@kamilio/wire 0.1.9 → 0.1.10

package/node_modules/toolcraft/node_modules/tiny-http-mcp-server/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -0,0 +1,841 @@
+import { snapshotOAuthPersistenceOptions } from "./persistence-options.js";
+import { createResourceBoundOAuthStores } from "./resource-bound-store.js";
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration, registrationMatchesRedirect } from "./client-registration.js";
+import { normalizeOAuthScope } from "./scope.js";
+import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
+import { isIP } from "node:net";
+import { registerOAuthClient } from "./register-client.js";
+import { URL } from "node:url";
+import { createAuthStoreClientStore, createAuthStoreSessionStore, assertPersistenceNamespace } from "./auth-store-session-store.js";
+import { createLoopbackAuthorizationSession, validateAuthorizationRedirect, snapshotLoopbackAuthorizationOptions } from "./loopback-authorization.js";
+import { createAuthorizationState } from "./authorization-state.js";
+import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
+import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError } from "./token-endpoint.js";
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { withOAuthSessionTransaction } from "./session-transaction.js";
+import { waitForOAuthOperation } from "./cancellable-operation.js";
+const MAX_JS_DATE_MS = 8_640_000_000_000_000;
+export function createOAuthClientProvider(options) {
+    if (isProviderOptions(options)) {
+        return options.provider;
+    }
+    return createDefaultOAuthClientProvider(options);
+}
+export function createDefaultOAuthClientProvider(options) {
+    const clock = options.now?.bind(options) ?? Date.now;
+    const browser = snapshotLoopbackAuthorizationOptions(options.browser);
+    const clientMode = options.client.mode;
+    const interactiveEnabled = options.allowInteractive !== false;
+    const sessionLockTimeoutMs = options.sessionLockTimeoutMs;
+    validateAuthorizationRedirect(browser);
+    assertPersistenceNamespace(options.persistenceNamespace);
+    const clientMetadata = getClientMetadata(options.client);
+    const requestedScope = clientMetadata?.scope;
+    const configuredClient = normalizeConfiguredClient(options.client);
+    const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
+    const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
+    const resourceIdentity = options.resourceIdentity, persistenceNamespace = options.persistenceNamespace, selectedSessionStore = options.sessionStore;
+    const suppliedGrant = options.initialGrant;
+    const capturedGrant = suppliedGrant === undefined ? undefined : { resource: suppliedGrant.resource, tokens: snapshotInitialGrantTokens(suppliedGrant.tokens) };
+    const authStore = options.authStore === undefined ? undefined : snapshotOAuthPersistenceOptions(options.authStore);
+    if (resourceIdentity !== undefined && selectedSessionStore !== undefined)
+        throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
+    const now = () => {
+        const timestamp = clock();
+        if (!Number.isSafeInteger(timestamp) || Math.abs(timestamp) > MAX_JS_DATE_MS)
+            throw new Error("OAuth clock must return valid epoch milliseconds");
+        return timestamp;
+    };
+    const registeredClients = new Map();
+    const resourceStores = resourceIdentity === undefined ? undefined :
+        createResourceBoundOAuthStores(authStore ?? {}, persistenceNamespace, resourceIdentity);
+    const sessionStore = resourceStores?.sessionStore ?? selectedSessionStore ?? createAuthStoreSessionStore(authStore, persistenceNamespace);
+    const clientStore = resourceStores?.clientStore ??
