@frontmcp/auth 1.12.0-rc.1 → 1.12.1

package/browser/session/authorization.store.mjs

@@ -1,6 +1,7 @@
 // libs/auth/src/session/authorization.store.ts
 import { internalZ as z } from "@frontmcp/lazy-zod";
 import { randomUUID, sha256Base64url } from "@frontmcp/utils";
+import { AuthFlowError } from "../errors/auth-internal.errors.mjs";
 var pkceChallengeSchema = z.object({
   challenge: z.string().min(43).max(128),
   method: z.literal("S256")
@@ -116,6 +117,25 @@ function buildRefreshTokenRecord(params) {
     providerTokensId: params.providerTokensId
   };
 }
+function isRedeemableCode(record) {
+  return !!record && !record.used && Date.now() <= record.expiresAt;
+}
+function isRotatableRefreshToken(record) {
+  return !!record && !record.revoked && Date.now() <= record.expiresAt;
+}
+function authorizationCodeRedeemedError() {
+  return new AuthFlowError(
+    "This authorization code was already redeemed by another token request, or it expired. Start a new authorization to get a new code.",
+    "AUTHORIZATION_CODE_REDEEMED"
+  );
+}
+function refreshTokenRedeemedError() {
+  return new AuthFlowError(
+    "This refresh token was already rotated by another token request, or it was revoked or expired. Sign in again to get a new refresh token.",
+    "REFRESH_TOKEN_REDEEMED"
+  );
+}
+var COMPARE_AND_DELETE_SCRIPT = `if redis.call('GET', KEYS[1]) == ARGV[1] then return redis.call('DEL', KEYS[1]) end return 0`;
 function verifyPkce(codeVerifier, challenge) {
   if (challenge.method !== "S256") {
     return false;
@@ -151,6 +171,7 @@ var InMemoryAuthorizationStore = class {
   }
   async markCodeUsed(code, issuedRefreshToken) {
     const record = this.codes.get(code);
+    if (issuedRefreshToken === void 0 && !isRedeemableCode(record)) throw authorizationCodeRedeemedError();
     if (record) {
       record.used = true;
       if (issuedRefreshToken) record.issuedRefreshToken = issuedRefreshToken;
@@ -192,7 +213,9 @@ var InMemoryAuthorizationStore = class {
     }
   }
   async rotateRefreshToken(oldToken, newRecord) {
-    await this.revokeRefreshToken(oldToken);
+    const record = this.refreshTokens.get(oldToken);
+    if (!isRotatableRefreshToken(record)) throw refreshTokenRedeemedError();
+    record.revoked = true;
     newRecord.previousToken = oldToken;
     await this.storeRefreshToken(newRecord);
   }
@@ -268,6 +291,14 @@ var RedisAuthorizationStore = class {
     return JSON.parse(data);
   }
   async markCodeUsed(code, issuedRefreshToken) {
+    if (issuedRefreshToken === void 0) {
+      const claimed = await this.claim("code", code, isRedeemableCode, (record2) => ({
+        ...record2,
+        used: true
+      }));
+      if (!claimed) throw authorizationCodeRedeemedError();
+      return;
+    }
     const record = await this.getAuthorizationCode(code);
     if (record) {
       record.used = true;
@@ -311,12 +342,31 @@ var RedisAuthorizationStore = class {
     }
   }
   async rotateRefreshToken(oldToken, newRecord) {
-    await this.revokeRefreshToken(oldToken);
+    const claimed = await this.claim("refresh", oldToken, isRotatableRefreshToken, (record) => ({
+      ...record,
+      revoked: true
+    }));
+    if (!claimed) throw refreshTokenRedeemedError();
     newRecord.previousToken = oldToken;
     await this.storeRefreshToken(newRecord);
   }
   async cleanup() {
   }
+  /**
+   * Replace the record under `type:id` with `update(record)` while `isLive(record)`. The compare-and-delete lets
+   * one request win: false when the record is missing or not live, or another request changed it first.
+   */
+  async claim(type, id, isLive, update) {
+    const key = this.key(type, id);
+    const raw = await this.redis.get(key);
+    if (!raw) return false;
+    const record = JSON.parse(raw);
+    if (!isLive(record)) return false;
+    if (await this.redis.eval(COMPARE_AND_DELETE_SCRIPT, 1, key, raw) !== 1) return false;
+    const ttl = Math.ceil((record.expiresAt - Date.now()) / 1e3);
+    await this.redis.set(key, JSON.stringify(update(record)), "EX", Math.max(ttl, 1));
+    return true;
+  }
 };
 export {
   AUTH_CODE_TTL_MS,
@@ -325,12 +375,16 @@ export {
   REFRESH_TOKEN_TTL_MS,
   RedisAuthorizationStore,
   authorizationCodeRecordSchema,
+  authorizationCodeRedeemedError,
   buildCodeRecord,
   buildPendingRecord,
   buildRefreshTokenRecord,
   generateAuthorizationCode,
   generatePkceChallenge,
   generateRefreshTokenValue,
+  isRedeemableCode,
+  isRotatableRefreshToken,
   pkceChallengeSchema,
+  refreshTokenRedeemedError,
   verifyPkce
 };

