@executor-js/sdk 1.5.15 → 1.5.17

package/dist/{chunk-EIHWBY6T.js → chunk-4XPVLX62.js}

@@ -62,6 +62,40 @@ var providerAuthorizeExtras = (authorizationUrl) => {
   }
   return {};
 };
+var hostnameFromCallbackDomain = (callbackDomain) => {
+  const trimmed = callbackDomain.trim();
+  if (trimmed.length === 0) return void 0;
+  const candidate = trimmed.includes("://") ? trimmed : `https://${trimmed}`;
+  if (!URL.canParse(candidate)) return void 0;
+  const url = new URL(candidate);
+  if (url.port !== "" || url.username !== "" || url.password !== "") return void 0;
+  if (url.pathname !== "/" && url.pathname !== "") return void 0;
+  return url.hostname.toLowerCase();
+};
+var siblingParentDomainOf = (hostname) => {
+  const labels = hostname.split(".");
+  if (labels.length < 3) return void 0;
+  const parent = labels.slice(1).join(".");
+  return parent.includes(".") ? parent : void 0;
+};
+var rebindTokenEndpointHostToCallbackDomain = (configuredTokenUrl, callbackDomain) => {
+  if (!callbackDomain) return configuredTokenUrl;
+  if (!URL.canParse(configuredTokenUrl)) return configuredTokenUrl;
+  const configured = new URL(configuredTokenUrl);
+  if (configured.protocol !== "https:") return configuredTokenUrl;
+  const targetHost = hostnameFromCallbackDomain(callbackDomain);
+  if (!targetHost) return configuredTokenUrl;
+  const configuredHost = configured.hostname.toLowerCase();
+  if (targetHost === configuredHost) return configuredTokenUrl;
+  const configuredParent = siblingParentDomainOf(configuredHost);
+  const targetParent = siblingParentDomainOf(targetHost);
+  if (!configuredParent || !targetParent || configuredParent !== targetParent) {
+    return configuredTokenUrl;
+  }
+  const rebound = new URL(configuredTokenUrl);
+  rebound.hostname = targetHost;
+  return rebound.toString();
+};
 var isOAuth2Error = Predicate.isTagged("OAuth2Error");
 var responseFromOAuthErrorCause = (cause) => {
   if (cause instanceof Response) return cause;
@@ -296,9 +330,10 @@ export {
   createOAuthState,
   buildAuthorizationUrl,
   providerAuthorizeExtras,
+  rebindTokenEndpointHostToCallbackDomain,
   exchangeAuthorizationCode,
   exchangeClientCredentials,
   refreshAccessToken,
   shouldRefreshToken
 };
-//# sourceMappingURL=chunk-EIHWBY6T.js.map
+//# sourceMappingURL=chunk-4XPVLX62.js.map

package/dist/chunk-4XPVLX62.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/oauth-helpers.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// OAuth 2.0 helpers — generic, isomorphic building blocks.\n//\n// Thin wrappers around `oauth4webapi` (stateless; pure Web Crypto +\n// `fetch`, no deps; runs unchanged in Node, CF Workers, and browsers).\n// Each public helper is a single `Effect.tryPromise` call that delegates\n// the RFC work to the library and normalises the failure surface into\n// `OAuth2Error`.\n//\n// What stays hand-rolled:\n//   - `OAuth2Error` — our tagged error; we want a stable shape across\n//     every token-endpoint call\n//   - `shouldRefreshToken` — skew check, trivial\n//   - `buildAuthorizationUrl` — the library doesn't expose a raw\n//     authorization-URL builder (it prefers PAR); a 30-line manual\n//     construction keeps the call sync and lets callers opt out of PAR\n// ---------------------------------------------------------------------------\n\nimport { Data, Effect, Predicate } from \"effect\";\nimport * as oauth from \"oauth4webapi\";\n\n// ---------------------------------------------------------------------------\n// Errors\n// ---------------------------------------------------------------------------\n\nexport class OAuth2Error extends Data.TaggedError(\"OAuth2Error\")<{\n  readonly message: string;\n  /**\n   * RFC 6749 §5.2 error code, when the token endpoint returned one\n   * (`invalid_grant`, `invalid_client`, `unauthorized_client`, ...).\n   * Callers use this to distinguish terminal failures (a refresh token\n   * the AS no longer honours → re-auth required) from transient ones.\n   */\n  readonly error?: string;\n  readonly cause?: unknown;\n}> {}\n\n// ---------------------------------------------------------------------------\n// Token response shape (RFC 6749 §5.1)\n// ---------------------------------------------------------------------------\n\nexport type OAuth2TokenResponse = {\n  readonly access_token: string;\n  readonly token_type?: string;\n  readonly refresh_token?: string;\n  readonly expires_in?: number;\n  readonly scope?: string;\n};\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Refresh tokens this many ms before expiry to avoid mid-request expiration. */\nexport const OAUTH2_REFRESH_SKEW_MS = 60_000;\n\n/** Default token-endpoint timeout. */\nexport const OAUTH2_DEFAULT_TIMEOUT_MS = 20_000;\n\nexport interface OAuthEndpointUrlPolicy {\n  readonly allowHttp?: boolean;\n}\n\nconst isLoopbackHttpUrl = (value: string): boolean => {\n  if (!URL.canParse(value)) return false;\n  const url = new URL(value);\n  if (url.protocol !== \"http:\") return false;\n  const hostname = url.hostname.toLowerCase();\n  return (\n    hostname === \"localhost\" ||\n    hostname === \"0.0.0.0\" ||\n    hostname === \"::1\" ||\n    hostname === \"[::1]\" ||\n    hostname.startsWith(\"127.\")\n  );\n};\n\nexport const isSupportedOAuthEndpointUrl = (\n  value: string,\n  policy: OAuthEndpointUrlPolicy = {},\n): boolean => {\n  if (!URL.canParse(value)) return false;\n  const url = new URL(value);\n  return (\n    url.protocol === \"https:\" ||\n    isLoopbackHttpUrl(value) ||\n    (url.protocol === \"http:\" && policy.allowHttp === true)\n  );\n};\n\nexport const assertSupportedOAuthEndpointUrl = (\n  value: string,\n  label = \"OAuth endpoint URL\",\n  policy: OAuthEndpointUrlPolicy = {},\n): string => {\n  if (isSupportedOAuthEndpointUrl(value, policy)) return value;\n  // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: synchronous assertion helper used by URL constructors and Effect.try wrappers\n  throw new TypeError(`${label} must use https: or loopback http:`);\n};\n\n// ---------------------------------------------------------------------------\n// PKCE (RFC 7636) — straight delegation to `oauth4webapi`\n// ---------------------------------------------------------------------------\n\nexport const createPkceCodeVerifier = (): string => oauth.generateRandomCodeVerifier();\n\nexport const createPkceCodeChallenge = (verifier: string): Promise<string> =>\n  oauth.calculatePKCECodeChallenge(verifier);\n\n/** RFC 