+        (authStore === undefined ? null : createAuthStoreClientStore(authStore, persistenceNamespace));
+    if (capturedGrant !== undefined) {
+        let resource;
+        try {
+            resource = new URL(capturedGrant.resource);
+        }
+        catch {
+            throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
+        }
+        if ((resource.protocol !== "http:" && resource.protocol !== "https:") || resource.username || resource.password || resource.href.includes("#"))
+            throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
+    }
+    const initialGrant = capturedGrant === undefined ? undefined : {
+        resource: canonicalizeResourceIndicator(capturedGrant.resource),
+        tokens: normalizeImportedTokens(capturedGrant.tokens, now),
+        client: configuredClient
+    };
+    if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
+        throw new Error("OAuth initial grant requires valid tokens and the original client ID");
+    if (initialGrant?.tokens !== undefined) {
+        if (requestedScope !== undefined && initialGrant.tokens.scope !== requestedScope)
+            throw new Error("OAuth initial grant does not match the requested OAuth scope");
+        try {
+            new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
+        }
+        catch {
+            throw new Error("OAuth initial grant access token is not a valid HTTP header value");
+        }
+    }
+    let initialGrantConsumed = false;
+    return {
+        async authenticate(input) {
+            input = { ...input, ...(input.discover === undefined ? {} : { discover: input.discover.bind(input) }) };
+            input.signal?.throwIfAborted();
+            assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+            const resource = canonicalizeResourceIndicator(input.requestUrl);
+            let session = await ensureAuthorizedSession(resource, undefined, input.fetch, true, false, input.signal);
+            if (session?.tokens !== undefined && !isExpired(session.tokens, now))
+                return { ...session.tokens };
+            if (session === null && !initialGrantConsumed && initialGrant?.resource === resource &&
+                initialGrant.tokens !== undefined && !isExpired(initialGrant.tokens, now))
+                return { ...initialGrant.tokens };
+            if (input.discover === undefined)
+                return;
+            const discovery = structuredClone(await waitForOAuthOperation(input.discover(), input.signal));
+            input.signal?.throwIfAborted();
+            assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
+            session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
+            if (session?.tokens === undefined || isExpired(session.tokens, now))
+                throw new Error("OAuth authentication did not establish a usable grant");
+            return { ...session.tokens };
+        },
+        async authorizeRequest(input) {
+            input = { ...input };
+            assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+            const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
+            const session = await ensureAuthorizedSession(requestUrl, undefined, input.fetch, false, false, input.signal);
+            const accessToken = session?.tokens?.accessToken;
+            if (session === null && !initialGrantConsumed && initialGrant?.resource === requestUrl &&
+                initialGrant.tokens !== undefined && !isExpired(initialGrant.tokens, now)) {
+                input.headers.set("Authorization", `Bearer ${initialGrant.tokens.accessToken}`);
+                return { ...initialGrant.tokens };
+            }
+            if (session === null ||
+                accessToken === undefined ||
+                session.tokens === undefined ||
+                isExpired(session.tokens, now)) {
+                return;
+            }
+            assertRequestMatchesResource(requestUrl, session.resource);
+            input.headers.set("Authorization", `Bearer ${accessToken}`);
+            return { ...session.tokens };
+        },
+        async handleUnauthorized(input) {
+            input = { ...input };
+            try {
+                input.signal?.throwIfAborted();
+                const presented = input.presentedTokens == null ? input.presentedTokens : normalizeStoredTokens(input.presentedTokens);
+                if (input.presentedTokens != null && presented === undefined)
+                    throw new Error("OAuth rejected-request provenance does not match its authorization header");
+                const challengeError = input.challenge?.params.error;
+                input = { ...input, discovery: structuredClone(input.discovery),
+                    ...(input.requestHeaders === undefined ? {} : { requestHeaders: new Headers(input.requestHeaders) }),
+                    ...(presented === undefined ? {} : { presentedTokens: presented }) };
+                assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+                const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
+                const discovery = input.discovery ?? structuredClone(await waitForOAuthOperation(input.discover?.() ?? Promise.reject(new Error("OAuth recovery requires metadata discovery")), input.signal));
+                if (discovery === undefined)
+                    throw new Error("OAuth recovery requires metadata discovery");
+                const resource = canonicalizeResourceIndicator(discovery.resource);
+                assertRequestMatchesResource(requestUrl, resource);
+                const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
+                const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : undefined);
+                let rejectedCurrentGrant = hasCachedAccessToken(cached) || (!initialGrantConsumed && initialGrant?.resource === resource);
+                let presentedTokens = input.presentedTokens;
+                if (input.presentedTokens !== undefined) {
+                    rejectedCurrentGrant = false;
+                    if (input.presentedTokens !== null) {
+                        const presented = input.presentedTokens;
+                        const header = input.requestHeaders?.get("Authorization") ?? "";
+                        const separator = header.indexOf(" ");
+                        if (header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+                            throw new Error("OAuth rejected-request provenance does not match its authorization header");
+                        presentedTokens = presented;
+                        rejectedCurrentGrant = currentTokens !== undefined && sameTokenGrant(currentTokens, presented);
+                    }
+                }
+                const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || (input.presentedTokens !== undefined && challengeError === undefined));
+                const session = await ensureAuthorizedSession(resource, {
+                    ...discovery,
+                    resource
+                }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
+                if (session?.tokens?.accessToken === undefined) {
+                    return { action: "fail" };
