@nitrostack/core 1.0.14 → 1.0.16

package/dist/auth/cimd.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Client ID Metadata Documents (CIMD).
+ *
+ * The final MCP 2026-07-28 authorization spec **deprecates Dynamic Client
+ * Registration (DCR)** in favor of CIMD: a client uses an HTTPS URL as its
+ * `client_id`, and that URL resolves to a JSON document describing the client
+ * (redirect URIs, grant types, etc.). Authorization servers fetch and cache the
+ * document instead of running a registration endpoint.
+ *
+ * This module provides:
+ * - a publisher that serves a client's own metadata document at a stable URL, and
+ * - a resolver that fetches and validates a client's CIMD URL.
+ *
+ * DCR remains available on the legacy path and as an opt-in; CIMD is the
+ * recommended mechanism on 2026-07-28.
+ *
+ * @module
+ */
+/**
+ * A Client ID Metadata Document (OAuth client metadata, RFC 7591 shape).
+ * The `client_id` MUST equal the HTTPS URL the document is served from.
+ */
+export interface ClientIdMetadataDocument {
+    /** The HTTPS URL this document is published at (also the OAuth `client_id`). */
+    client_id: string;
+    client_name?: string;
+    redirect_uris: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: string;
+    scope?: string;
+    application_type?: 'web' | 'native';
+    logo_uri?: string;
+    client_uri?: string;
+    contacts?: string[];
+    [key: string]: unknown;
+}
+/**
+ * Strict validation of a Client Identifier URL per draft-ietf-oauth-client-id-metadata-document-02 §2.
+ */
+export declare function validateClientIdentifierUrl(urlStr: string, allowLoopback?: boolean): URL;
+/**
+ * Build a Client ID Metadata Document for this client.
+ *
+ * @param clientIdUrl - The HTTPS URL the document will be served from. Becomes
+ *   the `client_id`.
+ */
+export declare function createClientIdMetadataDocument(clientIdUrl: string, metadata: {
+    redirect_uris: string[];
+} & Partial<Omit<ClientIdMetadataDocument, 'client_id' | 'redirect_uris'>>, options?: {
+    allowLoopback?: boolean;
+}): ClientIdMetadataDocument;
+/**
+ * Validate that a resolved document is a well-formed CIMD whose `client_id`
+ * matches the URL it was fetched from (prevents impersonation).
+ */
+export declare function validateClientIdMetadataDocument(doc: unknown, sourceUrl: string): ClientIdMetadataDocument;
+import dns from 'dns/promises';
+/**
+ * Checks whether an IPv4 or IPv6 address belongs to RFC 6890 special-use or private ranges.
+ */
+export declare function isSpecialUseIp(ip: string): boolean;
+/**
+ * Asserts that a target URL does not resolve to an RFC 6890 special-use or private IP address.
+ */
+export declare function assertSafeFetchTarget(urlStr: string, allowLoopback?: boolean, dnsLookupImpl?: typeof dns.lookup): Promise<void>;
+export declare const MAX_CIMD_DOCUMENT_BYTES = 5120;
+/**
+ * Reads response body up to maxBytes, throwing if exceeded.
+ */
+export declare function readBoundedJson<T = unknown>(response: Response, maxBytes?: number): Promise<T>;
+export declare const DEFAULT_CIMD_FETCH_TIMEOUT_MS = 5000;
+/**
+ * Resolve a client's CIMD by fetching its `client_id` URL and validating it.
+ * Authorization servers call this in place of a DCR lookup.
+ */
+export declare function resolveClientIdMetadataDocument(clientIdUrl: string, options?: {
+    fetchImpl?: typeof fetch;
+    allowLoopback?: boolean;
+    dnsLookupImpl?: typeof dns.lookup;
+    maxDocumentBytes?: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<ClientIdMetadataDocument>;
+/**
+ * Whether a string looks like a CIMD-style client id (a valid HTTP/HTTPS URL) rather
+ * than an opaque DCR-issued id.
+ */
+export declare function isClientIdMetadataUrl(clientId: string): boolean;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/auth/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../src/auth/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,UAAO,GAAG,GAAG,CA6CrF;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE;IAAE,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,WAAW,GAAG,eAAe,CAAC,CAAC,EAC9G,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACpC,wBAAwB,CAG1B;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,GAChB,wBAAwB,CAkB1B;AAGD,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B;;GAEG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAuElD;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,UAAQ,EACrB,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,GAChC,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;GAEG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,SAA0B,GACjC,OAAO,CAAC,CAAC,CAAC,CAoDZ;AAED,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD;;;GAGG;AACH,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GACA,OAAO,CAAC,wBAAwB,CAAC,CA+CnC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAU/D"}

package/dist/auth/cimd.js

@@ -0,0 +1,344 @@
+/**
+ * Client ID Metadata Documents (CIMD).
