@mcp-z/client 2.2.4 → 2.3.0

package/dist/cjs/auth/rfc9728-discovery.js

@@ -164,27 +164,33 @@ function _ts_generator(thisArg, body) {
         return '';
     }
 }
-function discoverProtectedResourceMetadata(resourceUrl) {
-    return _async_to_generator(function() {
-        var normalizedResourceUrl, allowLoopback, headerMetadata, localWellKnownUrl, response, unused, origin, path, rootUrl, response1, metadata, rootMetadata, subPathUrl, subPathResponse, unused1, unused2, subPathUrl1, response2, unused3, _error;
+function discoverProtectedResourceMetadata(_0) {
+    return _async_to_generator(function(resourceUrl) {
+        var options, signal, normalizedResourceUrl, allowLoopback, headerMetadata, localWellKnownUrl, response, unused, origin, path, rootUrl, response1, metadata, rootMetadata, subPathUrl, subPathResponse, unused1, unused2, subPathUrl1, response2, unused3, _error;
+        var _arguments = arguments;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    options = _arguments.length > 1 && _arguments[1] !== void 0 ? _arguments[1] : {};
+                    signal = options.signal;
+                    _state.label = 1;
+                case 1:
                     _state.trys.push([
-                        0,
-                        26,
+                        1,
+                        27,
                         ,
-                        27
+                        28
                     ]);
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     normalizedResourceUrl = (0, _urlutilsts.normalizeUrl)(resourceUrl);
                     // resourceUrl is the server the caller configured (never remote-supplied);
                     // its loopback-ness is the trust signal every fetch below relies on.
                     allowLoopback = (0, _discoveryfetchts.isLoopbackUrl)(normalizedResourceUrl);
                     return [
                         4,
-                        discoverProtectedResourceMetadataFromHeader(normalizedResourceUrl, allowLoopback)
+                        discoverProtectedResourceMetadataFromHeader(normalizedResourceUrl, allowLoopback, signal)
                     ];
-                case 1:
+                case 2:
                     headerMetadata = _state.sent();
                     if (headerMetadata) return [
                         2,
@@ -192,13 +198,13 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     ];
                     // Strategy 0: Try path-local well-known (supports path-prefixed deployments like /outlook)
                     localWellKnownUrl = (0, _urlutilsts.joinWellKnown)(normalizedResourceUrl, '/.well-known/oauth-protected-resource');
-                    _state.label = 2;
-                case 2:
+                    _state.label = 3;
+                case 3:
                     _state.trys.push([
-                        2,
-                        6,
+                        3,
+                        7,
                         ,
-                        7
+                        8
                     ]);
                     return [
                         4,
@@ -207,49 +213,51 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         }, 'protected resource metadata (path-local)', {
                             allowLoopback: allowLoopback
                         })
                     ];
-                case 3:
+                case 4:
                     response = _state.sent();
                     if (!response.ok) return [
                         3,
-                        5
+                        6
                     ];
                     return [
                         4,
                         (0, _discoveryfetchts.readDiscoveryJson)(response, 'protected resource metadata (path-local)')
                     ];
-                case 4:
+                case 5:
                     return [
                         2,
                         _state.sent()
                     ];
-                case 5:
+                case 6:
                     return [
                         3,
-                        7
+                        8
                     ];
-                case 6:
+                case 7:
                     unused = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         3,
-                        7
+                        8
                     ];
-                case 7:
+                case 8:
                     origin = getOrigin(normalizedResourceUrl);
                     path = getPath(normalizedResourceUrl);
                     // Strategy 1: Try root location (REQUIRED by RFC 9728)
                     rootUrl = "".concat(origin, "/.well-known/oauth-protected-resource");
-                    _state.label = 8;
-                case 8:
+                    _state.label = 9;
+                case 9:
                     _state.trys.push([
-                        8,
-                        18,
+                        9,
+                        19,
                         ,
-                        19
+                        20
                     ]);
                     return [
                         4,
@@ -258,22 +266,23 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         }, 'protected resource metadata (root)', {
                             allowLoopback: allowLoopback
                         })
                     ];
-                case 9:
+                case 10:
                     response1 = _state.sent();
                     if (!response1.ok) return [
                         3,
-                        17
+                        18
                     ];
                     return [
                         4,
                         (0, _discoveryfetchts.readDiscoveryJson)(response1, 'protected resource metadata (root)')
                     ];
-                case 10:
+                case 11:
                     metadata = _state.sent();
                     // Check if the discovered resource matches what we're looking for
                     if (metadata.resource === normalizedResourceUrl) {
@@ -292,20 +301,20 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                     }
                     if (!normalizedResourceUrl.startsWith(metadata.resource)) return [
                         3,
-                        17
+                        18
                     ];
                     // Still try sub-path location to see if there's more specific metadata