package/browser/session/consent.store.mjs

@@ -1,6 +1,7 @@
 // libs/auth/src/session/consent.store.ts
 function consentRecordKey(userSub, clientId) {
-  return `consent:${userSub}:${clientId}`;
+  const escapedSub = userSub.replace(/%/g, "%25").replace(/:/g, "%3A");
+  return `consent:${escapedSub}:${clientId}`;
 }
 var InMemoryConsentStore = class {
   records = /* @__PURE__ */ new Map();

package/browser/session/credentials-accessor.impl.mjs

@@ -1,4 +1,5 @@
 // libs/auth/src/session/credentials-accessor.impl.ts
+import { escapeControlCharacters } from "@frontmcp/utils";
 import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
 import { buildCredentialResumeUrl, signCredentialResumeToken } from "./credential-resume-link.mjs";
 var CredentialsAccessorImpl = class {
@@ -44,7 +45,9 @@ var CredentialsAccessorImpl = class {
     }
     const token = signCredentialResumeToken({ sub, key, context, ttlMs: this.resumeTtlMs }, this.signingSecret);
     const resumeUrl = buildCredentialResumeUrl(this.basePath, token);
-    this.logger.debug(`CredentialsAccessor: credential "${key}" not connected; issued resume link`);
+    this.logger.debug(
+      `CredentialsAccessor: credential "${escapeControlCharacters(key)}" not connected; issued resume link`
+    );
     return {
       connected: false,
       key,

package/browser/session/incremental-auth-ticket.mjs

@@ -23,6 +23,7 @@ function signIncrementalAuthTicket(input, secret) {
         name: input.name
       })
     } : {},
+    ...input.audience !== void 0 ? { aud: input.audience } : {},
     jti,
     exp: Date.now() + (input.ttlMs ?? DEFAULT_INCREMENTAL_TICKET_TTL_MS)
   };
@@ -44,6 +45,7 @@ function verifyIncrementalAuthTicket(token, secret, now = Date.now()) {
   if (!Number.isFinite(payload.exp)) return null;
   if (payload.toolId !== void 0 && typeof payload.toolId !== "string") return null;
   if (payload.profile !== void 0 && typeof payload.profile !== "string") return null;
+  if (payload.aud !== void 0 && typeof payload.aud !== "string") return null;
   if (payload.priorAppIds !== void 0 && (!Array.isArray(payload.priorAppIds) || payload.priorAppIds.some((id) => typeof id !== "string"))) {
     return null;
   }

