@boopkit/cap-oauth-server 0.1.4 → 0.3.1

package/dist/discovery.js

@@ -32,8 +32,9 @@
  * match exactly as clients enter it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DISCOVERY_MAX_AGE_SECONDS = exports.DEFAULT_SCOPES_SUPPORTED = exports.DEVICE_CODE_GRANT_TYPE = exports.CODE_CHALLENGE_METHODS_SUPPORTED = void 0;
+exports.PROTECTED_RESOURCE_METADATA_PATH = exports.DISCOVERY_MAX_AGE_SECONDS = exports.DEFAULT_SCOPES_SUPPORTED = exports.DEVICE_CODE_GRANT_TYPE = exports.CODE_CHALLENGE_METHODS_SUPPORTED = void 0;
 exports.buildAuthorizationServerMetadata = buildAuthorizationServerMetadata;
+exports.protectedResourceMetadataPaths = protectedResourceMetadataPaths;
 exports.buildProtectedResourceMetadata = buildProtectedResourceMetadata;
 /** Only S256. `plain` is not a PKCE method, it is the absence of one. */
 exports.CODE_CHALLENGE_METHODS_SUPPORTED = ['S256'];
@@ -81,6 +82,59 @@ function buildAuthorizationServerMetadata(config) {
         metadata.service_documentation = config.documentationUri;
     return metadata;
 }
+/** Where RFC 9728 puts the document for a resource mounted at the root. */
+exports.PROTECTED_RESOURCE_METADATA_PATH = '/.well-known/oauth-protected-resource';
+/**
+ * Every path the protected-resource document should answer at, bare path first.
+ *
+ * RFC 9728 3.1 locates the document by inserting the well-known segment
+ * between the resource URL's host and its path, so a resource at
+ * `https://host/api/mcp` publishes at
+ * `https://host/.well-known/oauth-protected-resource/api/mcp`. A resource at
+ * the root has nothing to insert before, and gets the bare path alone.
+ *
+ * The bare path is kept for a resource that is *not* at the root, because that
+ * is where clients in the field look after the specified location answers 404
+ * — observed 2026-09-06 with the Claude desktop app, which asks for the
+ * suffixed form first and falls back. Serving both costs one more literal
+ * route carrying the same body.
+ *
+ * The suffix comes from configuration read at boot and never from request
+ * input, so the routes below are fixed strings: there is no parameter to
+ * traverse with, for the same reason the documents themselves are computed
+ * rather than read off disk. Two inputs yield the bare path alone rather than
+ * a route built out of something that is not one: a `resource` that will not
+ * parse as a URL, and a path Express would read as a pattern — see
+ * `LITERAL_PATH` below.
+ */
+function protectedResourceMetadataPaths(resource) {
+    let pathname;
+    try {
+        pathname = new URL(resource).pathname;
+    }
+    catch {
+        return [exports.PROTECTED_RESOURCE_METADATA_PATH];
+    }
+    const suffix = pathname.replace(/\/+$/, '');
+    if (suffix === '' || !LITERAL_PATH.test(suffix))
+        return [exports.PROTECTED_RESOURCE_METADATA_PATH];
+    return [exports.PROTECTED_RESOURCE_METADATA_PATH, `${exports.PROTECTED_RESOURCE_METADATA_PATH}${suffix}`];
+}
+/**
+ * A path Express will match as the literal string it is.
+ *
+ * Express 5 parses its route paths, and several characters RFC 3986 allows in
+ * a path mean something to that parser: `:name` becomes a parameter matching
+ * any segment — silently, so the route would match the wrong URLs and not the
+ * right one — while `(`, `+` and `[` throw as the router is built, which for a
+ * value read at boot means the application does not start.
+ *
+ * So the suffixed route is offered only for a path made of characters that
+ * carry no meaning to the parser. Anything else keeps the bare path and loses
+ * only the second location; an app that refuses to boot over a discovery
+ * document's address would be the worse trade by far.
+ */
+const LITERAL_PATH = /^[A-Za-z0-9\-._~%!$&',;=@/]+$/;
 /** RFC 9728. */
 function buildProtectedResourceMetadata(config) {
     const metadata = {

package/dist/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AAiEH,4EAmCC;AAWD,wEAiBC;AAhGD,yEAAyE;AAC5D,QAAA,gCAAgC,GAAG,CAAC,MAAM,CAAU,CAAC;AAElE,6EAA6E;AAChE,QAAA,sBAAsB,GAAG,8CAA8C,CAAC;AAErF,6EAA6E;AAChE,QAAA,wBAAwB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAE/E,gFAAgF;AACnE,QAAA,yBAAyB,GAAG,IAAI,CAAC;AAE9C,0EAA0E;AAC1E,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAiBD,gEAAgE;AAChE,SAAgB,gCAAgC,CAC9C,MAAuB;IAEvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,iBAAiB;QAAE,UAAU,CAAC,IAAI,CAAC,8BAAsB,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAgC;QAC5C,MAAM,EAAE,IAAI;QACZ,sBAAsB,EAAE,GAAG,IAAI,kBAAkB;QACjD,cAAc,EAAE,GAAG,IAAI,cAAc;QACrC,gEAAgE;QAChE,wEAAwE;QACxE,kDAAkD;QAClD,qBAAqB,EAAE,GAAG,IAAI,iBAAiB;QAC/C,wEAAwE;QACxE,qEAAqE;QACrE,oDAAoD;QACpD,mBAAmB,EAAE,GAAG,IAAI,eAAe;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,UAAU;QACjC,2EAA2E;QAC3E,+CAA+C;QAC/C,gCAAgC,EAAE,CAAC,GAAG,wCAAgC,CAAC;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,8CAA8C;QAC9C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QAC7C,qCAAqC,EAAE,IAAI;KAC5C,CAAC;IAEF,IAAI,MAAM,CAAC,gBAAgB;QAAE,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACtF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD,gBAAgB;AAChB,SAAgB,8BAA8B,CAC5C,MAAuB;IAEvB,MAAM,QAAQ,GAA8B;QAC1C,iEAAiE;QACjE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,0EAA0E;QAC1E,wCAAwC;QACxC,qBAAqB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QAC7C,0EAA0E;QAC1E,gCAAgC;QAChC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;IAEF,IAAI,MAAM,CAAC,gBAAgB;QAAE,QAAQ,CAAC,sBAAsB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACvF,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AAiEH,4EAmCC;AAoCD,wEAYC;AAmBD,wEAiBC;AAxJD,yEAAyE;AAC5D,QAAA,gCAAgC,GAAG,CAAC,MAAM,CAAU,CAAC;AAElE,6EAA6E;AAChE,QAAA,sBAAsB,GAAG,8CAA8C,CAAC;AAErF,6EAA6E;AAChE,QAAA,wBAAwB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAE/E,gFAAgF;AACnE,QAAA,yBAAyB,GAAG,IAAI,CAAC;AAE9C,0EAA0E;AAC1E,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAiBD,gEAAgE;AAChE,SAAgB,gCAAgC,CAC9C,MAAuB;IAEvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,iBAAiB;QAAE,UAAU,CAAC,IAAI,CAAC,8BAAsB,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAgC;QAC5C,MAAM,EAAE,IAAI;QACZ,sBAAsB,EAAE,GAAG,IAAI,kBAAkB;QACjD,cAAc,EAAE,GAAG,IAAI,cAAc;QACrC,gEAAgE;QAChE,wEAAwE;QACxE,kDAAkD;QAClD,qBAAqB,EAAE,GAAG,IAAI,iBAAiB;QAC/C,wEAAwE;QACxE,qEAAqE;QACrE,oDAAoD;QACpD,mBAAmB,EAAE,GAAG,IAAI,eAAe;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,UAAU;QACjC,2EAA2E;QAC3E,+CAA+C;QAC/C,gCAAgC,EAAE,CAAC,GAAG,wCAAgC,CAAC;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,8CAA8C;QAC9C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QAC7C,qCAAqC,EAAE,IAAI;KAC5C,CAAC;IAEF,IAAI,MAAM,CAAC,gBAAgB;QAAE,QAAQ,CAAC,qBAAqB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACtF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD,2EAA2E;AAC9D,QAAA,gCAAgC,GAAG,uCAAuC,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,8BAA8B,CAAC,QAAgB;IAC7D,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,wCAAgC,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,wCAAgC,CAAC,CAAC;IAE3F,OAAO,CAAC,wCAAgC,EAAE,GAAG,wCAAgC,GAAG,MAAM,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAErD,gBAAgB;AAChB,SAAgB,8BAA8B,CAC5C,MAAuB;IAEvB,MAAM,QAAQ,GAA8B;QAC1C,iEAAiE;QACjE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,0EAA0E;QAC1E,wCAAwC;QACxC,qBAAqB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,gBAAgB,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QAC7C,0EAA0E;QAC1E,gCAAgC;QAChC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;IAEF,IAAI,MAAM,CAAC,gBAAgB;QAAE,QAAQ,CAAC,sBAAsB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IACvF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/errors.d.ts

