@adcp/sdk 6.12.0 → 6.13.1

package/dist/lib/auth/oauth/index.d.ts

@@ -34,6 +34,7 @@ export type { OAuthFlowHandler, OAuthProviderConfig, OAuthConfigStorage, OAuthCl
 export { DEFAULT_CLIENT_METADATA, OAuthError, OAuthCancelledError, OAuthTimeoutError, toMCPTokens, fromMCPTokens, toMCPClientInfo, fromMCPClientInfo, } from './types';
 export { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';
 export { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';
+export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow';
 export { MCPOAuthProvider } from './MCPOAuthProvider';
 import { MCPOAuthProvider } from './MCPOAuthProvider';
 import type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';

package/dist/lib/auth/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAG9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,8BAA8B;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,GACA,gBAAgB,CAqBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,GACA,gBAAgB,CAgBlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAa/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAIzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAO5E;AAGD,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAKpB,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,GAClC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAKtF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACpC,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,YAAY,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAIpE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK3F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAM9G,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,4BAA4B,EAC5B,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,8BAA8B;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,GACA,gBAAgB,CAqBlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,GACA,gBAAgB,CAgBlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAa/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAIzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAO5E;AAGD,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAKpB,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,GAClC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAKtF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,GACpC,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,YAAY,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAIpE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK3F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC"}

package/dist/lib/auth/oauth/index.js

@@ -32,7 +32,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InsufficientScopeError = exports.InvalidTokenError = exports.unbindAgentStorage = exports.getAgentStorage = exports.bindAgentStorage = exports.MissingEnvSecretError = exports.extractEnvSecretName = exports.toEnvSecretReference = exports.isEnvSecretReference = exports.resolveSecret = exports.ClientCredentialsExchangeError = exports.ensureClientCredentialsTokens = exports.exchangeClientCredentials = exports.createFileOAuthStorage = exports.discoverAuthorizationRequirements = exports.NeedsAuthorizationError = exports.AUTH_DIAGNOSIS_SCHEMA_VERSION = exports.runAuthDiagnosis = exports.validateTokenAudience = exports.decodeAccessTokenClaims = exports.parseWWWAuthenticate = exports.supportsDynamicRegistration = exports.supportsOAuth = exports.discoverOAuthMetadata = exports.MCPOAuthProvider = exports.NonInteractiveFlowHandler = exports.CLIFlowHandler = exports.fromMCPClientInfo = exports.toMCPClientInfo = exports.fromMCPTokens = exports.toMCPTokens = exports.OAuthTimeoutError = exports.OAuthCancelledError = exports.OAuthError = exports.DEFAULT_CLIENT_METADATA = void 0;
+exports.InsufficientScopeError = exports.InvalidTokenError = exports.unbindAgentStorage = exports.getAgentStorage = exports.bindAgentStorage = exports.MissingEnvSecretError = exports.extractEnvSecretName = exports.toEnvSecretReference = exports.isEnvSecretReference = exports.resolveSecret = exports.ClientCredentialsExchangeError = exports.ensureClientCredentialsTokens = exports.exchangeClientCredentials = exports.createFileOAuthStorage = exports.discoverAuthorizationRequirements = exports.NeedsAuthorizationError = exports.AUTH_DIAGNOSIS_SCHEMA_VERSION = exports.runAuthDiagnosis = exports.validateTokenAudience = exports.decodeAccessTokenClaims = exports.parseWWWAuthenticate = exports.supportsDynamicRegistration = exports.supportsOAuth = exports.discoverOAuthMetadata = exports.MCPOAuthProvider = exports.DEFAULT_WEB_FLOW_TTL_MS = exports.ConfidentialClientNotAllowedError = exports.AgentVanishedDuringFlowError = exports.ProtectedResourceMetadataError = exports.TokenExchangeError = exports.StateMismatchError = exports.InvalidOrExpiredFlowError = exports.InMemoryPendingFlowStore = exports.safeReturnTo = exports.completeWebOAuthFlow = exports.startWebOAuthFlow = exports.NonInteractiveFlowHandler = exports.CLIFlowHandler = exports.fromMCPClientInfo = exports.toMCPClientInfo = exports.fromMCPTokens = exports.toMCPTokens = exports.OAuthTimeoutError = exports.OAuthCancelledError = exports.OAuthError = exports.DEFAULT_CLIENT_METADATA = void 0;
 exports.createCLIOAuthProvider = createCLIOAuthProvider;
 exports.createNonInteractiveOAuthProvider = createNonInteractiveOAuthProvider;
 exports.isOAuthRequired = isOAuthRequired;
@@ -53,6 +53,22 @@ var CLIFlowHandler_1 = require("./CLIFlowHandler");
 Object.defineProperty(exports, "CLIFlowHandler", { enumerable: true, get: function () { return CLIFlowHandler_1.CLIFlowHandler; } });
 var NonInteractiveFlowHandler_1 = require("./NonInteractiveFlowHandler");
 Object.defineProperty(exports, "NonInteractiveFlowHandler", { enumerable: true, get: function () { return NonInteractiveFlowHandler_1.NonInteractiveFlowHandler; } });
+// Web (server-side) OAuth flow — companion to CLIFlowHandler for environments
+// where /oauth/start and /oauth/callback may be served by different processes.
+// Note: standalone functions, NOT a class implementing OAuthFlowHandler — see
+// docs/guides/WEB-OAUTH.md for the rationale (the contract spans two requests).
+var web_flow_1 = require("./web-flow");
+Object.defineProperty(exports, "startWebOAuthFlow", { enumerable: true, get: function () { return web_flow_1.startWebOAuthFlow; } });
+Object.defineProperty(exports, "completeWebOAuthFlow", { enumerable: true, get: function () { return web_flow_1.completeWebOAuthFlow; } });
+Object.defineProperty(exports, "safeReturnTo", { enumerable: true, get: function () { return web_flow_1.safeReturnTo; } });
+Object.defineProperty(exports, "InMemoryPendingFlowStore", { enumerable: true, get: function () { return web_flow_1.InMemoryPendingFlowStore; } });
+Object.defineProperty(exports, "InvalidOrExpiredFlowError", { enumerable: true, get: function () { return web_flow_1.InvalidOrExpiredFlowError; } });
+Object.defineProperty(exports, "StateMismatchError", { enumerable: true, get: function () { return web_flow_1.StateMismatchError; } });
+Object.defineProperty(exports, "TokenExchangeError", { enumerable: true, get: function () { return web_flow_1.TokenExchangeError; } });
+Object.defineProperty(exports, "ProtectedResourceMetadataError", { enumerable: true, get: function () { return web_flow_1.ProtectedResourceMetadataError; } });
+Object.defineProperty(exports, "AgentVanishedDuringFlowError", { enumerable: true, get: function () { return web_flow_1.AgentVanishedDuringFlowError; } });
+Object.defineProperty(exports, "ConfidentialClientNotAllowedError", { enumerable: true, get: function () { return web_flow_1.ConfidentialClientNotAllowedError; } });
+Object.defineProperty(exports, "DEFAULT_WEB_FLOW_TTL_MS", { enumerable: true, get: function () { return web_flow_1.DEFAULT_WEB_FLOW_TTL_MS; } });
 // Main provider
 var MCPOAuthProvider_1 = require("./MCPOAuthProvider");
 Object.defineProperty(exports, "MCPOAuthProvider", { enumerable: true, get: function () { return MCPOAuthProvider_1.MCPOAuthProvider; } });