package/browser/session/redis-session.store.mjs

@@ -1,9 +1,10 @@
 // libs/auth/src/session/redis-session.store.ts
 import { randomUUID, RedisStorageAdapter } from "@frontmcp/utils";
 import { SessionIdEmptyError } from "../errors/auth-internal.errors.mjs";
-import { signSession, verifyOrParseSession } from "./session-crypto.mjs";
+import { signSession, verifySession } from "./session-crypto.mjs";
 import { SessionRateLimiter } from "./session-rate-limiter.mjs";
 import {
+  sessionMaxLifetimeAt,
   storedSessionSchema
 } from "./transport-session.types.mjs";
 var RedisSessionStore = class {
@@ -110,7 +111,7 @@ var RedisSessionStore = class {
     try {
       let parsed;
       if (this.security.enableSigning) {
-        parsed = verifyOrParseSession(raw, { secret: this.security.signingSecret });
+        parsed = verifySession(raw, { secret: this.security.signingSecret });
         if (!parsed) {
           this.logger?.warn("[RedisSessionStore] Session signature verification failed", {
             sessionId: sessionId.slice(0, 20)
@@ -131,10 +132,11 @@ var RedisSessionStore = class {
         return null;
       }
       const session = result.data;
-      if (session.maxLifetimeAt && session.maxLifetimeAt < Date.now()) {
+      const maxLifetimeAt = sessionMaxLifetimeAt(session, this.security.maxLifetimeMs);
+      if (maxLifetimeAt && maxLifetimeAt < Date.now()) {
         this.logger?.info("[RedisSessionStore] Session exceeded max lifetime", {
           sessionId: sessionId.slice(0, 20),
-          maxLifetimeAt: session.maxLifetimeAt
+          maxLifetimeAt
         });
         await this.delete(sessionId);
         return null;

package/browser/session/secure-store-backends.mjs

@@ -1,4 +1,5 @@
 // libs/auth/src/session/secure-store-backends.ts
+import { base64urlEncode, randomBytes } from "@frontmcp/utils";
 import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
 import { VaultEncryption } from "./vault-encryption.mjs";
 var DEFAULT_KEY_PREFIX = "mcp:secret:";
@@ -14,7 +15,7 @@ var EncryptedStorageSecureStoreBackend = class {
     this.keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;
     this.logger = options.logger ?? noopAuthLogger;
     this.encryption = new VaultEncryption({
-      pepper: options.pepper,
+      pepper: options.pepper?.trim() ? options.pepper : base64urlEncode(randomBytes(32)),
       hkdfInfo: "frontmcp-secure-store-v1"
     });
   }

package/browser/session/secure-store.factory.mjs

@@ -56,6 +56,12 @@ async function createSecureStore(options) {
     return { backend: config.backend, scope, ttlMs, kind: "custom" };
   }
   const kind = isSqliteConfig(config) ? "sqlite" : isRedisConfig(config) ? "redis" : "memory";
+  const effectivePepper = readPepper(config) ?? pepper;
+  if (kind !== "memory" && !effectivePepper?.trim()) {
+    throw new SecureStoreConfigError(
+      `the ${kind} backing encrypts the secrets with a pepper, and none was given. Set VAULT_SECRET or JWT_SECRET (or pass pepper to createSecureStore()), or set secureStore.encryption.pepper.`
+    );
+  }
   let adapter;
   if (storage) {
     adapter = storage;
@@ -67,7 +73,7 @@ async function createSecureStore(options) {
   }
   const backend = new EncryptedStorageSecureStoreBackend({
     storage: adapter,
-    pepper: readPepper(config) ?? pepper,
+    pepper: effectivePepper,
     logger
   });
   return { backend, scope, ttlMs, kind, ...storage ? {} : { close: () => adapter.disconnect() } };