+ *
+ * The final MCP 2026-07-28 authorization spec **deprecates Dynamic Client
+ * Registration (DCR)** in favor of CIMD: a client uses an HTTPS URL as its
+ * `client_id`, and that URL resolves to a JSON document describing the client
+ * (redirect URIs, grant types, etc.). Authorization servers fetch and cache the
+ * document instead of running a registration endpoint.
+ *
+ * This module provides:
+ * - a publisher that serves a client's own metadata document at a stable URL, and
+ * - a resolver that fetches and validates a client's CIMD URL.
+ *
+ * DCR remains available on the legacy path and as an opt-in; CIMD is the
+ * recommended mechanism on 2026-07-28.
+ *
+ * @module
+ */
+/**
+ * Strict validation of a Client Identifier URL per draft-ietf-oauth-client-id-metadata-document-02 §2.
+ */
+export function validateClientIdentifierUrl(urlStr, allowLoopback = true) {
+    if (typeof urlStr !== 'string' || !urlStr) {
+        throw new Error(`Invalid Client Identifier URL: "${urlStr}"`);
+    }
+    let parsed;
+    try {
+        parsed = new URL(urlStr);
+    }
+    catch {
+        throw new Error(`Invalid Client Identifier URL: "${urlStr}"`);
+    }
+    // Scheme check
+    if (parsed.protocol !== 'https:') {
+        const isLoopback = allowLoopback && parsed.protocol === 'http:' &&
+            (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '[::1]' || parsed.hostname === '::1');
+        if (!isLoopback) {
+            throw new Error(`CIMD client_id must be an HTTPS URL, got: "${urlStr}"`);
+        }
+    }
+    // Userinfo check
+    if (parsed.username || parsed.password) {
+        throw new Error(`CIMD client_id URL must not contain userinfo: "${urlStr}"`);
+    }
+    // Fragment check
+    if (parsed.hash) {
+        throw new Error(`CIMD client_id URL must not contain a fragment component: "${urlStr}"`);
+    }
+    // Path check (must not be bare domain / empty path)
+    const rawPath = urlStr.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/?#]+/, '');
+    if (!rawPath || rawPath === '/' || !parsed.pathname || parsed.pathname === '/') {
+        throw new Error(`CIMD client_id URL must contain a path component (cannot be bare domain): "${urlStr}"`);
+    }
+    // Dot segments check
+    const pathWithoutQuery = rawPath.split('?')[0].split('#')[0];
+    const segments = pathWithoutQuery.split('/');
+    if (segments.some((seg) => seg === '.' || seg === '..')) {
+        throw new Error(`CIMD client_id URL must not contain single-dot or double-dot path segments: "${urlStr}"`);
+    }
+    return parsed;
+}
+/**
+ * Build a Client ID Metadata Document for this client.
+ *
+ * @param clientIdUrl - The HTTPS URL the document will be served from. Becomes
+ *   the `client_id`.
+ */
+export function createClientIdMetadataDocument(clientIdUrl, metadata, options) {
+    validateClientIdentifierUrl(clientIdUrl, options?.allowLoopback ?? true);
+    return { ...metadata, client_id: clientIdUrl };
+}
+/**
+ * Validate that a resolved document is a well-formed CIMD whose `client_id`
+ * matches the URL it was fetched from (prevents impersonation).
+ */
+export function validateClientIdMetadataDocument(doc, sourceUrl) {
+    if (!doc || typeof doc !== 'object') {
+        throw new Error('CIMD is not an object');
+    }
+    const d = doc;
+    if (typeof d.client_id !== 'string') {
+        throw new Error('CIMD is missing a string `client_id`');
+    }
+    const normalize = (u) => u.replace(/\/+$/, '');
+    if (normalize(d.client_id) !== normalize(sourceUrl)) {
+        throw new Error(`CIMD client_id "${d.client_id}" does not match the document URL "${sourceUrl}"`);
+    }
+    if (!Array.isArray(d.redirect_uris) || d.redirect_uris.some((u) => typeof u !== 'string')) {
+        throw new Error('CIMD `redirect_uris` must be an array of strings');
+    }
+    return d;
+}
+import net from 'net';
+import dns from 'dns/promises';
+/**
+ * Checks whether an IPv4 or IPv6 address belongs to RFC 6890 special-use or private ranges.