+                }
+                return { action: "retry" };
+            }
+            catch (error) {
+                input.signal?.throwIfAborted();
+                return {
+                    action: "fail",
+                    error: error instanceof Error ? error : new Error(String(error))
+                };
+            }
+        }
+    };
+    async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false, signal, rejectedTokens) {
+        signal?.throwIfAborted();
+        if (discovery !== undefined) {
+            if (getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer)
+                throw new Error("OAuth discovery authorization-server issuer mismatch");
+            assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+        }
+        const canonicalResource = canonicalizeResourceIndicator(resource);
+        return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
+            let session = await loadSession(canonicalResource);
+            if (resourceStores !== undefined) {
+                registeredClients.clear();
+                if (!resourceStores.initialGrantAllowed)
+                    initialGrantConsumed = true;
+            }
+            if (session !== null)
+                assertRegistrationIssuer(session.client, session.authorizationServer);
+            if (configuredClient !== null && discovery !== undefined)
+                assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+            if (session !== null && initialGrant?.resource === canonicalResource)
+                initialGrantConsumed = true;
+            signal?.throwIfAborted();
+            if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource
+                || getOwnString(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer
+                || (discovery !== undefined && discovery.authorizationServer !== session.authorizationServer))) {
+                await clearSession(canonicalResource);
+                session = null;
+            }
+            if (session === null && discovery !== undefined && !initialGrantConsumed && initialGrant?.resource === canonicalResource &&
+                initialGrant.tokens !== undefined && initialGrant.client !== null) {
+                session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
+                    client: initialGrant.client, tokens: initialGrant.tokens,
+                    ...(requestedScope === undefined ? {} : { requestedScope }), discovery: toStoredDiscovery(discovery) };
+                await saveSession(canonicalResource, session);
+                initialGrantConsumed = true;
+                signal?.throwIfAborted();
+            }
+            if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
+                forceRefresh = false;
+            const sessionDiscovery = resolveDiscovery(discovery, session);
+            if ((clientMode === "static" || configuredClient !== null || initialGrant !== undefined) && session !== null && (session.tokens !== undefined || session.refreshState === "pending")) {
+                const configured = configuredClient;
+                if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
+                    throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
+            }
+            if (requestedScope !== undefined && session?.tokens !== undefined && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
+                throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
+            if (configuredTokenMethod !== undefined && session !== null && (session.tokens !== undefined || session.refreshState === "pending") &&
+                (session.client.tokenEndpointAuthMethod ?? (session.client.clientSecret === undefined ? "none" : "client_secret_post")) !== configuredTokenMethod)
+                throw new Error("Stored session does not match the requested OAuth token endpoint authentication; select separate persistence or reset it");
+            if (session?.refreshState === "pending") {
+                if (!allowInteractive || !interactiveEnabled || sessionDiscovery === undefined)
+                    throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
+                return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
+            }
+            if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
+                return session;
+            }
+            if (session?.tokens?.refreshToken !== undefined &&
+                sessionDiscovery !== undefined &&
+                (forceRefresh || isExpired(session.tokens, now))) {
+                if (hasExpiredClientSecret(session.client, now)) {
+                    if (!allowInteractive || !interactiveEnabled || clientMode === "static" || configuredClient?.registration !== undefined)
+                        throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+                    return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
+                }
+                session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
+                if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
+                    return session;
+                }
+            }
+            if (forceRefresh && session?.tokens !== undefined) {
+                session = clearSessionTokens(session);
+                await saveSession(canonicalResource, session);
+            }
+            if (!allowInteractive || sessionDiscovery === undefined) {
+                return session;
+            }
+            if (!interactiveEnabled)
+                throw new Error("OAuth interactive authorization is disabled");
+            return authorizeSession(canonicalResource, session, sessionDiscovery, fetch, signal);
+        }, { signal, timeoutMs: sessionLockTimeoutMs });
+    }
+    async function refreshSession(resource, session, discovery, fetch, signal) {
+        signal?.throwIfAborted();
+        assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+        if (session.tokens?.refreshToken === undefined) {
+            return session;
+        }
+        assertTokenEndpointAuthentication(session.client, discovery.authorizationServerMetadata);
+        const pendingSession = { ...clearSessionTokens(session), refreshState: "pending" };
+        await saveSession(resource, pendingSession);
+        signal?.throwIfAborted();
+        let refreshAttempted = false;
+        let refreshedTokens;
+        while (true) {
+            try {
+                refreshedTokens = await refreshAccessToken({
+                    tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+                    clientId: session.client.clientId,
+                    clientSecret: session.client.clientSecret,
+                    tokenEndpointAuthMethod: session.client.tokenEndpointAuthMethod,
+                    refreshToken: session.tokens.refreshToken,
+                    resource,
+                    fetch, signal,
+                    now
+                });
+                break;
+            }
+            catch (error) {
+                signal?.throwIfAborted();
+                // Network errors, lost/malformed bodies and gateway failures cannot
+                // establish whether a rotating refresh token was already consumed.