package/browser/session/storage/storage-authorization-vault.mjs

@@ -1,5 +1,9 @@
 // libs/auth/src/session/storage/storage-authorization-vault.ts
-import { randomUUID, TypedStorage } from "@frontmcp/utils";
+import {
+  escapeControlCharacters,
+  randomUUID,
+  TypedStorage
+} from "@frontmcp/utils";
 import {
   authorizationVaultEntrySchema
 } from "../authorization-vault.mjs";
@@ -45,7 +49,9 @@ var StorageAuthorizationVault = class {
   async update(id, updates) {
     const entry = await this.get(id);
     if (!entry) {
-      console.warn(`[StorageAuthorizationVault] Update failed: vault entry not found for id ${id}`);
+      console.warn(
+        `[StorageAuthorizationVault] Update failed: vault entry not found for id ${escapeControlCharacters(id)}`
+      );
       return;
     }
     const updated = {

package/browser/session/storage-authorization.store.mjs

@@ -1,11 +1,15 @@
 // libs/auth/src/session/storage-authorization.store.ts
-import { TypedStorage } from "@frontmcp/utils";
+import { StorageNotSupportedError, TypedStorage } from "@frontmcp/utils";
 import {
+  authorizationCodeRedeemedError,
   buildCodeRecord,
   buildPendingRecord,
   buildRefreshTokenRecord,
   generateAuthorizationCode,
-  generateRefreshTokenValue
+  generateRefreshTokenValue,
+  isRedeemableCode,
+  isRotatableRefreshToken,
+  refreshTokenRedeemedError
 } from "./authorization.store.mjs";
 var StorageAuthorizationStore = class {
   codeStore;
@@ -13,10 +17,12 @@ var StorageAuthorizationStore = class {
   refreshStore;
   namespace;
   storageIsNamespaced;
+  base;
   constructor(storage, options = {}) {
     this.namespace = options.namespace ?? "oauth";
     this.storageIsNamespaced = this.isNamespacedStorage(storage);
     const base = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
+    this.base = base;
     this.codeStore = new TypedStorage(base);
     this.pendingStore = new TypedStorage(base);
     this.refreshStore = new TypedStorage(base);
@@ -55,6 +61,14 @@ var StorageAuthorizationStore = class {
     return record;
   }
   async markCodeUsed(code, issuedRefreshToken) {
+    if (issuedRefreshToken === void 0) {
+      const claimed = await this.claim(this.codeStore, this.key("code", code), isRedeemableCode, (record2) => ({
+        ...record2,
+        used: true
+      }));
+      if (!claimed) throw authorizationCodeRedeemedError();
+      return;
+    }
     const record = await this.getAuthorizationCode(code);
     if (record) {
       record.used = true;
@@ -105,7 +119,16 @@ var StorageAuthorizationStore = class {
     }
   }
   async rotateRefreshToken(oldToken, newRecord) {
-    await this.revokeRefreshToken(oldToken);
+    const claimed = await this.claim(
+      this.refreshStore,
+      this.key("refresh", oldToken),
+      isRotatableRefreshToken,
+      (record) => ({
+        ...record,
+        revoked: true
+      })
+    );
+    if (!claimed) throw refreshTokenRedeemedError();
     newRecord.previousToken = oldToken;
     await this.storeRefreshToken(newRecord);
   }
@@ -117,6 +140,29 @@ var StorageAuthorizationStore = class {
   // ============================================
   // Internals
   // ============================================
+  /**
+   * Replace the record under `key` with `update(record)` while `isLive(record)`. The compare-and-delete lets one
+   * request win: false when the record is missing or not live, or another request changed it first.
+   */
+  async claim(store, key, isLive, update) {
+    const raw = await this.base.get(key);
+    if (raw === null) return false;
+    const record = JSON.parse(raw);
+    if (!isLive(record) || !await this.deleteIfEquals(key, raw)) return false;
+    await store.set(key, update(record), this.ttl(record.expiresAt));
+    return true;
+  }
+  /** Delete `key` only while it holds `expectedValue`, on an adapter that can do that in one step. */
+  deleteIfEquals(key, expectedValue) {
+    if (!this.base.deleteIfEquals) {
+      throw new StorageNotSupportedError(
+        "deleteIfEquals",
+        "this storage adapter",
+        "Use the memory, Redis, Upstash, Vercel KV or SQLite adapter, so an authorization code or refresh token is redeemed once."
+      );
+    }
+    return this.base.deleteIfEquals(key, expectedValue);
+  }
   ttl(expiresAtMs) {
     const ttl = Math.ceil((expiresAtMs - Date.now()) / 1e3);
     return { ttlSeconds: ttl > 0 ? ttl : 1 };