+ */
+export function isSpecialUseIp(ip) {
+    if (net.isIPv4(ip)) {
+        const parts = ip.split('.').map(Number);
+        if (parts.length !== 4 || parts.some((n) => isNaN(n) || n < 0 || n > 255)) {
+            return true;
+        }
+        const [b0, b1] = parts;
+        // 0.0.0.0/8 (This host)
+        if (b0 === 0)
+            return true;
+        // 10.0.0.0/8 (Private)
+        if (b0 === 10)
+            return true;
+        // 100.64.0.0/10 (Carrier-Grade NAT)
+        if (b0 === 100 && b1 >= 64 && b1 <= 127)
+            return true;
+        // 127.0.0.0/8 (Loopback)
+        if (b0 === 127)
+            return true;
+        // 169.254.0.0/16 (Link-Local / Cloud Metadata)
+        if (b0 === 169 && b1 === 254)
+            return true;
+        // 172.16.0.0/12 (Private)
+        if (b0 === 172 && b1 >= 16 && b1 <= 31)
+            return true;
+        // 192.0.0.0/24, 192.0.2.0/24, 192.88.99.0/24
+        if (b0 === 192 && b1 === 0)
+            return true;
+        // 192.168.0.0/16 (Private)
+        if (b0 === 192 && b1 === 168)
+            return true;
+        // 198.18.0.0/15 (Benchmarking)
+        if (b0 === 198 && (b1 === 18 || b1 === 19))
+            return true;
+        // 198.51.100.0/24 (TEST-NET-2)
+        if (b0 === 198 && b1 === 51)
+            return true;
+        // 203.0.113.0/24 (TEST-NET-3)
+        if (b0 === 203 && b1 === 0)
+            return true;
+        // 224.0.0.0/4 (Multicast) and 240.0.0.0/4 (Reserved / Broadcast)
+        if (b0 >= 224)
+            return true;
+        return false;
+    }
+    if (net.isIPv6(ip)) {
+        const normalized = ip.toLowerCase().trim();
+        // :: and ::1
+        if (normalized === '::' || normalized === '::1' || normalized === '0:0:0:0:0:0:0:0' || normalized === '0:0:0:0:0:0:0:1') {
+            return true;
+        }
+        // IPv4-mapped IPv6 (::ffff:x.x.x.x)
+        if (normalized.includes('::ffff:')) {
+            const v4Part = normalized.split('::ffff:')[1];
+            if (v4Part && net.isIPv4(v4Part)) {
+                return isSpecialUseIp(v4Part);
+            }
+        }
+        // Unique-Local fc00::/7 (fc.. or fd..)
+        if (normalized.startsWith('fc') || normalized.startsWith('fd')) {
+            return true;
+        }
+        // Link-Local fe80::/10 (fe8, fe9, fea, feb)
+        if (/^fe[89ab]/i.test(normalized)) {
+            return true;
+        }
+        // Multicast ff00::/8
+        if (normalized.startsWith('ff')) {
+            return true;
+        }
+        // Discard 100::/64
+        if (normalized.startsWith('100:')) {
+            return true;
+        }
+        // Documentation 2001:db8::/32
+        if (normalized.startsWith('2001:db8:') || normalized.startsWith('2001:0db8:')) {
+            return true;
+        }
+        return false;
+    }
+    return true;
+}
+/**
+ * Asserts that a target URL does not resolve to an RFC 6890 special-use or private IP address.
+ */
+export async function assertSafeFetchTarget(urlStr, allowLoopback = false, dnsLookupImpl) {
+    let url;
+    try {
+        url = new URL(urlStr);
+    }
+    catch {
+        throw new Error(`Invalid Client Identifier URL: "${urlStr}"`);
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    // Dev loopback exemption
+    if (allowLoopback && (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1')) {
+        return;
+    }
+    // If literal IP
+    if (net.isIP(hostname)) {
+        if (isSpecialUseIp(hostname)) {
+            throw new Error(`Blocked connection to special-use IP address: ${hostname}`);
+        }
+        return;
+    }
+    // DNS lookup
+    const lookupFn = dnsLookupImpl ?? dns.lookup;
+    try {
+        const res = await lookupFn(hostname, { all: true });
+        const addresses = Array.isArray(res) ? res : [res];
+        if (!addresses || addresses.length === 0) {
+            throw new Error(`DNS resolution failed for ${hostname}: no addresses found`);
+        }
+        for (const addr of addresses) {
+            if (addr && addr.address && isSpecialUseIp(addr.address)) {
+                throw new Error(`CIMD destination ${hostname} resolved to special-use IP address: ${addr.address}`);
+            }
+        }
+    }
+    catch (err) {
+        if (err.message && err.message.includes('special-use IP')) {
+            throw err;
+        }
+        throw new Error(`DNS lookup failed for ${hostname}: ${err.message || String(err)}`);
+    }
+}
+export const MAX_CIMD_DOCUMENT_BYTES = 5120; // 5 KiB per draft-ietf-oauth-client-id-metadata-document-02 §4
+/**
+ * Reads response body up to maxBytes, throwing if exceeded.