6749 `state` — an unguessable correlation token minted by `oauth.start`\n *  and redeemed by `oauth.complete`. */\nexport const createOAuthState = (): string => oauth.generateRandomState();\n\n// ---------------------------------------------------------------------------\n// Authorization URL builder\n// ---------------------------------------------------------------------------\n\nexport type BuildAuthorizationUrlInput = {\n  readonly authorizationUrl: string;\n  readonly clientId: string;\n  readonly redirectUrl: string;\n  readonly scopes: readonly string[];\n  readonly state: string;\n  /** Pre-computed base64url S256 challenge (from `createPkceCodeChallenge`). */\n  readonly codeChallenge: string;\n  /** Separator between scopes. RFC 6749 says space; some providers use comma. */\n  readonly scopeSeparator?: string;\n  /** RFC 8707 Resource Indicator. MCP Authorization 2025-06-18 §\"Resource\n   *  Parameter Implementation\" requires clients to send this on every\n   *  authorization request, regardless of AS support. */\n  readonly resource?: string;\n  /** Provider-specific extras (e.g. Google's `access_type=offline`). */\n  readonly extraParams?: Readonly<Record<string, string>>;\n  readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;\n};\n\n/** Build an RFC 6749 §4.1.1 authorization URL. Sync; pre-computed\n *  challenge lets this stay out of the Promise world. */\nexport const buildAuthorizationUrl = (input: BuildAuthorizationUrlInput): string => {\n  const url = new URL(\n    assertSupportedOAuthEndpointUrl(\n      input.authorizationUrl,\n      \"Authorization URL\",\n      input.endpointUrlPolicy,\n    ),\n  );\n  // Benign default kept by design: a single space is the RFC 6749 scope\n  // separator. Callers targeting a legacy comma-separated provider pass\n  // `scopeSeparator` explicitly (see the field's JSDoc).\n  const separator = input.scopeSeparator ?? \" \";\n  url.searchParams.set(\"client_id\", input.clientId);\n  url.searchParams.set(\"redirect_uri\", input.redirectUrl);\n  url.searchParams.set(\"response_type\", \"code\");\n  if (input.scopes.length > 0) {\n    url.searchParams.set(\"scope\", input.scopes.join(separator));\n  }\n  url.searchParams.set(\"state\", input.state);\n  url.searchParams.set(\"code_challenge_method\", \"S256\");\n  url.searchParams.set(\"code_challenge\", input.codeChallenge);\n  if (input.resource) {\n    url.searchParams.set(\"resource\", input.resource);\n  }\n  if (input.extraParams) {\n    for (const [k, v] of Object.entries(input.extraParams)) {\n      url.searchParams.set(k, v);\n    }\n  }\n  return url.toString();\n};\n\n/** Provider-specific authorize-URL extras that are NOT RFC 6749 params, so the\n *  generic flow must add them per-provider (keyed off the authorization host).\n *\n *  Google: `access_type=offline` + `prompt=consent` are required to receive (and\n *  keep receiving, across reconnects / scope changes) a REFRESH TOKEN — without\n *  them Google issues an access-token-only grant that dies in ~1h and a\n *  re-consent can silently keep the old scope set. Do not add\n *  `include_granted_scopes=true` here: with historical grants on the same Google\n *  consent app, Google folds those unrelated scopes into the new consent flow and\n *  can fail inside accounts.google.com before returning to our callback. */\nexport const providerAuthorizeExtras = (\n  authorizationUrl: string,\n): Readonly<Record<string, string>> => {\n  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: URL() throws on invalid input → no provider extras\n  try {\n    const host = new URL(authorizationUrl).host.toLowerCase();\n    if (host === \"accounts.google.com\") {\n      return { access_type: \"offline\", prompt: \"consent\" };\n    }\n  } catch {\n    // Unparseable authorization URL — let buildAuthorizationUrl surface the error.\n  }\n  return {};\n};\n\n// ---------------------------------------------------------------------------\n// Regional token-endpoint rebind\n//\n// Some authorization servers publish a single static metadata document that\n// advertises one region's token endpoint, but issue authorization codes that\n// are only redeemable at the *regional* host the user's org actually lives on.\n// The region comes back on the callback as a non-standard `domain` (or `site`)\n// query param: Datadog returns `domain=us5.datadoghq.com` while its metadata\n// statically advertises `app.datadoghq.com`. Redeeming the code at the\n// advertised host then fails with `invalid_grant`.\n//\n// `rebindTokenEndpointHostToCallbackDomain` swaps ONLY the hostname of the\n// configured token URL to the callback-supplied host, and ONLY when that host\n// is a sibling subdomain of the configured one (same parent after stripping the\n// leftmost DNS label, e.g. `app.datadoghq.com` and `us5.datadoghq.com` both\n// reduce to `datadoghq.com`). The token request carries the client secret, the\n// code, and the PKCE verifier, so an attacker-influenced `domain` must never be\n// able to point it at an arbitrary origin. Anything that fails the sibling\n// check, fails to parse, or isn't https falls back to the configured URL\n// unchanged.\n// ---------------------------------------------------------------------------\n\nconst hostnameFromCallbackDomain = (callbackDomain: string): string | undefined => {\n  const trimmed = callbackDomain.trim();\n  if (trimmed.length === 0) return undefined;\n  // Datadog sends `domain` as a bare host and `site` as a full origin; accept\n  // either by tolerating an optional scheme, then taking only the hostname.\n  const candidate = trimmed.includes(\"://\") ? trimmed : `https://${trimmed}`;\n  if (!URL.canParse(candidate)) return undefined;\n  const url = new URL(candidate);\n  // A legitimate regional host carries no port, credentials, or path.\n  if (url.port !== \"\" || url.username !== \"\" || url.password !== \"\") return undefined;\n  if (url.pathname !== \"/\" && url.pathname !== \"\") return undefined;\n  return url.hostname.toLowerCase();\n};\n\n/** Parent domain after stripping the leftmost DNS label, or `undefined` when\n *  the host has no sibling space (a single label, or a parent that is a bare\n *  TLD). `app.datadoghq.com` -> `datadoghq.com`; `foo.com` -> undefined. */\nconst siblingParentDomainOf = (hostname: string): string | undefined => {\n  const labels = hostname.split(\".\");\n  if (labels.length < 3) return undefined;\n  const parent = labels.slice(1).join(\".