@@ -23,4 +23,42 @@ export declare class ClientRegistryError extends Error {
 }
 /** Is this one of ours? Narrower than `instanceof` across module instances. */
 export declare function isClientRegistryError(err: unknown): err is ClientRegistryError;
+/**
+ * Did the store refuse this write because a unique index already holds the
+ * value — Prisma's `P2002`?
+ *
+ * The registry's two create paths each do a find, then a create, with at least
+ * one `await` in between, so two callers can both look, both see nothing, and
+ * both write. Postgres settles that with the unique index on `client_id`, and
+ * the losing caller gets a `P2002`. Recognising it is what lets the loser
+ * converge on the winner's row instead of surfacing a database error to
+ * somebody who asked a perfectly ordinary question.
+ *
+ * `field` narrows the check to one column, and callers should pass it. A
+ * `P2002` on `public_id` is a generated-identifier collision, which is a
+ * genuinely exceptional thing and must not be mistaken for a lost race on a
+ * `client_id` somebody else was registering at the same moment.
+ *
+ * ## Why `field` is matched in two spellings
+ *
+ * Pass the **Prisma field name** — `clientId`. What arrives in `meta.target`
+ * may be either that or the mapped column name, and which one depends on the
+ * connector rather than on anything the caller can see:
+ *
+ *     PostgreSQL   target: ['client_id']    the column, from the constraint
+ *     MySQL        target: ['clientId']     the field
+ *
+ * So both are accepted, derived here rather than spelled out at each call site.
+ * This is not defensive padding; it is a measured result.
+ * `tests/integration/oauth-clients-postgres.test.ts` was written because an
+ * in-memory delegate gets to decide what its own errors look like, and the
+ * first thing real Postgres said was that the delegate had chosen the wrong
+ * spelling. A predicate matching only `clientId` passes every mock test in the
+ * suite and recovers from nothing in production.
+ *
+ * Matched structurally rather than with `instanceof PrismaClientKnownRequestError`,
+ * for the same reason `isClientRegistryError` is: this package never imports
+ * `@prisma/client`, and the delegate it is handed belongs to the application.
+ */
+export declare function isUniqueConstraintViolation(err: unknown, field?: string): boolean;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wDAAwD;AACxD,MAAM,MAAM,uBAAuB,GAC/B,yBAAyB,GACzB,sBAAsB,GACtB,gBAAgB,GAChB,iBAAiB;AACnB,iFAAiF;GAC/E,8BAA8B;AAChC,2DAA2D;GACzD,4BAA4B;AAC9B,6EAA6E;GAC3E,iCAAiC,CAAC;AAatC,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAM3D;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,mBAAmB,CAO9E"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wDAAwD;AACxD,MAAM,MAAM,uBAAuB,GAC/B,yBAAyB,GACzB,sBAAsB,GACtB,gBAAgB,GAChB,iBAAiB;AACnB,iFAAiF;GAC/E,8BAA8B;AAChC,2DAA2D;GACzD,4BAA4B;AAC9B,6EAA6E;GAC3E,iCAAiC,CAAC;AAatC,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAM3D;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,mBAAmB,CAO9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAejF"}

package/dist/errors.js

@@ -12,6 +12,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClientRegistryError = void 0;
 exports.isClientRegistryError = isClientRegistryError;
+exports.isUniqueConstraintViolation = isUniqueConstraintViolation;
 /** HTTP status a controller should answer a given code with. */
 const STATUS_BY_CODE = {
     invalid_client_metadata: 400,
@@ -38,4 +39,62 @@ function isClientRegistryError(err) {
         err.name === 'ClientRegistryError' &&
         typeof err.code === 'string');
 }
+/**
+ * Did the store refuse this write because a unique index already holds the
+ * value — Prisma's `P2002`?
+ *
+ * The registry's two create paths each do a find, then a create, with at least
+ * one `await` in between, so two callers can both look, both see nothing, and
+ * both write. Postgres settles that with the unique index on `client_id`, and
+ * the losing caller gets a `P2002`. Recognising it is what lets the loser
+ * converge on the winner's row instead of surfacing a database error to
+ * somebody who asked a perfectly ordinary question.
+ *
+ * `field` narrows the check to one column, and callers should pass it. A
+ * `P2002` on `public_id` is a generated-identifier collision, which is a
+ * genuinely exceptional thing and must not be mistaken for a lost race on a
+ * `client_id` somebody else was registering at the same moment.
+ *
+ * ## Why `field` is matched in two spellings
+ *
+ * Pass the **Prisma field name** — `clientId`. What arrives in `meta.target`
+ * may be either that or the mapped column name, and which one depends on the
+ * connector rather than on anything the caller can see:
+ *
+ *     PostgreSQL   target: ['client_id']    the column, from the constraint
+ *     MySQL        target: ['clientId']     the field
+ *
+ * So both are accepted, derived here rather than spelled out at each call site.
+ * This is not defensive padding; it is a measured result.
+ * `tests/integration/oauth-clients-postgres.test.ts` was written because an
+ * in-memory delegate gets to decide what its own errors look like, and the
+ * first thing real Postgres said was that the delegate had chosen the wrong
+ * spelling. A predicate matching only `clientId` passes every mock test in the
+ * suite and recovers from nothing in production.
+ *
+ * Matched structurally rather than with `instanceof PrismaClientKnownRequestError`,
+ * for the same reason `isClientRegistryError` is: this package never imports
+ * `@prisma/client`, and the delegate it is handed belongs to the application.
+ */
+function isUniqueConstraintViolation(err, field) {
+    if (typeof err !== 'object' || err === null)
+        return false;
+    if (err.code !== 'P2002')
+        return false;
+    if (field === undefined)
+        return true;
+    const target = err.meta?.target;
+    // Prisma reports `target` as a list of names, but as a bare string on some
+    // connectors and an array on others.
+    const reported = typeof target === 'string' ? [target] : Array.isArray(target) ? target : [];
+    // A P2002 with no usable target could be about any column. An empty list
+    // matches nothing, so the caller rethrows rather than guessing it was the
+    // race it hoped for.
+    const accepted = [field, snakeCase(field)];
+    return reported.some((name) => typeof name === 'string' && accepted.includes(name));
+}
+/** `clientId` -> `client_id`, the mapping the schema's `@map` names follow. */
+function snakeCase(field) {
+    return field.replace(/[A-Z]/g, (ch) => `_${ch.toLowerCase()}`);
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAuCH,sDAOC;AA/BD,gEAAgE;AAChE,MAAM,cAAc,GAA4C;IAC9D,uBAAuB,EAAE,GAAG;IAC5B,oBAAoB,EAAE,GAAG;IACzB,cAAc,EAAE,GAAG;IACnB,eAAe,EAAE,GAAG;IACpB,4BAA4B,EAAE,GAAG;IACjC,0BAA0B,EAAE,GAAG;IAC/B,+BAA+B,EAAE,GAAG;CACrC,CAAC;AAEF,MAAa,mBAAoB,SAAQ,KAAK;IAI5C,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACF;AAVD,kDAUC;AAED,+EAA+E;AAC/E,SAAgB,qBAAqB,CAAC,GAAY;IAChD,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACX,GAA0B,CAAC,IAAI,KAAK,qBAAqB;QAC1D,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ,CACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAuCH,sDAOC;AAuCD,kEAeC;AArFD,gEAAgE;AAChE,MAAM,cAAc,GAA4C;IAC9D,uBAAuB,EAAE,GAAG;IAC5B,oBAAoB,EAAE,GAAG;IACzB,cAAc,EAAE,GAAG;IACnB,eAAe,EAAE,GAAG;IACpB,4BAA4B,EAAE,GAAG;IACjC,0BAA0B,EAAE,GAAG;IAC/B,+BAA+B,EAAE,GAAG;CACrC,CAAC;AAEF,MAAa,mBAAoB,SAAQ,KAAK;IAI5C,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACF;AAVD,kDAUC;AAED,+EAA+E;AAC/E,SAAgB,qBAAqB,CAAC,GAAY;IAChD,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACX,GAA0B,CAAC,IAAI,KAAK,qBAAqB;QAC1D,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,SAAgB,2BAA2B,CAAC,GAAY,EAAE,KAAc;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAK,GAA0B,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,MAAM,GAAI,GAAuC,CAAC,IAAI,EAAE,MAAM,CAAC;IACrE,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GACZ,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/grant-service.d.ts