+ */
+export async function readBoundedJson(response, maxBytes = MAX_CIMD_DOCUMENT_BYTES) {
+    // Check Content-Length header first if present
+    const contentLength = response.headers?.get?.('content-length');
+    if (contentLength && parseInt(contentLength, 10) > maxBytes) {
+        throw new Error(`CIMD response exceeds maximum allowed size of ${maxBytes} bytes (Content-Length: ${contentLength})`);
+    }
+    if (response.body && typeof response.body.getReader === 'function') {
+        const reader = response.body.getReader();
+        const chunks = [];
+        let totalBytes = 0;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                if (value) {
+                    totalBytes += value.byteLength;
+                    if (totalBytes > maxBytes) {
+                        throw new Error(`CIMD response exceeds maximum allowed size of ${maxBytes} bytes`);
+                    }
+                    chunks.push(value);
+                }
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        const merged = Buffer.concat(chunks);
+        const text = merged.toString('utf8');
+        return JSON.parse(text);
+    }
+    // Fallback if no streaming body or in mock environments
+    if (typeof response.text === 'function') {
+        const text = await response.text();
+        if (Buffer.byteLength(text, 'utf8') > maxBytes) {
+            throw new Error(`CIMD response exceeds maximum allowed size of ${maxBytes} bytes`);
+        }
+        return JSON.parse(text);
+    }
+    if (typeof response.json === 'function') {
+        const data = await response.json();
+        const text = JSON.stringify(data);
+        if (Buffer.byteLength(text, 'utf8') > maxBytes) {
+            throw new Error(`CIMD response exceeds maximum allowed size of ${maxBytes} bytes`);
+        }
+        return data;
+    }
+    throw new Error('Unable to read response body');
+}
+export const DEFAULT_CIMD_FETCH_TIMEOUT_MS = 5000;
+/**
+ * Resolve a client's CIMD by fetching its `client_id` URL and validating it.
+ * Authorization servers call this in place of a DCR lookup.
+ */
+export async function resolveClientIdMetadataDocument(clientIdUrl, options) {
+    const allowLoopback = options?.allowLoopback ?? (process.env.NODE_ENV !== 'production');
+    await assertSafeFetchTarget(clientIdUrl, allowLoopback, options?.dnsLookupImpl);
+    if (!/^https:\/\//i.test(clientIdUrl)) {
+        const isLoopback = /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/i.test(clientIdUrl);
+        if (!isLoopback || !allowLoopback) {
+            throw new Error(`CIMD client_id must be an HTTPS URL, got: ${clientIdUrl}`);
+        }
+    }
+    const timeoutMs = options?.timeoutMs ?? DEFAULT_CIMD_FETCH_TIMEOUT_MS;
+    const timeoutSignal = typeof AbortSignal.timeout === 'function'
+        ? AbortSignal.timeout(timeoutMs)
+        : (() => {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(new Error(`CIMD request timed out after ${timeoutMs}ms`)), timeoutMs);
+            if (typeof timer.unref === 'function')
+                timer.unref();
+            return controller.signal;
+        })();
+    let effectiveSignal = timeoutSignal;
+    if (options?.signal) {
+        if (typeof AbortSignal.any === 'function') {
+            effectiveSignal = AbortSignal.any([options.signal, timeoutSignal]);
+        }
+        else {
+            const controller = new AbortController();
+            const onAbort = () => controller.abort();
+            options.signal.addEventListener('abort', onAbort, { once: true });
+            timeoutSignal.addEventListener('abort', onAbort, { once: true });
+            effectiveSignal = controller.signal;
+        }
+    }
+    const doFetch = options?.fetchImpl ?? fetch;
+    const response = await doFetch(clientIdUrl, {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+        redirect: 'error',
+        signal: effectiveSignal,
+    });
+    if (response.status !== 200) {
+        throw new Error(`Failed to resolve CIMD from ${clientIdUrl}: HTTP ${response.status} (expected 200 OK)`);
+    }
+    const maxBytes = options?.maxDocumentBytes ?? MAX_CIMD_DOCUMENT_BYTES;
+    const doc = await readBoundedJson(response, maxBytes);
+    return validateClientIdMetadataDocument(doc, clientIdUrl);
+}
+/**
+ * Whether a string looks like a CIMD-style client id (a valid HTTP/HTTPS URL) rather
+ * than an opaque DCR-issued id.
