@executor-js/sdk 0.1.0 → 0.2.0

package/dist/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,eAAO,MAAM,OAAO,wCAA8C,CAAC;AACnE,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC;AAE1C,eAAO,MAAM,MAAM,uCAA6C,CAAC;AACjE,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC;AAExC,eAAO,MAAM,QAAQ,yCAA+C,CAAC;AACrE,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,QAAQ,yCAA+C,CAAC;AACrE,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,YAAY,6CAAmD,CAAC;AAC7E,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,eAAO,MAAM,OAAO,wCAA8C,CAAC;AACnE,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC;AAE1C,eAAO,MAAM,MAAM,uCAA6C,CAAC;AACjE,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC;AAExC,eAAO,MAAM,QAAQ,yCAA+C,CAAC;AACrE,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,QAAQ,yCAA+C,CAAC;AACrE,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,YAAY,6CAAmD,CAAC;AAC7E,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AAEpD,eAAO,MAAM,mBAAmB,oDAA0D,CAAC;AAC3F,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAC"}

package/dist/index.d.ts

@@ -3,26 +3,31 @@ export { HttpApi, HttpApiBuilder, HttpApiClient, HttpApiEndpoint, HttpApiGroup,
 export type { DBAdapter, DBSchema, DBFieldAttribute, DBFieldType, StorageFailure, TypedAdapter, Where, WhereOperator, } from "@executor-js/storage-core";
 export { typedAdapter } from "@executor-js/storage-core";
 export { StorageError, UniqueViolationError } from "@executor-js/storage-core";
-export { ScopeId, ToolId, SecretId, PolicyId, ConnectionId } from "./ids";
+export { ScopeId, ToolId, SecretId, PolicyId, ConnectionId, CredentialBindingId } from "./ids";
 export { Scope } from "./scope";
-export { ToolNotFoundError, ToolInvocationError, ToolBlockedError, NoHandlerError, SourceNotFoundError, SourceRemovalNotAllowedError, PluginNotLoadedError, SecretNotFoundError, SecretResolutionError, SecretOwnedByConnectionError, ConnectionNotFoundError, ConnectionProviderNotRegisteredError, ConnectionRefreshNotSupportedError, ConnectionReauthRequiredError, type ExecutorError, } from "./errors";
-export { ToolSchema, SourceDetectionResult, type Source, type Tool, type ToolListFilter, } from "./types";
-export { coreSchema, isToolPolicyAction, TOOL_POLICY_ACTIONS, type CoreSchema, type SourceInput, type SourceInputTool, type SourceRow, type ToolRow, type DefinitionRow, type SecretRow, type ConnectionRow, type ToolPolicyRow, type ToolPolicyAction, type DefinitionsInput, type ToolAnnotations, } from "./core-schema";
-export { matchPattern, isValidPattern, resolveToolPolicy, resolveEffectivePolicy, effectivePolicyFromSorted, rowToToolPolicy, ToolPolicyActionSchema, type ToolPolicy, type CreateToolPolicyInput, type UpdateToolPolicyInput, type PolicyMatch, type EffectivePolicy, type PolicySource, } from "./policies";
-export { SecretRef, SetSecretInput, type SecretProvider } from "./secrets";
+export { ToolNotFoundError, ToolInvocationError, ToolBlockedError, NoHandlerError, SourceNotFoundError, SourceRemovalNotAllowedError, PluginNotLoadedError, SecretNotFoundError, SecretResolutionError, SecretOwnedByConnectionError, SecretInUseError, ConnectionNotFoundError, ConnectionProviderNotRegisteredError, ConnectionRefreshNotSupportedError, ConnectionReauthRequiredError, ConnectionInUseError, type ExecutorError, } from "./errors";
+export { ToolSchema, SourceDetectionResult, type RefreshSourceInput, type RemoveSourceInput, type Source, type Tool, type ToolListFilter, } from "./types";
+export { coreSchema, isToolPolicyAction, TOOL_POLICY_ACTIONS, type CoreSchema, type SourceInput, type SourceInputTool, type SourceRow, type ToolRow, type DefinitionRow, type SecretRow, type ConnectionRow, type CredentialBindingRow, type ToolPolicyRow, type ToolPolicyAction, type DefinitionsInput, type ToolAnnotations, } from "./core-schema";
+export { matchPattern, isValidPattern, resolveToolPolicy, resolveEffectivePolicy, effectivePolicyFromSorted, rowToToolPolicy, ToolPolicyActionSchema, type ToolPolicy, type CreateToolPolicyInput, type UpdateToolPolicyInput, type RemoveToolPolicyInput, type PolicyMatch, type EffectivePolicy, type PolicySource, } from "./policies";
+export { SecretRef, SetSecretInput, RemoveSecretInput, type SecretProvider } from "./secrets";
 export { SecretBackedMap, SecretBackedValue, isSecretBackedRef, resolveSecretBackedMap, type ResolveSecretBackedMapOptions, } from "./secret-backed-value";
-export { ConnectionRef, ConnectionProviderState, CreateConnectionInput, UpdateConnectionTokensInput, TokenMaterial, ConnectionRefreshError, type ConnectionProvider, type ConnectionRefreshInput, type ConnectionRefreshResult, } from "./connections";
+export { CredentialBindingKind, CredentialBindingValue, ConfiguredCredentialBinding, ConfiguredCredentialValue, ConfiguredCredentialValueSchema, ScopedSecretCredentialInput, CredentialBindingRef, SetCredentialBindingInput, CredentialBindingSourceInput, CredentialBindingSlotInput, RemoveCredentialBindingInput, ReplaceCredentialBindingValue, ReplaceCredentialBindingsInput, CredentialBindingResolutionStatus, ResolvedCredentialSlot, credentialBindingId, credentialSlotKey, credentialSlotPart, credentialBindingRowToRef, credentialBindingValueFromRow, type CredentialBindingsFacade, } from "./credential-bindings";
+export { Usage, type UsagesForSecretInput, type UsagesForConnectionInput } from "./usages";
+export { ConnectionRef, ConnectionProviderState, CreateConnectionInput, RemoveConnectionInput, UpdateConnectionTokensInput, TokenMaterial, ConnectionRefreshError, type ConnectionProvider, type ConnectionRefreshInput, type ConnectionRefreshResult, } from "./connections";
 export { FormElicitation, UrlElicitation, ElicitationAction, ElicitationResponse, ElicitationDeclinedError, type ElicitationRequest, type ElicitationHandler, type ElicitationContext, } from "./elicitation";
 export { type BlobStore, type PluginBlobStore, pluginBlobStore, makeInMemoryBlobStore, } from "./blob";
 export { type OAuthService, type OAuthStrategy, type OAuthDynamicDcrStrategy, type OAuthAuthorizationCodeStrategy, type OAuthClientCredentialsStrategy, type OAuthProviderState, type OAuthProbeInput, type OAuthProbeResult, type OAuthStartInput, type OAuthStartResult, type OAuthCompleteInput, type OAuthCompleteResult, OAuthProbeError, OAuthStartError, OAuthCompleteError, OAuthSessionNotFoundError, OAUTH2_PROVIDER_KEY, OAUTH2_SESSION_TTL_MS, OAuthStrategy as OAuthStrategySchema, OAuthProviderState as OAuthProviderStateSchema, OAuthDynamicDcrStrategy as OAuthDynamicDcrStrategySchema, OAuthAuthorizationCodeStrategy as OAuthAuthorizationCodeStrategySchema, OAuthClientCredentialsStrategy as OAuthClientCredentialsStrategySchema, } from "./oauth";