@@ -12,9 +12,12 @@ import type { PropertyStore } from './user-store.js';
  * under a wider set is bound by the grant's current, narrower one on its very
  * next call — no revocation, no new mechanism, and a test says so.
  *
- * RFC 8707 `resource` is the exception and stays on the token: an audience is a
- * property of a credential, not of a relationship, which is exactly why a
- * cautious client can ask for a narrow token against an unchanged grant.
+ * RFC 8707 `resource` is the planned exception, and the reasoning is that an
+ * audience is a property of a credential rather than of a relationship, which
+ * is exactly why a cautious client should be able to ask for a narrow token
+ * against an unchanged grant. None of that is built yet: the indicator is
+ * recorded on the grant below as last requested, no token carries an audience,
+ * and nothing enforces one. See boop-vdh0.
  *
  * ## Re-consent replaces, it does not union
  *
@@ -46,7 +49,11 @@ export interface OAuthGrantRecord {
     client_public_id: string;
     /** The current approved set. Replaced wholesale on re-consent. */
     scopes: string[];
-    /** RFC 8707, as last requested. Informational here; the token is authority. */
+    /**
+     * RFC 8707, as last requested. Recorded, not enforced: per-token audience
+     * binding is unimplemented, so no token carries this value and nothing checks
+     * it. See boop-vdh0.
+     */
     resource: string | null;
     /**
      * The identity key of the grant's **current** refresh token, or `null`.

package/dist/grant-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-service.d.ts","sourceRoot":"","sources":["../src/grant-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;OAQG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,wEAAwE;IACxE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,8EAA8E;IAC9E,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClD,uDAAuD;IACvD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5E,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7E,4EAA4E;IAC5E,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,4EAA4E;IAC5E,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,aAAa,CAAC;IAC7B,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAoH7E"}
+{"version":3,"file":"grant-service.d.ts","sourceRoot":"","sources":["../src/grant-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;OAQG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,wEAAwE;IACxE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,8EAA8E;IAC9E,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClD,uDAAuD;IACvD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5E,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7E,4EAA4E;IAC5E,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,4EAA4E;IAC5E,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,aAAa,CAAC;IAC7B,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAoH7E"}

package/dist/grant-service.js

@@ -18,9 +18,12 @@ const property_array_js_1 = require("./property-array.js");
  * under a wider set is bound by the grant's current, narrower one on its very
  * next call — no revocation, no new mechanism, and a test says so.
  *
- * RFC 8707 `resource` is the exception and stays on the token: an audience is a
- * property of a credential, not of a relationship, which is exactly why a
- * cautious client can ask for a narrow token against an unchanged grant.
+ * RFC 8707 `resource` is the planned exception, and the reasoning is that an
+ * audience is a property of a credential rather than of a relationship, which
+ * is exactly why a cautious client should be able to ask for a narrow token
+ * against an unchanged grant. None of that is built yet: the indicator is
+ * recorded on the grant below as last requested, no token carries an audience,
+ * and nothing enforces one. See boop-vdh0.
  *
  * ## Re-consent replaces, it does not union
  *

