@ractive-ch/tab-mcp 0.5.0 → 0.6.0

package/index.js

@@ -462,6 +462,7 @@ var MAX_JWT_BYTES = 8192;
 var MAX_JWKS_BYTES = 65536;
 var JWKS_TTL_MS = 10 * 60000;
 var JWKS_REFETCH_MS = 30000;
+var UNKNOWN_KID_REFETCH_MS = 5000;
 var JWKS_GRACE_MS = 60 * 60000;
 var FETCH_TIMEOUT_MS = 5000;
 
@@ -626,6 +627,7 @@ class HttpJsonError extends Error {
 class JwksCache {
   #url;
   #now;
+  #load;
   #keys = [];
   #fetchedAt = 0;
   #attemptedAt = Number.NEGATIVE_INFINITY;
@@ -634,14 +636,17 @@ class JwksCache {
   constructor(url, options = {}) {
     this.#url = typeof url === "string" ? () => Promise.resolve(url) : url;
     this.#now = options.now ?? Date.now;
+    this.#load = options.load ?? ((u) => fetchJson(u));
   }
   async keys(kid) {
+    const entered = this.#now();
     if (this.#inflight !== undefined)
       await this.#inflight.catch(() => {});
     const now = this.#now();
     const stale = now - this.#fetchedAt >= JWKS_TTL_MS;
-    const unknown = kid !== undefined && !this.#keys.some((k) => k.kid === kid);
-    if ((stale || unknown) && now - this.#attemptedAt >= JWKS_REFETCH_MS) {
+    const unknown = kid !== undefined && !this.#has(kid);
+    const floor = unknown && this.#lastError === undefined ? UNKNOWN_KID_REFETCH_MS : JWKS_REFETCH_MS;
+    if ((stale || unknown) && now - this.#attemptedAt >= floor) {
       try {
         await this.#refresh();
       } catch (error) {
@@ -651,13 +656,21 @@ class JwksCache {
     if (this.#now() - this.#fetchedAt >= JWKS_TTL_MS + JWKS_GRACE_MS) {
       throw this.#lastError ?? new Error("the JWKS could not be loaded");
     }
-    return kid === undefined ? this.#keys : this.#keys.filter((k) => k.kid === kid);
+    if (kid === undefined)
+      return this.#keys;
+    if (!this.#has(kid) && this.#fetchedAt < entered) {
+      throw this.#lastError ?? new Error("an unknown key id; the JWKS was fetched too recently");
+    }
+    return this.#keys.filter((k) => k.kid === kid);
+  }
+  #has(kid) {
+    return this.#keys.some((k) => k.kid === kid);
   }
   #refresh() {
     this.#inflight ??= (async () => {
       this.#attemptedAt = this.#now();
       try {
-        const doc = await fetchJson(await this.#url());
+        const doc = await this.#load(await this.#url());
         const keys = doc?.keys;
         if (!Array.isArray(keys))
           throw new Error("a JWKS needs keys");
@@ -1205,7 +1218,7 @@ function parseTabMessage(text) {
   }
 }
 // package.json
-var version = "0.5.0";
+var version = "0.6.0";
 
 // src/exchange.ts
 var RelayErrorCode = {
@@ -1550,6 +1563,11 @@ class Exchange {
   }
 }
 