+                if (!(error instanceof OAuthError) || !error.outcomeKnown)
+                    throw error;
+                if (error.error === "invalid_grant") {
+                    const clearedSession = clearSessionTokens(session);
+                    await saveSession(resource, clearedSession);
+                    return clearedSession;
+                }
+                if (shouldReRegisterStoredDynamicClient(error, await loadRegisteredClient(discovery.authorizationServer), false)) {
+                    await clearRegisteredClient(discovery.authorizationServer);
+                    await clearSession(resource);
+                    return null;
+                }
+                if (!refreshAttempted && isRetryableOAuthError(error)) {
+                    refreshAttempted = true;
+                    continue;
+                }
+                await saveSession(resource, session);
+                throw error;
+            }
+        }
+        const updatedSession = {
+            ...session,
+            tokens: {
+                ...refreshedTokens,
+                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken,
+                scope: refreshedTokens.scope ?? session.tokens.scope
+            },
+            discovery: toStoredDiscovery(discovery)
+        };
+        if (requestedScope !== undefined && normalizeOAuthScope(updatedSession.tokens?.scope ?? session.requestedScope) !== requestedScope)
+            throw new Error("OAuth refresh response does not match the requested OAuth scope; authorize again");
+        await saveSession(resource, updatedSession);
+        return updatedSession;
+    }
+    async function authorizeSession(resource, existingSession, discovery, fetch, signal) {
+        signal?.throwIfAborted();
+        assertS256PkceSupport(discovery.authorizationServerMetadata);
+        assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+        let currentSession = existingSession;
+        let transientRetryAttempted = false;
+        let reRegistrationAttempted = false;
+        while (true) {
+            const loopback = await createLoopbackAuthorizationSession({
+                ...browser,
+                signal: browser.signal === undefined ? signal : signal === undefined ? browser.signal : AbortSignal.any([signal, browser.signal])
+            });
+            let resolvedClient = null;
+            try {
+                resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
+                assertTokenEndpointAuthentication(resolvedClient.client, discovery.authorizationServerMetadata);
+                const sessionWithoutTokens = {
+                    resource,
+                    authorizationServer: discovery.authorizationServer,
+                    client: resolvedClient.client,
+                    ...(requestedScope === undefined ? {} : { requestedScope }),
+                    discovery: toStoredDiscovery(discovery)
+                };
+                await saveSession(resource, sessionWithoutTokens);
+                const verifier = generateCodeVerifier();
+                const challenge = generateCodeChallenge(verifier);
+                const authorizationUrl = buildAuthorizationUrl({
+                    metadata: discovery.authorizationServerMetadata,
+                    resource,
+                    clientId: resolvedClient.client.clientId,
+                    redirectUri: loopback.redirectUri,
+                    codeChallenge: challenge,
+                    clientMetadata
+                });
+                const code = await loopback.waitForCode(authorizationUrl);
+                const tokens = await exchangeAuthorizationCode({
+                    tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+                    clientId: resolvedClient.client.clientId,
+                    clientSecret: resolvedClient.client.clientSecret,
+                    tokenEndpointAuthMethod: resolvedClient.client.tokenEndpointAuthMethod,
+                    code,
+                    codeVerifier: verifier,
+                    redirectUri: loopback.redirectUri,
+                    resource,
+                    fetch, signal,
+                    now
+                });
+                if (requestedScope !== undefined && tokens.scope !== undefined && normalizeOAuthScope(tokens.scope) !== requestedScope)
+                    throw new Error("OAuth authorization response does not match the requested OAuth scope");
+                const session = {
+                    ...sessionWithoutTokens,
+                    tokens
+                };
+                await saveSession(resource, session);
+                return session;
+            }
+            catch (error) {
+                signal?.throwIfAborted();
+                if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
+                    reRegistrationAttempted = true;
+                    await clearRegisteredClient(discovery.authorizationServer);
+                    await clearSession(resource);
+                    currentSession = null;
+                    continue;
+                }
+                if (!transientRetryAttempted && isRetryableOAuthError(error)) {
+                    transientRetryAttempted = true;
+                    await clearSession(resource);
+                    currentSession = null;
+                    continue;
+                }
+                throw error;
+            }
+            finally {
+                loopback.close();
+            }
+        }
