@chrischall/mcp-utils 0.10.5 → 0.12.0

package/README.md

@@ -31,10 +31,11 @@ import light:
 
 | Import | Contents |
 | --- | --- |
-| `@chrischall/mcp-utils` | core barrel: `server` + `response` + `errors` + `config` + `fs` + `http` + `zod` + `auth` |
+| `@chrischall/mcp-utils` | core barrel: `server` + `response` + `errors` + `config` + `fs` + `http` + `concurrency` + `dates` + `zod` + `auth` + `scrape` |
 | `@chrischall/mcp-utils/session` | session registry, session store, token manager, cookie-session manager |
 | `@chrischall/mcp-utils/fetchproxy` | fetchproxy transport adapter, bot-wall / retry / concurrency helpers |
 | `@chrischall/mcp-utils/html` | opt-in HTML scraping helpers (needs `node-html-parser`) |
+| `@chrischall/mcp-utils/scrape` | convenience alias for the zero-dep `scrape` module (also in the core barrel) |
 | `@chrischall/mcp-utils/test` | in-memory test harness for tool registration |
 
 ```ts
@@ -69,7 +70,13 @@ the server instance without connecting a transport.
 ### `response` — tool-result formatting
 
 `textResult` / `jsonResult` (alias), `rawTextResult`, `imageResult`,
-`errorResult`, `flattenJsonApi`, `deepMapStringField`.
+`errorResult`, `flattenJsonApi`, `deepMapStringField`, `pruneUndefined`,
+`toArray`.
+
+`pruneUndefined(obj)` shallow-copies an object dropping `undefined`-valued keys
+(the compact-projection idiom: skylight's `compact`, viator/alltrails' `prune`);
+`toArray(v)` coerces `T | T[] | null | undefined` to `T[]` (the XML→JSON
+single-item guard from canvas-parent / infinitecampus).
 
 ```ts
 import { textResult, errorResult, flattenJsonApi, deepMapStringField } from '@chrischall/mcp-utils';
@@ -87,7 +94,10 @@ deepMapStringField(payload, 'eventDate', dmyToIso);
 `McpToolError` and its subclasses (`SessionNotAuthenticatedError`,
 `BotWallError`, `RateLimitError`, `UnreachableError`, `ModeMismatchError`),
 plus `createHelpfulError`, `wrapToolError`, `truncateErrorMessage`,
-`redactSecrets`, and `messageOf`. `redactSecrets` scrubs `Bearer`/`Basic` auth
+`redactSecrets`, `maskSecret`, and `messageOf`. `BotWallError` takes an optional
+`{ vendor }` (e.g. `'DataDome'`) woven into the message and exposed as a field;
+`maskSecret(value)` renders a `first8…last4` fingerprint for set-credential
+confirmations (short values are fully hidden). `redactSecrets` scrubs `Bearer`/`Basic` auth
 headers, `Cookie`/`Set-Cookie` values (cookie names stay visible), JWTs,
 well-known API-key shapes (`sk-…`, `ghp_…`, `xox?-…`, `AIza…`, `AKIA…`,
 `whsec_…`), and secret-bearing URL query params; `truncateErrorMessage` applies
@@ -113,8 +123,13 @@ tool surface can show the user.
 
 ### `config` — hardened env/config
 
-`readEnvVar`, `requireEnvVar`, `parseBoolEnv`, `readPortEnv`, `expandPath`,
-`loadDotenvSafely`, `createCachedJsonArrayLoader`.
+`readEnvVar`, `requireEnvVar`, `parseBoolEnv`, `readPortEnv`, `readIntEnv`,
+`readTtlMsEnv`, `expandPath`, `loadDotenvSafely`, `createCachedJsonArrayLoader`.
+
+`readIntEnv` is the general hardened integer reader (strict parse + optional
+`min`/`max`); `readTtlMsEnv(key, defaultMs)` reads a TTL in **seconds** and
+returns **milliseconds**, honoring an explicit `0` as "disabled" — the
+`<SVC>_CACHE_TTL` reader shared by the response-cache consumers.
 
 ```ts
 import { requireEnvVar, parseBoolEnv, readPortEnv, expandPath } from '@chrischall/mcp-utils';
@@ -153,9 +168,17 @@ A successful parse is cached; a missing/unreadable file, invalid JSON, or a
 non-string-array logs one stderr warning and negative-caches (returns defaults
 without re-reading). Pass `readFile` to inject a reader in tests.
 
-### `fs` — streaming file helpers (uploads)
+### `fs` — streaming file helpers (uploads) & binary output
+
+`fileBlob`, `readFileHead`, `resolveOutputDir`, `uniquePath`,
+`writeBinaryOutput`, `sniffMimeBytes`.
 
-`fileBlob`, `readFileHead`.
+The binary-output kit (hoisted from gemini + flightaware) is the fleet
+convention for tools that generate bytes: `resolveOutputDir(perCall,
+'<SVC>_OUTPUT_DIR')` resolves arg → env → cwd (creating the dir),
+`writeBinaryOutput({ dir, baseName, base64, mimeType })` writes to a
+**non-overwriting** path (`name.png`, `name-2.png`, …) and returns it, and
+`sniffMimeBytes` magic-byte-detects PNG/JPEG/WebP/GIF.
 