+// src/icons.ts
+var FAVICON_SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><title>tab-mcp relay</title><rect width="64" height="64" rx="14" fill="#1d4ed8"/><path d="M32 22l3.4-7A3.5 3.5 0 0 1 38.6 13h9.8a3.5 3.5 0 0 1 3.2 2l3.4 7z" fill="#fff" fill-opacity=".45"/><path d="M9 49V26a5 5 0 0 1 5-5h.5l3.7-7.4A3.5 3.5 0 0 1 21.3 12h9.4a3.5 3.5 0 0 1 3.1 1.6L37.5 21H50a5 5 0 0 1 5 5v23a5 5 0 0 1-5 5H14a5 5 0 0 1-5-5z" fill="#fff"/><rect x="22" y="35.5" width="20" height="5" fill="#1d4ed8"/><circle cx="21" cy="38" r="6" fill="#1d4ed8"/><circle cx="43" cy="38" r="6" fill="#1d4ed8"/></svg>';
+var FAVICON_ICO = new Uint8Array(Buffer.from("AAABAAMAEBAAAAEAIABoBAAANgAAACAgAAABACAAqBAAAJ4EAAAwMAAAAQAgAKglAABGFQAAKAAAABAAAAAgAAAAAQAgAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAANhOHQfYTh1x2E4d5dhOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3n2E4dd9hOHQnYTh1u2E4d89hNG//XTBr/2Ewa/9hMGv/YTBr/2Ewa/9hMGv/YTBr/2Ewa/9hMGv/XTBr/2E0b/9hOHfXYTh132E4d39hNHP/ea0L/66WM/+2slP/tq5T/7auU/+2rlP/tq5T/7auU/+2rlP/trJT/66aN/99uRv/YTRz/2E4d59hOHf7YTx//8b2r///////////////////////////////////////////////////////yw7P/2VEg/9hOHf/YTh3/2VIi//TMvf///////fbz//vs5////v7/////////////////++3o//318v//////9dHE/9lUJP/YTh3/2E4d/9lSIv/0zL7//PLu/+SGZf/dZjz/7a6X//fZzv/32c7/7rGc/95nPf/kg2D/++/r//XSxf/ZUyT/2E4d/9hOHf/ZUiL/9M7A//bWy//ZUiL/10oX/9lUJf/cYjf/3GI3/9pVJv/XShj/2FAf//XRxP/108f/2VMk/9hOHf/YTh3/2VIi//TMvv/88/D/5Ytr/95qQf/us57/+N7U//je1P/vt6P/32xD/+WHZv/88e3/9dLF/9lTJP/YTh3/2E4d/9lSIv/0y73///////349v/88Ov///////////////////////zw7P/99/X///////XRxP/ZVCT/2E4d/9hOHf/YUCD/8sa2///////////////////////////////////////////////////////zy7z/2VIi/9hOHf/YTh3/2E0c/+J9WP/21cn////+///////////////////////77Ob/+eLa//nj2//44dn/6Jh7/9hNHP/YTh3/2E4d/9hOHf/XTBr/3WY8//nm3//////////////////88/D/7a+Y/+qghv/qoYf/6p2D/95oPv/YTRz/2E4d/9hOHf3YTh3/2E4d/9hNHP/pm3//+unj//rq5P/66eP/7KiQ/+N/W//khmX/5Idl/+F4U//ZUiL/2E4d/9hOHf/YTh3d2E4d/9hOHf/YTh3/2VIi/9xhNv/dZDn/3GI2/9lSIv/YTh3/2FAf/9hQH//YTh3/2E4d/9hOHf/YTh3l2E4daNhOHfHYTh3/2E4d/9hOHf/YTRv/2E0b/9hNG//YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3z2E4dcdhOHQXYTh1o2E4d3dhOHf3YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf7YTh3f2E4dbthOHQcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAAACAAAABAAAAAAQAgAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAANhOHQDYTh0A2E4dANhOHTrYTh2l2E4d6thOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d7thOHazYTh1C2E4dAdhOHQDYTh0A2E4dANhOHQTYTh1p2E4d5NhOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHenYTh112E4dB9hOHQDYTh0A2E4dZthOHfbYTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHfrYTh112E4dAdhOHTTYTh3g2E4d/9hOHf/YTh3/2E4d/9hNHP/YTBv/2Ewb/9hMG//YTBv/2Ewb/9hMG//YTBv/2Ewb/9hMG//YTBv/2Ewb/9hMG//YTBv/2Ewb/9hMG//YTBv/2Ewb/9hMG//YTRv/2E4d/9hOHf/YTh3/2E4d/9hOHenYTh1C2E4dmNhOHf/YTh3/2E4d/9hNHP/YTx7/3F8z/95pQP/eaUD/3mlA/95pQP/eaUD/3mlA/95pQP/eaUD/3mlA/95pQP/eaUD/3mlA/95pQP/eaUD/3mlA/95pQP/eaUD/3mlA/9xhNf/YTx//2E0c/9hOHf/YTh3/2E4d/9hOHazYTh3e2E4d/9hOHf/YTh3/2VMj/+qghv/55N3/++/q//vv6v/77+r/++/q//vv6v/77+r/++/q//vv6v/77+r/++/q//vv6v/77+r/++/q//vv6v/77+r/++/q//vv6v/77+v/+ubf/+yokP/aVSb/2E0c/9hOHf/YTh3/2E4d7thOHfnYTh3/2E4d/9dMGv/jf1z//fj2/////////////////////////////////////////////////////////////////////////////////////////////////////////////vz7/+WKav/XSxr/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/10sZ/+qghv//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////7a2W/9hMG//YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/XSxr/66SL///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////usZv/2Ewb/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/rpIv///////////////////////zz8P/55d7//PLu/////////////////////////////////////////////PPw//nl3v/88u7//////////////////////+6xm//YTBv/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/10sa/+uki//////////////////zx7j/4XVO/9xeMv/gcUn/8cCu//////////////////////////////////PHuP/gdE7/3F4y/+BxSf/xv67///79////////////7rGb/9hMG//YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/XSxr/66SL////////////+N7U/9xhNf/XSxn/2E0c/9dLGf/bWy7/7rCa//LDs//ywrH/8sKx//LDsv/vtaD/3GE1/9dLGf/YTRz/10sZ/9tbLv/21cn////////////usZv/2Ewb/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/rpIv////////////usZz/2Ewb/9hOHf/YTh3/2E4d/9hNHP/YTh3/2E8e/9hPHv/YTx7/2E8e/9hOHf/YTRz/2E4d/9hOHf/YTh3/10sZ/+uljP///////////+6xm//YTBv/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/10sa/+uki////////////+6znv/YTBv/2E4d/9hOHf/YTh3/2E0c/9lQIP/ZUiP/2VIi/9lSIv/ZUiP/2VEh/9hNHP/YTh3/2E4d/9hOHf/XSxn/7KeO////////////7rGb/9hMG//YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/XSxr/66SL////////////+eLa/91mPP/XShj/2Ewb/9dLGf/cYDT/8Luo//TPwf/0zcD/9M3A//TOwf/xwK//3WU7/9dKGP/YTBv/10sZ/9xgM//32s/////////////usZv/2Ewb/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/rpIv/////////////////9dDD/+N/W//dZjv/4npW//PJuv/////////////////////////////////10MP/439b/91mO//ie1b/88m6/////////////////+6xm//YTBv/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/10sa/+uki////////////////////////fj2//vt5//99/T////////////////////////////////////////////9+Pb/++3n//339P//////////////////////7rGb/9hMG//YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/XSxr/66SL///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////usZv/2Ewb/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/rpIv//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////+6wm//YTBv/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/10sZ/+eSdP//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////6p6D/9dLGv/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTRv/3GE2//XTxv////////////////////////////////////////////////////////////////////////////////////////////////////////////nj2//fbkb/2Ewb/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTRz/3GE2/+eSc//21sv///////////////////////////////////////////////////////vs5//0zb//9M2///TNv//0zb//9M2///TNv//yxbX/66aN/91kOf/YTRz/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTRv/10kX/+N/W//99/T////////////////////////////////////////////+/fz/8b6s/+mbf//pnIH/6ZyB/+mcgf/pnIH/6ZyB/+mdgv/liWn/2VMj/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YThz/2VMk//LGtv////////////////////////////////////////////nl3v/ro4n/6Z2C/+qeg//qnoP/6p6D/+qeg//qnoP/6Z2B/95rQv/YTRz/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/XTBr/439b//339f/////////////////////////////////++vn/6p+F/+iWef/qn4T/6p+E/+qfhP/qn4T/6p+E/+qfhP/liGf/2VMk/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d+NhOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/ZUiP/7KiP//nm3//66uT/+urk//rq5P/66uT/+ufg/+6wmv/aVij/3WQ5/+B0Tv/hdU//4XVO/+F1Tv/hdU//4HFJ/9pZK//YTRz/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3a2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hNHP/YUCD/3F8z/91jOP/dYzj/3WM4/91jOP/cYDT/2VEh/9hNHP/YTRz/2E0b/9hNHP/YTRz/2E0c/9hNHP/YTRv/2E0c/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d6thOHZHYTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTRz/2E0b/9hNG//YTRv/2E0b/9hNHP/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh2l2E4dLdhOHdrYTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d5NhOHTrYTh0A2E4dWthOHfDYTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHfbYTh1p2E4dANhOHQDYTh0B2E4dWthOHdrYTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3g2E4dZthOHQTYTh0A2E4dANhOHQDYTh0A2E4dLdhOHZHYTh3a2E4d+NhOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHfnYTh3e2E4dmNhOHTTYTh0A2E4dANhOHQBgAAACgAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAGAAAABYAAABigAAAAwAAAAYAAAAAEAIAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANhOHQDYTh0A2E4dANhOHRDYTh1c2E4ds9hOHevYTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3w2E4dvNhOHWfYTh0X2E4dANhOHQDYTh0AAAAAAAAAAAAAAAAA2E4dANhOHQDYTh0A2E4dQdhOHbnYTh332E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHfrYTh3F2E4dUNhOHQPYTh0A2E4dAAAAAADYTh0A2E4dANhOHQPYTh1o2E4d6thOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d8thOHXvYTh0H2E4dANhOHQDYTh0A2E4dANhOHWXYTh302E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHfrYTh172E4dA9hOHQDYTh0A2E4dO9hOHefYTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3y2E4dUNhOHQDYTh0L2E4dr9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4dxdhOHRfYTh1M2E4d8thOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hNHP/XSxn/2Ewb/9hNHP/YTRz/2E0c/9hNHP/YTRz/2E0c/9hNHP/YTRz/2E0c/9hNHP/YTRz/2E0c/9hNHP/YTRz/2E0c/9hNHP/YTRz/2E0c/9hNHP/YTRz/2E0c/9hNHP/YTRz/2E0c/9hNHP/YTRz/2E0b/9dLGf/YTRv/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d+thOHWfYTh2f2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E0b/9xhNv/nlHb/7rCa/++1oP/vtaD/77Wg/++1oP/vtaD/77Wg/++1oP/vtaD/77Wg/++1oP/vtaD/77Wg/++1oP/vtaD/77Wg/++1oP/vtaD/77Wg/++1oP/vtaD/77Wg/++1oP/vtaD/77Wg/++1oP/vtaD/7rGc/+iYfP/eZz3/2E0c/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHbzYTh3Y2E4d/9hOHf/YTh3/2E4d/9hOHf/YTBv/4HFJ//fZz//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////54tr/4nxY/9hMG//YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHfDYTh3z2E4d/9hOHf/YTh3/2E4d/9hNHP/aVif/88q7////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////99nO/9tdMP/YTRz/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3+2E4d/9hOHf/YTh3/2E4d/9hMG//fbkX//PLu/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////vn4/+J8WP/XSxr/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/ifVn//vn4//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////7+/+aObv/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////////////////////zy7v/44dn/+ebf//759//////////////////////////////////////////////////////////////////++/r/+ujh//jg2P/87+v///////////////////////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4///////////////////////99fP/7a+Y/99wSP/bXC//3GA0/+OBX//0z8H///////////////////////////////////////////////////////bYzf/liWj/3GI3/9tcLv/fbEP/66WM//zw7P////////////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////759//ol3v/2E4d/9dMGv/YTRz/2E0b/9dLGf/bXTD/88i4////////////////////////////////////////////9tXK/91lOv/XSxn/2E0b/9hNHP/YTBr/2E0b/+WJaP/88/D///////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////PHuP/ZUyP/2E0c/9hOHf/YTh3/2E4d/9hOHf/YTBr/3mk//+ynjv/sqpL/7KmS/+ypkv/sqZL/7KmS/+ypkv/sqZH/4HJL/9dMGv/YTh3/2E4d/9hOHf/YTh3/2E4d/9hPHv/vtqL///////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4/////////////////+eUd//XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E0c/9dMGv/XTBr/10wa/9dMGv/XTBr/10wa/9dMGv/XTBr/2E0b/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGf/kg2D//vv6//////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4/////////////vz8/+SFY//XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dMGv/hdU7//fb0//////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4/////////////////+iZfP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E0c/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E0c/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGf/lh2b//vz7//////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////TOwf/aVyj/2E0c/9hOHf/YTh3/2E4d/9hOHf/XSxr/4HJK//C5pv/wvKr/8Lyp//C8qf/wvKn/8Lyp//C8qv/wvKn/4nxY/9dLGv/YTh3/2E4d/9hOHf/YTh3/2E0c/9lRIf/xvq3///////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////78+//rpYz/2VIj/9dLGf/YTBv/2Ewa/9dLGf/dZTv/9dPG////////////////////////////////////////////+N/W/99vR//XSxn/2Ewa/9hMG//XSxr/2E8f/+iWef/9+Pb///////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4///////////////////////++vn/8b+u/+N/W//eZz3/32xE/+eSdP/33NL///////////////////////////////////////////////////////nk3P/pmn7/329H/91mPP/ielX/77ai//329P////////////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////////////////////759//77ej//PHt///9/f////////////////////////////////////////////////////////////////////7//PLu//vs5//99/X///////////////////////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////7+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/jflr//vr4///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////+/+aPcP/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9dLGv/heVT//fj2//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////39/+WKaf/XSxn/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hNG//dZTr/+urk/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////PPw/+BySv/YTBr/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTx//7KuU////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////8Luo/9lTJP/YThz/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTRz/21os/+yrlP/66uT//vn3//////////////////////////////////////////////////////////////////////////////////////////////38//78+//+/Pv//vz7//78+//+/Pv//vz7//78+//+/Pv//vv6//318v/21cn/5oxs/9pYKv/YTRz/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E0c/9hPH//dZDn/44Jf//nk3f/////////////////////////////////////////////////////////////////////////////////99fP/8cGv/++3pP/vuKT/77ik/++4pP/vuKT/77ik/++4pP/vuKT/77ai/+2slf/qoIb/5Ytr/9lUJf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTBv/10oZ/+qfhf/////////////////////////////////////////////////////////////////////////////////21Mj/6Z2C/+mcgf/pnIH/6ZyB/+mcgf/pnIH/6ZyB/+mcgf/pnIH/6ZyB/+mdgv/pnIH/32xD/9hNHP/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E0b/9xiN//54tr///////////////////////////////////////////////////////////////////////318v/tr5n/6Z2B/+qeg//qnoP/6p6D/+qeg//qnoP/6p6D/+qeg//qnoP/6p6D/+qfhP/mjG3/2VQl/9hOHP/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hMG//qoIX///////////////////////////////////////////////////////////////////////bUyP/qnoP/6p6D/+qeg//qnoP/6p6D/+qeg//qnoP/6p6D/+qeg//qnoP/6p6D/+mdgv/fbkb/2E0c/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hNG//cYjf/+eLa////////////////////////////////////////////////////////////++zn/+iVeP/pnYL/6p6D/+qeg//qnoP/6p6D/+qeg//qnoP/6p6D/+qeg//qnoP/6p+F/+aNbv/aVSb/2E4c/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3+2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTBv/6Z2C////////////////////////////////////////////////////////////7a2X/9pWJ//kgmD/6Zl9/+mbgP/pm4D/6ZuA/+mbgP/pm4D/6ZuA/+mbgP/pm3//5pBx/91kOf/YTRz/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3x2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTRz/2lcp/+yokP/44dj/+urk//rq5P/66uT/+urk//rq5P/66uT/+urk//nj2//us57/210w/9hMG//ZUiL/3F8y/91jOP/dZDn/3WQ5/91kOf/dZDn/3WQ5/91kOf/cYjb/2lYo/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3T2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E0c/9hPHv/bXC//3WM4/91jOP/dYzj/3WM4/91jOP/dYzj/3WM4/9teMf/YUB//2E0c/9hOHf/YTh3/2E0c/9hNG//YTRv/2E0b/9hNG//YTRv/2E0b/9hNG//YTRz/2E0c/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHevYTh2W2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTRz/2E0b/9hNG//YTRv/2E0b/9hNG//YTRv/2E0b/9hNHP/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHbPYTh1D2E4d7thOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d99hOHVzYTh0H2E4do9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4dudhOHRDYTh0A2E4dL9hOHd7YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3q2E4dQdhOHQDYTh0A2E4dANhOHVPYTh3r2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHfTYTh1o2E4dANhOHQDYTh0A2E4dANhOHQDYTh1T2E4d3thOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d59hOHWXYTh0D2E4dANhOHQAAAAAA2E4dANhOHQDYTh0A2E4dL9hOHaPYTh3u2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHfLYTh2v2E4dO9hOHQDYTh0A2E4dAAAAAAAAAAAAAAAAANhOHQDYTh0A2E4dANhOHQfYTh1D2E4dlthOHdPYTh3x2E4d/thOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/9hOHf/YTh3/2E4d/thOHfPYTh3Y2E4dn9hOHUzYTh0L2E4dANhOHQDYTh0AAAAAAAAAAADYAAAAABsAALAAAAAABQAAQAAAAAACAADAAAAAAAEAAIAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAQAAwAAAAAADAABgAAAAAAIAALAAAAAADQAA2AAAAAAbAAA=", "base64"));
+var APPLE_TOUCH_ICON = new Uint8Array(Buffer.from("iVBORw0KGgoAAAANSUhEUgAAALQAAAC0EAYAAABtXdpxAAA5HElEQVR42u2dZ2AUVReGn5lt6Z1OqKF3BFEICEqVKqICCggKgoqIHxYURSmCCgoooiBFBRUQlCagIkhTegdp0lsChPSy2Znvx9yhrEYBk2w2uc+fN7szO3t3NvvOmXPPvVfBS4mM7NDhjz/+8rRFqCuLl7UzJGKBoaXFfuWTDb2zhqHFPjc0vK54vMTQIqcMDRHPO1aK437o6fMhkeRhMg1xXTY06ZKhF78x9FxXQ2N6GHr5KUP3fmzorvmGntojNM3QjO5ZvJ8qVDOfOHVq8eLKlT19Gm4dxdMNuFncDNlst/73e1vFF1pujqF1xT9Cs6OGVhthaKWhhvodF2oer5OnP69EInFWNzR1gqHnvzJ0bydDN48zdH2gofvWGnol6d+O7C2GnWcN2s2QrUIz/37vYu8b2jTR0A4tDL37HUNL3m2o5eWbfHvTqPPs+ZFI8iG3+btLGG7onlWGrhQR9rJPDd07wdCM2VkdIa8adp4zIGHMf7lFEUwypMp9hj7S0dBOcw2tWstQmwWJRFLAuSDuoNeIyHvOs4aufs/QpNVuL/ARRp3m6ZabeNyg3SJlP6EpN+5VqbehvUVuuGtzQ0uvzOKwGULtnv58Eokk1zEDO/XGp1O2GrpmsqGfNjD0px8MTV3idhyLMOys+rRynFw3aDdDzqJTL3yAoT3XG/r0UkOjSmVx2Cy+EIlEIrka8Pm5PS06JRe1N/SDzwzdYgZ2y4Q6hKbndiok1wzazZjNEyAiXaW0oU1Fjvj1GYY2WW6oJcLtcKahy1SGRCK5VbII6M5MNPTjSoZOEb4TV9/t9aowao0cJscNWhhzFlUXQZGGDhSPn/va0MKN3A4jDVkikWQ3WXRKauUM/XGkoa91MHR7kNvrHcKo03OqgTlm0P/c2VfRx9ARuw19UNx6WEuIHcwymYCcap9EIpG4kUXf1WHhRyNE3fXX5Q11TRA7XO07y+4USLYZ9M3VKTcQ5XCThBHf+bDbYczeU5/s+4gSiUSSHSRFGzpaRMwThc+lbhE7+AtNzi6jzu5OtSyMucV2Q2c+YuhfjNncXxqzRCLJa4iRxgGiaOFNMdLxrS8MDXLbD/8sRjrfMv/ZoN1SGW7G3NZp6FRRp1yluNvL5YAQiUSS1zEj41RDHE8a+kJjQ8fcYWiw0GtG/V/f+LaN8Z87/1rsMHSqGHJdZrTYIAwbW3aePYlEIslF3HLVrm2GfiSSGq8J/0sWBn77A2Bu2aD/OXRvIMbGm6mMKiXFBmnMEokkv+Hma87nDB3zu6GjxAhGZwWx3y0PfLnpFEcWdcyCiqIXc5IYSHLVmE2kMUskkvyG6WsiMraJqShejDW0306xfZhQ163mpm81B23WIYsQP0gY8Yhdht75kNv++s0cVCKRSLwYs7hB5J59jxn6xmBD73PPVFhv5qBwEwbt5vgiNDdH/g0Us8s96F59ITv/JBJJQcPsFBQBbGExf/wY8biM2XmYKXzV998OeLMRtNsY9qZiHuXnvjXUaqY0zCS4NGaJRFJQcUsB1x9r6IuHxOaNYkOqW7HFX8hyw9+PBDQnMZovei2bbRLb5cg/iUQiuRG3TEKKWNGpZ1FDF0x3f4H7AJe/RNBuKQ23Ido91xjaZJnby6QxSyQSyY2YAbBIBfuJWTn/Jx4X3ey2/1/mGsoqxeGWxDbnY35aGPPV2eU8Nk+qRCKReAlufnr3YkMf7+q231+qPK4atNsGc2kpUTbSWywVE1XW7YBydjmJRCK5Ocy6abF4bu/WhpYf5rbf1dSzmtUGgypi5ZKu97rtJyNniUQiuTXcxoNUFCu7dF/ott/V8mTlnwun3xQjYIYf8vQnk0gkknyCmaEQqY/9vxraWqyheGqauWMWOWhzlexO37htyPEVBCQSiSSf45aTrjzE0FYZbvvZTIN2yyU3jTfUXCX7KnLNP4lEIskeRCStivmkHxQDAP0+ENudpuGKnLJ1nqEdWhpqcxvaLZFIJJJswi2SvlNUx1XvmsUO5cTsS3ebServhdqRSCQSSQ4SJhZnbS4mndvsnrKoK3LOJe/2dFMlEomkYBK93NCA4aZBiyGIzY4aannZ002USCSSgkntOEOjVgqDjhB1eNVGebppEolEUrAJEyux1OkhctClRSdhpVc83TSJRCIp2DhEH2B0qDDo8omG+omJpqnp6SZKbpIzxOIE/W79Sf4EPVWvw27Qz+tR7AS9Mf35E0ghDR3vnQhWQ0cHqlEOH1Bcykaqg+Kr7KAGKMHspRYoY5RnKAL44ZBFoRIvw232u3J7hEHfWcNQv0883UJJFtiwooDeRx/FGdBGaIFMAmtdawtlBYSmBYar6yDk8cCllksQ2iVokqUoBPj5PqdGgDKTYZQEkknzyuFGUUpJ7ODq7PqGdyG+R9Ia130Q91ViXVdNiNucONrlgMThKbu1laBH6h04CGojdTV9QLmTqvgCLq/89JKCgVv4VLuwMOhiX4hnRP2zXBHF4yji3MeRiAtcMVoPZoN/uM8CdRXUX1U13LcFND9Z/5OAk1DfUnW073gIHu3fSx0BwbUC1lu+B//9vsPUbaBMYSPFMCJpb7SosqzHDq5qWjprIeHp5HquLpDwTPI6rRfEjrxSP/NlWH1oW3jybljzwLbeyQdh3/xjD6eVA22z/jmLQb1LSeJOwEmmXJBNkkcRKecQu5iLY0WM8USrQp5umURwnktkgjZdj2UdlFtT/Dn7HnjmzS51wsZDu86NXIE6+G/xbaz+68I5BY+zly5+lPkmzLq0bG3cszDHtvKX+PYQvzopyNUT1HeUetwHpJL+n4xaNRIp+kf6fC6D3pSnOQacJgYncEZoIileeWH8N/zwQQVKUBgrUIRQrKDMZwylQBmjDKCIpxvpvZgRtDkB/+OebpDEwLVJa84MuLNO1Rd8u8OITv02FvkCagSWb+jwAcTg0KuRoEiBFFh0YbPizqN4eMSz1jfhZaWHtdArUC2l3DKfMjCi/fQOMTa4MOvSi5nfgnpOfYMuQDoZN2XUqnF8fZD+AedA78hLnATHPttipSYEvOL7slob7FbbD4ov+G/0HaQeARuWWOUoEE8yGqCjeXUEH0kRbJAZ5XLqXSC5ddpUvSJk9HUmaKcguXJqcb0spMVnVNcmAB1oTBAovypTKPtf37zgICLo8yOMh0Ve93SDCiwObCigtda+YSlElYxsZW8EE355/qNiO6D2yopVfPpft78m4jFVdoX9Lek40bl6Xk3mlF0ZEF8BRqXOOBLzKSQVT12oJYBySfmRKlwzehMz1XSZBFygd9Zf5iT4fuTzlvo1lHqsiGYLhajRJafa20PEoZBx1oFgGammMQjUtupW+oFSjCNKbcAlbl+92Zy5dl71SjzMIdCWaHfo00Arqo/gW7jcPaGGKwn+7HbmSIYNTiSd+z5jNiTekZKubQE+VV6hOCjlKIH9b867BLhq0GmLjIeODp5uUEFFr6P35Aj4v+rrUp0wfuxzIUWbQtvvGrUMDLl+R6EFOVq+FTJxoQNWLCjgcrhO0QlGPT+rUcxC+OzAovfjloOyUplIGaAIYVi5asz6IU6SAbyof8h5KDom/E5rI2gwqtpiv/5QuEnYs9YDYLmotuEt0O16NPuAPzlLBnCWWDKBJFLzVYrD/D/0w4ECFKcQNqA4EVhB2aPMoQJob+l7+QUuvxY/3LUNtp34IzW1Jhz3O5eWMQz0N5hKDChtaUgAshPXDWHQ+lPisaziyG0sRgTsKq79xJvQZsHdSwOXw4d+/6tc7HHwDXIUVSZ4upH5ADOF4cCOAocdp+7NeAF6vTii+el2cDL+/EvOnaAuVrvQlquds5SjOHYovbHYSfswuMtW/bjfPAhZEtBO/QH0b/QENgDHOUcG1yJuiYE/vqigNDA6Z1MrpIfoQ2Fzh/0JKT/DwcknymbUBe0pfbX+IygNqIYv3n+HkU2Yt8fSmD2EHqI35wAEFfP3VwdBt8ktHw++XxpztiOM2aRCl8jG9hegw/jGq4L6gDJZeZHiXI24tQS9OruhSFhYqNUJDR01/udngZB+AcHqXNBH6wdYDZzgvDTmfyDZuHPQV+gav4HvcPvXystwV9lqNfxGQpl1xY7bXgPdrjdmH5ApI+jrkflLT2EaQbD+GvMgenHNNf7toeHxGl38Mv/74SVZ4BKdc3N4i5LwYFCzgKCHIHJ+kWhbaXDt0u5nFvhWsj+h9oc6r1da6/suBH3u/63aHfS9emG2YqRMJDePXeSsC9GaA+B43x6rdIDajSv+7vMgBEf5h1ueB72R3o8/Pd3YvIM0aA+hV9C7cAiCzvidVPtB19YtKgRHg++XjnHKPE+3Lh9jMeswDCo8E9nR/iJ0eKXxt0E9QWlFAwIgqlXkAPu9ULJUYbvtMOhb9CC2wI2vltwy5oCr2Xoc66HwjJDL1p+gaq2yfo7WoJRWjlMHSBDVLgUcadC5jSiu0nz1l5kHjcbV+tK/FTQ8X7O7n8y75R5m1cAb9KEwdC7T9IGg6lClbdmujrIQNajkWPv9YJmoWhgMbOMPUj3d6HxEKhlo1zphy58o8YDdBqEbA8tbzoBeWG/DAQp86kgadC6jt9Sf4zgEzvdbqj4G3Ua3eDC4JfhudsxTvkeOcMst3H74UQMiR9vbQN/tHRPD+kL4oeANlmagn9HLsYMCbxTZjnk2o+nHnxCw289PvRMqaJHpjj6gKMomalDgI2lp0LmFyMFpVv0FvoHoDbV2+neChlVqvu/nd91+BX3ASW4jyrrUzsou+sG9o+oV9X8VIt4KbmHtAfofejG2YRi0/F6yH1HHrwQTgAXKh5Z8yR4IIX4BEyzrQQ/TWxbkSFoadC6htxCR8/t+M9RHoFtsyy+Du4Lv5453lbkYQ44LcKTgMSw3/gYi9gS/bXkWqjYuW8hxPzCUnhQCLhKP7LzNMXQRSZu/j6ieka/ZWwG/KB9RBrjIFXOGioKENOicRkTE2gW9B7Mh+vdau/wfgIauGk/7XX/2feX0mB7FHJnZgzaEQI3BUVN8/oCQJoErLNtAL6m346CnG5mPEQGK8oDSlCAon1Gir90Xgj/3f9EyBvQy+gMcpMBF0tISchi9sN6GPyDokv959SnotqHl28EPgO/jjq7KDK6VfUk8i9uQ+ULfh9SzTIJqo8t2cDwCPExzgrk2hFySvZgjNyvpD3EYgn8MeMfyLpT/qcQddg0YxCOEA5eJL0iRtDTonEJUCWi6/hxfQ/TWmnv9H4CGp2o87Hf9P5hFFm7lKcxI+mkeJAxqfhW1xuc4hDQPXGXZDnopvWNBjORyjTNcxAmKTdlKTYg6VbKkvQ4ERvnfb2kBejP9GY5RYKY6kAadQ+hFRORc3Bgh2PWZlk2D7wXfzxxjlLmebp0kS9wi6YiFIXUtk6DaorKDHD2BR0Qk/V+nKZX8PeZsgUH6feyHkBmBVssxKPde8Ra2zUBZY+g9qTc5+6CXIw06uzFHCAboQ5kLjV6r+bF/c2i4v0Y7P6enGye5acw66RbcSQDUnBK1zOdPCHkkcKtlN+g+YmiyrO7IGY4Zk02pk9VoWkCFbZF7HN0gYJFvZdUKeg/9TU55upE5jzTobEavr/fmKAT95rdF7Q3d+reIDm4GvksdnyoLuHYLLcnbuNluxLshhS3vQbXpZR93PAo8QQdCgUuyuiNHMCNpXW/AXgirGtTQUh7KDCs+2D4N+I09pJLvU03SoLMLUa6lOfQhzIVGn9Za4N8GGsbV7H19mbOcv9nLMG+ju3AvwVDj0ajRPnsg9MXA05YDoKv63exFRtI5xSljRRo1WJ3Oo1Dxs8gh9jfAb5JPa3UP6P30MZz1dCNzDmkW2YTeXh/CSQj8ym+R+ih0u9Dy8+Cu4HvEsUJZAqTJnKVX4ma6hb4NqWOZCFVHlm3reBgYQT+KABe4LCPpHMCMpC3GhTB8Vkgv6xNQZmSxhbbngWks4jLk11ooadD/FXMllGT9KeZA9Le1fvZvBw2Dawz1s163n4+Y2FzinZipqcdpSyjU6BY1ymcvhHQM3GjZCXohvXVBHvGW44g1Hi2TVTsvQMUqpU46JoPvlz7j1Hmg99Xf5oynG5n9SIP+j+hV9W4chqAf/FapPaGb1nJx8GPg29/RU5kFpBWM3uZ8j3ud9LKQuyyToNoLZZs4HgT60pFQCvzcETmGWSedrtdlNxQ6HtLdOg1KP1dkn60p6AMZzzmuraCTT7D+90MUEMx/kA3sIgVoog/gT3DFah/zJjRaVkv3PwYN59Vo49cR6C5e53PjRPESL8c9kr4/6nWfw7BvzbGT6Rsh7pXEba5gUE6zhMqebqxHMWzSvHN8TGlNCCituYtAjBG2t8NODpEGlk6W1xkHFfuW3uEYD8eXny/uPAdpQ9LnadNAmaAMppinT8F/Rxq0eUuaQhoa6C30gRwHrYu+iB+Ap/R3OAs0U+7AH6w1LBeVOeD3p69dOQ5BP/kHWQpBd0urN4KfAt+xjv3Ks57+UJIcwz2S/jiktGU81Him/IMOB2z9+cCIVCcoZ5WpSjkKbspDTF2gv86n+gVwDnP+SiBkHnN9pN8D+hj9C2IBVTEmS9rKTMqDslgZR2mgDMWuLiZ7fURsBkrxenV2QeGSoWWsu6DU4CKxtlpwcPHJV9JPgjIOF0W5uhalt2KuSZiPbgpuEnOFh/v0ZzkGLGItiRBw3q+E2hCK14342dYNipYPP2etCtXeLVfcMQoqXIyMcfSCYr3Di1rrQ0j5gNmWTVAppvRQx3Kw/WYdk59usSRZYHZKiU6stMB0TX8RLl5JCHMtA1bpW0gGCsyYNzfCCcIC+gUq6Dsh+b1UH80O8RuSwrRecOZK7BTnW3BlWGKoqyIklE+O0j6D5DppY7VyoL2thfAhKGeVpVTmrxG3mIVQ6a8UpwmcWRQz3Xk//Nhz80tJTkhXM97Wt4AyWOlGhKdPxu1TcAzajHxOch4nuI5rD/MFBHziG6ECnZ66Jz3oOHRS75kbtAPKVyzxi/00hFQM+ErdDPaZttpKFFCXSvj+w/tkiLkaxAVAks8x5++W08TeEtoUPZLJkLkuc6HeAq44k4ZojeH0UzFPOKNhk21ffMoouDjiSqLrJWCR8i6lQXmf5ykKuMSMHM2ohz+4/LWFvA5rzmzfmnQFDjc4VSfja1AbKInc6elPe/vkf4MWVRZ6gH4v+0HvzUjOQOWPSuuOvTDwo4d2h1+ANkvvjg8YB/ZJtgpKOU83WiIp2Fx6OP5T1zRY33BX7ZTvYe+Eo3ekPQRp85zN9J9BjVBm8SgQakTqak8ljMZwalLMz5lF4RfXtvZJ08CpZhbRo0BpSl38Pf2pbp38m4O2i7XPIo3Jbfzq+mSqG6D9uOiJgY3gWetDn4SvhjItixW2LQRaUhi4VnUhO/ckEo8RPi/4KUtfaHuo0ZrAhRD0tn9fFZgWuujLuDT4c8HZshmLQJnKUEoAzanPPnDV0HrqsUAZ/SUmAcuZQwVPf5rbJ99G0Pon+kIugy3Gekg5CK/Oe7xNIR166fc/FdoXbMutQ28YWOCWU5RIJB4ki9TRH0HH49Lj4LnPP6hwLgb2LjzaNr07qK+olxkISm0q4gskKr9QBZTKlMGB106xkP/qoM3JiurqH/M9tGjfoGVACnT9ocWrwR2vM2b3tf+kMUskeQfTmF03GmvlhDKhjlAY6HjoyfBdENwkIE79HJRoauEPSknlT2qDUpFS3mzMJvnHoM01/3TtOb6BMvcVe93WF54b9dDG8LMQgG8/NYxrS0vJTh2JJO9j+XuPahN8912B06Dz5qbBQaUwFlLQQN9h1EnnF/JNDlp/Sh/LWXCcs89SmkP/Bx+4GBYI1RqVszpGXbejXFpKIvFeRERsbWTpxE8w4JfOhBeG7QkHM9Iegt37jvinbQaLom6jH3h7yav3W5Xo1DNXLrlvQP0tAV9A56PNIoPLXrefl9/qSCQS/jJQqOTrhTtZY+BZR5fdYa9AwHBfRc0EvZc+ktOebmx2fFwvR/+JTSSBbbd1o7IP7jlep4n/IfDv6XNOSeHqCEE5zadEko9wm72u/ntVr/g1gVLdim6wNQZtsP4bP3u6kf8d7zet4fpnXAD/8j4r1YtQvW756Y5Z1233wycffEqJRHI9bp36EUOCoy2PQsUnI1s7hoDeXp/PUnAbKO51eL116T56Y/ZD+PjgsZZ6EB4WHGdt6+lWSSSSXEFUbama2pVREHl3kVM2f1BDlZk8xrU7aC/F6zsJtUh9DN9CBWukyz4WCmWGPG/xB2yebplEIslx3CZDqq1U/MSnNdj32RRFAedpV4zuBKUSpXF4urG3jvdG0KJzUFGVTdSAyONF+tkqg8NmG67cCWS41TlLJJJ8T8lThf6w7YSAAN9BaiHgEX2YNy8u670GHU8SLrA8qy5kCkReKvKN7fpbGbusc5ZIChohrQPXWHZC2M7gny33gL5dD2WLp1t1+3ivQYuyOeVL5U2lJNjft3ZXkj3dKIlE4kks9S0jGQ/WCZbNynTQf2MPKZ5u1e3jvQZtkioWY13COhI83RiJROJR9nCENGA7B0nFGInoxXfS3m/QEolEkk+RBi2RSCR5FGnQEolEkkeRBi2RSCR5FGnQEolEkkeRBi2RSCR5FGnQEolEkkeRBi2RSCR5FGnQEolEkkeRBi2RSCR5FGnQEolEkkeRBi2RSCR5FGnQ3oac47pg4eVLNkn+G16/okq+xVwU030uLreZuVxPa3XoA8l9Uxdr1SDtp4y39Q9Bu6D10L8Em269oBwFvws+69QfwHeO431l3j+8r1hCyH2lCkkOY6467764sXLjt5BZ2VWfqpD8ROr3WjVIezhD1xeCvl8vom8F+ybbWAXwu8tHUdeBT2v7MOW5f3hf+X3naaRB5xXMSMn8QboZc2yHK6qrGRy4eGxvegxsuePAV6mn4PSamCrOMnD6x5hRzhS4sPDy6Mye4Hwsc7L+KwS+5v+B2gVKLIuIse2F4k0LNbXGQsU3SlV0zIH6bask+dqh3GMlLtgvg880+ypl2HVvnEo6GuCLQ95vZSMucQk2p8M0jXkGS4mDczsutsj8Gvby57tp/WHrB3/8kFYGzu6KneMcCafXxux3loGLla5sdh2CzCPae/o+CNkWEG1ZDCXbFnrHthqKDYlYbz0H1azlFjkGQp3OlT73HQll+xR7zPYx2HZZ31eu/09LN1YqwoFdGrbnkQbtaZxiaS7bjSvAHJl4+uWMH2DJJ+t6J86BH5M2pSdZ4M/zZ9tnNICkeamttXagr9J/ZAko1ZSz2EBpTRdUoB59sIFeFZXPYG+9o5vS94HuzzrqgX2eta6SAaFxQQssCtTtUHG6zwhov6hx58A0uLdVvfMBz0Owr/9G9ZPr2usSEZdFRly3hPsFWBizHqEPZz7sOXb0+fQn4Pthv8YkBMCvd+8YmlwNTi48f6/zf5AyNa231hr09vyPiaAUV45SG5RyfEQX4Am6cRpOvsBEZzHY9cPh3Wk1gQ4MYT44itjGK2cgvHTwS5bH4K6K1ef4dYNOA+5pHbQbGg6vudOvKPgVdZxXfrmu3S4R2Vvk5dkTSIPObdxTF8KYL82NP+yaB19/92NA/MfwjfbTyPidcCLj/MSMGaCN1HexCtQzygd0AUtZ9UkKA8UpTh9gB8UAsPIRADvF+11b4Xyr0HYA2ip9rp4EF+1XHs08BCte+T0jaTqsSd0+OdkH7vyyWgPfd2DA2Acyw5zQOK72Cv9RoF5W2/EWV9eExEdGWv9IFgZ39qOLHTIHw8yHl56PawQLYleHJDwOFwZeXpmZDvTkfkJAvV+5kzfA8oKlG+HAFgKxADolxKHGAHBAPOp79S2OA1CIOwAyv9X66vFwPvlyrcw9sLDHmmkJKfDThs2tkrpC02J1x/vHwpP7O/YM3Qv1I6t86lsVCMAXFUjHKSJrm/y+cw9p0LlFFjnGnV0OnUibCuPSv6p8MQPWltwxJvkr0I5pD/EFqHHqT1QByxuKL9UAeAWAYkQAt92JpNxHPQJAQTlBXVBVy0nqgnOuq48eD+sm7vRNeRr2pf4Zkh4BvS60LRIyDp6a0Glj2EIIfN7vbbUzkCyWtffHR8ZY15HFndGGrbu/SNkEY6p9/nbsENhV+HCZtOOg/059qoJlqlqZZsAnrAJAFxpMgHh8a9+3CASULtxLsAjgo0FVLa8SDSld04Zpp2DJqfVPJr4P29se/CQV6J/2wP6w3+DRhNYNQxaDzzl7uvIOMuWVy8hTnNPoVyPmG871atf2wsm/w8DV4xecmwKrz2+zJq8H/VWmcAHUg+r/6My1CCanEZG98hD3EQyWk2oz3oS48YmRrirw0eX5j13uBsP7TWsVswNi68ZddDXmmjGbP9yCjpkCEsas/4Y/m+H7j9ZaE0vDC7aJ284Phx2vHrozbQjQTokmENTXlMrcy7WIO6drN8w1Pb9SRhAJ1paWiUyEc60vzc78GUaXmLUmdguMOfD56dj7IPF4ygrtZ64Zs/y+cwUZQec0br3wv0bvCE7WYWjvj5ULs+FU1wuznXXAskxtw8tAtNhRFz90T5Fi/ADV15Vq3Auu312t9PIw/5lfusSHgdOZWUYHRnTud6lwIoQuDDxoCSTLyDHfY16I3XLzi6etnZo4FN6MnBYccxZiA6/8kfkIWGLUNjwJVBbn61ryyzMkkYIG6kKlE/eDs0RmhH4QZn22bOSVnqDdo++kOQyt23NFod7gd9lngnKKgvt95xIygs4pnFd/eADs23isQvq78Eba1KoxE+DU0guBzniw/KxGMZRrP8+8VveaYeQelSXKOEoDX+s/Eg+LK6xzJE6ESd3nlbkcAelHnQP0DVz7oea1z5HTuF2If+ux50hqEIxp+sWg2CoQ2+XKjsxBYGmubuRJ/vL/kWcQuWbllLKYSqBt1prrM+DLAT8suXIQpg77fvjl10AP019nPgX3+84lpEFnN2auWfzjJkxKXqKNhA+Off3UpdfgyIunq2QcBcs6tSqv4j23iqJeVvlCGU5J0I5qD+pfwJdFlkfHpcGiRr+OSYy+bn+lgMRTbnHv+X6Xfsr8FcaM+mJ2bH04Nfj8Qec5sHRQt9P32nnM84gLiLJN+ZwoyOylVdEfh5nfLF0XVw/WLNjePznsuv0Lyvedy0iDzm7ccs3fW9Y+mlAXVhXfOi1pCKgnlKE8CPjnUm45uzF/uGnKWqpCatF0h/4STJ21aNrlt+DkJxdqO3/1dCNzEbd69dlXVpy9Egk7Bx1KSZ0J6l5LA4ZxLbfsbYjvW/1QaUQLiP35SlnXWzClw8K7Lq+Dy0US6rhWebqR+ReZg84hzr57sVXmIJgdt/zIld6Q4XL20+PA8qn6CiUwbgm9IZLKilTS0cFSV11Bbzj488nN6Ukws+OSH+PKQrdhLUeFtAFtqZ7JRvLtEHV1inIPLeHULxcKOZNgvs+qVgknQWuv9eRJUBupR0Spo3dEzlkhyiotuyz1GQabf9vfL3UsLPtuQ/fEntCDNoR4uo35EGnQOcSqXVv6JPWHg/1PfpfRFtRi6ha+BcZRz6t/qO6EEYQFSDQ6mWb9+cMbVybDPMcvhxMSgFACqeXpRuYcysscIwmcMzNf1u+GlCLp1bWRoHZSmxCE96Q0bvbzPk5bQsFZLvMr3Q++e+pXv4RA6KA0XhTUGIL1gDHqOk+3Mv8gDTqbSZ2Q/pneC1bU+n17Ujhkts4cptcCSxHLSlHJmq9+sOZ9gNKXjoRB5neuX/V2kPB60qeu+p5uXC4QILLQG3DhB8pkpR7+gG8++55NzJTH48oRBsDeU0ed6U/AzqhDYam/wD3Uxd/TbcxHSIPOZo70PF004xDsr3Fsffo5UC6pI3kbqJhPf7AmYm4JpQONCQRQZhtaQNgr1BeHp5uSGyhvKE9QGJJXpDXQKsHakJ3NU/rAPdSt6/+lp1uXf/DGbqo8zdHvzjyScR4ul07AFQNqVeUC9TzdKokkmxGRtL5Mz+Q3OBB7fG/6BUjV0hP0FzzduPyDNOhsZn/4sapp68F1h2u7PgrIyKP1rhJJNqBuVQbQEU49GTPFGQKxX1xpntnJ063KP0iDzib0S1RmJ5yoeH6/cwFoS/U7mMZf53OWSPIRShMljQYQuz9uYGZ3uLIysamrjqdblX+QBp1N6NHaTJZA5unMTfr9yJFVkoJBYcKwgn6PPovFkHnctYH7Pd2o/IPsJMwm9F/ZTjLwHj4kAXYxDWeap1smkeQ8uhgirm/T53LJ063JP8gIOptQv1La0gbUN9Qk5TngFBdwerpVEkkOY87dsZTxlAZrC8sHTPB0o/IP0qCzCeV5pQz3QNEz4T9Yy4CyTHmItshUhyRfo4fSnP0QEhg4ybIBAgP87lKberpV+QeZ4shmqv9R7hHHRLCkqCVQADsniCHvzl4mkfwHtBLaaBZAqeNFStqqQ+Hnw/pajwPwEBU93TrvR0bQ2Uy51BJT7UcgoJ7fBEtJ0JvrAznm6VZJJNmMWMJL6aW0IQTKRZZYbj8FAQ7fZ9RwTzcu/yANOpuptLJUF8d3ULFsqSP2j0A7onfmC2S5nSRfof/OXlLB0cg2T2kKTSrU+dZ/JTCIRwhHpvayCZniyGaCZvkPUd+G+xLrBQTUhG2RB8qlvgusYySZQFGjLCnfcZ5LZILeSX+JE6C0V2w0BALxy9dhQIDx+fRaPMYRYI6+knhQpigvURzvme/7ZhHT6WoHtI7Mgqh3y8ywvwT1Hqxcz+cBYKnYT84PnS3kR6vIE7R+5y5HQDf42vHjz1cscDLi/BvO+aBa1Sl0J//McmY1lnjSvtVT2ABt5zZMDzwFnbR7DgR9DnpFvQ9HgXw64aj6oRpNCziVfmG0MwAmbZ7X81IyXLmc2MxVBxQ/ZRc1yTcRpX6YU2SA+r7yDh2hbXzD9MAzUGRpWA1rQZgcK5eRBp1DVNgTud/eHR6c2Kx3cDOY8Nrc+y8uAD2RFBJAuZ+7CcR7bUusGKM9oi9hORRvGbHGNgkG1nr42/CmUL10ufcdcz3dyFxgCocAtCl6SSbDkfjTfhkrYI66ouEVGygJygaqA4H4e/WdhFgsVuuvpTIeqrYr+4KjPTzQrGnVoFAA3gWu/T/L+Dlb8OZ/mbyJueTVIt6jNHT/qVWr4GFwR6NKj/jOB22BVpOpgHrj4qJeg+gc0t/T53AR1IeUvTwFPX5rMzfEAtXnlqvreMfTjcxFxPetDlBO8ww8Edx+cmhRKGcvMcd+DFz9tTTGA35i9XNvQ6Q09EJ6aw6A/wyfzuo+6Ptgh0mhnaBUUJF3bbWv298b/6fzMN74L5O3cVvyqljf8FPWPjD4l26FIj6HQjNDKlo+AK2YNoL5eM/SVyKnqG/lD9JA304wW6BNeMNGgZ9Bj8NtVobYgZd4jAiuXajyO27fd8WvSrWwz4fBk7olhk+FkAoBX1k2gTZc380qwI7NK0xMtFH/le2kgJ6h38EeeODTpueCCkHHlk0KBy28bn/Prkmeb/EGa/BO3HKO9/Svc9xvPbx0d49PCvWDoE3+W9XeoHXWv+MH8m6EpV415gOkgrZTa8NMuGtGtQl+n8LQP3vOLXQYQvoF/KHu5eoq4O7Gle9xuyB1CGpcNugVeGZil5fCngTf6fbV6uugzdeT2QA4xFQAeQ3zQryBPaSAXkf7mO+hxRMNugakwwsPdns34idwrLAHKA8B6cZSWLJKKWcoWD+i3MTsxTY7A1fxEWWhq6P5leA6MLRxr8RCFyG4X0Cw5Rtw9dWSGQ8kGUtHebwXXHT+6X300ZwBfaUOv0OjcTUP+RWH0Xf3f7iIC8o0LXavbeJ1r/OWCDG7MS9I4gJluU99nwnwxIcdMkNrwcDaD48KOwABUb4j1GKgpWj9+IqrQ6U9/n2LHLNeWu/IQdCn6zGsgxanG/wcEAyjij31YpGtUCQ8LMzi5OoahXn2QpNPkAad0wijM41anakGMQQec7QODzkJY+c93bTIAKj4YCmbYzq4fF0LeR30eL06u657fU5jGowol3Pt1dozC6zHLD7KfOj0c5P/Ba2F8W2e+7poH6i0oHS4/aCnT24exLxACQNzNLF9qzSFp3c/eDz8Phh+4slehc9AsQ8jfKxPg6u3lsA40FvoAznOVaPMccwL8C9sJRlcma7ZvAq+b/oMVmdDzy5tjoe0gndOPFOv6Ewo0aFQH+sPXLtD8pHGnBvIKo7cws2olZVKd9pBe6K7BwIVa0TudAyHKRMXWi+vhx+XbxqU+CXEz05K07qB8rPag/agPqoEE821iOt2y7dEFYa+kDUkgHZSe4QvQFnG15SGcqtLRNh3Q59P2qeEpsBDhZodDhoBAbP8AtUIrg1dF8eRuGEamIiQrT9alrILutGCYKDS46UaOKJh8uBvx12aDr/+uOOF5AhI+TJtuN4NLA3VX+gDSlnlJHWvHee2ERcOfbQ+k1jQ1uhN+AwsseoKJkNNWwU/n3h4Ynb75aFloMPqxksCU8F+zNZb2cO1eu7cuoBIAGnQuY9p1GbOUkSulfaUrm0/Bu/se/aJIuugY9km4wM3wbczfvksYTtsrLjng5REuNj3iiOzLLie1JIYD0or5S4CQOmphNEYlEB2UxO4V6mPP9BLH8EZ0FbrVn4HfaPux2ZQtiufEwWOzbY1SgMoWyjygv0ctJ571/yAu6Dzvc1aB02D8o4S39qLAQmi/eatrYygbg6HiKjFmo1YjGxt3a2VNvmsh4mpL3xY7CKsfnvb/uQ5MH/eKi1+AeyIOdQ07XOI25/4vmsdaGiD+AaUycqLFAelhxJKNCip/EpVoKJSCgfQQn+O46CJpaj0U3o5doBSQ4nlDvDd6xihvA2VV5Wu5rBD+7hoLagStK/auEhgayg+I6KFdep17Te/b2nMHkEatKdw70RzGZG1o5ptutIYmnEH/kCj9bU+8dsBB988sT6jPmx55sDu1Adg0x17H03pA+feuNQ8cwNcfP3KlcyHIO7pxM6uIMgck3mG+8GvuM9mZTlElA95w/oOhAcGx1ruhwqbIz91jIaGcTW7+X0Bd7St9ITPAigaFz7Y2gaAHm7tMy4o0phvD4tbN5q48wnw9R2oRkD7fdEDA5+D5oPrjwroDvs/OBaVvhY2r94fmzIbNg/c/3ZqNMQ64x7L7AyxW68sdvWH+F+S2rh6gmu61o6PIaCnb5KqQERKyFnLmxDeIPiw5T2o/ki5eJ/XoMG8ap/6FYO6RSp96TMSwr8JrmU5BcCZG9prVmXI79ujSIPOK1j+Ptdsb2Q9oYRDjUblcfwJNSiPA+g19f5nQp6DpDdTHtVC4FLF+KjMLhC/M7mTNhAy27lq6d+Bb6JDVUdBWGhQmqUmhLYNHGc5Dr5jHVuVY8Bo9lIE2OP2xmbqxEylWGT8lK1cS1GZjwHw/cAxTPkK7qAyPsAdVO7qA/Sd2HEMwyBhbnJP1xNw6VL8EFcvSFyY0lT7HLQaWkV9AfgN8qmuboOwoOAeligI7R8Qa1kIjrV2uzJGvNcYYB2v3tAe9+9bVmXkCaRBeymWdupkJkFwuwBUIJgA7MamWD5023n+3xyg07+8gaerCgoKN3mWrYMsQ1kPYQRhAcIKB2HpB+xkK/3cdo4CIB6ARUD1m2qH/L7zIDIqkkgkkjyKNGiJRCLJo0iDlkgkkjyKNGiJRCLJo0iDlkgkkjyKNGiJRCLJo0iDlkgkkjyKNGiJRCLJo0iDlkgkkjyKNGiJRCLJo3i/QZtDVOVsWxKJxJz+1pY/Fo7wfktLIQ0N9Dms5IqnGyORSDzKVv0PUoGN7CaFLCch8xa816DFYquu1zS7PhFiX4kr72pz3XZXAVm0VCKRXCVpQ+oz2mlICE8uqn0KykllEZU83arbx3sNOgA/VNDu104wFk5ZL7RzAtSmB0eQ02NKJAWQi+Pi17vmQFyTxOOukqD4KDuo4elW3T6miXlftCnmq1WeUArTGA7fdapu+tdw8bErM1yfebpxEokkV3BbBmx3jSORaUUgfX/GE9o6UO6iGn6ebuTtIwzaFe/phtz2BxislKUpnLkr1pHZG+KaJ55xRXq6VRKJJFdwyy8fqXL6csYuyCzjSuMhIIRAb76XFk1POu/phtw2k3mR4pC0O/Ul11k42ud0iYzD120Xi7RKJJL8S8IXyau10XAs/mzJjHagfM87lOKvS415GcKgL87xdENuF+VJpQOhkPZ+eh/9PdhS5cCM1BPX7WD17l5ciUTyN5iL2QpO9D7X2PkeHL37tDNjD6in1dfo4ulG/neEQZ97zNMNuW2KEYEVGKs8TRFYsmD94IRvYPOK/a+nfnHdfrKqQyLxfrQbFy9OnZU+V+8D06cuiYuzwcXzV+7LHAuKRdnizZ2DJsKgYx51e957kgJisUv1daUa98KZNrHhmU/Ch8vnDbgUBXHTEh93wbWqDs2LPptEIrkR9caM8qKaa5sn9INl7204l+gE2hFNIFCCQl684urVYFJ82Mv93XbwvqSA+OLUwWoMz8La4Tv3pTwBs0cunxjvB+zkMGlcW61YGrVE4j04ybz+F3vwvZPFMurAx1ELi17+CVLWpq/T+oOyV/mKCnj779ss3nhR/LH3E3EWbmb937yJiKSV3rQjFFy/aUP1F2Dml8vGxvWCDTN2v5Gy5oZTYBh1Ok6v/iolkvyI5paSFEO4k15Irabtg0l15ymXAuHP+05vyVDBUln9nl5ARn76PR98QRj0rrmGpk7wdJP+M+JKq/5PKU9TiNkWNz2zGrzRc+rQmC/gh4CN7ZJCIbO3qw/1AEf+GLMvkeQLzM4/t1TG8bRzMc6hMPzhaY1itsKKh34rnPgSKP2V4jQBAvH35nI6gVs/2YHi4iOd2m3o+dmebmG2IeboUD9Q7qIF/BF6YmV6CRhSftJL547CW2OmJ8TUgDOfxY7LbOnpxkokEuBq558zOnMYCiyesG5S4svQr8WYXWfawVzXz4fjMyFjiPMb3R8UURxg3kF7OcKPtQGG7o1QIiM7dPjjD/tXxhNf+xvauYOnW5rtiFsk/bheiu3AUzxAGNSsHlXFJw0GrXtkTXgkNBlTJ81/M/gMsu9WWgOLeI/Snm68RJK/cR3QxjAEzvSMedQZDZ8EfjflcggsfGCNI+EcJBZPOaNtBLWDuoN+oFQgEjt/TYXkCxKeNPSBCsKgzQ0vNzZ07FpPNzHHELdO+mFOkgHaJq05MyAkIeB1yxqo7lv+dcdUqOxTurvjPNRsFvWCz04o9mtENetgqOCKTHf0Af/ffQarR0FB+Z3qQBIp+fFfRSK5LWzYAFjKBhIh80tXD/1ZONM7tqczGo5NOTvD2R+Otz/3ZMajsHP0oV1pO+DgqBPh6bXg6IAzFzJ8gPmsIgGU08piKgEZN3YW5k92iKq69m3cDLpRO0N/qGto0FuebmqOI+aR1kvpHTkI2j6tPbOAj5QXKQaWFWoZXoGAD/0OWapD0WZhd1otEOYfVM4SCfa7bceUcOB39pLi6Q8jkeQRihKODbT39CP6akjsnNxGmw0xoXG7MxvApZPxDtcSyGjgHKoroC/XNX4DxaVspDqoKeq7PAyEEICF/JLCuEk+/d7QAa+6GXRIoKFLaxvaKP9G0v+GuRDAGWJxgl5Zf4TDoI3VD7IaeJ+vuQQkishZdjRKJH/FggWAypTGAUox5Qi1QWmrWGgISjdaEuzpRuYVnGJap64ixbxwrlnKLZLTVxINXZlmaCPzldqN+xUAzCt2cSKwgZKgrKIqWJ5WoCoAjT3dRInEazhz9a8KAOSfcoRs5JC4VG26aD6TxXSjy0Rd9IU5bvtJJBKJJHvIuPHh8iqGnvnFfCYL4937gaFrvnLbILOsEolEkj3YDblcy9CFvcTzZr5duZo5vTEXbdL+B0O/KWSoXz1PfyKJRCLxckQKGR9D5onpnnveY2j6IXPHf0ldrH7X0DUfuW2QBWUSiURyewhjThxs6AwR+F4z5lOnFi+uXPk6gzafuJGkNYZ+eqehKT3FBvN1Baj0RSKRSLKT5ecM/bVBVnvcZOffTysNXdTJbYMsLpNIJJJ/xi3jEDPL0A+nGJq2UGywuAfKfzFotx1EKJ662NAPphp6ZqLbyzKQSCQSyd/h5rMz2xi6cYjbfq5/eeE1hFGn3fjsFlE3/XGUoVpZscHu6TMgkUgkeYykGx9uFTpFGLQ2Qzxh//sU883XN1uELhNvUNjQH8d6+gxIJBJJHsPMKAQYktDc0JF7DT2xQ2w3UxpZZiD+1aDFAczQ22FInOg0fK29oYfdrhQke/oMSSQSSS5j5ppFRkETRRUfiPK5ZQOy2D9LbnWEYPqND7eL6UlHdDU0yRwbLp4n1YMnSyKRSHIDs5rNzU8XiyHbE42Z/XCtFxusIvD91yq4mzZotxyJ2+u+Fjnp0SJUT58uNvgKlZ2IEokkv+JWzbZe5JaHiBHZcUPFBofw0cybPfAtz7Eh3sAMzUXKwyWqOiaK402KFs9HiP3MTkSnZ86fRCKR5DS7Vhg6aL6hR927/dJv6XBkQx2zGCIupskz5+oIFKH7WDGv9FMiorbUEfu5DXWUSCSSPM/VOTJufPqAmB6033FD1+9xe51ysykNd7JrljpzEiWRe04UH+BVUZb3kZilyTlQ7Gcas+xMlEgkeR0zY+BmzLuWG9rvqKHZZ8wm/9mg3XLTpuEKo47fYuhrogBwzEZDU8veuJ/MUUskkjyH6UtuPrl+pqF9PhSP97u/8L8as0m2D9V2mxXPNGBh3LbDhvYTV5o3Bhla+KTbYbK4lZBIJJIcxywbFnXMZrnc4hhDh0ww9GgVt9f954jZnRw3QGHYZkrDzD0PM+Q+8XCMKMerP87t5WZvpxWJRCLJGbJYMSqhpaFmHbNZBBH3qtvrs92Yrx44t86AMGpzRKLbmPMyYqmtF/809PHXDPVb4nYYswrEllvtlkgkBY2twrBHHjDUHGDiWid2ENVrpGc1RDu7yPUUglsKxIyMRaRs/83Q9p8Z+j+RA7rbNOo4t8PJCFsikdwsWVSPxXxp6MxWhk4RemKn2+utt1rH/F/xeI5XGLY5oMVt5GHR3w19XIxU7N3O0IofZnE4adgSicTE7ORzm8wt8XlDl4uVTD6cZuhGMYG+Zg60M+/4tZxKYfwbHjdoE2HUZnuyOBHl3zC0+wJDu042tLKYtk/d4unPIZFI8hrmmn8/i3ntZ9xhqDlRftp3bi+w/9skRrlFnjFoE7cUSBY566t79zW0lRih82ApQ+8UayiGPXeTbyurRiSSvEsWnXjuOMWAuUMhhpqrZC8UVRjb3zb02tJSgqs+k9M55VslzxuSm2H/S4Tt976h1UVKpLmYdS9aFJTXvmJoWBNDHVnNJmVeECxIJJLc4l+MWOtvaJJIZR4VKdHNDxv641xDN8UaemaVeGGWqYm8Zsju5HmDzgo34zarOrKY6yNApEaifjS0zuOGRotymXJiftbaRQ0NkQsQSCQewyVSlgdfNPSA+F3uDTV07ctiewlDz44xVN+fxQGvBnZ53ZDd+T9zjIe7yzf0WQAAAABJRU5ErkJggg==", "base64"));
+
 // src/notopen.ts
 var RETRYABLE = new Set(["tools/list"]);
 function isRetryable(method) {
@@ -1677,6 +1695,142 @@ class RateLimiter {
   }
 }
 