\");\n  // Require the parent to itself be multi-label so a 2-label configured host\n  // can never rebind across an entire TLD (e.g. foo.com -> bar.com).\n  return parent.includes(\".\") ? parent : undefined;\n};\n\nexport const rebindTokenEndpointHostToCallbackDomain = (\n  configuredTokenUrl: string,\n  callbackDomain: string | null | undefined,\n): string => {\n  if (!callbackDomain) return configuredTokenUrl;\n  if (!URL.canParse(configuredTokenUrl)) return configuredTokenUrl;\n  const configured = new URL(configuredTokenUrl);\n  if (configured.protocol !== \"https:\") return configuredTokenUrl;\n  const targetHost = hostnameFromCallbackDomain(callbackDomain);\n  if (!targetHost) return configuredTokenUrl;\n  const configuredHost = configured.hostname.toLowerCase();\n  if (targetHost === configuredHost) return configuredTokenUrl;\n  const configuredParent = siblingParentDomainOf(configuredHost);\n  const targetParent = siblingParentDomainOf(targetHost);\n  if (!configuredParent || !targetParent || configuredParent !== targetParent) {\n    return configuredTokenUrl;\n  }\n  const rebound = new URL(configuredTokenUrl);\n  rebound.hostname = targetHost;\n  return rebound.toString();\n};\n\n// ---------------------------------------------------------------------------\n// Error mapping — `oauth4webapi`'s `process*Response` failure shapes are\n// either a WWW-Authenticate challenge or an RFC 6749 §5.2 error body,\n// both exposed via `.error` / `.error_description`. Probing the envelope\n// preserves RFC 6749 error-code semantics (e.g., mapping `invalid_grant`\n// to reauth-required) across wrappers.\n// ---------------------------------------------------------------------------\n\nconst isOAuth2Error = Predicate.isTagged(\"OAuth2Error\") as (cause: unknown) => cause is OAuth2Error;\n\nconst responseFromOAuthErrorCause = (cause: unknown): Response | undefined => {\n  if (cause instanceof Response) return cause;\n  if (typeof cause !== \"object\" || cause === null) return undefined;\n  const envelope = cause as {\n    readonly cause?: unknown;\n    readonly response?: unknown;\n  };\n  if (envelope.response instanceof Response) return envelope.response;\n  if (envelope.cause instanceof Response) return envelope.cause;\n  return undefined;\n};\n\nconst redactTokenEndpointBody = (body: string): string =>\n  body\n    .replaceAll(\n      /(\"(?:access_token|refresh_token|id_token|client_secret)\"\\s*:\\s*\")[^\"]*(\")/gi,\n      \"$1[redacted]$2\",\n    )\n    .replaceAll(\n      /((?:access_token|refresh_token|id_token|client_secret|code)=)[^&\\s]*/gi,\n      \"$1[redacted]\",\n    );\n\nconst tokenEndpointHttpSummary = async (response: Response): Promise<string> => {\n  const status = `HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : \"\"}`;\n  const contentType = response.headers.get(\"content-type\");\n  const url = response.url ? ` from ${response.url}` : \"\";\n  const parts = [`${status}${url}`];\n  if (contentType) parts.push(`content-type ${contentType}`);\n  const preview = await bodyPreviewFromResponse(response);\n  if (preview) parts.push(`body: ${preview}`);\n  return parts.join(\"; \");\n};\n\nconst bodyPreviewFromResponse = async (response: Response): Promise<string | undefined> => {\n  const text = await Promise.resolve()\n    .then(() => response.clone().text())\n    .then(\n      (value) => value.trim(),\n      () => \"\",\n    );\n  if (!text) return undefined;\n  const redacted = redactTokenEndpointBody(text.replaceAll(/\\s+/g, \" \"));\n  return redacted.length > 500 ? `${redacted.slice(0, 500)}...` : redacted;\n};\n\nconst toOAuth2Error = (cause: unknown): OAuth2Error => {\n  if (isOAuth2Error(cause)) return cause;\n  if (typeof cause === \"object\" && cause !== null) {\n    const c = cause as {\n      error?: unknown;\n      error_description?: unknown;\n      message?: unknown;\n    };\n    const code = typeof c.error === \"string\" ? c.error : undefined;\n    const description =\n      typeof c.error_description === \"string\"\n        ? c.error_description\n        : typeof c.message === \"string\"\n          ? c.message\n          : undefined;\n    return new OAuth2Error({\n      message: `OAuth token exchange failed: ${description ?? code ?? \"unknown error\"}`,\n      error: code,\n      cause,\n    });\n  }\n  return new OAuth2Error({\n    message: \"OAuth token exchange failed\",\n    cause,\n  });\n};\n\nconst toOAuth2ErrorWithHttpSummary = (cause: unknown): Effect.Effect<OAuth2Error> => {\n  if (isOAuth2Error(cause)) return Effect.succeed(cause);\n  const base = toOAuth2Error(cause);\n  const response = responseFromOAuthErrorCause(cause);\n  if (!response) return Effect.succeed(base);\n  return Effect.promise(() => tokenEndpointHttpSummary(response)).pipe(\n    Effect.map(\n      (summary) =>\n        new OAuth2Error({\n          message: `${base.message} (${summary})`,\n          error: base.error,\n          cause,\n        }),\n    ),\n  );\n};\n\nconst failOAuth2WithHttpSummary = (cause: unknown): Effect.Effect<never, OAuth2Error> =>\n  toOAuth2ErrorWithHttpSummary(cause).pipe(Effect.flatMap((error) => Effect.fail(error)));\n\n// ---------------------------------------------------------------------------\n// oauth4webapi adapter helpers\n// ---------------------------------------------------------------------------\n\nexport type ClientAuthMethod = \"body\" | \"basic\";\n\n/**\n * The token-endpoint client-auth transport used when a caller doesn't specify\n * one. `\"body\"` is `client_secret_post` (the secret in the form body) — the\n * method our DCR registers (`token_endpoint_auth_method: client_secret_post`)\n * and the one every confidential client in the v2 model uses. EXPLICIT and\n * documented rather than a hidden inline `?? \"body\"`: callers that need\n * `client_secret_basic` pass `clientAuth: \"basic\"`. For PUBLIC clients (no\n * secret) the method is irrelevant — `pickClientAuth` returns `None()`.