACD,cAAc,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;IACpC,CAAC;IAED,kFAAkF;IAClF,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,iBAAiB,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,uBAAuB,EACvB,sBAAsB,cAAc,8BAA8B,EAClE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kDAAkD,YAAY,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACtH,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAA2B,EAAE;IAE7B,OAAO,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}

package/dist/oauth/index.d.ts

@@ -37,8 +37,8 @@
  * }
  * ```
  */
-export type { OAuthConfig, OAuthToken, ExchangeRequest, RefreshRequest, RawTokenResponse, OAuthErrorResponse, } from "./types.js";
-export { discover, discoverLaunchpad, LAUNCHPAD_BASE_URL, type DiscoverOptions, } from "./discovery.js";
+export type { OAuthConfig, OAuthToken, ExchangeRequest, RefreshRequest, RawTokenResponse, OAuthErrorResponse, ProtectedResourceMetadata, FallbackReason, DiscoverySelectionErrorReason, DiscoverFromResourceResult, } from "./types.js";
+export { discover, discoverProtectedResource, discoverFromResource, discoverLaunchpad, requireOriginRoot, DiscoverySelectionError, LAUNCHPAD_BASE_URL, type DiscoverOptions, type DiscoverFromResourceOptions, } from "./discovery.js";
 export { exchangeCode, refreshToken, isTokenExpired, type TokenOptions, } from "./exchange.js";
 export { generatePKCE, generateState, type PKCE, } from "./pkce.js";
 export { buildAuthorizationUrl, type AuthorizeParams, } from "./authorize.js";

package/dist/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,YAAY,EACV,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,KAAK,IAAI,GACV,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,gBAAgB,GACjB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,YAAY,EACV,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,QAAQ,EACR,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,2BAA2B,GACjC,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,KAAK,IAAI,GACV,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,uBAAuB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,gBAAgB,GACjB,MAAM,eAAe,CAAC"}

package/dist/oauth/index.js

@@ -38,7 +38,7 @@
  * ```
  */
 // Discovery
-export { discover, discoverLaunchpad, LAUNCHPAD_BASE_URL, } from "./discovery.js";
+export { discover, discoverProtectedResource, discoverFromResource, discoverLaunchpad, requireOriginRoot, DiscoverySelectionError, LAUNCHPAD_BASE_URL, } from "./discovery.js";
 // Token exchange
 export { exchangeCode, refreshToken, isTokenExpired, } from "./exchange.js";
 // PKCE utilities

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAYH,YAAY;AACZ,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AAExB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,GAEf,MAAM,eAAe,CAAC;AAEvB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,aAAa,GAEd,MAAM,WAAW,CAAC;AAEnB,oBAAoB;AACpB,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAExB,cAAc;AACd,OAAO,EACL,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAE1B,gBAAgB;AAChB,OAAO,EACL,YAAY,GAEb,MAAM,oBAAoB,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAE9B,oBAAoB;AACpB,OAAO,EACL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAEhC,WAAW;AACX,OAAO,EACL,gBAAgB,GACjB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAgBH,YAAY;AACZ,OAAO,EACL,QAAQ,EACR,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,GAGnB,MAAM,gBAAgB,CAAC;AAExB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,GAEf,MAAM,eAAe,CAAC;AAEvB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,aAAa,GAEd,MAAM,WAAW,CAAC;AAEnB,oBAAoB;AACpB,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAExB,cAAc;AACd,OAAO,EACL,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAE1B,gBAAgB;AAChB,OAAO,EACL,YAAY,GAEb,MAAM,oBAAoB,CAAC;AAE5B,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAE9B,oBAAoB;AACpB,OAAO,EACL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAEhC,WAAW;AACX,OAAO,EACL,gBAAgB,GACjB,MAAM,eAAe,CAAC"}