-export { OAuth2Error, OAUTH2_DEFAULT_TIMEOUT_MS, OAUTH2_REFRESH_SKEW_MS, buildAuthorizationUrl, createPkceCodeChallenge, createPkceCodeVerifier, exchangeAuthorizationCode, exchangeClientCredentials, refreshAccessToken, shouldRefreshToken, type OAuth2TokenResponse, type BuildAuthorizationUrlInput, type ClientAuthMethod, type ExchangeAuthorizationCodeInput, type ExchangeClientCredentialsInput, type RefreshAccessTokenInput, } from "./oauth-helpers";
+export { OAuth2Error, OAUTH2_DEFAULT_TIMEOUT_MS, OAUTH2_REFRESH_SKEW_MS, assertSupportedOAuthEndpointUrl, buildAuthorizationUrl, createPkceCodeChallenge, createPkceCodeVerifier, exchangeAuthorizationCode, exchangeClientCredentials, isSupportedOAuthEndpointUrl, refreshAccessToken, shouldRefreshToken, type OAuth2TokenResponse, type BuildAuthorizationUrlInput, type ClientAuthMethod, type ExchangeAuthorizationCodeInput, type ExchangeClientCredentialsInput, type RefreshAccessTokenInput, } from "./oauth-helpers";
 export { makeOAuth2Service, type OAuthServiceDeps } from "./oauth-service";
+export type { ScopedDBAdapter, ScopedTypedAdapter } from "./scoped-adapter";
+export { HostedOutboundRequestBlocked, makeHostedHttpClientLayer, validateHostedOutboundUrl, type HostedHttpClientOptions, } from "./hosted-http-client";
 export { OAuthDiscoveryError, OAuthAuthorizationServerMetadataSchema, OAuthClientInformationSchema, OAuthProtectedResourceMetadataSchema, beginDynamicAuthorization, discoverAuthorizationServerMetadata, discoverProtectedResourceMetadata, registerDynamicClient, type BeginDynamicAuthorizationInput, type DiscoveryRequestOptions, type DynamicAuthorizationState, type DynamicAuthorizationStartResult, type DynamicClientMetadata, type OAuthAuthorizationServerMetadata, type OAuthClientInformation, type OAuthProtectedResourceMetadata, type RegisterDynamicClientInput, } from "./oauth-discovery";
 export { OAUTH_POPUP_MESSAGE_TYPE, type OAuthPopupResult, isOAuthPopupResult, } from "./oauth-popup-types";
 export { type Plugin, type PluginSpec, type PluginCtx, type PluginExtensions, type ConfiguredPlugin, type AnyPlugin, type StorageDeps, type StaticSourceDecl, type StaticToolDecl, type StaticToolHandlerInput, type InvokeToolInput, type SourceLifecycleInput, type SecretListEntry, type Elicit, definePlugin, defineSchema, } from "./plugin";
 export { type Executor, type ExecutorConfig, type OnElicitation, type InvokeOptions, createExecutor, collectSchemas, } from "./executor";
 export { defineExecutorConfig, type ExecutorCliConfig, type ExecutorDialect, type ExecutorPluginsFactory, } from "./config";
-export { makeTestConfig } from "./testing";
+export { makeTestConfig } from "./test-config";
 export { hoistDefinitions, collectRefs, reattachDefs, normalizeRefs } from "./schema-refs";
 export { schemaToTypeScriptPreview, schemaToTypeScriptPreviewWithDefs, buildToolTypeScriptPreview, type TypeScriptRenderOptions, type TypeScriptSchemaPreview, } from "./schema-types";
+export { InternalError } from "./api-errors";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EACL,OAAO,EACP,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,yBAAyB,CAAC;AAKjC,YAAY,EACV,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,YAAY,EACZ,KAAK,EACL,aAAa,GACd,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAG/E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAG1E,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAGhC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,oCAAoC,EACpC,kCAAkC,EAClC,6BAA6B,EAC7B,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,cAAc,GACpB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,sBAAsB,EACtB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACb,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,IAAI,mBAAmB,EACpC,kBAAkB,IAAI,wBAAwB,EAC9C,uBAAuB,IAAI,6BAA6B,EACxD,8BAA8B,IAAI,oCAAoC,EACtE,8BAA8B,IAAI,oCAAoC,GACvE,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE3E,OAAO,EACL,mBAAmB,EACnB,sCAAsC,EACtC,4BAA4B,EAC5B,oCAAoC,EACpC,yBAAyB,EACzB,mCAAmC,EACnC,iCAAiC,EACjC,qBAAqB,EACrB,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,MAAM,EACX,YAAY,EACZ,YAAY,GACb,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG3F,OAAO,EACL,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EACL,OAAO,EACP,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,yBAAyB,CAAC;AAKjC,YAAY,EACV,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,YAAY,EACZ,KAAK,EACL,aAAa,GACd,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAIzD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAG/E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAG/F,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAGhC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,gBAAgB,EAChB,uBAAuB,EACvB,oCAAoC,EACpC,kCAAkC,EAClC,6BAA6B,EAC7B,oBAAoB,EACpB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,cAAc,GACpB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,sBAAsB,EACtB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,+BAA+B,EAC/B,2BAA2B,EAC3B,oBAAoB,EACpB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,iCAAiC,EACjC,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,6BAA6B,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,KAAK,EAAE,KAAK,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAG3F,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACb,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,QAAQ,CAAC;AAGhB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,IAAI,mBAAmB,EACpC,kBAAkB,IAAI,wBAAwB,EAC9C,uBAAuB,IAAI,6BAA6B,EACxD,8BAA8B,IAAI,oCAAoC,EACtE,8BAA8B,IAAI,oCAAoC,GACvE,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,sCAAsC,EACtC,4BAA4B,EAC5B,oCAAoC,EACpC,yBAAyB,EACzB,mCAAmC,EACnC,iCAAiC,EACjC,qBAAqB,EACrB,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,EACrC,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,MAAM,EACX,YAAY,EACZ,YAAY,GACb,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG3F,OAAO,EACL,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,3 +1,10 @@
+import {
+  SecretBackedMap,
+  SecretBackedValue,
+  defineExecutorConfig,
+  isSecretBackedRef,
+  resolveSecretBackedMap
+} from "./chunk-6SQWMOM4.js";
 import {
   ElicitationAction,
   ElicitationResponse,
@@ -5,10 +12,10 @@ import {
   NoHandlerError,
   PluginNotLoadedError,
   PolicyId,
+  RemoveConnectionInput,
+  RemoveSecretInput,
   Scope,
   ScopeId,
-  SecretBackedMap,
-  SecretBackedValue,
   SecretId,
   SecretNotFoundError,
   SecretRef,
@@ -24,11 +31,8 @@ import {
   UrlElicitation,
   collectSchemas,
   createExecutor,
-  defineExecutorConfig,
-  isSecretBackedRef,
-  makeInMemoryBlobStore,
-  resolveSecretBackedMap
-} from "./chunk-2WV7VSNL.js";
+  makeInMemoryBlobStore
+} from "./chunk-VLVPSIQ4.js";
 
