@shipfox/api-auth-dto 19.0.0 → 20.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 10 files with swc (343.44ms)
+Successfully compiled: 11 files with swc (250.85ms)

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @shipfox/api-auth-dto
 
+## 20.0.0
+
+### Minor Changes
+
+- 9113421: Add MCP OAuth discovery, public-client registration, and Client ID Metadata Document resolution for the read-only profile.
+
 ## 19.0.0
 
 ### Minor Changes

package/dist/schemas/index.d.ts

@@ -3,6 +3,7 @@ export { type AdminBootstrapStateDto, type AdminGrantDto, type AdministratorGran
 export { type ChangePasswordBodyDto, changePasswordBodySchema, emailSchema, type ImpersonateResponseDto, impersonateResponseSchema, type LoginBodyDto, type LoginMethodDto, type LoginMethodsResponseDto, type LoginResponseDto, type LogoutBodyDto, loginBodySchema, loginMethodSchema, loginMethodsResponseSchema, loginResponseSchema, logoutBodySchema, type MeResponseDto, meResponseSchema, type PasswordResetConfirmBodyDto, type PasswordResetConfirmResponseDto, type PasswordResetRequestBodyDto, passwordResetConfirmBodySchema, passwordResetConfirmResponseSchema, passwordResetRequestBodySchema, passwordSchema, type RefreshResponseDto, refreshResponseSchema, type SessionResponseDto, type SignupAcceptErrorDto, type SignupBodyDto, type SignupMembershipDto, type SignupResponseDto, sessionResponseSchema, signupAcceptErrorSchema, signupBodySchema, signupMembershipSchema, signupResponseSchema, type VerifyEmailConfirmBodyDto, type VerifyEmailConfirmResponseDto, type VerifyEmailResendBodyDto, type VerifyEmailResendResponseDto, verifyEmailConfirmBodySchema, verifyEmailConfirmResponseSchema, verifyEmailResendBodySchema, verifyEmailResendResponseSchema, } from './auth.js';
 export { type E2eCreateSessionBodyDto, type E2eCreateSessionResponseDto, type E2eCreateUserBodyDto, type E2eCreateUserResponseDto, type E2eSessionDto, e2eCreateSessionBodySchema, e2eCreateSessionResponseSchema, e2eCreateUserBodySchema, e2eCreateUserResponseSchema, } from './e2e.js';
 export { JOB_LEASE_TOKEN_AUDIENCE, type JobLeaseTokenClaims, jobLeaseTokenClaimsSchema, } from './job-lease-token.js';
+export { OAUTH_READ_SCOPE, type OAuthAuthorizationServerMetadataDto, type OAuthClientMetadataDocumentDto, type OAuthDynamicClientRegistrationRequestDto, type OAuthDynamicClientRegistrationResponseDto, type OAuthProtectedResourceMetadataDto, oauthAuthorizationServerMetadataSchema, oauthClientMetadataDocumentSchema, oauthDynamicClientRegistrationRequestSchema, oauthDynamicClientRegistrationResponseSchema, oauthProtectedResourceMetadataSchema, } from './oauth.js';
 export { RUNNER_SESSION_TOKEN_AUDIENCE, type RunnerSessionTokenClaims, runnerSessionTokenClaimsSchema, } from './runner-session-token.js';
 export { type UserDto, userDtoSchema, userStatusSchema } from './user.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACxC,KAAK,qBAAqB,EAC1B,gBAAgB,EAChB,oCAAoC,EACpC,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,KAAK,kCAAkC,EACvC,KAAK,qCAAqC,EAC1C,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,oCAAoC,EACzC,KAAK,2BAA2B,EAChC,KAAK,SAAS,EACd,yBAAyB,EACzB,mBAAmB,EACnB,+BAA+B,EAC/B,qCAAqC,EACrC,wCAAwC,EACxC,+BAA+B,EAC/B,kCAAkC,EAClC,uCAAuC,EACvC,8BAA8B,EAC9B,eAAe,EACf,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,yBAAyB,EACzB,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,sCAAsC,EAC3C,KAAK,0CAA0C,EAC/C,qCAAqC,EACrC,0BAA0B,EAC1B,8BAA8B,EAC9B,yCAAyC,EACzC,6CAA6C,EAC7C,KAAK,+BAA+B,EACpC,kCAAkC,GACnC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,qBAAqB,EAC1B,wBAAwB,EACxB,WAAW,EACX,KAAK,sBAAsB,EAC3B,yBAAyB,EACzB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,aAAa,EAClB,gBAAgB,EAChB,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,2BAA2B,EAChC,8BAA8B,EAC9B,kCAAkC,EAClC,8BAA8B,EAC9B,cAAc,EACd,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,KAAK,wBAAwB,EAC7B,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAC,KAAK,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAC,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACxC,KAAK,qBAAqB,EAC1B,gBAAgB,EAChB,oCAAoC,EACpC,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,KAAK,kCAAkC,EACvC,KAAK,qCAAqC,EAC1C,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,oCAAoC,EACzC,KAAK,2BAA2B,EAChC,KAAK,SAAS,EACd,yBAAyB,EACzB,mBAAmB,EACnB,+BAA+B,EAC/B,qCAAqC,EACrC,wCAAwC,EACxC,+BAA+B,EAC/B,kCAAkC,EAClC,uCAAuC,EACvC,8BAA8B,EAC9B,eAAe,EACf,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,yBAAyB,EACzB,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,sCAAsC,EAC3C,KAAK,0CAA0C,EAC/C,qCAAqC,EACrC,0BAA0B,EAC1B,8BAA8B,EAC9B,yCAAyC,EACzC,6CAA6C,EAC7C,KAAK,+BAA+B,EACpC,kCAAkC,GACnC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,qBAAqB,EAC1B,wBAAwB,EACxB,WAAW,EACX,KAAK,sBAAsB,EAC3B,yBAAyB,EACzB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,aAAa,EAClB,gBAAgB,EAChB,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,2BAA2B,EAChC,8BAA8B,EAC9B,kCAAkC,EAClC,8BAA8B,EAC9B,cAAc,EACd,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,gBAAgB,EAChB,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,wCAAwC,EAC7C,KAAK,yCAAyC,EAC9C,KAAK,iCAAiC,EACtC,sCAAsC,EACtC,iCAAiC,EACjC,2CAA2C,EAC3C,4CAA4C,EAC5C,oCAAoC,GACrC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,6BAA6B,EAC7B,KAAK,wBAAwB,EAC7B,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAC,KAAK,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAC,MAAM,WAAW,CAAC"}

