@circle-rd/auth-ai 0.0.0-stage → 0.1.0

package/dist/browser/store.js

@@ -0,0 +1,99 @@
+import { AuthAiError, ERR } from "../errors.js";
+export function createObservable(initial) {
+    let value = initial;
+    const listeners = new Set();
+    return {
+        get: () => value,
+        set(next) {
+            if (Object.is(next, value))
+                return;
+            value = next;
+            for (const listener of [...listeners])
+                listener();
+        },
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+    };
+}
+function asError(err) {
+    return err instanceof AuthAiError
+        ? err
+        : ERR.API_001("The request failed", { cause: err });
+}
+export const INITIAL_AUTH_STATE = {
+    status: "loading",
+    user: null,
+    error: null,
+};
+export function createAuthStore(auth) {
+    const state = createObservable(INITIAL_AUTH_STATE);
+    // A slow answer must not overwrite a newer one.
+    let latest = 0;
+    return {
+        state,
+        async refresh() {
+            const ticket = (latest += 1);
+            try {
+                const user = await auth.getUser();
+                if (ticket !== latest)
+                    return;
+                state.set(user
+                    ? { status: "authenticated", user, error: null }
+                    : { status: "unauthenticated", user: null, error: null });
+            }
+            catch (err) {
+                if (ticket !== latest)
+                    return;
+                // Keep the last known user: a failed refresh does not sign anyone out.
+                state.set({
+                    status: "error",
+                    user: state.get().user,
+                    error: asError(err),
+                });
+            }
+        },
+    };
+}
+export function createResourceStore(load, options = {}) {
+    const state = createObservable({
+        status: "idle",
+        data: null,
+        error: null,
+    });
+    let latest = 0;
+    async function refresh() {
+        const ticket = (latest += 1);
+        const previous = state.get().data;
+        state.set({ status: "loading", data: previous, error: null });
+        try {
+            const data = await load();
+            if (ticket === latest)
+                state.set({ status: "ready", data, error: null });
+        }
+        catch (err) {
+            if (ticket !== latest)
+                return;
+            const error = asError(err);
+            state.set({ status: "error", data: previous, error });
+            options.onError?.(error);
+        }
+    }
+    return {
+        state,
+        refresh,
+        start() {
+            void refresh();
+            const timer = options.pollIntervalMs
+                ? setInterval(() => void refresh(), options.pollIntervalMs)
+                : undefined;
+            return () => {
+                // A load in flight when the consumer leaves must not write afterwards.
+                latest += 1;
+                if (timer !== undefined)
+                    clearInterval(timer);
+            };
+        },
+    };
+}

package/dist/claims.d.ts

@@ -0,0 +1,60 @@
+import { z } from "zod";
+declare const featureValueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+/** Claims of an ID token issued by auth-service. Unknown claims are kept as is. */
+export declare const idTokenClaimsSchema: z.ZodObject<{
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    features: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    plan: z.ZodOptional<z.ZodString>;
+    org_id: z.ZodOptional<z.ZodString>;
+    sid: z.ZodOptional<z.ZodString>;
+    azp: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    picture: z.ZodOptional<z.ZodString>;
+    given_name: z.ZodOptional<z.ZodString>;
+    family_name: z.ZodOptional<z.ZodString>;
+    company: z.ZodOptional<z.ZodString>;
+    updated_at: z.ZodOptional<z.ZodNumber>;
+    email: z.ZodOptional<z.ZodString>;
+    email_verified: z.ZodOptional<z.ZodBoolean>;
+    phone_number: z.ZodOptional<z.ZodString>;
+    iss: z.ZodString;
+    sub: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+}, z.core.$loose>;
+/**
+ * Claims of a JWT access token. `azp` is the OAuth client that obtained the
+ * token and `scope` is a space-separated list.
+ */
+export declare const accessTokenClaimsSchema: z.ZodObject<{
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    features: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    plan: z.ZodOptional<z.ZodString>;
+    org_id: z.ZodOptional<z.ZodString>;
+    azp: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    sid: z.ZodOptional<z.ZodString>;
+    iss: z.ZodString;
+    sub: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+}, z.core.$loose>;
+export type FeatureValue = z.infer<typeof featureValueSchema>;
+export type IdTokenClaims = z.infer<typeof idTokenClaimsSchema>;
+export type AccessTokenClaims = z.infer<typeof accessTokenClaimsSchema>;
+export type PermissionAction = "read" | "write";
+type EntitlementClaims = Pick<IdTokenClaims, "roles" | "permissions" | "features">;
+export declare function hasRole(claims: EntitlementClaims, role: string): boolean;
+/**
+ * `resource` grants read access and `resource.write` grants write access,
+ * which also implies read: auth-service keeps only the highest action.
+ */
+export declare function hasPermission(claims: EntitlementClaims, resource: string, action?: PermissionAction): boolean;
+/** A feature is enabled when present and neither `false` nor `0` nor `""`. */
+export declare function hasFeature(claims: EntitlementClaims, key: string): boolean;
+export declare function getFeature(claims: EntitlementClaims, key: string): FeatureValue | undefined;
+export {};