package/dist/lib/auth/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AA+EH,wDAmCC;AAYD,8EA0BC;AAKD,0CASC;AAKD,kDAaC;AAKD,4CAIC;AAMD,sDAOC;AA9LD,iCASiB;AARf,gHAAA,uBAAuB,OAAA;AACvB,mGAAA,UAAU,OAAA;AACV,4GAAA,mBAAmB,OAAA;AACnB,0GAAA,iBAAiB,OAAA;AACjB,oGAAA,WAAW,OAAA;AACX,sGAAA,aAAa,OAAA;AACb,wGAAA,eAAe,OAAA;AACf,0GAAA,iBAAiB,OAAA;AAGnB,gBAAgB;AAChB,mDAA6E;AAApE,gHAAA,cAAc,OAAA;AACvB,yEAA8G;AAArG,sIAAA,yBAAyB,OAAA;AAElC,gBAAgB;AAChB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AAEzB,2CAA2C;AAC3C,gCAAgC;AAChC,2CAA2C;AAE3C,yDAAsD;AACtD,qDAA6E;AAE7E,mCAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAgB,sBAAsB,CACpC,KAAkB,EAClB,OAWC;IAED,MAAM,UAAU,GAAyB;QACvC,YAAY,EAAE,OAAO,EAAE,YAAY;QACnC,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,+BAAc,CAAC,UAAU,CAAC,CAAC;IAEnD,iCAAiC;IACjC,MAAM,cAAc,GAAwB;QAC1C,GAAG,+BAAuB;QAC1B,aAAa,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxD,GAAG,OAAO,EAAE,cAAc;KAC3B,CAAC;IAEF,OAAO,IAAI,mCAAgB,CAAC;QAC1B,KAAK;QACL,WAAW;QACX,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iCAAiC,CAC/C,KAAkB,EAClB,OAOC;IAED,MAAM,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,yBAAyB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAErF,MAAM,cAAc,GAAwB;QAC1C,GAAG,+BAAuB;QAC1B,aAAa,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxD,GAAG,OAAO,EAAE,cAAc;KAC3B,CAAC;IAEF,OAAO,IAAI,mCAAgB,CAAC;QAC1B,KAAK;QACL,WAAW;QACX,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,KAAkB;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,4CAA4C;QAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAkB;IACjD,OAAO,KAAK,CAAC,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC,mBAAmB,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,KAAkB;IACtD,sCAAsC;IACtC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,YAAa,CAAC,YAAY,CAAC;IAC1C,CAAC;IACD,4BAA4B;IAC5B,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,kBAAkB;AAClB,yCAMqB;AALnB,kHAAA,qBAAqB,OAAA;AACrB,0GAAA,aAAa,OAAA;AACb,wHAAA,2BAA2B,OAAA;AAK7B,8EAA8E;AAC9E,6CASuB;AARrB,mHAAA,oBAAoB,OAAA;AACpB,sHAAA,uBAAuB,OAAA;AACvB,oHAAA,qBAAqB,OAAA;AAQvB,qEAAqE;AACrE,uCASoB;AARlB,4GAAA,gBAAgB,OAAA;AAChB,yHAAA,6BAA6B,OAAA;AAS/B,+DAA+D;AAC/D,8EAA8E;AAC9E,6DAA6D;AAC7D,mEAKkC;AAJhC,iIAAA,uBAAuB,OAAA;AACvB,2IAAA,iCAAiC,OAAA;AAKnC,wEAAwE;AACxE,+CAAsF;AAA7E,sHAAA,sBAAsB,OAAA;AAE/B,4EAA4E;AAC5E,4EAA4E;AAC5E,yDAAyD;AACzD,iEAMiC;AAL/B,kIAAA,yBAAyB,OAAA;AACzB,sIAAA,6BAA6B,OAAA;AAC7B,uIAAA,8BAA8B,OAAA;AAKhC,2EAA2E;AAC3E,qDAAqD;AACrD,qDAM2B;AALzB,gHAAA,aAAa,OAAA;AACb,uHAAA,oBAAoB,OAAA;AACpB,uHAAA,oBAAoB,OAAA;AACpB,uHAAA,oBAAoB,OAAA;AACpB,wHAAA,qBAAqB,OAAA;AAOvB,0EAA0E;AAC1E,mEAAmE;AACnE,uDAA2F;AAAlF,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,sHAAA,kBAAkB,OAAA;AAE9D,iFAAiF;AACjF,iFAAiF;AACjF,sFAAsF;AACtF,6EAA4G;AAAnG,8GAAA,iBAAiB,OAAA;AAAE,mHAAA,sBAAsB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AAwGH,wDAmCC;AAYD,8EA0BC;AAKD,0CASC;AAKD,kDAaC;AAKD,4CAIC;AAMD,sDAOC;AAvND,iCASiB;AARf,gHAAA,uBAAuB,OAAA;AACvB,mGAAA,UAAU,OAAA;AACV,4GAAA,mBAAmB,OAAA;AACnB,0GAAA,iBAAiB,OAAA;AACjB,oGAAA,WAAW,OAAA;AACX,sGAAA,aAAa,OAAA;AACb,wGAAA,eAAe,OAAA;AACf,0GAAA,iBAAiB,OAAA;AAGnB,gBAAgB;AAChB,mDAA6E;AAApE,gHAAA,cAAc,OAAA;AACvB,yEAA8G;AAArG,sIAAA,yBAAyB,OAAA;AAElC,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,uCAmBoB;AAlBlB,6GAAA,iBAAiB,OAAA;AACjB,gHAAA,oBAAoB,OAAA;AACpB,wGAAA,YAAY,OAAA;AACZ,oHAAA,wBAAwB,OAAA;AACxB,qHAAA,yBAAyB,OAAA;AACzB,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAClB,0HAAA,8BAA8B,OAAA;AAC9B,wHAAA,4BAA4B,OAAA;AAC5B,6HAAA,iCAAiC,OAAA;AACjC,mHAAA,uBAAuB,OAAA;AAUzB,gBAAgB;AAChB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AAEzB,2CAA2C;AAC3C,gCAAgC;AAChC,2CAA2C;AAE3C,yDAAsD;AACtD,qDAA6E;AAE7E,mCAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAgB,sBAAsB,CACpC,KAAkB,EAClB,OAWC;IAED,MAAM,UAAU,GAAyB;QACvC,YAAY,EAAE,OAAO,EAAE,YAAY;QACnC,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,+BAAc,CAAC,UAAU,CAAC,CAAC;IAEnD,iCAAiC;IACjC,MAAM,cAAc,GAAwB;QAC1C,GAAG,+BAAuB;QAC1B,aAAa,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxD,GAAG,OAAO,EAAE,cAAc;KAC3B,CAAC;IAEF,OAAO,IAAI,mCAAgB,CAAC;QAC1B,KAAK;QACL,WAAW;QACX,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iCAAiC,CAC/C,KAAkB,EAClB,OAOC;IAED,MAAM,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,yBAAyB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAErF,MAAM,cAAc,GAAwB;QAC1C,GAAG,+BAAuB;QAC1B,aAAa,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxD,GAAG,OAAO,EAAE,cAAc;KAC3B,CAAC;IAEF,OAAO,IAAI,mCAAgB,CAAC;QAC1B,KAAK;QACL,WAAW;QACX,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,KAAkB;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,4CAA4C;QAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAkB;IACjD,OAAO,KAAK,CAAC,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC,mBAAmB,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,KAAkB;IACtD,sCAAsC;IACtC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,YAAa,CAAC,YAAY,CAAC;IAC1C,CAAC;IACD,4BAA4B;IAC5B,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,kBAAkB;AAClB,yCAMqB;AALnB,kHAAA,qBAAqB,OAAA;AACrB,0GAAA,aAAa,OAAA;AACb,wHAAA,2BAA2B,OAAA;AAK7B,8EAA8E;AAC9E,6CASuB;AARrB,mHAAA,oBAAoB,OAAA;AACpB,sHAAA,uBAAuB,OAAA;AACvB,oHAAA,qBAAqB,OAAA;AAQvB,qEAAqE;AACrE,uCASoB;AARlB,4GAAA,gBAAgB,OAAA;AAChB,yHAAA,6BAA6B,OAAA;AAS/B,+DAA+D;AAC/D,8EAA8E;AAC9E,6DAA6D;AAC7D,mEAKkC;AAJhC,iIAAA,uBAAuB,OAAA;AACvB,2IAAA,iCAAiC,OAAA;AAKnC,wEAAwE;AACxE,+CAAsF;AAA7E,sHAAA,sBAAsB,OAAA;AAE/B,4EAA4E;AAC5E,4EAA4E;AAC5E,yDAAyD;AACzD,iEAMiC;AAL/B,kIAAA,yBAAyB,OAAA;AACzB,sIAAA,6BAA6B,OAAA;AAC7B,uIAAA,8BAA8B,OAAA;AAKhC,2EAA2E;AAC3E,qDAAqD;AACrD,qDAM2B;AALzB,gHAAA,aAAa,OAAA;AACb,uHAAA,oBAAoB,OAAA;AACpB,uHAAA,oBAAoB,OAAA;AACpB,uHAAA,oBAAoB,OAAA;AACpB,wHAAA,qBAAqB,OAAA;AAOvB,0EAA0E;AAC1E,mEAAmE;AACnE,uDAA2F;AAAlF,oHAAA,gBAAgB,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,sHAAA,kBAAkB,OAAA;AAE9D,iFAAiF;AACjF,iFAAiF;AACjF,sFAAsF;AACtF,6EAA4G;AAAnG,8GAAA,iBAAiB,OAAA;AAAE,mHAAA,sBAAsB,OAAA"}