+    }
+    async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
+        parentSignal?.throwIfAborted();
+        if (clientMode === "static" || configuredClient !== null) {
+            if (configuredClient === null) {
+                throw new Error("OAuth client_id must not be blank");
+            }
+            assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(configuredClient, now))
+                throw new Error("OAuth client secret has expired; update the imported registration");
+            return {
+                kind: "static",
+                fromStoredRegistration: false,
+                client: configuredClient
+            };
+        }
+        const registrationEndpoint = getOwnString(discovery.authorizationServerMetadata, "registration_endpoint");
+        let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        const importedClient = existingSession?.client.registrationOwnership === "caller" ? existingSession.client :
+            storedClient?.registrationOwnership === "caller" ? storedClient : undefined;
+        if (importedClient !== undefined) {
+            assertRegistrationIssuer(importedClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(importedClient, now))
+                throw new Error("OAuth client secret has expired; update the imported registration");
+            if (!registrationMatchesRedirect(importedClient, redirectUri))
+                throw new Error("OAuth imported registration does not match the configured redirect URI; update its callback configuration");
+            return { kind: "static", fromStoredRegistration: false, client: importedClient };
+        }
+        if (storedClient !== null) {
+            assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(storedClient, now) || !registrationMatchesRedirect(storedClient, redirectUri)) {
+                await clearRegisteredClient(discovery.authorizationServer);
+                storedClient = null;
+            }
+        }
+        if (storedClient !== null) {
+            return {
+                kind: "dynamic",
+                fromStoredRegistration: true,
+                client: storedClient
+            };
+        }
+        if (registrationEndpoint === undefined) {
+            if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
+                return {
+                    kind: "dynamic",
+                    fromStoredRegistration: true,
+                    client: existingSession.client
+                };
+            }
+            throw new Error("Authorization server metadata is missing registration_endpoint");
+        }
+        if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
+            await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
+            return {
+                kind: "dynamic",
+                fromStoredRegistration: true,
+                client: existingSession.client
+            };
+        }
+        const supported = getSupportedTokenAuthMethods(discovery.authorizationServerMetadata);
+        const registrationMethod = requestedTokenMethod ?? (supported === undefined ? "none" :
+            ["none", "client_secret_basic", "client_secret_post"].find(method => supported.includes(method)));
+        if (registrationMethod === undefined || (supported !== undefined && !supported.includes(registrationMethod)))
+            throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+        const registration = await registerOAuthClient({
+            registrationEndpoint, redirectUri, metadata: clientMetadata,
+            tokenEndpointAuthMethod: normalizeOAuthTokenEndpointAuthMethod(registrationMethod),
+            fetch, signal: parentSignal
+        });
+        const registeredSecret = getOwnString(registration, "client_secret");
+        const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry(registration, "token_endpoint_auth_method")) ??
+            requestedTokenMethod ?? (supported === undefined ? undefined : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
+        const registeredClient = {
+            clientId: registration.client_id.trim(),
+            ...(registeredSecret === undefined ? {} : { clientSecret: registeredSecret.trim() }),
+            ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
+            registration
+        };
+        assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+        if (hasExpiredClientSecret(registeredClient, now))
+            throw new Error("OAuth client secret has expired in the registration response");
+        if (!registrationMatchesRedirect(registeredClient, redirectUri, true))
+            throw new Error("OAuth registration response does not match the requested redirect URI");
+        const clientWithRedirect = { ...registeredClient, requestedRedirectUri: redirectUri };
+        await saveRegisteredClient(discovery.authorizationServer, clientWithRedirect);
+        return {
+            kind: "dynamic",
+            fromStoredRegistration: false,
+            client: clientWithRedirect
+        };
+    }
+    async function loadSession(resource) {
+        return normalizeLoadedSession(await sessionStore.load(resource));
+    }
+    async function saveSession(resource, session) {
+        await sessionStore.save(resource, structuredClone(session));
+    }
+    async function clearSession(resource) {
+        await sessionStore.clear(resource);
+    }
+    async function loadRegisteredClient(issuer) {
+        if (registeredClients.has(issuer)) {
