@suveren/gateway 0.11.1 → 0.12.0

package/dist/mcp-server/http.mjs

@@ -1885,7 +1885,7 @@ var SharedState = class {
 
 // src/index.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // src/lib/mandate-brief.ts
 import { getProfile } from "@hap/core";
@@ -2607,6 +2607,20 @@ import { randomUUID } from "crypto";
 // src/lib/manifest-loader.ts
 import { readFileSync as readFileSync12, existsSync as existsSync11 } from "fs";
 import { join as join11, resolve } from "path";
+var EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+function isExactSemver(value) {
+  return typeof value === "string" && EXACT_SEMVER_RE.test(value);
+}
+function invalidNpmPinReason(manifest) {
+  if (!manifest.npmPackage) return null;
+  if (manifest.npmVersion === void 0) {
+    return `npmPackage "${manifest.npmPackage}" is set but npmVersion is missing \u2014 every connector manifest must pin an exact tested version`;
+  }
+  if (!isExactSemver(manifest.npmVersion)) {
+    return `npmVersion ${JSON.stringify(manifest.npmVersion)} for "${manifest.npmPackage}" is not an exact semver (e.g. "1.2.3") \u2014 ranges, dist-tags like "latest", git specs, URLs, and file paths are not allowed`;
+  }
+  return null;
+}
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
@@ -2629,6 +2643,11 @@ function loadManifests(integrationsDir) {
     const manifestPath = join11(dir, relativePath);
     try {
       const manifest = JSON.parse(readFileSync12(manifestPath, "utf-8"));
+      const pinReason = invalidNpmPinReason(manifest);
+      if (pinReason) {
+        console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${pinReason}`);
+        continue;
+      }
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {
@@ -3960,45 +3979,83 @@ ${lines.join("\n")}`
   };
 }
 
-// src/index.ts
-function jsonSchemaToZodShape(schema) {
-  const properties = schema.properties ?? {};
-  const required = new Set(schema.required ?? []);
-  const shape = {};
-  for (const [key, prop] of Object.entries(properties)) {
-    let zodType;
-    switch (prop.type) {
-      case "string":
-        if (prop.enum && Array.isArray(prop.enum)) {
-          zodType = z.enum(prop.enum);
-        } else {
-          zodType = z.string();
-        }
-        break;
-      case "number":
-      case "integer":
-        zodType = z.number();
-        break;
-      case "boolean":
-        zodType = z.boolean();
-        break;
-      case "array":
-        zodType = z.array(z.unknown());
-        break;
-      case "object":
-        zodType = z.record(z.unknown());
-        break;
-      default:
-        zodType = z.unknown();
+// src/lib/json-schema-to-zod.ts
+import { z } from "zod";
+var MAX_DEPTH = 8;
+function convert(schema, depth) {
+  if (!schema || typeof schema !== "object" || depth > MAX_DEPTH) return z.unknown();
+  const s = schema;
+  if ("$ref" in s) return withDescription(z.unknown(), s);
+  let t;
+  const type = Array.isArray(s.type) ? void 0 : s.type;
+  switch (type) {
+    case "string": {
+      if (Array.isArray(s.enum) && s.enum.length > 0 && s.enum.every((v) => typeof v === "string")) {
+        t = z.enum(s.enum);
         break;
+      }
+      let str = z.string();
+      if (typeof s.minLength === "number") str = str.min(s.minLength);
+      if (typeof s.maxLength === "number") str = str.max(s.maxLength);
+      if (typeof s.pattern === "string") {
+        try {
+          str = str.regex(new RegExp(s.pattern));
+        } catch {
+        }
+      }
+      t = str;
+      break;
     }
-    if (typeof prop.description === "string") {
-      zodType = zodType.describe(prop.description);
+    case "number":
+    case "integer": {
+      let num = z.number();
+      if (type === "integer") num = num.int();
+      if (typeof s.minimum === "number") num = num.min(s.minimum);
+      if (typeof s.maximum === "number") num = num.max(s.maximum);
+      t = num;
+      break;
+    }
+    case "boolean":
+      t = z.boolean();
+      break;
+    case "array": {
+      let arr = z.array(s.items ? convert(s.items, depth + 1) : z.unknown());
+      if (typeof s.minItems === "number") arr = arr.min(s.minItems);
+      if (typeof s.maxItems === "number") arr = arr.max(s.maxItems);
+      t = arr;
+      break;
+    }
+    case "object": {
+      if (s.properties && typeof s.properties === "object") {
+        t = z.object(shapeOf(s, depth + 1)).passthrough();
+      } else {
+        t = z.record(z.unknown());
+      }