\n */\nexport const DEFAULT_CLIENT_AUTH_METHOD: ClientAuthMethod = \"body\";\n\nconst asFromTokenUrl = (\n  tokenUrl: string,\n  endpointUrlPolicy: OAuthEndpointUrlPolicy = {},\n): oauth.AuthorizationServer => {\n  assertSupportedOAuthEndpointUrl(tokenUrl, \"Token URL\", endpointUrlPolicy);\n  const url = new URL(tokenUrl);\n  return {\n    issuer: `${url.protocol}//${url.host}`,\n    token_endpoint: tokenUrl,\n  };\n};\n\nconst asFromTokenUrlAndIssuer = (\n  tokenUrl: string,\n  issuerUrl: string | null | undefined,\n  options: {\n    readonly idTokenSigningAlgValuesSupported?: readonly string[];\n    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;\n  } = {},\n): oauth.AuthorizationServer => {\n  const as = asFromTokenUrl(tokenUrl, options.endpointUrlPolicy);\n  const withIssuer = issuerUrl ? { ...as, issuer: issuerUrl } : as;\n  return options.idTokenSigningAlgValuesSupported\n    ? {\n        ...withIssuer,\n        id_token_signing_alg_values_supported: [...options.idTokenSigningAlgValuesSupported],\n      }\n    : withIssuer;\n};\n\nconst oauth4webapiRequestOptions = (\n  targetUrl: string,\n  timeoutMs: number | undefined,\n  endpointUrlPolicy: OAuthEndpointUrlPolicy = {},\n): Record<string, unknown> => {\n  const options: Record<string, unknown> = {\n    signal: AbortSignal.timeout(timeoutMs ?? OAUTH2_DEFAULT_TIMEOUT_MS),\n  };\n  if (\n    isLoopbackHttpUrl(targetUrl) ||\n    (URL.canParse(targetUrl) &&\n      new URL(targetUrl).protocol === \"http:\" &&\n      endpointUrlPolicy.allowHttp === true)\n  ) {\n    (options as { [oauth.allowInsecureRequests]?: boolean })[oauth.allowInsecureRequests] = true;\n  }\n  return options;\n};\n\n// Select the token-endpoint client authentication. The secret's presence is the\n// EXPLICIT public-vs-confidential discriminator in the v2 model: a registered\n// client either has a secret (confidential — authenticate it) or has none\n// (public PKCE — `None()`, RFC 7636). This is not a silent guess: `loadClient`\n// persists a non-empty secret for confidential clients and null/\"\" for public\n// ones, so an absent secret here unambiguously means \"public client\". The\n// `method` only chooses HOW a present secret is sent (post vs basic).\nconst pickClientAuth = (\n  clientSecret: string | null | undefined,\n  method: ClientAuthMethod,\n): oauth.ClientAuth => {\n  if (!clientSecret) return oauth.None();\n  return method === \"basic\"\n    ? oauth.ClientSecretBasic(clientSecret)\n    : oauth.ClientSecretPost(clientSecret);\n};\n\nconst tokenResponseFrom = (r: oauth.TokenEndpointResponse): OAuth2TokenResponse => ({\n  access_token: r.access_token,\n  token_type: r.token_type,\n  refresh_token: r.refresh_token,\n  expires_in: typeof r.expires_in === \"number\" ? r.expires_in : undefined,\n  scope: r.scope,\n});\n\n// MCP source connections are pure OAuth 2.0 — we never request `openid` and\n// never consume `id_token`. Some providers (PostHog, etc.) front an OIDC\n// backend and emit an `id_token` anyway; oauth4webapi then strict-validates\n// its claims against the AS metadata and rejects mismatches we don't care\n// about. Strip the field before delegation.\nconst stripIdToken = async (response: Response): Promise<Response> => {\n  const body = await response\n    .clone()\n    .json()\n    .then(\n      (value: unknown) => value,\n      () => null,\n    );\n  if (!body || typeof body !== \"object\" || !(\"id_token\" in (body as Record<string, unknown>))) {\n    return response;\n  }\n  const { id_token: _ignored, ...rest } = body as Record<string, unknown>;\n  return new Response(JSON.stringify(rest), {\n    status: response.status,\n    statusText: response.statusText,\n    headers: response.headers,\n  });\n};\n\nconst processTokenEndpointResponse = async (\n  as: oauth.AuthorizationServer,\n  client: oauth.Client,\n  response: Response,\n): Promise<OAuth2TokenResponse> =>\n  tokenResponseFrom(\n    await oauth.processGenericTokenEndpointResponse(as, client, await stripIdToken(response)),\n  );\n\n// ---------------------------------------------------------------------------\n// Exchange authorization code → tokens\n// ---------------------------------------------------------------------------\n\nexport type ExchangeAuthorizationCodeInput = {\n  readonly tokenUrl: string;\n  readonly issuerUrl?: string | null;\n  readonly clientId: string;\n  readonly clientSecret?: string | null;\n  readonly redirectUrl: string;\n  readonly codeVerifier: string;\n  readonly code: string;\n  readonly clientAuth?: ClientAuthMethod;\n  readonly idTokenSigningAlgValuesSupported?: readonly string[];\n  /** RFC 8707 Resource Indicator. MCP Auth spec MUST-requires this on\n   *  the token request when the client knows the resource it intends\n   *  to call. */\n  readonly resource?: string;\n  readonly timeoutMs?: number;\n  readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;\n};\n\nexport const exchangeAuthorizationCode = (\n  input: ExchangeAuthorizationCodeInput,\n): Effect.Effect<OAuth2TokenResponse, OAuth2Error> =>\n  Effect.tryPromise({\n    try: async () => {\n      const as = asFromTokenUrlAndIssuer(input.tokenUrl, input.issuerUrl, {\n        idTokenSigningAlgValuesSupported: input.idTokenSigningAlgValuesSupported,\n        endpointUrlPolicy: input.endpointUrlPolicy,\n      });\n      const client: oauth.Client = { client_id: input.clientId };\n      const clientAuth = pickClientAuth(\n        input.clientSecret,\n        input.clientAuth ?? DEFAULT_CLIENT_AUTH_METHOD,\n      );\n      // `authorizationCodeGrantRequest` requires its `callbackParameters`\n      // to have been returned from `validateAuthResponse`. Our public API\n      // takes the `code` directly (the UI already validated `state` by\n      // looking up the session), so skip the library's state-validation\n      // rail and go through the generic grant request instead.\n      const params = new URLSearchParams({\n        code: input.code,\n        redirect_uri: input.redirectUrl,\n        code_verifier: input.codeVerifier,\n      });\n      if (input.resource) {\n        params.set(\"resource\", input.resource);\n      }\n      const response = await oauth.genericTokenEndpointRequest(\n        as,\n        client,\n        clientAuth,\n        \"authorization_code\",\n        params,\n        oauth4webapiRequestOptions(input.tokenUrl, input.timeoutMs, input.endpointUrlPolicy),\n      );\n      return await processTokenEndpointResponse(as, client, response);\n    },\n    catch: (cause) => cause,\n  }).pipe(Effect.catch(failOAuth2WithHttpSummary));\n\n// ---------------------------------------------------------------------------\n// Exchange client credentials → tokens (RFC 6749 §4.4)\n// ---------------------------------------------------------------------------\n\nexport type ExchangeClientCredentialsInput = {\n  readonly tokenUrl: string;\n  readonly clientId: string;\n  readonly clientSecret: string;\n  readonly scopes?: readonly string[];\n  readonly scopeSeparator?: string;\n  readonly clientAuth?: ClientAuthMethod;\n  /** RFC 8707 Resource Indicator. MCP Authorization 2025-06-18 requires this\n   *  on token requests when the client knows the protected resource. */\n  readonly resource?: string;\n  readonly timeoutMs?: number;\n  readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;\n};\n\nexport const exchangeClientCredentials = (\n  input: ExchangeClientCredentialsInput,\n): Effect.Effect<OAuth2TokenResponse, OAuth2Error> =>\n  Effect.tryPromise({\n    try: async () => {\n      const as = asFromTokenUrl(input.tokenUrl, input.endpointUrlPolicy);\n      const client: oauth.Client = { client_id: input.clientId };\n      const clientAuth = pickClientAuth(\n        input.clientSecret,\n        input.clientAuth ?? DEFAULT_CLIENT_AUTH_METHOD,\n      );\n      const params = new URLSearchParams();\n      if (input.scopes && input.scopes.length > 0) {\n        params.set(\"scope\", input.scopes.join(input.scopeSeparator ?? \" \"));\n      }\n      if (input.resource) {\n        params.set(\"resource\", input.resource);\n      }\n      const response = await oauth.clientCredentialsGrantRequest(\n        as,\n        client,\n        clientAuth,\n        params,\n        oauth4webapiRequestOptions(input.tokenUrl, input.timeoutMs, input.endpointUrlPolicy),\n      );\n      const result = await oauth.processClientCredentialsResponse(as, client, response);\n      return tokenResponseFrom(result);\n    },\n    catch: (cause) => cause,\n  }).pipe(Effect.catch(failOAuth2WithHttpSummary));\n\n// ---------------------------------------------------------------------------\n// Refresh access token\n// ---------------------------------------------------------------------------\n\nexport type RefreshAccessTokenInput = {\n  readonly tokenUrl: string;\n  readonly issuerUrl?: string | null;\n  readonly clientId: string;\n  readonly clientSecret?: string | null;\n  readonly refreshToken: string;\n  readonly scopes?: readonly string[];\n  readonly scopeSeparator?: string;\n  readonly clientAuth?: ClientAuthMethod;\n  readonly idTokenSigningAlgValuesSupported?: readonly string[];\n  /** RFC 8707 Resource Indicator — MCP spec MUST-requires this on\n   *  refresh requests so the new access token's audience is bound to\n   *  the same resource. */\n  readonly resource?: string;\n  readonly timeoutMs?: number;\n  readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;\n};\n\nexport const refreshAccessToken = (\n  input: RefreshAccessTokenInput,\n): Effect.Effect<OAuth2TokenResponse, OAuth2Error> =>\n  Effect.tryPromise({\n    try: async () => {\n      const as = asFromTokenUrlAndIssuer(input.tokenUrl, input.issuerUrl, {\n        idTokenSigningAlgValuesSupported: input.idTokenSigningAlgValuesSupported,\n        endpointUrlPolicy: input.endpointUrlPolicy,\n      });\n      const client: oauth.Client = { client_id: input.clientId };\n      const clientAuth = pickClientAuth(\n        input.clientSecret,\n        input.clientAuth ?? DEFAULT_CLIENT_AUTH_METHOD,\n      );\n      const extraParams = new URLSearchParams();\n      if (input.scopes && input.scopes.length > 0) {\n        extraParams.set(\"scope\", input.scopes.join(input.scopeSeparator ?? \" \"));\n      }\n      if (input.resource) {\n        extraParams.set(\"resource\", input.resource);\n      }\n      const additionalParameters =\n        Array.from(extraParams.keys()).length > 0 ? extraParams : undefined;\n      const response = await oauth.refreshTokenGrantRequest(\n        as,\n        client,\n        clientAuth,\n        input.refreshToken,\n        {\n          ...oauth4webapiRequestOptions(input.tokenUrl, input.timeoutMs, input.endpointUrlPolicy),\n          additionalParameters,\n        },\n      );\n      const result = await oauth.processRefreshTokenResponse(\n        as,\n        client,\n        await stripIdToken(response),\n      );\n      return tokenResponseFrom(result);\n    },\n    catch: (cause) => cause,\n  }).pipe(Effect.catch(failOAuth2WithHttpSummary));\n\n// ---------------------------------------------------------------------------\n// Refresh-needed predicate\n// ---------------------------------------------------------------------------\n\nexport const shouldRefreshToken = (input: {\n  readonly expiresAt: number | null;\n  readonly now?: number;\n  readonly skewMs?: number;\n}): boolean => {\n  if (input.expiresAt === null) return false;\n  const now = input.now ?? Date.now();\n  const skew = input.skewMs ?? OAUTH2_REFRESH_SKEW_MS;\n  return input.expiresAt <= now + skew;\n};\n"],"mappings":";AAkBA,SAAS,MAAM,QAAQ,iBAAiB;AACxC,YAAY,WAAW;AAMhB,IAAM,cAAN,cAA0B,KAAK,YAAY,aAAa,EAU5D;AAAC;AAmBG,IAAM,yBAAyB;AAG/B,IAAM,4BAA4B;AAMzC,IAAM,oBAAoB,CAAC,UAA2B;AACpD,MAAI,CAAC,IAAI,SAAS,KAAK,EAAG,QAAO;AACjC,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,QAAM,WAAW,IAAI,SAAS,YAAY;AAC1C,SACE,aAAa,eACb,aAAa,aACb,aAAa,SACb,aAAa,WACb,SAAS,WAAW,MAAM;AAE9B;AAEO,IAAM,8BAA8B,CACzC,OACA,SAAiC,CAAC,MACtB;AACZ,MAAI,CAAC,IAAI,SAAS,KAAK,EAAG,QAAO;AACjC,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,SACE,IAAI,aAAa,YACjB,kBAAkB,KAAK,KACtB,IAAI,aAAa,WAAW,OAAO,cAAc;AAEtD;AAEO,IAAM,kCAAkC,CAC7C,OACA,QAAQ,sBACR,SAAiC,CAAC,MACvB;AACX,MAAI,4BAA4B,OAAO,MAAM,EAAG,QAAO;AAEvD,QAAM,IAAI,UAAU,GAAG,KAAK,oCAAoC;AAClE;AAMO,IAAM,yBAAyB,MAAoB,iCAA2B;AAE9E,IAAM,0BAA0B,CAAC,aAChC,iCAA2B,QAAQ;AAIpC,IAAM,mBAAmB,MAAoB,0BAAoB;AA2BjE,IAAM,wBAAwB,CAAC,UAA8C;AAClF,QAAM,MAAM,IAAI;AAAA,IACd;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,IACR;AAAA,EACF;AAIA,QAAM,YAAY,MAAM,kBAAkB;AAC1C,MAAI,aAAa,IAAI,aAAa,MAAM,QAAQ;AAChD,MAAI,aAAa,IAAI,gBAAgB,MAAM,WAAW;AACtD,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,MAAM,OAAO,SAAS,GAAG;AAC3B,QAAI,aAAa,IAAI,SAAS,MAAM,OAAO,KAAK,SAAS,CAAC;AAAA,EAC5D;AACA,MAAI,aAAa,IAAI,SAAS,MAAM,KAAK;AACzC,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,kBAAkB,MAAM,aAAa;AAC1D,MAAI,MAAM,UAAU;AAClB,QAAI,aAAa,IAAI,YAAY,MAAM,QAAQ;AAAA,EACjD;AACA,MAAI,MAAM,aAAa;AACrB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,WAAW,GAAG;AACtD,UAAI,aAAa,IAAI,GAAG,CAAC;AAAA,IAC3B;AAAA,EACF;AACA,SAAO,IAAI,SAAS;AACtB;AAYO,IAAM,0BAA0B,CACrC,qBACqC;AAErC,MAAI;AACF,UAAM,OAAO,IAAI,IAAI,gBAAgB,EAAE,KAAK,YAAY;AACxD,QAAI,SAAS,uBAAuB;AAClC,aAAO,EAAE,aAAa,WAAW,QAAQ,UAAU;AAAA,IACrD;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,CAAC;AACV;AAwBA,IAAM,6BAA6B,CAAC,mBAA+C;AACjF,QAAM,UAAU,eAAe,KAAK;AACpC,MAAI,QAAQ,WAAW,EAAG,QAAO;AAGjC