 ```ts
 import { fileBlob, readFileHead } from '@chrischall/mcp-utils';
@@ -177,9 +200,11 @@ constant memory instead of a 20 MB Buffer.
 
 `createApiClient` plus building blocks: `buildQueryString`, `buildOptionalBody`,
 `formatApiError`, `parseLinkHeader`, `parseCookieJar`, `parseCookieHeader`,
-`runBoundedBatch`, JWT helpers (`decodeJwtExp`, `decodeJwtSessionId`,
-`decodeJwtClaim`, `validateJwtExpiry`), and the `ApiError` / `UpstreamHttpError` /
-`UnauthorizedError` / `RateLimitedError` / `RequestTimeoutError` classes.
+`runBoundedBatch`, `createThrottle`, `createResponseCache`, `parseRetryAfterMs`,
+`splitHost`, `buildUserAgent`, `parseContentDispositionFilename`, JWT helpers
+(`decodeJwtExp`, `decodeJwtSessionId`, `decodeJwtClaim`, `validateJwtExpiry`),
+and the `ApiError` / `UpstreamHttpError` / `UnauthorizedError` /
+`RateLimitedError` / `RequestTimeoutError` classes.
 
 `decodeJwtClaim(token, claim)` is the generic single-claim reader — returns the
 raw claim value (`unknown`) or `undefined` for an undecodable token / absent
@@ -203,6 +228,23 @@ const data = await api.get('/v1/things', { query: { page: 2 } });
 `RequestTimeoutError` instead of hanging the tool call. A 429 retry gets a fresh
 timeout. Omit it to keep the previous unbounded behavior.
 
+`retry` also accepts `statuses` (e.g. `[429, 503]`), `honorRetryAfter: true`
+(sleep the response's `Retry-After` instead of the fixed `delayMs`, bounded by
+`maxRetryAfterMs`, default 30 s — hoisted from getyourguide / musicbrainz /
+viator / tripadvisor), and the standalone `parseRetryAfterMs(header)` for custom
+clients.
+
+`api.fetchRaw(method, path)` is the binary path `fetchJson` can't express —
+returns `{ status, contentType, headers, bytes }` with the same 401/429/error
+mapping (gzip sales reports, PNG maps, attachment downloads).
+
+`createResponseCache({ ttlMs: { dynamic, static }, maxEntries })` is the bounded
+tiered-TTL response cache for billed / rate-limited reads (flightaware / viator
+/ tripadvisor): key on the request path (and body for POST-reads), route
+reference data through the long `static` tier via
+`fetchThrough(key, load, 'static')`, and pair the TTLs with `readTtlMsEnv`.
+Writes are never cached.
+
 `parseCookieHeader(header)` parses an inbound *request* `Cookie:` header
 (`name=value; name2=value2`) into a `Record<string, string>` (first `=` splits,
 so values may contain `=`; last value wins on a duplicate name). It's the
@@ -234,10 +276,18 @@ a single hung row can't wedge the call. It always returns a full-length,
 input-ordered array. `setTimer`/`clearTimer` are injectable for tests. This
 hoists zillow's bulk-tool deadline + `pending`-backfill primitive.
 
-### `concurrency` — bounded async map
+### `concurrency` — bounded async map & single-flight
 
-`mapWithConcurrency` — a zero-dependency bounded-fan-out map that preserves
-**input order**.
+`mapWithConcurrency`, `singleFlight`, `memoizeAsync` — zero-dependency async
+primitives.
+
+`singleFlight(fn)` shares ONE in-flight invocation across concurrent callers
+(cleared on settle; a rejection doesn't poison the next call) — the
+login/refresh/bridge-ready guard hand-rolled in honeybook / infinitecampus /
+onehome / vibo / alltrails / tripadvisor / artsonia. `memoizeAsync(loader)` is
+the keyed variant: a promise cache that coalesces concurrent loads per key and
+evicts rejected loads so the next `get` retries (redfin's `LocalityPoolCache`),
+with `delete`/`clear` for invalidation and test hooks.
 
 ```ts
 import { mapWithConcurrency } from '@chrischall/mcp-utils';
@@ -256,7 +306,8 @@ plus per-item backfill rather than a plain all-or-nothing map.
 
 ### `dates` — date-format converters
 
-`isoToDmy`, `dmyToIso`, `isoToCompactTimestamp`. For upstreams that don't speak
+`isoToDmy`, `dmyToIso`, `isoToCompactTimestamp`, `todayIso`, `toIsoDateUtc`,
+`shiftIsoDate`, `ensureSeconds`. For upstreams that don't speak
 ISO 8601, so a server can keep its surface ISO (`yyyy-MM-dd`) and translate at
 the API boundary. Pair with `deepMapStringField` to normalize a date field
 across a whole response.
@@ -268,13 +319,56 @@ const apiDate = isoToDmy('2025-08-28');                 // '28-08-2025' (request
 deepMapStringField(payload, 'eventDate', dmyToIso);     // '28-08-2025' → '2025-08-28' (response)
 ```
 