package/dist/schemas/index.js

@@ -3,6 +3,7 @@ export { adminBootstrapStateSchema, adminGrantDtoSchema, administratorGrantSumma
 export { changePasswordBodySchema, emailSchema, impersonateResponseSchema, loginBodySchema, loginMethodSchema, loginMethodsResponseSchema, loginResponseSchema, logoutBodySchema, meResponseSchema, passwordResetConfirmBodySchema, passwordResetConfirmResponseSchema, passwordResetRequestBodySchema, passwordSchema, refreshResponseSchema, sessionResponseSchema, signupAcceptErrorSchema, signupBodySchema, signupMembershipSchema, signupResponseSchema, verifyEmailConfirmBodySchema, verifyEmailConfirmResponseSchema, verifyEmailResendBodySchema, verifyEmailResendResponseSchema } from './auth.js';
 export { e2eCreateSessionBodySchema, e2eCreateSessionResponseSchema, e2eCreateUserBodySchema, e2eCreateUserResponseSchema } from './e2e.js';
 export { JOB_LEASE_TOKEN_AUDIENCE, jobLeaseTokenClaimsSchema } from './job-lease-token.js';
+export { OAUTH_READ_SCOPE, oauthAuthorizationServerMetadataSchema, oauthClientMetadataDocumentSchema, oauthDynamicClientRegistrationRequestSchema, oauthDynamicClientRegistrationResponseSchema, oauthProtectedResourceMetadataSchema } from './oauth.js';
 export { RUNNER_SESSION_TOKEN_AUDIENCE, runnerSessionTokenClaimsSchema } from './runner-session-token.js';
 export { userDtoSchema, userStatusSchema } from './user.js';
 

package/dist/schemas/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/schemas/index.ts"],"sourcesContent":["export {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  AUTH_USER_SIGNED_UP,\n  type AuthEventMap,\n  type AuthPasswordResetSendRequestedEvent,\n  type AuthUserSignedUpEvent,\n  authEventSchemas,\n  authPasswordResetSendRequestedSchema,\n  authUserSignedUpSchema,\n} from '../events.js';\nexport {\n  type AdminBootstrapStateDto,\n  type AdminGrantDto,\n  type AdministratorGrantSummaryDto,\n  type AdministratorUserDirectoryQueryDto,\n  type AdministratorUserDirectoryResponseDto,\n  type AdministratorUserIdentityDto,\n  type AdministratorUserLookupQueryDto,\n  type AdministratorUserMutationResponseDto,\n  type AdministratorUserSummaryDto,\n  type AdminRole,\n  adminBootstrapStateSchema,\n  adminGrantDtoSchema,\n  administratorGrantSummarySchema,\n  administratorUserDirectoryQuerySchema,\n  administratorUserDirectoryResponseSchema,\n  administratorUserIdentitySchema,\n  administratorUserLookupQuerySchema,\n  administratorUserMutationResponseSchema,\n  administratorUserSummarySchema,\n  adminRoleSchema,\n  type BootstrapAdminOwnerBodyDto,\n  type BootstrapAdminOwnerResponseDto,\n  bootstrapAdminOwnerBodySchema,\n  bootstrapAdminOwnerResponseSchema,\n  type GrantAdminRoleBodyDto,\n  type GrantAdminRoleResponseDto,\n  grantAdminRoleBodySchema,\n  grantAdminRoleResponseSchema,\n  type ImpersonateUserBodyDto,\n  impersonateUserBodySchema,\n  isAdminRole,\n  type ListAdminGrantsQueryDto,\n  type ListAdminGrantsResponseDto,\n  listAdminGrantsQuerySchema,\n  listAdminGrantsResponseSchema,\n  type ReactivateAdministratorUserBodyDto,\n  type RevokeAdminGrantBodyDto,\n  type RevokeAdminGrantResponseDto,\n  type RevokeAdministratorUserSessionsBodyDto,\n  type RevokeAdministratorUserSessionsResponseDto,\n  reactivateAdministratorUserBodySchema,\n  revokeAdminGrantBodySchema,\n  revokeAdminGrantResponseSchema,\n  revokeAdministratorUserSessionsBodySchema,\n  revokeAdministratorUserSessionsResponseSchema,\n  type SuspendAdministratorUserBodyDto,\n  suspendAdministratorUserBodySchema,\n} from './admin.js';\nexport {\n  type ChangePasswordBodyDto,\n  changePasswordBodySchema,\n  emailSchema,\n  type ImpersonateResponseDto,\n  impersonateResponseSchema,\n  type LoginBodyDto,\n  type LoginMethodDto,\n  type LoginMethodsResponseDto,\n  type LoginResponseDto,\n  type LogoutBodyDto,\n  loginBodySchema,\n  loginMethodSchema,\n  loginMethodsResponseSchema,\n  loginResponseSchema,\n  logoutBodySchema,\n  type MeResponseDto,\n  meResponseSchema,\n  type PasswordResetConfirmBodyDto,\n  type PasswordResetConfirmResponseDto,\n  type PasswordResetRequestBodyDto,\n  passwordResetConfirmBodySchema,\n  passwordResetConfirmResponseSchema,\n  passwordResetRequestBodySchema,\n  passwordSchema,\n  type