,QAAM,YAAY,QAAQ,SAAS,KAAK,IAAI,UAAU,WAAW,OAAO;AACxE,MAAI,CAAC,IAAI,SAAS,SAAS,EAAG,QAAO;AACrC,QAAM,MAAM,IAAI,IAAI,SAAS;AAE7B,MAAI,IAAI,SAAS,MAAM,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,QAAO;AAC1E,MAAI,IAAI,aAAa,OAAO,IAAI,aAAa,GAAI,QAAO;AACxD,SAAO,IAAI,SAAS,YAAY;AAClC;AAKA,IAAM,wBAAwB,CAAC,aAAyC;AACtE,QAAM,SAAS,SAAS,MAAM,GAAG;AACjC,MAAI,OAAO,SAAS,EAAG,QAAO;AAC9B,QAAM,SAAS,OAAO,MAAM,CAAC,EAAE,KAAK,GAAG;AAGvC,SAAO,OAAO,SAAS,GAAG,IAAI,SAAS;AACzC;AAEO,IAAM,0CAA0C,CACrD,oBACA,mBACW;AACX,MAAI,CAAC,eAAgB,QAAO;AAC5B,MAAI,CAAC,IAAI,SAAS,kBAAkB,EAAG,QAAO;AAC9C,QAAM,aAAa,IAAI,IAAI,kBAAkB;AAC7C,MAAI,WAAW,aAAa,SAAU,QAAO;AAC7C,QAAM,aAAa,2BAA2B,cAAc;AAC5D,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,iBAAiB,WAAW,SAAS,YAAY;AACvD,MAAI,eAAe,eAAgB,QAAO;AAC1C,QAAM,mBAAmB,sBAAsB,cAAc;AAC7D,QAAM,eAAe,sBAAsB,UAAU;AACrD,MAAI,CAAC,oBAAoB,CAAC,gBAAgB,qBAAqB,cAAc;AAC3E,WAAO;AAAA,EACT;AACA,QAAM,UAAU,IAAI,IAAI,kBAAkB;AAC1C,UAAQ,WAAW;AACnB,SAAO,QAAQ,SAAS;AAC1B;AAUA,IAAM,gBAAgB,UAAU,SAAS,aAAa;AAEtD,IAAM,8BAA8B,CAAC,UAAyC;AAC5E,MAAI,iBAAiB,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,WAAW;AAIjB,MAAI,SAAS,oBAAoB,SAAU,QAAO,SAAS;AAC3D,MAAI,SAAS,iBAAiB,SAAU,QAAO,SAAS;AACxD,SAAO;AACT;AAEA,IAAM,0BAA0B,CAAC,SAC/B,KACG;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF;AAEJ,IAAM,2BAA2B,OAAO,aAAwC;AAC9E,QAAM,SAAS,QAAQ,SAAS,MAAM,GAAG,SAAS,aAAa,IAAI,SAAS,UAAU,KAAK,EAAE;AAC7F,QAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,QAAM,MAAM,SAAS,MAAM,SAAS,SAAS,GAAG,KAAK;AACrD,QAAM,QAAQ,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE;AAChC,MAAI,YAAa,OAAM,KAAK,gBAAgB,WAAW,EAAE;AACzD,QAAM,UAAU,MAAM,wBAAwB,QAAQ;AACtD,MAAI,QAAS,OAAM,KAAK,SAAS,OAAO,EAAE;AAC1C,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,IAAM,0BAA0B,OAAO,aAAoD;AACzF,QAAM,OAAO,MAAM,QAAQ,QAAQ,EAChC,KAAK,MAAM,SAAS,MAAM,EAAE,KAAK,CAAC,EAClC;AAAA,IACC,CAAC,UAAU,MAAM,KAAK;AAAA,IACtB,MAAM;AAAA,EACR;AACF,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,WAAW,wBAAwB,KAAK,WAAW,QAAQ,GAAG,CAAC;AACrE,SAAO,SAAS,SAAS,MAAM,GAAG,SAAS,MAAM,GAAG,GAAG,CAAC,QAAQ;AAClE;AAEA,IAAM,gBAAgB,CAAC,UAAgC;AACrD,MAAI,cAAc,KAAK,EAAG,QAAO;AACjC,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,IAAI;AAKV,UAAM,OAAO,OAAO,EAAE,UAAU,WAAW,EAAE,QAAQ;AACrD,UAAM,cACJ,OAAO,EAAE,sBAAsB,WAC3B,EAAE,oBACF,OAAO,EAAE,YAAY,WACnB,EAAE,UACF;AACR,WAAO,IAAI,YAAY;AAAA,MACrB,SAAS,gCAAgC,eAAe,QAAQ,eAAe;AAAA,MAC/E,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,YAAY;AAAA,IACrB,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAEA,IAAM,+BAA+B,CAAC,UAA+C;AACnF,MAAI,cAAc,KAAK,EAAG,QAAO,OAAO,QAAQ,KAAK;AACrD,QAAM,OAAO,cAAc,KAAK;AAChC,QAAM,WAAW,4BAA4B,KAAK;AAClD,MAAI,CAAC,SAAU,QAAO,OAAO,QAAQ,IAAI;AACzC,SAAO,OAAO,QAAQ,MAAM,yBAAyB,QAAQ,CAAC,EAAE;AAAA,IAC9D,OAAO;AAAA,MACL,CAAC,YACC,IAAI,YAAY;AAAA,QACd,SAAS,GAAG,KAAK,OAAO,KAAK,OAAO;AAAA,QACpC,OAAO,KAAK;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AACF;AAEA,IAAM,4BAA4B,CAAC,UACjC,6BAA6B,KAAK,EAAE,KAAK,OAAO,QAAQ,CAAC,UAAU,OAAO,KAAK,KAAK,CAAC,CAAC;AAiBjF,IAAM,6BAA+C;AAE5D,IAAM,iBAAiB,CACrB,UACA,oBAA4C,CAAC,MACf;AAC9B,kCAAgC,UAAU,aAAa,iBAAiB;AACxE,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,SAAO;AAAA,IACL,QAAQ,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI;AAAA,IACpC,gBAAgB;AAAA,EAClB;AACF;AAEA,IAAM,0BAA0B,CAC9B,UACA,WACA,UAGI,CAAC,MACyB;AAC9B,QAAM,KAAK,eAAe,UAAU,QAAQ,iBAAiB;AAC7D,QAAM,aAAa,YAAY,EAAE,GAAG,IAAI,QAAQ,UAAU,IAAI;AAC9D,SAAO,QAAQ,mCACX;AAAA,IACE,GAAG;AAAA,IACH,uCAAuC,CAAC,GAAG,QAAQ,gCAAgC;AAAA,EACrF,IACA;AACN;AAEA,IAAM,6BAA6B,CACjC,WACA,WACA,oBAA4C,CAAC,MACjB;AAC5B,QAAM,UAAmC;AAAA,IACvC,QAAQ,YAAY,QAAQ,aAAa,yBAAyB;AAAA,EACpE;AACA,MACE,kBAAkB,SAAS,KAC1B,IAAI,SAAS,SAAS,KACrB,IAAI,IAAI,SAAS,EAAE,aAAa,WAChC,kBAAkB,cAAc,MAClC;AACA,IAAC,QAA8D,2BAAqB,IAAI;AAAA,EAC1F;AACA,SAAO;AACT;AASA,IAAM,iBAAiB,CACrB,cACA,WACqB;AACrB,MAAI,CAAC,aAAc,QAAa,WAAK;AACrC,SAAO,WAAW,UACR,wBAAkB,YAAY,IAC9B,uBAAiB,YAAY;AACzC;AAEA,IAAM,oBAAoB,CAAC,OAAyD;AAAA,EAClF,cAAc,EAAE;AAAA,EAChB,YAAY,EAAE;AAAA,EACd,eAAe,EAAE;AAAA,EACjB,YAAY,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;AAAA,EAC9D,OAAO,EAAE;AACX;AAOA,IAAM,eAAe,OAAO,aAA0C;AACpE,QAAM,OAAO,MAAM,SAChB,MAAM,EACN,KAAK,EACL;AAAA,IACC,CAAC,UAAmB;AAAA,IACpB,MAAM;AAAA,EACR;AACF,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,EAAE,cAAe,OAAmC;AAC3F,WAAO;AAAA,EACT;AACA,QAAM,EAAE,UAAU,UAAU,GAAG,KAAK,IAAI;AACxC,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS;AAAA,EACpB,CAAC;AACH;AAEA,IAAM,+BAA+B,OACnC,IACA,QACA,aAEA;AAAA,EACE,MAAY,0CAAoC,IAAI,QAAQ,MAAM,aAAa,QAAQ,CAAC;AAC1F;AAwBK,IAAM,4BAA4B,CACvC,UAEA,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,UAAM,KAAK,wBAAwB,MAAM,UAAU,MAAM,WAAW;AAAA,MAClE,kCAAkC,MAAM;AAAA,MACxC,mBAAmB,MAAM;AAAA,IAC3B,CAAC;AACD,UAAM,SAAuB,EAAE,WAAW,MAAM,SAAS;AACzD,UAAM,aAAa;AAAA,MACjB,MAAM;AAAA,MACN,MAAM,cAAc;AAAA,IACtB;AAMA,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,MAAM,MAAM;AAAA,MACZ,cAAc,MAAM;AAAA,MACpB,eAAe,MAAM;AAAA,IACvB,CAAC;AACD,QAAI,MAAM,UAAU;AAClB,aAAO,IAAI,YAAY,MAAM,QAAQ;AAAA,IACvC;AACA,UAAM,WAAW,MAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,2BAA2B,MAAM,UAAU,MAAM,WAAW,MAAM,iBAAiB;AAAA,IACrF;AACA,WAAO,MAAM,6BAA6B,IAAI,QAAQ,QAAQ;AAAA,EAChE;AAAA,EACA,OAAO,CAAC,UAAU;AACpB,CAAC,EAAE,KAAK,OAAO,MAAM,yBAAyB,CAAC;AAoB1C,IAAM,4BAA4B,CACvC,UAEA,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,UAAM,KAAK,eAAe,MAAM,UAAU,MAAM,iBAAiB;AACjE,UAAM,SAAuB,EAAE,WAAW,MAAM,SAAS;AACzD,UAAM,aAAa;AAAA,MACjB,MAAM;AAAA,MACN,MAAM,cAAc;AAAA,IACtB;AACA,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,MAAM,UAAU,MAAM,OAAO,SAAS,GAAG;AAC3C,aAAO,IAAI,SAAS,MAAM,OAAO,KAAK,MAAM,kBAAkB,GAAG,CAAC;AAAA,IACpE;AACA,QAAI,MAAM,UAAU;AAClB,aAAO,IAAI,YAAY,MAAM,QAAQ;AAAA,IACvC;AACA,UAAM,WAAW,MAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,2BAA2B,MAAM,UAAU,MAAM,WAAW,MAAM,iBAAiB;AAAA,IACrF;AACA,UAAM,SAAS,MAAY,uCAAiC,IAAI,QAAQ,QAAQ;AAChF,WAAO,kBAAkB,MAAM;AAAA,EACjC;AAAA,EACA,OAAO,CAAC,UAAU;AACpB,CAAC,EAAE,KAAK,OAAO,MAAM,yBAAyB,CAAC;AAwB1C,IAAM,qBAAqB,CAChC,UAEA,OAAO,WAAW;AAAA,EAChB,KAAK,YAAY;AACf,UAAM,KAAK,wBAAwB,MAAM,UAAU,MAAM,WAAW;AAAA,MAClE,kCAAkC,MAAM;AAAA,MACxC,mBAAmB,MAAM;AAAA,IAC3B,CAAC;AACD,UAAM,SAAuB,EAAE,WAAW,MAAM,SAAS;AACzD,UAAM,aAAa;AAAA,MACjB,MAAM;AAAA,MACN,MAAM,cAAc;AAAA,IACtB;AACA,UAAM,cAAc,IAAI,gBAAgB;AACxC,QAAI,MAAM,UAAU,MAAM,OAAO,SAAS,GAAG;AAC3C,kBAAY,IAAI,SAAS,MAAM,OAAO,KAAK,MAAM,kBAAkB,GAAG,CAAC;AAAA,IACzE;AACA,QAAI,MAAM,UAAU;AAClB,kBAAY,IAAI,YAAY,MAAM,QAAQ;AAAA,IAC5C;AACA,UAAM,uBACJ,MAAM,KAAK,YAAY,KAAK,CAAC,EAAE,SAAS,IAAI,cAAc;AAC5D,UAAM,WAAW,MAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,QACE,GAAG,2BAA2B,MAAM,UAAU,MAAM,WAAW,MAAM,iBAAiB;AAAA,QACtF;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAY;AAAA,MACzB;AAAA,MACA;AAAA,MACA,MAAM,aAAa,QAAQ;AAAA,IAC7B;AACA,WAAO,kBAAkB,MAAM;AAAA,EACjC;AAAA,EACA,OAAO,CAAC,UAAU;AACpB,CAAC,EAAE,KAAK,OAAO,MAAM,yBAAyB,CAAC;AAM1C,IAAM,qBAAqB,CAAC,UAIpB;AACb,MAAI,MAAM,cAAc,KAAM,QAAO;AACrC,QAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,QAAM,OAAO,MAAM,UAAU;AAC7B,SAAO,MAAM,aAAa,MAAM;AAClC;","names":[]}