package/dist/lib/auth/oauth/web-flow.d.ts

@@ -0,0 +1,270 @@
+/**
+ * Web (server-side) OAuth flow helpers for `@adcp/sdk`.
+ *
+ * Companion to `CLIFlowHandler` for environments where `/oauth/start` and
+ * `/oauth/callback` may be served by different processes. Discovery, PKCE,
+ * URL construction, and token exchange are delegated to the MCP SDK's
+ * `client/auth.js` primitives so this module is glue plus a pending-flow
+ * store interface — not reimplemented protocol logic.
+ *
+ * Wire contract:
+ *   - PRM (RFC 9728) is consulted first; `prm.resource` is the source of
+ *     truth for the RFC 8707 `resource` indicator. We fall back to
+ *     `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource
+ *     server does not implement PRM (404). Connection / parse / 5xx
+ *     errors throw `ProtectedResourceMetadataError` — never silently
+ *     downgrade to local guessing.
+ *   - `prm.resource` must share an origin with the agent URL; the MCP
+ *     SDK's `checkResourceAllowed` guards against a poisoned PRM
+ *     pointing the audience at a third party.
+ *   - AS URL = `prm.authorization_servers[0]` when PRM is present, else
+ *     the agent origin.
+ *   - Scope priority: caller-supplied `scopeHint` (e.g. from a 401
+ *     `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`
+ *     > `clientMetadata.scope`.
+ *   - Refresh is NOT this module's concern. Once `oauth_tokens` are
+ *     persisted, `MCPOAuthProvider` handles refresh on the next agent
+ *     call and the MCP SDK forwards `resource` into the refresh request.
+ *     Callers who DIY refresh against `oauth_tokens` are responsible for
+ *     forwarding `resource` themselves.
+ */
+import type { OAuthClientInformation, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { AgentConfig, OAuthConfigStorage } from './types';
+import { OAuthError } from './types';
+/**
+ * Default TTL for a pending web flow row. RFC 6749 §10.12 recommends
+ * short-lived state; 10 minutes covers slow-typing users without leaving
+ * the PKCE verifier on disk longer than necessary.
+ */
+export declare const DEFAULT_WEB_FLOW_TTL_MS: number;
+/**
+ * State persisted between `/oauth/start` and `/oauth/callback`.
+ *
+ * `codeVerifier` is a PKCE secret. Store implementations MUST encrypt it
+ * at rest if persistence crosses a trust boundary (shared DB, cross-tenant
+ * Redis, etc.).
+ *
+ * `carry` is preserved verbatim and round-tripped to the callback. It
+ * MUST be JSON-serializable, MUST NOT contain secrets, and MUST be
+ * treated as attacker-influenced data (the caller typically populates it
+ * from the `/start` request).
+ */
+export interface PendingWebFlow {
+    state: string;
+    agentId: string;
+    agentUrl: string;
+    codeVerifier: string;
+    redirectUri: string;
+    resource?: string;
+    scope?: string;
+    authorizationServerUrl: string;
+    /** Persist as JSON (e.g. Postgres `jsonb`); contents are MCP SDK-typed. */
+    clientInformation: OAuthClientInformation;
+    createdAt: Date;
+    expiresAt: Date;
+    /** JSON-serializable, no secrets, attacker-influenced. */
+    carry?: Record<string, unknown>;
+}
+/**
+ * Persistence interface for in-flight web OAuth flows.
+ *
+ * Canonical implementations:
+ *
+ * Postgres:
+ * ```sql
+ * INSERT INTO pending_oauth_flows (state, payload, expires_at)
+ *   VALUES ($1, $2, $3);
+ * -- consume:
+ * DELETE FROM pending_oauth_flows
+ *   WHERE state = $1 AND expires_at > now()
+ *   RETURNING payload;
+ * ```
+ *
+ * Redis:
+ * ```
+ * SET pending:flow:<state> <payload> EX 600 NX     -- put
+ * GETDEL pending:flow:<state>                      -- consume
+ * ```
+ *
+ * `consume` MUST be a single atomic operation that deletes and returns the
+ * row (or returns null). A `SELECT` followed by a separate `DELETE` is a
+ * replay vulnerability and DOES NOT satisfy this contract — a callback
+ * replayed before the first one commits would mint two tokens.
+ *
+ * `consume` MUST treat expired rows as absent (return null) and SHOULD
+ * delete them on read so a separate sweep is not strictly required.
+ *
+ * **Tradeoff: consume runs before token exchange.** `completeWebOAuthFlow`
+ * consumes the pending row before attempting `exchangeAuthorization`. If
+ * the AS returns a transient 5xx (or the network blips between us and the
+ * AS), the row is gone and the user must restart from `/oauth/start`.
+ * This is the right call for `invalid_grant` (replay protection — the
+ * authorization code is one-shot at the AS regardless), but it means
+ * transient AS failures cost the user a click. Revisit only if you see
+ * real retry-loss in the field.
+ */
+export interface PendingWebFlowStore {
+    /** Insert a new flow. MUST reject duplicate `state`. */
+    put(flow: PendingWebFlow): Promise<void>;
+    /**
+     * Atomic delete-and-return. MUST NOT return the same row twice.
+     * Returns null if the row is absent or expired.
+     */
+    consume(state: string): Promise<PendingWebFlow | null>;
+    /** Optional housekeeping for expired rows that were never claimed. */
+    cleanupExpired?(): Promise<number>;
+}
+/** @deprecated Renamed to `PendingWebFlowStore`. */
+export type PendingFlowStore = PendingWebFlowStore;
+export declare class InvalidOrExpiredFlowError extends OAuthError {
+    constructor(state: string);
+}
+export declare class StateMismatchError extends OAuthError {
+    constructor();
+}
+export declare class TokenExchangeError extends OAuthError {
+    readonly status: number;
+    readonly body: string;
+    /**
+     * RFC 6749 §5.2 error code when the authorization server returned a
+     * standard error envelope (`invalid_grant`, `invalid_client`, etc.).
+     * Undefined when the AS returned a non-OAuth-shaped failure.
+     */
+    readonly oauthErrorCode?: string | undefined;
+    constructor(message: string, status: number, body: string, 
+    /**
+     * RFC 6749 §5.2 error code when the authorization server returned a
+     * standard error envelope (`invalid_grant`, `invalid_client`, etc.).
+     * Undefined when the AS returned a non-OAuth-shaped failure.
+     */
+    oauthErrorCode?: string | undefined);
+}
+export declare class ProtectedResourceMetadataError extends OAuthError {
+    constructor(message: string);
+}
+export declare class AgentVanishedDuringFlowError extends OAuthError {
+    constructor(agentId: string);
+}
+export declare class ConfidentialClientNotAllowedError extends OAuthError {
+    constructor(agentId: string | undefined);
+}
+export interface StartWebFlowOptions {
+    /** Agent the flow is for. Must include `agent_uri`. */
+    agent: AgentConfig;
+    /** Absolute URL of the consumer's `/callback` route (must match what the AS sees). */
+    redirectUri: string;
+    /** Where to persist the pending flow until callback. */
+    pendingFlowStore: PendingWebFlowStore;
+    /** When provided, dynamic-registration results land in `agent.oauth_client`. */
+    agentStorage?: OAuthConfigStorage;
+    /**
+     * Free-form caller payload, round-tripped to `completeWebOAuthFlow`.
+     * Must be JSON-serializable. Do not store secrets here. Treated as
+     * attacker-influenced — validate before reflecting (e.g. via
+     * {@link safeReturnTo} for redirect targets).
+     */
+    carry?: Record<string, unknown>;
+    /**
+     * Scope hint (highest priority per SEP-835). Pass through the `scope`
+     * value from a prior 401 `WWW-Authenticate` challenge if you have one.
+     */
+    scopeHint?: string;
+    /** Override flow TTL. Default: {@link DEFAULT_WEB_FLOW_TTL_MS}. */
+    ttlMs?: number;
+    /** Override the random-state generator (defaults to 32 bytes base64url). */
+    generateState?: () => string;
+    /** Override `fetch` (timeouts, signing, mocks). */
+    fetch?: typeof fetch;
+    /**
+     * Override base client metadata. `redirect_uris` is always replaced
+     * with `[redirectUri]` regardless of what's passed here.
+     */
+    clientMetadata?: Partial<OAuthClientMetadata>;
+    /**
+     * Permit the AS to register a confidential client (i.e. one that
+     * returns a `client_secret` from dynamic registration). Default false:
+     * if the AS issues a secret we throw {@link ConfidentialClientNotAllowedError}
+     * rather than silently persisting a long-lived credential to your
+     * agent storage.
+     */
+    allowConfidentialClient?: boolean;
+}
+export interface StartWebFlowResult {
+    authorizationUrl: string;
+    state: string;
+    expiresAt: Date;
+}
+export interface CompleteWebFlowOptions {
+    state: string;
+    code: string;
+    pendingFlowStore: PendingWebFlowStore;
+    /** When provided, the issued tokens are persisted to `agent.oauth_tokens`. */
+    agentStorage?: OAuthConfigStorage;
+    fetch?: typeof fetch;
+    /**
+     * The caller-bound expected state (e.g. from a session cookie set at
+     * `/oauth/start`). When provided, must equal `state`; mismatch throws
+     * {@link StateMismatchError}. Without this, `state` is replay-protected
+     * but not browser-bound — see WEB-OAUTH.md.
+     */
+    expectedState?: string;
+}
+export interface CompleteWebFlowResult {
+    agentId: string;
+    agentUrl: string;
+    tokens: OAuthTokens;
+    carry?: Record<string, unknown>;
+    /** True if `agentStorage` was provided AND `saveAgent` succeeded. */
+    persisted: boolean;
+}
+/**
+ * Begin a web OAuth flow. Returns the authorization URL the consumer
+ * should redirect the browser to. Persists the PKCE verifier and other
+ * flow state via `pendingFlowStore.put` so a different process can complete it.
+ */
+export declare function startWebOAuthFlow(opts: StartWebFlowOptions): Promise<StartWebFlowResult>;
+/**
+ * Finish a web OAuth flow. Atomically consumes the pending row, exchanges
+ * the authorization code for tokens, and (if storage is provided)
+ * persists tokens to `agent.oauth_tokens`. Returns whatever the caller
+ * stashed in `carry` so the consumer can route the user appropriately.
+ *
+ * The pending row is consumed BEFORE `exchangeAuthorization` runs. A
+ * transient AS failure leaves the user with no row to retry against and
+ * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}
+ * for the full tradeoff discussion.
+ */
+export declare function completeWebOAuthFlow(opts: CompleteWebFlowOptions): Promise<CompleteWebFlowResult>;
+/**
+ * Validate a redirect target supplied via `carry`.
+ *
+ * Treats `value` as attacker-influenced. Returns a string that is safe to
+ * pass to `res.redirect`, or `undefined` if the value is invalid.
+ *
+ * Defaults to **path-only** redirects (must start with a single `/` and
+ * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`
+ * to permit absolute URLs against an allowlist.
+ *
+ * @example
+ * ```ts
+ * res.redirect(safeReturnTo(carry?.return_to) ?? '/');
+ * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');
+ * ```
+ */
+export declare function safeReturnTo(value: unknown, options?: {
+    allowedReturnHosts?: string[];
+}): string | undefined;
+/**
+ * In-memory pending-flow store for tests and single-instance dev.
+ *
+ * Production deployments MUST implement `PendingWebFlowStore` against a
+ * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so
+ * `/start` and `/callback` can hit different processes.
+ */
+export declare class InMemoryPendingFlowStore implements PendingWebFlowStore {
+    private readonly flows;
+    put(flow: PendingWebFlow): Promise<void>;
+    consume(state: string): Promise<PendingWebFlow | null>;
+    cleanupExpired(): Promise<number>;
+}
+//# sourceMappingURL=web-flow.d.ts.map