package/dist/grant-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-service.js","sourceRoot":"","sources":["../src/grant-service.ts"],"names":[],"mappings":";;;AA+GA,sCAEC;AAED,gDAoHC;AAvOD,6CAAyC;AAEzC,2DAA4D;AAG5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,sEAAsE;AACzD,QAAA,qBAAqB,GAAG,cAAc,CAAC;AAEpD,8EAA8E;AACjE,QAAA,wBAAwB,GAAG,6BAA6B,CAAC;AAkEtE,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,KAAuB;IACnD,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE9C,KAAK,UAAU,IAAI,CAAC,MAAc;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAS,EAC9B,aAAa,EACb,MAAM,EACN,6BAAqB,CACtB,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,MAAc,EACd,MAA0B,EAC1B,QAA4B;QAE5B,MAAM,IAAA,8BAAU,EAAC,aAAa,EAAE,MAAM,EAAE,6BAAqB,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE;YACnF,UAAU,EAAE,gCAAwB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK;QAEL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc;YACrC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CACtF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO;YAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK;YACzB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAEtC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,CACvE,CAAC;YAEF,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,KAAK,GACT,KAAK,IAAI,CAAC;gBACR,CAAC,CAAC;oBACE,GAAG,MAAM,CAAC,KAAK,CAAC;oBAChB,SAAS,EAAE,KAAK,CAAC,QAAQ;oBACzB,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;oBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;oBAChC,UAAU,EAAE,SAAS;iBACtB;gBACH,CAAC,CAAC;oBACE,QAAQ,EAAE,IAAA,wBAAU,GAAE;oBACtB,SAAS,EAAE,KAAK,CAAC,QAAQ;oBACzB,gBAAgB,EAAE,KAAK,CAAC,cAAc;oBACtC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;oBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;oBAChC,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,IAAI;iBACnB,CAAC;YAER,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;YAC/F,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU;YAC7C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CACtF,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM;YAC/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,oEAAoE;YACpE,oEAAoE;YACpE,oEAAoE;YACpE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAE1C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAqB;gBAC9B,GAAG,MAAM;gBACT,oEAAoE;gBACpE,oEAAoE;gBACpE,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,SAAS;aACtB,CAAC;YACF,MAAM,KAAK,CACT,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACvD,QAAQ,CACT,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"grant-service.js","sourceRoot":"","sources":["../src/grant-service.ts"],"names":[],"mappings":";;;AAsHA,sCAEC;AAED,gDAoHC;AA9OD,6CAAyC;AAEzC,2DAA4D;AAG5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,sEAAsE;AACzD,QAAA,qBAAqB,GAAG,cAAc,CAAC;AAEpD,8EAA8E;AACjE,QAAA,wBAAwB,GAAG,6BAA6B,CAAC;AAsEtE,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,KAAuB;IACnD,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE9C,KAAK,UAAU,IAAI,CAAC,MAAc;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAS,EAC9B,aAAa,EACb,MAAM,EACN,6BAAqB,CACtB,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC;IAED,KAAK,UAAU,KAAK,CAClB,MAAc,EACd,MAA0B,EAC1B,QAA4B;QAE5B,MAAM,IAAA,8BAAU,EAAC,aAAa,EAAE,MAAM,EAAE,6BAAqB,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE;YACnF,UAAU,EAAE,gCAAwB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK;QAEL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc;YACrC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CACtF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO;YAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK;YACzB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAEtC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,CACvE,CAAC;YAEF,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,KAAK,GACT,KAAK,IAAI,CAAC;gBACR,CAAC,CAAC;oBACE,GAAG,MAAM,CAAC,KAAK,CAAC;oBAChB,SAAS,EAAE,KAAK,CAAC,QAAQ;oBACzB,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;oBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;oBAChC,UAAU,EAAE,SAAS;iBACtB;gBACH,CAAC,CAAC;oBACE,QAAQ,EAAE,IAAA,wBAAU,GAAE;oBACtB,SAAS,EAAE,KAAK,CAAC,QAAQ;oBACzB,gBAAgB,EAAE,KAAK,CAAC,cAAc;oBACtC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;oBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;oBAChC,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,IAAI;iBACnB,CAAC;YAER,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;YAC/F,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU;YAC7C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CACtF,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM;YAC/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,oEAAoE;YACpE,oEAAoE;YACpE,oEAAoE;YACpE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAE1C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAqB;gBAC9B,GAAG,MAAM;gBACT,oEAAoE;gBACpE,oEAAoE;gBACpE,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,SAAS;aACtB,CAAC;YACF,MAAM,KAAK,CACT,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACvD,QAAQ,CACT,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -23,11 +23,12 @@ export type { RedirectUriClassification, RedirectUriShape } from './redirect-uri
 export { generateClientPublicId, isValidClientPublicId, CLIENT_PUBLIC_ID_ALPHABET, CLIENT_PUBLIC_ID_LENGTH, } from './public-id.js';
 export { ClientRegistryError, isClientRegistryError } from './errors.js';
 export type { ClientRegistryErrorCode } from './errors.js';
-export { createClientRegistryService, validateRedirectUris, DEFAULT_GRANT_TYPES, DEFAULT_RESPONSE_TYPES, DEFAULT_METADATA_MAX_AGE_MS, DEFAULT_ABANDONED_CLIENT_TTL_MS, DEFAULT_MAX_REGISTERED_CLIENTS, } from './client-registry-service.js';
+export { createClientRegistryService, validateRedirectUris, STRANGER_CREATED_MODES, DEFAULT_GRANT_TYPES, DEFAULT_RESPONSE_TYPES, DEFAULT_METADATA_MAX_AGE_MS, DEFAULT_ABANDONED_CLIENT_TTL_MS, DEFAULT_MAX_REGISTERED_CLIENTS, } from './client-registry-service.js';
 export type { ClientRegistryService, ClientRegistryServiceOptions, PruneOptions, } from './client-registry-service.js';
+export { blockedHostReason, isBlockedAddress } from './outbound-target.js';
 export { fetchMetadataDocument, isValidMetadataUri, DEFAULT_METADATA_TIMEOUT_MS, DEFAULT_METADATA_MAX_BYTES, DEFAULT_METADATA_MAX_REDIRECTS, } from './metadata-document.js';
 export type { FetchLike, FetchLikeResponse, MetadataFetchOptions, } from './metadata-document.js';
-export { buildAuthorizationServerMetadata, buildProtectedResourceMetadata, CODE_CHALLENGE_METHODS_SUPPORTED, DEVICE_CODE_GRANT_TYPE, DEFAULT_SCOPES_SUPPORTED, DISCOVERY_MAX_AGE_SECONDS, } from './discovery.js';
+export { buildAuthorizationServerMetadata, buildProtectedResourceMetadata, CODE_CHALLENGE_METHODS_SUPPORTED, DEVICE_CODE_GRANT_TYPE, DEFAULT_SCOPES_SUPPORTED, DISCOVERY_MAX_AGE_SECONDS, PROTECTED_RESOURCE_METADATA_PATH, protectedResourceMetadataPaths, } from './discovery.js';
 export type { DiscoveryConfig, AuthorizationServerMetadata, ProtectedResourceMetadata, } from './discovery.js';
 export { readServerConfig, clampTtlSeconds, OauthServerConfigError, DEFAULT_ACCESS_TOKEN_TTL_SECONDS, DEFAULT_REFRESH_TOKEN_TTL_SECONDS, ACCESS_TOKEN_TTL_BOUNDS, REFRESH_TOKEN_TTL_BOUNDS, } from './config.js';
 export type { ServerConfig, ReadConfigOptions } from './config.js';
@@ -35,8 +36,8 @@ export { createDiscoveryHandlers, createDiscoveryRouter } from './discovery-cont
 export type { DiscoveryHandlers } from './discovery-controller.js';
 export { createRegistrationHandlers, createRegistrationRouter, toRegistrationResponse, } from './registration-controller.js';
 export type { RegistrationHandlerDeps, RegistrationRouterOptions, } from './registration-controller.js';
-export { createRegistrationRateLimiter, DEFAULT_REGISTRATION_RATE_LIMIT, DEFAULT_REGISTRATION_RATE_WINDOW_MS, } from './rate-limit.js';
-export type { RateLimiterOptions, RegistrationRateLimiter } from './rate-limit.js';
+export { createFixedWindowRateLimiter, createRegistrationRateLimiter, rateLimitAddress, DEFAULT_METADATA_RESOLUTION_RATE_LIMIT, DEFAULT_REGISTRATION_RATE_LIMIT, DEFAULT_REGISTRATION_RATE_WINDOW_MS, } from './rate-limit.js';
+export type { FixedWindowRateLimiter, RateLimiterOptions, RegistrationRateLimiter, } from './rate-limit.js';
 export { CLIENT_MODES } from './types.js';
 export type { ClientMode, ClientStatus, OauthClient, OauthClientDelegate, ClientMetadataInput, ClientIdMetadataDocument, StaticClientInput, } from './types.js';
 export { createTokenService, buildIdentityKey, AUTHORIZATION_CODE_TTL_SECONDS, OAUTH_CODE_DOMAIN, OAUTH_ACCESS_DOMAIN, OAUTH_REFRESH_DOMAIN, } from './token-service.js';
@@ -52,12 +53,16 @@ export { isStaleWriteError } from './user-store.js';
 export type { IdentityStore, PropertyStore, PropertyWriteOptions, StoredIdentity, StoredProperty, } from './user-store.js';
 export { readArray, writeArray } from './property-array.js';
 export type { ArraySnapshot } from './property-array.js';
-export { createConsentHandlers, createConsentRouter, defaultIsSignedIn, monogramFor, provenanceFor, safeLogoUri, scopeDescriptionsFrom, toScopeViews, warnUndescribedScopes, SCOPE_DESCRIPTIONS_LOCAL, } from './consent-controller.js';
+export { createConsentHandlers, createConsentRouter, defaultIsSignedIn, monogramFor, provenanceFor, safeHttpsUri, scopeDescriptionsFrom, toScopeViews, warnUndescribedScopes, SCOPE_DESCRIPTIONS_LOCAL, } from './consent-controller.js';
 export type { AuthorizationRequest, ConsentCredentials, ConsentHandlers, ConsentHandlerDeps, ConsentRegister, ConsentRegistration, ConsentRouterOptions, ConsentScopeView, ConsentSession, ConsentSignIn, ConsentSignedIn, ConsentVariant, ScopeDescriptions, } from './consent-controller.js';
+export { isSameSiteRequest } from './same-site.js';
+export type { SameSiteRequest } from './same-site.js';
 export { createTokenHandlers, createTokenRouter, parseScopes, OFFLINE_ACCESS_SCOPE, } from './token-controller.js';
 export type { TokenHandlerDeps, TokenRouterOptions, TokenResponse, } from './token-controller.js';
 export { createOAuthBearerMiddleware, createOAuthResourceServer, createOAuthTokenResolver, missingScopes, requireOAuth, DEFAULT_BEARER_CHALLENGE, } from './bearer.js';
 export type { OAuthBearerOptions, OAuthResourceServer, ResolvedOAuthPrincipal, } from './bearer.js';
+export { createClientInUsePredicate, createClientPruneJob } from './client-prune.js';
+export type { ClientInUseOptions, ClientPruneJob, ClientPruneOptions, ClientPruneResult, } from './client-prune.js';
 export { createRevocationService, REVOKED_BY_CLIENT, REVOKED_BY_USER, REVOKED_CLIENT_WIDE, } from './revocation-service.js';
 export type { RevocationService, RevocationServiceOptions, RevokedGrant, } from './revocation-service.js';