+ */
+export function isClientIdMetadataUrl(clientId) {
+    if (typeof clientId !== 'string' || !clientId.trim()) {
+        return false;
+    }
+    try {
+        const parsed = new URL(clientId);
+        return (parsed.protocol === 'https:' || parsed.protocol === 'http:') && Boolean(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=cimd.js.map

package/dist/auth/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../src/auth/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAsBH;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,aAAa,GAAG,IAAI;IAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,eAAe;IACf,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAC7D,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;QACnI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,GAAG,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8DAA8D,MAAM,GAAG,CAAC,CAAC;IAC3F,CAAC;IAED,oDAAoD;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,8EAA8E,MAAM,GAAG,CAAC,CAAC;IAC3G,CAAC;IAED,qBAAqB;IACrB,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,gFAAgF,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAAmB,EACnB,QAA8G,EAC9G,OAAqC;IAErC,2BAA2B,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC,CAAC;IACzE,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,GAAY,EACZ,SAAiB;IAEjB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,mBAAmB,CAAC,CAAC,SAAS,sCAAsC,SAAS,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAA6B,CAAC;AACvC,CAAC;AAED,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QACvB,wBAAwB;QACxB,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,uBAAuB;QACvB,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3B,oCAAoC;QACpC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACrD,yBAAyB;QACzB,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5B,+CAA+C;QAC/C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1C,0BAA0B;QAC1B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACpD,6CAA6C;QAC7C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,2BAA2B;QAC3B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1C,+BAA+B;QAC/B,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,+BAA+B;QAC/B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,8BAA8B;QAC9B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,iEAAiE;QACjE,IAAI,EAAE,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3C,aAAa;QACb,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YACxH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,oCAAoC;QACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,uCAAuC;QACvC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,4CAA4C;QAC5C,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,qBAAqB;QACrB,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mBAAmB;QACnB,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,8BAA8B;QAC9B,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,aAAa,GAAG,KAAK,EACrB,aAAiC;IAEjC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEtD,yBAAyB;IACzB,IAAI,aAAa,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;QAClG,OAAO;IACT,CAAC;IAED,gBAAgB;IAChB,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvB,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO;IACT,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAS,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,sBAAsB,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,wCAAwC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1D,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,KAAK,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC,CAAC,+DAA+D;AAE5G;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAkB,EAClB,QAAQ,GAAG,uBAAuB;IAElC,+CAA+C;IAC/C,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAChE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,2BAA2B,aAAa,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,IAAI,OAAQ,QAAQ,CAAC,IAAY,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAI,QAAQ,CAAC,IAAmC,CAAC,SAAS,EAAE,CAAC;QACzE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,KAAK,EAAE,CAAC;oBACV,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;oBAC/B,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;wBAC1B,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,QAAQ,CAAC,CAAC;oBACrF,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,QAAQ,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,QAAQ,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,WAAmB,EACnB,OAOC;IAED,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;IACxF,MAAM,qBAAqB,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAEhF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,qDAAqD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3F,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,6CAA6C,WAAW,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,6BAA6B,CAAC;IACtE,MAAM,aAAa,GAAG,OAAO,WAAW,CAAC,OAAO,KAAK,UAAU;QAC7D,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,gCAAgC,SAAS,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACtH,IAAI,OAAQ,KAAa,CAAC,KAAK,KAAK,UAAU;gBAAG,KAAa,CAAC,KAAK,EAAE,CAAC;YACvE,OAAO,UAAU,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,eAAe,GAAG,aAAa,CAAC;IACpC,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC1C,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,aAAa,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;QACtC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE;QAC1C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,UAAU,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,gBAAgB,IAAI,uBAAuB,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO,gCAAgC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/auth/client.d.ts

@@ -60,6 +60,12 @@ export declare class OAuth2Client {
         scope?: string;
         resource?: string;
         state?: string;
+        /**
+         * OIDC `prompt` value (SEP-2207). Set to `consent` when an OpenID Connect
+         * authorization server requires re-consent to issue a refresh token
+         * (typically alongside the `offline_access` scope).
+         */
+        prompt?: string;
     }): Promise<{
         authUrl: string;
         state: string;
@@ -147,5 +153,20 @@ export declare class OAuth2Client {
      * Generate random state for CSRF protection
      */
     private generateState;
+    /**
+     * Whether a redirect URI targets loopback (localhost / 127.0.0.1 / [::1]),
+     * used to infer `application_type: 'native'` for DCR (SEP-837).
+     */
+    static isLoopbackRedirect(uri: string): boolean;
+    /**
+     * Validate the issuer returned on an authorization response (RFC 9207 /
+     * SEP-2468). MCP 2026-07-28 clients MUST verify the `iss` parameter on the
+     * authorization redirect matches the authorization server's issuer to defend
+     * against mix-up attacks. Throws on mismatch.
+     *
+     * @param receivedIss - `iss` query parameter from the authorization redirect.
+     * @param expectedIssuer - Issuer from the AS metadata used to start the flow.