                     // But save root metadata as fallback
                     rootMetadata = metadata;
                     // Try sub-path location for more specific metadata
                     subPathUrl = "".concat(origin, "/.well-known/oauth-protected-resource").concat(path);
-                    _state.label = 11;
-                case 11:
+                    _state.label = 12;
+                case 12:
                     _state.trys.push([
-                        11,
-                        15,
+                        12,
+                        16,
                         ,
-                        16
+                        17
                     ]);
                     return [
                         4,
@@ -314,67 +323,70 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         }, 'protected resource metadata (sub-path)', {
                             allowLoopback: allowLoopback
                         })
                     ];
-                case 12:
+                case 13:
                     subPathResponse = _state.sent();
                     if (!subPathResponse.ok) return [
                         3,
-                        14
+                        15
                     ];
                     return [
                         4,
                         (0, _discoveryfetchts.readDiscoveryJson)(subPathResponse, 'protected resource metadata (sub-path)')
                     ];
-                case 13:
+                case 14:
                     return [
                         2,
                         _state.sent()
                     ];
-                case 14:
+                case 15:
                     return [
                         3,
-                        16
+                        17
                     ];
-                case 15:
+                case 16:
                     unused1 = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         3,
-                        16
+                        17
                     ];
-                case 16:
+                case 17:
                     // Return root metadata as it applies to this resource
                     return [
                         2,
                         rootMetadata
                     ];
-                case 17:
+                case 18:
                     return [
                         3,
-                        19
+                        20
                     ];
-                case 18:
+                case 19:
                     unused2 = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         3,
-                        19
+                        20
                     ];
-                case 19:
+                case 20:
                     if (!path) return [
                         3,
-                        25
+                        26
                     ];
                     subPathUrl1 = "".concat(origin, "/.well-known/oauth-protected-resource").concat(path);
-                    _state.label = 20;
-                case 20:
+                    _state.label = 21;
+                case 21:
                     _state.trys.push([
-                        20,
-                        24,
+                        21,
+                        25,
                         ,
-                        25
+                        26
                     ]);
                     return [
                         4,
@@ -383,59 +395,62 @@ function discoverProtectedResourceMetadata(resourceUrl) {
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         }, 'protected resource metadata (sub-path)', {
                             allowLoopback: allowLoopback
                         })
                     ];
-                case 21:
+                case 22:
                     response2 = _state.sent();
                     if (!response2.ok) return [
                         3,
-                        23
+                        24
                     ];
                     return [
                         4,
                         (0, _discoveryfetchts.readDiscoveryJson)(response2, 'protected resource metadata (sub-path)')
                     ];
-                case 22:
+                case 23:
                     return [
                         2,
                         _state.sent()
                     ];
-                case 23:
+                case 24:
                     return [
                         3,
-                        25
+                        26
                     ];
-                case 24:
+                case 25:
                     unused3 = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         3,
-                        25
+                        26
                     ];
-                case 25:
+                case 26:
                     // Neither location found or resource didn't match
                     return [
                         2,
                         null
                     ];
-                case 26:
+                case 27:
                     _error = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     // Network error, invalid URL, or other failure
                     return [
                         2,
                         null
                     ];
-                case 27:
+                case 28:
                     return [
                         2
                     ];
             }
         });
-    })();
+    }).apply(this, arguments);
 }
-function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback) {
+function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback, signal) {
     return _async_to_generator(function() {
         var response, header, postResponse, match, metadataUrl, metadataResponse, _error;
         return _ts_generator(this, function(_state) {
@@ -447,6 +462,7 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback)
                         ,
                         7
                     ]);
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         4,
                         fetch(resourceUrl, {
@@ -454,7 +470,8 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback)
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         })
                     ];
                 case 1:
@@ -473,7 +490,8 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback)
                                 Connection: 'close',