 export { createRevocationHandlers, createRevocationRouter, } from './revocation-controller.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzE,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,YAAY,GACb,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,gCAAgC,EAChC,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAEnF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GACb,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,eAAe,EACf,cAAc,EACd,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzE,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,YAAY,GACb,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,eAAe,EACf,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,gCAAgC,EAChC,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,gBAAgB,EAChB,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GACb,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,YAAY,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,eAAe,EACf,cAAc,EACd,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACrF,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -19,8 +19,9 @@
  * that mechanically.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_REFRESH_DOMAIN = exports.OAUTH_ACCESS_DOMAIN = exports.OAUTH_CODE_DOMAIN = exports.AUTHORIZATION_CODE_TTL_SECONDS = exports.buildIdentityKey = exports.createTokenService = exports.CLIENT_MODES = exports.DEFAULT_REGISTRATION_RATE_WINDOW_MS = exports.DEFAULT_REGISTRATION_RATE_LIMIT = exports.createRegistrationRateLimiter = exports.toRegistrationResponse = exports.createRegistrationRouter = exports.createRegistrationHandlers = exports.createDiscoveryRouter = exports.createDiscoveryHandlers = exports.REFRESH_TOKEN_TTL_BOUNDS = exports.ACCESS_TOKEN_TTL_BOUNDS = exports.DEFAULT_REFRESH_TOKEN_TTL_SECONDS = exports.DEFAULT_ACCESS_TOKEN_TTL_SECONDS = exports.OauthServerConfigError = exports.clampTtlSeconds = exports.readServerConfig = exports.DISCOVERY_MAX_AGE_SECONDS = exports.DEFAULT_SCOPES_SUPPORTED = exports.DEVICE_CODE_GRANT_TYPE = exports.CODE_CHALLENGE_METHODS_SUPPORTED = exports.buildProtectedResourceMetadata = exports.buildAuthorizationServerMetadata = exports.DEFAULT_METADATA_MAX_REDIRECTS = exports.DEFAULT_METADATA_MAX_BYTES = exports.DEFAULT_METADATA_TIMEOUT_MS = exports.isValidMetadataUri = exports.fetchMetadataDocument = exports.DEFAULT_MAX_REGISTERED_CLIENTS = exports.DEFAULT_ABANDONED_CLIENT_TTL_MS = exports.DEFAULT_METADATA_MAX_AGE_MS = exports.DEFAULT_RESPONSE_TYPES = exports.DEFAULT_GRANT_TYPES = exports.validateRedirectUris = exports.createClientRegistryService = exports.isClientRegistryError = exports.ClientRegistryError = exports.CLIENT_PUBLIC_ID_LENGTH = exports.CLIENT_PUBLIC_ID_ALPHABET = exports.isValidClientPublicId = exports.generateClientPublicId = exports.isLoopbackHost = exports.matchesAnyRedirectUri = exports.matchRedirectUri = exports.classifyRedirectUri = void 0;
-exports.ACCOUNT_COVERAGE_STATEMENT = exports.createConnectionsRouter = exports.createConnectionsHandlers = exports.createRevocationRouter = exports.createRevocationHandlers = exports.REVOKED_CLIENT_WIDE = exports.REVOKED_BY_USER = exports.REVOKED_BY_CLIENT = exports.createRevocationService = exports.DEFAULT_BEARER_CHALLENGE = exports.requireOAuth = exports.missingScopes = exports.createOAuthTokenResolver = exports.createOAuthResourceServer = exports.createOAuthBearerMiddleware = exports.OFFLINE_ACCESS_SCOPE = exports.parseScopes = exports.createTokenRouter = exports.createTokenHandlers = exports.SCOPE_DESCRIPTIONS_LOCAL = exports.warnUndescribedScopes = exports.toScopeViews = exports.scopeDescriptionsFrom = exports.safeLogoUri = exports.provenanceFor = exports.monogramFor = exports.defaultIsSignedIn = exports.createConsentRouter = exports.createConsentHandlers = exports.writeArray = exports.readArray = exports.isStaleWriteError = exports.isOAuthError = exports.OAuthError = exports.verifyCodeChallenge = exports.isValidCodeVerifier = exports.isValidCodeChallenge = exports.deriveCodeChallenge = exports.CODE_CHALLENGE_METHOD = exports.OAUTH_CODES_INFO_SCHEMA = exports.OAUTH_CODES_PROPERTY = exports.createAuthorizationCodeService = exports.OAUTH_GRANTS_INFO_SCHEMA = exports.OAUTH_GRANTS_PROPERTY = exports.isGrantActive = exports.createGrantService = void 0;
+exports.DEFAULT_REGISTRATION_RATE_LIMIT = exports.DEFAULT_METADATA_RESOLUTION_RATE_LIMIT = exports.rateLimitAddress = exports.createRegistrationRateLimiter = exports.createFixedWindowRateLimiter = exports.toRegistrationResponse = exports.createRegistrationRouter = exports.createRegistrationHandlers = exports.createDiscoveryRouter = exports.createDiscoveryHandlers = exports.REFRESH_TOKEN_TTL_BOUNDS = exports.ACCESS_TOKEN_TTL_BOUNDS = exports.DEFAULT_REFRESH_TOKEN_TTL_SECONDS = exports.DEFAULT_ACCESS_TOKEN_TTL_SECONDS = exports.OauthServerConfigError = exports.clampTtlSeconds = exports.readServerConfig = exports.protectedResourceMetadataPaths = exports.PROTECTED_RESOURCE_METADATA_PATH = exports.DISCOVERY_MAX_AGE_SECONDS = exports.DEFAULT_SCOPES_SUPPORTED = exports.DEVICE_CODE_GRANT_TYPE = exports.CODE_CHALLENGE_METHODS_SUPPORTED = exports.buildProtectedResourceMetadata = exports.buildAuthorizationServerMetadata = exports.DEFAULT_METADATA_MAX_REDIRECTS = exports.DEFAULT_METADATA_MAX_BYTES = exports.DEFAULT_METADATA_TIMEOUT_MS = exports.isValidMetadataUri = exports.fetchMetadataDocument = exports.isBlockedAddress = exports.blockedHostReason = exports.DEFAULT_MAX_REGISTERED_CLIENTS = exports.DEFAULT_ABANDONED_CLIENT_TTL_MS = exports.DEFAULT_METADATA_MAX_AGE_MS = exports.DEFAULT_RESPONSE_TYPES = exports.DEFAULT_GRANT_TYPES = exports.STRANGER_CREATED_MODES = exports.validateRedirectUris = exports.createClientRegistryService = exports.isClientRegistryError = exports.ClientRegistryError = exports.CLIENT_PUBLIC_ID_LENGTH = exports.CLIENT_PUBLIC_ID_ALPHABET = exports.isValidClientPublicId = exports.generateClientPublicId = exports.isLoopbackHost = exports.matchesAnyRedirectUri = exports.matchRedirectUri = exports.classifyRedirectUri = void 0;
+exports.REVOKED_BY_CLIENT = exports.createRevocationService = exports.createClientPruneJob = exports.createClientInUsePredicate = exports.DEFAULT_BEARER_CHALLENGE = exports.requireOAuth = exports.missingScopes = exports.createOAuthTokenResolver = exports.createOAuthResourceServer = exports.createOAuthBearerMiddleware = exports.OFFLINE_ACCESS_SCOPE = exports.parseScopes = exports.createTokenRouter = exports.createTokenHandlers = exports.isSameSiteRequest = exports.SCOPE_DESCRIPTIONS_LOCAL = exports.warnUndescribedScopes = exports.toScopeViews = exports.scopeDescriptionsFrom = exports.safeHttpsUri = exports.provenanceFor = exports.monogramFor = exports.defaultIsSignedIn = exports.createConsentRouter = exports.createConsentHandlers = exports.writeArray = exports.readArray = exports.isStaleWriteError = exports.isOAuthError = exports.OAuthError = exports.verifyCodeChallenge = exports.isValidCodeVerifier = exports.isValidCodeChallenge = exports.deriveCodeChallenge = exports.CODE_CHALLENGE_METHOD = exports.OAUTH_CODES_INFO_SCHEMA = exports.OAUTH_CODES_PROPERTY = exports.createAuthorizationCodeService = exports.OAUTH_GRANTS_INFO_SCHEMA = exports.OAUTH_GRANTS_PROPERTY = exports.isGrantActive = exports.createGrantService = exports.OAUTH_REFRESH_DOMAIN = exports.OAUTH_ACCESS_DOMAIN = exports.OAUTH_CODE_DOMAIN = exports.AUTHORIZATION_CODE_TTL_SECONDS = exports.buildIdentityKey = exports.createTokenService = exports.CLIENT_MODES = exports.DEFAULT_REGISTRATION_RATE_WINDOW_MS = void 0;
+exports.ACCOUNT_COVERAGE_STATEMENT = exports.createConnectionsRouter = exports.createConnectionsHandlers = exports.createRevocationRouter = exports.createRevocationHandlers = exports.REVOKED_CLIENT_WIDE = exports.REVOKED_BY_USER = void 0;
 // Side-effect import: the Express request augmentation this capability's
 // middleware writes (`req.oauthGrant`) and its consent controller reads
 // (`req.user`). Importing the package is what gives an application those
@@ -42,11 +43,15 @@ Object.defineProperty(exports, "isClientRegistryError", { enumerable: true, get:
 var client_registry_service_js_1 = require("./client-registry-service.js");
 Object.defineProperty(exports, "createClientRegistryService", { enumerable: true, get: function () { return client_registry_service_js_1.createClientRegistryService; } });
 Object.defineProperty(exports, "validateRedirectUris", { enumerable: true, get: function () { return client_registry_service_js_1.validateRedirectUris; } });
+Object.defineProperty(exports, "STRANGER_CREATED_MODES", { enumerable: true, get: function () { return client_registry_service_js_1.STRANGER_CREATED_MODES; } });
 Object.defineProperty(exports, "DEFAULT_GRANT_TYPES", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_GRANT_TYPES; } });
 Object.defineProperty(exports, "DEFAULT_RESPONSE_TYPES", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_RESPONSE_TYPES; } });
 Object.defineProperty(exports, "DEFAULT_METADATA_MAX_AGE_MS", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_METADATA_MAX_AGE_MS; } });
 Object.defineProperty(exports, "DEFAULT_ABANDONED_CLIENT_TTL_MS", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_ABANDONED_CLIENT_TTL_MS; } });
 Object.defineProperty(exports, "DEFAULT_MAX_REGISTERED_CLIENTS", { enumerable: true, get: function () { return client_registry_service_js_1.DEFAULT_MAX_REGISTERED_CLIENTS; } });
+var outbound_target_js_1 = require("./outbound-target.js");
+Object.defineProperty(exports, "blockedHostReason", { enumerable: true, get: function () { return outbound_target_js_1.blockedHostReason; } });
+Object.defineProperty(exports, "isBlockedAddress", { enumerable: true, get: function () { return outbound_target_js_1.isBlockedAddress; } });
 var metadata_document_js_1 = require("./metadata-document.js");
 Object.defineProperty(exports, "fetchMetadataDocument", { enumerable: true, get: function () { return metadata_document_js_1.fetchMetadataDocument; } });
 Object.defineProperty(exports, "isValidMetadataUri", { enumerable: true, get: function () { return metadata_document_js_1.isValidMetadataUri; } });
@@ -60,6 +65,8 @@ Object.defineProperty(exports, "CODE_CHALLENGE_METHODS_SUPPORTED", { enumerable:
 Object.defineProperty(exports, "DEVICE_CODE_GRANT_TYPE", { enumerable: true, get: function () { return discovery_js_1.DEVICE_CODE_GRANT_TYPE; } });
 Object.defineProperty(exports, "DEFAULT_SCOPES_SUPPORTED", { enumerable: true, get: function () { return discovery_js_1.DEFAULT_SCOPES_SUPPORTED; } });
 Object.defineProperty(exports, "DISCOVERY_MAX_AGE_SECONDS", { enumerable: true, get: function () { return discovery_js_1.DISCOVERY_MAX_AGE_SECONDS; } });
+Object.defineProperty(exports, "PROTECTED_RESOURCE_METADATA_PATH", { enumerable: true, get: function () { return discovery_js_1.PROTECTED_RESOURCE_METADATA_PATH; } });
+Object.defineProperty(exports, "protectedResourceMetadataPaths", { enumerable: true, get: function () { return discovery_js_1.protectedResourceMetadataPaths; } });