RefreshResponseDto,\n  refreshResponseSchema,\n  type SessionResponseDto,\n  type SignupAcceptErrorDto,\n  type SignupBodyDto,\n  type SignupMembershipDto,\n  type SignupResponseDto,\n  sessionResponseSchema,\n  signupAcceptErrorSchema,\n  signupBodySchema,\n  signupMembershipSchema,\n  signupResponseSchema,\n  type VerifyEmailConfirmBodyDto,\n  type VerifyEmailConfirmResponseDto,\n  type VerifyEmailResendBodyDto,\n  type VerifyEmailResendResponseDto,\n  verifyEmailConfirmBodySchema,\n  verifyEmailConfirmResponseSchema,\n  verifyEmailResendBodySchema,\n  verifyEmailResendResponseSchema,\n} from './auth.js';\nexport {\n  type E2eCreateSessionBodyDto,\n  type E2eCreateSessionResponseDto,\n  type E2eCreateUserBodyDto,\n  type E2eCreateUserResponseDto,\n  type E2eSessionDto,\n  e2eCreateSessionBodySchema,\n  e2eCreateSessionResponseSchema,\n  e2eCreateUserBodySchema,\n  e2eCreateUserResponseSchema,\n} from './e2e.js';\nexport {\n  JOB_LEASE_TOKEN_AUDIENCE,\n  type JobLeaseTokenClaims,\n  jobLeaseTokenClaimsSchema,\n} from './job-lease-token.js';\nexport {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from './runner-session-token.js';\nexport {type UserDto, userDtoSchema, userStatusSchema} from './user.js';\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","AUTH_USER_SIGNED_UP","authEventSchemas","authPasswordResetSendRequestedSchema","authUserSignedUpSchema","adminBootstrapStateSchema","adminGrantDtoSchema","administratorGrantSummarySchema","administratorUserDirectoryQuerySchema","administratorUserDirectoryResponseSchema","administratorUserIdentitySchema","administratorUserLookupQuerySchema","administratorUserMutationResponseSchema","administratorUserSummarySchema","adminRoleSchema","bootstrapAdminOwnerBodySchema","bootstrapAdminOwnerResponseSchema","grantAdminRoleBodySchema","grantAdminRoleResponseSchema","impersonateUserBodySchema","isAdminRole","listAdminGrantsQuerySchema","listAdminGrantsResponseSchema","reactivateAdministratorUserBodySchema","revokeAdminGrantBodySchema","revokeAdminGrantResponseSchema","revokeAdministratorUserSessionsBodySchema","revokeAdministratorUserSessionsResponseSchema","suspendAdministratorUserBodySchema","changePasswordBodySchema","emailSchema","impersonateResponseSchema","loginBodySchema","loginMethodSchema","loginMethodsResponseSchema","loginResponseSchema","logoutBodySchema","meResponseSchema","passwordResetConfirmBodySchema","passwordResetConfirmResponseSchema","passwordResetRequestBodySchema","passwordSchema","refreshResponseSchema","sessionResponseSchema","signupAcceptErrorSchema","signupBodySchema","signupMembershipSchema","signupResponseSchema","verifyEmailConfirmBodySchema","verifyEmailConfirmResponseSchema","verifyEmailResendBodySchema","verifyEmailResendResponseSchema","e2eCreateSessionBodySchema","e2eCreateSessionResponseSchema","e2eCreateUserBodySchema","e2eCreateUserResponseSchema","JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","userDtoSchema","userStatusSchema"],"mappings":"AAAA,SACEA,kCAAkC,EAClCC,mBAAmB,EAInBC,gBAAgB,EAChBC,oCAAoC,EACpCC,sBAAsB,QACjB,eAAe;AACtB,SAWEC,yBAAyB,EACzBC,mBAAmB,EACnBC,+BAA+B,EAC/BC,qCAAqC,EACrCC,wCAAwC,EACxCC,+BAA+B,EAC/BC,kCAAkC,EAClCC,uCAAuC,EACvCC,8BAA8B,EAC9BC,eAAe,EAGfC,6BAA6B,EAC7BC,iCAAiC,EAGjCC,wBAAwB,EACxBC,4BAA4B,EAE5BC,yBAAyB,EACzBC,WAAW,EAGXC,0BAA0B,EAC1BC,6BAA6B,EAM7BC,qCAAqC,EACrCC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,yCAAyC,EACzCC,6CAA6C,EAE7CC,kCAAkC,QAC7B,aAAa;AACpB,SAEEC,wBAAwB,EACxBC,WAAW,EAEXC,yBAAyB,EAMzBC,eAAe,EACfC,iBAAiB,EACjBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,gBAAgB,EAEhBC,gBAAgB,EAIhBC,8BAA8B,EAC9BC,kCAAkC,EAClCC,8BAA8B,EAC9BC,cAAc,EAEdC,qBAAqB,EAMrBC,qBAAqB,EACrBC,uBAAuB,EACvBC,gBAAgB,EAChBC,sBAAsB,EACtBC,oBAAoB,EAKpBC,4BAA4B,EAC5BC,gCAAgC,EAChCC,2BAA2B,EAC3BC,+BAA+B,QAC1B,YAAY;AACnB,SAMEC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,uBAAuB,EACvBC,2BAA2B,QACtB,WAAW;AAClB,SACEC,wBAAwB,EAExBC,yBAAyB,QACpB,uBAAuB;AAC9B,SACEC,6BAA6B,EAE7BC,8BAA8B,QACzB,4BAA4B;AACnC,SAAsBC,aAAa,EAAEC,gBAAgB,QAAO,YAAY"}
+{"version":3,"sources":["../../src/schemas/index.ts"],"sourcesContent":["export {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  AUTH_USER_SIGNED_UP,\n  type AuthEventMap,\n  type AuthPasswordResetSendRequestedEvent,\n  type AuthUserSignedUpEvent,\n  authEventSchemas,\n  authPasswordResetSendRequestedSchema,\n  authUserSignedUpSchema,\n} from '../events.js';\nexport {\n  type AdminBootstrapStateDto,\n  type AdminGrantDto,\n  type AdministratorGrantSummaryDto,\n  type AdministratorUserDirectoryQueryDto,\n  type AdministratorUserDirectoryResponseDto,\n  type AdministratorUserIdentityDto,\n  type AdministratorUserLookupQueryDto,\n  type AdministratorUserMutationResponseDto,\n  type AdministratorUserSummaryDto,\n  type AdminRole,\n  adminBootstrapStateSchema,\n  adminGrantDtoSchema,\n  