package/dist/claims.js

@@ -0,0 +1,68 @@
+import { z } from "zod";
+const featureValueSchema = z.union([z.string(), z.number(), z.boolean()]);
+const audienceSchema = z.union([z.string(), z.array(z.string())]);
+// Present only when the matching scope was granted.
+const entitlementShape = {
+    roles: z.array(z.string()).optional(),
+    permissions: z.array(z.string()).optional(),
+    features: z.record(z.string(), featureValueSchema).optional(),
+    plan: z.string().optional(),
+    org_id: z.string().optional(),
+};
+const registeredShape = {
+    iss: z.string(),
+    sub: z.string(),
+    aud: audienceSchema,
+    exp: z.number(),
+    iat: z.number(),
+};
+/** Claims of an ID token issued by auth-service. Unknown claims are kept as is. */
+export const idTokenClaimsSchema = z.looseObject({
+    ...registeredShape,
+    sid: z.string().optional(),
+    azp: z.string().optional(),
+    name: z.string().optional(),
+    picture: z.string().optional(),
+    given_name: z.string().optional(),
+    family_name: z.string().optional(),
+    company: z.string().optional(),
+    updated_at: z.number().optional(),
+    email: z.string().optional(),
+    email_verified: z.boolean().optional(),
+    phone_number: z.string().optional(),
+    ...entitlementShape,
+});
+/**
+ * Claims of a JWT access token. `azp` is the OAuth client that obtained the
+ * token and `scope` is a space-separated list.
+ */
+export const accessTokenClaimsSchema = z.looseObject({
+    ...registeredShape,
+    azp: z.string(),
+    scope: z.string().optional(),
+    sid: z.string().optional(),
+    ...entitlementShape,
+});
+export function hasRole(claims, role) {
+    return claims.roles?.includes(role) ?? false;
+}
+/**
+ * `resource` grants read access and `resource.write` grants write access,
+ * which also implies read: auth-service keeps only the highest action.
+ */
+export function hasPermission(claims, resource, action = "read") {
+    const permissions = claims.permissions;
+    if (!permissions)
+        return false;
+    if (permissions.includes(`${resource}.write`))
+        return true;
+    return action === "read" && permissions.includes(resource);
+}
+/** A feature is enabled when present and neither `false` nor `0` nor `""`. */
+export function hasFeature(claims, key) {
+    const value = claims.features?.[key];
+    return value !== undefined && value !== false && value !== 0 && value !== "";
+}
+export function getFeature(claims, key) {
+    return claims.features?.[key];
+}