package/browser/session/storage-consent.store.mjs

@@ -12,7 +12,9 @@ var StorageConsentStore = class {
     this.storage = new TypedStorage(namespacedStorage);
   }
   async get(userSub, clientId) {
-    return this.storage.get(this.key(userSub, clientId));
+    const record = await this.storage.get(this.key(userSub, clientId));
+    if (!record || record.userSub !== userSub || record.clientId !== clientId) return null;
+    return record;
   }
   async set(record) {
     await this.storage.set(this.key(record.userSub, record.clientId), record);

package/browser/session/token-storage.factory.mjs

@@ -9,7 +9,7 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // libs/auth/src/session/token-storage.factory.ts
-import { MemoryStorageAdapter, RedisStorageAdapter } from "@frontmcp/utils";
+import { MemoryStorageAdapter, RedisStorageAdapter, requireOptionalModule } from "@frontmcp/utils";
 function isRedisTokenStorage(config) {
   return typeof config === "object" && config !== null && "redis" in config && !!config.redis;
 }
@@ -26,7 +26,10 @@ async function createTokenStorageAdapter(config) {
     return adapter;
   }
   if (isSqliteTokenStorage(config)) {
-    const { SqliteStorageAdapter } = __require("@frontmcp/storage-sqlite");
+    const { SqliteStorageAdapter } = requireOptionalModule(
+      "@frontmcp/storage-sqlite",
+      () => __require("@frontmcp/storage-sqlite")
+    );
     const adapter = new SqliteStorageAdapter({
       path: config.sqlite.path,
       encryption: config.sqlite.encryption,

package/browser/session/transport-session.types.mjs

@@ -1,5 +1,10 @@
 // libs/auth/src/session/transport-session.types.ts
 import { internalZ as z } from "@frontmcp/lazy-zod";
+function sessionMaxLifetimeAt(session, maxLifetimeMs) {
+  const configured = maxLifetimeMs && maxLifetimeMs > 0 ? session.createdAt + maxLifetimeMs : void 0;
+  const deadlines = [session.maxLifetimeAt, configured].filter((deadline) => !!deadline);
+  return deadlines.length > 0 ? Math.min(...deadlines) : void 0;
+}
 var transportProtocolSchema = z.enum([
   "legacy-sse",
   "sse",
@@ -97,6 +102,7 @@ export {
   legacySseTransportStateSchema,
   redisConfigSchema,
   sessionJwtPayloadSchema,
+  sessionMaxLifetimeAt,
   sseTransportStateSchema,
   statefulHttpTransportStateSchema,
   statelessHttpTransportStateSchema,