package/dist/lib/auth/oauth/web-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-flow.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAWH,OAAO,KAAK,EAEV,sBAAsB,EAEtB,mBAAmB,EAEnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAA6D,UAAU,EAAmB,MAAM,SAAS,CAAC;AAEjH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvD,sEAAsE;IACtE,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD,qBAAa,yBAA0B,SAAQ,UAAU;gBAC3C,KAAK,EAAE,MAAM;CAI1B;AAED,qBAAa,kBAAmB,SAAQ,UAAU;;CAKjD;AAED,qBAAa,kBAAmB,SAAQ,UAAU;aAG9B,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;IAC5B;;;;OAIG;aACa,cAAc,CAAC,EAAE,MAAM;gBARvC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM;IAC5B;;;;OAIG;IACa,cAAc,CAAC,EAAE,MAAM,YAAA;CAK1C;AAED,qBAAa,8BAA+B,SAAQ,UAAU;gBAChD,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,4BAA6B,SAAQ,UAAU;gBAC9C,OAAO,EAAE,MAAM;CAQ5B;AAED,qBAAa,iCAAkC,SAAQ,UAAU;gBACnD,OAAO,EAAE,MAAM,GAAG,SAAS;CASxC;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,EAAE,WAAW,CAAC;IACnB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,gFAAgF;IAChF,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,mDAAmD;IACnD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoF9F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAkDvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,GAAG,SAAS,CAoBhH;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAErD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQtD,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;CAWxC"}