 var config_js_1 = require("./config.js");
 Object.defineProperty(exports, "readServerConfig", { enumerable: true, get: function () { return config_js_1.readServerConfig; } });
 Object.defineProperty(exports, "clampTtlSeconds", { enumerable: true, get: function () { return config_js_1.clampTtlSeconds; } });
@@ -76,7 +83,10 @@ Object.defineProperty(exports, "createRegistrationHandlers", { enumerable: true,
 Object.defineProperty(exports, "createRegistrationRouter", { enumerable: true, get: function () { return registration_controller_js_1.createRegistrationRouter; } });
 Object.defineProperty(exports, "toRegistrationResponse", { enumerable: true, get: function () { return registration_controller_js_1.toRegistrationResponse; } });
 var rate_limit_js_1 = require("./rate-limit.js");
+Object.defineProperty(exports, "createFixedWindowRateLimiter", { enumerable: true, get: function () { return rate_limit_js_1.createFixedWindowRateLimiter; } });
 Object.defineProperty(exports, "createRegistrationRateLimiter", { enumerable: true, get: function () { return rate_limit_js_1.createRegistrationRateLimiter; } });
+Object.defineProperty(exports, "rateLimitAddress", { enumerable: true, get: function () { return rate_limit_js_1.rateLimitAddress; } });
+Object.defineProperty(exports, "DEFAULT_METADATA_RESOLUTION_RATE_LIMIT", { enumerable: true, get: function () { return rate_limit_js_1.DEFAULT_METADATA_RESOLUTION_RATE_LIMIT; } });
 Object.defineProperty(exports, "DEFAULT_REGISTRATION_RATE_LIMIT", { enumerable: true, get: function () { return rate_limit_js_1.DEFAULT_REGISTRATION_RATE_LIMIT; } });
 Object.defineProperty(exports, "DEFAULT_REGISTRATION_RATE_WINDOW_MS", { enumerable: true, get: function () { return rate_limit_js_1.DEFAULT_REGISTRATION_RATE_WINDOW_MS; } });
 var types_js_1 = require("./types.js");
@@ -117,11 +127,13 @@ Object.defineProperty(exports, "createConsentRouter", { enumerable: true, get: f
 Object.defineProperty(exports, "defaultIsSignedIn", { enumerable: true, get: function () { return consent_controller_js_1.defaultIsSignedIn; } });
 Object.defineProperty(exports, "monogramFor", { enumerable: true, get: function () { return consent_controller_js_1.monogramFor; } });
 Object.defineProperty(exports, "provenanceFor", { enumerable: true, get: function () { return consent_controller_js_1.provenanceFor; } });
-Object.defineProperty(exports, "safeLogoUri", { enumerable: true, get: function () { return consent_controller_js_1.safeLogoUri; } });
+Object.defineProperty(exports, "safeHttpsUri", { enumerable: true, get: function () { return consent_controller_js_1.safeHttpsUri; } });
 Object.defineProperty(exports, "scopeDescriptionsFrom", { enumerable: true, get: function () { return consent_controller_js_1.scopeDescriptionsFrom; } });
 Object.defineProperty(exports, "toScopeViews", { enumerable: true, get: function () { return consent_controller_js_1.toScopeViews; } });
 Object.defineProperty(exports, "warnUndescribedScopes", { enumerable: true, get: function () { return consent_controller_js_1.warnUndescribedScopes; } });
 Object.defineProperty(exports, "SCOPE_DESCRIPTIONS_LOCAL", { enumerable: true, get: function () { return consent_controller_js_1.SCOPE_DESCRIPTIONS_LOCAL; } });
+var same_site_js_1 = require("./same-site.js");
+Object.defineProperty(exports, "isSameSiteRequest", { enumerable: true, get: function () { return same_site_js_1.isSameSiteRequest; } });
 var token_controller_js_1 = require("./token-controller.js");
 Object.defineProperty(exports, "createTokenHandlers", { enumerable: true, get: function () { return token_controller_js_1.createTokenHandlers; } });
 Object.defineProperty(exports, "createTokenRouter", { enumerable: true, get: function () { return token_controller_js_1.createTokenRouter; } });
@@ -134,6 +146,9 @@ Object.defineProperty(exports, "createOAuthTokenResolver", { enumerable: true, g
 Object.defineProperty(exports, "missingScopes", { enumerable: true, get: function () { return bearer_js_1.missingScopes; } });
 Object.defineProperty(exports, "requireOAuth", { enumerable: true, get: function () { return bearer_js_1.requireOAuth; } });
 Object.defineProperty(exports, "DEFAULT_BEARER_CHALLENGE", { enumerable: true, get: function () { return bearer_js_1.DEFAULT_BEARER_CHALLENGE; } });
+var client_prune_js_1 = require("./client-prune.js");
+Object.defineProperty(exports, "createClientInUsePredicate", { enumerable: true, get: function () { return client_prune_js_1.createClientInUsePredicate; } });
+Object.defineProperty(exports, "createClientPruneJob", { enumerable: true, get: function () { return client_prune_js_1.createClientPruneJob; } });
 var revocation_service_js_1 = require("./revocation-service.js");
 Object.defineProperty(exports, "createRevocationService", { enumerable: true, get: function () { return revocation_service_js_1.createRevocationService; } });
 Object.defineProperty(exports, "REVOKED_BY_CLIENT", { enumerable: true, get: function () { return revocation_service_js_1.REVOKED_BY_CLIENT; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;AAEH,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,wBAAsB;AAEtB,qDAK2B;AAJzB,sHAAA,mBAAmB,OAAA;AACnB,mHAAA,gBAAgB,OAAA;AAChB,wHAAA,qBAAqB,OAAA;AACrB,iHAAA,cAAc,OAAA;AAIhB,+CAKwB;AAJtB,sHAAA,sBAAsB,OAAA;AACtB,qHAAA,qBAAqB,OAAA;AACrB,yHAAA,yBAAyB,OAAA;AACzB,uHAAA,uBAAuB,OAAA;AAGzB,yCAAyE;AAAhE,gHAAA,mBAAmB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAGnD,2EAQsC;AAPpC,yIAAA,2BAA2B,OAAA;AAC3B,kIAAA,oBAAoB,OAAA;AACpB,iIAAA,mBAAmB,OAAA;AACnB,oIAAA,sBAAsB,OAAA;AACtB,yIAAA,2BAA2B,OAAA;AAC3B,6IAAA,+BAA+B,OAAA;AAC/B,4IAAA,8BAA8B,OAAA;AAQhC,+DAMgC;AAL9B,6HAAA,qBAAqB,OAAA;AACrB,0HAAA,kBAAkB,OAAA;AAClB,mIAAA,2BAA2B,OAAA;AAC3B,kIAAA,0BAA0B,OAAA;AAC1B,sIAAA,8BAA8B,OAAA;AAQhC,+CAOwB;AANtB,gIAAA,gCAAgC,OAAA;AAChC,8HAAA,8BAA8B,OAAA;AAC9B,gIAAA,gCAAgC,OAAA;AAChC,sHAAA,sBAAsB,OAAA;AACtB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AAQ3B,yCAQqB;AAPnB,6GAAA,gBAAgB,OAAA;AAChB,4GAAA,eAAe,OAAA;AACf,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAChC,8HAAA,iCAAiC,OAAA;AACjC,oHAAA,uBAAuB,OAAA;AACvB,qHAAA,wBAAwB,OAAA;AAI1B,qEAA2F;AAAlF,kIAAA,uBAAuB,OAAA;AAAE,gIAAA,qBAAqB,OAAA;AAGvD,2EAIsC;AAHpC,wIAAA,0BAA0B,OAAA;AAC1B,sIAAA,wBAAwB,OAAA;AACxB,oIAAA,sBAAsB,OAAA;AAOxB,iDAIyB;AAHvB,8HAAA,6BAA6B,OAAA;AAC7B,gIAAA,+BAA+B,OAAA;AAC/B,oIAAA,mCAAmC,OAAA;AAIrC,uCAA0C;AAAjC,wGAAA,YAAY,OAAA;AAWrB,uDAO4B;AAN1B,sHAAA,kBAAkB,OAAA;AAClB,oHAAA,gBAAgB,OAAA;AAChB,kIAAA,8BAA8B,OAAA;AAC9B,qHAAA,iBAAiB,OAAA;AACjB,uHAAA,mBAAmB,OAAA;AACnB,wHAAA,oBAAoB,OAAA;AAUtB,uDAK4B;AAJ1B,sHAAA,kBAAkB,OAAA;AAClB,iHAAA,aAAa,OAAA;AACb,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA;AAU1B,iFAIyC;AAHvC,+IAAA,8BAA8B,OAAA;AAC9B,qIAAA,oBAAoB,OAAA;AACpB,wIAAA,uBAAuB,OAAA;AAYzB,qCAMmB;AALjB,gHAAA,qBAAqB,OAAA;AACrB,8GAAA,mBAAmB,OAAA;AACnB,+GAAA,oBAAoB,OAAA;AACpB,8GAAA,mBAAmB,OAAA;AACnB,8GAAA,mBAAmB,OAAA;AAGrB,mDAA4D;AAAnD,4GAAA,UAAU,OAAA;AAAE,8GAAA,YAAY,OAAA;AAGjC,iDAAoD;AAA3C,kHAAA,iBAAiB,OAAA;AAS1B,yDAA4D;AAAnD,8GAAA,SAAS,OAAA;AAAE,+GAAA,UAAU,OAAA;AAG9B,iEAWiC;AAV/B,8HAAA,qBAAqB,OAAA;AACrB,4HAAA,mBAAmB,OAAA;AACnB,0HAAA,iBAAiB,OAAA;AACjB,oHAAA,WAAW,OAAA;AACX,sHAAA,aAAa,OAAA;AACb,oHAAA,WAAW,OAAA;AACX,8HAAA,qBAAqB,OAAA;AACrB,qHAAA,YAAY,OAAA;AACZ,8HAAA,qBAAqB,OAAA;AACrB,iIAAA,wBAAwB,OAAA;AAkB1B,6DAK+B;AAJ7B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,kHAAA,WAAW,OAAA;AACX,2HAAA,oBAAoB,OAAA;AAQtB,yCAOqB;AANnB,wHAAA,2BAA2B,OAAA;AAC3B,sHAAA,yBAAyB,OAAA;AACzB,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,yGAAA,YAAY,OAAA;AACZ,qHAAA,wBAAwB,OAAA;AAQ1B,iEAKiC;AAJ/B,gIAAA,uBAAuB,OAAA;AACvB,0HAAA,iBAAiB,OAAA;AACjB,wHAAA,eAAe,OAAA;AACf,4HAAA,mBAAmB,OAAA;AAQrB,uEAGoC;AAFlC,oIAAA,wBAAwB,OAAA;AACxB,kIAAA,sBAAsB,OAAA;AAQxB,yEAIqC;AAHnC,sIAAA,yBAAyB,OAAA;AACzB,oIAAA,uBAAuB,OAAA;AACvB,uIAAA,0BAA0B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;AAEH,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,wBAAsB;AAEtB,qDAK2B;AAJzB,sHAAA,mBAAmB,OAAA;AACnB,mHAAA,gBAAgB,OAAA;AAChB,wHAAA,qBAAqB,OAAA;AACrB,iHAAA,cAAc,OAAA;AAIhB,+CAKwB;AAJtB,sHAAA,sBAAsB,OAAA;AACtB,qHAAA,qBAAqB,OAAA;AACrB,yHAAA,yBAAyB,OAAA;AACzB,uHAAA,uBAAuB,OAAA;AAGzB,yCAAyE;AAAhE,gHAAA,mBAAmB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAGnD,2EASsC;AARpC,yIAAA,2BAA2B,OAAA;AAC3B,kIAAA,oBAAoB,OAAA;AACpB,oIAAA,sBAAsB,OAAA;AACtB,iIAAA,mBAAmB,OAAA;AACnB,oIAAA,sBAAsB,OAAA;AACtB,yIAAA,2BAA2B,OAAA;AAC3B,6IAAA,+BAA+B,OAAA;AAC/B,4IAAA,8BAA8B,OAAA;AAQhC,2DAA2E;AAAlE,uHAAA,iBAAiB,OAAA;AAAE,sHAAA,gBAAgB,OAAA;AAE5C,+DAMgC;AAL9B,6HAAA,qBAAqB,OAAA;AACrB,0HAAA,kBAAkB,OAAA;AAClB,mIAAA,2BAA2B,OAAA;AAC3B,kIAAA,0BAA0B,OAAA;AAC1B,sIAAA,8BAA8B,OAAA;AAQhC,+CASwB;AARtB,gIAAA,gCAAgC,OAAA;AAChC,8HAAA,8BAA8B,OAAA;AAC9B,gIAAA,gCAAgC,OAAA;AAChC,sHAAA,sBAAsB,OAAA;AACtB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,gIAAA,gCAAgC,OAAA;AAChC,8HAAA,8BAA8B,OAAA;AAQhC,yCAQqB;AAPnB,6GAAA,gBAAgB,OAAA;AAChB,4GAAA,eAAe,OAAA;AACf,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAChC,8HAAA,iCAAiC,OAAA;AACjC,oHAAA,uBAAuB,OAAA;AACvB,qHAAA,wBAAwB,OAAA;AAI1B,qEAA2F;AAAlF,kIAAA,uBAAuB,OAAA;AAAE,gIAAA,qBAAqB,OAAA;AAGvD,2EAIsC;AAHpC,wIAAA,0BAA0B,OAAA;AAC1B,sIAAA,wBAAwB,OAAA;AACxB,oIAAA,sBAAsB,OAAA;AAOxB,iDAOyB;AANvB,6HAAA,4BAA4B,OAAA;AAC5B,8HAAA,6BAA6B,OAAA;AAC7B,iHAAA,gBAAgB,OAAA;AAChB,uIAAA,sCAAsC,OAAA;AACtC,gIAAA,+BAA+B,OAAA;AAC/B,oIAAA,mCAAmC,OAAA;AAQrC,uCAA0C;AAAjC,wGAAA,YAAY,OAAA;AAWrB,uDAO4B;AAN1B,sHAAA,kBAAkB,OAAA;AAClB,oHAAA,gBAAgB,OAAA;AAChB,kIAAA,8BAA8B,OAAA;AAC9B,qHAAA,iBAAiB,OAAA;AACjB,uHAAA,mBAAmB,OAAA;AACnB,wHAAA,oBAAoB,OAAA;AAUtB,uDAK4B;AAJ1B,sHAAA,kBAAkB,OAAA;AAClB,iHAAA,aAAa,OAAA;AACb,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA;AAU1B,iFAIyC;AAHvC,+IAAA,8BAA8B,OAAA;AAC9B,qIAAA,oBAAoB,OAAA;AACpB,wIAAA,uBAAuB,OAAA;AAYzB,qCAMmB;AALjB,gHAAA,qBAAqB,OAAA;AACrB,8GAAA,mBAAmB,OAAA;AACnB,+GAAA,oBAAoB,OAAA;AACpB,8GAAA,mBAAmB,OAAA;AACnB,8GAAA,mBAAmB,OAAA;AAGrB,mDAA4D;AAAnD,4GAAA,UAAU,OAAA;AAAE,8GAAA,YAAY,OAAA;AAGjC,iDAAoD;AAA3C,kHAAA,iBAAiB,OAAA;AAS1B,yDAA4D;AAAnD,8GAAA,SAAS,OAAA;AAAE,+GAAA,UAAU,OAAA;AAG9B,iEAWiC;AAV/B,8HAAA,qBAAqB,OAAA;AACrB,4HAAA,mBAAmB,OAAA;AACnB,0HAAA,iBAAiB,OAAA;AACjB,oHAAA,WAAW,OAAA;AACX,sHAAA,aAAa,OAAA;AACb,qHAAA,YAAY,OAAA;AACZ,8HAAA,qBAAqB,OAAA;AACrB,qHAAA,YAAY,OAAA;AACZ,8HAAA,qBAAqB,OAAA;AACrB,iIAAA,wBAAwB,OAAA;AAkB1B,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAG1B,6DAK+B;AAJ7B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,kHAAA,WAAW,OAAA;AACX,2HAAA,oBAAoB,OAAA;AAQtB,yCAOqB;AANnB,wHAAA,2BAA2B,OAAA;AAC3B,sHAAA,yBAAyB,OAAA;AACzB,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,yGAAA,YAAY,OAAA;AACZ,qHAAA,wBAAwB,OAAA;AAQ1B,qDAAqF;AAA5E,6HAAA,0BAA0B,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAQzD,iEAKiC;AAJ/B,gIAAA,uBAAuB,OAAA;AACvB,0HAAA,iBAAiB,OAAA;AACjB,wHAAA,eAAe,OAAA;AACf,4HAAA,mBAAmB,OAAA;AAQrB,uEAGoC;AAFlC,oIAAA,wBAAwB,OAAA;AACxB,kIAAA,sBAAsB,OAAA;AAQxB,yEAIqC;AAHnC,sIAAA,yBAAyB,OAAA;AACzB,oIAAA,uBAAuB,OAAA;AACvB,uIAAA,0BAA0B,OAAA"}