+            return registeredClients.get(issuer) ?? null;
+        }
+        if (clientStore === null) {
+            return null;
+        }
+        const client = await clientStore.load(issuer);
+        const normalizedClient = client === null ? null : normalizeStoredOAuthClient(client);
+        if (client !== null && normalizedClient === null) {
+            await clientStore.clear(issuer);
+            return null;
+        }
+        registeredClients.set(issuer, normalizedClient);
+        return normalizedClient;
+    }
+    async function saveRegisteredClient(issuer, client) {
+        registeredClients.set(issuer, client);
+        if (clientStore !== null) {
+            await clientStore.save(issuer, client);
+        }
+    }
+    async function clearRegisteredClient(issuer) {
+        registeredClients.delete(issuer);
+        if (clientStore !== null) {
+            await clientStore.clear(issuer);
+        }
+    }
+}
+function isProviderOptions(options) {
+    return Object.prototype.hasOwnProperty.call(options, "provider");
+}
+function isExpired(tokens, now) {
+    return tokens.expiresAt !== null && tokens.expiresAt <= now();
+}
+function resolveDiscovery(discovery, session) {
+    if (discovery !== undefined) {
+        return {
+            ...discovery,
+            resource: canonicalizeResourceIndicator(discovery.resource)
+        };
+    }
+    if (session === null) {
+        return undefined;
+    }
+    const metadata = session.discovery.authorizationServerMetadata;
+    const issuer = getOwnString(metadata, "issuer");
+    const authorizationEndpoint = getOwnString(metadata, "authorization_endpoint");
+    const tokenEndpoint = getOwnString(metadata, "token_endpoint");
+    const codeChallengeMethodsSupported = getOwnStringArray(metadata, "code_challenge_methods_supported");
+    if (issuer === undefined ||
+        authorizationEndpoint === undefined ||
+        tokenEndpoint === undefined ||
+        codeChallengeMethodsSupported === undefined ||
+        !codeChallengeMethodsSupported.includes("S256")) {
+        return undefined;
+    }
+    return {
+        resource: canonicalizeResourceIndicator(session.resource),
+        resourceMetadataUrl: session.discovery.resourceMetadataUrl,
+        resourceMetadata: session.discovery
+            .resourceMetadata,
+        authorizationServer: session.authorizationServer,
+        authorizationServerMetadataUrl: "",
+        authorizationServerMetadata: metadata
+    };
+}
+function sameTokenGrant(left, right) {
+    return left.accessToken === right.accessToken && left.refreshToken === right.refreshToken &&
+        left.tokenType === right.tokenType && left.expiresAt === right.expiresAt && left.scope === right.scope;
+}
+function clearSessionTokens(session) {
+    const nextSession = { ...session };
+    delete nextSession.tokens;
+    delete nextSession.refreshState;
+    return nextSession;
+}
+function hasCachedAccessToken(session) {
+    return session?.tokens?.accessToken !== undefined;
+}
+function normalizeLoadedSession(session) {
+    if (session === null) {
+        return null;
+    }
+    const discovery = structuredClone(session.discovery);
+    const refreshState = getOwnEntry(session, "refreshState");
+    if (refreshState !== undefined && (refreshState !== "pending" || getOwnEntry(session, "tokens") !== undefined))
+        throw new Error("Stored OAuth refresh state is invalid");
+    const client = normalizeStoredOAuthClient(getOwnEntry(session, "client"));
+    if (client === null) {
+        return { ...session, discovery, client: { clientId: "" }, tokens: undefined };
+    }
+    const tokens = normalizeStoredTokens(getOwnEntry(session, "tokens"));
+    if (tokens !== undefined) {
+        try {
+            new Headers({ Authorization: `Bearer ${tokens.accessToken}` });
+        }
+        catch {
+            throw new Error("Stored OAuth access token is not a valid HTTP header value");
+        }
+    }
+    return { ...session, discovery, client, tokens };
+}
+function snapshotInitialGrantTokens(value) {
+    if (!isObjectRecord(value))
+        return value;
+    const expiresAt = getOwnEntry(value, "expiresAt"), expiresIn = getOwnEntry(value, "expiresIn"), issuedAt = getOwnEntry(value, "issuedAt");
+    return { ...value, expiresAt, expiresIn, issuedAt };
+}
+function normalizeImportedTokens(value, now) {
+    if (!isObjectRecord(value))
+        return undefined;
+    const absolute = getOwnEntry(value, "expiresAt");
+    const lifetime = getOwnEntry(value, "expiresIn");
+    const issuedAt = getOwnEntry(value, "issuedAt");
+    const snapshot = { ...value };
+    if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+        throw new Error("OAuth initial grant has invalid relative expiry");
+    if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
+        Math.abs(issuedAt) > MAX_JS_DATE_MS))
+        throw new Error("OAuth initial grant has invalid issuance time");
+    const expiresAt = absolute !== undefined && absolute !== null ? absolute :
+        lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
+    return normalizeStoredTokens({ ...snapshot, expiresAt });
+}
+function normalizeStoredTokens(value) {
+    if (value === undefined || !isObjectRecord(value)) {
+        return undefined;
+    }
+    const accessToken = getOwnString(value, "accessToken");
+    const tokenType = getOwnString(value, "tokenType");
+    const expiresAt = getOwnEntry(value, "expiresAt");
+    const refreshToken = getOwnEntry(value, "refreshToken");