administratorGrantSummarySchema,\n  administratorUserDirectoryQuerySchema,\n  administratorUserDirectoryResponseSchema,\n  administratorUserIdentitySchema,\n  administratorUserLookupQuerySchema,\n  administratorUserMutationResponseSchema,\n  administratorUserSummarySchema,\n  adminRoleSchema,\n  type BootstrapAdminOwnerBodyDto,\n  type BootstrapAdminOwnerResponseDto,\n  bootstrapAdminOwnerBodySchema,\n  bootstrapAdminOwnerResponseSchema,\n  type GrantAdminRoleBodyDto,\n  type GrantAdminRoleResponseDto,\n  grantAdminRoleBodySchema,\n  grantAdminRoleResponseSchema,\n  type ImpersonateUserBodyDto,\n  impersonateUserBodySchema,\n  isAdminRole,\n  type ListAdminGrantsQueryDto,\n  type ListAdminGrantsResponseDto,\n  listAdminGrantsQuerySchema,\n  listAdminGrantsResponseSchema,\n  type ReactivateAdministratorUserBodyDto,\n  type RevokeAdminGrantBodyDto,\n  type RevokeAdminGrantResponseDto,\n  type RevokeAdministratorUserSessionsBodyDto,\n  type RevokeAdministratorUserSessionsResponseDto,\n  reactivateAdministratorUserBodySchema,\n  revokeAdminGrantBodySchema,\n  revokeAdminGrantResponseSchema,\n  revokeAdministratorUserSessionsBodySchema,\n  revokeAdministratorUserSessionsResponseSchema,\n  type SuspendAdministratorUserBodyDto,\n  suspendAdministratorUserBodySchema,\n} from './admin.js';\nexport {\n  type ChangePasswordBodyDto,\n  changePasswordBodySchema,\n  emailSchema,\n  type ImpersonateResponseDto,\n  impersonateResponseSchema,\n  type LoginBodyDto,\n  type LoginMethodDto,\n  type LoginMethodsResponseDto,\n  type LoginResponseDto,\n  type LogoutBodyDto,\n  loginBodySchema,\n  loginMethodSchema,\n  loginMethodsResponseSchema,\n  loginResponseSchema,\n  logoutBodySchema,\n  type MeResponseDto,\n  meResponseSchema,\n  type PasswordResetConfirmBodyDto,\n  type PasswordResetConfirmResponseDto,\n  type PasswordResetRequestBodyDto,\n  passwordResetConfirmBodySchema,\n  passwordResetConfirmResponseSchema,\n  passwordResetRequestBodySchema,\n  passwordSchema,\n  type RefreshResponseDto,\n  refreshResponseSchema,\n  type SessionResponseDto,\n  type SignupAcceptErrorDto,\n  type SignupBodyDto,\n  type SignupMembershipDto,\n  type SignupResponseDto,\n  sessionResponseSchema,\n  signupAcceptErrorSchema,\n  signupBodySchema,\n  signupMembershipSchema,\n  signupResponseSchema,\n  type VerifyEmailConfirmBodyDto,\n  type VerifyEmailConfirmResponseDto,\n  type VerifyEmailResendBodyDto,\n  type VerifyEmailResendResponseDto,\n  verifyEmailConfirmBodySchema,\n  verifyEmailConfirmResponseSchema,\n  verifyEmailResendBodySchema,\n  verifyEmailResendResponseSchema,\n} from './auth.js';\nexport {\n  type E2eCreateSessionBodyDto,\n  type E2eCreateSessionResponseDto,\n  type E2eCreateUserBodyDto,\n  type E2eCreateUserResponseDto,\n  type E2eSessionDto,\n  e2eCreateSessionBodySchema,\n  e2eCreateSessionResponseSchema,\n  e2eCreateUserBodySchema,\n  e2eCreateUserResponseSchema,\n} from './e2e.js';\nexport {\n  JOB_LEASE_TOKEN_AUDIENCE,\n  type JobLeaseTokenClaims,\n  jobLeaseTokenClaimsSchema,\n} from './job-lease-token.js';\nexport {\n  OAUTH_READ_SCOPE,\n  type OAuthAuthorizationServerMetadataDto,\n  type OAuthClientMetadataDocumentDto,\n  type OAuthDynamicClientRegistrationRequestDto,\n  type OAuthDynamicClientRegistrationResponseDto,\n  type OAuthProtectedResourceMetadataDto,\n  oauthAuthorizationServerMetadataSchema,\n  oauthClientMetadataDocumentSchema,\n  oauthDynamicClientRegistrationRequestSchema,\n  oauthDynamicClientRegistrationResponseSchema,\n  oauthProtectedResourceMetadataSchema,\n} from './oauth.js';\nexport {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from './runner-session-token.js';\nexport {type UserDto, userDtoSchema, userStatusSchema} from './user.js';\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","AUTH_USER_SIGNED_UP","authEventSchemas","authPasswordResetSendRequestedSchema","authUserSignedUpSchema","adminBootstrapStateSchema","adminGrantDtoSchema","administratorGrantSummarySchema","administratorUserDirectoryQuerySchema","administratorUserDirectoryResponseSchema","administratorUserIdentitySchema","administratorUserLookupQuerySchema","administratorUserMutationResponseSchema","administratorUserSummarySchema","adminRoleSchema","bootstrapAdminOwnerBodySchema","bootstrapAdminOwnerResponseSchema","grantAdminRoleBodySchema","grantAdminRoleResponseSchema","impersonateUserBodySchema","isAdminRole","listAdminGrantsQuerySchema","listAdminGrantsResponseSchema","reactivateAdministratorUserBodySchema","revokeAdminGrantBodySchema","revokeAdminGrantResponseSchema","revokeAdministratorUserSessionsBodySchema","revokeAdministratorUserSessionsResponseSchema","suspendAdministratorUserBodySchema","changePasswordBodySchema","emailSchema","impersonateResponseSchema","loginBodySchema","loginMethodSchema","loginMethodsResponseSchema","loginResponseSchema","logoutBodySchema","meResponseSchema","passwordResetConfirmBodySchema","passwordResetConfirmResponseSchema","passwordResetRequestBodySchema","passwordSchema","refreshResponseSchema","sessionResponseSchema","signupAcceptErrorSchema","signupBodySchema","signupMembershipSchema","signupResponseSchema","verifyEmailConfirmBodySchema","verifyEmailConfirmResponseSchema","verifyEmailResendBodySchema","verifyEmailResendResponseSchema","e2eCreateSessionBodySchema","e2eCreateSessionResponseSchema","e2eCreateUserBodySchema","e2eCreateUserResponseSchema","JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","OAUTH_READ_SCOPE","oauthAuthorizationServerMetadataSchema","oauthClientMetadataDocumentSchema","oauthDynamicClientRegistrationRequestSchema","oauthDynamicClientRegistrationResponseSchema","oauthProtectedResourceMetadataSchema","RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","userDtoSchema","userStatusSchema"],"mappings":"AAAA,SACEA,kCAAkC,EAClCC,mBAAmB,EAInBC,gBAAgB,EAChBC,oCAAoC,EACpCC,sBAAsB,QACjB,eAAe;AACtB,SAWEC,yBAAyB,EACzBC,mBAAmB,EACnBC,+BAA+B,EAC/BC,qCAAqC,EACrCC,wCAAwC,EACxCC,+BAA+B,EAC/BC,kCAAkC,EAClCC,uCAAuC,EACvCC,8BAA8B,EAC9BC,eAAe,EAGfC,6BAA6B,EAC7BC,iCAAiC,EAGjCC,wBAAwB,EACxBC,4BAA4B,EAE5BC,yBAAyB,EACzBC,WAAW,EAGXC,0BAA0B,EAC1BC,6BAA6B,EAM7BC,qCAAqC,EACrCC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,yCAAyC,EACzCC,6CAA6C,EAE7CC,kCAAkC,QAC7B,aAAa;AACpB,SAEEC,wBAAwB,EACxBC,WAAW,EAEXC,yBAAyB,EAMzBC,eAAe,EACfC,iBAAiB,EACjBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,gBAAgB,EAEhBC,gBAAgB,EAIhBC,8BAA8B,EAC9BC,kCAAkC,EAClCC,8BAA8B,EAC9BC,cAAc,EAEdC,qBAAqB,EAMrBC,qBAAqB,EACrBC,uBAAuB,EACvBC,gBAAgB,EAChBC,sBAAsB,EACtBC,oBAAoB,EAKpBC,4BAA4B,EAC5BC,gCAAgC,EAChCC,2BAA2B,EAC3BC,+BAA+B,QAC1B,YAAY;AACnB,SAMEC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,uBAAuB,EACvBC,2BAA2B,QACtB,WAAW;AAClB,SACEC,wBAAwB,EAExBC,yBAAyB,QACpB,uBAAuB;AAC9B,SACEC,gBAAgB,EAMhBC,sCAAsC,EACtCC,iCAAiC,EACjCC,2CAA2C,EAC3CC,4CAA4C,EAC5CC,oCAAoC,QAC/B,aAAa;AACpB,SACEC,6BAA6B,EAE7BC,8BAA8B,QACzB,4BAA4B;AACnC,SAAsBC,aAAa,EAAEC,gBAAgB,QAAO,YAAY"}

package/dist/schemas/oauth.d.ts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+/** The only scope exposed by the MCP read-only profile. */
+export declare const OAUTH_READ_SCOPE: 'read';
+/** RFC 9728 metadata advertised for the protected MCP resource. */
+export declare const oauthProtectedResourceMetadataSchema: z.ZodObject<{
+    resource: z.ZodString;
+    authorization_servers: z.ZodArray<z.ZodString>;
+    scopes_supported: z.ZodArray<z.ZodLiteral<"read">>;
+}, z.core.$strict>;
+export type OAuthProtectedResourceMetadataDto = z.infer<typeof oauthProtectedResourceMetadataSchema>;
+/** RFC 8414 metadata for the MCP authorization server. */
+export declare const oauthAuthorizationServerMetadataSchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodString;
+    token_endpoint: z.ZodString;
+    registration_endpoint: z.ZodString;
+    response_types_supported: z.ZodArray<z.ZodLiteral<"code">>;
+    grant_types_supported: z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>;
+    code_challenge_methods_supported: z.ZodArray<z.ZodLiteral<"S256">>;
+    token_endpoint_auth_methods_supported: z.ZodArray<z.ZodLiteral<"none">>;
+    scopes_supported: z.ZodArray<z.ZodLiteral<"read">>;
+    client_id_metadata_document_supported: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export type OAuthAuthorizationServerMetadataDto = z.infer<typeof oauthAuthorizationServerMetadataSchema>;
+/** RFC 7591 request shape accepted by the MCP public-client profile. */
+export declare const oauthDynamicClientRegistrationRequestSchema: z.ZodObject<{
+    client_name: z.ZodString;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodLiteral<"code">>>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodLiteral<"none">>;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type OAuthDynamicClientRegistrationRequestDto = z.infer<typeof oauthDynamicClientRegistrationRequestSchema>;
+/** RFC 7591 response shape returned for a newly registered public client. */
+export declare const oauthDynamicClientRegistrationResponseSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_name: z.ZodString;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    grant_types: z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>;
+    response_types: z.ZodArray<z.ZodLiteral<"code">>;
+    token_endpoint_auth_method: z.ZodLiteral<"none">;
+    scope: z.ZodLiteral<"read">;
+}, z.core.$strict>;
+export type OAuthDynamicClientRegistrationResponseDto = z.infer<typeof oauthDynamicClientRegistrationResponseSchema>;
+/**
+ * The subset of a Client ID Metadata Document needed before authorization.
+ * Optional standard metadata is retained in the schema so a conforming
+ * document can be validated without treating unrelated fields as identity.