+     */
+    static validateAuthorizationIssuer(receivedIss: string | undefined | null, expectedIssuer: string): void;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/auth/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,aAAa,EAIb,mBAAmB,EACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAsB,UAAU,EAAuB,MAAM,WAAW,CAAC;AAGhF;;;;;;;;;GASG;AAEH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAsB;gBAExB,MAAM,EAAE,mBAAmB;IAIvC;;;;;;;;;OASG;IACG,iCAAiC,CACrC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,CAAC;IAyCrC;;;;;;;;OAQG;IACG,mCAAmC,CACvC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,2BAA2B,CAAC;IAmDvC;;;;;OAKG;IACG,cAAc,CAClB,oBAAoB,EAAE,MAAM,EAC5B,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,0BAA0B,CAAC;IAqBtC;;;;;;;;;;;OAWG;IACG,sBAAsB,CAAC,OAAO,EAAE;QACpC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,UAAU,CAAC;KAClB,CAAC;IA+BF;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,UAAU,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,aAAa,CAAC;IA6B1B;;;;;;;;;OASG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,aAAa,CAAC;IA8B1B;;;;;;;;OAQG;IACG,yBAAyB,CAAC,OAAO,EAAE;QACvC,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyB1B;;;;;;;;OAQG;IACG,WAAW,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,kBAAkB,EAAE,MAAM,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;KAClD,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCjB;;OAEG;YACW,YAAY;IAuB1B;;OAEG;YACW,aAAa;IAa3B;;OAEG;IACH,OAAO,CAAC,aAAa;CAGtB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,aAAa,EAIb,mBAAmB,EACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAsB,UAAU,EAAuB,MAAM,WAAW,CAAC;AAGhF;;;;;;;;;GASG;AAEH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAsB;gBAExB,MAAM,EAAE,mBAAmB;IAIvC;;;;;;;;;OASG;IACG,iCAAiC,CACrC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,CAAC;IAyCrC;;;;;;;;OAQG;IACG,mCAAmC,CACvC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,2BAA2B,CAAC;IAmDvC;;;;;OAKG;IACG,cAAc,CAClB,oBAAoB,EAAE,MAAM,EAC5B,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,0BAA0B,CAAC;IAgCtC;;;;;;;;;;;OAWG;IACG,sBAAsB,CAAC,OAAO,EAAE;QACpC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,UAAU,CAAC;KAClB,CAAC;IAqCF;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,OAAO,EAAE;QAClC,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,UAAU,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,aAAa,CAAC;IA6B1B;;;;;;;;;OASG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,aAAa,CAAC;IA8B1B;;;;;;;;OAQG;IACG,yBAAyB,CAAC,OAAO,EAAE;QACvC,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyB1B;;;;;;;;OAQG;IACG,WAAW,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,kBAAkB,EAAE,MAAM,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;KAClD,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCjB;;OAEG;YACW,YAAY;IAuB1B;;OAEG;YACW,aAAa;IAa3B;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAS/C;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;CAgBzG"}

package/dist/auth/client.js

@@ -115,6 +115,15 @@ export class OAuth2Client {
      * @param metadata - Client metadata
      */
     async registerClient(registrationEndpoint, metadata) {
+        // SEP-837: default application_type to 'native' when every redirect URI is
+        // loopback (CLI/desktop), so the AS accepts localhost redirects; otherwise
+        // 'web'. An explicit value from the caller always wins.
+        if (metadata.application_type === undefined) {
+            const allLoopback = Array.isArray(metadata.redirect_uris) &&
+                metadata.redirect_uris.length > 0 &&
+                metadata.redirect_uris.every((uri) => OAuth2Client.isLoopbackRedirect(uri));
+            metadata = { ...metadata, application_type: allLoopback ? 'native' : 'web' };
+        }
         const response = await fetch(registrationEndpoint, {
             method: 'POST',
             headers: {
@@ -163,6 +172,11 @@ export class OAuth2Client {
             // RFC 8707 - Resource Indicators
             params.append('resource', options.resource);
         }
+        if (options.prompt) {
+            // SEP-2207: OIDC authorization servers may need prompt=consent to
+            // (re-)issue a refresh token for offline_access.
+            params.append('prompt', options.prompt);
+        }
         const authUrl = `${options.authorizationEndpoint}?${params.toString()}`;
         return { authUrl, state, pkce };
     }
@@ -326,5 +340,39 @@ export class OAuth2Client {
     generateState() {
         return crypto.randomBytes(16).toString('hex');
     }
+    /**
+     * Whether a redirect URI targets loopback (localhost / 127.0.0.1 / [::1]),
+     * used to infer `application_type: 'native'` for DCR (SEP-837).
+     */
+    static isLoopbackRedirect(uri) {
+        try {
+            const host = new URL(uri).hostname;
+            return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Validate the issuer returned on an authorization response (RFC 9207 /
+     * SEP-2468). MCP 2026-07-28 clients MUST verify the `iss` parameter on the
+     * authorization redirect matches the authorization server's issuer to defend
+     * against mix-up attacks. Throws on mismatch.
+     *
+     * @param receivedIss - `iss` query parameter from the authorization redirect.
+     * @param expectedIssuer - Issuer from the AS metadata used to start the flow.
+     */
+    static validateAuthorizationIssuer(receivedIss, expectedIssuer) {
+        // RFC 9207: if the AS advertised authorization_response_iss_parameter_supported
+        // the client MUST validate iss. A missing iss from such an AS is a failure;
+        // callers that know the AS omits it can skip this call.