+    const scope = getOwnEntry(value, "scope");
+    const normalizedAccessToken = accessToken?.trim();
+    const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : undefined;
+    const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
+    if (accessToken === undefined ||
+        normalizedAccessToken === undefined ||
+        normalizedAccessToken.length === 0 ||
+        tokenType !== "Bearer" ||
+        !(expiresAt === null ||
+            (typeof expiresAt === "number" &&
+                Number.isSafeInteger(expiresAt) &&
+                expiresAt <= MAX_JS_DATE_MS &&
+                Number.isFinite(new Date(expiresAt).getTime()))) ||
+        (refreshToken !== undefined &&
+            (typeof refreshToken !== "string" ||
+                normalizedRefreshToken === undefined ||
+                normalizedRefreshToken.length === 0))) {
+        return undefined;
+    }
+    return {
+        accessToken: normalizedAccessToken,
+        tokenType,
+        expiresAt,
+        ...(normalizedRefreshToken === undefined ? {} : { refreshToken: normalizedRefreshToken }),
+        ...(normalizedScope === undefined
+            ? {}
+            : { scope: normalizedScope })
+    };
+}
+function getClientMetadata(client) {
+    if (client.metadata === undefined) {
+        return undefined;
+    }
+    return {
+        clientName: normalizeOptionalOAuthString(client.metadata.clientName),
+        scope: normalizeOAuthScope(client.metadata.scope),
+        softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
+        softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
+    };
+}
+function normalizeConfiguredClient(client) {
+    const registration = client.registration === undefined ? undefined : parseOAuthClientRegistration(client.registration);
+    const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
+    if (clientId === undefined)
+        return null;
+    const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === undefined ? undefined : getOwnString(registration, "client_secret")?.trim());
+    return normalizeStoredOAuthClient({ clientId, clientSecret, registration,
+        ...(registration === undefined ? {} : { registrationOwnership: "caller" }),
+        tokenEndpointAuthMethod: client.tokenEndpointAuthMethod });
+}
+function normalizeOptionalOAuthString(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key)
+        ? record[key]
+        : undefined;
+}
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnString(record, key) {
+    const value = getOwnEntry(record, key);
+    return typeof value === "string" ? value : undefined;
+}
+function requireOwnString(record, key, label) {
+    const value = getOwnString(record, key);
+    if (value === undefined) {
+        throw new Error(`${label} is missing ${key}`);
+    }
+    return value;
+}
+function getOwnStringArray(record, key) {
+    const value = getOwnEntry(record, key);
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string")
+        ? value
+        : undefined;
+}
+function buildAuthorizationUrl(input) {
+    const authorizationEndpoint = requireOwnString(input.metadata, "authorization_endpoint", "Authorization server metadata");
+    const issuer = requireOwnString(input.metadata, "issuer", "Authorization server metadata");
+    const url = new URL(authorizationEndpoint);
+    const resource = canonicalizeResourceIndicator(input.resource);
+    const state = createAuthorizationState({
+        issuer,
+        requireIssuer: getOwnEntry(input.metadata, "authorization_response_iss_parameter_supported") === true
+    });
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", input.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri);
+    url.searchParams.set("code_challenge", input.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("resource", resource);
+    url.searchParams.set("state", state);
+    if (input.clientMetadata?.scope !== undefined && input.clientMetadata.scope.length > 0) {
+        url.searchParams.set("scope", input.clientMetadata.scope);
+    }
+    return url.toString();
+}
+function assertS256PkceSupport(metadata) {
+    if (!getOwnStringArray(metadata, "code_challenge_methods_supported")?.includes("S256")) {
+        throw new Error("Authorization server metadata must advertise code_challenge_methods_supported including S256");
+    }
+}
+function normalizeHostname(hostname) {
+    return hostname.endsWith(".") ? hostname.slice(0, -1).toLowerCase() : hostname.toLowerCase();
+}
+function isLoopbackHostname(hostname) {
+    const normalizedHostname = normalizeHostname(hostname);
+    return (normalizedHostname === "localhost" ||
+        normalizedHostname === "::1" ||
+        normalizedHostname === "[::1]" ||
+        (isIP(normalizedHostname) === 4 && normalizedHostname.startsWith("127.")));
+}
+function assertSecureUrl(value, label) {
+    const url = new URL(value);
+    if (url.username !== "" || url.password !== "" || url.href.includes("#")) {
+        throw new Error(`${label} must not include credentials or fragment`);
+    }
+    if (url.protocol === "https:") {
+        return url;
+    }
+    if (url.protocol === "http:" && isLoopbackHostname(url.hostname)) {
+        return url;
+    }
+    throw new Error(`${label} must use https unless it targets a loopback host`);
+}
+function assertSecureOAuthFlowEndpoints(metadata) {
+    const issuer = assertSecureUrl(requireOwnString(metadata, "issuer", "Authorization server metadata"), "Authorization server issuer");
+    if (issuer.href.includes("?"))