 // src/promise-executor.ts
 import { Effect } from "effect";
@@ -37,10 +41,7 @@ var isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray
 var promisifyDeep = (value) => {
   if (typeof value === "function") {
     return ((...args) => {
-      const result = value.apply(
-        void 0,
-        args
-      );
+      const result = value.apply(void 0, args);
       if (Effect.isEffect(result)) {
         return Effect.runPromise(result);
       }
@@ -53,10 +54,7 @@ var promisifyDeep = (value) => {
       const v = Reflect.get(target, prop, receiver);
       if (typeof v === "function") {
         return (...args) => {
-          const result = v.apply(
-            target,
-            args
-          );
+          const result = v.apply(target, args);
           if (Effect.isEffect(result)) {
             return Effect.runPromise(result);
           }
@@ -91,9 +89,7 @@ var createExecutor2 = async (config) => {
     plugins,
     onElicitation: config.onElicitation
   };
-  const effectExecutor = await Effect.runPromise(
-    createExecutor(effectConfig)
-  );
+  const effectExecutor = await Effect.runPromise(createExecutor(effectConfig));
   return promisifyDeep(effectExecutor);
 };
 export {
@@ -103,6 +99,8 @@ export {
   NoHandlerError,
   PluginNotLoadedError,
   PolicyId,
+  RemoveConnectionInput,
+  RemoveSecretInput,
   Scope,
   ScopeId,
   SecretBackedMap,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/promise-executor.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// @executor-js/sdk/promise — thin Promise façade over the Effect SDK.\n//\n// Consumer goal: use executors + plugins without touching Effect. The\n// façade wraps `createExecutor` so it returns a Promise, and proxies\n// every method on the returned executor to unwrap its Effect into a\n// Promise. Plugin factories are Effect-native but consumers never see\n// that — the proxy flattens plugin extension methods too.\n//\n// Not a goal: authoring plugins in Promise style. The plugin model\n// (storage, schema, staticSources, Effect ctx) is Effect-only. Bring\n// your own `@executor-js/plugin-*` from the Effect side.\n// ---------------------------------------------------------------------------\n\nimport { Brand, Effect } from \"effect\";\n\nimport { makeMemoryAdapter } from \"@executor-js/storage-core/testing/memory\";\n\nimport { makeInMemoryBlobStore } from \"./blob\";\nimport {\n  createExecutor as createEffectExecutor,\n  collectSchemas,\n  type Executor as EffectExecutor,\n  type OnElicitation,\n} from \"./executor\";\nimport { ScopeId } from \"./ids\";\nimport type { AnyPlugin } from \"./plugin\";\nimport { Scope } from \"./scope\";\n\n// ---------------------------------------------------------------------------\n// Types\n//\n// Promise consumers shouldn't need to construct Effect `Brand`s to call into\n// the executor — branded ids (`SecretId`, `ScopeId`, `ToolId`, `PolicyId`,\n// `ConnectionId`) are typed as `string & Brand<...>` on the Effect side, but\n// at runtime they're plain strings. `Unbrand` strips brand tags from\n// parameter types (recursively, so it walks into object fields like\n// `secrets.set({ id, scope })`) so consumers can pass plain strings. Return\n// types are passed through unchanged — caller code that reads `.id` etc.\n// off a returned ref still gets the branded type for use as an opaque token.\n// ---------------------------------------------------------------------------\n\ntype Unbrand<T> = T extends Brand.Brand<string>\n  ? string\n  : T extends readonly (infer U)[]\n    ? readonly Unbrand<U>[]\n    : T extends ReadonlyMap<infer K, infer V>\n      ? ReadonlyMap<Unbrand<K>, Unbrand<V>>\n      : T extends ReadonlySet<infer U>\n        ? ReadonlySet<Unbrand<U>>\n        : T extends Date\n          ? T\n          : T extends (...args: infer A) => infer R\n            ? (...args: { [I in keyof A]: Unbrand<A[I]> }) => Unbrand<R>\n            : T extends object\n              ? { readonly [K in keyof T]: Unbrand<T[K]> }\n              : T;\n\nexport type Promisified<T> = T extends (\n  ...args: infer A\n) => Effect.Effect<infer R, infer _E>\n  ? (...args: { [I in keyof A]: Unbrand<A[I]> }) => Promise<R>\n  : T extends readonly unknown[]\n    ? T\n    : T extends object\n      ? { readonly [K in keyof T]: Promisified<T[K]> }\n      : T;\n\nexport type Executor<TPlugins extends readonly AnyPlugin[] = []> = Promisified<\n  EffectExecutor<TPlugins>\n>;\n\nexport interface ExecutorConfig<TPlugins extends readonly AnyPlugin[] = []> {\n  /**\n   * Precedence-ordered scope stack (innermost first). Optional — defaults\n   * to a single-element stack with id \"default-scope\". Pass an array of\n   * `{ id, name }` partials to build a multi-scope executor.\n   */\n  readonly scopes?: readonly { readonly id?: string; readonly name?: string }[];\n  readonly plugins?: TPlugins;\n  /**\n   * How to respond when a tool requests user input mid-invocation. Pass\n   * `\"accept-all\"` for tests / non-interactive hosts, or a handler\n   * `(ctx) => Promise<ElicitationResponse>` for interactive ones.\n   * Required at construction so per-invoke calls don't have to thread\n   * an options arg.\n   */\n  readonly onElicitation: OnElicitation;\n}\n\n// ---------------------------------------------------------------------------\n// Promisify proxy — walks nested objects, converts Effect-returning methods\n// into Promise-returning methods. Non-Effect return values pass through.\n// ---------------------------------------------------------------------------\n\nconst isPlainObject = (v: unknown): v is Record<string | symbol, unknown> =>\n  v !== null &&\n  typeof v === \"object\" &&\n  !Array.isArray(v) &&\n  !(v instanceof Date) &&\n  !(v instanceof Promise);\n\nconst promisifyDeep = <T>(value: T): Promisified<T> => {\n  if (typeof value === \"function\") {\n    return ((...args: unknown[]) => {\n      const result = (value as (...a: unknown[]) => unknown).apply(\n        undefined,\n        args,\n      );\n      if (Effect.isEffect(result)) {\n        return Effect.runPromise(result as Effect.Effect<unknown, unknown>);\n      }\n      return result;\n    }) as Promisified<T>;\n  }\n\n  if (!isPlainObject(value)) return value as Promisified<T>;\n\n  return new Proxy(value, {\n    get(target, prop, receiver) {\n      const v = Reflect.get(target, prop, receiver);\n      if (typeof v === \"function\") {\n        return (...args: unknown[]) => {\n          const result = (v as (...a: unknown[]) => unknown).apply(\n            target,\n            args,\n          );\n          if (Effect.isEffect(result)) {\n            return Effect.runPromise(result as Effect.Effect<unknown, unknown>);\n          }\n          return result;\n        };\n      }\n      if (isPlainObject(v)) return promisifyDeep(v);\n      return v;\n    },\n  }) as Promisified<T>;\n};\n\n// ---------------------------------------------------------------------------\n// createExecutor — Promise wrapper over the Effect createExecutor.\n// Defaults to an in-memory adapter + blob store, so a consumer can\n// construct an executor with just `{ plugins: [...] }`.\n// ---------------------------------------------------------------------------\n\nexport const createExecutor = async <\n  const TPlugins extends readonly AnyPlugin[] = [],\n>(\n  config: ExecutorConfig<TPlugins>,\n): Promise<Executor<TPlugins>> => {\n  const plugins = (config?.plugins ?? []) as TPlugins;\n  const schema = collectSchemas(plugins);\n\n  const scopes =\n    config.scopes && config.scopes.length > 0\n      ? config.scopes.map(\n          (s, i) =>\n            new Scope({\n              id: ScopeId.make(s.id ?? (i === 0 ? \"default-scope\" : `scope-${i}`)),\n              name: s.name ?? (i === 0 ? \"default\" : `scope-${i}`),\n              createdAt: new Date(),\n            }),\n        )\n      : [\n          new Scope({\n            id: ScopeId.make(\"default-scope\"),\n            name: \"default\",\n            createdAt: new Date(),\n          }),\n        ];\n\n  const effectConfig = {\n    scopes,\n    adapter: makeMemoryAdapter({ schema }),\n    blobs: makeInMemoryBlobStore(),\n    plugins,\n    onElicitation: config.onElicitation,\n  };\n\n  // The SDK has no observability requirement; storage failures surface\n  // as raw `StorageError` / `UniqueViolationError` in the typed channel.\n  // `Effect.runPromise` turns them into Promise rejections — consumers\n  // get the tagged error as the rejected value. See\n  // notes/promise-sdk-typed-errors.md for the planned `runPromiseExit`\n  // rewrite that exposes the full error union to consumers.\n  const effectExecutor = await Effect.runPromise(\n    createEffectExecutor(effectConfig),\n  );\n\n  return promisifyDeep(effectExecutor) as Executor<TPlugins>;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,SAAgB,cAAc;AAE9B,SAAS,yBAAyB;AA+ElC,IAAM,gBAAgB,CAAC,MACrB,MAAM,QACN,OAAO,MAAM,YACb,CAAC,MAAM,QAAQ,CAAC,KAChB,EAAE,aAAa,SACf,EAAE,aAAa;AAEjB,IAAM,gBAAgB,CAAI,UAA6B;AACrD,MAAI,OAAO,UAAU,YAAY;AAC/B,YAAQ,IAAI,SAAoB;AAC9B,YAAM,SAAU,MAAuC;AAAA,QACrD;AAAA,QACA;AAAA,MACF;AACA,UAAI,OAAO,SAAS,MAAM,GAAG;AAC3B,eAAO,OAAO,WAAW,MAAyC;AAAA,MACpE;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAElC,SAAO,IAAI,MAAM,OAAO;AAAA,IACtB,IAAI,QAAQ,MAAM,UAAU;AAC1B,YAAM,IAAI,QAAQ,IAAI,QAAQ,MAAM,QAAQ;AAC5C,UAAI,OAAO,MAAM,YAAY;AAC3B,eAAO,IAAI,SAAoB;AAC7B,gBAAM,SAAU,EAAmC;AAAA,YACjD;AAAA,YACA;AAAA,UACF;AACA,cAAI,OAAO,SAAS,MAAM,GAAG;AAC3B,mBAAO,OAAO,WAAW,MAAyC;AAAA,UACpE;AACA,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,cAAc,CAAC,EAAG,QAAO,cAAc,CAAC;AAC5C,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAQO,IAAMA,kBAAiB,OAG5B,WACgC;AAChC,QAAM,UAAW,QAAQ,WAAW,CAAC;AACrC,QAAM,SAAS,eAAe,OAAO;AAErC,QAAM,SACJ,OAAO,UAAU,OAAO,OAAO,SAAS,IACpC,OAAO,OAAO;AAAA,IACZ,CAAC,GAAG,MACF,IAAI,MAAM;AAAA,MACR,IAAI,QAAQ,KAAK,EAAE,OAAO,MAAM,IAAI,kBAAkB,SAAS,CAAC,GAAG;AAAA,MACnE,MAAM,EAAE,SAAS,MAAM,IAAI,YAAY,SAAS,CAAC;AAAA,MACjD,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACL,IACA;AAAA,IACE,IAAI,MAAM;AAAA,MACR,IAAI,QAAQ,KAAK,eAAe;AAAA,MAChC,MAAM;AAAA,MACN,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAEN,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,SAAS,kBAAkB,EAAE,OAAO,CAAC;AAAA,IACrC,OAAO,sBAAsB;AAAA,IAC7B;AAAA,IACA,eAAe,OAAO;AAAA,EACxB;AAQA,QAAM,iBAAiB,MAAM,OAAO;AAAA,IAClC,eAAqB,YAAY;AAAA,EACnC;AAEA,SAAO,cAAc,cAAc;AACrC;","names":["createExecutor"]}