+### `scrape` — SSR JSON-store & page extraction (zero-dep)
+
+`decodeHtmlEntities`, `stripHtml`, `sanitizeJsLiterals`, `matchBalanced`,
+`extractJsonAfterMarker`, `extractJsonLdBlocks`, `findJsonLdEntity`,
+`ogContent`, `findArrayByShape`, `deepCollectArrays`, `deepFindObject`,
+`isCloudflareChallenge`, `stripJsonGuard`.
+
+Pure string/JSON primitives for server-rendered pages — no `node-html-parser`
+(DOM-level scraping stays in the [`/html`](#html) subpath). Consolidates the SSR
+JSON-store stack re-implemented across musescore / tock / zillow / opentable /
+tripadvisor / etix:
+
+```ts
+import {
+  extractJsonAfterMarker, findJsonLdEntity, ogContent,
+  findArrayByShape, isCloudflareChallenge, stripJsonGuard,
+} from '@chrischall/mcp-utils';
+
+// A redux/__NEXT_DATA__-style store (JS literals repaired via sanitize):
+const store = extractJsonAfterMarker(html, ['window.$REDUX_STATE', '"appState"'], { sanitize: true });
+
+// schema.org / OpenGraph readers:
+const event = findJsonLdEntity(html, 'Event');      // checks blocks, @graph, mainEntity
+const title = ogContent(html, 'og:title');
+
+// Drift-tolerant array location + anti-XSSI guard stripping:
+const homes = findArrayByShape(pageProps, ['savedHomesList'], (f) => !!f && typeof f === 'object');
+const data = JSON.parse(stripJsonGuard(body));      // )]}'  while(1);  for(;;);  {}&&
+```
+
+`isCloudflareChallenge` matches the DEFINITIVE interstitial markers only
+(`_cf_chl_opt`, `<title>Just a moment`) — never `cdn-cgi/challenge-platform`,
+which Cloudflare inlines on cleared pages too. `decodeHtmlEntities` decodes
+`&amp;` LAST so attribute-escaped JSON survives one level; `matchBalanced` is
+the string/escape-aware bracket walker regex can't replace.
+
 ### `zod` — schema atoms
 
 Reusable schemas (`PositiveInt`, `NonNegInt`, `NonEmptyString`, `IsoDate`,
 `IsoTime`, `NumericIdString`, `SafePathSegment`, `schemaOrigin`,
 `schemaConfirm`), pagination helpers
 (`paginationSchema`, `pageSchema`, `calculateOffset`), tool-annotation builders
-(`toolAnnotations`), and time normalizers (`extractTime`, `normalizeTime`).
+(`toolAnnotations`), time normalizers (`extractTime`, `normalizeTime`), and the
+lenient response validator `parseLenient`.
+
+`parseLenient(schema, raw, { label, context, mode? })` is the degrade-never-break
+validator for reverse-engineered APIs (alltrails' `parseAllTrails`, ofw's
+`parseOFW`, getyourguide's `parseGYG`): on success it returns the parsed data;
+on drift it warns to **stderr** with the precise issue paths and returns the
+RAW response (or throws an `McpToolError` in `mode: 'strict'` for write paths).
 
 ```ts
 import { paginationSchema, calculateOffset, toolAnnotations } from '@chrischall/mcp-utils';
@@ -292,8 +386,15 @@ injection.
 ### `auth` — auth resolver skeletons
 
 `createAuthResolver`, `resolveAuthPattern`, `sessionLoginFlow`,
-`createOAuth2Refresher`, and the supporting `FetchproxySession` /
-`AuthPattern` types.
+`createOAuth2Refresher`, `createCachedTokenSource`, `signEs256Jwt`, and the
+supporting `FetchproxySession` / `AuthPattern` types.
+
+`createCachedTokenSource({ mint, bufferMs })` caches any minted token until
+shortly before expiry with a single-flight mint and an `invalidate()` hook for
+401-replay — wrap it around `createOAuth2Refresher` (musicbrainz), an ES256
+self-mint (app-store-connect), or a login exchange (zola). `signEs256Jwt(pem,
+payload, { header: { kid } })` is the P-256/`ieee-p1363` JWS signer those
+self-minted-JWT APIs need (the decode counterparts live in `http`).
 
 ```ts
 import { createAuthResolver, createOAuth2Refresher } from '@chrischall/mcp-utils';
@@ -462,6 +563,12 @@ registerBridgeHealthcheckTool({
 });
 ```
 
+Two optional hooks absorb the site-specific healthchecks workday / zillow /
+etix hand-rolled: `classifyThrown(err)` maps the probe's thrown error to a
+custom `{ kind, hint }` (e.g. an SSO bounce → `session_expired` with re-sign-in
+copy; its hint wins the result hint), and `hints` overrides the default copy
+per ladder arm (`{ timeout: 'DataDome may be challenging the tab — …' }`).
+
 ### `html` — scraping helpers *(subpath, optional peer)*
 
