@poe-platform/safe-js 0.1.807 → 0.1.809

package/dist/safe-js/chunks/{chunk-E7V44LSN.js → chunk-5KAVJF3R.js}

@@ -5145,11 +5145,25 @@ function normalizeBearerTokenType(value) {
 
 // packages/mcp-oauth/src/client/register-client.ts
 async function registerOAuthClient(input) {
-  if (new URL(input.redirectUri).protocol === "https:") validateHostedOAuthRedirect(input.redirectUri);
-  else loopbackTarget({ redirectUri: input.redirectUri });
+  if (input.redirectUri !== void 0 && input.redirectUris !== void 0)
+    throw new Error("Specify either redirectUri or redirectUris, not both");
+  const redirects = input.redirectUris === void 0 ? [input.redirectUri] : input.redirectUris;
+  if (!Array.isArray(redirects) || redirects.length === 0 || redirects.length > 32)
+    throw new Error("OAuth registration requires one to 32 redirect URIs");
+  const redirectUris = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const redirectUri of redirects) {
+    if (typeof redirectUri !== "string" || redirectUri.length === 0)
+      throw new Error("Invalid OAuth registration redirect URI");
+    if (seen.has(redirectUri)) throw new Error("Duplicate OAuth registration redirect URI");
+    if (new URL(redirectUri).protocol === "https:") validateHostedOAuthRedirect(redirectUri);
+    else loopbackTarget({ redirectUri });
+    seen.add(redirectUri);
+    redirectUris.push(redirectUri);
+  }
   const body = JSON.stringify(buildClientRegistrationBody(
     input.metadata,
-    input.redirectUri,
+    redirectUris,
     normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? "none"
   ));
   if (new TextEncoder().encode(body).byteLength > 65536) throw new Error("OAuth registration request is too large");
@@ -5168,9 +5182,9 @@ function getOwnString2(input, key2) {
   const descriptor = Object.getOwnPropertyDescriptor(input, key2);
   return descriptor !== void 0 && "value" in descriptor && typeof descriptor.value === "string" ? descriptor.value : void 0;
 }
-function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
+function buildClientRegistrationBody(metadata, redirectUris, tokenEndpointAuthMethod) {
   const body = {
-    redirect_uris: [redirectUri],
+    redirect_uris: redirectUris,
     grant_types: ["authorization_code", "refresh_token"],
     response_types: ["code"],
     token_endpoint_auth_method: tokenEndpointAuthMethod
@@ -6576,19 +6590,38 @@ function createParameterHeaders(definitions, argumentsValue) {
 // packages/tiny-mcp-client/src/oauth-discovery.ts
 var metadataErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.tiny-mcp-client.OAuthMetadataError");
 var OAuthMetadataError = class extends Error {
-  constructor(phase, message, status) {
+  constructor(phase, message, status, reason = status === void 0 ? "invalid-metadata" : "http-error", failures = []) {
     super(message);
     this.phase = phase;
     this.status = status;
+    this.reason = reason;
+    this.failures = failures;
     this.name = "OAuthMetadataError";
+    this.category = reason === "invalid-json" ? "json" : reason === "http-error" ? "http" : reason === "network-error" ? "network" : "validation";
     Object.defineProperty(this, metadataErrorBrand, { value: true });
   }
   phase;
   status;
+  reason;
+  failures;
   static is(value) {
     return value instanceof Error && Object.getOwnPropertyDescriptor(value, metadataErrorBrand)?.value === true;
   }
+  category;
 };
+function metadataFailure(error, phase, reason) {
+  return OAuthMetadataError.is(error) ? error : new OAuthMetadataError(
+    phase,
+    error instanceof Error ? error.message : String(error),
+    void 0,
+    reason
+  );
+}
+function aggregateMetadataFailures(phase, errors2, message) {
+  const primary = errors2.find((error) => error.category === "validation") ?? errors2[0];
+  const failures = errors2.map(({ phase: phase2, category, reason, status }) => Object.freeze({ phase: phase2, category, reason, status }));
+  return new OAuthMetadataError(phase, message, primary.status, primary.reason, Object.freeze(failures));
+}
 function defaultOAuthMetadataFetch(input, init) {
   return fetch(input, init);
 }
@@ -6654,14 +6687,16 @@ function validateAuthorizationServerMetadata(value, issuer) {
   if (value.issuer !== issuer) {
     throw new OAuthMetadataError(
       "authorization-server",
-      `Authorization server metadata issuer mismatch: expected ${issuer}, received ${value.issuer}`
+      `Authorization server metadata issuer mismatch: expected ${issuer}, received ${value.issuer}`,
+      void 0,
+      "issuer-mismatch"
     );
   }
   if (typeof value.authorization_endpoint !== "string" || value.authorization_endpoint.length === 0) {