+{"version":3,"sources":["../src/promise-executor.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// @executor-js/sdk/promise — thin Promise façade over the Effect SDK.\n//\n// Consumer goal: use executors + plugins without touching Effect. The\n// façade wraps `createExecutor` so it returns a Promise, and proxies\n// every method on the returned executor to unwrap its Effect into a\n// Promise. Plugin factories are Effect-native but consumers never see\n// that — the proxy flattens plugin extension methods too.\n//\n// Not a goal: authoring plugins in Promise style. The plugin model\n// (storage, schema, staticSources, Effect ctx) is Effect-only. Bring\n// your own `@executor-js/plugin-*` from the Effect side.\n// ---------------------------------------------------------------------------\n\nimport { Brand, Effect } from \"effect\";\n\nimport { makeMemoryAdapter } from \"@executor-js/storage-core/testing/memory\";\n\nimport { makeInMemoryBlobStore } from \"./blob\";\nimport {\n  createExecutor as createEffectExecutor,\n  collectSchemas,\n  type Executor as EffectExecutor,\n  type OnElicitation,\n} from \"./executor\";\nimport { ScopeId } from \"./ids\";\nimport type { AnyPlugin } from \"./plugin\";\nimport { Scope } from \"./scope\";\n\n// ---------------------------------------------------------------------------\n// Types\n//\n// Promise consumers shouldn't need to construct Effect `Brand`s to call into\n// the executor — branded ids (`SecretId`, `ScopeId`, `ToolId`, `PolicyId`,\n// `ConnectionId`) are typed as `string & Brand<...>` on the Effect side, but\n// at runtime they're plain strings. `Unbrand` strips brand tags from\n// parameter types (recursively, so it walks into object fields like\n// `secrets.set({ id, scope })`) so consumers can pass plain strings. Return\n// types are passed through unchanged — caller code that reads `.id` etc.\n// off a returned ref still gets the branded type for use as an opaque token.\n// ---------------------------------------------------------------------------\n\ntype Unbrand<T> =\n  T extends Brand.Brand<string>\n    ? string\n    : T extends readonly (infer U)[]\n      ? readonly Unbrand<U>[]\n      : T extends ReadonlyMap<infer K, infer V>\n        ? ReadonlyMap<Unbrand<K>, Unbrand<V>>\n        : T extends ReadonlySet<infer U>\n          ? ReadonlySet<Unbrand<U>>\n          : T extends Date\n            ? T\n            : T extends (...args: infer A) => infer R\n              ? (...args: { [I in keyof A]: Unbrand<A[I]> }) => Unbrand<R>\n              : T extends object\n                ? { readonly [K in keyof T]: Unbrand<T[K]> }\n                : T;\n\nexport type Promisified<T> = T extends (...args: infer A) => Effect.Effect<infer R, infer _E>\n  ? (...args: { [I in keyof A]: Unbrand<A[I]> }) => Promise<R>\n  : T extends readonly unknown[]\n    ? T\n    : T extends object\n      ? { readonly [K in keyof T]: Promisified<T[K]> }\n      : T;\n\nexport type Executor<TPlugins extends readonly AnyPlugin[] = []> = Promisified<\n  EffectExecutor<TPlugins>\n>;\n\nexport interface ExecutorConfig<TPlugins extends readonly AnyPlugin[] = []> {\n  /**\n   * Precedence-ordered scope stack (innermost first). Optional — defaults\n   * to a single-element stack with id \"default-scope\". Pass an array of\n   * `{ id, name }` partials to build a multi-scope executor.\n   */\n  readonly scopes?: readonly { readonly id?: string; readonly name?: string }[];\n  readonly plugins?: TPlugins;\n  /**\n   * How to respond when a tool requests user input mid-invocation. Pass\n   * `\"accept-all\"` for tests / non-interactive hosts, or a handler\n   * `(ctx) => Promise<ElicitationResponse>` for interactive ones.\n   * Required at construction so per-invoke calls don't have to thread\n   * an options arg.\n   */\n  readonly onElicitation: OnElicitation;\n}\n\n// ---------------------------------------------------------------------------\n// Promisify proxy — walks nested objects, converts Effect-returning methods\n// into Promise-returning methods. Non-Effect return values pass through.\n// ---------------------------------------------------------------------------\n\nconst isPlainObject = (v: unknown): v is Record<string | symbol, unknown> =>\n  v !== null &&\n  typeof v === \"object\" &&\n  !Array.isArray(v) &&\n  !(v instanceof Date) &&\n  !(v instanceof Promise);\n\nconst promisifyDeep = <T>(value: T): Promisified<T> => {\n  if (typeof value === \"function\") {\n    return ((...args: unknown[]) => {\n      const result = (value as (...a: unknown[]) => unknown).apply(undefined, args);\n      if (Effect.isEffect(result)) {\n        return Effect.runPromise(result as Effect.Effect<unknown, unknown>);\n      }\n      return result;\n    }) as Promisified<T>;\n  }\n\n  if (!isPlainObject(value)) return value as Promisified<T>;\n\n  return new Proxy(value, {\n    get(target, prop, receiver) {\n      const v = Reflect.get(target, prop, receiver);\n      if (typeof v === \"function\") {\n        return (...args: unknown[]) => {\n          const result = (v as (...a: unknown[]) => unknown).apply(target, args);\n          if (Effect.isEffect(result)) {\n            return Effect.runPromise(result as Effect.Effect<unknown, unknown>);\n          }\n          return result;\n        };\n      }\n      if (isPlainObject(v)) return promisifyDeep(v);\n      return v;\n    },\n  }) as Promisified<T>;\n};\n\n// ---------------------------------------------------------------------------\n// createExecutor — Promise wrapper over the Effect createExecutor.\n// Defaults to an in-memory adapter + blob store, so a consumer can\n// construct an executor with just `{ plugins: [...] }`.\n// ---------------------------------------------------------------------------\n\nexport const createExecutor = async <const TPlugins extends readonly AnyPlugin[] = []>(\n  config: ExecutorConfig<TPlugins>,\n): Promise<Executor<TPlugins>> => {\n  const plugins = (config?.plugins ?? []) as TPlugins;\n  const schema = collectSchemas(plugins);\n\n  const scopes =\n    config.scopes && config.scopes.length > 0\n      ? config.scopes.map(\n          (s, i) =>\n            new Scope({\n              id: ScopeId.make(s.id ?? (i === 0 ? \"default-scope\" : `scope-${i}`)),\n              name: s.name ?? (i === 0 ? \"default\" : `scope-${i}`),\n              createdAt: new Date(),\n            }),\n        )\n      : [\n          new Scope({\n            id: ScopeId.make(\"default-scope\"),\n            name: \"default\",\n            createdAt: new Date(),\n          }),\n        ];\n\n  const effectConfig = {\n    scopes,\n    adapter: makeMemoryAdapter({ schema }),\n    blobs: makeInMemoryBlobStore(),\n    plugins,\n    onElicitation: config.onElicitation,\n  };\n\n  // The SDK has no observability requirement; storage failures surface\n  // as raw `StorageError` / `UniqueViolationError` in the typed channel.\n  // `Effect.runPromise` turns them into Promise rejections — consumers\n  // get the tagged error as the rejected value. See\n  // notes/promise-sdk-typed-errors.md for the planned `runPromiseExit`\n  // rewrite that exposes the full error union to consumers.\n  const effectExecutor = await Effect.runPromise(createEffectExecutor(effectConfig));\n\n  return promisifyDeep(effectExecutor) as Executor<TPlugins>;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,SAAgB,cAAc;AAE9B,SAAS,yBAAyB;AA8ElC,IAAM,gBAAgB,CAAC,MACrB,MAAM,QACN,OAAO,MAAM,YACb,CAAC,MAAM,QAAQ,CAAC,KAChB,EAAE,aAAa,SACf,EAAE,aAAa;AAEjB,IAAM,gBAAgB,CAAI,UAA6B;AACrD,MAAI,OAAO,UAAU,YAAY;AAC/B,YAAQ,IAAI,SAAoB;AAC9B,YAAM,SAAU,MAAuC,MAAM,QAAW,IAAI;AAC5E,UAAI,OAAO,SAAS,MAAM,GAAG;AAC3B,eAAO,OAAO,WAAW,MAAyC;AAAA,MACpE;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAElC,SAAO,IAAI,MAAM,OAAO;AAAA,IACtB,IAAI,QAAQ,MAAM,UAAU;AAC1B,YAAM,IAAI,QAAQ,IAAI,QAAQ,MAAM,QAAQ;AAC5C,UAAI,OAAO,MAAM,YAAY;AAC3B,eAAO,IAAI,SAAoB;AAC7B,gBAAM,SAAU,EAAmC,MAAM,QAAQ,IAAI;AACrE,cAAI,OAAO,SAAS,MAAM,GAAG;AAC3B,mBAAO,OAAO,WAAW,MAAyC;AAAA,UACpE;AACA,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,cAAc,CAAC,EAAG,QAAO,cAAc,CAAC;AAC5C,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAQO,IAAMA,kBAAiB,OAC5B,WACgC;AAChC,QAAM,UAAW,QAAQ,WAAW,CAAC;AACrC,QAAM,SAAS,eAAe,OAAO;AAErC,QAAM,SACJ,OAAO,UAAU,OAAO,OAAO,SAAS,IACpC,OAAO,OAAO;AAAA,IACZ,CAAC,GAAG,MACF,IAAI,MAAM;AAAA,MACR,IAAI,QAAQ,KAAK,EAAE,OAAO,MAAM,IAAI,kBAAkB,SAAS,CAAC,GAAG;AAAA,MACnE,MAAM,EAAE,SAAS,MAAM,IAAI,YAAY,SAAS,CAAC;AAAA,MACjD,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACL,IACA;AAAA,IACE,IAAI,MAAM;AAAA,MACR,IAAI,QAAQ,KAAK,eAAe;AAAA,MAChC,MAAM;AAAA,MACN,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAEN,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,SAAS,kBAAkB,EAAE,OAAO,CAAC;AAAA,IACrC,OAAO,sBAAsB;AAAA,IAC7B;AAAA,IACA,eAAe,OAAO;AAAA,EACxB;AAQA,QAAM,iBAAiB,MAAM,OAAO,WAAW,eAAqB,YAAY,CAAC;AAEjF,SAAO,cAAc,cAAc;AACrC;","names":["createExecutor"]}