package/dist/client.d.ts

@@ -0,0 +1,54 @@
+import type { IdTokenClaims } from "./claims.js";
+import type { AuthClientConfig, ResolvedAuthClientConfig } from "./config.js";
+import type { IntrospectionResult } from "./introspection.js";
+import type { JWTPayload } from "jose";
+import type { VerifyJwtOptions } from "./jwt.js";
+import type { LoginHandshake, LoginRequest, LoginResult, ClientCredentialsOptions, LogoutUrlOptions, RefreshOptions, StartLoginOptions, TokenSet, TokenTypeHint } from "./types.js";
+export interface AuthClientOptions {
+    /** Replaces the global `fetch`, e.g. to add a proxy or an observability layer. */
+    readonly fetch?: typeof fetch;
+}
+/**
+ * OIDC relying party for auth-service: authorization-code grant with PKCE,
+ * refresh with RFC 8707 resource narrowing, logout, revocation and
+ * introspection. It keeps no session: callers persist the handshake, the
+ * tokens and the claims where it suits them.
+ */
+export declare class AuthClient {
+    #private;
+    readonly config: ResolvedAuthClientConfig;
+    /** The fetch used for every request, shared with the REST API clients built on this one. */
+    readonly fetch: typeof fetch;
+    constructor(config: AuthClientConfig, options?: AuthClientOptions);
+    startLogin(options?: StartLoginOptions): Promise<LoginRequest>;
+    /**
+     * Completes the sign-in from the callback URL. `resource` is deliberately not
+     * sent on the code exchange: the token is then issued for every audience
+     * requested at sign-in and each refresh narrows it to one.
+     */
+    handleCallback(callbackUrl: URL | string, handshake: LoginHandshake): Promise<LoginResult>;
+    verifyIdToken(idToken: string): Promise<IdTokenClaims>;
+    /**
+     * Exchanges a refresh token for fresh tokens. The provider rotates the
+     * refresh token on every use: the returned one replaces the presented one,
+     * and a replayed stale token revokes the whole family. Concurrent callers
+     * should go through a grant manager. `scope` is never sent: the rotated
+     * token would be left with the scopes of that request only.
+     */
+    refresh(refreshToken: string, options?: RefreshOptions): Promise<TokenSet>;
+    /** URL ending the provider session (RP-initiated logout). */
+    logoutUrl(options?: LogoutUrlOptions): Promise<string>;
+    revoke(token: string, hint?: TokenTypeHint): Promise<void>;
+    introspect(token: string, hint?: TokenTypeHint): Promise<IntrospectionResult>;
+    /**
+     * Verifies the signature, issuer, audience and expiry of a JWT signed by the
+     * provider. Low-level: prefer the bearer and logout token verifiers.
+     */
+    verifyJwt(token: string, options: VerifyJwtOptions): Promise<JWTPayload>;
+    /**
+     * `client_credentials` grant for the application itself: no user is bound to
+     * the token. Needs a confidential client.
+     */
+    clientCredentials(options?: ClientCredentialsOptions): Promise<TokenSet>;
+}
+export declare function createAuthClient(config: AuthClientConfig, options?: AuthClientOptions): AuthClient;