-    throw new Error("Authorization server metadata must include authorization_endpoint");
+    throw new OAuthMetadataError("authorization-server", "Authorization server metadata must include authorization_endpoint", void 0, "invalid-endpoint");
   }
   if (typeof value.token_endpoint !== "string" || value.token_endpoint.length === 0) {
-    throw new Error("Authorization server metadata must include token_endpoint");
+    throw new OAuthMetadataError("authorization-server", "Authorization server metadata must include token_endpoint", void 0, "invalid-endpoint");
   }
   for (const field of ["authorization_endpoint", "token_endpoint", "registration_endpoint"]) {
     if (field === "registration_endpoint" && value[field] === void 0) {
@@ -6673,19 +6708,25 @@ function validateAuthorizationServerMetadata(value, issuer) {
         throw new Error();
       }
       endpoint = new URL(value[field]);
-    } catch {
-      throw new Error(`Authorization server metadata ${field} must be an absolute URL`);
+      assertSecureUrl2(endpoint, `Authorization server metadata ${field}`);
+    } catch (error) {
+      throw new OAuthMetadataError("authorization-server", `Authorization server metadata ${field} must be an absolute URL: ${error instanceof Error ? error.message : "invalid URL"}`, void 0, "invalid-endpoint");
     }
-    assertSecureUrl2(endpoint, `Authorization server metadata ${field}`);
   }
   if (!isStringArray(value.response_types_supported) || !value.response_types_supported.includes("code")) {
-    throw new Error(
-      "Authorization server metadata must include response_types_supported containing code"
+    throw new OAuthMetadataError(
+      "authorization-server",
+      "Authorization server metadata must include response_types_supported containing code",
+      void 0,
+      "response-type-unsupported"
     );
   }
   if (!isStringArray(value.code_challenge_methods_supported) || !value.code_challenge_methods_supported.includes("S256")) {
-    throw new Error(
-      "Authorization server metadata must include code_challenge_methods_supported containing S256"
+    throw new OAuthMetadataError(
+      "authorization-server",
+      "Authorization server metadata must include code_challenge_methods_supported containing S256",
+      void 0,
+      "pkce-unsupported"
     );
   }
   return value;
@@ -6701,19 +6742,24 @@ async function readJsonResponse(response, phase, signal) {
   try {
     return JSON.parse(text);
   } catch {
-    throw new Error(`${label} response must be valid JSON`);
+    throw new OAuthMetadataError(phase, `${label} response must be valid JSON`, void 0, "invalid-json");
   }
 }
 async function fetchMetadata(fetch2, location, phase, parentSignal) {
   parentSignal?.throwIfAborted();
   const deadline = AbortSignal.timeout(1e4);
   const signal = parentSignal === void 0 ? deadline : AbortSignal.any([deadline, parentSignal]);
-  const response = await fetchMcpResponse(fetch2, location, {
-    method: "GET",
-    headers: { Accept: "application/json" },
-    signal
-  });
-  return readJsonResponse(response, phase, signal);
+  try {
+    const response = await fetchMcpResponse(fetch2, location, {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      signal
+    });
+    return await readJsonResponse(response, phase, signal);
+  } catch (error) {
+    parentSignal?.throwIfAborted();
+    throw metadataFailure(error, phase, "network-error");
+  }
 }
 function resolveWellKnownMetadataUrl(inputUrl, suffix) {
   const url = new URL(typeof inputUrl === "string" ? inputUrl : inputUrl.toString());
@@ -6823,7 +6869,7 @@ var OAuthMetadataDiscovery = class {
     if (resourceMetadataUrl === void 0) {
       locations.add(new URL("/.well-known/oauth-protected-resource", resource).toString());
     }
-    let lastError;
+    const errors2 = [];
     for (const location of locations) {
       try {
         const metadata = validateProtectedResourceMetadata(
@@ -6833,17 +6879,18 @@ var OAuthMetadataDiscovery = class {
         return { location, metadata };
       } catch (error) {
         signal?.throwIfAborted();
-        lastError = error;
+        errors2.push(metadataFailure(error, "protected-resource", "invalid-metadata"));
       }
     }
-    throw lastError;
+    throw aggregateMetadataFailures("protected-resource", errors2, errors2.at(-1).message);
   }
-  async discover(resourceUrl, { resourceMetadataUrl, signal } = {}) {
+  async discover(resourceUrl, { resourceMetadataUrl, signal, expectedIssuer } = {}) {
     signal?.throwIfAborted();
+    if (expectedIssuer !== void 0) validateAuthorizationServerIssuer(expectedIssuer);