package/dist/oauth-discovery.d.ts

@@ -1,5 +1,6 @@
-import { Effect, Schema } from "effect";
-import { createPkceCodeChallenge } from "./oauth-helpers";
+import { Effect, Layer, Schema } from "effect";
+import { HttpClient } from "effect/unstable/http";
+import { createPkceCodeChallenge, type OAuthEndpointUrlPolicy } from "./oauth-helpers";
 declare const OAuthDiscoveryError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "OAuthDiscoveryError";
 } & Readonly<A>;
@@ -11,6 +12,12 @@ declare const OAuthDiscoveryError_base: new <A extends Record<string, any> = {}>
 export declare class OAuthDiscoveryError extends OAuthDiscoveryError_base<{
     readonly message: string;
     readonly status?: number;
+    /** RFC 6749 §5.2 / RFC 7591 §3.2.2 error code, when the AS returned
+     *  one (`invalid_client_metadata`, `invalid_redirect_uri`, ...). Lets
+     *  the HTTP edge surface a structured error to the UI rather than
+     *  swallow the AS's response into a generic message string. */
+    readonly error?: string;
+    readonly errorDescription?: string;
     readonly cause?: unknown;
 }> {
 }
@@ -70,8 +77,8 @@ export declare const OAuthClientInformationSchema: Schema.Struct<{
 }>;
 export type OAuthClientInformation = typeof OAuthClientInformationSchema.Type;
 export interface DiscoveryRequestOptions {
-    /** Injected for tests. Defaults to the global `fetch`. */
-    readonly fetch?: typeof fetch;
+    /** Injected for tests. Defaults to the platform fetch-backed HttpClient. */
+    readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
     /** Abort the request after this many ms. Default 20000. */
     readonly timeoutMs?: number;
     /** Send `MCP-Protocol-Version: <value>` on every request. Harmless
@@ -82,6 +89,7 @@ export interface DiscoveryRequestOptions {
      *  authorization-server metadata, DCR, authorization, or token calls. */
     readonly resourceHeaders?: Readonly<Record<string, string>>;
     readonly resourceQueryParams?: Readonly<Record<string, string>>;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 }
 export declare const discoverProtectedResourceMetadata: (resourceUrl: string, options?: DiscoveryRequestOptions) => Effect.Effect<{
     readonly metadataUrl: string;
@@ -97,6 +105,7 @@ export interface RegisterDynamicClientInput {
     readonly initialAccessToken?: string | null;
 }
 export declare const registerDynamicClient: (input: RegisterDynamicClientInput, options?: DiscoveryRequestOptions) => Effect.Effect<OAuthClientInformation, OAuthDiscoveryError>;
+export declare const canonicalResourceUrl: (value: string) => string;
 export interface DynamicAuthorizationState {
     readonly resourceMetadata: OAuthProtectedResourceMetadata | null;
     readonly resourceMetadataUrl: string | null;
@@ -104,6 +113,12 @@ export interface DynamicAuthorizationState {
     readonly authorizationServerMetadataUrl: string;
     readonly authorizationServerMetadata: OAuthAuthorizationServerMetadata;
     readonly clientInformation: OAuthClientInformation;
+    /** RFC 8707 canonical resource URL passed on /authorize and persisted
+     *  for the matching /token + refresh calls. */
+    readonly resource: string;
+    /** Scopes ultimately requested at /authorize. Persisted so refresh
+     *  can replay the same set. */
+    readonly scopes: readonly string[];
 }
 export interface DynamicAuthorizationStartResult {
     readonly authorizationUrl: string;

package/dist/oauth-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-discovery.d.ts","sourceRoot":"","sources":["../src/oauth-discovery.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAQ,MAAM,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGtD,OAAO,EAGL,uBAAuB,EAExB,MAAM,iBAAiB,CAAC;;;;AAMzB;;;;wDAIwD;AACxD,qBAAa,mBAAoB,SAAQ,yBAEvC;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAmBL,eAAO,MAAM,oCAAoC;;;;;;EAMY,CAAC;AAC9D,MAAM,MAAM,8BAA8B,GACxC,OAAO,oCAAoC,CAAC,IAAI,CAAC;AAEnD,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;EAcY,CAAC;AAChE,MAAM,MAAM,gCAAgC,GAC1C,OAAO,sCAAsC,CAAC,IAAI,CAAC;AAErD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,0BAA0B,CAAC,EAChC,MAAM,GACN,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD,CAAC;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;EAaY,CAAC;AACtD,MAAM,MAAM,sBAAsB,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAC;AAY9E,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;uEACmE;IACnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;6EAEyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AA6ED,eAAO,MAAM,iCAAiC,GAC5C,aAAa,MAAM,EACnB,UAAS,uBAA4B,KACpC,MAAM,CAAC,MAAM,CACZ;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,8BAA8B,CAAA;CAAE,GACnF,IAAI,EACN,mBAAmB,CA0DjB,CAAC;AAyBL,eAAO,MAAM,mCAAmC,GAC9C,QAAQ,MAAM,EACd,UAAS,uBAA4B,KACpC,MAAM,CAAC,MAAM,CACZ;IACE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;CACrD,GACD,IAAI,EACN,mBAAmB,CAuDjB,CAAC;AAYL,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAkED,eAAO,MAAM,qBAAqB,GAChC,OAAO,0BAA0B,EACjC,UAAS,uBAA4B,KACpC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,CA8FzD,CAAC;AAMJ,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,EAAE,8BAA8B,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;IAChD,QAAQ,CAAC,2BAA2B,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;CACpD;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;CAC3C;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;kCAC8B;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACzD;0BACsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;4DAEwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,gCAAgC,GAAG,IAAI,CAAC;QAC/E,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,GAAG,IAAI,CAAC;QAClE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KAC5D,CAAC;CACH;AAED,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,EACrC,UAAS,uBAA4B,KACpC,MAAM,CAAC,MAAM,CAAC,+BAA+B,EAAE,mBAAmB,CAwHjE,CAAC;AAEL,OAAO,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"oauth-discovery.d.ts","sourceRoot":"","sources":["../src/oauth-discovery.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAkB,MAAM,EAAE,KAAK,EAA6B,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1F,OAAO,EAAmB,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AAEtF,OAAO,EAIL,uBAAuB,EAEvB,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;;;;AAMzB;;;;wDAIwD;AACxD,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;mEAG+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AASL,eAAO,MAAM,oCAAoC;;;;;;EAMY,CAAC;AAC9D,MAAM,MAAM,8BAA8B,GAAG,OAAO,oCAAoC,CAAC,IAAI,CAAC;AAE9F,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;EAcY,CAAC;AAChE,MAAM,MAAM,gCAAgC,GAAG,OAAO,sCAAsC,CAAC,IAAI,CAAC;AAElG,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,0BAA0B,CAAC,EAChC,MAAM,GACN,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD,CAAC;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;EAaY,CAAC;AACtD,MAAM,MAAM,sBAAsB,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAC;AAU9E,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC9D,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;uEACmE;IACnE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;6EAEyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD;AAgHD,eAAO,MAAM,iCAAiC,GAC5C,aAAa,MAAM,EACnB,UAAS,uBAA4B,KACpC,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,8BAA8B,CAAA;CAAE,GAAG,IAAI,EAC1F,mBAAmB,CA2CjB,CAAC;AAuBL,eAAO,MAAM,mCAAmC,GAC9C,QAAQ,MAAM,EACd,UAAS,uBAA4B,KACpC,MAAM,CAAC,MAAM,CACd;IACE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;CACrD,GAAG,IAAI,EACR,mBAAmB,CA+DjB,CAAC;AAYL,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AA4ED,eAAO,MAAM,qBAAqB,GAChC,OAAO,0BAA0B,EACjC,UAAS,uBAA4B,KACpC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,CAmFzD,CAAC;AAWJ,eAAO,MAAM,oBAAoB,GAAI,OAAO,MAAM,KAAG,MAMpD,CAAC;AAmDF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,EAAE,8BAA8B,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;IAChD,QAAQ,CAAC,2BAA2B,EAAE,gCAAgC,CAAC;IACvE,QAAQ,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;IACnD;mDAC+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;mCAC+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;CAC3C;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;kCAC8B;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACzD;0BACsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;4DAEwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,gCAAgC,GAAG,IAAI,CAAC;QAC/E,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,GAAG,IAAI,CAAC;QAClE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KAC5D,CAAC;CACH;AAED,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,EACrC,UAAS,uBAA4B,KACpC,MAAM,CAAC,MAAM,CAAC,+BAA+B,EAAE,mBAAmB,CAqKjE,CAAC;AAEL,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/oauth-helpers.d.ts