                                 'Content-Type': 'application/json'
                             },
-                            body: '{}'
+                            body: '{}',
+                            signal: signal
                         })
                     ];
                 case 2:
@@ -500,7 +518,8 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback)
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         }, 'resource_metadata URL', {
                             allowLoopback: allowLoopback
                         })
@@ -524,6 +543,7 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback)
                     ];
                 case 6:
                     _error = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         2,
                         null
@@ -538,13 +558,13 @@ function discoverProtectedResourceMetadataFromHeader(resourceUrl, allowLoopback)
 }
 function discoverAuthorizationServerMetadata(_0) {
     return _async_to_generator(function(authServerUrl) {
-        var options, _options_allowLoopback, allowLoopback, normalizedAuthServerUrl, localWellKnownUrl, localResponse, origin, wellKnownUrl, response, _error;
+        var options, _options_allowLoopback, allowLoopback, signal, normalizedAuthServerUrl, localWellKnownUrl, localResponse, origin, wellKnownUrl, response, _error;
         var _arguments = arguments;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
                     options = _arguments.length > 1 && _arguments[1] !== void 0 ? _arguments[1] : {};
-                    _options_allowLoopback = options.allowLoopback, allowLoopback = _options_allowLoopback === void 0 ? false : _options_allowLoopback;
+                    _options_allowLoopback = options.allowLoopback, allowLoopback = _options_allowLoopback === void 0 ? false : _options_allowLoopback, signal = options.signal;
                     _state.label = 1;
                 case 1:
                     _state.trys.push([
@@ -553,6 +573,7 @@ function discoverAuthorizationServerMetadata(_0) {
                         ,
                         8
                     ]);
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     normalizedAuthServerUrl = (0, _urlutilsts.normalizeUrl)(authServerUrl);
                     localWellKnownUrl = (0, _urlutilsts.joinWellKnown)(normalizedAuthServerUrl, '/.well-known/oauth-authorization-server');
                     return [
@@ -562,7 +583,8 @@ function discoverAuthorizationServerMetadata(_0) {
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         }, 'authorization server metadata (path-local)', {
                             allowLoopback: allowLoopback
                         })
@@ -592,7 +614,8 @@ function discoverAuthorizationServerMetadata(_0) {
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         }, 'authorization server metadata', {
                             allowLoopback: allowLoopback
                         })
@@ -616,6 +639,7 @@ function discoverAuthorizationServerMetadata(_0) {
                     ];
                 case 7:
                     _error = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         2,
                         null
@@ -628,18 +652,24 @@ function discoverAuthorizationServerMetadata(_0) {
         });
     }).apply(this, arguments);
 }
-function discoverAuthorizationServerIssuer(resourceUrl) {
-    return _async_to_generator(function() {
-        var _match_, response, header, match, _error;
+function discoverAuthorizationServerIssuer(_0) {
+    return _async_to_generator(function(resourceUrl) {
+        var options, signal, _match_, response, header, match, _error;
+        var _arguments = arguments;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    options = _arguments.length > 1 && _arguments[1] !== void 0 ? _arguments[1] : {};
+                    signal = options.signal;
+                    _state.label = 1;
+                case 1:
                     _state.trys.push([
-                        0,
-                        2,
+                        1,
+                        3,
                         ,
-                        3
+                        4
                     ]);
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         4,
                         fetch(resourceUrl, {
@@ -647,10 +677,11 @@ function discoverAuthorizationServerIssuer(resourceUrl) {
                             headers: {
                                 Accept: 'application/json',
                                 Connection: 'close'
-                            }
+                            },
+                            signal: signal
                         })
                     ];
-                case 1:
+                case 2:
                     response = _state.sent();
                     header = response.headers.get('www-authenticate');
                     if (!header) return [
@@ -666,18 +697,19 @@ function discoverAuthorizationServerIssuer(resourceUrl) {
                         2,
                         (_match_ = match[1]) !== null && _match_ !== void 0 ? _match_ : null
                     ];
-                case 2:
+                case 3:
                     _error = _state.sent();
+                    (0, _discoveryfetchts.throwIfAborted)(signal);
                     return [
                         2,
                         null
                     ];
-                case 3:
+                case 4:
                     return [
                         2
                     ];
             }
         });
-    })();
+    }).apply(this, arguments);
 }