+      break;
     }
-    shape[key] = required.has(key) ? zodType : zodType.optional();
+    default:
+      t = z.unknown();
+  }
+  return withDescription(t, s);
+}
+function withDescription(t, s) {
+  return typeof s.description === "string" ? t.describe(s.description) : t;
+}
+function shapeOf(schema, depth) {
+  const properties = schema.properties ?? {};
+  const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+  const shape = {};
+  for (const [key, prop] of Object.entries(properties)) {
+    const t = convert(prop, depth);
+    shape[key] = required.has(key) ? t : t.optional();
   }
   return shape;
 }
+function jsonSchemaToZodShape(schema) {
+  return shapeOf(schema ?? {}, 1);
+}
+
+// src/index.ts
 function createMcpServer(state2, integrationManager2) {
   const { cache } = state2;
   const enriched = state2.getEnrichedAuthorizations();
@@ -4016,7 +4073,7 @@ function createMcpServer(state2, integrationManager2) {
     {
       description: 'List what you are currently authorized to do. Call with no arguments for a compact overview, or with a domain (e.g., "charge") for full details including consumption, bounds, and capability map.',
       inputSchema: {
-        domain: z.string().optional().describe('Profile domain to show full details for (e.g., "charge", "deploy"). Omit for compact overview.')
+        domain: z2.string().optional().describe('Profile domain to show full details for (e.g., "charge", "deploy"). Omit for compact overview.')
       }
     },
     listAuthorizationsHandler(state2, integrationManager2)
@@ -4026,7 +4083,7 @@ function createMcpServer(state2, integrationManager2) {
     {
       description: "Check if any attestations are waiting for your owner's approval.",
       inputSchema: {
-        domain: z.string().describe(`The owner's domain (e.g., "compliance")`)
+        domain: z2.string().describe(`The owner's domain (e.g., "compliance")`)
       }
     },
     checkPendingHandler(cache)
@@ -4044,7 +4101,7 @@ function createMcpServer(state2, integrationManager2) {
     {
       description: "Check status of pending proposals awaiting domain owner commitment. Call with a proposal_id to check a specific proposal, or without to see all.",
       inputSchema: {
-        proposal_id: z.string().optional().describe("Specific proposal ID to check. Omit to see all.")
+        proposal_id: z2.string().optional().describe("Specific proposal ID to check. Omit to see all.")
       }
     },
     checkPendingCommitmentsHandler(state2, integrationManager2)
@@ -4345,6 +4402,17 @@ var IntegrationManager = class {
   }
   running = /* @__PURE__ */ new Map();
   onToolsChanged = null;
+  /**
+   * Called when a persisted config was migrated to the manifest's command/args
+   * (see `migrateNpxConfig`) so the caller can write the fix back to
+   * `integrations.json` — the manager itself has no registry/persistence
+   * handle, by design (mirrors `onToolsChanged`). Without a subscriber the
+   * migration still takes effect for THIS start (the in-memory config is
+   * still corrected before spawn); only the one-time persistence is skipped,
+   * so every later start keeps re-migrating in memory, which is safe, if
+   * redundant.
+   */
+  onConfigMigrated = null;
   /**
    * Per-integration operation queue. Start/stop for one id are serialized
    * through here; without it, a second start issued while the first is still
@@ -4370,6 +4438,16 @@ var IntegrationManager = class {
   setOnToolsChanged(cb) {
     this.onToolsChanged = cb;
   }
+  /**
+   * Register a callback invoked when a persisted config is migrated off a
+   * stale `npx` command to the current manifest's command/args (see
+   * `migrateNpxConfig`). The caller is expected to persist `updates` against
+   * `id` in `integrations.json` so the fix survives the next boot instead of
+   * silently reapplying on every start.
+   */
+  setOnConfigMigrated(cb) {
+    this.onConfigMigrated = cb;
+  }
   /**
    * Is `npmPackage` present AND usable?
    *
@@ -4400,6 +4478,23 @@ var IntegrationManager = class {
       return false;
     }
   }
+  /**
+   * The installed version of `npmPackage`, or null if it isn't usably
+   * installed at all (see `isUsableInstall`) or its package.json has no
+   * parseable `version`. Never throws — an unreadable version is treated the
+   * same as "not installed", which is the safe direction: it drives a
+   * (re)install rather than a false "already pinned".