+        if (receivedIss === undefined || receivedIss === null || receivedIss === '') {
+            throw new Error('Authorization response is missing the required `iss` parameter (RFC 9207 / SEP-2468).');
+        }
+        const normalize = (u) => u.replace(/\/+$/, '');
+        if (normalize(receivedIss) !== normalize(expectedIssuer)) {
+            throw new Error(`Authorization response issuer mismatch (RFC 9207 / SEP-2468): expected "${expectedIssuer}", got "${receivedIss}".`);
+        }
+    }
 }
 //# sourceMappingURL=client.js.map

package/dist/auth/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAY5B,OAAO,EAAE,kBAAkB,EAAc,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE5F;;;;;;;;;GASG;AAEH,MAAM,OAAO,YAAY;IACf,MAAM,CAAsB;IAEpC,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iCAAiC,CACrC,WAAmB;QAEnB,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBACxC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACzD,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;oBACnD,IAAI,MAAM,EAAE,gBAAgB,EAAE,CAAC;wBAC7B,+BAA+B;wBAC/B,OAAO,MAAM,IAAI,CAAC,aAAa,CAA4B,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBACtF,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qCAAqC;QACvC,CAAC;QAED,8BAA8B;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAEpD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAA4B,GAAG,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe;gBACf,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,sDAAsD,WAAW,IAAI;YACrE,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mCAAmC,CACvC,MAAc;QAEd,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,uCAAuC;QACvC,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC;YAChC,gCAAgC;YAChC,aAAa,CAAC,IAAI,CAChB,GAAG,SAAS,CAAC,MAAM,0CAA0C,IAAI,EAAE,CACpE,CAAC;YACF,qCAAqC;YACrC,aAAa,CAAC,IAAI,CAChB,GAAG,SAAS,CAAC,MAAM,oCAAoC,IAAI,EAAE,CAC9D,CAAC;YACF,qCAAqC;YACrC,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,aAAa,CAAC,IAAI,CAChB,GAAG,SAAS,CAAC,MAAM,yCAAyC,CAC7D,CAAC;YACF,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,mCAAmC,CAAC,CAAC;QAC7E,CAAC;QAED,eAAe;QACf,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAA8B,GAAG,CAAC,CAAC;gBAE5E,gDAAgD;gBAChD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CACb,qDAAqD;wBACrD,kDAAkD,CACnD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe;gBACf,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,wDAAwD,MAAM,IAAI;YAClE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,oBAA4B,EAC5B,QAAmC;QAEnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,QAAQ,EAAE,kBAAkB;aAC7B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAmD,CAAC;YACxG,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,MAAM,MAAM,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,CAChH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAgC,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAO5B;QAKC,wDAAwD;QACxD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAExC,qCAAqC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAEpD,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,KAAK;YACL,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,iCAAiC;YACjC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAExE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAQ1B;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;SAC1C,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,QAAQ,EAAE,kBAAkB;SAC7B,CAAC;QAEF,wBAAwB;QACxB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAC9C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,OAOlB;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,QAAQ,EAAE,kBAAkB;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAC9C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,yBAAyB,CAAC,OAM/B;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,QAAQ,EAAE,kBAAkB;YAC5B,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CACnC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAC9C,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SACvB,CAAC;QAEF,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,OAMjB;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAC9C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CACxB,QAAgB,EAChB,MAAuB,EACvB,OAA+B;QAE/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,IAAmB,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,iBAAiB,IAAI,eAAe,EAAE,CACvF,CAAC;QACJ,CAAC;QAED,OAAO,IAAqB,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAc,GAAW;QAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/auth/client.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAY5B,OAAO,EAAE,kBAAkB,EAAc,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE5F;;;;;;;;;GASG;AAEH,MAAM,OAAO,YAAY;IACf,MAAM,CAAsB;IAEpC,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iCAAiC,CACrC,WAAmB;QAEnB,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBACxC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACzD,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;oBACnD,IAAI,MAAM,EAAE,gBAAgB,EAAE,CAAC;wBAC7B,+BAA+B;wBAC/B,OAAO,MAAM,IAAI,CAAC,aAAa,CAA4B,MAAM,CAAC,gBAAgB,CAAC,CAAC;oBACtF,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qCAAqC;QACvC,CAAC;QAED,8BAA8B;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAEpD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAA4B,GAAG,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe;gBACf,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,sDAAsD,WAAW,IAAI;YACrE,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mCAAmC,CACvC,MAAc;QAEd,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,uCAAuC;QACvC,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC;YAChC,gCAAgC;YAChC,aAAa,CAAC,IAAI,CAChB,GAAG,SAAS,CAAC,MAAM,0CAA0C,IAAI,EAAE,CACpE,CAAC;YACF,qCAAqC;YACrC,aAAa,CAAC,IAAI,CAChB,GAAG,SAAS,CAAC,MAAM,oCAAoC,IAAI,EAAE,CAC9D,CAAC;YACF,qCAAqC;YACrC,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,aAAa,CAAC,IAAI,CAChB,GAAG,SAAS,CAAC,MAAM,yCAAyC,CAC7D,CAAC;YACF,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,mCAAmC,CAAC,CAAC;QAC7E,CAAC;QAED,eAAe;QACf,