     const cacheKey = canonicalizeResourceIndicator(resourceUrl);
     resolveProtectedResourceMetadataUrl(resourceUrl, resourceMetadataUrl);
     const memoryCachedResult = this.memoryCache.get(cacheKey);
-    if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0) {
+    if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0 && (expectedIssuer === void 0 || memoryCachedResult.authorizationServer === expectedIssuer)) {
       return structuredClone(memoryCachedResult);
     }
     const sharedCachedResult = resourceMetadataUrl === void 0 ? await waitForCache(this.cache?.get(cacheKey), signal) : void 0;
@@ -6851,44 +6898,63 @@ var OAuthMetadataDiscovery = class {
     if (sharedCachedResult !== null && sharedCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       try {
         const result = validateCachedDiscovery(sharedCachedResult, cacheKey);
-        this.memoryCache.set(cacheKey, structuredClone(result));
-        return result;
+        if (expectedIssuer === void 0 || result.authorizationServer === expectedIssuer) {
+          this.memoryCache.set(cacheKey, structuredClone(result));
+          return result;
+        }
       } catch {
         await waitForCache(this.cache?.delete?.(cacheKey), signal);
       }
     }
     const { location: resourceMetadataLocation, metadata: resourceMetadata } = await this.discoverProtectedResource(cacheKey, resourceMetadataUrl, signal);
     const authorizationServerErrors = [];
-    for (const authorizationServer of resourceMetadata.authorization_servers) {
-      const normalizedAuthorizationServer = validateAuthorizationServerIssuer(authorizationServer);
+    const failures = [];
+    if (expectedIssuer !== void 0 && !resourceMetadata.authorization_servers.includes(expectedIssuer)) {
+      throw new OAuthMetadataError("authorization-server", "Expected issuer was not advertised by the protected resource", void 0, "issuer-mismatch");
+    }
+    const authorizationServers = expectedIssuer === void 0 ? resourceMetadata.authorization_servers : [expectedIssuer];
+    for (const authorizationServer of authorizationServers) {
+      let normalizedAuthorizationServer;
+      try {
+        normalizedAuthorizationServer = validateAuthorizationServerIssuer(authorizationServer);
+      } catch (error) {
+        const failure = metadataFailure(error, "authorization-server", "invalid-metadata");
+        failures.push(failure);
+        authorizationServerErrors.push(failure.message);
+        continue;
+      }
       const metadataLocations = authorizationServerMetadataLocations(normalizedAuthorizationServer);
       for (const authorizationServerMetadataUrl of metadataLocations) {
+        let authorizationServerMetadata;
         try {
-          const authorizationServerMetadata = validateAuthorizationServerMetadata(
+          authorizationServerMetadata = validateAuthorizationServerMetadata(
             await fetchMetadata(this.fetchImpl, authorizationServerMetadataUrl, "authorization-server", signal),
             normalizedAuthorizationServer
           );
-          const result = {
-            resource: resourceMetadata.resource,
-            resourceMetadataUrl: resourceMetadataLocation,
-            resourceMetadata,
-            authorizationServer: normalizedAuthorizationServer,
-            authorizationServerMetadataUrl,
-            authorizationServerMetadata
-          };
-          this.memoryCache.set(cacheKey, structuredClone(result));
-          await waitForCache(this.cache?.set(cacheKey, structuredClone(result)), signal);
-          return result;
         } catch (error) {
           signal?.throwIfAborted();
+          failures.push(metadataFailure(error, "authorization-server", "invalid-metadata"));
           authorizationServerErrors.push(
             `${authorizationServerMetadataUrl}: ${error instanceof Error ? error.message : String(error)}`
           );
+          continue;
         }
+        const result = {
+          resource: resourceMetadata.resource,
+          resourceMetadataUrl: resourceMetadataLocation,
+          resourceMetadata,
+          authorizationServer: normalizedAuthorizationServer,
+          authorizationServerMetadataUrl,
+          authorizationServerMetadata
+        };
+        await waitForCache(this.cache?.set(cacheKey, structuredClone(result)), signal);
+        this.memoryCache.set(cacheKey, structuredClone(result));
+        return result;
       }
     }
-    throw new OAuthMetadataError(
+    throw aggregateMetadataFailures(
       "authorization-server",
+      failures,
       `Unable to load authorization server metadata for ${cacheKey}: ${authorizationServerErrors.join(
         "; "
       )}`