package/dist/lib/auth/oauth/web-flow.js

@@ -0,0 +1,413 @@
+"use strict";
+/**
+ * Web (server-side) OAuth flow helpers for `@adcp/sdk`.
+ *
+ * Companion to `CLIFlowHandler` for environments where `/oauth/start` and
+ * `/oauth/callback` may be served by different processes. Discovery, PKCE,
+ * URL construction, and token exchange are delegated to the MCP SDK's
+ * `client/auth.js` primitives so this module is glue plus a pending-flow
+ * store interface — not reimplemented protocol logic.
+ *
+ * Wire contract:
+ *   - PRM (RFC 9728) is consulted first; `prm.resource` is the source of
+ *     truth for the RFC 8707 `resource` indicator. We fall back to
+ *     `resourceUrlFromServerUrl(agent.agent_uri)` only when the resource
+ *     server does not implement PRM (404). Connection / parse / 5xx
+ *     errors throw `ProtectedResourceMetadataError` — never silently
+ *     downgrade to local guessing.
+ *   - `prm.resource` must share an origin with the agent URL; the MCP
+ *     SDK's `checkResourceAllowed` guards against a poisoned PRM
+ *     pointing the audience at a third party.
+ *   - AS URL = `prm.authorization_servers[0]` when PRM is present, else
+ *     the agent origin.
+ *   - Scope priority: caller-supplied `scopeHint` (e.g. from a 401
+ *     `WWW-Authenticate` challenge, per SEP-835) > `prm.scopes_supported`
+ *     > `clientMetadata.scope`.
+ *   - Refresh is NOT this module's concern. Once `oauth_tokens` are
+ *     persisted, `MCPOAuthProvider` handles refresh on the next agent
+ *     call and the MCP SDK forwards `resource` into the refresh request.
+ *     Callers who DIY refresh against `oauth_tokens` are responsible for
+ *     forwarding `resource` themselves.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryPendingFlowStore = exports.ConfidentialClientNotAllowedError = exports.AgentVanishedDuringFlowError = exports.ProtectedResourceMetadataError = exports.TokenExchangeError = exports.StateMismatchError = exports.InvalidOrExpiredFlowError = exports.DEFAULT_WEB_FLOW_TTL_MS = void 0;
+exports.startWebOAuthFlow = startWebOAuthFlow;
+exports.completeWebOAuthFlow = completeWebOAuthFlow;
+exports.safeReturnTo = safeReturnTo;
+const crypto_1 = require("crypto");
+const auth_js_1 = require("@modelcontextprotocol/sdk/client/auth.js");
+const auth_utils_js_1 = require("@modelcontextprotocol/sdk/shared/auth-utils.js");
+const types_1 = require("./types");
+/**
+ * Default TTL for a pending web flow row. RFC 6749 §10.12 recommends
+ * short-lived state; 10 minutes covers slow-typing users without leaving
+ * the PKCE verifier on disk longer than necessary.
+ */
+exports.DEFAULT_WEB_FLOW_TTL_MS = 10 * 60 * 1000;
+class InvalidOrExpiredFlowError extends types_1.OAuthError {
+    constructor(state) {
+        super(`OAuth flow not found or expired (state=${state})`, 'invalid_or_expired_flow');
+        this.name = 'InvalidOrExpiredFlowError';
+    }
+}
+exports.InvalidOrExpiredFlowError = InvalidOrExpiredFlowError;
+class StateMismatchError extends types_1.OAuthError {
+    constructor() {
+        super('OAuth state does not match the value the caller bound to this session', 'state_mismatch');
+        this.name = 'StateMismatchError';
+    }
+}
+exports.StateMismatchError = StateMismatchError;
+class TokenExchangeError extends types_1.OAuthError {
+    status;
+    body;
+    oauthErrorCode;
+    constructor(message, status, body, 
+    /**
+     * RFC 6749 §5.2 error code when the authorization server returned a
+     * standard error envelope (`invalid_grant`, `invalid_client`, etc.).
+     * Undefined when the AS returned a non-OAuth-shaped failure.
+     */
+    oauthErrorCode) {
+        super(message, 'token_exchange_failed');
+        this.status = status;
+        this.body = body;
+        this.oauthErrorCode = oauthErrorCode;
+        this.name = 'TokenExchangeError';
+    }
+}
+exports.TokenExchangeError = TokenExchangeError;
+class ProtectedResourceMetadataError extends types_1.OAuthError {
+    constructor(message) {
+        super(message, 'protected_resource_metadata_error');
+        this.name = 'ProtectedResourceMetadataError';
+    }
+}
+exports.ProtectedResourceMetadataError = ProtectedResourceMetadataError;
+class AgentVanishedDuringFlowError extends types_1.OAuthError {
+    constructor(agentId) {
+        super(`Agent ${agentId} could not be loaded from storage during token persistence; tokens were not saved`, 'agent_vanished_during_flow', agentId);
+        this.name = 'AgentVanishedDuringFlowError';
+    }
+}
+exports.AgentVanishedDuringFlowError = AgentVanishedDuringFlowError;
+class ConfidentialClientNotAllowedError extends types_1.OAuthError {
+    constructor(agentId) {
+        super('Authorization server issued a confidential client (client_secret) during dynamic registration. ' +
+            'Pass `allowConfidentialClient: true` if you intend to persist a long-lived AS credential to your agent storage.', 'confidential_client_not_allowed', agentId);
+        this.name = 'ConfidentialClientNotAllowedError';
+    }
+}
+exports.ConfidentialClientNotAllowedError = ConfidentialClientNotAllowedError;
+/**
+ * Begin a web OAuth flow. Returns the authorization URL the consumer
+ * should redirect the browser to. Persists the PKCE verifier and other
+ * flow state via `pendingFlowStore.put` so a different process can complete it.
+ */
+async function startWebOAuthFlow(opts) {
+    const { agent, redirectUri, pendingFlowStore, agentStorage, carry, scopeHint, ttlMs = exports.DEFAULT_WEB_FLOW_TTL_MS, generateState, fetch: fetchFn, clientMetadata: clientMetadataOverrides, allowConfidentialClient = false, } = opts;
+    if (!agent.agent_uri) {
+        throw new types_1.OAuthError('Agent missing agent_uri', 'invalid_agent', agent.id);
+    }
+    const prm = await tryDiscoverPRM(agent.agent_uri, fetchFn);
+    if (prm?.resource) {
+        assertPrmResourceMatchesAgentOrigin(agent.agent_uri, prm.resource);
+    }
+    const asUrl = resolveAuthorizationServerUrl(agent.agent_uri, prm);
+    const asMetadata = await (0, auth_js_1.discoverAuthorizationServerMetadata)(asUrl.toString(), { fetchFn });
+    if (!asMetadata) {
+        throw new types_1.OAuthError(`No OAuth metadata at ${asUrl.toString()}`, 'no_authorization_server_metadata', agent.id);
+    }
+    const resource = prm?.resource ? new URL(prm.resource) : (0, auth_utils_js_1.resourceUrlFromServerUrl)(new URL(agent.agent_uri));
+    const baseClientMetadata = {
+        ...types_1.DEFAULT_CLIENT_METADATA,
+        ...clientMetadataOverrides,
+        redirect_uris: [redirectUri],
+    };
+    const scope = scopeHint ?? prm?.scopes_supported?.join(' ') ?? baseClientMetadata.scope;
+    const clientInformation = await resolveClientInformation({
+        agent,
+        agentStorage,
+        asUrl,
+        asMetadata,
+        clientMetadata: baseClientMetadata,
+        fetchFn,
+        allowConfidentialClient,
+    });
+    const state = (generateState ?? defaultGenerateState)();
+    const { authorizationUrl, codeVerifier } = await (0, auth_js_1.startAuthorization)(asUrl.toString(), {
+        metadata: asMetadata,
+        clientInformation,
+        redirectUrl: redirectUri,
+        scope,
+        state,
+        resource,
+    });
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + ttlMs);
+    const flow = {
+        state,
+        agentId: agent.id,
+        agentUrl: agent.agent_uri,
+        codeVerifier,
+        redirectUri,
+        resource: resource.href,
+        scope,
+        authorizationServerUrl: asUrl.toString(),
+        clientInformation,
+        createdAt: now,
+        expiresAt,
+        carry,
+    };
+    await pendingFlowStore.put(flow);
+    return {
+        authorizationUrl: authorizationUrl.toString(),
+        state,
+        expiresAt,
+    };
+}
+/**
+ * Finish a web OAuth flow. Atomically consumes the pending row, exchanges
+ * the authorization code for tokens, and (if storage is provided)
+ * persists tokens to `agent.oauth_tokens`. Returns whatever the caller
+ * stashed in `carry` so the consumer can route the user appropriately.
+ *
+ * The pending row is consumed BEFORE `exchangeAuthorization` runs. A
+ * transient AS failure leaves the user with no row to retry against and
+ * they must restart from `/oauth/start`. See {@link PendingWebFlowStore}
+ * for the full tradeoff discussion.
+ */
+async function completeWebOAuthFlow(opts) {
+    const { state, code, pendingFlowStore, agentStorage, fetch: fetchFn, expectedState } = opts;
+    if (expectedState !== undefined && expectedState !== state) {
+        throw new StateMismatchError();
+    }
+    const flow = await pendingFlowStore.consume(state);
+    if (!flow || flow.expiresAt.getTime() < Date.now()) {
+        throw new InvalidOrExpiredFlowError(state);
+    }
+    const asMetadata = await (0, auth_js_1.discoverAuthorizationServerMetadata)(flow.authorizationServerUrl, {
+        fetchFn,
+    });
+    let tokens;
+    try {
+        tokens = await (0, auth_js_1.exchangeAuthorization)(flow.authorizationServerUrl, {
+            metadata: asMetadata ?? undefined,
+            clientInformation: flow.clientInformation,
+            authorizationCode: code,
+            codeVerifier: flow.codeVerifier,
+            redirectUri: flow.redirectUri,
+            resource: flow.resource ? new URL(flow.resource) : undefined,
+            fetchFn,
+        });
+    }
+    catch (err) {
+        throw wrapTokenExchangeError(err);
+    }
+    let persisted = false;
+    if (agentStorage) {
+        const agent = await agentStorage.loadAgent(flow.agentId);
+        if (!agent) {
+            throw new AgentVanishedDuringFlowError(flow.agentId);
+        }
+        agent.oauth_tokens = (0, types_1.fromMCPTokens)(tokens);
+        delete agent.oauth_code_verifier;
+        await agentStorage.saveAgent(agent);
+        persisted = true;
+    }
+    return {
+        agentId: flow.agentId,
+        agentUrl: flow.agentUrl,
+        tokens,
+        carry: flow.carry,
+        persisted,
+    };
+}
+/**
+ * Validate a redirect target supplied via `carry`.
+ *
+ * Treats `value` as attacker-influenced. Returns a string that is safe to
+ * pass to `res.redirect`, or `undefined` if the value is invalid.
+ *
+ * Defaults to **path-only** redirects (must start with a single `/` and
+ * not be protocol-relative `//evil.example`). Pass `allowedReturnHosts`
+ * to permit absolute URLs against an allowlist.
+ *
+ * @example
+ * ```ts
+ * res.redirect(safeReturnTo(carry?.return_to) ?? '/');
+ * res.redirect(safeReturnTo(carry?.return_to, { allowedReturnHosts: ['app.example.com'] }) ?? '/');
+ * ```
+ */
+function safeReturnTo(value, options = {}) {
+    if (typeof value !== 'string' || value.length === 0)
+        return undefined;
+    // Path-only: must be `/...` but not `//...` (protocol-relative) or `/\...`.
+    if (value.startsWith('/') && !value.startsWith('//') && !value.startsWith('/\\')) {
+        return value;
+    }
+    const allowed = options.allowedReturnHosts;
+    if (!allowed || allowed.length === 0)
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:')
+        return undefined;
+    if (!allowed.includes(parsed.host))
+        return undefined;
+    return parsed.toString();
+}
+/**
+ * In-memory pending-flow store for tests and single-instance dev.
+ *
+ * Production deployments MUST implement `PendingWebFlowStore` against a
+ * shared store (Postgres `DELETE … RETURNING`, Redis `GETDEL`) so
+ * `/start` and `/callback` can hit different processes.
+ */
+class InMemoryPendingFlowStore {
+    flows = new Map();
+    async put(flow) {
+        if (this.flows.has(flow.state)) {
+            throw new Error(`Pending flow already exists for state ${flow.state}`);
+        }
+        this.flows.set(flow.state, flow);
+    }
+    async consume(state) {
+        const flow = this.flows.get(state);
+        if (!flow)
+            return null;
+        this.flows.delete(state);
+        if (flow.expiresAt.getTime() < Date.now())
+            return null;
+        return flow;
+    }
+    async cleanupExpired() {
+        const now = Date.now();
+        let removed = 0;
+        for (const [state, flow] of this.flows) {
+            if (flow.expiresAt.getTime() < now) {
+                this.flows.delete(state);
+                removed++;
+            }
+        }
+        return removed;
+    }
+}
+exports.InMemoryPendingFlowStore = InMemoryPendingFlowStore;
+// ============================================================
+// Internals
+// ============================================================
+/**
+ * The MCP SDK reports a 404 PRM lookup with this exact message; treat it
+ * as "PRM is genuinely absent" and fall back. Anything else is a
+ * connection, parse, or 5xx error and is allowed to bubble.
+ *
+ * Source (verified against `@modelcontextprotocol/sdk@1.29.0`):
+ *   `dist/esm/client/auth.js` → `discoverOAuthProtectedResourceMetadata`
+ *   throws `new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`)`
+ *   when `response.status === 404` (or no response was returned).
+ *
+ * If a future MCP SDK reword this message, the test
+ * "falls back to server-derived resource on a 404 PRM" at
+ * `test/lib/oauth-web-flow.test.js` will fail — that test calls the real
+ * SDK against a 404 fixture and is the canary for this regression.
+ */
+const PRM_ABSENT_MARKER = 'does not implement OAuth 2.0 Protected Resource Metadata';
+async function tryDiscoverPRM(agentUrl, fetchFn) {
+    try {
+        return await (0, auth_js_1.discoverOAuthProtectedResourceMetadata)(agentUrl, undefined, fetchFn);
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.includes(PRM_ABSENT_MARKER)) {
+            // PRM is optional under RFC 9728 — fall back to local resource
+            // derivation. Connection/parse/5xx errors fall through.
+            return undefined;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        throw new ProtectedResourceMetadataError(`PRM discovery failed: ${message}`);
+    }
+}
+function assertPrmResourceMatchesAgentOrigin(agentUrl, prmResource) {
+    const requested = (0, auth_utils_js_1.resourceUrlFromServerUrl)(new URL(agentUrl));
+    if (!(0, auth_utils_js_1.checkResourceAllowed)({ requestedResource: requested, configuredResource: prmResource })) {
+        throw new ProtectedResourceMetadataError(`PRM advertises resource ${prmResource} which does not share an origin/path with agent ${agentUrl}`);
+    }
+}
+function resolveAuthorizationServerUrl(agentUrl, prm) {
+    const first = prm?.authorization_servers?.[0];
+    if (first) {
+        return new URL(first);
+    }
+    return new URL(new URL(agentUrl).origin);
+}
+async function resolveClientInformation(args) {
+    const { agent, agentStorage, asUrl, asMetadata, clientMetadata, fetchFn, allowConfidentialClient } = args;
+    if (agent.oauth_client) {
+        return (0, types_1.toMCPClientInfo)(agent.oauth_client);
+    }
+    if (!asMetadata.registration_endpoint) {
+        throw new types_1.OAuthError('Agent has no oauth_client and authorization server does not advertise dynamic client registration', 'no_client_credentials', agent.id);
+    }
+    const registered = await (0, auth_js_1.registerClient)(asUrl.toString(), {
+        metadata: asMetadata,
+        clientMetadata,
+        fetchFn,
+    });
+    if (registered.client_secret && !allowConfidentialClient) {
+        throw new ConfidentialClientNotAllowedError(agent.id);
+    }
+    if (agentStorage) {
+        // Load fresh and save fresh so two concurrent /start calls for the
+        // same agentId do not trample each other's `oauth_client` via a
+        // shared in-memory reference.
+        const fresh = (await agentStorage.loadAgent(agent.id)) ?? agent;
+        fresh.oauth_client = (0, types_1.fromMCPClientInfo)(registered);
+        await agentStorage.saveAgent(fresh);
+    }
+    return registered;
+}
+function defaultGenerateState() {
+    return (0, crypto_1.randomBytes)(32).toString('base64url');
+}
+/**
+ * Map an MCP SDK token-exchange failure to {@link TokenExchangeError},
+ * redacting bearer/refresh tokens that some authorization servers echo
+ * back in error responses for debugging.
+ */
+function wrapTokenExchangeError(err) {
+    // The MCP SDK's `parseErrorResponse` decodes a well-formed OAuth error
+    // envelope into an `OAuthError` subclass with `errorCode` (e.g.
+    // `InvalidGrantError`). Malformed responses come through as
+    // `ServerError` with the raw body in `message`, so the redaction pass
+    // covers both cases.
+    const oauthErrorCode = err?.errorCode;
+    const message = err instanceof Error ? err.message : String(err);
+    const status = err?.status ?? 0;
+    const rawBody = err?.body ?? message;
+    const body = redactTokens(rawBody);
+    const display = oauthErrorCode ? `${oauthErrorCode}: ${message}` : message;
+    return new TokenExchangeError(`Token exchange failed: ${redactTokens(display)}`, status, body, oauthErrorCode);
+}
+const SENSITIVE_TOKEN_KEYS = ['access_token', 'refresh_token', 'id_token', 'token'];
+/**
+ * Best-effort redaction of bearer/refresh tokens from an AS error body
+ * (which may be JSON, form-encoded, or freeform). Adopters MUST still
+ * treat `TokenExchangeError.body` as sensitive — do not reflect it to
+ * the browser or write it to access logs unredacted.
+ */
+function redactTokens(input) {
+    let out = input;
+    for (const key of SENSITIVE_TOKEN_KEYS) {
+        // JSON form: "key":"…"
+        out = out.replace(new RegExp(`("${key}"\\s*:\\s*")[^"]*(")`, 'gi'), '$1<redacted>$2');
+        // form-encoded: key=…
+        out = out.replace(new RegExp(`(\\b${key}=)[^&\\s]+`, 'gi'), '$1<redacted>');
+    }
+    return out;
+}
+//# sourceMappingURL=web-flow.js.map