 ```ts

package/dist/auth/cached-token.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `createCachedTokenSource` — a tiny in-memory cache around any token mint.
+ *
+ * Consolidates the "cache `{ token, expiresAt }`, refresh a bit before expiry,
+ * single-flight the mint" shape hand-rolled in app-store-connect
+ * (`ensureToken`, ES256 self-mint), musicbrainz (`accessToken` around
+ * `createOAuth2Refresher`), and zola (`ensureSession` JWT refresh). The mint is
+ * injected, so the same source fronts an OAuth refresher, a JWT signer, or a
+ * login exchange.
+ */
+/** What a mint returns: the token plus (optionally) when it expires. */
+export interface MintedToken {
+    /** The bearer/access token. */
+    token: string;
+    /** Absolute expiry (Date or epoch ms). Takes precedence over {@link ttlMs}. */
+    expiresAt?: Date | number;
+    /** Relative lifetime in ms, when the mint knows it (e.g. `expires_in * 1000`). */
+    ttlMs?: number;
+}
+/** Options for {@link createCachedTokenSource}. */
+export interface CachedTokenSourceOptions {
+    /** Mint a fresh token (OAuth exchange, JWT sign, login…). */
+    mint: () => Promise<MintedToken>;
+    /** Refresh this many ms BEFORE the token's expiry. Defaults to 60 000. */
+    bufferMs?: number;
+    /** Lifetime assumed when the mint reports no expiry. Defaults to 3 600 000 (1 h). */
+    defaultTtlMs?: number;
+    /** Injectable clock (defaults to `Date.now`) — for tests. */
+    now?: () => number;
+}
+/** The token source returned by {@link createCachedTokenSource}. */
+export interface CachedTokenSource {
+    /** A currently-valid token — cached, or freshly minted when absent/near expiry. */
+    getToken(): Promise<string>;
+    /** Drop the cached token so the next {@link getToken} re-mints (the 401-replay hook). */
+    invalidate(): void;
+}
+/**
+ * Build a race-safe cached token source. Concurrent `getToken`s share one
+ * in-flight mint; a rejected mint is not cached (the next call retries);
+ * `invalidate()` is the reactive hook to call after an upstream 401 before
+ * replaying the request.
+ */
+export declare function createCachedTokenSource(opts: CachedTokenSourceOptions): CachedTokenSource;
+//# sourceMappingURL=cached-token.d.ts.map

package/dist/auth/cached-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-token.d.ts","sourceRoot":"","sources":["../../src/auth/cached-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAC1B,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,yFAAyF;IACzF,UAAU,IAAI,IAAI,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,iBAAiB,CAmCzF"}

package/dist/auth/cached-token.js

@@ -0,0 +1,53 @@
+/**
+ * `createCachedTokenSource` — a tiny in-memory cache around any token mint.
+ *
+ * Consolidates the "cache `{ token, expiresAt }`, refresh a bit before expiry,
+ * single-flight the mint" shape hand-rolled in app-store-connect
+ * (`ensureToken`, ES256 self-mint), musicbrainz (`accessToken` around
+ * `createOAuth2Refresher`), and zola (`ensureSession` JWT refresh). The mint is
+ * injected, so the same source fronts an OAuth refresher, a JWT signer, or a
+ * login exchange.
+ */
+/**
+ * Build a race-safe cached token source. Concurrent `getToken`s share one
+ * in-flight mint; a rejected mint is not cached (the next call retries);
+ * `invalidate()` is the reactive hook to call after an upstream 401 before
+ * replaying the request.
+ */
+export function createCachedTokenSource(opts) {
+    const now = opts.now ?? Date.now;
+    const bufferMs = opts.bufferMs ?? 60_000;
+    const defaultTtlMs = opts.defaultTtlMs ?? 3_600_000;
+    let cached = null;
+    let inFlight = null;
+    const expiryOf = (minted) => {
+        if (minted.expiresAt !== undefined) {
+            return minted.expiresAt instanceof Date ? minted.expiresAt.getTime() : minted.expiresAt;
+        }
+        return now() + (minted.ttlMs ?? defaultTtlMs);
+    };
+    return {
+        getToken() {
+            if (cached && cached.expiresAt - bufferMs > now())
+                return Promise.resolve(cached.token);
+            if (inFlight)
+                return inFlight;
+            const p = opts
+                .mint()
+                .then((minted) => {
+                cached = { token: minted.token, expiresAt: expiryOf(minted) };
+                return minted.token;
+            })
+                .finally(() => {
+                if (inFlight === p)
+                    inFlight = null;
+            });
+            inFlight = p;
+            return p;
+        },
+        invalidate() {
+            cached = null;
+        },
+    };
+}
+//# sourceMappingURL=cached-token.js.map

package/dist/auth/cached-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-token.js","sourceRoot":"","sources":["../../src/auth/cached-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgCH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA8B;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC;IAEpD,IAAI,MAAM,GAAgD,IAAI,CAAC;IAC/D,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAE5C,MAAM,QAAQ,GAAG,CAAC,MAAmB,EAAU,EAAE;QAC/C,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QAC1F,CAAC;QACD,OAAO,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,OAAO;QACL,QAAQ;YACN,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,QAAQ,GAAG,GAAG,EAAE;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxF,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,MAAM,CAAC,GAAG,IAAI;iBACX,IAAI,EAAE;iBACN,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9D,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,QAAQ,KAAK,CAAC;oBAAE,QAAQ,GAAG,IAAI,CAAC;YACtC,CAAC,CAAC,CAAC;YACL,QAAQ,GAAG,CAAC,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;QACD,UAAU;YACR,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/es256.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `signEs256Jwt` — minimal ES256 (P-256 / SHA-256) JWS signer for APIs that
+ * authenticate with a self-minted JWT (App Store Connect's `kid`/`iss`/`aud`
+ * scheme). mcp-utils already DECODES JWTs (`decodeJwtExp` and friends); this is
+ * the signing counterpart, hoisted from app-store-connect's `signES256` +
+ * `mintJwt`.
+ *
+ * Uses `dsaEncoding: 'ieee-p1363'` (raw `r||s`) — the JOSE signature format —
+ * NOT the DER default, which upstreams reject.
+ */
+/** Options for {@link signEs256Jwt}. */
+export interface SignEs256JwtOptions {
+    /** Extra header fields merged over `{ alg: 'ES256', typ: 'JWT' }` (e.g. `kid`). */
+    header?: Record<string, unknown>;
+}
+/**
+ * Sign a JWT with ES256. `privateKeyPem` is a PEM-encoded P-256 private key
+ * (PKCS#8 `.p8` contents); the payload is serialized verbatim — the caller
+ * supplies `iss` / `iat` / `exp` / `aud` per its API's rules. Returns the
+ * compact `header.payload.signature` JWS.
+ */
+export declare function signEs256Jwt(privateKeyPem: string, payload: Record<string, unknown>, opts?: SignEs256JwtOptions): string;
+//# sourceMappingURL=es256.d.ts.map