+// src/store/memory.ts
+function copy(record) {
+  return { ...record, scopes: [...record.scopes] };
+}
+function matches(record, selector) {
+  return "grantId" in selector ? record.grantId === selector.grantId : record.addressId === selector.addressId;
+}
+function isLive(record, now) {
+  return record.expiresAt > now && (record.kind === "access" || record.usedAt === undefined);
+}
+function summarizeGrants(records, now) {
+  const grants = new Map;
+  for (const r of records) {
+    if (!isLive(r, now) || grants.has(r.grantId))
+      continue;
+    const summary = {
+      grantId: r.grantId,
+      clientId: r.clientId,
+      clientName: r.clientName,
+      scopes: [...r.scopes],
+      createdAt: r.grantCreatedAt
+    };
+    if (r.subject !== undefined)
+      summary.subject = r.subject;
+    grants.set(r.grantId, summary);
+  }
+  return [...grants.values()].sort((a, b) => a.createdAt - b.createdAt || a.grantId.localeCompare(b.grantId));
+}
+
+class NonceSet {
+  #until = new Map;
+  get size() {
+    return this.#until.size;
+  }
+  claim(key, expiresAt, now) {
+    const until = this.#until.get(key);
+    if (until !== undefined && until > now)
+      return false;
+    this.#until.set(key, expiresAt);
+    return true;
+  }
+  sweep(now) {
+    let n = 0;
+    for (const [key, until] of this.#until) {
+      if (until <= now) {
+        this.#until.delete(key);
+        n++;
+      }
+    }
+    return n;
+  }
+  clear() {
+    this.#until.clear();
+  }
+}
+
+class MemoryTokenStore {
+  #records = new Map;
+  #nonces = new NonceSet;
+  #revokedGrants = new Map;
+  #revokedAddresses = new Map;
+  async put(record) {
+    if (this.#revokedGrants.has(record.grantId))
+      return false;
+    const address = this.#revokedAddresses.get(record.addressId);
+    if (address !== undefined && record.grantCreatedAt <= address.at) {
+      return false;
+    }
+    this.#records.set(record.hash, copy(record));
+    return true;
+  }
+  async get(hash) {
+    const r = this.#records.get(hash);
+    return r === undefined ? undefined : copy(r);
+  }
+  async markUsed(hash, now, keepUntil) {
+    const r = this.#records.get(hash);
+    if (r === undefined || r.usedAt !== undefined)
+      return false;
+    r.usedAt = now;
+    r.expiresAt = Math.min(r.expiresAt, keepUntil);
+    return true;
+  }
+  async revoke(selector, options) {
+    if ("grantId" in selector) {
+      this.#revokedGrants.set(selector.grantId, options.keepUntil);
+    } else {
+      const old = this.#revokedAddresses.get(selector.addressId);
+      this.#revokedAddresses.set(selector.addressId, {
+        at: Math.max(old?.at ?? 0, options.now),
+        until: Math.max(old?.until ?? 0, options.keepUntil)
+      });
+    }
+    let n = 0;
+    for (const [hash, r] of this.#records) {
+      if (matches(r, selector)) {
+        this.#records.delete(hash);
+        n++;
+      }
+    }
+    return n;
+  }
+  async listGrants(addressId, now) {
+    const own = [...this.#records.values()].filter((r) => r.addressId === addressId);
+    return summarizeGrants(own, now);
+  }
+  async deleteExpired(now) {
+    for (const [id, until] of this.#revokedGrants) {
+      if (until <= now)
+        this.#revokedGrants.delete(id);
+    }
+    for (const [id, t] of this.#revokedAddresses) {
+      if (t.until <= now)
+        this.#revokedAddresses.delete(id);
+    }
+    this.#nonces.sweep(now);
+    let n = 0;
+    for (const [hash, r] of this.#records) {
+      if (r.expiresAt <= now) {
+        this.#records.delete(hash);
+        n++;
+      }
+    }
+    return n;
+  }
+  async claimNonce(key, expiresAt, now) {
+    return this.#nonces.claim(key, expiresAt, now);
+  }
+  async close() {
+    this.#nonces.clear();
+    this.#records.clear();
+    this.#revokedGrants.clear();
+    this.#revokedAddresses.clear();
+  }
+}
+
 // src/tokens.ts
 var PREFIX = {
   access: "tmcp_at_",
@@ -1706,7 +1860,8 @@ async function issueTokenPair(store, grant, options) {
     scopes: grant.scopes,
     grantCreatedAt: grant.grantCreatedAt,
     issuedAt: now,
-    ...grant.subject === undefined ? {} : { subject: grant.subject }
+    ...grant.subject === undefined ? {} : { subject: grant.subject },
+    ...grant.clientAuth === undefined ? {} : { clientAuth: grant.clientAuth }
   };
   const accessExpires = Math.min(now + options.accessTtlMs, options.grantEndsAt);
   const refreshStored = await store.put({
@@ -1732,6 +1887,75 @@ async function issueTokenPair(store, grant, options) {
   };
 }
 