package/dist/lib/auth/oauth/web-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-flow.js","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/web-flow.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;AA2PH,8CAoFC;AAaD,oDAkDC;AAkBD,oCAoBC;AAlbD,mCAAqC;AACrC,sEAMkD;AAClD,kFAAgH;AAWhH,mCAAiH;AAEjH;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAoFtD,MAAa,yBAA0B,SAAQ,kBAAU;IACvD,YAAY,KAAa;QACvB,KAAK,CAAC,0CAA0C,KAAK,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC;AAED,MAAa,kBAAmB,SAAQ,kBAAU;IAChD;QACE,KAAK,CAAC,uEAAuE,EAAE,gBAAgB,CAAC,CAAC;QACjG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED,MAAa,kBAAmB,SAAQ,kBAAU;IAG9B;IACA;IAMA;IATlB,YACE,OAAe,EACC,MAAc,EACd,IAAY;IAC5B;;;;OAIG;IACa,cAAuB;QAEvC,KAAK,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QATxB,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAMZ,mBAAc,GAAd,cAAc,CAAS;QAGvC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAfD,gDAeC;AAED,MAAa,8BAA+B,SAAQ,kBAAU;IAC5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AALD,wEAKC;AAED,MAAa,4BAA6B,SAAQ,kBAAU;IAC1D,YAAY,OAAe;QACzB,KAAK,CACH,SAAS,OAAO,mFAAmF,EACnG,4BAA4B,EAC5B,OAAO,CACR,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AATD,oEASC;AAED,MAAa,iCAAkC,SAAQ,kBAAU;IAC/D,YAAY,OAA2B;QACrC,KAAK,CACH,iGAAiG;YAC/F,iHAAiH,EACnH,iCAAiC,EACjC,OAAO,CACR,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAVD,8EAUC;AA2ED;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CAAC,IAAyB;IAC/D,MAAM,EACJ,KAAK,EACL,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,KAAK,EACL,SAAS,EACT,KAAK,GAAG,+BAAuB,EAC/B,aAAa,EACb,KAAK,EAAE,OAAO,EACd,cAAc,EAAE,uBAAuB,EACvC,uBAAuB,GAAG,KAAK,GAChC,GAAG,IAAI,CAAC;IAET,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,kBAAU,CAAC,yBAAyB,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;QAClB,mCAAmC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAElE,MAAM,UAAU,GAAG,MAAM,IAAA,6CAAmC,EAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAU,CAAC,wBAAwB,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,kCAAkC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,wCAAwB,EAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAE5G,MAAM,kBAAkB,GAAwB;QAC9C,GAAG,+BAAuB;QAC1B,GAAG,uBAAuB;QAC1B,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B,CAAC;IAEF,MAAM,KAAK,GAAG,SAAS,IAAI,GAAG,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;IAExF,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CAAC;QACvD,KAAK;QACL,YAAY;QACZ,KAAK;QACL,UAAU;QACV,cAAc,EAAE,kBAAkB;QAClC,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,CAAC,aAAa,IAAI,oBAAoB,CAAC,EAAE,CAAC;IACxD,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,MAAM,IAAA,4BAAkB,EAAC,KAAK,CAAC,QAAQ,EAAE,EAAE;QACpF,QAAQ,EAAE,UAAU;QACpB,iBAAiB;QACjB,WAAW,EAAE,WAAW;QACxB,KAAK;QACL,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;IAClD,MAAM,IAAI,GAAmB;QAC3B,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,YAAY;QACZ,WAAW;QACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,KAAK;QACL,sBAAsB,EAAE,KAAK,CAAC,QAAQ,EAAE;QACxC,iBAAiB;QACjB,SAAS,EAAE,GAAG;QACd,SAAS;QACT,KAAK;KACN,CAAC;IACF,MAAM,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEjC,OAAO;QACL,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QAC7C,KAAK;QACL,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,oBAAoB,CAAC,IAA4B;IACrE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE5F,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,6CAAmC,EAAC,IAAI,CAAC,sBAAsB,EAAE;QACxF,OAAO;KACR,CAAC,CAAC;IAEH,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAA,+BAAqB,EAAC,IAAI,CAAC,sBAAsB,EAAE;YAChE,QAAQ,EAAE,UAAU,IAAI,SAAS;YACjC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,iBAAiB,EAAE,IAAI;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5D,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,YAAY,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,mBAAmB,CAAC;QACjC,MAAM,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM;QACN,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,YAAY,CAAC,KAAc,EAAE,UAA6C,EAAE;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtE,4EAA4E;IAC5E,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAClF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAa,wBAAwB;IAClB,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D,KAAK,CAAC,GAAG,CAAC,IAAoB;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA7BD,4DA6BC;AAED,+DAA+D;AAC/D,YAAY;AACZ,+DAA+D;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,iBAAiB,GAAG,0DAA0D,CAAC;AAErF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,OAAiC;IAEjC,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,gDAAsC,EAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpE,+DAA+D;YAC/D,wDAAwD;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,8BAA8B,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAAC,QAAgB,EAAE,WAAmB;IAChF,MAAM,SAAS,GAAG,IAAA,wCAAwB,EAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAA,oCAAoB,EAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,8BAA8B,CACtC,2BAA2B,WAAW,mDAAmD,QAAQ,EAAE,CACpG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAgB,EAAE,GAA+C;IACtG,MAAM,KAAK,GAAG,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,IAQvC;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,IAAI,CAAC;IAE1G,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,IAAA,uBAAe,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAU,CAClB,mGAAmG,EACnG,uBAAuB,EACvB,KAAK,CAAC,EAAE,CACT,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAA+B,MAAM,IAAA,wBAAc,EAAC,KAAK,CAAC,QAAQ,EAAE,EAAE;QACpF,QAAQ,EAAE,UAAU;QACpB,cAAc;QACd,OAAO;KACR,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACzD,MAAM,IAAI,iCAAiC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,mEAAmE;QACnE,gEAAgE;QAChE,8BAA8B;QAC9B,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC;QAChE,KAAK,CAAC,YAAY,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;QACnD,MAAM,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,GAAY;IAC1C,uEAAuE;IACvE,gEAAgE;IAChE,4DAA4D;IAC5D,sEAAsE;IACtE,qBAAqB;IACrB,MAAM,cAAc,GAAI,GAA8B,EAAE,SAAS,CAAC;IAClE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,MAAM,GAAI,GAA2B,EAAE,MAAM,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAI,GAAyB,EAAE,IAAI,IAAI,OAAO,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3E,OAAO,IAAI,kBAAkB,CAAC,0BAA0B,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACvC,uBAAuB;QACvB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,sBAAsB,EAAE,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACtF,sBAAsB;QACtB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,YAAY,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-05-05T15:52:36.563Z"
+  "synced_at": "2026-05-07T19:07:41.217Z"
 }