@@ -25,6 +25,11 @@ export type OAuth2TokenResponse = {
 export declare const OAUTH2_REFRESH_SKEW_MS = 60000;
 /** Default token-endpoint timeout. */
 export declare const OAUTH2_DEFAULT_TIMEOUT_MS = 20000;
+export interface OAuthEndpointUrlPolicy {
+    readonly allowHttp?: boolean;
+}
+export declare const isSupportedOAuthEndpointUrl: (value: string, policy?: OAuthEndpointUrlPolicy) => boolean;
+export declare const assertSupportedOAuthEndpointUrl: (value: string, label?: string, policy?: OAuthEndpointUrlPolicy) => string;
 export declare const createPkceCodeVerifier: () => string;
 export declare const createPkceCodeChallenge: (verifier: string) => Promise<string>;
 export type BuildAuthorizationUrlInput = {
@@ -37,8 +42,13 @@ export type BuildAuthorizationUrlInput = {
     readonly codeChallenge: string;
     /** Separator between scopes. RFC 6749 says space; some providers use comma. */
     readonly scopeSeparator?: string;
+    /** RFC 8707 Resource Indicator. MCP Authorization 2025-06-18 §"Resource
+     *  Parameter Implementation" requires clients to send this on every
+     *  authorization request, regardless of AS support. */
+    readonly resource?: string;
     /** Provider-specific extras (e.g. Google's `access_type=offline`). */
     readonly extraParams?: Readonly<Record<string, string>>;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 };
 /** Build an RFC 6749 §4.1.1 authorization URL. Sync; pre-computed
  *  challenge lets this stay out of the Promise world. */
@@ -54,7 +64,12 @@ export type ExchangeAuthorizationCodeInput = {
     readonly code: string;
     readonly clientAuth?: ClientAuthMethod;
     readonly idTokenSigningAlgValuesSupported?: readonly string[];
+    /** RFC 8707 Resource Indicator. MCP Auth spec MUST-requires this on
+     *  the token request when the client knows the resource it intends
+     *  to call. */
+    readonly resource?: string;
     readonly timeoutMs?: number;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 };
 export declare const exchangeAuthorizationCode: (input: ExchangeAuthorizationCodeInput) => Effect.Effect<OAuth2TokenResponse, OAuth2Error>;
 export type ExchangeClientCredentialsInput = {
@@ -65,6 +80,7 @@ export type ExchangeClientCredentialsInput = {
     readonly scopeSeparator?: string;
     readonly clientAuth?: ClientAuthMethod;
     readonly timeoutMs?: number;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 };
 export declare const exchangeClientCredentials: (input: ExchangeClientCredentialsInput) => Effect.Effect<OAuth2TokenResponse, OAuth2Error>;
 export type RefreshAccessTokenInput = {
@@ -77,7 +93,12 @@ export type RefreshAccessTokenInput = {
     readonly scopeSeparator?: string;
     readonly clientAuth?: ClientAuthMethod;
     readonly idTokenSigningAlgValuesSupported?: readonly string[];
+    /** RFC 8707 Resource Indicator — MCP spec MUST-requires this on
+     *  refresh requests so the new access token's audience is bound to
+     *  the same resource. */
+    readonly resource?: string;
     readonly timeoutMs?: number;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 };
 export declare const refreshAccessToken: (input: RefreshAccessTokenInput) => Effect.Effect<OAuth2TokenResponse, OAuth2Error>;
 export declare const shouldRefreshToken: (input: {

package/dist/oauth-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-helpers.d.ts","sourceRoot":"","sources":["../src/oauth-helpers.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;AAOtC,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAML,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAMF,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,sCAAsC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAMhD,eAAO,MAAM,sBAAsB,QAAO,MACN,CAAC;AAErC,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAC7B,CAAC;AAM7C,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,CAAC;AAEF;yDACyD;AACzD,eAAO,MAAM,qBAAqB,GAAI,OAAO,0BAA0B,KAAG,MAgBzE,CAAC;AAwCF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC;AA2IhD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,KACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAiC7C,CAAC;AAML,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,KACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CA4B7C,CAAC;AAML,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,OAAO,uBAAuB,KAC7B,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CA0C7C,CAAC;AAML,eAAO,MAAM,kBAAkB,GAAI,OAAO;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,KAAG,OAKH,CAAC"}
+{"version":3,"file":"oauth-helpers.d.ts","sourceRoot":"","sources":["../src/oauth-helpers.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAQ,MAAM,EAAa,MAAM,QAAQ,CAAC;;;;AAOjD,qBAAa,WAAY,SAAQ,iBAAgC;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AAML,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAMF,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,sCAAsC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAgBD,eAAO,MAAM,2BAA2B,GACtC,OAAO,MAAM,EACb,SAAQ,sBAA2B,KAClC,OAQF,CAAC;AAEF,eAAO,MAAM,+BAA+B,GAC1C,OAAO,MAAM,EACb,cAA4B,EAC5B,SAAQ,sBAA2B,KAClC,MAIF,CAAC;AAMF,eAAO,MAAM,sBAAsB,QAAO,MAA4C,CAAC;AAEvF,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAC7B,CAAC;AAM7C,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;2DAEuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD,CAAC;AAEF;yDACyD;AACzD,eAAO,MAAM,qBAAqB,GAAI,OAAO,0BAA0B,KAAG,MA2BzE,CAAC;AA6GF,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC;AA0GhD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D;;mBAEe;IACf,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,KACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAiCC,CAAC;AAMnD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,OAAO,8BAA8B,KACpC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAqBC,CAAC;AAMnD,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9D;;6BAEyB;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,OAAO,uBAAuB,KAC7B,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAoCC,CAAC;AAMnD,eAAO,MAAM,kBAAkB,GAAI,OAAO;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,KAAG,OAKH,CAAC"}

package/dist/oauth-popup-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-popup-types.d.ts","sourceRoot":"","sources":["../src/oauth-popup-types.ts"],"names":[],"mappings":"AAQA,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,EAAG,uBAAgC,CAAC;AAEzE,MAAM,MAAM,gBAAgB,CAAC,KAAK,IAC9B,CAAC;IACC,QAAQ,CAAC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GAAG,KAAK,CAAC,GACV;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,eAAO,MAAM,kBAAkB,GAAI,KAAK,EACtC,OAAO,OAAO,KACb,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAG+B,CAAC"}
+{"version":3,"file":"oauth-popup-types.d.ts","sourceRoot":"","sources":["../src/oauth-popup-types.ts"],"names":[],"mappings":"AAQA,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,EAAG,uBAAgC,CAAC;AAEzE,MAAM,MAAM,gBAAgB,CAAC,KAAK,IAC9B,CAAC;IACC,QAAQ,CAAC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GAAG,KAAK,CAAC,GACV;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,eAAO,MAAM,kBAAkB,GAAI,KAAK,EAAE,OAAO,OAAO,KAAG,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAGzB,CAAC"}