package/dist/metadata-document.d.ts

@@ -11,6 +11,16 @@ import type { ClientIdMetadataDocument } from './types.js';
  * drive it directly: what a failing fetch, an oversized body or a lying
  * document do is behaviour worth pinning, and none of it is reachable through a
  * real network in a test suite.
+ *
+ * ## Where the URL may point
+ *
+ * The bounds below — timeout, size, hop count — bound what a fetch can *cost*.
+ * They say nothing about where it goes, and for a while nothing did: an
+ * unauthenticated `GET /oauth/authorize` naming any https URL made this server
+ * issue a request to it, so the response time answered "is there something at
+ * `10.0.0.5:443`?" for anyone who asked (boop-jd4x). `outbound-target.ts` is
+ * that guard, and it runs **before every hop**, including the ones a redirect
+ * chooses.
  */
 /** The `fetch` shape this module needs. Narrower than the global on purpose. */
 export type FetchLike = (url: string, init: {
@@ -36,6 +46,18 @@ export interface MetadataFetchOptions {
     maxBytes?: number;
     /** How many `https`→`https` hops to follow before giving up. */
     maxRedirects?: number;
+    /**
+     * Resolve a hostname to the addresses it points at.
+     *
+     * Optional. Without it, every *literal* private, loopback or link-local
+     * target is still refused, and so are the names reserved for a local network;
+     * with it, a perfectly ordinary name that answers `10.0.0.5` is refused too.
+     * Injected rather than imported because a capability package has no business
+     * reaching for `node:dns`, and because a resolver in the module body is a
+     * resolver no test can stand in front of. The scaffold wires
+     * `dns.promises.lookup`.
+     */
+    resolveHost?: (hostname: string) => Promise<string[]>;
 }
 export declare const DEFAULT_METADATA_TIMEOUT_MS = 3000;
 export declare const DEFAULT_METADATA_MAX_BYTES: number;