package/dist/lib/utils/response-unwrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-unwrapper.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/response-unwrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,KAAK,EACV,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAGlC;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB,mBAAmB,GACnB,2BAA2B,GAC3B,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,GACrB,sBAAsB,GACtB,oBAAoB,GACpB,2BAA2B,GAC3B,kCAAkC,GAClC,qBAAqB,GACrB,uBAAuB,GACvB,kBAAkB,GAClB,sBAAsB,CAAC;AAE3B;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,gBAAgB,EAAE,GAAG,EACrB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,EACxB,OAAO,CAAC,EAAE;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5C,YAAY,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CA0FtC;AAyDD;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1F,eAAO,MAAM,mBAAmB,EAAG,kBAA2B,CAAC;AAuI/D;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAI/E;AAoFD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAIlD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAgBtE"}
+{"version":3,"file":"response-unwrapper.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/response-unwrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,KAAK,EACV,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAGlC;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB,mBAAmB,GACnB,2BAA2B,GAC3B,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,GACrB,sBAAsB,GACtB,oBAAoB,GACpB,2BAA2B,GAC3B,kCAAkC,GAClC,qBAAqB,GACrB,uBAAuB,GACvB,kBAAkB,GAClB,sBAAsB,CAAC;AAE3B;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,gBAAgB,EAAE,GAAG,EACrB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,EACxB,OAAO,CAAC,EAAE;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5C,YAAY,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CA0FtC;AAyDD;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1F,eAAO,MAAM,mBAAmB,EAAG,kBAA2B,CAAC;AAuI/D;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAI/E;AAsFD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAIlD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAgBtE"}

package/dist/lib/utils/response-unwrapper.js

@@ -303,20 +303,21 @@ function readExtractionPath(data) {
 /**
  * Unwrap A2A response
  *
- * NOTE: This function should only be called when status is "completed".
- * Intermediate statuses ("working", "submitted", "input-required") are handled
- * at the response level (not in artifacts) and should not reach this function.
+ * Called for terminal task states ("completed", "failed", "rejected",
+ * "canceled"). All four carry the same artifact + DataPart envelope per
+ * AdCP transport-errors §A2A Binding — failed tasks place `adcp_error`
+ * into the DataPart alongside an optional terse TextPart.
  *
- * A2A response flow:
- * - Intermediate: { status: "working", message: "..." } - NO artifacts yet
- * - Completed: { status: "completed", result: { artifacts: [...] } } - Parse artifacts here
+ * Intermediate statuses ("working", "submitted", "input-required",
+ * "auth-required") do not yet have AdCP artifacts and are rejected here
+ * so callers handle them at the response level.
  */
+const TERMINAL_A2A_STATES = new Set(['completed', 'failed', 'rejected', 'canceled']);
 function unwrapA2AResponse(response) {
-    // Validate that we're not processing intermediate statuses
-    // Task status check: only completed tasks should reach artifact extraction
-    if (response.result?.status?.state && response.result.status.state !== 'completed') {
-        throw new Error(`Cannot unwrap A2A response with intermediate status: ${response.result.status.state}. ` +
-            'Only completed responses should be unwrapped.');
+    const taskState = response.result?.status?.state;
+    if (taskState && !TERMINAL_A2A_STATES.has(taskState)) {
+        throw new Error(`Cannot unwrap A2A response with intermediate status: ${taskState}. ` +
+            'Only terminal responses (completed, failed, rejected, canceled) should be unwrapped.');
     }
     // A2A error response (JSON-RPC error)
     if (response.error) {
@@ -330,20 +331,20 @@ function unwrapA2AResponse(response) {
             ],
         };
     }
-    // A2A completed response - simple requirements per AdCP spec:
-    // - MUST have result.artifacts array with at least one completed artifact
-    // - Completed artifact MUST have at least one DataPart (kind: 'data') with the AdCP response
+    // A2A terminal response — same shape regardless of success or failure:
+    // - MUST have result.artifacts array with at least one artifact
+    // - Artifact MUST have at least one DataPart (kind: 'data') with the AdCP payload
+    //   (success payload for `completed`, `adcp_error` envelope for `failed`)
     // - MAY have TextParts (kind: 'text') with optional messages
     const artifacts = response.result?.artifacts;
     if (!Array.isArray(artifacts) || artifacts.length === 0) {
-        throw new Error('A2A completed response must have at least one artifact');
+        throw new Error('A2A response must have at least one artifact');
     }
     // Take last artifact (conversational protocols append artifacts over time)
     // Note: A2A artifacts don't have a status field - only Tasks have status.
-    // If the Task status is "completed", all artifacts in result.artifacts are completed.
     const artifact = artifacts[artifacts.length - 1];
     if (!artifact) {
-        throw new Error('A2A completed response must have at least one artifact');
+        throw new Error('A2A response must have at least one artifact');
     }
     if (!artifact.parts || !Array.isArray(artifact.parts)) {
         throw new Error('A2A artifact missing parts array');
@@ -353,7 +354,7 @@ function unwrapA2AResponse(response) {
     const dataParts = artifact.parts.filter((p) => p.kind === 'data');
     const dataPart = dataParts[dataParts.length - 1];
     if (!dataPart?.data) {
-        throw new Error('A2A completed response must have a DataPart with AdCP data');
+        throw new Error('A2A response must have a DataPart with AdCP data');
     }
     const textParts = artifact.parts.filter((p) => p.kind === 'text' && p.text).map((p) => p.text);
     // Unwrap nested response field if present (some agents wrap AdCP responses)