package/browser/session/utils/session-crypto.utils.mjs

@@ -1,5 +1,13 @@
 // libs/auth/src/session/utils/session-crypto.utils.ts
-import { decryptValue, encryptValue, getEnv, getMachineId, isProduction, sha256 } from "@frontmcp/utils";
+import {
+  decryptValue,
+  encryptValue,
+  getEnv,
+  getMachineId,
+  getRuntimeContext,
+  isProduction,
+  sha256
+} from "@frontmcp/utils";
 import { SessionSecretRequiredError } from "../../errors/auth-internal.errors.mjs";
 var cachedKey = null;
 function getKey() {
@@ -9,6 +17,11 @@ function getKey() {
     if (isProduction()) {
       throw new SessionSecretRequiredError("session ID encryption");
     }
+    if (getRuntimeContext().deployment === "distributed") {
+      throw new SessionSecretRequiredError(
+        "session ID encryption in a distributed deployment, whose responses carry the machine id: set MCP_SESSION_SECRET (openssl rand -hex 32)"
+      );
+    }
     console.warn(
       "[SessionIdUtils] Using machine ID as session encryption secret - NOT SECURE FOR PRODUCTION. Set MCP_SESSION_SECRET environment variable for secure session encryption."
     );

package/browser/session/vercel-kv-session.store.mjs

@@ -1,9 +1,10 @@
 // libs/auth/src/session/vercel-kv-session.store.ts
 import { randomUUID, VercelKvStorageAdapter } from "@frontmcp/utils";
 import { SessionIdEmptyError } from "../errors/auth-internal.errors.mjs";
-import { signSession, verifyOrParseSession } from "./session-crypto.mjs";
+import { signSession, verifySession } from "./session-crypto.mjs";
 import { SessionRateLimiter } from "./session-rate-limiter.mjs";
 import {
+  sessionMaxLifetimeAt,
   storedSessionSchema
 } from "./transport-session.types.mjs";
 var VercelKvSessionStore = class {
@@ -92,7 +93,7 @@ var VercelKvSessionStore = class {
     try {
       let parsed;
       if (this.security.enableSigning) {
-        parsed = verifyOrParseSession(raw, { secret: this.security.signingSecret });
+        parsed = verifySession(raw, { secret: this.security.signingSecret });
         if (!parsed) {
           this.logger?.warn("[VercelKvSessionStore] Session signature verification failed", {
             sessionId: sessionId.slice(0, 20)
@@ -113,10 +114,11 @@ var VercelKvSessionStore = class {
         return null;
       }
       const session = result.data;
-      if (session.maxLifetimeAt && session.maxLifetimeAt < Date.now()) {
+      const maxLifetimeAt = sessionMaxLifetimeAt(session, this.security.maxLifetimeMs);
+      if (maxLifetimeAt && maxLifetimeAt < Date.now()) {
         this.logger?.info("[VercelKvSessionStore] Session exceeded max lifetime", {
           sessionId: sessionId.slice(0, 20),
-          maxLifetimeAt: session.maxLifetimeAt
+          maxLifetimeAt
         });
         await this.delete(sessionId);
         return null;

package/cimd/cimd-redis.cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd-redis.cache.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd-redis.cache.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAa5E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,cAAe,YAAW,gBAAgB;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAElC,MAAM,EAAE,eAAe;IA+BnC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;OAKG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA0BhE;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAerE;;;;;;OAMG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB9F;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4BtE;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhD;;;;;OAKG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IA0B1F;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAK7B;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IA2BhC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"cimd-redis.cache.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd-redis.cache.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAa5E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,cAAe,YAAW,gBAAgB;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAElC,MAAM,EAAE,eAAe;IAiCnC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;OAKG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA0BhE;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAerE;;;;;;OAMG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB9F;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4BtE;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhD;;;;;OAKG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IA0B1F;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAK7B;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IA2BhC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/cimd/cimd.service.d.ts

@@ -122,6 +122,7 @@ export declare class CimdService {
      *
      * @param clientId - The URL from which the document was fetched
      * @param document - The document to validate
+     * @returns The parsed document, with the schema's defaults for the fields it leaves out
      */
     private validateDocument;
 }