package/dist/oauth-service.d.ts

@@ -1,21 +1,29 @@
-import { Effect } from "effect";
-import type { DBAdapter, StorageFailure, TypedAdapter } from "@executor-js/storage-core";
+import { Effect, Layer } from "effect";
+import { HttpClient } from "effect/unstable/http";
+import type { StorageFailure, TypedAdapter } from "@executor-js/storage-core";
 import { CreateConnectionInput, type ConnectionProvider, type ConnectionRef } from "./connections";
 import type { ConnectionProviderNotRegisteredError } from "./errors";
 import type { CoreSchema } from "./core-schema";
 import { SetSecretInput, type SecretRef } from "./secrets";
 import { type OAuthService } from "./oauth";
+import { type OAuthEndpointUrlPolicy } from "./oauth-helpers";
+import type { ScopedDBAdapter } from "./scoped-adapter";
 export interface OAuthServiceDeps {
     /** Typed core-schema adapter. Already scope-wrapped upstream so reads
      *  fall through the scope stack; writes stamp the scope the caller
      *  named (`tokenScope` on start input). */
     readonly adapter: TypedAdapter<CoreSchema>;
-    /** Raw adapter for opening transactions — the typed one doesn't expose
-     *  `.transaction` directly. */
-    readonly rawAdapter: DBAdapter;
+    /** Scoped adapter for opening transactions — the typed one doesn't
+     *  expose `.transaction` directly. */
+    readonly rawAdapter: ScopedDBAdapter;
     /** Resolves client-id / client-secret refs at start + refresh time.
      *  A `null` return means "secret row is gone" and aborts the flow. */
     readonly secretsGet: (id: string) => Effect.Effect<string | null, StorageFailure>;
+    readonly secretsGetResolved?: (id: string) => Effect.Effect<{
+        readonly value: string;
+        readonly scopeId: string | null;
+    } | null, StorageFailure>;
+    readonly secretsGetAtScope?: (id: string, scope: string) => Effect.Effect<string | null, StorageFailure>;
     readonly secretsSet: (input: SetSecretInput) => Effect.Effect<SecretRef, StorageFailure>;
     /** Mints the Connection row + backing secret rows. Called from
      *  `complete` (and from `start` for `client-credentials`). */
@@ -25,6 +33,9 @@ export interface OAuthServiceDeps {
     readonly newSessionId?: () => string;
     /** `Date.now()` substitute — tests override to drive TTL behavior. */
     readonly now?: () => number;
+    /** Outbound HTTP client used for OAuth metadata/DCR probes. */
+    readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
+    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
 }
 export declare const makeOAuth2Service: (deps: OAuthServiceDeps) => {
     readonly service: OAuthService;

package/dist/oauth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-service.d.ts","sourceRoot":"","sources":["../src/oauth-service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACV,SAAS,EACT,cAAc,EACd,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEL,qBAAqB,EAErB,KAAK,kBAAkB,EAGvB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,oCAAoC,EACrC,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAgBL,KAAK,YAAY,EAGlB,MAAM,SAAS,CAAC;AAmMjB,MAAM,WAAW,gBAAgB;IAC/B;;+CAE2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAC3C;mCAC+B;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;0EACsE;IACtE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzF;kEAC8D;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,oCAAoC,GAAG,cAAc,CACtD,CAAC;IACF;yBACqB;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAyCD,eAAO,MAAM,iBAAiB,GAC5B,MAAM,gBAAgB,KACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;CAq7BnF,CAAC"}
+{"version":3,"file":"oauth-service.d.ts","sourceRoot":"","sources":["../src/oauth-service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAY,MAAM,EAAE,KAAK,EAAyB,MAAM,QAAQ,CAAC;AACxE,OAAO,EAAmB,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AAEtF,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAEL,qBAAqB,EAErB,KAAK,kBAAkB,EAGvB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAgBL,KAAK,YAAY,EAGlB,MAAM,SAAS,CAAC;AAMjB,OAAO,EAOL,KAAK,sBAAsB,EAE5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAgFxD,MAAM,WAAW,gBAAgB;IAC/B;;+CAE2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAC3C;0CACsC;IACtC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC;0EACsE;IACtE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;IAClF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAC5B,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAChB;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,EAClE,cAAc,CACf,CAAC;IACF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzF;kEAC8D;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,oCAAoC,GAAG,cAAc,CAAC,CAAC;IACzF;yBACqB;IACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;CACrD;AAqCD,eAAO,MAAM,iBAAiB,GAC5B,MAAM,gBAAgB,KACrB;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;CAs8BnF,CAAC"}

package/dist/oauth.d.ts

@@ -115,25 +115,34 @@ export declare const OAuthProviderState: Schema.Union<readonly [Schema.Struct<{
      *  issued one) is a separate secret row. */
     readonly clientId: Schema.String;
     readonly clientSecretSecretId: Schema.NullOr<Schema.String>;
+    readonly clientSecretSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientAuth: Schema.Literals<readonly ["body", "basic"]>;
     readonly scopes: Schema.withDecodingDefaultType<Schema.$Array<Schema.String>>;
     readonly scopeSeparator: Schema.optional<Schema.String>;
     readonly scope: Schema.NullOr<Schema.String>;
+    /** RFC 8707 canonical resource URL. Replayed on refresh so the new
+     *  access token's audience stays bound to the same resource. */
+    readonly resource: Schema.optional<Schema.NullOr<Schema.String>>;
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"authorization-code">;
     readonly tokenEndpoint: Schema.String;
     readonly issuerUrl: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientIdSecretId: Schema.String;
+    readonly clientIdSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientSecretSecretId: Schema.NullOr<Schema.String>;
+    readonly clientSecretSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientAuth: Schema.Literals<readonly ["body", "basic"]>;
     readonly scopes: Schema.withDecodingDefaultType<Schema.$Array<Schema.String>>;
     readonly scopeSeparator: Schema.optional<Schema.String>;
     readonly scope: Schema.NullOr<Schema.String>;
+    readonly resource: Schema.optional<Schema.NullOr<Schema.String>>;
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"client-credentials">;
     readonly tokenEndpoint: Schema.String;
     readonly clientIdSecretId: Schema.String;
+    readonly clientIdSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly clientSecretSecretId: Schema.String;
+    readonly clientSecretSecretScopeId: Schema.optional<Schema.NullOr<Schema.String>>;
     readonly scopes: Schema.$Array<Schema.String>;
     readonly scopeSeparator: Schema.optional<Schema.String>;
     readonly clientAuth: Schema.Literals<readonly ["body", "basic"]>;
@@ -142,9 +151,7 @@ export declare const OAuthProviderState: Schema.Union<readonly [Schema.Struct<{
 export type OAuthProviderState = typeof OAuthProviderState.Type;
 /** The canonical refresh handler key. Every OAuth2-minted connection
  *  registers under this single value; the handler switches on
- *  `providerState.kind`. Historical per-plugin keys (`mcp:oauth2`,
- *  `openapi:oauth2`, `google-discovery:google`) are aliased to this
- *  during migration. */
+ *  `providerState.kind`. */
 export declare const OAUTH2_PROVIDER_KEY: "oauth2";
 export interface OAuthProbeInput {
     readonly endpoint: string;
@@ -216,6 +223,9 @@ export interface OAuthStartResult {
 export interface OAuthCompleteInput {
     /** RFC 6749 `state` parameter — maps to a session row id. */
     readonly state: string;
+    /** Optional scope check for route-scoped completions. Browser callback
+     *  completions omit this because the callback URL has no scope path. */
+    readonly tokenScope?: string;
     readonly code?: string;
     /** RFC 6749 `error` parameter — set when the AS redirected back with
      *  a failure. The service surfaces this as a tagged error. */
@@ -230,17 +240,16 @@ declare const OAuthProbeError_base: Schema.Class<OAuthProbeError, Schema.TaggedS
     readonly message: Schema.String;
 }>, import("effect/Cause").YieldableError>;
 export declare class OAuthProbeError extends OAuthProbeError_base {
-    static annotations: {
-        httpApiStatus: number;
-    };
 }
 declare const OAuthStartError_base: Schema.Class<OAuthStartError, Schema.TaggedStruct<"OAuthStartError", {
     readonly message: Schema.String;
+    /** RFC 6749 §5.2 / RFC 7591 §3.2.2 error code propagated up from the
+     *  authorization server (e.g. `invalid_client_metadata`). UI surfaces
+     *  it as the structured "AS rejected the registration" reason. */
+    readonly error: Schema.optional<Schema.String>;
+    readonly errorDescription: Schema.optional<Schema.String>;
 }>, import("effect/Cause").YieldableError>;
 export declare class OAuthStartError extends OAuthStartError_base {
-    static annotations: {
-        httpApiStatus: number;
-    };
 }
 declare const OAuthCompleteError_base: Schema.Class<OAuthCompleteError, Schema.TaggedStruct<"OAuthCompleteError", {
     readonly message: Schema.String;
@@ -250,17 +259,11 @@ declare const OAuthCompleteError_base: Schema.Class<OAuthCompleteError, Schema.T
     readonly code: Schema.optional<Schema.String>;
 }>, import("effect/Cause").YieldableError>;
 export declare class OAuthCompleteError extends OAuthCompleteError_base {
-    static annotations: {
-        httpApiStatus: number;
-    };
 }
 declare const OAuthSessionNotFoundError_base: Schema.Class<OAuthSessionNotFoundError, Schema.TaggedStruct<"OAuthSessionNotFoundError", {
     readonly sessionId: Schema.String;
 }>, import("effect/Cause").YieldableError>;
 export declare class OAuthSessionNotFoundError extends OAuthSessionNotFoundError_base {
-    static annotations: {
-        httpApiStatus: number;
-    };
 }
 export interface OAuthService {
     readonly probe: (input: OAuthProbeInput) => Effect.Effect<OAuthProbeResult, OAuthProbeError>;
@@ -268,7 +271,7 @@ export interface OAuthService {
     readonly complete: (input: OAuthCompleteInput) => Effect.Effect<OAuthCompleteResult, OAuthCompleteError | OAuthSessionNotFoundError | StorageFailure>;
     /** Drop an in-flight session without completing — used when the
      *  user cancels the popup or the source is deleted mid-onboarding. */
-    readonly cancel: (sessionId: string, tokenScope?: string) => Effect.Effect<void, StorageFailure>;
+    readonly cancel: (sessionId: string, tokenScope: string) => Effect.Effect<void, StorageFailure>;
 }
 export declare const OAUTH2_SESSION_TTL_MS: number;
 export { ConnectionId };