package/dist/lib/utils/response-unwrapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"response-unwrapper.js","sourceRoot":"","sources":["../../../src/lib/utils/response-unwrapper.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA2DH,wDA+FC;AA4MD,gDAIC;AAyFD,kCAIC;AAQD,sCAgBC;AA7dD,6BAAwB;AACxB,iDAAoD;AAEpD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,WAAW;IACtB,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,SAAS;CACV,CAAC;AAgBX,yDAA2D;AAqB3D;;;;;;;;;GASG;AACH,SAAgB,sBAAsB,CACpC,gBAAqB,EACrB,QAAiB,EACjB,QAAwB,EACxB,OAA6C;IAE7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI,SAAc,CAAC;IACnB,IAAI,iBAAgD,CAAC;IACrD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QACpD,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3B,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAC7C,CAAC;SAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,wCAAwC;QACxC,IAAI,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YACpD,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;YAC3B,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,CAAC;aAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC3C,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,CAAiD,KAAQ,EAAK,EAAE;QAC5E,IAAI,iBAAiB,KAAK,SAAS;YAAE,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClD,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,uEAAuE;IACvE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,wCAAqB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,iFAAiF;YACjF,yFAAyF;YACzF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,GAAG,SAAoC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,+EAA+E;gBAC/E,yFAAyF;gBACzF,IAAI,OAAO,EAAE,qBAAqB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;oBAClE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAC/D,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,SAAS,GAAG,QAA2D,CAAC;wBAC9E,IAAI,IAAI;4BAAE,SAAS,CAAC,QAAQ,GAAG,IAAc,CAAC;wBAC9C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBAED,6DAA6D;gBAC7D,iEAAiE;gBACjE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,EAAE,IAAI,KAAK,eAAe,CAAC;gBAE9F,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,YAAY,GAAG,IAAA,iCAAkB,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAChE,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC5C,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAChF,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,KAAK,WAAW,EAAE,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;gBAED,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC;YAED,2EAA2E;YAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,IAA4C,CAAC;YACtE,IAAI,IAAI;gBAAE,SAAS,CAAC,QAAQ,GAAG,IAAc,CAAC;YAC9C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,OAAO,SAAyB,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,MAAiB,EAAE,IAA6B;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,aAAa,GAAI,MAA2B,CAAC,KAAK,EAAE,QAAQ,CAAC;IACnE,IAAI,CAAC,CAAC,aAAa,YAAY,OAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,MAAM,aAAa,GAAI,aAAiC,CAAC,OAAO,CAAC;IACjE,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,4BAA4B;IAC5B,IAAI,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QAC5D,OAAO,CAAC,IAAI,CACV,0BAA0B,YAAY,mDAAmD,aAAa,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,SAAS,CACjJ,CAAC;QACF,OAAO,WAAW,CAAC,IAA+B,CAAC;IACrD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAAa;IAClC,OAAO,mBAAmB,IAAI,QAAQ,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,IAAI,QAAQ,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,QAAa;IAClC,OAAO,QAAQ,IAAI,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AACxH,CAAC;AAUY,QAAA,mBAAmB,GAAG,kBAA2B,CAAC;AAO/D;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,QAAa;IACtC,gFAAgF;IAChF,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,oDAAoD;QACpD,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,QAAQ,CAAC,iBAAiB,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,iBAAiC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QACzF,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACvC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBACrC,IAAI,MAAM,EAAE,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BACrE,OAAO,EAAE,MAAM,EAAE,MAAsB,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;wBACrE,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,0CAA0C;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI;YAC5D,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,IAAI,eAAe,CAAC;QAE9C,OAAO;YACL,MAAM,EAAE;gBACN,UAAU,EAAE;oBACV,IAAI,EAAE,WAAW,CAAC,SAAS;oBAC3B,OAAO,EAAE,YAAY,IAAI,sBAAsB;oBAC/C,SAAS,EAAE,IAAI;iBAChB;aACyB;YAC5B,cAAc,EAAE,OAAO;SACxB,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAAC;QAExC,uEAAuE;QACvE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACtC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE;oBACN,GAAG,IAAI;oBACP,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClC;gBACD,cAAc,EAAE,oBAAoB;aACrC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;IAChE,CAAC;IAED,kDAAkD;IAClD,IAAI,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QACzE,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;gBACxD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;gBAE9G,OAAO;oBACL,MAAM,EAAE;wBACN,MAAM,EAAE;4BACN;gCACE,IAAI,EAAE,WAAW,CAAC,gBAAgB;gCAClC,OAAO,EAAE,kEAAkE,OAAO,GAAG;6BACtF;yBACF;qBACF;oBACD,cAAc,EAAE,eAAe;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAoB,EAAE,IAAuB;IACtE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,2BAAmB,EAAE;YACjD,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,2EAA2E;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,IAAa;IAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,IAAI,GAAI,IAAgC,CAAC,2BAAmB,CAAC,CAAC;IACpE,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,QAAa;IACtC,2DAA2D;IAC3D,2EAA2E;IAC3E,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI;YACtF,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,sCAAsC;IACtC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,WAAW,CAAC,OAAO;oBAC5D,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,6BAA6B;oBAChE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC1D;aACF;SACF,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,0EAA0E;IAC1E,6FAA6F;IAC7F,6DAA6D;IAE7D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,sFAAsF;IACtF,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,uDAAuD;IACvD,2FAA2F;IAC3F,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEzG,4EAA4E;IAC5E,IAAI,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,oCAAoC;IACpC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,QAAa;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,QAAQ,EAAE,UAAU,IAAI,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,QAAa,EAAE,QAAgB;IAC3D,wCAAwC;IACxC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,wCAAqB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,6DAA6D;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"response-unwrapper.js","sourceRoot":"","sources":["../../../src/lib/utils/response-unwrapper.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA2DH,wDA+FC;AA4MD,gDAIC;AA2FD,kCAIC;AAQD,sCAgBC;AA/dD,6BAAwB;AACxB,iDAAoD;AAEpD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,WAAW;IACtB,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,SAAS;CACV,CAAC;AAgBX,yDAA2D;AAqB3D;;;;;;;;;GASG;AACH,SAAgB,sBAAsB,CACpC,gBAAqB,EACrB,QAAiB,EACjB,QAAwB,EACxB,OAA6C;IAE7C,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI,SAAc,CAAC;IACnB,IAAI,iBAAgD,CAAC;IACrD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QACpD,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3B,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAC7C,CAAC;SAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,wCAAwC;QACxC,IAAI,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YACpD,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;YAC3B,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,CAAC;aAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC3C,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,CAAiD,KAAQ,EAAK,EAAE;QAC5E,IAAI,iBAAiB,KAAK,SAAS;YAAE,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClD,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,uEAAuE;IACvE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,wCAAqB,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,iFAAiF;YACjF,yFAAyF;YACzF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,GAAG,SAAoC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,+EAA+E;gBAC/E,yFAAyF;gBACzF,IAAI,OAAO,EAAE,qBAAqB,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;oBAClE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAC/D,IAAI,QAAQ,EAAE,CAAC;wBACb,MAAM,SAAS,GAAG,QAA2D,CAAC;wBAC9E,IAAI,IAAI;4BAAE,SAAS,CAAC,QAAQ,GAAG,IAAc,CAAC;wBAC9C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBAED,6DAA6D;gBAC7D,iEAAiE;gBACjE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,EAAE,IAAI,KAAK,eAAe,CAAC;gBAE9F,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,YAAY,GAAG,IAAA,iCAAkB,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAChE,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC5C,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAChF,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,KAAK,WAAW,EAAE,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;gBAED,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC;YAED,2EAA2E;YAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,IAA4C,CAAC;YACtE,IAAI,IAAI;gBAAE,SAAS,CAAC,QAAQ,GAAG,IAAc,CAAC;YAC9C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,OAAO,SAAyB,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,MAAiB,EAAE,IAA6B;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,aAAa,GAAI,MAA2B,CAAC,KAAK,EAAE,QAAQ,CAAC;IACnE,IAAI,CAAC,CAAC,aAAa,YAAY,OAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,MAAM,aAAa,GAAI,aAAiC,CAAC,OAAO,CAAC;IACjE,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,4BAA4B;IAC5B,IAAI,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QAC5D,OAAO,CAAC,IAAI,CACV,0BAA0B,YAAY,mDAAmD,aAAa,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,SAAS,CACjJ,CAAC;QACF,OAAO,WAAW,CAAC,IAA+B,CAAC;IACrD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAAa;IAClC,OAAO,mBAAmB,IAAI,QAAQ,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,IAAI,QAAQ,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,QAAa;IAClC,OAAO,QAAQ,IAAI,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AACxH,CAAC;AAUY,QAAA,mBAAmB,GAAG,kBAA2B,CAAC;AAO/D;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,QAAa;IACtC,gFAAgF;IAChF,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,oDAAoD;QACpD,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,QAAQ,CAAC,iBAAiB,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,iBAAiC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QACzF,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACvC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBACrC,IAAI,MAAM,EAAE,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BACrE,OAAO,EAAE,MAAM,EAAE,MAAsB,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;wBACrE,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,0CAA0C;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClD,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI;YAC5D,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,IAAI,eAAe,CAAC;QAE9C,OAAO;YACL,MAAM,EAAE;gBACN,UAAU,EAAE;oBACV,IAAI,EAAE,WAAW,CAAC,SAAS;oBAC3B,OAAO,EAAE,YAAY,IAAI,sBAAsB;oBAC/C,SAAS,EAAE,IAAI;iBAChB;aACyB;YAC5B,cAAc,EAAE,OAAO;SACxB,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAAC;QAExC,uEAAuE;QACvE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACtC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE;oBACN,GAAG,IAAI;oBACP,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;iBAClC;gBACD,cAAc,EAAE,oBAAoB;aACrC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;IAChE,CAAC;IAED,kDAAkD;IAClD,IAAI,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QACzE,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;gBACxD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;gBAE9G,OAAO;oBACL,MAAM,EAAE;wBACN,MAAM,EAAE;4BACN;gCACE,IAAI,EAAE,WAAW,CAAC,gBAAgB;gCAClC,OAAO,EAAE,kEAAkE,OAAO,GAAG;6BACtF;yBACF;qBACF;oBACD,cAAc,EAAE,eAAe;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAoB,EAAE,IAAuB;IACtE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,2BAAmB,EAAE;YACjD,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,2EAA2E;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,IAAa;IAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,IAAI,GAAI,IAAgC,CAAC,2BAAmB,CAAC,CAAC;IACpE,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1G,SAAS,iBAAiB,CAAC,QAAa;IACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IACjD,IAAI,SAAS,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,wDAAwD,SAAS,IAAI;YACnE,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,sCAAsC;IACtC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,WAAW,CAAC,OAAO;oBAC5D,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,6BAA6B;oBAChE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC1D;aACF;SACF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,gEAAgE;IAChE,kFAAkF;IAClF,0EAA0E;IAC1E,6DAA6D;IAE7D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,uDAAuD;IACvD,2FAA2F;IAC3F,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEzG,4EAA4E;IAC5E,IAAI,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,oCAAoC;IACpC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,QAAa;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,QAAQ,EAAE,UAAU,IAAI,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,QAAa,EAAE,QAAgB;IAC3D,wCAAwC;IACxC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,wCAAqB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,6DAA6D;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/version.d.ts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "6.12.0";
+export declare const LIBRARY_VERSION = "6.13.1";
 /**
  * AdCP specification version this library is built for
  */
@@ -29,10 +29,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "6.12.0";
+    readonly library: "6.13.1";
     readonly adcp: "3.0.6";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0-beta.1", "3.0.0-beta.3", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6"];
-    readonly generatedAt: "2026-05-05T15:52:11.508Z";
+    readonly generatedAt: "2026-05-07T19:07:17.284Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -11,7 +11,7 @@ exports.parseAdcpMajorVersion = parseAdcpMajorVersion;
 /**
  * AdCP SDK library version
  */
-exports.LIBRARY_VERSION = '6.12.0';
+exports.LIBRARY_VERSION = '6.13.1';
 /**
  * AdCP specification version this library is built for
  */
@@ -43,10 +43,10 @@ exports.COMPATIBLE_ADCP_VERSIONS = [
  * Full version information
  */
 exports.VERSION_INFO = {
-    library: '6.12.0',
+    library: '6.13.1',
     adcp: '3.0.6',
     compatibleVersions: exports.COMPATIBLE_ADCP_VERSIONS,
-    generatedAt: '2026-05-05T15:52:11.508Z',
+    generatedAt: '2026-05-07T19:07:17.284Z',
 };
 /**
  * Get the AdCP specification version this library is built for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "6.12.0",
+  "version": "6.13.1",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",