package/dist/{chunk-QEKKFEJL.js → chunk-5Q35SELN.js}

@@ -24,7 +24,7 @@ import {
   isValidPattern,
   resolveEffectivePolicy,
   rowToToolPolicy
-} from "./chunk-6EED5LAL.js";
+} from "./chunk-PCSRC6WP.js";
 import {
   OAUTH2_DEFAULT_TIMEOUT_MS,
   assertSupportedOAuthEndpointUrl,
@@ -35,9 +35,10 @@ import {
   exchangeAuthorizationCode,
   exchangeClientCredentials,
   providerAuthorizeExtras,
+  rebindTokenEndpointHostToCallbackDomain,
   refreshAccessToken,
   shouldRefreshToken
-} from "./chunk-EIHWBY6T.js";
+} from "./chunk-4XPVLX62.js";
 import {
   AuthTemplateSlug,
   ConnectionAddress,
@@ -549,6 +550,11 @@ var coreTables = defineTables({
       refresh_item_id: nullableTextColumn("refresh_item_id"),
       expires_at: nullableBigintColumn("expires_at"),
       oauth_scope: nullableTextColumn("oauth_scope"),
+      // Per-connection token endpoint override. Set only when the code was
+      // redeemed at a region other than the oauth_client's configured token host
+      // (multi-site providers like Datadog signal the org's region on the
+      // callback). Null means refresh uses the oauth_client's `token_url`.
+      oauth_token_url: nullableTextColumn("oauth_token_url"),
       provider_state: nullableJsonColumn("provider_state"),
       created_at: dateColumn("created_at"),
       updated_at: dateColumn("updated_at")
@@ -3114,10 +3120,26 @@ var ConnectionOutput = Schema2.Struct({
 });
 var ConnectionsListInput = Schema2.Struct({
   integration: Schema2.optional(Schema2.String),
-  owner: Schema2.optional(OwnerSchema)
+  owner: Schema2.optional(OwnerSchema),
+  verbose: Schema2.optional(Schema2.Boolean)
+});
+var ConnectionListItem = Schema2.Struct({
+  owner: OwnerSchema,
+  name: Schema2.String,
+  integration: Schema2.String,
+  template: Schema2.String,
+  provider: Schema2.String,
+  address: Schema2.String,
+  identityLabel: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  description: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  expiresAt: Schema2.NullOr(Schema2.Number),
+  oauthClient: Schema2.NullOr(Schema2.String),
+  oauthClientOwner: Schema2.NullOr(OwnerSchema),
+  oauthScopeCount: Schema2.NullOr(Schema2.Number),
+  oauthScope: Schema2.optional(Schema2.NullOr(Schema2.String))
 });
 var ConnectionsListOutput = Schema2.Struct({
-  connections: Schema2.Array(ConnectionOutput)
+  connections: Schema2.Array(ConnectionListItem)
 });
 var ConnectionCreateHandoffInput = Schema2.Struct({
   integration: Schema2.String,
@@ -3332,6 +3354,22 @@ var connectionToOutput = (connection) => ({
   oauthClientOwner: connection.oauthClientOwner ?? null,
   oauthScope: connection.oauthScope ?? null
 });
+var oauthScopeCount = (scope) => scope == null ? null : scope.split(/\s+/).filter(Boolean).length;
+var connectionToListItem = (connection, verbose) => ({
+  owner: connection.owner,
+  name: String(connection.name),
+  integration: String(connection.integration),
+  template: String(connection.template),
+  provider: String(connection.provider),
+  address: String(connection.address),
+  identityLabel: connection.identityLabel ?? null,
+  description: connection.description ?? null,
+  expiresAt: connection.expiresAt ?? null,
+  oauthClient: connection.oauthClient == null ? null : String(connection.oauthClient),
+  oauthClientOwner: connection.oauthClientOwner ?? null,
+  oauthScopeCount: oauthScopeCount(connection.oauthScope),
+  ...verbose ? { oauthScope: connection.oauthScope ?? null } : {}
+});
 var toolToOutput = (toolRow) => ({
   address: String(toolRow.address),
   owner: toolRow.owner,
@@ -3430,7 +3468,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
         }),
         tool({
           name: "connections.list",
-          description: "List saved connections (the credential for one integration). Never returns the credential value. Optionally filter by integration or owner.",
+          description: "List saved connections (the credential for one integration). Never returns the credential value. Optionally filter by integration or owner. OAuth scopes are summarized as `oauthScopeCount` by default; pass `verbose: true` to include the full `oauthScope` grant string per connection.",
           inputSchema: ConnectionsListInputStd,
           outputSchema: ConnectionsListOutputStd,
           execute: (input, { ctx }) => Effect5.map(
@@ -3439,7 +3477,9 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
               owner: input.owner === void 0 ? void 0 : input.owner
             }),
             (connections) => ({
-              connections: connections.map(connectionToOutput)
+              connections: connections.map(
+                (connection) => connectionToListItem(connection, input.verbose === true)
+              )
             })
           )
         }),
@@ -4041,6 +4081,13 @@ var looseDb = (db) => db;
 var accessItemId = (owner, integration, name) => `oauth:${owner}:${integration}:${name}`;
 var refreshItemIdFor = (accessId) => `${accessId}:refresh`;
 var dedupeScopes = (scopes) => [...new Set(scopes)];
+var recordedOAuthScope = (token, requestedScopes) => {
+  if (token.scope == null) return requestedScopes.join(" ") || null;
+  const granted = token.scope.split(/\s+/).filter(Boolean);
+  const coveredByRefreshToken = token.refresh_token && requestedScopes.includes("offline_access") ? ["offline_access"] : [];
+  const recorded = dedupeScopes([...granted, ...coveredByRefreshToken]);
+  return recorded.join(" ") || null;
+};
 var decodeJsonPayload = Schema4.decodeUnknownOption(Schema4.UnknownFromJsonString);
 var requestedScopesFromPayload = (payload) => {
   const decoded = typeof payload === "string" ? decodeJsonPayload(payload).pipe(Option2.getOrElse(() => payload)) : payload;
@@ -4332,7 +4379,9 @@ var makeOAuthService = (deps) => {
         client,
         token,
         requestedScopes,
-        input.clientOwner
+        input.clientOwner,
+        // client_credentials has no callback, so no regional rebind applies.