package/dist/client.js

@@ -0,0 +1,204 @@
+import * as oidc from "openid-client";
+import { idTokenClaimsSchema } from "./claims.js";
+import { parseAuthClientConfig } from "./config.js";
+import { ERR } from "./errors.js";
+import { introspectionSchema } from "./introspection.js";
+import { toAuthAiError } from "./oauth-errors.js";
+import { createProviderLoader } from "./provider.js";
+function toTokenSet(response) {
+    const expiresIn = response.expiresIn();
+    if (expiresIn === undefined) {
+        throw ERR.OIDC_003("The token response carries no expires_in");
+    }
+    return {
+        accessToken: response.access_token,
+        tokenType: response.token_type,
+        expiresAt: Math.floor(Date.now() / 1000) + expiresIn,
+        ...(response.scope ? { scope: response.scope } : {}),
+        ...(response.refresh_token ? { refreshToken: response.refresh_token } : {}),
+        ...(response.id_token ? { idToken: response.id_token } : {}),
+    };
+}
+/**
+ * OIDC relying party for auth-service: authorization-code grant with PKCE,
+ * refresh with RFC 8707 resource narrowing, logout, revocation and
+ * introspection. It keeps no session: callers persist the handshake, the
+ * tokens and the claims where it suits them.
+ */
+export class AuthClient {
+    config;
+    /** The fetch used for every request, shared with the REST API clients built on this one. */
+    fetch;
+    #loadProvider;
+    constructor(config, options = {}) {
+        this.config = parseAuthClientConfig(config);
+        this.fetch =
+            options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+        this.#loadProvider = createProviderLoader(this.config, options.fetch);
+    }
+    async startLogin(options = {}) {
+        const { configuration } = await this.#loadProvider();
+        const handshake = {
+            state: oidc.randomState(),
+            nonce: oidc.randomNonce(),
+            codeVerifier: oidc.randomPKCECodeVerifier(),
+        };
+        const parameters = new URLSearchParams({
+            redirect_uri: this.config.redirectUri,
+            scope: this.config.scopes.join(" "),
+            state: handshake.state,
+            nonce: handshake.nonce,
+            code_challenge: await oidc.calculatePKCECodeChallenge(handshake.codeVerifier),
+            code_challenge_method: "S256",
+        });
+        if (options.prompt)
+            parameters.set("prompt", options.prompt);
+        if (options.loginHint)
+            parameters.set("login_hint", options.loginHint);
+        for (const resource of this.config.resources) {
+            parameters.append("resource", resource);
+        }
+        return {
+            url: oidc.buildAuthorizationUrl(configuration, parameters).href,
+            handshake,
+        };
+    }
+    /**
+     * Completes the sign-in from the callback URL. `resource` is deliberately not
+     * sent on the code exchange: the token is then issued for every audience
+     * requested at sign-in and each refresh narrows it to one.
+     */
+    async handleCallback(callbackUrl, handshake) {
+        const provider = await this.#loadProvider();
+        let response;
+        try {
+            response = await oidc.authorizationCodeGrant(provider.configuration, new URL(callbackUrl), {
+                pkceCodeVerifier: handshake.codeVerifier,
+                expectedState: handshake.state,
+                expectedNonce: handshake.nonce,
+                idTokenExpected: true,
+            });
+        }
+        catch (err) {
+            throw toAuthAiError(err, "authorization-response");
+        }
+        const tokens = toTokenSet(response);
+        if (!tokens.idToken) {
+            throw ERR.OIDC_002("The token response carries no ID token");
+        }
+        const claims = await this.#verifyIdToken(provider, tokens.idToken);
+        if (claims["nonce"] !== handshake.nonce) {
+            throw ERR.TOK_001("ID token nonce mismatch");
+        }
+        return {
+            tokens: { ...tokens, idToken: tokens.idToken },
+            claims,
+            sessionId: claims.sid,
+        };
+    }
+    async verifyIdToken(idToken) {
+        return this.#verifyIdToken(await this.#loadProvider(), idToken);
+    }
+    /**
+     * Exchanges a refresh token for fresh tokens. The provider rotates the
+     * refresh token on every use: the returned one replaces the presented one,
+     * and a replayed stale token revokes the whole family. Concurrent callers
+     * should go through a grant manager. `scope` is never sent: the rotated
+     * token would be left with the scopes of that request only.
+     */
+    async refresh(refreshToken, options = {}) {
+        const { configuration } = await this.#loadProvider();
+        try {
+            const response = await oidc.refreshTokenGrant(configuration, refreshToken, options.resource ? { resource: options.resource } : undefined);
+            return toTokenSet(response);
+        }
+        catch (err) {
+            throw toAuthAiError(err, "token-request");
+        }
+    }
+    /** URL ending the provider session (RP-initiated logout). */
+    async logoutUrl(options = {}) {
+        const { configuration } = await this.#loadProvider();
+        if (!configuration.serverMetadata().end_session_endpoint) {
+            throw ERR.OIDC_004("The provider advertises no end_session_endpoint");
+        }
+        const parameters = new URLSearchParams();
+        if (this.config.postLogoutRedirectUri) {
+            parameters.set("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
+        }
+        if (options.idTokenHint) {
+            parameters.set("id_token_hint", options.idTokenHint);
+        }
+        if (options.state)
+            parameters.set("state", options.state);
+        return oidc.buildEndSessionUrl(configuration, parameters).href;
+    }
+    async revoke(token, hint) {
+        const { configuration } = await this.#loadProvider();
+        if (!configuration.serverMetadata().revocation_endpoint) {
+            throw ERR.OIDC_004("The provider advertises no revocation_endpoint");
+        }
+        try {
+            await oidc.tokenRevocation(configuration, token, hint ? { token_type_hint: hint } : undefined);
+        }
+        catch (err) {
+            throw toAuthAiError(err, "token-request");
+        }
+    }
+    async introspect(token, hint) {
+        const { configuration } = await this.#loadProvider();
+        if (!configuration.serverMetadata().introspection_endpoint) {
+            throw ERR.OIDC_004("The provider advertises no introspection_endpoint");
+        }
+        try {
+            const response = await oidc.tokenIntrospection(configuration, token, hint ? { token_type_hint: hint } : undefined);
+            return introspectionSchema.parse(response);
+        }
+        catch (err) {
+            throw toAuthAiError(err, "token-request");
+        }
+    }
+    /**
+     * Verifies the signature, issuer, audience and expiry of a JWT signed by the
+     * provider. Low-level: prefer the bearer and logout token verifiers.
+     */
+    async verifyJwt(token, options) {
+        return (await this.#loadProvider()).verifyJwt(token, options);
+    }
+    /**
+     * `client_credentials` grant for the application itself: no user is bound to
+     * the token. Needs a confidential client.
+     */
+    async clientCredentials(options = {}) {
+        if (!this.config.clientSecret) {
+            throw ERR.CFG_001("clientCredentials requires a clientSecret");
+        }
+        const { configuration } = await this.#loadProvider();
+        const parameters = {};
+        if (options.scope)
+            parameters["scope"] = options.scope;
+        if (options.resource)
+            parameters["resource"] = options.resource;
+        try {
+            return toTokenSet(await oidc.clientCredentialsGrant(configuration, parameters));
+        }
+        catch (err) {
+            throw toAuthAiError(err, "token-request");
+        }
+    }
+    async #verifyIdToken(provider, idToken) {
+        const payload = await provider.verifyJwt(idToken, {
+            audience: this.config.clientId,
+        });
+        const claims = idTokenClaimsSchema.safeParse(payload);
+        if (!claims.success) {
+            throw ERR.TOK_001("The ID token claims have an unexpected shape", {
+                cause: claims.error,
+            });
+        }
+        return claims.data;
+    }
+}
+export function createAuthClient(config, options = {}) {
+    return new AuthClient(config, options);
+}