+// src/oauth/domain-cache.ts
+class DomainCache {
+  #entries = new Map;
+  #counts = new Map;
+  #max;
+  #perDomain;
+  #isDead;
+  constructor(max, perDomain, isDead = () => false) {
+    this.#max = max;
+    this.#perDomain = perDomain;
+    this.#isDead = isDead;
+  }
+  get size() {
+    return this.#entries.size;
+  }
+  get(key) {
+    const entry = this.#entries.get(key);
+    if (entry === undefined)
+      return;
+    this.#entries.delete(key);
+    this.#entries.set(key, entry);
+    return entry.value;
+  }
+  delete(key) {
+    const entry = this.#entries.get(key);
+    if (entry === undefined)
+      return;
+    this.#entries.delete(key);
+    const left = (this.#counts.get(entry.domain) ?? 1) - 1;
+    if (left > 0)
+      this.#counts.set(entry.domain, left);
+    else
+      this.#counts.delete(entry.domain);
+  }
+  set(key, domain, value, now) {
+    this.delete(key);
+    if ((this.#counts.get(domain) ?? 0) >= this.#perDomain) {
+      this.#evictOldestOf(domain);
+    } else if (this.#entries.size >= this.#max) {
+      this.#evict(now);
+    }
+    this.#entries.set(key, { domain, value });
+    this.#counts.set(domain, (this.#counts.get(domain) ?? 0) + 1);
+  }
+  #evict(now) {
+    for (const [key, entry] of this.#entries) {
+      if (this.#isDead(entry.value, now)) {
+        this.delete(key);
+        return;
+      }
+    }
+    const most = Math.max(0, ...this.#counts.values());
+    for (const [key, entry] of this.#entries) {
+      if (this.#counts.get(entry.domain) === most) {
+        this.delete(key);
+        return;
+      }
+    }
+  }
+  #evictOldestOf(domain) {
+    for (const [key, entry] of this.#entries) {
+      if (entry.domain === domain) {
+        this.delete(key);
+        return;
+      }
+    }
+  }
+}
+
 // src/oauth/cimd.ts
 class ClientMetadataError extends Error {
   name = "ClientMetadataError";
@@ -1741,6 +1965,16 @@ class ClientMetadataError extends Error {
     this.reason = reason;
   }
 }
+var TRANSIENT_REASONS = new Set([
+  "rate_limited",
+  "fetch_failed",
+  "unresolvable",
+  "too_large"
+]);
+function isTransient(error) {
+  return TRANSIENT_REASONS.has(error.reason);
+}
+var STALE_GRACE_MS = 60 * 60000;
 var MAX_CLIENT_ID_LENGTH = 2048;
 var MAX_NAME_LENGTH = 64;
 var MAX_REDIRECT_URIS = 20;
@@ -1748,6 +1982,9 @@ var MIN_CACHE_MS = 5 * 60000;
 var DEFAULT_CACHE_MS = 60 * 60000;
 var MAX_CACHE_MS = 24 * 60 * 60000;
 var MAX_CACHE_ENTRIES = 1000;
+var MAX_CACHE_PER_DOMAIN = 100;
+var FAILURE_CACHE_MS = 60000;
+var MAX_FAILURES = 1000;
 async function defaultLookup(hostname) {
   const records = await Bun.dns.lookup(hostname, {});
   return records.map((r) => r.address);
@@ -1781,12 +2018,22 @@ function limitKey(hostname) {
     return h;
   return h.split(".").slice(-2).join(".");
 }
+function knownBudget() {
+  return {
+    perHost: new RateLimiter({ capacity: 5, refillPerSecond: 0.2 }),
+    perDomain: new RateLimiter({ capacity: 15, refillPerSecond: 0.6 }),
+    global: new RateLimiter({ capacity: 100, refillPerSecond: 10 })
+  };
+}
 