package/dist/auth/es256.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256.d.ts","sourceRoot":"","sources":["../../src/auth/es256.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,GAAE,mBAAwB,GAC7B,MAAM,CAOR"}

package/dist/auth/es256.js

@@ -0,0 +1,27 @@
+/**
+ * `signEs256Jwt` — minimal ES256 (P-256 / SHA-256) JWS signer for APIs that
+ * authenticate with a self-minted JWT (App Store Connect's `kid`/`iss`/`aud`
+ * scheme). mcp-utils already DECODES JWTs (`decodeJwtExp` and friends); this is
+ * the signing counterpart, hoisted from app-store-connect's `signES256` +
+ * `mintJwt`.
+ *
+ * Uses `dsaEncoding: 'ieee-p1363'` (raw `r||s`) — the JOSE signature format —
+ * NOT the DER default, which upstreams reject.
+ */
+import { createSign } from 'node:crypto';
+const b64url = (data) => (typeof data === 'string' ? Buffer.from(data, 'utf8') : data).toString('base64url');
+/**
+ * Sign a JWT with ES256. `privateKeyPem` is a PEM-encoded P-256 private key
+ * (PKCS#8 `.p8` contents); the payload is serialized verbatim — the caller
+ * supplies `iss` / `iat` / `exp` / `aud` per its API's rules. Returns the
+ * compact `header.payload.signature` JWS.
+ */
+export function signEs256Jwt(privateKeyPem, payload, opts = {}) {
+    const header = { alg: 'ES256', typ: 'JWT', ...opts.header };
+    const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
+    const signer = createSign('SHA256');
+    signer.update(signingInput);
+    const signature = signer.sign({ key: privateKeyPem, dsaEncoding: 'ieee-p1363' });
+    return `${signingInput}.${b64url(signature)}`;
+}
+//# sourceMappingURL=es256.js.map

package/dist/auth/es256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256.js","sourceRoot":"","sources":["../../src/auth/es256.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,MAAM,GAAG,CAAC,IAAqB,EAAU,EAAE,CAC/C,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAQtF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,OAAgC,EAChC,OAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5D,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/auth/index.d.ts

@@ -234,4 +234,6 @@ export interface OAuth2RefreshResult {
  * blow up a tool result.
  */
 export declare function createOAuth2Refresher(opts: OAuth2RefresherOptions): () => Promise<OAuth2RefreshResult>;
+export * from './cached-token.js';
+export * from './es256.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAY9E,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAExE,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,KAAK,GAAG,YAAY,CAAC;CAC9B;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,SAAS,EAAE,WAAW,CAAC;IACvB,kFAAkF;IAClF,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,WAAW,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;IAChE,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAuBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,mBAAmB,GACxB,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAkEnC;AAMD,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,0DAA0D;IAC1D,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAerF;AAMD,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAaD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CA+D7B;AAMD,iDAAiD;AACjD,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;OAGG;IACH,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,GAC3B,MAAM,OAAO,CAAC,mBAAmB,CAAC,CA0EpC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAY9E,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAExE,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,KAAK,GAAG,YAAY,CAAC;CAC9B;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,SAAS,EAAE,WAAW,CAAC;IACvB,kFAAkF;IAClF,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,WAAW,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;IAChE,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAuBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,mBAAmB,GACxB,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAkEnC;AAMD,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,0DAA0D;IAC1D,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAerF;AAMD,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAaD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CA+D7B;AAMD,iDAAiD;AACjD,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;OAGG;IACH,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,GAC3B,MAAM,OAAO,CAAC,mBAAmB,CAAC,CA0EpC;AAMD,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC"}