 /* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/auth/rfc9728-discovery.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/rfc9728-discovery.ts"],"sourcesContent":["/**\n * RFC 9728 Protected Resource Metadata Discovery\n * Probes .well-known/oauth-protected-resource endpoint\n */\n\nimport { joinWellKnown, normalizeUrl } from '../lib/url-utils.ts';\nimport { discoveryFetch, isLoopbackUrl, readDiscoveryJson } from './discovery-fetch.ts';\nimport type { AuthorizationServerMetadata, ProtectedResourceMetadata } from './types.ts';\n\n/** Returns `url`'s origin (protocol + host), or the original string if it doesn't parse. */\nfunction getOrigin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return url;\n  }\n}\n\n/** Returns `url`'s pathname, or `''` for the root path or an unparseable URL. */\nfunction getPath(url: string): string {\n  try {\n    const parsed = new URL(url);\n    return parsed.pathname === '/' ? '' : parsed.pathname;\n  } catch {\n    return '';\n  }\n}\n\n/**\n * Discovers RFC 9728 Protected Resource Metadata: the `WWW-Authenticate`\n * header first, then `.well-known/oauth-protected-resource` at the origin root and, for a path-prefixed resource, its sub-path variant.\n *\n * @param resourceUrl - URL of the protected resource (e.g. `https://ai.todoist.net/mcp`).\n * @returns Discovered metadata, or `null` if none is found.\n */\nexport async function discoverProtectedResourceMetadata(resourceUrl: string): Promise<ProtectedResourceMetadata | null> {\n  try {\n    const normalizedResourceUrl = normalizeUrl(resourceUrl);\n    // resourceUrl is the server the caller configured (never remote-supplied);\n    // its loopback-ness is the trust signal every fetch below relies on.\n    const allowLoopback = isLoopbackUrl(normalizedResourceUrl);\n    const headerMetadata = await discoverProtectedResourceMetadataFromHeader(normalizedResourceUrl, allowLoopback);\n    if (headerMetadata) return headerMetadata;\n\n    // Strategy 0: Try path-local well-known (supports path-prefixed deployments like /outlook)\n    const localWellKnownUrl = joinWellKnown(normalizedResourceUrl, '/.well-known/oauth-protected-resource');\n    try {\n      const response = await discoveryFetch(\n        localWellKnownUrl,\n        {\n          method: 'GET',\n          headers: { Accept: 'application/json', Connection: 'close' },\n        },\n        'protected resource metadata (path-local)',\n        { allowLoopback }\n      );\n      if (response.ok) {\n        return await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (path-local)');\n      }\n    } catch {\n      // Continue to origin-based discovery\n    }\n\n    const origin = getOrigin(normalizedResourceUrl);\n    const path = getPath(normalizedResourceUrl);\n\n    // Strategy 1: Try root location (REQUIRED by RFC 9728)\n    const rootUrl = `${origin}/.well-known/oauth-protected-resource`;\n\n    try {\n      const response = await discoveryFetch(\n        rootUrl,\n        {\n          method: 'GET',\n          headers: { Accept: 'application/json', Connection: 'close' },\n        },\n        'protected resource metadata (root)',\n        { allowLoopback }\n      );\n\n      if (response.ok) {\n        const metadata = await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (root)');\n        // Check if the discovered resource matches what we're looking for\n        if (metadata.resource === normalizedResourceUrl) {\n          return metadata;\n        }\n        // If there's no path component, return root metadata\n        // (e.g., looking for http://example.com and found it)\n        if (!path) {\n          return metadata;\n        }\n        // If requested URL starts with metadata.resource, the root metadata applies to sub-paths\n        // (e.g., looking for http://example.com/api/v1/mcp, found http://example.com)\n        if (normalizedResourceUrl.startsWith(metadata.resource)) {\n          // Still try sub-path location to see if there's more specific metadata\n          // But save root metadata as fallback\n          const rootMetadata = metadata;\n\n          // Try sub-path location for more specific metadata\n          const subPathUrl = `${origin}/.well-known/oauth-protected-resource${path}`;\n          try {\n            const subPathResponse = await discoveryFetch(\n              subPathUrl,\n              {\n                method: 'GET',\n                headers: { Accept: 'application/json', Connection: 'close' },\n              },\n              'protected resource metadata (sub-path)',\n              { allowLoopback }\n            );\n            if (subPathResponse.ok) {\n              return await readDiscoveryJson<ProtectedResourceMetadata>(subPathResponse, 'protected resource metadata (sub-path)');\n            }\n          } catch {\n            // Sub-path failed, use root metadata\n          }\n\n          // Return root metadata as it applies to this resource\n          return rootMetadata;\n        }\n        // Otherwise, try sub-path location before giving up\n      }\n    } catch {\n      // Continue to sub-path location\n    }\n\n    // Strategy 2: Try sub-path location (MCP spec extension)\n    // Only try if there's a path component\n    if (path) {\n      const subPathUrl = `${origin}/.well-known/oauth-protected-resource${path}`;\n\n      try {\n        const response = await discoveryFetch(\n          subPathUrl,\n          {\n            method: 'GET',\n            headers: { Accept: 'application/json', Connection: 'close' },\n          },\n          'protected resource metadata (sub-path)',\n          { allowLoopback }\n        );\n\n        if (response.ok) {\n          return await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (sub-path)');\n        }\n      } catch {\n        // Fall through to return null\n      }\n    }\n\n    // Neither location found or resource didn't match\n    return null;\n  } catch (_error) {\n    // Network error, invalid URL, or other failure\n    return null;\n  }\n}\n\nasync function discoverProtectedResourceMetadataFromHeader(resourceUrl: string, allowLoopback: boolean): Promise<ProtectedResourceMetadata | null> {\n  try {\n    const response = await fetch(resourceUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    let header = response.headers.get('www-authenticate');\n    if (!header) {\n      const postResponse = await fetch(resourceUrl, {\n        method: 'POST',\n        headers: { Accept: 'application/json', Connection: 'close', 'Content-Type': 'application/json' },\n        body: '{}',\n      });\n      header = postResponse.headers.get('www-authenticate');\n    }\n\n    if (!header) return null;\n\n    const match = header.match(/resource_metadata=\"([^\"]+)\"/i);\n    if (!match || !match[1]) return null;\n\n    // metadataUrl is remote-server-chosen (the primary SSRF vector here);\n    // allowLoopback reflects trust in resourceUrl, not in metadataUrl.\n    const metadataUrl = match[1];\n    const metadataResponse = await discoveryFetch(\n      metadataUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n      },\n      'resource_metadata URL',\n      { allowLoopback }\n    );\n\n    if (!metadataResponse.ok) {\n      return null;\n    }\n\n    return await readDiscoveryJson<ProtectedResourceMetadata>(metadataResponse, 'resource_metadata URL');\n  } catch (_error) {\n    return null;\n  }\n}\n\n/**\n * Discovers RFC 8414 Authorization Server Metadata at\n * `.well-known/oauth-authorization-server`, path-local variant first.