 class ClientMetadataFetcher {
-  #cache = new Map;
+  #cache = new DomainCache(MAX_CACHE_ENTRIES, MAX_CACHE_PER_DOMAIN, (entry, now) => entry.until + STALE_GRACE_MS <= now);
+  #failures = new Map;
   #perHost = new RateLimiter({ capacity: 5, refillPerSecond: 0.2 });
   #perDomain = new RateLimiter({ capacity: 15, refillPerSecond: 0.6 });
   #global = new RateLimiter({ capacity: 30, refillPerSecond: 1 });
+  #refreshes = knownBudget();
+  #keys = knownBudget();
   #allowedHosts;
   #logger;
   #timeoutMs;
@@ -1805,34 +2052,106 @@ class ClientMetadataFetcher {
     this.#testMode = options.testMode;
     this.#now = options.now ?? Date.now;
   }
-  async get(clientId) {
+  async get(clientId, options = {}) {
     const url = this.#checkUrl(clientId);
     const now = this.#now();
     const cached = this.#cache.get(clientId);
-    if (cached !== undefined && cached.until > now) {
-      this.#cache.delete(clientId);
-      this.#cache.set(clientId, cached);
+    if (cached !== undefined && cached.until > now)
       return cached.meta;
+    const known = cached !== undefined && now < cached.until + STALE_GRACE_MS;
+    const stale = options.allowStale === true && known ? cached?.meta : undefined;
+    try {
+      const failed = this.#failures.get(clientId);
+      if (failed !== undefined && failed.until > now)
+        throw failed.error;
+      return await this.#refresh(clientId, url, now, known);
+    } catch (error) {
+      const transient = error instanceof ClientMetadataError && isTransient(error);
+      if (!transient)
+        this.#cache.delete(clientId);
+      if (stale === undefined || !transient)
+        throw error;
+      this.#logger?.info("oauth.cimd_stale", {
+        host: url.host,
+        reason: error.reason
+      });
+      return stale;
+    }
+  }
+  async#refresh(clientId, url, now, known) {
+    this.#admit(url, now, known ? "refresh" : "new");
+    let meta;
+    let ttlMs;
+    try {
+      const address = await this.#vettedAddress(url);
+      const response = await this.#fetchJson(url, address, [
+        "application/json"
+      ]);
+      meta = validateDocument(response.doc, clientId, url, {
+        test: this.#testMode !== undefined,
+        onFallback: (reason) => this.#logger?.info("oauth.cimd_auth_fallback", {
+          host: url.host,
+          reason
+        })
+      });
+      ttlMs = cacheMs(response.cacheControl);
+    } catch (error) {
+      if (error instanceof ClientMetadataError) {
+        this.#rememberFailure(clientId, error, now);
+      }
+      throw error;
     }
+    this.#failures.delete(clientId);
+    this.#cache.set(clientId, limitKey(url.hostname), { meta, until: now + ttlMs }, now);
+    return meta;
+  }
+  #rememberFailure(clientId, error, now) {
+    this.#failures.delete(clientId);
+    if (this.#failures.size >= MAX_FAILURES) {
+      const oldest = this.#failures.keys().next().value;
+      if (oldest !== undefined)
+        this.#failures.delete(oldest);
+    }
+    this.#failures.set(clientId, { error, until: now + FAILURE_CACHE_MS });
+  }
+  async fetchJwks(jwksUri) {
+    const url = this.#checkJwksUri(jwksUri);
+    this.#admit(url, this.#now(), "keys");
+    const address = await this.#vettedAddress(url);
+    const response = await this.#fetchJson(url, address, [
+      "application/json",
+      "application/jwk-set+json"
+    ]);
+    return response.doc;
+  }
+  #admit(url, now, budget) {
+    const { perHost, perDomain, global } = budget === "refresh" ? this.#refreshes : budget === "keys" ? this.#keys : {
+      perHost: this.#perHost,
+      perDomain: this.#perDomain,
+      global: this.#global
+    };
     const key = limitKey(url.hostname);
-    if (!this.#perHost.available(url.host, now) || !this.#perDomain.available(key, now)) {
+    if (!perHost.available(url.host, now) || !perDomain.available(key, now)) {
       throw new ClientMetadataError("rate_limited", "Too many requests for this AI app's details. Try again in a minute.");
     }
-    if (!this.#global.take("all", now)) {
+    if (!global.take("all", now)) {
       throw new ClientMetadataError("rate_limited", "The relay is busy. Try again in a minute.");
     }
-    this.#perHost.take(url.host, now);
-    this.#perDomain.take(key, now);
-    const address = await this.#vettedAddress(url);
-    const { meta, ttlMs } = await this.#fetchDocument(url, clientId, address);
-    this.#cache.delete(clientId);
-    if (this.#cache.size >= MAX_CACHE_ENTRIES) {
-      const oldest = this.#cache.keys().next().value;
-      if (oldest !== undefined)
-        this.#cache.delete(oldest);
+    perHost.take(url.host, now);
+    perDomain.take(key, now);
+  }
+  #checkJwksUri(jwksUri) {
+    const url = parseJwksUri(jwksUri, this.#testMode !== undefined);
+    if (url === undefined) {
+      throw new ClientMetadataError("invalid_jwks_uri", "The AI app's jwks_uri is not accepted.");
     }
-    this.#cache.set(clientId, { meta, until: now + ttlMs });
-    return meta;
+    if (this.#allowedHosts.length > 0 && !this.#allowedHosts.includes(url.host)) {
+      throw new ClientMetadataError("host_not_allowed", `This relay does not accept AI apps from ${url.host}.`);
+    }
+    if (isIpLiteral(url.hostname) && !this.#addressAllowed(url.hostname)) {
+      throw this.#notLoaded("private_address", url);
+    }
+    return url;
   }
   #checkUrl(clientId) {
     const refuse = (message) => new ClientMetadataError("invalid_client_id", message);
@@ -1894,9 +2213,9 @@ class ClientMetadataFetcher {
     }
     return addresses.find((a) => parseIpv4(a) !== undefined) ?? addresses[0] ?? "";
   }
-  async#fetchDocument(url, clientId, address) {
+  async#fetchJson(url, address, types) {
     const fail = (detail) => this.#notLoaded("fetch_failed", url, detail);
-    const pinned = new URL(clientId);
+    const pinned = new URL(url.href);
     pinned.hostname = address.includes(":") ? `[${address}]` : address;
     const hostname = url.hostname.replace(/^\[|\]$/g, "");
     const tls = url.protocol === "https:" ? {
@@ -1921,8 +2240,9 @@ class ClientMetadataFetcher {
       if (response.status !== 200)
         throw fail(`status_${response.status}`);
       const type = (response.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase();
-      if (type !== "application/json")
+      if (type === undefined || !types.includes(type)) {
         throw fail("not_json");
+      }
       const text = await this.#readLimited(response, url);
       let doc;
       try {
@@ -1930,8 +2250,7 @@ class ClientMetadataFetcher {
       } catch {
         throw fail("bad_json");
       }
-      const meta = validateDocument(doc, clientId, url);
-      return { meta, ttlMs: cacheMs(response.headers.get("cache-control")) };
+      return { doc, cacheControl: response.headers.get("cache-control") };
     } finally {
       if (!response.bodyUsed)
         response.body?.cancel().catch(() => {});
@@ -1986,7 +2305,7 @@ function foreignDomain(name, hostname) {
   }
   return false;
 }
-function validateDocument(doc, clientId, url) {
+function validateDocument(doc, clientId, url, options = {}) {
   const invalid = (message) => new ClientMetadataError("invalid_metadata", message);
   if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
     throw invalid("The AI app's details are not a JSON object.");
@@ -2012,10 +2331,7 @@ function validateDocument(doc, clientId, url) {
   if (!Array.isArray(uris) || uris.length === 0 || uris.length > MAX_REDIRECT_URIS || !uris.every((u) => typeof u === "string" && isRedirectUri(u))) {
     throw invalid("The AI app's details have no valid redirect_uris.");
   }
-  const method = d["token_endpoint_auth_method"];
-  if (method !== undefined && method !== "none") {
-    throw invalid('The AI app must use token_endpoint_auth_method "none" with this relay.');
-  }
+  const auth = clientAuth(d, url, options, invalid);
   const grants = d["grant_types"];
   if (grants !== undefined && (!Array.isArray(grants) || !grants.includes("authorization_code"))) {
     throw invalid("The AI app's details do not allow the authorization code grant.");
@@ -2028,9 +2344,81 @@ function validateDocument(doc, clientId, url) {
     clientId,
     name: displayName(name),
     host: url.host,
-    redirectUris: uris
+    redirectUris: uris,
+    auth
   };
 }
+function clientAuth(d, url, options, invalid) {
+  const method = d["token_endpoint_auth_method"];
+  const supported = d["token_endpoint_auth_methods_supported"];
+  const listsNone = Array.isArray(supported) && supported.includes("none");
+  if (method === undefined || method === "none")
+    return { method: "none" };
+  const checked = method === "private_key_jwt" ? privateKeyJwt(d, url, options.test === true) : {
+    problem: "unsupported_method",
+    message: 'The AI app must use token_endpoint_auth_method "none" or "private_key_jwt" with this relay, or list "none" in token_endpoint_auth_methods_supported.'
+  };
+  if ("jwksUri" in checked) {
+    return { method: "private_key_jwt", ...checked, publicAllowed: listsNone };
+  }
+  if (listsNone) {
+    options.onFallback?.(checked.problem);
+    return { method: "none" };
+  }
+  throw invalid(checked.message);
+}
+function privateKeyJwt(d, url, test) {
+  const jwksUri = d["jwks_uri"];
+  if (jwksUri === undefined) {
+    return {
+      problem: "no_jwks_uri",
+      message: "The AI app uses private_key_jwt but publishes no jwks_uri (an inline jwks is not accepted)."
+    };
+  }
+  if (d["jwks"] !== undefined) {
+    return {
+      problem: "jwks_and_jwks_uri",
+      message: "The AI app's details have both jwks and jwks_uri."
+    };
+  }
+  const parsed = typeof jwksUri === "string" ? parseJwksUri(jwksUri, test) : undefined;
+  if (parsed === undefined || parsed.protocol !== url.protocol || parsed.host !== url.host) {
+    return {
+      problem: "bad_jwks_uri",
+      message: "The AI app's jwks_uri must be an https:// URL on the host of its client_id."
+    };
+  }
+  const alg = d["token_endpoint_auth_signing_alg"];
+  if (alg !== undefined && !isAlgorithm(alg)) {
+    return {
+      problem: "signing_alg",
+      message: "The AI app's token_endpoint_auth_signing_alg is not one this relay accepts."
+    };
+  }
+  return {
+    jwksUri: parsed.href,
+    algorithms: alg === undefined ? JWT_ALGORITHMS : [alg]
+  };
+}
+function parseJwksUri(value, test) {
+  if (value.length > MAX_CLIENT_ID_LENGTH)
+    return;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return;
+  }
+  const scheme = url.protocol === "https:" || test && url.protocol === "http:";
+  if (!scheme || url.href !== value)
+    return;
+  if (url.username !== "" || url.password !== "" || url.hash !== "") {
+    return;
+  }
+  if (url.port !== "" && !test)
+    return;
+  return url;
+}
 var PRIVATE_USE_SCHEME = /^[a-z][a-z0-9+-]*(\.[a-z0-9+-]+)+:$/;
 function isRedirectUri(value) {
   if (value.length > 2048 || value.includes("#"))
@@ -2074,6 +2462,151 @@ function redirectUriMatches(requested, registered) {
   return a.href === b.href;
 }
 