package/dist/metadata-document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata-document.d.ts","sourceRoot":"","sources":["../src/metadata-document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,KACE,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,0BAA0B,QAAY,CAAC;AACpD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAKhD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAczD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,EACpB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CA+CnC"}
+{"version":3,"file":"metadata-document.d.ts","sourceRoot":"","sources":["../src/metadata-document.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,KACE,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACvD;AAED,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,0BAA0B,QAAY,CAAC;AACpD,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAKhD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAczD;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,EACpB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAoDnC"}

package/dist/metadata-document.js

@@ -4,6 +4,7 @@ exports.DEFAULT_METADATA_MAX_REDIRECTS = exports.DEFAULT_METADATA_MAX_BYTES = ex
 exports.isValidMetadataUri = isValidMetadataUri;
 exports.fetchMetadataDocument = fetchMetadataDocument;
 const errors_js_1 = require("./errors.js");
+const outbound_target_js_1 = require("./outbound-target.js");
 exports.DEFAULT_METADATA_TIMEOUT_MS = 3000;
 exports.DEFAULT_METADATA_MAX_BYTES = 64 * 1024;
 exports.DEFAULT_METADATA_MAX_REDIRECTS = 3;
@@ -44,7 +45,12 @@ async function fetchMetadataDocument(clientId, fetchImpl, options = {}) {
     if (!isValidMetadataUri(clientId)) {
         throw unusable(`client_id is not a usable https metadata document URL: ${clientId}`);
     }
-    const body = await readDocument(clientId, fetchImpl, { timeoutMs, maxBytes, maxRedirects });
+    const body = await readDocument(clientId, fetchImpl, {
+        timeoutMs,
+        maxBytes,
+        maxRedirects,
+        resolveHost: options.resolveHost,
+    });
     let parsed;
     try {
         parsed = JSON.parse(body);
@@ -78,10 +84,46 @@ async function fetchMetadataDocument(clientId, fetchImpl, options = {}) {
     }
     return doc;
 }
-/** The transport half: redirects, timeout, size cap. */
+/**
+ * Refuse a target that is not on the public internet.
+ *
+ * Called before the request rather than after it, because the request *is* the
+ * leak: the body is discarded on a refusal either way, and what an attacker
+ * reads is whether the connection was made and how long it took.
+ */
+async function assertPublicTarget(url, resolveHost) {
+    const { hostname } = new URL(url);
+    const reason = (0, outbound_target_js_1.blockedHostReason)(hostname);
+    if (reason !== null)
+        throw unusable(`metadata document at ${url} is not fetchable: ${reason}`);
+    if (!resolveHost)
+        return;
+    let addresses;
+    try {
+        addresses = await resolveHost(hostname);
+    }
+    catch (err) {
+        // Fail closed. A name we could not resolve is a name we cannot vouch for,
+        // and "could not check" must never read as "checked and fine".
+        throw unusable(`metadata document at ${url} could not be resolved: ${describe(err)}`);
+    }
+    // An empty answer is not a clean bill of health: it means nothing was
+    // checked, which is the same position as a resolver that threw.
+    if (addresses.length === 0) {
+        throw unusable(`metadata document at ${url} resolves to no address`);
+    }
+    const blocked = addresses.find((address) => (0, outbound_target_js_1.isBlockedAddress)(address));
+    if (blocked !== undefined) {
+        throw unusable(`metadata document at ${url} resolves to ${blocked}, which is not a public address`);
+    }
+}
+/** The transport half: target guard, redirects, timeout, size cap. */
 async function readDocument(startUrl, fetchImpl, limits) {
     let url = startUrl;
     for (let hop = 0; hop <= limits.maxRedirects; hop += 1) {
+        // Every hop, not just the first: a public URL that redirects to
+        // `https://169.254.169.254` is the same probe with one step in front of it.
+        await assertPublicTarget(url, limits.resolveHost);
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), limits.timeoutMs);
         let response;

package/dist/metadata-document.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata-document.js","sourceRoot":"","sources":["../src/metadata-document.ts"],"names":[],"mappings":";;;AA6DA,gDAcC;AASD,sDAmDC;AAvID,2CAAkD;AA8CrC,QAAA,2BAA2B,GAAG,IAAK,CAAC;AACpC,QAAA,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,QAAA,8BAA8B,GAAG,CAAC,CAAC;AAEhD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,IAAI,+BAAmB,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,IAAI,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,SAAoB,EACpB,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mCAA2B,CAAC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kCAA0B,CAAC;IAChE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sCAA8B,CAAC;IAE5E,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,0DAA0D,QAAQ,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAE5F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,cAAc,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,GAAG,GAAG,MAAkC,CAAC;IAE/C;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,CACZ,wBAAwB,QAAQ,kCAAkC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,SAAoB,EACpB,MAAqE;IAErE,IAAI,GAAG,GAAG,QAAQ,CAAC;IAEnB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAErE,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBAC9B,MAAM,EAAE,KAAK;gBACb,sEAAsE;gBACtE,uEAAuE;gBACvE,gEAAgE;gBAChE,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,wBAAwB,GAAG,0BAA0B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,MAAM,QAAQ,CAAC,wBAAwB,GAAG,8BAA8B,CAAC,CAAC;YAEzF,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,wBAAwB,GAAG,iCAAiC,QAAQ,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,CACZ,wBAAwB,GAAG,sCAAsC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,wBAAwB,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,+DAA+D;QAC/D,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5D,MAAM,QAAQ,CACZ,wBAAwB,GAAG,aAAa,QAAQ,oBAAoB,MAAM,CAAC,QAAQ,MAAM,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,QAAQ,CAAC,wBAAwB,GAAG,gBAAgB,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,yBAAyB,MAAM,CAAC,YAAY,QAAQ,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"metadata-document.js","sourceRoot":"","sources":["../src/metadata-document.ts"],"names":[],"mappings":";;;AAoFA,gDAcC;AASD,sDAwDC;AAnKD,2CAAkD;AAClD,6DAA2E;AAoE9D,QAAA,2BAA2B,GAAG,IAAK,CAAC;AACpC,QAAA,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,QAAA,8BAA8B,GAAG,CAAC,CAAC;AAEhD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,IAAI,+BAAmB,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,IAAI,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,SAAoB,EACpB,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mCAA2B,CAAC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kCAA0B,CAAC;IAChE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sCAA8B,CAAC;IAE5E,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,0DAA0D,QAAQ,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE;QACnD,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,cAAc,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,GAAG,GAAG,MAAkC,CAAC;IAE/C;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,CACZ,wBAAwB,QAAQ,kCAAkC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAW,EACX,WAAkE;IAElE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,IAAA,sCAAiB,EAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,QAAQ,CAAC,wBAAwB,GAAG,sBAAsB,MAAM,EAAE,CAAC,CAAC;IAE/F,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,QAAQ,CAAC,wBAAwB,GAAG,2BAA2B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,sEAAsE;IACtE,gEAAgE;IAChE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,qCAAgB,EAAC,OAAO,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,CACZ,wBAAwB,GAAG,gBAAgB,OAAO,iCAAiC,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,SAAoB,EACpB,MAKC;IAED,IAAI,GAAG,GAAG,QAAQ,CAAC;IAEnB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACvD,gEAAgE;QAChE,4EAA4E;QAC5E,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAErE,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBAC9B,MAAM,EAAE,KAAK;gBACb,sEAAsE;gBACtE,uEAAuE;gBACvE,gEAAgE;gBAChE,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,wBAAwB,GAAG,0BAA0B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,MAAM,QAAQ,CAAC,wBAAwB,GAAG,8BAA8B,CAAC,CAAC;YAEzF,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,wBAAwB,GAAG,iCAAiC,QAAQ,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,CACZ,wBAAwB,GAAG,sCAAsC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,GAAG,CAChG,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,wBAAwB,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,+DAA+D;QAC/D,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5D,MAAM,QAAQ,CACZ,wBAAwB,GAAG,aAAa,QAAQ,oBAAoB,MAAM,CAAC,QAAQ,MAAM,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,QAAQ,CAAC,wBAAwB,GAAG,gBAAgB,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,CAAC,wBAAwB,QAAQ,yBAAyB,MAAM,CAAC,YAAY,QAAQ,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC"}