package/dist/safe-js/chunks/{chunk-7RGEML7S.js → chunk-EUKAVPB5.js}

@@ -2,7 +2,7 @@ import {
   McpError,
   connectMcpTransport,
   normalizeMcpOptions
-} from "./chunk-E7V44LSN.js";
+} from "./chunk-5KAVJF3R.js";
 import {
   declareHostOperation,
   runResources

package/dist/safe-js/chunks/{cli-runtime-EV4DQ7UW.js → cli-runtime-UC3OADSS.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-XQOJJA4C.js";
 import {
   parseMcpConfig
-} from "./chunk-E7V44LSN.js";
+} from "./chunk-5KAVJF3R.js";
 import {
   lint,
   makeEnvModule,
@@ -296,7 +296,7 @@ async function runScriptFile(filepath, parsed, options) {
     import("./dump-OX7M4C56.js"),
     import("./runtime-modules-UOVJSSD7.js"),
     import("../modules/fs.js"),
-    import("./mcp-DSJET2K4.js")
+    import("./mcp-IOBUSD2E.js")
   ]);
   const loaded = loadExecutableSource(filepath, await options.readFile(filepath, "utf8"));
   const meta = {

package/dist/safe-js/chunks/{mcp-DSJET2K4.js → mcp-IOBUSD2E.js}

@@ -1,7 +1,7 @@
 import {
   makeMcpModule
-} from "./chunk-7RGEML7S.js";
-import "./chunk-E7V44LSN.js";
+} from "./chunk-EUKAVPB5.js";
+import "./chunk-5KAVJF3R.js";
 import "./chunk-ROIZEQTS.js";
 import "./chunk-EQUBWQJN.js";
 import "./chunk-2IYZK337.js";

package/dist/safe-js/cli.js

@@ -13,7 +13,7 @@ import { createHostFileSystem } from "@poe-platform/safe-fs/node";
 import { fileURLToPath } from "node:url";
 async function runCli(argv, options = {}) {
   if (!argv.includes("--help") && !argv.includes("-h")) {
-    const runtime = await import("./chunks/cli-runtime-EV4DQ7UW.js");
+    const runtime = await import("./chunks/cli-runtime-UC3OADSS.js");
     return runtime.runCli(argv, options, createUsage());
   }
   const brokenPipe = createBrokenPipeState();
@@ -32,7 +32,7 @@ async function runCli(argv, options = {}) {
         stderr.write(`${error instanceof Error ? error.message : String(error)}
 `);
         if (brokenPipe.closed) return 0;
-        const { exitCodeForError } = await import("./chunks/cli-runtime-EV4DQ7UW.js");
+        const { exitCodeForError } = await import("./chunks/cli-runtime-UC3OADSS.js");
         return exitCodeForError(error);
       }
     }