+// src/oauth/client-auth.ts
+var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var CLIENT_ASSERTION_MAX_LIFETIME_MS = 60 * 60000;
+var CLIENT_ASSERTION_MAX_AGE_MS = 5 * 60000;
+var CLIENT_ASSERTION_LEEWAY_MS = 30000;
+var MAX_JTI2 = 256;
+var MAX_KEY_SETS = 1000;
+var MAX_KEY_SETS_PER_DOMAIN = 100;
+var SWEEP_INTERVAL_MS = 1000;
+var ACCEPTED_TYPES = new Set(["jwt", "client-authentication+jwt"]);
+function assertionSubject(assertion) {
+  try {
+    const sub = decodeJwt(assertion).payload["sub"];
+    return typeof sub === "string" && sub !== "" ? sub : undefined;
+  } catch {
+    return;
+  }
+}
+function nonceKey(clientId, jti) {
+  return hashToken(JSON.stringify(["client_assertion", clientId, jti]));
+}
+async function verifyClientAssertion(assertion, check) {
+  const { header, payload } = await verifyJwt(assertion, check.keys, {
+    algorithms: check.auth.algorithms
+  });
+  const typ = header["typ"];
+  if (typ !== undefined && (typeof typ !== "string" || !ACCEPTED_TYPES.has(typ.toLowerCase()))) {
+    throw new JwtError("typ", "the assertion's type is not a client assertion");
+  }
+  if (payload["iss"] !== check.clientId) {
+    throw new JwtError("iss", "the assertion's issuer is not the client");
+  }
+  if (payload["sub"] !== check.clientId) {
+    throw new JwtError("sub", "the assertion's subject is not the client");
+  }
+  if (!audiences(payload).some((a) => check.audiences.includes(a))) {
+    throw new JwtError("aud", "the assertion is not for this relay");
+  }
+  const usableUntil = checkTimes(payload, check.now);
+  const jti = payload["jti"];
+  if (typeof jti !== "string" || jti === "" || jti.length > MAX_JTI2) {
+    throw new JwtError("jti", "the assertion needs a jti");
+  }
+  const key = nonceKey(check.clientId, jti);
+  if (!await check.claimNonce(key, usableUntil, check.now)) {
+    throw new JwtError("replayed", "the assertion was already used");
+  }
+}
+function checkTimes(payload, now) {
+  const leeway = CLIENT_ASSERTION_LEEWAY_MS;
+  const exp = numericDate(payload, "exp");
+  if (exp === undefined)
+    throw new JwtError("exp", "the assertion has no exp");
+  if (exp <= now - leeway) {
+    throw new JwtError("expired", "the assertion has expired");
+  }
+  if (exp > now + CLIENT_ASSERTION_MAX_LIFETIME_MS + leeway) {
+    throw new JwtError("lifetime", "the assertion lives longer than an hour");
+  }
+  const iat = numericDate(payload, "iat");
+  let end = exp;
+  if (iat === undefined) {
+    if (exp > now + CLIENT_ASSERTION_MAX_AGE_MS + leeway) {
+      throw new JwtError("lifetime", "an assertion without iat may live five minutes");
+    }
+  } else {
+    if (iat > now + leeway) {
+      throw new JwtError("iat", "the assertion was issued in the future");
+    }
+    if (iat + CLIENT_ASSERTION_MAX_AGE_MS <= now - leeway) {
+      throw new JwtError("too_old", "the assertion was issued too long ago");
+    }
+    end = Math.min(exp, iat + CLIENT_ASSERTION_MAX_AGE_MS);
+  }
+  const nbf = numericDate(payload, "nbf");
+  if (nbf !== undefined && nbf > now + leeway) {
+    throw new JwtError("nbf", "the assertion is not valid yet");
+  }
+  return end + leeway;
+}
+function quotaKey(clientId) {
+  return ipPrefixKey(new URL(clientId).hostname.replace(/\.$/, ""));
+}
+
+class NonceQuota {
+  #until = new Map;
+  #perDomain;
+  #max;
+  #total = 0;
+  #sweptAt = Number.NEGATIVE_INFINITY;
+  constructor(perDomain, max) {
+    this.#perDomain = perDomain;
+    this.#max = max;
+  }
+  refusal(domain, now) {
+    this.sweep(now);
+    if ((this.#until.get(domain)?.length ?? 0) >= this.#perDomain) {
+      return "domain_full";
+    }
+    return this.#total >= this.#max ? "full" : undefined;
+  }
+  add(domain, until) {
+    const list = this.#until.get(domain);
+    if (list === undefined)
+      this.#until.set(domain, [until]);
+    else
+      list.push(until);
+    this.#total++;
+  }
+  sweep(now) {
+    if (now - this.#sweptAt < SWEEP_INTERVAL_MS)
+      return false;
+    this.#sweptAt = now;
+    this.#total = 0;
+    for (const [domain, list] of this.#until) {
+      const live = list.filter((until) => until > now);
+      if (live.length === 0)
+        this.#until.delete(domain);
+      else
+        this.#until.set(domain, live);
+      this.#total += live.length;
+    }
+    return true;
+  }
+}
+
+class ClientKeySets {
+  #sets = new DomainCache(MAX_KEY_SETS, MAX_KEY_SETS_PER_DOMAIN);
+  #load;
+  #now;
+  constructor(load, now = Date.now) {
+    this.#load = load;
+    this.#now = now;
+  }
+  for(jwksUri) {
+    const known = this.#sets.get(jwksUri);
+    if (known !== undefined)
+      return known;
+    const set = new JwksCache(jwksUri, { load: this.#load, now: this.#now });
+    const domain = limitKey(new URL(jwksUri).hostname);
+    this.#sets.set(jwksUri, domain, set, this.#now());
+    return set;
+  }
+}
+
 // src/oauth/html.ts
 var ESCAPES = {
   "&": "&amp;",
@@ -2124,6 +2657,9 @@ function renderPage(title, body) {
 <meta name="robots" content="noindex">
 <title>${escapeHtml(title)}</title>
 <link rel="stylesheet" href="/authorize.css">
+<link rel="icon" href="/favicon.ico" sizes="32x32">
+<link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png">
 </head>
 <body>
 <main>
@@ -2640,6 +3176,12 @@ var REFRESH_REUSE_WINDOW_MS = 24 * 60 * 60000;
 var MAX_CODES = 1e4;
 var MAX_FORM_BYTES = 8192;
 var MAX_STATE_LENGTH = 1024;
+var MAX_NONCES_PER_HOST = 1e4;
+var MAX_NONCES = 1e5;
+var CLIENT_AUTH_FAILED = "client authentication failed";
+function assertionRequired(auth) {
+  return auth.method === "private_key_jwt" && !auth.publicAllowed;
+}
 