\n *\n * @param authServerUrl - URL of the authorization server (typically from RFC 9728 discovery).\n * @param options.allowLoopback - Loopback trust grant computed from the server the caller is actually talking to, never from `authServerUrl` itself. Defaults to `false`.\n * @returns Discovered metadata, or `null` if none is found.\n */\nexport async function discoverAuthorizationServerMetadata(authServerUrl: string, options: { allowLoopback?: boolean } = {}): Promise<AuthorizationServerMetadata | null> {\n  const { allowLoopback = false } = options;\n  try {\n    const normalizedAuthServerUrl = normalizeUrl(authServerUrl);\n    const localWellKnownUrl = joinWellKnown(normalizedAuthServerUrl, '/.well-known/oauth-authorization-server');\n    const localResponse = await discoveryFetch(\n      localWellKnownUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n      },\n      'authorization server metadata (path-local)',\n      { allowLoopback }\n    );\n\n    if (localResponse.ok) {\n      return await readDiscoveryJson<AuthorizationServerMetadata>(localResponse, 'authorization server metadata (path-local)');\n    }\n\n    const origin = getOrigin(normalizedAuthServerUrl);\n    const wellKnownUrl = `${origin}/.well-known/oauth-authorization-server`;\n\n    const response = await discoveryFetch(\n      wellKnownUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n      },\n      'authorization server metadata',\n      { allowLoopback }\n    );\n\n    if (!response.ok) {\n      return null;\n    }\n\n    return await readDiscoveryJson<AuthorizationServerMetadata>(response, 'authorization server metadata');\n  } catch (_error) {\n    return null;\n  }\n}\n\n/**\n * Discover OAuth Authorization Server Issuer from resource response (RFC 9207)\n *\n * @param resourceUrl - URL of the protected resource\n * @returns Issuer URL if present in WWW-Authenticate header, null otherwise\n */\nexport async function discoverAuthorizationServerIssuer(resourceUrl: string): Promise<string | null> {\n  try {\n    const response = await fetch(resourceUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n    });\n\n    const header = response.headers.get('www-authenticate');\n    if (!header) return null;\n\n    const match = header.match(/(?:authorization_server|issuer)=\"([^\"]+)\"/i);\n    if (!match) return null;\n\n    return match[1] ?? null;\n  } catch (_error) {\n    return null;\n  }\n}\n"],"names":["discoverAuthorizationServerIssuer","discoverAuthorizationServerMetadata","discoverProtectedResourceMetadata","getOrigin","url","URL","origin","getPath","parsed","pathname","resourceUrl","normalizedResourceUrl","allowLoopback","headerMetadata","localWellKnownUrl","response","path","rootUrl","metadata","rootMetadata","subPathUrl","subPathResponse","_error","normalizeUrl","isLoopbackUrl","discoverProtectedResourceMetadataFromHeader","joinWellKnown","discoveryFetch","method","headers","Accept","Connection","ok","readDiscoveryJson","resource","startsWith","header","postResponse","match","metadataUrl","metadataResponse","fetch","get","body","authServerUrl","options","normalizedAuthServerUrl","localResponse","wellKnownUrl"],"mappings":"AAAA;;;CAGC;;;;;;;;;;;QAgQqBA;eAAAA;;QAhDAC;eAAAA;;QAhLAC;eAAAA;;;0BA9BsB;gCACqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGjE,0FAA0F,GAC1F,SAASC,UAAUC,GAAW;IAC5B,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,MAAM;IAC5B,EAAE,eAAM;QACN,OAAOF;IACT;AACF;AAEA,+EAA+E,GAC/E,SAASG,QAAQH,GAAW;IAC1B,IAAI;QACF,IAAMI,SAAS,IAAIH,IAAID;QACvB,OAAOI,OAAOC,QAAQ,KAAK,MAAM,KAAKD,OAAOC,QAAQ;IACvD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AASO,SAAeP,kCAAkCQ,WAAmB;;YAEjEC,uBAGAC,eACAC,gBAIAC,mBAEEC,kBAgBFT,QACAU,MAGAC,SAGEF,WAWEG,UAeEC,cAGAC,YAEEC,mCA4BND,aAGEL,oBAoBHO;;;;;;;;;;oBAnHDX,wBAAwBY,IAAAA,wBAAY,EAACb;oBAC3C,2EAA2E;oBAC3E,qEAAqE;oBAC/DE,gBAAgBY,IAAAA,+BAAa,EAACb;oBACb;;wBAAMc,4CAA4Cd,uBAAuBC;;;oBAA1FC,iBAAiB;oBACvB,IAAIA,gBAAgB;;wBAAOA;;oBAE3B,2FAA2F;oBACrFC,oBAAoBY,IAAAA,yBAAa,EAACf,uBAAuB;;;;;;;;;oBAE5C;;wBAAMgB,IAAAA,gCAAc,EACnCb,mBACA;4BACEc,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,4CACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZG,WAAW;yBASbA,SAASiB,EAAE,EAAXjB;;;;oBACK;;wBAAMkB,IAAAA,mCAAiB,EAA4BlB,UAAU;;;oBAApE;;wBAAO;;;;;;;;;;;;;;oBAMLT,SAASH,UAAUQ;oBACnBK,OAAOT,QAAQI;oBAErB,uDAAuD;oBACjDM,UAAU,AAAC,GAAS,OAAPX,QAAO;;;;;;;;;oBAGP;;wBAAMqB,IAAAA,gCAAc,EACnCV,SACA;4BACEW,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,sCACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZG,YAAW;yBAUbA,UAASiB,EAAE,EAAXjB;;;;oBACe;;wBAAMkB,IAAAA,mCAAiB,EAA4BlB,WAAU;;;oBAAxEG,WAAW;oBACjB,kEAAkE;oBAClE,IAAIA,SAASgB,QAAQ,KAAKvB,uBAAuB;wBAC/C;;4BAAOO;;oBACT;oBACA,qDAAqD;oBACrD,sDAAsD;oBACtD,IAAI,CAACF,MAAM;wBACT;;4BAAOE;;oBACT;yBAGIP,sBAAsBwB,UAAU,CAACjB,SAASgB,QAAQ,GAAlDvB;;;;oBACF,uEAAuE;oBACvE,qCAAqC;oBAC/BQ,eAAeD;oBAErB,mDAAmD;oBAC7CE,aAAa,AAAC,GAAgDJ,OAA9CV,QAAO,yCAA4C,OAALU;;;;;;;;;oBAE1C;;wBAAMW,IAAAA,gCAAc,EAC1CP,YACA;4BACEQ,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,0CACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZS,kBAAkB;yBASpBA,gBAAgBW,EAAE,EAAlBX;;;;oBACK;;wBAAMY,IAAAA,mCAAiB,EAA4BZ,iBAAiB;;;oBAA3E;;wBAAO;;;;;;;;;;;;;;oBAMX,sDAAsD;oBACtD;;wBAAOF;;;;;;;;;;;;;;yBAUTH,MAAAA;;;;oBACII,cAAa,AAAC,GAAgDJ,OAA9CV,QAAO,yCAA4C,OAALU;;;;;;;;;oBAGjD;;wBAAMW,IAAAA,gCAAc,EACnCP,aACA;4BACEQ,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,0CACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZG,YAAW;yBAUbA,UAASiB,EAAE,EAAXjB;;;;oBACK;;wBAAMkB,IAAAA,mCAAiB,EAA4BlB,WAAU;;;oBAApE;;wBAAO;;;;;;;;;;;;;;oBAOb,kDAAkD;oBAClD;;wBAAO;;;oBACAO;oBACP,+CAA+C;oBAC/C;;wBAAO;;;;;;;;IAEX;;AAEA,SAAeG,4CAA4Cf,WAAmB,EAAEE,aAAsB;;YAE5FG,UAKFqB,QAEIC,cAUFC,OAKAC,aACAC,kBAeClB;;;;;;;;;;oBAtCU;;wBAAMmB,MAAM/B,aAAa;4BACxCkB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMhB,WAAW;oBAKbqB,SAASrB,SAASc,OAAO,CAACa,GAAG,CAAC;yBAC9B,CAACN,QAAD;;;;oBACmB;;wBAAMK,MAAM/B,aAAa;4BAC5CkB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;gCAAS,gBAAgB;4BAAmB;4BAC/FY,MAAM;wBACR;;;oBAJMN,eAAe;oBAKrBD,SAASC,aAAaR,OAAO,CAACa,GAAG,CAAC;;;oBAGpC,IAAI,CAACN,QAAQ;;wBAAO;;oBAEdE,QAAQF,OAAOE,KAAK,CAAC;oBAC3B,IAAI,CAACA,SAAS,CAACA,KAAK,CAAC,EAAE,EAAE;;wBAAO;;oBAEhC,sEAAsE;oBACtE,mEAAmE;oBAC7DC,cAAcD,KAAK,CAAC,EAAE;oBACH;;wBAAMX,IAAAA,gCAAc,EAC3CY,aACA;4BACEX,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,yBACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZ4B,mBAAmB;oBAUzB,IAAI,CAACA,iBAAiBR,EAAE,EAAE;wBACxB;;4BAAO;;oBACT;oBAEO;;wBAAMC,IAAAA,mCAAiB,EAA4BO,kBAAkB;;;oBAA5E;;wBAAO;;;oBACAlB;oBACP;;wBAAO;;;;;;;;IAEX;;AAUO,SAAerB;wCAAoC2C,aAAqB;YAAEC,iCACvEjC,eAEAkC,yBACAhC,mBACAiC,eAcAzC,QACA0C,cAEAjC,UAeCO;;;;;oBArCsEuB,UAAAA,oEAAuC,CAAC;6CACrFA,QAA1BjC,eAAAA,oDAAgB;;;;;;;;;oBAEhBkC,0BAA0BvB,IAAAA,wBAAY,EAACqB;oBACvC9B,oBAAoBY,IAAAA,yBAAa,EAACoB,yBAAyB;oBAC3C;;wBAAMnB,IAAAA,gCAAc,EACxCb,mBACA;4BACEc,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,8CACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZmC,gBAAgB;yBAUlBA,cAAcf,EAAE,EAAhBe;;;;oBACK;;wBAAMd,IAAAA,mCAAiB,EAA8Bc,eAAe;;;oBAA3E;;wBAAO;;;oBAGHzC,SAASH,UAAU2C;oBACnBE,eAAe,AAAC,GAAS,OAAP1C,QAAO;oBAEd;;wBAAMqB,IAAAA,gCAAc,EACnCqB,cACA;4BACEpB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D,GACA,iCACA;4BAAEnB,eAAAA;wBAAc;;;oBAPZG,WAAW;oBAUjB,IAAI,CAACA,SAASiB,EAAE,EAAE;wBAChB;;4BAAO;;oBACT;oBAEO;;wBAAMC,IAAAA,mCAAiB,EAA8BlB,UAAU;;;oBAAtE;;wBAAO;;;oBACAO;oBACP;;wBAAO;;;;;;;;IAEX;;AAQO,SAAetB,kCAAkCU,WAAmB;;YAahE4B,SAXDvB,UAKAqB,QAGAE,OAIChB;;;;;;;;;;oBAZU;;wBAAMmB,MAAM/B,aAAa;4BACxCkB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;wBAC7D;;;oBAHMhB,WAAW;oBAKXqB,SAASrB,SAASc,OAAO,CAACa,GAAG,CAAC;oBACpC,IAAI,CAACN,QAAQ;;wBAAO;;oBAEdE,QAAQF,OAAOE,KAAK,CAAC;oBAC3B,IAAI,CAACA,OAAO;;wBAAO;;oBAEnB;;yBAAOA,UAAAA,KAAK,CAAC,EAAE,cAARA,qBAAAA,UAAY;;;oBACZhB;oBACP;;wBAAO;;;;;;;;IAEX"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/ai/mcp-z/client/src/auth/rfc9728-discovery.ts"],"sourcesContent":["/**\n * RFC 9728 Protected Resource Metadata Discovery\n * Probes .well-known/oauth-protected-resource endpoint\n */\n\nimport { joinWellKnown, normalizeUrl } from '../lib/url-utils.ts';\nimport { discoveryFetch, isLoopbackUrl, readDiscoveryJson, throwIfAborted } from './discovery-fetch.ts';\nimport type { AuthorizationServerMetadata, ProtectedResourceMetadata } from './types.ts';\n\n/** Returns `url`'s origin (protocol + host), or the original string if it doesn't parse. */\nfunction getOrigin(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return url;\n  }\n}\n\n/** Returns `url`'s pathname, or `''` for the root path or an unparseable URL. */\nfunction getPath(url: string): string {\n  try {\n    const parsed = new URL(url);\n    return parsed.pathname === '/' ? '' : parsed.pathname;\n  } catch {\n    return '';\n  }\n}\n\n/**\n * Discovers RFC 9728 Protected Resource Metadata: the `WWW-Authenticate`\n * header first, then `.well-known/oauth-protected-resource` at the origin root and, for a path-prefixed resource, its sub-path variant.\n *\n * @param resourceUrl - URL of the protected resource (e.g. `https://ai.todoist.net/mcp`).\n * @returns Discovered metadata, or `null` if none is found.\n */\nexport async function discoverProtectedResourceMetadata(resourceUrl: string, options: { signal?: AbortSignal } = {}): Promise<ProtectedResourceMetadata | null> {\n  const { signal } = options;\n  try {\n    throwIfAborted(signal);\n    const normalizedResourceUrl = normalizeUrl(resourceUrl);\n    // resourceUrl is the server the caller configured (never remote-supplied);\n    // its loopback-ness is the trust signal every fetch below relies on.\n    const allowLoopback = isLoopbackUrl(normalizedResourceUrl);\n    const headerMetadata = await discoverProtectedResourceMetadataFromHeader(normalizedResourceUrl, allowLoopback, signal);\n    if (headerMetadata) return headerMetadata;\n\n    // Strategy 0: Try path-local well-known (supports path-prefixed deployments like /outlook)\n    const localWellKnownUrl = joinWellKnown(normalizedResourceUrl, '/.well-known/oauth-protected-resource');\n    try {\n      const response = await discoveryFetch(\n        localWellKnownUrl,\n        {\n          method: 'GET',\n          headers: { Accept: 'application/json', Connection: 'close' },\n          signal,\n        },\n        'protected resource metadata (path-local)',\n        { allowLoopback }\n      );\n      if (response.ok) {\n        return await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (path-local)');\n      }\n    } catch {\n      throwIfAborted(signal);\n      // Continue to origin-based discovery\n    }\n\n    const origin = getOrigin(normalizedResourceUrl);\n    const path = getPath(normalizedResourceUrl);\n\n    // Strategy 1: Try root location (REQUIRED by RFC 9728)\n    const rootUrl = `${origin}/.well-known/oauth-protected-resource`;\n\n    try {\n      const response = await discoveryFetch(\n        rootUrl,\n        {\n          method: 'GET',\n          headers: { Accept: 'application/json', Connection: 'close' },\n          signal,\n        },\n        'protected resource metadata (root)',\n        { allowLoopback }\n      );\n\n      if (response.ok) {\n        const metadata = await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (root)');\n        // Check if the discovered resource matches what we're looking for\n        if (metadata.resource === normalizedResourceUrl) {\n          return metadata;\n        }\n        // If there's no path component, return root metadata\n        // (e.g., looking for http://example.com and found it)\n        if (!path) {\n          return metadata;\n        }\n        // If requested URL starts with metadata.resource, the root metadata applies to sub-paths\n        // (e.g., looking for http://example.com/api/v1/mcp, found http://example.com)\n        if (normalizedResourceUrl.startsWith(metadata.resource)) {\n          // Still try sub-path location to see if there's more specific metadata\n          // But save root metadata as fallback\n          const rootMetadata = metadata;\n\n          // Try sub-path location for more specific metadata\n          const subPathUrl = `${origin}/.well-known/oauth-protected-resource${path}`;\n          try {\n            const subPathResponse = await discoveryFetch(\n              subPathUrl,\n              {\n                method: 'GET',\n                headers: { Accept: 'application/json', Connection: 'close' },\n                signal,\n              },\n              'protected resource metadata (sub-path)',\n              { allowLoopback }\n            );\n            if (subPathResponse.ok) {\n              return await readDiscoveryJson<ProtectedResourceMetadata>(subPathResponse, 'protected resource metadata (sub-path)');\n            }\n          } catch {\n            throwIfAborted(signal);\n            // Sub-path failed, use root