+ */
+export declare const oauthClientMetadataDocumentSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_name: z.ZodString;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodLiteral<"code">>>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    client_uri: z.ZodOptional<z.ZodString>;
+    logo_uri: z.ZodOptional<z.ZodString>;
+    tos_uri: z.ZodOptional<z.ZodString>;
+    policy_uri: z.ZodOptional<z.ZodString>;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+export type OAuthClientMetadataDocumentDto = z.infer<typeof oauthClientMetadataDocumentSchema>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/schemas/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/schemas/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAStB,2DAA2D;AAC3D,eAAO,MAAM,gBAAgB,EAAG,MAAe,CAAC;AAEhD,mEAAmE;AACnE,eAAO,MAAM,oCAAoC;;;;kBAMtC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,oCAAoC,CAC5C,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;kBAaxC,CAAC;AAEZ,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,sCAAsC,CAC9C,CAAC;AAWF,wEAAwE;AACxE,eAAO,MAAM,2CAA2C;;;;;;;;;;kBAE7C,CAAC;AAEZ,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAC5D,OAAO,2CAA2C,CACnD,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,4CAA4C;;;;;;;;;;;kBAU9C,CAAC;AAEZ,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAC7D,OAAO,4CAA4C,CACpD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;iBAgB9B,CAAC;AAEjB,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/schemas/oauth.js

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+const oauthUrlSchema = z.string().url().max(2048);
+const oauthClientNameSchema = z.string().min(1).max(256);
+const oauthRedirectUriSchema = z.string().min(1).max(2048);
+const oauthScopeSchema = z.string().min(1).max(256);
+const oauthGrantTypeSchema = z.enum([
+    'authorization_code',
+    'refresh_token'
+]);
+const oauthResponseTypeSchema = z.literal('code');
+/** The only scope exposed by the MCP read-only profile. */ export const OAUTH_READ_SCOPE = 'read';
+/** RFC 9728 metadata advertised for the protected MCP resource. */ export const oauthProtectedResourceMetadataSchema = z.object({
+    resource: oauthUrlSchema,
+    authorization_servers: z.array(oauthUrlSchema).min(1),
+    scopes_supported: z.array(z.literal(OAUTH_READ_SCOPE)).min(1)
+}).strict();
+/** RFC 8414 metadata for the MCP authorization server. */ export const oauthAuthorizationServerMetadataSchema = z.object({
+    issuer: oauthUrlSchema,
+    authorization_endpoint: oauthUrlSchema,
+    token_endpoint: oauthUrlSchema,
+    registration_endpoint: oauthUrlSchema,
+    response_types_supported: z.array(oauthResponseTypeSchema).min(1),
+    grant_types_supported: z.array(oauthGrantTypeSchema).min(1),
+    code_challenge_methods_supported: z.array(z.literal('S256')).min(1),
+    token_endpoint_auth_methods_supported: z.array(z.literal('none')).min(1),
+    scopes_supported: z.array(z.literal(OAUTH_READ_SCOPE)).min(1),
+    client_id_metadata_document_supported: z.literal(true)
+}).strict();
+const oauthRegistrationProfileFields = {
+    client_name: oauthClientNameSchema,
+    redirect_uris: z.array(oauthRedirectUriSchema).min(1).max(10),
+    grant_types: z.array(oauthGrantTypeSchema).min(1).max(2).optional(),
+    response_types: z.array(oauthResponseTypeSchema).min(1).max(1).optional(),
+    token_endpoint_auth_method: z.literal('none').optional(),
+    scope: oauthScopeSchema.optional()
+};
+/** RFC 7591 request shape accepted by the MCP public-client profile. */ export const oauthDynamicClientRegistrationRequestSchema = z.object(oauthRegistrationProfileFields).strict();
+/** RFC 7591 response shape returned for a newly registered public client. */ export const oauthDynamicClientRegistrationResponseSchema = z.object({
+    client_id: z.string().min(1).max(2048),
+    client_name: oauthClientNameSchema,
+    redirect_uris: z.array(oauthRedirectUriSchema).min(1).max(10),
+    grant_types: z.array(oauthGrantTypeSchema).min(1).max(2),
+    response_types: z.array(oauthResponseTypeSchema).min(1).max(1),
+    token_endpoint_auth_method: z.literal('none'),
+    scope: z.literal(OAUTH_READ_SCOPE)
+}).strict();
+/**
+ * The subset of a Client ID Metadata Document needed before authorization.
+ * Optional standard metadata is retained in the schema so a conforming
+ * document can be validated without treating unrelated fields as identity.