package/dist/auth/index.js

@@ -311,4 +311,6 @@ export function createOAuth2Refresher(opts) {
 function messageOf(err) {
     return err instanceof Error ? err.message : String(err);
 }
+export * from './cached-token.js';
+export * from './es256.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAuDlD;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACrE,MAAM,IAAI,GAAI,GAAkC,CAAC,IAAI,CAAC;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAyB;IAEzB,MAAM,EACJ,MAAM,EACN,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,UAAU,EACV,GAAG,GACJ,GAAG,IAAI,CAAC;IAET,OAAO,KAAK,UAAU,WAAW;QAC/B,iFAAiF;QACjF,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;QAED,wEAAwE;QACxE,MAAM,QAAQ,GACZ,aAAa,KAAK,SAAS;YAC3B,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,OAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,wEAAwE;gBACxE,mEAAmE;gBACnE,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACvC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,kBAAkB,CACtB,YAAY,MAAM,0CAA0C;wBAC1D,2CAA2C,UAAU,EAAE,EACzD,EAAE,IAAI,EAAE,UAAU,EAAE,CACrB,CAAC;gBACJ,CAAC;gBACD,oEAAoE;gBACpE,mDAAmD;gBACnD,MAAM,kBAAkB,CACtB,YAAY,MAAM,yCAAyC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAC/F,EAAE,IAAI,EAAE,OAAO,MAAM,yCAAyC,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC9C,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,IAAI,4BAA4B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAClE,CAAC;QAED,yDAAyD;QACzD,MAAM,kBAAkB,CACtB,aAAa,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,mBAAmB,UAAU,kBAAkB,CAAC,CAAC,CAAC,8BAA8B,EAAE;YACnH,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,aAAa,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,EACrE,EAAE,IAAI,EAAE,OAAO,MAAM,8BAA8B,EAAE,CACtD,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAkCD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoB;IAC3D,MAAM,OAAO,GAA4C;QACvD,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,aAAa;QACrB,OAAO,CAAC,UAAU;KACnB,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,QAAQ;YAAE,OAAO,QAAQ,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,kBAAkB,CACtB,6EAA6E;QAC3E,mDAAmD,EACrD,EAAE,IAAI,EAAE,2EAA2E,EAAE,CACtF,CAAC;AACJ,CAAC;AA6CD,MAAM,gBAAgB,GACpB,gHAAgH,CAAC;AAEnH,mFAAmF;AACnF,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,CAAC,GAAG,OAAsD,CAAC;IACjE,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC;IAEvD,4DAA4D;IAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC3C,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,kBAAkB,CAAC,uBAAuB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE;YACtF,IAAI,EAAE,sDAAsD;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,yCAAyC,EAAE;YAClE,IAAI,EAAE,qEAAqE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,CAAC,SAAS,CAAC,EAAE,SAAS;QACtB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK;QACxB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,QAAQ;QAC9B,GAAG,IAAI,CAAC,WAAW;KACpB,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE;YACP,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,mCAAmC;YACnD,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;QACD,IAAI;KACL,CAAC,CAAC;IAEH,yEAAyE;IACzE,MAAM,MAAM,GAAG,cAAc,CAAC;QAC5B,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;QAClC,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,kBAAkB,CACtB,yBAAyB,IAAI,CAAC,UAAU,mBAAmB,OAAO,CAAC,MAAM,oCAAoC,EAC7G;YACE,IAAI,EAAE,0GAA0G;SACjH,CACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AACjD,CAAC;AA2CD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC;IAE9C,IAAI,QAAQ,GAAwC,IAAI,CAAC;IAEzD,KAAK,UAAU,YAAY;QACzB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,SAAS;YACrB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,GAAG,IAAI,CAAC,MAAM;SACf,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEd,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,kBAAkB,CACtB,gCAAgC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EACrG,EAAE,IAAI,EAAE,gEAAgE,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAiC,CAAC;QAClF,MAAM,WAAW,GAAG,IAAI,EAAE,YAAY,CAAC;QACvC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,kBAAkB,CAAC,gDAAgD,EAAE;gBACzE,IAAI,EAAE,iDAAiD;aACxD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAwB,EAAE,WAAW,EAAE,CAAC;QACpD,IAAI,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,iBAAiB;QAC9B,IAAI,OAAgB,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,MAAM,YAAY,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,CAAC;gBACZ,IAAI,OAAO,GAAG,UAAU;oBAAE,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,SAAS,OAAO;QACrB,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACzC,IAAI,QAAQ,KAAK,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,QAAQ,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAuDlD;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACrE,MAAM,IAAI,GAAI,GAAkC,CAAC,IAAI,CAAC;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAyB;IAEzB,MAAM,EACJ,MAAM,EACN,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,UAAU,EACV,GAAG,GACJ,GAAG,IAAI,CAAC;IAET,OAAO,KAAK,UAAU,WAAW;QAC/B,iFAAiF;QACjF,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;QAED,wEAAwE;QACxE,MAAM,QAAQ,GACZ,aAAa,KAAK,SAAS;YAC3B,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,OAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,wEAAwE;gBACxE,mEAAmE;gBACnE,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBACvC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,kBAAkB,CACtB,YAAY,MAAM,0CAA0C;wBAC1D,2CAA2C,UAAU,EAAE,EACzD,EAAE,IAAI,EAAE,UAAU,EAAE,CACrB,CAAC;gBACJ,CAAC;gBACD,oEAAoE;gBACpE,mDAAmD;gBACnD,MAAM,kBAAkB,CACtB,YAAY,MAAM,yCAAyC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAC/F,EAAE,IAAI,EAAE,OAAO,MAAM,yCAAyC,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC9C,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,IAAI,4BAA4B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAClE,CAAC;QAED,yDAAyD;QACzD,MAAM,kBAAkB,CACtB,aAAa,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,mBAAmB,UAAU,kBAAkB,CAAC,CAAC,CAAC,8BAA8B,EAAE;YACnH,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,aAAa,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,EACrE,EAAE,IAAI,EAAE,OAAO,MAAM,8BAA8B,EAAE,CACtD,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAkCD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoB;IAC3D,MAAM,OAAO,GAA4C;QACvD,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,aAAa;QACrB,OAAO,CAAC,UAAU;KACnB,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,QAAQ;YAAE,OAAO,QAAQ,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,kBAAkB,CACtB,6EAA6E;QAC3E,mDAAmD,EACrD,EAAE,IAAI,EAAE,2EAA2E,EAAE,CACtF,CAAC;AACJ,CAAC;AA6CD,MAAM,gBAAgB,GACpB,gHAAgH,CAAC;AAEnH,mFAAmF;AACnF,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,CAAC,GAAG,OAAsD,CAAC;IACjE,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC;IAEvD,4DAA4D;IAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC3C,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,kBAAkB,CAAC,uBAAuB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE;YACtF,IAAI,EAAE,sDAAsD;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,yCAAyC,EAAE;YAClE,IAAI,EAAE,qEAAqE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,CAAC,SAAS,CAAC,EAAE,SAAS;QACtB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK;QACxB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,QAAQ;QAC9B,GAAG,IAAI,CAAC,WAAW;KACpB,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE;YACP,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,mCAAmC;YACnD,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;QACD,IAAI;KACL,CAAC,CAAC;IAEH,yEAAyE;IACzE,MAAM,MAAM,GAAG,cAAc,CAAC;QAC5B,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;QAClC,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,kBAAkB,CACtB,yBAAyB,IAAI,CAAC,UAAU,mBAAmB,OAAO,CAAC,MAAM,oCAAoC,EAC7G;YACE,IAAI,EAAE,0GAA0G;SACjH,CACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AACjD,CAAC;AA2CD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC;IAE9C,IAAI,QAAQ,GAAwC,IAAI,CAAC;IAEzD,KAAK,UAAU,YAAY;QACzB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,SAAS;YACrB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,GAAG,IAAI,CAAC,MAAM;SACf,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEd,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,kBAAkB,CACtB,gCAAgC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EACrG,EAAE,IAAI,EAAE,gEAAgE,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAiC,CAAC;QAClF,MAAM,WAAW,GAAG,IAAI,EAAE,YAAY,CAAC;QACvC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,kBAAkB,CAAC,gDAAgD,EAAE;gBACzE,IAAI,EAAE,iDAAiD;aACxD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAwB,EAAE,WAAW,EAAE,CAAC;QACpD,IAAI,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,iBAAiB;QAC9B,IAAI,OAAgB,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,MAAM,YAAY,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,CAAC;gBACZ,IAAI,OAAO,GAAG,UAAU;oBAAE,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,SAAS,OAAO;QACrB,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACzC,IAAI,QAAQ,KAAK,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,QAAQ,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC"}