 class OAuthError extends Error {
   status;
@@ -2689,10 +3231,16 @@ function hostOf(url) {
     return url;
   }
 }
+function logHost(clientId) {
+  return clientId !== undefined && URL.canParse(clientId) ? hostOf(clientId).slice(0, 100) : "(not a URL)";
+}
 
 class AuthorizationServer {
   #host;
   #cimd;
+  #clientKeys;
+  #nonces = new NonceSet;
+  #nonceQuota = new NonceQuota(MAX_NONCES_PER_HOST, MAX_NONCES);
   #pending = new Map;
   #pendingPerIp = new Map;
   #pendingPerAddress = new Map;
@@ -2743,6 +3291,8 @@ class AuthorizationServer {
       logger: host.logger,
       ...testMode?.cimd === undefined ? {} : { testMode: testMode.cimd }
     });
+    const cimd = this.#cimd;
+    this.#clientKeys = new ClientKeySets((url) => cimd.fetchJwks(url));
   }
   get #issuer() {
     return this.#host.publicUrl();
@@ -2796,8 +3346,10 @@ class AuthorizationServer {
       response_modes_supported: ["query"],
       grant_types_supported: ["authorization_code", "refresh_token"],
       code_challenge_methods_supported: ["S256"],
-      token_endpoint_auth_methods_supported: ["none"],
-      revocation_endpoint_auth_methods_supported: ["none"],
+      token_endpoint_auth_methods_supported: ["none", "private_key_jwt"],
+      token_endpoint_auth_signing_alg_values_supported: JWT_ALGORITHMS,
+      revocation_endpoint_auth_methods_supported: ["none", "private_key_jwt"],
+      revocation_endpoint_auth_signing_alg_values_supported: JWT_ALGORITHMS,
       scopes_supported: [SCOPE],
       client_id_metadata_document_supported: true,
       authorization_response_iss_parameter_supported: true,
@@ -3296,20 +3848,21 @@ ${cancel}
         "code_verifier",
         "refresh_token",
         "resource",
-        "scope"
+        "scope",
+        "client_assertion",
+        "client_assertion_type"
       ]);
       if ("duplicate" in p) {
         throw new OAuthError(400, "invalid_request", `${p.duplicate} was sent more than once`);
       }
-      const clientId = p["client_id"];
-      if (clientId === undefined) {
-        throw new OAuthError(400, "invalid_request", "client_id is required");
-      }
+      const client = await this.#authenticateClient(p, [
+        `${this.#issuer}/token`
+      ]);
       let body;
       if (p["grant_type"] === "authorization_code") {
-        body = await this.#codeGrant(p, clientId);
+        body = await this.#codeGrant(p, client);
       } else if (p["grant_type"] === "refresh_token") {
-        body = await this.#refreshGrant(p, clientId);
+        body = await this.#refreshGrant(p, client);
       } else if (p["grant_type"] === undefined) {
         throw new OAuthError(400, "invalid_request", "grant_type is required");
       } else {
@@ -3343,19 +3896,96 @@ ${cancel}
       throw new OAuthError(400, "invalid_request", "the body must be application/x-www-form-urlencoded");
     }
     if (req.headers.get("authorization") !== null) {
-      throw new OAuthError(401, "invalid_client", "client authentication is not supported (token_endpoint_auth_method none)");
+      throw new OAuthError(401, "invalid_client", "HTTP authentication is not supported (token_endpoint_auth_method none or private_key_jwt)");
     }
     const text = await this.#readForm(req);
     if (text === undefined) {
       throw new OAuthError(413, "invalid_request", "the request is too large");
     }
     const params = new URLSearchParams(text);
-    if (params.has("client_secret") || params.has("client_assertion")) {
-      throw new OAuthError(400, "invalid_client", "client authentication is not supported (token_endpoint_auth_method none)");
+    if (params.has("client_secret")) {
+      throw new OAuthError(400, "invalid_client", "client secrets are not supported (token_endpoint_auth_method none or private_key_jwt)");
     }
     return params;
   }
-  async#codeGrant(p, clientId) {
+  async#authenticateClient(p, endpoints) {
+    const assertion = p["client_assertion"];
+    const type = p["client_assertion_type"];
+    if (assertion === undefined && type === undefined) {
+      const clientId = p["client_id"];
+      if (clientId === undefined) {
+        throw new OAuthError(400, "invalid_request", "client_id is required");
+      }
+      return { clientId, assertion: false };
+    }
+    if (assertion === undefined || type === undefined) {
+      throw new OAuthError(400, "invalid_request", "client_assertion and client_assertion_type go together");
+    }
+    const clientId = p["client_id"] ?? assertionSubject(assertion);
+    if (type !== CLIENT_ASSERTION_TYPE) {
+      throw this.#clientAuthFailed(clientId, "assertion_type");
+    }
+    if (clientId === undefined) {
+      throw this.#clientAuthFailed(clientId, "no_client_id");
+    }
+    let client;
+    try {
+      client = await this.#cimd.get(clientId, { allowStale: true });
+    } catch (error) {
+      if (!(error instanceof ClientMetadataError))
+        throw error;
+      const reason = `metadata_${error.reason}`;
+      throw isTransient(error) || error.reason === "private_address" ? this.#clientAuthUnavailable(clientId, reason) : this.#clientAuthFailed(clientId, reason);
+    }
+    if (client.auth.method !== "private_key_jwt") {
+      throw this.#clientAuthFailed(clientId, "not_private_key_jwt");
+    }
+    const domain = quotaKey(clientId);
+    try {
+      await verifyClientAssertion(assertion, {
+        clientId,
+        auth: client.auth,
+        keys: this.#clientKeys.for(client.auth.jwksUri),
+        audiences: [this.#issuer, ...endpoints],
+        claimNonce: (key, until, now) => this.#claimNonce(clientId, domain, key, until, now),
+        now: Date.now()
+      });
+    } catch (error) {
+      if (!(error instanceof JwtError))
+        throw error;
+      throw error.reason === "jwks_unavailable" ? this.#clientAuthUnavailable(clientId, error.reason) : this.#clientAuthFailed(clientId, error.reason);
+    }
+    return { clientId, assertion: true };
+  }
+  #clientAuthFailed(clientId, reason) {
+    this.#host.logger.info("oauth.client_auth_failed", {
+      client: logHost(clientId),
+      reason
+    });
+    return new OAuthError(401, "invalid_client", CLIENT_AUTH_FAILED);
+  }
+  #clientAuthUnavailable(clientId, reason) {
+    this.#host.logger.warn("oauth.client_auth_unavailable", {
+      client: logHost(clientId),
+      reason
+    });
+    return new OAuthError(503, "temporarily_unavailable", "the client cannot be authenticated right now; try again shortly");
+  }
+  async#claimNonce(clientId, domain, key, until, now) {
+    if (this.#nonceQuota.sweep(now))
+      this.#nonces.sweep(now);
+    const refusal = this.#nonceQuota.refusal(domain, now);
+    if (refusal !== undefined) {
+      throw this.#clientAuthUnavailable(clientId, `nonces_${refusal}`);
+    }
+    const store = this.#host.store;
+    const claimed = store.claimNonce === undefined ? this.#nonces.claim(key, until, now) : await store.claimNonce(key, until, now);
+    if (claimed)
+      this.#nonceQuota.add(domain, until);
+    return claimed;
+  }
+  async#codeGrant(p, client) {
+    const clientId = client.clientId;
     const code = p["code"];
     const redirectUri = p["redirect_uri"];
     const verifier = p["code_verifier"];
@@ -3367,6 +3997,12 @@ ${cancel}
     const invalid = (why) => new OAuthError(400, "invalid_grant", why);
     if (issued === undefined)
       throw invalid("the code is not valid");
+    if (!constantTimeEqual(clientId, issued.client.clientId)) {
+      throw invalid("the code was issued to another client");
+    }
+    if (assertionRequired(issued.client.auth) && !client.assertion) {
+      throw this.#clientAuthFailed(clientId, "assertion_required");
+    }
     if (issued.used) {
       if (issued.grantId !== undefined) {
         await this.#revokeGrant(issued.addressId, issued.grantId, "reuse_detected");
@@ -3376,9 +4012,6 @@ ${cancel}
     issued.used = true;
     if (issued.expiresAt <= Date.now())
       throw invalid("the code has expired");
-    if (!constantTimeEqual(clientId, issued.client.clientId)) {
-      throw invalid("the code was issued to another client");
-    }
     if (redirectUri !== issued.redirectUri) {
       throw invalid("redirect_uri does not match the authorization request");
     }
@@ -3402,7 +4035,8 @@ ${cancel}
       clientName: issued.client.name,
       scopes: issued.scopes,
       grantCreatedAt: now,
-      ...issued.subject === undefined ? {} : { subject: issued.subject }
+      ...issued.subject === undefined ? {} : { subject: issued.subject },
+      ...client.assertion ? { clientAuth: "private_key_jwt" } : {}
     }, {
       accessTtlMs: config.accessTokenTtlMs,
       refreshTtlMs: config.refreshTokenTtlMs,
@@ -3436,7 +4070,8 @@ ${cancel}
       scope: scopes.join(" ")
     };
   }
-  async#refreshGrant(p, clientId) {
+  async#refreshGrant(p, client) {
+    const clientId = client.clientId;
     const token = p["refresh_token"];
     if (token === undefined) {
       throw new OAuthError(400, "invalid_request", "refresh_token is required");
@@ -3450,6 +4085,9 @@ ${cancel}
     if (!constantTimeEqual(clientId, record.clientId)) {
       throw invalid("the refresh token was issued to another client");
     }
+    if (record.clientAuth === "private_key_jwt" && !client.assertion) {
+      throw this.#clientAuthFailed(clientId, "assertion_required");
+    }
     const now = Date.now();
     if (record.expiresAt <= now)
       throw invalid("the refresh token has expired");
@@ -3481,7 +4119,8 @@ ${cancel}
       clientName: record.clientName,
       scopes: record.scopes,
       grantCreatedAt: record.grantCreatedAt,
-      ...record.subject === undefined ? {} : { subject: record.subject }
+      ...record.subject === undefined ? {} : { subject: record.subject },
+      ...record.clientAuth === "private_key_jwt" || client.assertion ? { clientAuth: "private_key_jwt" } : {}
     }, {
       accessTtlMs: this.#host.config.accessTokenTtlMs,
       refreshTtlMs: this.#host.config.refreshTokenTtlMs,
@@ -3517,24 +4156,36 @@ ${cancel}
         throw new OAuthError(429, "temporarily_unavailable", "too many requests; try again shortly");
       }
       const params = await this.#formParams(req);
-      const p = single(params, ["token", "client_id", "token_type_hint"]);
+      const p = single(params, [
+        "token",
+        "client_id",
+        "token_type_hint",
+        "client_assertion",
+        "client_assertion_type"
+      ]);
       if ("duplicate" in p) {
         throw new OAuthError(400, "invalid_request", `${p.duplicate} was sent more than once`);
       }
       const token = p["token"];
-      const clientId = p["client_id"];
-      if (token === undefined || clientId === undefined) {
-        throw new OAuthError(400, "invalid_request", "token and client_id are required");
+      if (token === undefined) {
+        throw new OAuthError(400, "invalid_request", "token is required");
       }
+      const client = await this.#authenticateClient(p, [
+        `${this.#issuer}/revoke`,
+        `${this.#issuer}/token`
+      ]);
       const record = await this.#host.store.get(hashToken(token));
       if (record === undefined)
         return new Response(null, {
           status: 200,
           headers: { ...this.#cors(), ...noStore }
         });
-      if (!constantTimeEqual(clientId, record.clientId)) {
+      if (!constantTimeEqual(client.clientId, record.clientId)) {
         throw new OAuthError(400, "invalid_client", "the token was issued to another client");
       }
+      if (record.clientAuth === "private_key_jwt" && !client.assertion) {
+        throw this.#clientAuthFailed(client.clientId, "assertion_required");
+      }
       await this.#revokeGrant(record.addressId, record.grantId, "revoked");
       this.#host.logger.info("oauth.revoked", {
         address: shortAddress(record.addressId),
@@ -3580,6 +4231,7 @@ ${cancel}
     this.#guessesPerAddress.sweep(now);
     this.#tokenPerIp.sweep(now);
     this.#refreshesPerGrant.sweep(now);
+    this.#nonces.sweep(now);
   }
 }
 