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAA8B,GAAG,CAAC,CAAC;gBAE5E,gDAAgD;gBAChD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CACb,qDAAqD;wBACrD,kDAAkD,CACnD,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe;gBACf,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,wDAAwD,MAAM,IAAI;YAClE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,oBAA4B,EAC5B,QAAmC;QAEnC,2EAA2E;QAC3E,2EAA2E;QAC3E,wDAAwD;QACxD,IAAI,QAAQ,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACrC,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBACjC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9E,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,QAAQ,EAAE,kBAAkB;aAC7B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAmD,CAAC;YACxG,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,MAAM,MAAM,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,CAChH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAgC,CAAC;QACnE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAa5B;QAKC,wDAAwD;QACxD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAExC,qCAAqC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAEpD,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,KAAK;YACL,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,iCAAiC;YACjC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,kEAAkE;YAClE,iDAAiD;YACjD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAExE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAQ1B;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;SAC1C,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,QAAQ,EAAE,kBAAkB;SAC7B,CAAC;QAEF,wBAAwB;QACxB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAC9C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,OAOlB;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,QAAQ,EAAE,kBAAkB;SAC7B,CAAC;QAEF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAC9C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,yBAAyB,CAAC,OAM/B;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,QAAQ,EAAE,kBAAkB;YAC5B,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CACnC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAC9C,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SACvB,CAAC;QAEF,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,OAMjB;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAC9C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CACxB,QAAgB,EAChB,MAAuB,EACvB,OAA+B;QAE/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,IAAmB,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,iBAAiB,IAAI,eAAe,EAAE,CACvF,CAAC;QACJ,CAAC;QAED,OAAO,IAAqB,CAAC;IAC/B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAc,GAAW;QAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CAAC,GAAW;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACnC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAAC,WAAsC,EAAE,cAAsB;QAC/F,gFAAgF;QAChF,4EAA4E;QAC5E,wDAAwD;QACxD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,2EAA2E,cAAc,WAAW,WAAW,IAAI,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -26,6 +26,7 @@ export * from './server-metadata.js';
 export * from './token-validation.js';
 export { createAuthMiddleware, requireScopes, optionalAuth, RequireScopes, isAuthenticated, hasScope, hasAnyScope, hasAllScopes, } from './middleware.js';
 export { OAuth2Client } from './client.js';
-export { TokenStore, MemoryTokenStore, FileTokenStore, createDefaultTokenStore, isTokenExpired, calculateExpiration, tokenResponseToStored, } from './token-store.js';
+export { TokenStore, MemoryTokenStore, FileTokenStore, createDefaultTokenStore, isTokenExpired, calculateExpiration, tokenResponseToStored, getIssuerBoundToken, } from './token-store.js';
+export { createClientIdMetadataDocument, validateClientIdMetadataDocument, validateClientIdentifierUrl, resolveClientIdMetadataDocument, isClientIdMetadataUrl, isSpecialUseIp, assertSafeFetchTarget, readBoundedJson, MAX_CIMD_DOCUMENT_BYTES, DEFAULT_CIMD_FETCH_TIMEOUT_MS, type ClientIdMetadataDocument, } from './cimd.js';
 export { configureServerAuth, createScopeGuards, createMCPScopeGuards, getStandardMCPScopes, validateAuthConfig, } from './server-integration.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EACL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,SAAS,EACT,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAK1B,cAAc,YAAY,CAAC;AAG3B,cAAc,WAAW,CAAC;AAG1B,cAAc,sBAAsB,CAAC;AAGrC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EACL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,SAAS,EACT,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAK1B,cAAc,YAAY,CAAC;AAG3B,cAAc,WAAW,CAAC;AAG1B,cAAc,sBAAsB,CAAC;AAGrC,cAAc,uBAAuB,CAAC;AAGtC,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,eAAe,EACf,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,8BAA8B,EAC9B,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,EAC/B,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC"}

package/dist/auth/index.js

@@ -40,7 +40,9 @@ export { createAuthMiddleware, requireScopes, optionalAuth, RequireScopes, isAut
 // OAuth client (for clients)
 export { OAuth2Client } from './client.js';
 // Token storage
-export { MemoryTokenStore, FileTokenStore, createDefaultTokenStore, isTokenExpired, calculateExpiration, tokenResponseToStored, } from './token-store.js';
+export { MemoryTokenStore, FileTokenStore, createDefaultTokenStore, isTokenExpired, calculateExpiration, tokenResponseToStored, getIssuerBoundToken, } from './token-store.js';
+// Client ID Metadata Documents (CIMD) — the 2026-07-28 DCR replacement.
+export { createClientIdMetadataDocument, validateClientIdMetadataDocument, validateClientIdentifierUrl, resolveClientIdMetadataDocument, isClientIdMetadataUrl, isSpecialUseIp, assertSafeFetchTarget, readBoundedJson, MAX_CIMD_DOCUMENT_BYTES, DEFAULT_CIMD_FETCH_TIMEOUT_MS, } from './cimd.js';
 // Server integration helpers
 export { configureServerAuth, createScopeGuards, createMCPScopeGuards, getStandardMCPScopes, validateAuthConfig, } from './server-integration.js';
 //# sourceMappingURL=index.js.map