package/dist/concurrency/index.d.ts

@@ -39,4 +39,5 @@
  * @param fn Async mapper, called with each `item` and its input `index`.
  */
 export declare function mapWithConcurrency<T, R>(items: readonly T[], limit: number, fn: (item: T, index: number) => Promise<R>): Promise<R[]>;
+export * from './single-flight.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/concurrency/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/concurrency/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAC3C,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,EAAE,CAAC,CAad"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/concurrency/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAC3C,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,EAAE,CAAC,CAad;AAED,cAAc,oBAAoB,CAAC"}

package/dist/concurrency/index.js

@@ -50,4 +50,5 @@ export async function mapWithConcurrency(items, limit, fn) {
     }));
     return results;
 }
+export * from './single-flight.js';
 //# sourceMappingURL=index.js.map

package/dist/concurrency/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/concurrency/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAmB,EACnB,KAAa,EACb,EAA0C;IAE1C,MAAM,OAAO,GAAG,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE;QAC1C,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/concurrency/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAmB,EACnB,KAAa,EACb,EAA0C;IAE1C,MAAM,OAAO,GAAG,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE;QAC1C,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,cAAc,oBAAoB,CAAC"}

package/dist/concurrency/single-flight.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `singleFlight` / `memoizeAsync` — in-flight promise coalescing.
+ *
+ * The fleet hand-rolls this shape at least nine times: honeybook's
+ * `apiVersionPromise` (self-clearing memoized fetch), infinitecampus's
+ * `loginInFlight`, onehome's `capturePromise`, vibo's `loginInFlight` +
+ * `reauthInFlight`, alltrails's `ensureApiKey`/`bridgeReady`, tripadvisor's
+ * `bridgeReady`, artsonia's `ensureStarted`, and redfin's promise-caching
+ * `LocalityPoolCache`. Two primitives cover all of them:
+ *
+ *  - {@link singleFlight} — one shared in-flight promise, cleared on settle
+ *    (the login/refresh/bridge-ready guard).
+ *  - {@link memoizeAsync} — a keyed promise cache that coalesces concurrent
+ *    loads and evicts a rejected load so the next call retries (the keyed
+ *    loader cache).
+ */
+/**
+ * Wrap an async `fn` so concurrent calls share ONE in-flight invocation. The
+ * in-flight promise is cleared once it settles, so the next call starts fresh
+ * and a rejection doesn't poison later callers (every waiter of the failed
+ * flight still sees the rejection).
+ *
+ * This is the guard `createOAuth2Refresher` embeds, exposed standalone for
+ * login flows, bridge-start, and API-version fetches.
+ */
+export declare function singleFlight<T>(fn: () => Promise<T>): () => Promise<T>;
+/** The keyed async cache returned by {@link memoizeAsync}. */
+export interface AsyncMemo<K, V> {
+    /** Load (or return the cached/in-flight load of) the value for `key`. */
+    get(key: K): Promise<V>;
+    /** Drop one key so the next {@link get} reloads it. */
+    delete(key: K): void;
+    /** Drop everything. */
+    clear(): void;
+    /** Number of cached (or in-flight) keys. */
+    readonly size: number;
+}
+/**
+ * Memoize an async `loader` by key, caching the **promise** so concurrent
+ * `get`s of the same key coalesce onto one load. A load that REJECTS is
+ * evicted as it settles — the rejection reaches every coalesced waiter, but
+ * the next `get` retries instead of replaying the cached failure.
+ *
+ * `delete`/`clear` cover invalidation and the `_reset*` test hooks the donor
+ * repos (redfin, zola) exposed by hand.
+ */
+export declare function memoizeAsync<K, V>(loader: (key: K) => Promise<V>): AsyncMemo<K, V>;
+//# sourceMappingURL=single-flight.d.ts.map

package/dist/concurrency/single-flight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-flight.d.ts","sourceRoot":"","sources":["../../src/concurrency/single-flight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAUtE;AAED,8DAA8D;AAC9D,MAAM,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC;IAC7B,yEAAyE;IACzE,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,uDAAuD;IACvD,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACrB,uBAAuB;IACvB,KAAK,IAAI,IAAI,CAAC;IACd,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAyBlF"}

package/dist/concurrency/single-flight.js

@@ -0,0 +1,76 @@
+/**
+ * `singleFlight` / `memoizeAsync` — in-flight promise coalescing.
+ *
+ * The fleet hand-rolls this shape at least nine times: honeybook's
+ * `apiVersionPromise` (self-clearing memoized fetch), infinitecampus's
+ * `loginInFlight`, onehome's `capturePromise`, vibo's `loginInFlight` +
+ * `reauthInFlight`, alltrails's `ensureApiKey`/`bridgeReady`, tripadvisor's
+ * `bridgeReady`, artsonia's `ensureStarted`, and redfin's promise-caching
+ * `LocalityPoolCache`. Two primitives cover all of them:
+ *
+ *  - {@link singleFlight} — one shared in-flight promise, cleared on settle
+ *    (the login/refresh/bridge-ready guard).
+ *  - {@link memoizeAsync} — a keyed promise cache that coalesces concurrent
+ *    loads and evicts a rejected load so the next call retries (the keyed
+ *    loader cache).
+ */
+/**
+ * Wrap an async `fn` so concurrent calls share ONE in-flight invocation. The
+ * in-flight promise is cleared once it settles, so the next call starts fresh
+ * and a rejection doesn't poison later callers (every waiter of the failed
+ * flight still sees the rejection).
+ *
+ * This is the guard `createOAuth2Refresher` embeds, exposed standalone for
+ * login flows, bridge-start, and API-version fetches.
+ */
+export function singleFlight(fn) {
+    let inFlight = null;
+    return function run() {
+        if (inFlight)
+            return inFlight;
+        const p = fn().finally(() => {
+            if (inFlight === p)
+                inFlight = null;
+        });
+        inFlight = p;
+        return p;
+    };
+}
+/**
+ * Memoize an async `loader` by key, caching the **promise** so concurrent
+ * `get`s of the same key coalesce onto one load. A load that REJECTS is
+ * evicted as it settles — the rejection reaches every coalesced waiter, but
+ * the next `get` retries instead of replaying the cached failure.
+ *
+ * `delete`/`clear` cover invalidation and the `_reset*` test hooks the donor
+ * repos (redfin, zola) exposed by hand.
+ */
+export function memoizeAsync(loader) {
+    const cache = new Map();
+    return {
+        get(key) {
+            const hit = cache.get(key);
+            if (hit)
+                return hit;
+            const p = loader(key);
+            cache.set(key, p);
+            // Evict a failed load so the next get() retries; guard against the slot
+            // having been deleted/replaced while this load was in flight.
+            p.catch(() => {
+                if (cache.get(key) === p)
+                    cache.delete(key);
+            });
+            return p;
+        },
+        delete(key) {
+            cache.delete(key);
+        },
+        clear() {
+            cache.clear();
+        },
+        get size() {
+            return cache.size;
+        },
+    };
+}
+//# sourceMappingURL=single-flight.js.map

package/dist/concurrency/single-flight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-flight.js","sourceRoot":"","sources":["../../src/concurrency/single-flight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAI,EAAoB;IAClD,IAAI,QAAQ,GAAsB,IAAI,CAAC;IACvC,OAAO,SAAS,GAAG;QACjB,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC1B,IAAI,QAAQ,KAAK,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,QAAQ,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAO,MAA8B;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,OAAO;QACL,GAAG,CAAC,GAAM;YACR,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAClB,wEAAwE;YACxE,8DAA8D;YAC9D,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACX,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,CAAC,GAAM;YACX,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,KAAK;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,IAAI;YACN,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}