package/dist/safe-js/index.js

@@ -8,7 +8,7 @@ import {
 } from "./chunks/chunk-425IYA26.js";
 import {
   makeMcpModule
-} from "./chunks/chunk-7RGEML7S.js";
+} from "./chunks/chunk-EUKAVPB5.js";
 import {
   AgentSpawnError,
   SPAWN_MODES,
@@ -24,7 +24,7 @@ import {
 } from "./chunks/chunk-XQOJJA4C.js";
 import {
   parseMcpConfig
-} from "./chunks/chunk-E7V44LSN.js";
+} from "./chunks/chunk-5KAVJF3R.js";
 import {
   captureHostContext,
   deepCopyFromSandbox,

package/dist/safe-js/workerd.js

@@ -81716,19 +81716,38 @@ function createParameterHeaders(definitions2, argumentsValue) {
 // packages/tiny-mcp-client/src/oauth-discovery.ts
 var metadataErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.tiny-mcp-client.OAuthMetadataError");
 var OAuthMetadataError = class extends Error {
-  constructor(phase, message, status) {
+  constructor(phase, message, status, reason = status === void 0 ? "invalid-metadata" : "http-error", failures = []) {
     super(message);
     this.phase = phase;
     this.status = status;
+    this.reason = reason;
+    this.failures = failures;
     this.name = "OAuthMetadataError";
+    this.category = reason === "invalid-json" ? "json" : reason === "http-error" ? "http" : reason === "network-error" ? "network" : "validation";
     Object.defineProperty(this, metadataErrorBrand, { value: true });
   }
   phase;
   status;
+  reason;
+  failures;
   static is(value) {
     return value instanceof Error && Object.getOwnPropertyDescriptor(value, metadataErrorBrand)?.value === true;
   }
+  category;
 };
+function metadataFailure(error, phase, reason) {
+  return OAuthMetadataError.is(error) ? error : new OAuthMetadataError(
+    phase,
+    error instanceof Error ? error.message : String(error),
+    void 0,
+    reason
+  );
+}
+function aggregateMetadataFailures(phase, errors, message) {
+  const primary = errors.find((error) => error.category === "validation") ?? errors[0];
+  const failures = errors.map(({ phase: phase2, category, reason, status }) => Object.freeze({ phase: phase2, category, reason, status }));
+  return new OAuthMetadataError(phase, message, primary.status, primary.reason, Object.freeze(failures));
+}
 function defaultOAuthMetadataFetch(input, init) {
   return fetch(input, init);
 }
@@ -81794,14 +81813,16 @@ function validateAuthorizationServerMetadata(value, issuer) {
   if (value.issuer !== issuer) {
     throw new OAuthMetadataError(
       "authorization-server",
-      `Authorization server metadata issuer mismatch: expected ${issuer}, received ${value.issuer}`
+      `Authorization server metadata issuer mismatch: expected ${issuer}, received ${value.issuer}`,
+      void 0,
+      "issuer-mismatch"
     );
   }
   if (typeof value.authorization_endpoint !== "string" || value.authorization_endpoint.length === 0) {
-    throw new Error("Authorization server metadata must include authorization_endpoint");
+    throw new OAuthMetadataError("authorization-server", "Authorization server metadata must include authorization_endpoint", void 0, "invalid-endpoint");
   }
   if (typeof value.token_endpoint !== "string" || value.token_endpoint.length === 0) {
-    throw new Error("Authorization server metadata must include token_endpoint");
+    throw new OAuthMetadataError("authorization-server", "Authorization server metadata must include token_endpoint", void 0, "invalid-endpoint");
   }
   for (const field of ["authorization_endpoint", "token_endpoint", "registration_endpoint"]) {
     if (field === "registration_endpoint" && value[field] === void 0) {
@@ -81813,19 +81834,25 @@ function validateAuthorizationServerMetadata(value, issuer) {
         throw new Error();
       }
       endpoint = new URL(value[field]);
-    } catch {
-      throw new Error(`Authorization server metadata ${field} must be an absolute URL`);
+      assertSecureUrl(endpoint, `Authorization server metadata ${field}`);
+    } catch (error) {
+      throw new OAuthMetadataError("authorization-server", `Authorization server metadata ${field} must be an absolute URL: ${error instanceof Error ? error.message : "invalid URL"}`, void 0, "invalid-endpoint");
     }
-    assertSecureUrl(endpoint, `Authorization server metadata ${field}`);