package/dist/config.d.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+export declare const DEFAULT_SCOPES: readonly ["openid", "profile", "email", "roles", "permissions", "features", "offline_access"];
+export declare const WALLET_SELF_SCOPE = "wallet:self:read";
+/**
+ * With a gateway, the sign-in also asks for the audiences of the gateway and
+ * of auth-service (which serves the wallet) and for the wallet scope: this is
+ * what the application's "LiteLLM support" switch authorises.
+ */
+export declare const authClientConfigSchema: z.ZodPipe<z.ZodObject<{
+    issuer: z.ZodURL;
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    tokenEndpointAuthMethod: z.ZodDefault<z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+    }>>;
+    redirectUri: z.ZodURL;
+    postLogoutRedirectUri: z.ZodOptional<z.ZodURL>;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    resources: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+    gatewayUrl: z.ZodOptional<z.ZodURL>;
+    clockToleranceSeconds: z.ZodDefault<z.ZodNumber>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>, z.ZodTransform<{
+    issuer: string;
+    clientId: string;
+    tokenEndpointAuthMethod: "client_secret_basic" | "client_secret_post";
+    redirectUri: string;
+    scopes: string[];
+    resources: string[];
+    clockToleranceSeconds: number;
+    timeoutMs: number;
+    clientSecret?: string | undefined;
+    postLogoutRedirectUri?: string | undefined;
+    gatewayUrl?: string | undefined;
+}, {
+    issuer: string;
+    clientId: string;
+    tokenEndpointAuthMethod: "client_secret_basic" | "client_secret_post";
+    redirectUri: string;
+    scopes: string[];
+    resources: string[];
+    clockToleranceSeconds: number;
+    timeoutMs: number;
+    clientSecret?: string | undefined;
+    postLogoutRedirectUri?: string | undefined;
+    gatewayUrl?: string | undefined;
+}>>;
+export type AuthClientConfig = z.input<typeof authClientConfigSchema>;
+export type ResolvedAuthClientConfig = z.output<typeof authClientConfigSchema>;
+export declare function parseAuthClientConfig(input: unknown): ResolvedAuthClientConfig;