@@ -3988,112 +4640,10 @@ class TabSession {
   }
 }
 
-// src/store/memory.ts
-function copy(record) {
-  return { ...record, scopes: [...record.scopes] };
-}
-function matches(record, selector) {
-  return "grantId" in selector ? record.grantId === selector.grantId : record.addressId === selector.addressId;
-}
-function isLive(record, now) {
-  return record.expiresAt > now && (record.kind === "access" || record.usedAt === undefined);
-}
-function summarizeGrants(records, now) {
-  const grants = new Map;
-  for (const r of records) {
-    if (!isLive(r, now) || grants.has(r.grantId))
-      continue;
-    const summary = {
-      grantId: r.grantId,
-      clientId: r.clientId,
-      clientName: r.clientName,
-      scopes: [...r.scopes],
-      createdAt: r.grantCreatedAt
-    };
-    if (r.subject !== undefined)
-      summary.subject = r.subject;
-    grants.set(r.grantId, summary);
-  }
-  return [...grants.values()].sort((a, b) => a.createdAt - b.createdAt || a.grantId.localeCompare(b.grantId));
-}
-
-class MemoryTokenStore {
-  #records = new Map;
-  #revokedGrants = new Map;
-  #revokedAddresses = new Map;
-  async put(record) {
-    if (this.#revokedGrants.has(record.grantId))
-      return false;
-    const address = this.#revokedAddresses.get(record.addressId);
-    if (address !== undefined && record.grantCreatedAt <= address.at) {
-      return false;
-    }
-    this.#records.set(record.hash, copy(record));
-    return true;
-  }
-  async get(hash) {
-    const r = this.#records.get(hash);
-    return r === undefined ? undefined : copy(r);
-  }
-  async markUsed(hash, now, keepUntil) {
-    const r = this.#records.get(hash);
-    if (r === undefined || r.usedAt !== undefined)
-      return false;
-    r.usedAt = now;
-    r.expiresAt = Math.min(r.expiresAt, keepUntil);
-    return true;
-  }
-  async revoke(selector, options) {
-    if ("grantId" in selector) {
-      this.#revokedGrants.set(selector.grantId, options.keepUntil);
-    } else {
-      const old = this.#revokedAddresses.get(selector.addressId);
-      this.#revokedAddresses.set(selector.addressId, {
-        at: Math.max(old?.at ?? 0, options.now),
-        until: Math.max(old?.until ?? 0, options.keepUntil)
-      });
-    }
-    let n = 0;
-    for (const [hash, r] of this.#records) {
-      if (matches(r, selector)) {
-        this.#records.delete(hash);
-        n++;
-      }
-    }
-    return n;
-  }
-  async listGrants(addressId, now) {
-    const own = [...this.#records.values()].filter((r) => r.addressId === addressId);
-    return summarizeGrants(own, now);
-  }
-  async deleteExpired(now) {
-    for (const [id, until] of this.#revokedGrants) {
-      if (until <= now)
-        this.#revokedGrants.delete(id);
-    }
-    for (const [id, t] of this.#revokedAddresses) {
-      if (t.until <= now)
-        this.#revokedAddresses.delete(id);
-    }
-    let n = 0;
-    for (const [hash, r] of this.#records) {
-      if (r.expiresAt <= now) {
-        this.#records.delete(hash);
-        n++;
-      }
-    }
-    return n;
-  }
-  async close() {
-    this.#records.clear();
-    this.#revokedGrants.clear();
-    this.#revokedAddresses.clear();
-  }
-}
-
 // src/store/sqlite.ts
 import { Database } from "bun:sqlite";
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 5;
+var MIN_READER_VERSION = 5;
 var REUSE_WINDOW_MS = 86400000;
 function toRecord(row) {
   const record = {
@@ -4112,6 +4662,8 @@ function toRecord(row) {
     record.usedAt = row.used_at;
   if (row.subject !== null)
     record.subject = row.subject;
+  if (row.client_auth === "private_key_jwt")
+    record.clientAuth = "private_key_jwt";
   return record;
 }
 
@@ -4122,7 +4674,24 @@ class SqliteTokenStore {
     this.#db.run("PRAGMA busy_timeout = 5000");
     if (path !== ":memory:")
       this.#db.run("PRAGMA journal_mode = WAL");
+    this.#checkReader();
     this.#migrate();
+    this.#db.run(`CREATE TABLE IF NOT EXISTS meta (
+			key TEXT PRIMARY KEY,
+			value INTEGER NOT NULL
+		) STRICT`);
+    this.#db.query(`INSERT INTO meta (key, value) VALUES ('min_reader_version', $v)
+				ON CONFLICT (key) DO UPDATE SET value = max(value, excluded.value)`).run({ v: MIN_READER_VERSION });
+  }
+  #checkReader() {
+    const table = this.#db.query("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'meta'").get();
+    if (table === null)
+      return;
+    const row = this.#db.query("SELECT value FROM meta WHERE key = 'min_reader_version'").get();
+    if (row !== null && row.value > SCHEMA_VERSION) {
+      this.#db.close();
+      throw new Error(`the token store file needs a newer relay (schema ${row.value}; this relay knows ${SCHEMA_VERSION})`);
+    }
   }
   #migrate() {
     const row = this.#db.query("PRAGMA user_version").get();
@@ -4148,12 +4717,20 @@ class SqliteTokenStore {
 				issued_at INTEGER NOT NULL,
 				expires_at INTEGER NOT NULL,
 				used_at INTEGER,
-				subject TEXT
+				subject TEXT,
+				client_auth TEXT
 			) STRICT`);
       const columns = this.#db.query("PRAGMA table_info(tokens)").all();
       if (!columns.some((c) => c.name === "subject")) {
         this.#db.run("ALTER TABLE tokens ADD COLUMN subject TEXT");
       }
+      if (!columns.some((c) => c.name === "client_auth")) {
+        this.#db.run("ALTER TABLE tokens ADD COLUMN client_auth TEXT");
+      }
+      this.#db.run(`CREATE TABLE IF NOT EXISTS nonces (
+				key TEXT PRIMARY KEY,
+				expires_at INTEGER NOT NULL
+			) STRICT`);
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_grant ON tokens (grant_id)");
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_address ON tokens (address_id)");
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_expires ON tokens (expires_at)");
@@ -4178,9 +4755,11 @@ class SqliteTokenStore {
   }
   #insert(r) {
     this.#db.query(`INSERT OR REPLACE INTO tokens (hash, kind, grant_id, address_id, client_id,
-				client_name, scopes, grant_created_at, issued_at, expires_at, used_at, subject)
+				client_name, scopes, grant_created_at, issued_at, expires_at, used_at, subject,
+				client_auth)
 				VALUES ($hash, $kind, $grant_id, $address_id, $client_id, $client_name,
-				$scopes, $grant_created_at, $issued_at, $expires_at, $used_at, $subject)`).run({
+				$scopes, $grant_created_at, $issued_at, $expires_at, $used_at, $subject,
+				$client_auth)`).run({
       hash: r.hash,
       kind: r.kind,
       grant_id: r.grantId,
@@ -4192,7 +4771,8 @@ class SqliteTokenStore {
       issued_at: r.issuedAt,
       expires_at: r.expiresAt,
       used_at: r.usedAt ?? null,
-      subject: r.subject ?? null
+      subject: r.subject ?? null,
+      client_auth: r.clientAuth ?? null
     });
   }
   async get(hash) {
@@ -4228,8 +4808,15 @@ class SqliteTokenStore {
   }
   async deleteExpired(now) {
     this.#db.query("DELETE FROM revocations WHERE keep_until <= $now").run({ now });
+    this.#db.query("DELETE FROM nonces WHERE expires_at <= $now").run({ now });
     return this.#db.query("DELETE FROM tokens WHERE expires_at <= $now").run({ now }).changes;
   }
+  async claimNonce(key, expiresAt, now) {
+    const result = this.#db.query(`INSERT INTO nonces (key, expires_at) VALUES ($key, $expires_at)
+				ON CONFLICT (key) DO UPDATE SET expires_at = excluded.expires_at
+				WHERE nonces.expires_at <= $now`).run({ key, expires_at: expiresAt, now });
+    return result.changes === 1;
+  }
   async close() {
     this.#db.close();
   }
@@ -4317,12 +4904,24 @@ function metaVersion(body) {
 }
 var INDEX_HTML = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<title>tab-mcp relay</title></head>
+<title>tab-mcp relay</title>
+<link rel="icon" href="/favicon.ico" sizes="32x32"><link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png"></head>
 <body><h1>tab-mcp relay</h1>
 <p>This server relays AI apps' MCP requests to tools offered by web pages open in a browser tab.
 It does not log request contents. Source and documentation:
 <a href="https://github.com/ractive/tab-mcp">github.com/ractive/tab-mcp</a>.</p>
 </body></html>`;
+function icon(body, type) {
+  return new Response(body, {
+    headers: {
+      "content-type": type,
+      "content-security-policy": "default-src 'none'",
+      "x-content-type-options": "nosniff",
+      "cache-control": "public, max-age=86400"
+    }
+  });
+}
 function createRelay(options = {}) {
   return startRelay(options, undefined);
 }
@@ -5034,12 +5633,17 @@ function startRelay(options, hooks) {
         GET: () => new Response(INDEX_HTML, {
           headers: {
             "content-type": "text/html; charset=utf-8",
-            "content-security-policy": "default-src 'none'; frame-ancestors 'none'",
+            "content-security-policy": "default-src 'none'; img-src 'self'; frame-ancestors 'none'",
             "x-content-type-options": "nosniff",
             "cache-control": "public, max-age=3600"
           }
         })
       },
+      "/favicon.ico": { GET: () => icon(FAVICON_ICO, "image/x-icon") },
+      "/favicon.svg": { GET: () => icon(FAVICON_SVG, "image/svg+xml") },
+      "/apple-touch-icon.png": {
+        GET: () => icon(APPLE_TOUCH_ICON, "image/png")
+      },
       "/tab": (req, srv) => handleTab(req, srv),
       "/.well-known/oauth-authorization-server": {
         GET: () => auth.metadata(),
@@ -5180,5 +5784,5 @@ export {
   resolveConfig
 };
 
-//# debugId=C9E94078D468D4A064756E2164756E21
+//# debugId=61513056506259C164756E2164756E21
 //# sourceMappingURL=index.js.map