   }
   if (!isStringArray(value.response_types_supported) || !value.response_types_supported.includes("code")) {
-    throw new Error(
-      "Authorization server metadata must include response_types_supported containing code"
+    throw new OAuthMetadataError(
+      "authorization-server",
+      "Authorization server metadata must include response_types_supported containing code",
+      void 0,
+      "response-type-unsupported"
     );
   }
   if (!isStringArray(value.code_challenge_methods_supported) || !value.code_challenge_methods_supported.includes("S256")) {
-    throw new Error(
-      "Authorization server metadata must include code_challenge_methods_supported containing S256"
+    throw new OAuthMetadataError(
+      "authorization-server",
+      "Authorization server metadata must include code_challenge_methods_supported containing S256",
+      void 0,
+      "pkce-unsupported"
     );
   }
   return value;
@@ -81841,19 +81868,24 @@ async function readJsonResponse(response, phase, signal) {
   try {
     return JSON.parse(text);
   } catch {
-    throw new Error(`${label} response must be valid JSON`);
+    throw new OAuthMetadataError(phase, `${label} response must be valid JSON`, void 0, "invalid-json");
   }
 }
 async function fetchMetadata(fetch2, location, phase, parentSignal) {
   parentSignal?.throwIfAborted();
   const deadline = AbortSignal.timeout(1e4);
   const signal = parentSignal === void 0 ? deadline : AbortSignal.any([deadline, parentSignal]);
-  const response = await fetchMcpResponse(fetch2, location, {
-    method: "GET",
-    headers: { Accept: "application/json" },
-    signal
-  });
-  return readJsonResponse(response, phase, signal);
+  try {
+    const response = await fetchMcpResponse(fetch2, location, {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      signal
+    });
+    return await readJsonResponse(response, phase, signal);
+  } catch (error) {
+    parentSignal?.throwIfAborted();
+    throw metadataFailure(error, phase, "network-error");
+  }
 }
 function resolveWellKnownMetadataUrl(inputUrl, suffix) {
   const url = new URL(typeof inputUrl === "string" ? inputUrl : inputUrl.toString());
@@ -81963,7 +81995,7 @@ var OAuthMetadataDiscovery = class {
     if (resourceMetadataUrl === void 0) {
       locations.add(new URL("/.well-known/oauth-protected-resource", resource).toString());
     }
-    let lastError;
+    const errors = [];
     for (const location of locations) {
       try {
         const metadata = validateProtectedResourceMetadata(
@@ -81973,17 +82005,18 @@ var OAuthMetadataDiscovery = class {
         return { location, metadata };
       } catch (error) {
         signal?.throwIfAborted();
-        lastError = error;
+        errors.push(metadataFailure(error, "protected-resource", "invalid-metadata"));
       }
     }
-    throw lastError;
+    throw aggregateMetadataFailures("protected-resource", errors, errors.at(-1).message);
   }
-  async discover(resourceUrl, { resourceMetadataUrl, signal } = {}) {
+  async discover(resourceUrl, { resourceMetadataUrl, signal, expectedIssuer } = {}) {
     signal?.throwIfAborted();
+    if (expectedIssuer !== void 0) validateAuthorizationServerIssuer(expectedIssuer);
     const cacheKey = canonicalizeResourceIndicator(resourceUrl);
     resolveProtectedResourceMetadataUrl(resourceUrl, resourceMetadataUrl);
     const memoryCachedResult = this.memoryCache.get(cacheKey);
-    if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0) {
+    if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0 && (expectedIssuer === void 0 || memoryCachedResult.authorizationServer === expectedIssuer)) {
       return structuredClone(memoryCachedResult);
     }
     const sharedCachedResult = resourceMetadataUrl === void 0 ? await waitForCache(this.cache?.get(cacheKey), signal) : void 0;
@@ -81991,44 +82024,63 @@ var OAuthMetadataDiscovery = class {
     if (sharedCachedResult !== null && sharedCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       try {
         const result = validateCachedDiscovery(sharedCachedResult, cacheKey);
-        this.memoryCache.set(cacheKey, structuredClone(result));
-        return result;