+        throw new Error("Authorization server issuer must not include query or fragment");
+    const authorizationEndpoint = requireOwnString(metadata, "authorization_endpoint", "Authorization server metadata");
+    const tokenEndpoint = requireOwnString(metadata, "token_endpoint", "Authorization server metadata");
+    const registrationEndpoint = getOwnString(metadata, "registration_endpoint");
+    assertNoAccessTokenInUrl(authorizationEndpoint, "Authorization endpoint");
+    assertNoAccessTokenInUrl(tokenEndpoint, "Token endpoint");
+    assertSecureUrl(authorizationEndpoint, "Authorization endpoint");
+    assertSecureUrl(tokenEndpoint, "Token endpoint");
+    if (registrationEndpoint !== undefined) {
+        assertNoAccessTokenInUrl(registrationEndpoint, "Registration endpoint");
+        assertSecureUrl(registrationEndpoint, "Registration endpoint");
+    }
+}
+function assertNoAccessTokenInUrl(value, label) {
+    const url = value instanceof URL ? new URL(value.toString()) : new URL(value);
+    if (url.searchParams.has("access_token")) {
+        throw new Error(`${label} must not include access_token in the URI`);
+    }
+}
+function assertRequestMatchesResource(requestUrl, resource) {
+    if (requestUrl !== resource) {
+        throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
+    }
+}
+function assertRegistrationIssuer(client, issuer) {
+    const registrationIssuer = client.registration === undefined ? undefined : getOwnString(client.registration, "issuer");
+    if (registrationIssuer !== undefined && registrationIssuer !== issuer)
+        throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+    if (client.clientSecret === undefined || client.tokenEndpointAuthMethod === "none" || client.registration === undefined)
+        return false;
+    const expiry = getOwnEntry(client.registration, "client_secret_expires_at");
+    return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1000;
+}
+function getSupportedTokenAuthMethods(metadata) {
+    const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.length > 128 || value.some(method => typeof method !== "string"))
+        throw new Error("Invalid OAuth token endpoint authentication metadata");
+    return value;
+}
+function assertTokenEndpointAuthentication(client, metadata) {
+    const method = client.tokenEndpointAuthMethod ?? (client.clientSecret === undefined ? "none" : "client_secret_post");
+    if (method !== "none" && client.clientSecret === undefined)
+        throw new Error("OAuth token endpoint authentication requires a client secret");
+    const supported = getSupportedTokenAuthMethods(metadata);
+    if (supported !== undefined && !supported.includes(method))
+        throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
+}
+function toStoredDiscovery(discovery) {
+    return {
+        resourceMetadataUrl: discovery.resourceMetadataUrl,
+        resourceMetadata: discovery.resourceMetadata,
+        authorizationServerMetadata: discovery.authorizationServerMetadata
+    };
+}
+function shouldReRegisterStoredDynamicClient(error, client, alreadyAttempted) {
+    if (!(error instanceof OAuthError) || error.error !== "invalid_client" || alreadyAttempted) {
+        return false;
+    }
+    if (client === null) {
+        return false;
+    }
+    if ("kind" in client) {
+        return client.kind === "dynamic" && client.fromStoredRegistration;
+    }
+    return client.registrationOwnership !== "caller";
+}