package/cimd/cimd.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.service.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.service.ts"],"names":[],"mappings":"AAWA,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAY3F,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EASL,KAAK,eAAe,EAEpB,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAmBtB;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,YAAY,CAAC,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC;;OAEG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IAyBlE;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;OAGG;IACH,OAAO,CAAC,KAAK;IAUb,2FAA2F;IACrF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;;OAQG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqD5E;;;;;;OAMG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAUhF;;;;;;;;OAQG;IACH,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAmB7D;;;;;;;OAOG;IACG,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzG;;;;;OAKG;YACW,UAAU;IA2BxB,mHAAmH;IACnH,OAAO,CAAC,iBAAiB;IAezB;;;;OAIG;IACG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAOhD;;OAEG;YACW,qBAAqB;IAenC;;;;;OAKG;YACW,SAAS;IAqJvB;;OAEG;YACW,qBAAqB;IAyCnC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAiBzB"}
+{"version":3,"file":"cimd.service.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.service.ts"],"names":[],"mappings":"AAWA,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAY3F,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EASL,KAAK,eAAe,EAEpB,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAyBtB;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,YAAY,CAAC,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC;;OAEG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IAyBlE;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;OAGG;IACH,OAAO,CAAC,KAAK;IAUb,2FAA2F;IACrF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;;OAQG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqD5E;;;;;;OAMG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAUhF;;;;;;;;OAQG;IACH,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAmB7D;;;;;;;OAOG;IACG,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzG;;;;;OAKG;YACW,UAAU;IA2BxB,mHAAmH;IACnH,OAAO,CAAC,iBAAiB;IAezB;;;;OAIG;IACG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAOhD;;OAEG;YACW,qBAAqB;IAenC;;;;;OAKG;YACW,SAAS;IAsJvB;;OAEG;YACW,qBAAqB;IAyCnC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;CAmBzB"}

package/cimd/cimd.validator.d.ts

@@ -11,6 +11,8 @@ import type { CimdSecurityConfig } from './cimd.types';
  * @returns true if this is a CIMD client_id
  */
 export declare function isCimdClientId(clientId: string, allowInsecure?: boolean): boolean;
+/** Whether private addresses are refused for this host: with blockPrivateIPs, for every host but a localhost one under allowInsecureForTesting. */
+export declare function blocksPrivateAddressesFor(hostname: string, securityConfig?: Partial<CimdSecurityConfig>): boolean;
 /**
  * Validate a client_id URL for CIMD usage.
  *

package/cimd/cimd.validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.validator.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,UAAQ,GAAG,OAAO,CA4B/E;AAUD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CA6DvG;AAED;;GAEG;AACH,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAqBrE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgDxF;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzF;AAyGD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAgB5E"}
+{"version":3,"file":"cimd.validator.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,UAAQ,GAAG,OAAO,CA4B/E;AAUD,mJAAmJ;AACnJ,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAGjH;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CA4DvG;AAED;;GAEG;AACH,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAqBrE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgDxF;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKzF;AAyGD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAgB5E"}

package/detection/auth-provider-detection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider-detection.d.ts","sourceRoot":"","sources":["../../src/detection/auth-provider-detection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAcrD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;gCAOrC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;gCAQ5C,CAAC;AAMH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,wCAAwC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAiB7D;AAyBD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,WAAW,GAAG,SAAS,EACnC,IAAI,EAAE,WAAW,EAAE,GAClB,2BAA2B,CA+F7B;AA6BD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,UAAU,EAAE,WAAW,GAAG,SAAS,GAClC,OAAO,CAaT;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGtG;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpG"}
+{"version":3,"file":"auth-provider-detection.d.ts","sourceRoot":"","sources":["../../src/detection/auth-provider-detection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAcrD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;gCAOrC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;gCAQ5C,CAAC;AAMH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,wCAAwC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAiB7D;AAyBD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,WAAW,GAAG,SAAS,EACnC,IAAI,EAAE,WAAW,EAAE,GAClB,2BAA2B,CAyG7B;AAyCD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,GAAG,SAAS,EAChC,UAAU,EAAE,WAAW,GAAG,SAAS,GAClC,OAAO,CAaT;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGtG;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpG"}