package/dist/config.js

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import { ERR } from "./errors.js";
+export const DEFAULT_SCOPES = [
+    "openid",
+    "profile",
+    "email",
+    "roles",
+    "permissions",
+    "features",
+    "offline_access",
+];
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+// Scope that lets a user token read the user's own wallet.
+export const WALLET_SELF_SCOPE = "wallet:self:read";
+const issuerSchema = z
+    .url({ protocol: /^https$/ })
+    .refine((value) => !value.endsWith("/"), {
+    message: "must not end with a slash: it is compared verbatim to `iss`",
+});
+// http is allowed for loopback only, so local development needs no tunnel.
+const redirectUriSchema = z.url().refine((value) => {
+    // Zod runs refinements even when `z.url()` failed.
+    if (!URL.canParse(value))
+        return false;
+    const url = new URL(value);
+    return (url.protocol === "https:" ||
+        (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname)));
+}, { message: "must be https (http is only accepted for localhost)" });
+// An audience is compared verbatim to `aud`: a trailing slash would never match.
+const gatewayUrlSchema = redirectUriSchema.refine((value) => !value.endsWith("/"), { message: "must not end with a slash: it is compared verbatim to `aud`" });
+const authClientConfigShape = z.object({
+    issuer: issuerSchema,
+    clientId: z.string().min(1),
+    // Absent for a public client, which then relies on PKCE alone.
+    clientSecret: z.string().min(1).optional(),
+    tokenEndpointAuthMethod: z
+        .enum(["client_secret_basic", "client_secret_post"])
+        .default("client_secret_basic"),
+    redirectUri: redirectUriSchema,
+    postLogoutRedirectUri: redirectUriSchema.optional(),
+    scopes: z
+        .array(z.string().min(1))
+        .refine((scopes) => scopes.includes("openid"), {
+        message: "must include `openid`",
+    })
+        .default([...DEFAULT_SCOPES]),
+    // RFC 8707 audiences requested at sign-in; each refresh narrows to one.
+    resources: z.array(z.url()).default([]),
+    // Public URL of the LiteLLM gateway: turns on the gateway and wallet audiences.
+    gatewayUrl: gatewayUrlSchema.optional(),
+    clockToleranceSeconds: z.number().int().min(0).max(300).default(5),
+    timeoutMs: z.number().int().positive().default(10_000),
+});
+/**
+ * With a gateway, the sign-in also asks for the audiences of the gateway and
+ * of auth-service (which serves the wallet) and for the wallet scope: this is
+ * what the application's "LiteLLM support" switch authorises.
+ */
+export const authClientConfigSchema = authClientConfigShape.transform((config) => {
+    if (!config.gatewayUrl)
+        return config;
+    return {
+        ...config,
+        scopes: [...new Set([...config.scopes, WALLET_SELF_SCOPE])],
+        resources: [
+            ...new Set([...config.resources, config.gatewayUrl, config.issuer]),
+        ],
+    };
+});
+export function parseAuthClientConfig(input) {
+    const result = authClientConfigSchema.safeParse(input);
+    if (result.success)
+        return result.data;
+    const issues = result.error.issues
+        .map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`)
+        .join("; ");
+    throw ERR.CFG_001(`Invalid SDK configuration: ${issues}`, {
+        cause: result.error,
+    });
+}