+        if (expectedIssuer === void 0 || result.authorizationServer === expectedIssuer) {
+          this.memoryCache.set(cacheKey, structuredClone(result));
+          return result;
+        }
       } catch {
         await waitForCache(this.cache?.delete?.(cacheKey), signal);
       }
     }
     const { location: resourceMetadataLocation, metadata: resourceMetadata } = await this.discoverProtectedResource(cacheKey, resourceMetadataUrl, signal);
     const authorizationServerErrors = [];
-    for (const authorizationServer of resourceMetadata.authorization_servers) {
-      const normalizedAuthorizationServer = validateAuthorizationServerIssuer(authorizationServer);
+    const failures = [];
+    if (expectedIssuer !== void 0 && !resourceMetadata.authorization_servers.includes(expectedIssuer)) {
+      throw new OAuthMetadataError("authorization-server", "Expected issuer was not advertised by the protected resource", void 0, "issuer-mismatch");
+    }
+    const authorizationServers = expectedIssuer === void 0 ? resourceMetadata.authorization_servers : [expectedIssuer];
+    for (const authorizationServer of authorizationServers) {
+      let normalizedAuthorizationServer;
+      try {
+        normalizedAuthorizationServer = validateAuthorizationServerIssuer(authorizationServer);
+      } catch (error) {
+        const failure = metadataFailure(error, "authorization-server", "invalid-metadata");
+        failures.push(failure);
+        authorizationServerErrors.push(failure.message);
+        continue;
+      }
       const metadataLocations = authorizationServerMetadataLocations(normalizedAuthorizationServer);
       for (const authorizationServerMetadataUrl of metadataLocations) {
+        let authorizationServerMetadata;
         try {
-          const authorizationServerMetadata = validateAuthorizationServerMetadata(
+          authorizationServerMetadata = validateAuthorizationServerMetadata(
             await fetchMetadata(this.fetchImpl, authorizationServerMetadataUrl, "authorization-server", signal),
             normalizedAuthorizationServer
           );
-          const result = {
-            resource: resourceMetadata.resource,
-            resourceMetadataUrl: resourceMetadataLocation,
-            resourceMetadata,
-            authorizationServer: normalizedAuthorizationServer,
-            authorizationServerMetadataUrl,
-            authorizationServerMetadata
-          };
-          this.memoryCache.set(cacheKey, structuredClone(result));
-          await waitForCache(this.cache?.set(cacheKey, structuredClone(result)), signal);
-          return result;
         } catch (error) {
           signal?.throwIfAborted();
+          failures.push(metadataFailure(error, "authorization-server", "invalid-metadata"));
           authorizationServerErrors.push(
             `${authorizationServerMetadataUrl}: ${error instanceof Error ? error.message : String(error)}`
           );
+          continue;
         }
+        const result = {
+          resource: resourceMetadata.resource,
+          resourceMetadataUrl: resourceMetadataLocation,
+          resourceMetadata,
+          authorizationServer: normalizedAuthorizationServer,
+          authorizationServerMetadataUrl,
+          authorizationServerMetadata
+        };
+        await waitForCache(this.cache?.set(cacheKey, structuredClone(result)), signal);
+        this.memoryCache.set(cacheKey, structuredClone(result));
+        return result;
       }
     }
-    throw new OAuthMetadataError(
+    throw aggregateMetadataFailures(
       "authorization-server",
+      failures,
       `Unable to load authorization server metadata for ${cacheKey}: ${authorizationServerErrors.join(
         "; "
       )}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-js",
-  "version": "0.1.807",
+  "version": "0.1.809",
   "description": "Budgeted JavaScript interpreter with explicit host capabilities and resumable execution",
   "type": "module",
   "license": "MIT",
@@ -82,7 +82,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@poe-platform/safe-fs": "0.1.807",
+    "@poe-platform/safe-fs": "0.1.809",
     "@petamoriken/float16": "^3.9.3",
     "@noble/hashes": "2.4.0",
     "@formatjs/intl-localematcher": "0.8.13",