metadata\n          }\n\n          // Return root metadata as it applies to this resource\n          return rootMetadata;\n        }\n        // Otherwise, try sub-path location before giving up\n      }\n    } catch {\n      throwIfAborted(signal);\n      // Continue to sub-path location\n    }\n\n    // Strategy 2: Try sub-path location (MCP spec extension)\n    // Only try if there's a path component\n    if (path) {\n      const subPathUrl = `${origin}/.well-known/oauth-protected-resource${path}`;\n\n      try {\n        const response = await discoveryFetch(\n          subPathUrl,\n          {\n            method: 'GET',\n            headers: { Accept: 'application/json', Connection: 'close' },\n            signal,\n          },\n          'protected resource metadata (sub-path)',\n          { allowLoopback }\n        );\n\n        if (response.ok) {\n          return await readDiscoveryJson<ProtectedResourceMetadata>(response, 'protected resource metadata (sub-path)');\n        }\n      } catch {\n        throwIfAborted(signal);\n        // Fall through to return null\n      }\n    }\n\n    // Neither location found or resource didn't match\n    return null;\n  } catch (_error) {\n    throwIfAborted(signal);\n    // Network error, invalid URL, or other failure\n    return null;\n  }\n}\n\nasync function discoverProtectedResourceMetadataFromHeader(resourceUrl: string, allowLoopback: boolean, signal?: AbortSignal): Promise<ProtectedResourceMetadata | null> {\n  try {\n    throwIfAborted(signal);\n    const response = await fetch(resourceUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n      signal,\n    });\n\n    let header = response.headers.get('www-authenticate');\n    if (!header) {\n      const postResponse = await fetch(resourceUrl, {\n        method: 'POST',\n        headers: { Accept: 'application/json', Connection: 'close', 'Content-Type': 'application/json' },\n        body: '{}',\n        signal,\n      });\n      header = postResponse.headers.get('www-authenticate');\n    }\n\n    if (!header) return null;\n\n    const match = header.match(/resource_metadata=\"([^\"]+)\"/i);\n    if (!match || !match[1]) return null;\n\n    // metadataUrl is remote-server-chosen (the primary SSRF vector here);\n    // allowLoopback reflects trust in resourceUrl, not in metadataUrl.\n    const metadataUrl = match[1];\n    const metadataResponse = await discoveryFetch(\n      metadataUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n        signal,\n      },\n      'resource_metadata URL',\n      { allowLoopback }\n    );\n\n    if (!metadataResponse.ok) {\n      return null;\n    }\n\n    return await readDiscoveryJson<ProtectedResourceMetadata>(metadataResponse, 'resource_metadata URL');\n  } catch (_error) {\n    throwIfAborted(signal);\n    return null;\n  }\n}\n\n/**\n * Discovers RFC 8414 Authorization Server Metadata at\n * `.well-known/oauth-authorization-server`, path-local variant first.\n *\n * @param authServerUrl - URL of the authorization server (typically from RFC 9728 discovery).\n * @param options.allowLoopback - Loopback trust grant computed from the server the caller is actually talking to, never from `authServerUrl` itself. Defaults to `false`.\n * @returns Discovered metadata, or `null` if none is found.\n */\nexport async function discoverAuthorizationServerMetadata(authServerUrl: string, options: { allowLoopback?: boolean; signal?: AbortSignal } = {}): Promise<AuthorizationServerMetadata | null> {\n  const { allowLoopback = false, signal } = options;\n  try {\n    throwIfAborted(signal);\n    const normalizedAuthServerUrl = normalizeUrl(authServerUrl);\n    const localWellKnownUrl = joinWellKnown(normalizedAuthServerUrl, '/.well-known/oauth-authorization-server');\n    const localResponse = await discoveryFetch(\n      localWellKnownUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n        signal,\n      },\n      'authorization server metadata (path-local)',\n      { allowLoopback }\n    );\n\n    if (localResponse.ok) {\n      return await readDiscoveryJson<AuthorizationServerMetadata>(localResponse, 'authorization server metadata (path-local)');\n    }\n\n    const origin = getOrigin(normalizedAuthServerUrl);\n    const wellKnownUrl = `${origin}/.well-known/oauth-authorization-server`;\n\n    const response = await discoveryFetch(\n      wellKnownUrl,\n      {\n        method: 'GET',\n        headers: { Accept: 'application/json', Connection: 'close' },\n        signal,\n      },\n      'authorization server metadata',\n      { allowLoopback }\n    );\n\n    if (!response.ok) {\n      return null;\n    }\n\n    return await readDiscoveryJson<AuthorizationServerMetadata>(response, 'authorization server metadata');\n  } catch (_error) {\n    throwIfAborted(signal);\n    return null;\n  }\n}\n\n/**\n * Discover OAuth Authorization Server Issuer from resource response (RFC 9207)\n *\n * @param resourceUrl - URL of the protected resource\n * @returns Issuer URL if present in WWW-Authenticate header, null otherwise\n */\nexport async function discoverAuthorizationServerIssuer(resourceUrl: string, options: { signal?: AbortSignal } = {}): Promise<string | null> {\n  const { signal } = options;\n  try {\n    throwIfAborted(signal);\n    const response = await fetch(resourceUrl, {\n      method: 'GET',\n      headers: { Accept: 'application/json', Connection: 'close' },\n      signal,\n    });\n\n    const header = response.headers.get('www-authenticate');\n    if (!header) return null;\n\n    const match = header.match(/(?:authorization_server|issuer)=\"([^\"]+)\"/i);\n    if (!match) return null;\n\n    return match[1] ?? null;\n  } catch (_error) {\n    throwIfAborted(signal);\n    return null;\n  }\n}\n"],"names":["discoverAuthorizationServerIssuer","discoverAuthorizationServerMetadata","discoverProtectedResourceMetadata","getOrigin","url","URL","origin","getPath","parsed","pathname","resourceUrl","options","signal","normalizedResourceUrl","allowLoopback","headerMetadata","localWellKnownUrl","response","path","rootUrl","metadata","rootMetadata","subPathUrl","subPathResponse","_error","throwIfAborted","normalizeUrl","isLoopbackUrl","discoverProtectedResourceMetadataFromHeader","joinWellKnown","discoveryFetch","method","headers","Accept","Connection","ok","readDiscoveryJson","resource","startsWith","header","postResponse","match","metadataUrl","metadataResponse","fetch","get","body","authServerUrl","normalizedAuthServerUrl","localResponse","wellKnownUrl"],"mappings":"AAAA;;;CAGC;;;;;;;;;;;QAoRqBA;eAAAA;;QApDAC;eAAAA;;QAhMAC;eAAAA;;;0BA9BsB;gCACqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGjF,0FAA0F,GAC1F,SAASC,UAAUC,GAAW;IAC5B,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,MAAM;IAC5B,EAAE,eAAM;QACN,OAAOF;IACT;AACF;AAEA,+EAA+E,GAC/E,SAASG,QAAQH,GAAW;IAC1B,IAAI;QACF,IAAMI,SAAS,IAAIH,IAAID;QACvB,OAAOI,OAAOC,QAAQ,KAAK,MAAM,KAAKD,OAAOC,QAAQ;IACvD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AASO,SAAeP;wCAAkCQ,WAAmB;YAAEC,SACnEC,QAGAC,uBAGAC,eACAC,gBAIAC,mBAEEC,kBAkBFX,QACAY,MAGAC,SAGEF,WAYEG,UAeEC,cAGAC,YAEEC,mCA+BND,aAGEL,oBAsBHO;;;;;oBA/HkEb,UAAAA,oEAAoC,CAAC;oBACxGC,SAAWD,QAAXC;;;;;;;;;oBAENa,IAAAA,gCAAc,EAACb;oBACTC,wBAAwBa,IAAAA,wBAAY,EAAChB;oBAC3C,2EAA2E;oBAC3E,qEAAqE;oBAC/DI,gBAAgBa,IAAAA,+BAAa,EAACd;oBACb;;wBAAMe,4CAA4Cf,uBAAuBC,eAAeF;;;oBAAzGG,iBAAiB;oBACvB,IAAIA,gBAAgB;;wBAAOA;;oBAE3B,2FAA2F;oBACrFC,oBAAoBa,IAAAA,yBAAa,EAAChB,uBAAuB;;;;;;;;;oBAE5C;;wBAAMiB,IAAAA,gCAAc,EACnCd,mBACA;4BACEe,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF,GACA,4CACA;4BAAEE,eAAAA;wBAAc;;;oBARZG,WAAW;yBAUbA,SAASkB,EAAE,EAAXlB;;;;oBACK;;wBAAMmB,IAAAA,mCAAiB,EAA4BnB,UAAU;;;oBAApE;;wBAAO;;;;;;;;;oBAGTQ,IAAAA,gCAAc,EAACb;;;;;;oBAIXN,SAASH,UAAUU;oBACnBK,OAAOX,QAAQM;oBAErB,uDAAuD;oBACjDM,UAAU,AAAC,GAAS,OAAPb,QAAO;;;;;;;;;oBAGP;;wBAAMwB,IAAAA,gCAAc,EACnCX,SACA;4BACEY,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF,GACA,sCACA;4BAAEE,eAAAA;wBAAc;;;oBARZG,YAAW;yBAWbA,UAASkB,EAAE,EAAXlB;;;;oBACe;;wBAAMmB,IAAAA,mCAAiB,EAA4BnB,WAAU;;;oBAAxEG,WAAW;oBACjB,kEAAkE;oBAClE,IAAIA,SAASiB,QAAQ,KAAKxB,uBAAuB;wBAC/C;;4BAAOO;;oBACT;oBACA,qDAAqD;oBACrD,sDAAsD;oBACtD,IAAI,CAACF,MAAM;wBACT;;4BAAOE;;oBACT;yBAGIP,sBAAsByB,UAAU,CAAClB,SAASiB,QAAQ,GAAlDxB;;;;oBACF,uEAAuE;oBACvE,qCAAqC;oBAC/BQ,eAAeD;oBAErB,mDAAmD;oBAC7CE,aAAa,AAAC,GAAgDJ,OAA9CZ,QAAO,yCAA4C,OAALY;;;;;;;;;oBAE1C;;wBAAMY,IAAAA,gCAAc,EAC1CR,YACA;4BACES,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF,GACA,0CACA;4BAAEE,eAAAA;wBAAc;;;oBARZS,kBAAkB;yBAUpBA,gBAAgBY,EAAE,EAAlBZ;;;;oBACK;;wBAAMa,IAAAA,mCAAiB,EAA4Bb,iBAAiB;;;oBAA3E;;wBAAO;;;;;;;;;oBAGTE,IAAAA,gCAAc,EAACb;;;;;;oBAIjB,sDAAsD;oBACtD;;wBAAOS;;;;;;;;;oBAKXI,IAAAA,gCAAc,EAACb;;;;;;yBAMbM,MAAAA;;;;oBACII,cAAa,AAAC,GAAgDJ,OAA9CZ,QAAO,yCAA4C,OAALY;;;;;;;;;oBAGjD;;wBAAMY,IAAAA,gCAAc,EACnCR,aACA;4BACES,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF,GACA,0CACA;4BAAEE,eAAAA;wBAAc;;;oBARZG,YAAW;yBAWbA,UAASkB,EAAE,EAAXlB;;;;oBACK;;wBAAMmB,IAAAA,mCAAiB,EAA4BnB,WAAU;;;oBAApE;;wBAAO;;;;;;;;;oBAGTQ,IAAAA,gCAAc,EAACb;;;;;;oBAKnB,kDAAkD;oBAClD;;wBAAO;;;oBACAY;oBACPC,IAAAA,gCAAc,EAACb;oBACf,+CAA+C;oBAC/C;;wBAAO;;;;;;;;IAEX;;AAEA,SAAegB,4CAA4ClB,WAAmB,EAAEI,aAAsB,EAAEF,MAAoB;;YAGlHK,UAMFsB,QAEIC,cAWFC,OAKAC,aACAC,kBAgBCnB;;;;;;;;;;oBA1CPC,IAAAA,gCAAc,EAACb;oBACE;;wBAAMgC,MAAMlC,aAAa;4BACxCqB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF;;;oBAJMK,WAAW;oBAMbsB,SAAStB,SAASe,OAAO,CAACa,GAAG,CAAC;yBAC9B,CAACN,QAAD;;;;oBACmB;;wBAAMK,MAAMlC,aAAa;4BAC5CqB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;gCAAS,gBAAgB;4BAAmB;4BAC/FY,MAAM;4BACNlC,QAAAA;wBACF;;;oBALM4B,eAAe;oBAMrBD,SAASC,aAAaR,OAAO,CAACa,GAAG,CAAC;;;oBAGpC,IAAI,CAACN,QAAQ;;wBAAO;;oBAEdE,QAAQF,OAAOE,KAAK,CAAC;oBAC3B,IAAI,CAACA,SAAS,CAACA,KAAK,CAAC,EAAE,EAAE;;wBAAO;;oBAEhC,sEAAsE;oBACtE,mEAAmE;oBAC7DC,cAAcD,KAAK,CAAC,EAAE;oBACH;;wBAAMX,IAAAA,gCAAc,EAC3CY,aACA;4BACEX,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF,GACA,yBACA;4BAAEE,eAAAA;wBAAc;;;oBARZ6B,mBAAmB;oBAWzB,IAAI,CAACA,iBAAiBR,EAAE,EAAE;wBACxB;;4BAAO;;oBACT;oBAEO;;wBAAMC,IAAAA,mCAAiB,EAA4BO,kBAAkB;;;oBAA5E;;wBAAO;;;oBACAnB;oBACPC,IAAAA,gCAAc,EAACb;oBACf;;wBAAO;;;;;;;;IAEX;;AAUO,SAAeX;wCAAoC8C,aAAqB;YAAEpC,iCACvEG,eAAuBF,QAGvBoC,yBACAhC,mBACAiC,eAeA3C,QACA4C,cAEAjC,UAgBCO;;;;;oBAxCsEb,UAAAA,oEAA6D,CAAC;6CACnGA,QAAlCG,eAAAA,oDAAgB,gCAAOF,SAAWD,QAAXC;;;;;;;;;oBAE7Ba,IAAAA,gCAAc,EAACb;oBACToC,0BAA0BtB,IAAAA,wBAAY,EAACqB;oBACvC/B,oBAAoBa,IAAAA,yBAAa,EAACmB,yBAAyB;oBAC3C;;wBAAMlB,IAAAA,gCAAc,EACxCd,mBACA;4BACEe,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF,GACA,8CACA;4BAAEE,eAAAA;wBAAc;;;oBARZmC,gBAAgB;yBAWlBA,cAAcd,EAAE,EAAhBc;;;;oBACK;;wBAAMb,IAAAA,mCAAiB,EAA8Ba,eAAe;;;oBAA3E;;wBAAO;;;oBAGH3C,SAASH,UAAU6C;oBACnBE,eAAe,AAAC,GAAS,OAAP5C,QAAO;oBAEd;;wBAAMwB,IAAAA,gCAAc,EACnCoB,cACA;4BACEnB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF,GACA,iCACA;4BAAEE,eAAAA;wBAAc;;;oBARZG,WAAW;oBAWjB,IAAI,CAACA,SAASkB,EAAE,EAAE;wBAChB;;4BAAO;;oBACT;oBAEO;;wBAAMC,IAAAA,mCAAiB,EAA8BnB,UAAU;;;oBAAtE;;wBAAO;;;oBACAO;oBACPC,IAAAA,gCAAc,EAACb;oBACf;;wBAAO;;;;;;;;IAEX;;AAQO,SAAeZ;wCAAkCU,WAAmB;YAAEC,SACnEC,QAeC6B,SAZDxB,UAMAsB,QAGAE,OAICjB;;;;;oBAjBkEb,UAAAA,oEAAoC,CAAC;oBACxGC,SAAWD,QAAXC;;;;;;;;;oBAENa,IAAAA,gCAAc,EAACb;oBACE;;wBAAMgC,MAAMlC,aAAa;4BACxCqB,QAAQ;4BACRC,SAAS;gCAAEC,QAAQ;gCAAoBC,YAAY;4BAAQ;4BAC3DtB,QAAAA;wBACF;;;oBAJMK,WAAW;oBAMXsB,SAAStB,SAASe,OAAO,CAACa,GAAG,CAAC;oBACpC,IAAI,CAACN,QAAQ;;wBAAO;;oBAEdE,QAAQF,OAAOE,KAAK,CAAC;oBAC3B,IAAI,CAACA,OAAO;;wBAAO;;oBAEnB;;yBAAOA,UAAAA,KAAK,CAAC,EAAE,cAARA,qBAAAA,UAAY;;;oBACZjB;oBACPC,IAAAA,gCAAc,EAACb;oBACf;;wBAAO;;;;;;;;IAEX"}

package/dist/cjs/auth/types.d.cts

@@ -142,11 +142,15 @@ export interface DcrRegistrationOptions {
      * remote-controlled AS metadata). Defaults to `false`.
      */
     allowLoopback?: boolean;
+    /** Cancels an in-progress registration request. */
+    signal?: AbortSignal;
 }
 /**
  * Options for OAuth authorization flow
  */
 export interface OAuthFlowOptions {
+    /** Cancels an in-progress authorization and closes its callback listener. */
+    signal?: AbortSignal;
     /** Port for OAuth callback listener (required - use get-port to find available port) */
     port: number;
     /** Issuer identifier discovered before the flow starts; the `iss` in the authorization response must match it (RFC 9207) */

package/dist/cjs/auth/types.d.ts

@@ -142,11 +142,15 @@ export interface DcrRegistrationOptions {
      * remote-controlled AS metadata). Defaults to `false`.
      */
     allowLoopback?: boolean;
+    /** Cancels an in-progress registration request. */
+    signal?: AbortSignal;
 }
 /**
  * Options for OAuth authorization flow
  */
 export interface OAuthFlowOptions {
+    /** Cancels an in-progress authorization and closes its callback listener. */
+    signal?: AbortSignal;
     /** Port for OAuth callback listener (required - use get-port to find available port) */
     port: number;
     /** Issuer identifier discovered before the flow starts; the `iss` in the authorization response must match it (RFC 9207) */