+ */ export const oauthClientMetadataDocumentSchema = z.object({
+    client_id: z.string().min(1).max(2048),
+    client_name: oauthClientNameSchema,
+    redirect_uris: z.array(oauthRedirectUriSchema).min(1).max(10),
+    grant_types: z.array(oauthGrantTypeSchema).min(1).max(2).optional(),
+    response_types: z.array(oauthResponseTypeSchema).min(1).max(1).optional(),
+    token_endpoint_auth_method: z.string().min(1).max(128).optional(),
+    scope: oauthScopeSchema.optional(),
+    client_uri: oauthUrlSchema.optional(),
+    logo_uri: oauthUrlSchema.optional(),
+    tos_uri: oauthUrlSchema.optional(),
+    policy_uri: oauthUrlSchema.optional(),
+    jwks_uri: oauthUrlSchema.optional(),
+    contacts: z.array(z.string().min(1).max(256)).max(10).optional()
+}).passthrough();
+
+//# sourceMappingURL=oauth.js.map

package/dist/schemas/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/oauth.ts"],"sourcesContent":["import {z} from 'zod';\n\nconst oauthUrlSchema = z.string().url().max(2048);\nconst oauthClientNameSchema = z.string().min(1).max(256);\nconst oauthRedirectUriSchema = z.string().min(1).max(2048);\nconst oauthScopeSchema = z.string().min(1).max(256);\nconst oauthGrantTypeSchema = z.enum(['authorization_code', 'refresh_token']);\nconst oauthResponseTypeSchema = z.literal('code');\n\n/** The only scope exposed by the MCP read-only profile. */\nexport const OAUTH_READ_SCOPE = 'read' as const;\n\n/** RFC 9728 metadata advertised for the protected MCP resource. */\nexport const oauthProtectedResourceMetadataSchema = z\n  .object({\n    resource: oauthUrlSchema,\n    authorization_servers: z.array(oauthUrlSchema).min(1),\n    scopes_supported: z.array(z.literal(OAUTH_READ_SCOPE)).min(1),\n  })\n  .strict();\n\nexport type OAuthProtectedResourceMetadataDto = z.infer<\n  typeof oauthProtectedResourceMetadataSchema\n>;\n\n/** RFC 8414 metadata for the MCP authorization server. */\nexport const oauthAuthorizationServerMetadataSchema = z\n  .object({\n    issuer: oauthUrlSchema,\n    authorization_endpoint: oauthUrlSchema,\n    token_endpoint: oauthUrlSchema,\n    registration_endpoint: oauthUrlSchema,\n    response_types_supported: z.array(oauthResponseTypeSchema).min(1),\n    grant_types_supported: z.array(oauthGrantTypeSchema).min(1),\n    code_challenge_methods_supported: z.array(z.literal('S256')).min(1),\n    token_endpoint_auth_methods_supported: z.array(z.literal('none')).min(1),\n    scopes_supported: z.array(z.literal(OAUTH_READ_SCOPE)).min(1),\n    client_id_metadata_document_supported: z.literal(true),\n  })\n  .strict();\n\nexport type OAuthAuthorizationServerMetadataDto = z.infer<\n  typeof oauthAuthorizationServerMetadataSchema\n>;\n\nconst oauthRegistrationProfileFields = {\n  client_name: oauthClientNameSchema,\n  redirect_uris: z.array(oauthRedirectUriSchema).min(1).max(10),\n  grant_types: z.array(oauthGrantTypeSchema).min(1).max(2).optional(),\n  response_types: z.array(oauthResponseTypeSchema).min(1).max(1).optional(),\n  token_endpoint_auth_method: z.literal('none').optional(),\n  scope: oauthScopeSchema.optional(),\n};\n\n/** RFC 7591 request shape accepted by the MCP public-client profile. */\nexport const oauthDynamicClientRegistrationRequestSchema = z\n  .object(oauthRegistrationProfileFields)\n  .strict();\n\nexport type OAuthDynamicClientRegistrationRequestDto = z.infer<\n  typeof oauthDynamicClientRegistrationRequestSchema\n>;\n\n/** RFC 7591 response shape returned for a newly registered public client. */\nexport const oauthDynamicClientRegistrationResponseSchema = z\n  .object({\n    client_id: z.string().min(1).max(2048),\n    client_name: oauthClientNameSchema,\n    redirect_uris: z.array(oauthRedirectUriSchema).min(1).max(10),\n    grant_types: z.array(oauthGrantTypeSchema).min(1).max(2),\n    response_types: z.array(oauthResponseTypeSchema).min(1).max(1),\n    token_endpoint_auth_method: z.literal('none'),\n    scope: z.literal(OAUTH_READ_SCOPE),\n  })\n  .strict();\n\nexport type OAuthDynamicClientRegistrationResponseDto = z.infer<\n  typeof oauthDynamicClientRegistrationResponseSchema\n>;\n\n/**\n * The subset of a Client ID Metadata Document needed before authorization.\n * Optional standard metadata is retained in the schema so a conforming\n * document can be validated without treating unrelated fields as identity.\n */\nexport const oauthClientMetadataDocumentSchema = z\n  .object({\n    client_id: z.string().min(1).max(2048),\n    client_name: oauthClientNameSchema,\n    redirect_uris: z.array(oauthRedirectUriSchema).min(1).max(10),\n    grant_types: z.array(oauthGrantTypeSchema).min(1).max(2).optional(),\n    response_types: z.array(oauthResponseTypeSchema).min(1).max(1).optional(),\n    token_endpoint_auth_method: z.string().min(1).max(128).optional(),\n    scope: oauthScopeSchema.optional(),\n    client_uri: oauthUrlSchema.optional(),\n    logo_uri: oauthUrlSchema.optional(),\n    tos_uri: oauthUrlSchema.optional(),\n    policy_uri: oauthUrlSchema.optional(),\n    jwks_uri: oauthUrlSchema.optional(),\n    contacts: z.array(z.string().min(1).max(256)).max(10).optional(),\n  })\n  .passthrough();\n\nexport type OAuthClientMetadataDocumentDto = z.infer<typeof oauthClientMetadataDocumentSchema>;\n"],"names":["z","oauthUrlSchema","string","url","max","oauthClientNameSchema","min","oauthRedirectUriSchema","oauthScopeSchema","oauthGrantTypeSchema","enum","oauthResponseTypeSchema","literal","OAUTH_READ_SCOPE","oauthProtectedResourceMetadataSchema","object","resource","authorization_servers","array","scopes_supported","strict","oauthAuthorizationServerMetadataSchema","issuer","authorization_endpoint","token_endpoint","registration_endpoint","response_types_supported","grant_types_supported","code_challenge_methods_supported","token_endpoint_auth_methods_supported","client_id_metadata_document_supported","oauthRegistrationProfileFields","client_name","redirect_uris","grant_types","optional","response_types","token_endpoint_auth_method","scope","oauthDynamicClientRegistrationRequestSchema","oauthDynamicClientRegistrationResponseSchema","client_id","oauthClientMetadataDocumentSchema","client_uri","logo_uri","tos_uri","policy_uri","jwks_uri","contacts","passthrough"],"mappings":"AAAA,SAAQA,CAAC,QAAO,MAAM;AAEtB,MAAMC,iBAAiBD,EAAEE,MAAM,GAAGC,GAAG,GAAGC,GAAG,CAAC;AAC5C,MAAMC,wBAAwBL,EAAEE,MAAM,GAAGI,GAAG,CAAC,GAAGF,GAAG,CAAC;AACpD,MAAMG,yBAAyBP,EAAEE,MAAM,GAAGI,GAAG,CAAC,GAAGF,GAAG,CAAC;AACrD,MAAMI,mBAAmBR,EAAEE,MAAM,GAAGI,GAAG,CAAC,GAAGF,GAAG,CAAC;AAC/C,MAAMK,uBAAuBT,EAAEU,IAAI,CAAC;IAAC;IAAsB;CAAgB;AAC3E,MAAMC,0BAA0BX,EAAEY,OAAO,CAAC;AAE1C,yDAAyD,GACzD,OAAO,MAAMC,mBAAmB,OAAgB;AAEhD,iEAAiE,GACjE,OAAO,MAAMC,uCAAuCd,EACjDe,MAAM,CAAC;IACNC,UAAUf;IACVgB,uBAAuBjB,EAAEkB,KAAK,CAACjB,gBAAgBK,GAAG,CAAC;IACnDa,kBAAkBnB,EAAEkB,KAAK,CAAClB,EAAEY,OAAO,CAACC,mBAAmBP,GAAG,CAAC;AAC7D,GACCc,MAAM,GAAG;AAMZ,wDAAwD,GACxD,OAAO,MAAMC,yCAAyCrB,EACnDe,MAAM,CAAC;IACNO,QAAQrB;IACRsB,wBAAwBtB;IACxBuB,gBAAgBvB;IAChBwB,uBAAuBxB;IACvByB,0BAA0B1B,EAAEkB,KAAK,CAACP,yBAAyBL,GAAG,CAAC;IAC/DqB,uBAAuB3B,EAAEkB,KAAK,CAACT,sBAAsBH,GAAG,CAAC;IACzDsB,kCAAkC5B,EAAEkB,KAAK,CAAClB,EAAEY,OAAO,CAAC,SAASN,GAAG,CAAC;IACjEuB,uCAAuC7B,EAAEkB,KAAK,CAAClB,EAAEY,OAAO,CAAC,SAASN,GAAG,CAAC;IACtEa,kBAAkBnB,EAAEkB,KAAK,CAAClB,EAAEY,OAAO,CAACC,mBAAmBP,GAAG,CAAC;IAC3DwB,uCAAuC9B,EAAEY,OAAO,CAAC;AACnD,GACCQ,MAAM,GAAG;AAMZ,MAAMW,iCAAiC;IACrCC,aAAa3B;IACb4B,eAAejC,EAAEkB,KAAK,CAACX,wBAAwBD,GAAG,CAAC,GAAGF,GAAG,CAAC;IAC1D8B,aAAalC,EAAEkB,KAAK,CAACT,sBAAsBH,GAAG,CAAC,GAAGF,GAAG,CAAC,GAAG+B,QAAQ;IACjEC,gBAAgBpC,EAAEkB,KAAK,CAACP,yBAAyBL,GAAG,CAAC,GAAGF,GAAG,CAAC,GAAG+B,QAAQ;IACvEE,4BAA4BrC,EAAEY,OAAO,CAAC,QAAQuB,QAAQ;IACtDG,OAAO9B,iBAAiB2B,QAAQ;AAClC;AAEA,sEAAsE,GACtE,OAAO,MAAMI,8CAA8CvC,EACxDe,MAAM,CAACgB,gCACPX,MAAM,GAAG;AAMZ,2EAA2E,GAC3E,OAAO,MAAMoB,+CAA+CxC,EACzDe,MAAM,CAAC;IACN0B,WAAWzC,EAAEE,MAAM,GAAGI,GAAG,CAAC,GAAGF,GAAG,CAAC;IACjC4B,aAAa3B;IACb4B,eAAejC,EAAEkB,KAAK,CAACX,wBAAwBD,GAAG,CAAC,GAAGF,GAAG,CAAC;IAC1D8B,aAAalC,EAAEkB,KAAK,CAACT,sBAAsBH,GAAG,CAAC,GAAGF,GAAG,CAAC;IACtDgC,gBAAgBpC,EAAEkB,KAAK,CAACP,yBAAyBL,GAAG,CAAC,GAAGF,GAAG,CAAC;IAC5DiC,4BAA4BrC,EAAEY,OAAO,CAAC;IACtC0B,OAAOtC,EAAEY,OAAO,CAACC;AACnB,GACCO,MAAM,GAAG;AAMZ;;;;CAIC,GACD,OAAO,MAAMsB,oCAAoC1C,EAC9Ce,MAAM,CAAC;IACN0B,WAAWzC,EAAEE,MAAM,GAAGI,GAAG,CAAC,GAAGF,GAAG,CAAC;IACjC4B,aAAa3B;IACb4B,eAAejC,EAAEkB,KAAK,CAACX,wBAAwBD,GAAG,CAAC,GAAGF,GAAG,CAAC;IAC1D8B,aAAalC,EAAEkB,KAAK,CAACT,sBAAsBH,GAAG,CAAC,GAAGF,GAAG,CAAC,GAAG+B,QAAQ;IACjEC,gBAAgBpC,EAAEkB,KAAK,CAACP,yBAAyBL,GAAG,CAAC,GAAGF,GAAG,CAAC,GAAG+B,QAAQ;IACvEE,4BAA4BrC,EAAEE,MAAM,GAAGI,GAAG,CAAC,GAAGF,GAAG,CAAC,KAAK+B,QAAQ;IAC/DG,OAAO9B,iBAAiB2B,QAAQ;IAChCQ,YAAY1C,eAAekC,QAAQ;IACnCS,UAAU3C,eAAekC,QAAQ;IACjCU,SAAS5C,eAAekC,QAAQ;IAChCW,YAAY7C,eAAekC,QAAQ;IACnCY,UAAU9C,eAAekC,QAAQ;IACjCa,UAAUhD,EAAEkB,KAAK,CAAClB,EAAEE,MAAM,GAAGI,GAAG,CAAC,GAAGF,GAAG,CAAC,MAAMA,GAAG,CAAC,IAAI+B,QAAQ;AAChE,GACCc,WAAW,GAAG"}