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAWrC;;;yDAGyD;AACzD,eAAO,MAAM,uBAAuB;;IAElC;mDAC+C;;EAE/C,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAC;AAE1E;;;2EAG2E;AAC3E,eAAO,MAAM,8BAA8B;;;;IAIzC;;wEAEoE;;IAEpE;;4DAEwD;;IAExD;8CAC0C;;;IAG1C;sCACkC;;IAElC;mEAC+D;;IAI/D;oEACgE;;EAEhE,CAAC;AACH,MAAM,MAAM,8BAA8B,GACxC,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAE7C;;;sCAGsC;AACtC,eAAO,MAAM,8BAA8B;;;;;;;;EAQzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GACxC,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAE7C;;cAEc;AACd,eAAO,MAAM,aAAa;;IA5DxB;mDAC+C;;;;;;IAa/C;;wEAEoE;;IAEpE;;4DAEwD;;IAExD;8CAC0C;;;IAG1C;sCACkC;;IAElC;mEAC+D;;IAI/D;oEACgE;;;;;;;;;;IA6BhE,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAQtD;;+BAE+B;AAC/B,eAAO,MAAM,kBAAkB;;;;;;;IAU3B;;gDAE4C;;;;;;;;;;;;;;;;;;;;;;;;;;IA6B9C,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC;AAEhE;;;;wBAIwB;AACxB,eAAO,MAAM,mBAAmB,EAAG,QAAiB,CAAC;AAMrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;wEACoE;IACpE,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrE,QAAQ,CAAC,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C;;;;;8BAK0B;IAC1B,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAC;IAC9C;;;;qBAIiB;IACjB,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;CAC7C;AAMD,MAAM,WAAW,eAAe;IAC9B;;+CAE2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C;;;6CAGyC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;uDACmD;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;kDAE8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;oEACgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;0BAEsB;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;gEAE4D;IAC5D,QAAQ,CAAC,mBAAmB,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACxE;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;kEAC8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;;;;AAWD,qBAAa,eAAgB,SAAQ,oBAKpC;IACC,MAAM,CAAC,WAAW;;MAA0B;CAC7C;;;;AAED,qBAAa,eAAgB,SAAQ,oBAKpC;IACC,MAAM,CAAC,WAAW;;MAA0B;CAC7C;;;IAMG;;iDAE6C;;;AANjD,qBAAa,kBAAmB,SAAQ,uBASvC;IACC,MAAM,CAAC,WAAW;;MAA0B;CAC7C;;;;AAED,qBAAa,yBAA0B,SAAQ,8BAK9C;IACC,MAAM,CAAC,WAAW;;MAA0B;CAC7C;AAOD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,eAAe,KACnB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,eAAe,KACnB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,GAAG,cAAc,CAAC,CAAC;IACvE,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,kBAAkB,KACtB,MAAM,CAAC,MAAM,CAChB,mBAAmB,EACnB,kBAAkB,GAAG,yBAAyB,GAAG,cAAc,CAChE,CAAC;IACF;0EACsE;IACtE,QAAQ,CAAC,MAAM,EAAE,CACf,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;CAC1C;AAOD,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AAIpD,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAWrC;;;yDAGyD;AACzD,eAAO,MAAM,uBAAuB;;IAElC;mDAC+C;;EAE/C,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAC;AAE1E;;;2EAG2E;AAC3E,eAAO,MAAM,8BAA8B;;;;IAIzC;;wEAEoE;;IAEpE;;4DAEwD;;IAExD;8CAC0C;;;IAG1C;sCACkC;;IAElC;mEAC+D;;IAE/D;oEACgE;;EAEhE,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAExF;;;sCAGsC;AACtC,eAAO,MAAM,8BAA8B;;;;;;;;EAQzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAExF;;cAEc;AACd,eAAO,MAAM,aAAa;;IAxDxB;mDAC+C;;;;;;IAa/C;;wEAEoE;;IAEpE;;4DAEwD;;IAExD;8CAC0C;;;IAG1C;sCACkC;;IAElC;mEAC+D;;IAE/D;oEACgE;;;;;;;;;;IA2BhE,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAQtD;;+BAE+B;AAC/B,eAAO,MAAM,kBAAkB;;;;;;;IAQ3B;;gDAE4C;;;;;;;;IAQ5C;oEACgE;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BlE,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC;AAEhE;;4BAE4B;AAC5B,eAAO,MAAM,mBAAmB,EAAG,QAAiB,CAAC;AAMrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;wEACoE;IACpE,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrE,QAAQ,CAAC,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C;;;;;8BAK0B;IAC1B,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAC;IAC9C;;;;qBAIiB;IACjB,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;CAC7C;AAMD,MAAM,WAAW,eAAe;IAC9B;;+CAE2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C;;;6CAGyC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;uDACmD;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;kDAE8C;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC;oEACgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;0BAEsB;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;gEAE4D;IAC5D,QAAQ,CAAC,mBAAmB,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACxE;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;4EACwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;kEAC8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;;;;AAWD,qBAAa,eAAgB,SAAQ,oBAMpC;CAAG;;;IAMA;;sEAEkE;;;;AANtE,qBAAa,eAAgB,SAAQ,oBAWpC;CAAG;;;IAMA;;iDAE6C;;;AANjD,qBAAa,kBAAmB,SAAQ,uBAUvC;CAAG;;;;AAEJ,qBAAa,yBAA0B,SAAQ,8BAM9C;CAAG;AAOJ,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAC7F,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,eAAe,KACnB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,GAAG,cAAc,CAAC,CAAC;IACvE,QAAQ,CAAC,QAAQ,EAAE,CACjB,KAAK,EAAE,kBAAkB,KACtB,MAAM,CAAC,MAAM,CAChB,mBAAmB,EACnB,kBAAkB,GAAG,yBAAyB,GAAG,cAAc,CAChE,CAAC;IACF;0EACsE;IACtE,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;CACjG;AAOD,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AAIpD,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/oxlint-plugin-executor.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oxlint-plugin-executor.test.d.ts.map

package/dist/oxlint-plugin-executor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxlint-plugin-executor.test.d.ts","sourceRoot":"","sources":["../src/oxlint-plugin-executor.test.ts"],"names":[],"mappings":""}