+        null
       ).pipe(
         Effect7.mapError(
           (cause) => new OAuthStartError({
@@ -4445,8 +4494,12 @@ var makeOAuthService = (deps) => {
         restartRequired: true
       });
     }
+    const tokenUrl = rebindTokenEndpointHostToCallbackDomain(
+      client.tokenUrl,
+      input.callbackDomain
+    );
     const token = yield* exchangeAuthorizationCode({
-      tokenUrl: client.tokenUrl,
+      tokenUrl,
       clientId: client.clientId,
       clientSecret: client.clientSecret,
       redirectUrl: session.redirectUrl,
@@ -4476,7 +4529,10 @@ var makeOAuthService = (deps) => {
       // The scopes `start` requested (the integration's declared set), persisted
       // on the session. Empty only for a corrupt/legacy session with no payload.
       session.requestedScopes ?? [],
-      session.clientOwner
+      session.clientOwner,
+      // Persist the regional token endpoint ONLY when it differs from the
+      // client's configured one, so refresh redeems against the same region.
+      tokenUrl === client.tokenUrl ? null : tokenUrl
     ).pipe(
       Effect7.mapError(
         (cause) => new OAuthCompleteError({
@@ -4489,7 +4545,7 @@ var makeOAuthService = (deps) => {
     yield* deleteSession(input.state);
     return connection;
   });
-  const mintFromToken = (target, client, token, requestedScopes, clientOwner) => Effect7.gen(function* () {
+  const mintFromToken = (target, client, token, requestedScopes, clientOwner, oauthTokenUrl) => Effect7.gen(function* () {
     const provider = deps.defaultWritableProvider();
     if (!provider || !provider.set) {
       return yield* new StorageError({
@@ -4516,12 +4572,12 @@ var makeOAuthService = (deps) => {
       oauthClientOwner: clientOwner,
       refreshItemId,
       expiresAt: expiresAtFrom(token),
-      // Benign fallback (kept by design): record the granted scope the AS
-      // echoed back; when it omits `scope` (some servers do), fall back to the
-      // scopes we requested (declared ∪ client). This only affects the recorded
-      // scope label, not what the token can do, so a guess here masks no
-      // misconfiguration.
-      oauthScope: token.scope ?? (requestedScopes.join(" ") || null)
+      // Record the granted scope the AS echoed back. Some providers, including
+      // Microsoft, issue a refresh token for `offline_access` but omit that
+      // non-resource scope from the token `scope` string, so preserve it when
+      // the refresh token proves it was granted.
+      oauthScope: recordedOAuthScope(token, requestedScopes),
+      oauthTokenUrl
     });
   });
   const deleteSession = (state) => deps.fuma.use(
@@ -4573,6 +4629,7 @@ var makeOAuthService = (deps) => {
 
 // src/executor.ts
 var PLUGIN_STORAGE_DELETE_KEY_BATCH_SIZE = 90;
+var PLUGIN_STORAGE_CREATE_ROW_BATCH_SIZE = 90;
 var MAX_APPROVAL_ARGUMENT_PREVIEW_CHARS = 4e3;
 var acceptAllHandler = () => Effect8.succeed(ElicitationResponse.make({ action: "accept" }));
 var resolveElicitationHandler = (onElicitation) => onElicitation === "accept-all" ? acceptAllHandler : onElicitation;
@@ -4970,20 +5027,26 @@ var makePluginStorageFacade = (input) => {
     if (uniqueEntries.length === 0) return;
     yield* deleteManyImpl(owner, os.subject, uniqueEntries);
     const now = /* @__PURE__ */ new Date();
-    yield* input.core.createMany(
-      "plugin_storage",
-      uniqueEntries.map((entry) => ({
-        tenant,
-        owner: os.owner,
-        subject: os.subject,
-        plugin_id: input.pluginId,
-        collection: entry.collection,
-        key: entry.key,
-        data: entry.data,
-        created_at: now,
-        updated_at: now
-      }))
-    );
+    for (let offset = 0; offset < uniqueEntries.length; offset += PLUGIN_STORAGE_CREATE_ROW_BATCH_SIZE) {
+      const batchEntries = uniqueEntries.slice(
+        offset,
+        offset + PLUGIN_STORAGE_CREATE_ROW_BATCH_SIZE
+      );
+      yield* input.core.createMany(
+        "plugin_storage",
+        batchEntries.map((entry) => ({
+          tenant,
+          owner: os.owner,
+          subject: os.subject,
+          plugin_id: input.pluginId,
+          collection: entry.collection,
+          key: entry.key,
+          data: entry.data,
+          created_at: now,
+          updated_at: now
+        }))
+      );
+    }
   });
   const removeManyImpl = (owner, entries) => Effect8.gen(function* () {
     const os = ownerSubject(owner);
@@ -5236,8 +5299,9 @@ var createExecutor = (config) => Effect8.gen(function* () {
     }
     const clientSecret = clientRow.client_secret_item_id ? (yield* provider.get(ProviderItemId.make(String(clientRow.client_secret_item_id)))) ?? "" : "";
     const grantedScopes = row.oauth_scope ? String(row.oauth_scope).split(/\s+/).filter(Boolean) : [];
+    const tokenUrl = row.oauth_token_url ? String(row.oauth_token_url) : String(clientRow.token_url);
     const token = String(clientRow.grant) === "client_credentials" ? yield* exchangeClientCredentials({
-      tokenUrl: String(clientRow.token_url),
+      tokenUrl,
       clientId: String(clientRow.client_id),
       clientSecret,
       scopes: grantedScopes,
@@ -5264,7 +5328,7 @@ var createExecutor = (config) => Effect8.gen(function* () {
         return yield* reauth("Stored refresh token could not be resolved.");
       }
       return yield* refreshAccessToken({
-        tokenUrl: String(clientRow.token_url),
+        tokenUrl,
         clientId: String(clientRow.client_id),
         clientSecret,
         refreshToken,
@@ -5804,6 +5868,7 @@ var createExecutor = (config) => Effect8.gen(function* () {
           refresh_item_id: input.refreshItemId,
           expires_at: input.expiresAt,
           oauth_scope: input.oauthScope,
+          oauth_token_url: input.oauthTokenUrl ?? null,
           updated_at: now
         };
         if (existing) {
@@ -5834,6 +5899,7 @@ var createExecutor = (config) => Effect8.gen(function* () {
             refresh_item_id: input.refreshItemId,
             expires_at: input.expiresAt,
             oauth_scope: input.oauthScope,
+            oauth_token_url: input.oauthTokenUrl ?? null,
             provider_state: null,
             created_at: now,
             updated_at: now
@@ -5861,6 +5927,7 @@ var createExecutor = (config) => Effect8.gen(function* () {
       refresh_item_id: input.refreshItemId,
       expires_at: input.expiresAt,
       oauth_scope: input.oauthScope,
+      oauth_token_url: input.oauthTokenUrl ?? null,
       provider_state: null,
       created_at: now,
       updated_at: now
@@ -6672,4 +6739,4 @@ export {
   collectTables,
   createExecutor
 };
-//# sourceMappingURL=chunk-QEKKFEJL.js.map
+//# sourceMappingURL=chunk-5Q35SELN.js.map