+   */
+  readInstalledVersion(npmPackage) {
+    if (!this.isUsableInstall(npmPackage)) return null;
+    const pkgJson = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
+    try {
+      const pkg = JSON.parse(readFileSync14(pkgJson, "utf8"));
+      return typeof pkg.version === "string" ? pkg.version : null;
+    } catch {
+      return null;
+    }
+  }
   /**
    * Does the node_modules/.bin shim for `binName` exist? On Windows npm writes
    * `<name>`, `<name>.cmd`, and `<name>.ps1`; the .cmd variant is what actually
@@ -4410,9 +4505,32 @@ var IntegrationManager = class {
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
     return candidates.some((c) => existsSync13(join13(INTEGRATIONS_BIN, c)));
   }
+  /**
+   * The exact version THIS gateway's CURRENTLY LOADED manifest pins
+   * `config.npmPackage` to — or undefined when there's no npmPackage, no
+   * manifest for this id, or the manifest's `npmPackage` no longer names the
+   * same package as `config` (a manually re-pointed integration: nothing in
+   * the manifest vouches for a version of config's actual package).
+   *
+   * Read fresh from `getManifest(config.id)` on every call, never from
+   * anything persisted on `config` itself — manifests are reloaded fresh on
+   * every boot, `integrations.json` is not, so this is what keeps the pin
+   * from going stale the day after an integration was first activated. Used
+   * both to decide the npm install/update (`ensureInstalled`) and to decide
+   * whether a persisted `npx …` command must be refused/migrated
+   * (`migrateNpxConfig`) — one definition of "pinned", so the two can't
+   * disagree about which connectors it applies to.
+   */
+  pinnedVersionFor(config) {
+    if (!config.npmPackage) return void 0;
+    const manifest = getManifest(config.id);
+    return manifest?.npmPackage === config.npmPackage ? manifest.npmVersion : void 0;
+  }
   /**
    * Install an npm package into the managed integrations directory if not
-   * already present. Called automatically before spawning when
+   * already present, and — when `config`'s manifest pins an exact
+   * `npmVersion` for this same package — bring the installed copy to EXACTLY
+   * that version, older or newer. Called automatically before spawning when
    * config.npmPackage is set.
    *
    * Asynchronous ON PURPOSE. This used to be execSync, which blocked the MCP
@@ -4422,19 +4540,49 @@ var IntegrationManager = class {
    * CI runners: ~3.6s (Linux), ~5.4s (macOS), ~14s (Windows), and far worse
    * on machines with real-time antivirus.
    */
-  async ensureInstalled(npmPackage) {
+  async ensureInstalled(config) {
+    const npmPackage = config.npmPackage;
+    if (!npmPackage) return;
     ensureIntegrationsDir();
+    const pinnedVersion = this.pinnedVersionFor(config);
+    if (pinnedVersion) {
+      if (this.readInstalledVersion(npmPackage) === pinnedVersion) return;
+      return withInstallLock(async () => {
+        const current = this.readInstalledVersion(npmPackage);
+        if (current === pinnedVersion) return;
+        console.error(
+          `[IntegrationManager] ${npmPackage} ${current ?? "(not installed)"} \u2192 ${pinnedVersion} (pinned by manifest)`
+        );
+        const cleanFirst = !this.isUsableInstall(npmPackage);
+        await this.installNow(npmPackage, pinnedVersion, cleanFirst);
+      });
+    }
     if (this.isUsableInstall(npmPackage)) return;
     return withInstallLock(async () => {
       if (this.isUsableInstall(npmPackage)) return;
       await this.installNow(npmPackage);
     });
   }
-  /** The actual install. Callers MUST hold the install lock. */
-  async installNow(npmPackage) {
+  /**
+   * The actual install. Callers MUST hold the install lock.
+   *
+   * `exactVersion`, when given, is a pin already validated as an exact semver
+   * by the manifest loader (`isExactSemver`) — re-validated here anyway
+   * because this method does not trust its caller's caller, and because the
+   * version reaches a shell on Windows (see the package-name check below).
+   *
+   * `cleanFirst` (default true, i.e. today's behaviour for every caller
+   * except a version-only pin correction): wipe any existing package
+   * directory before installing. Needed for a genuinely broken/partial
+   * install, where stale files can make the reinstall itself fail; skipped
+   * for a USABLE install being corrected to a different pinned version, so a
+   * failed update leaves the previously-working version on disk instead of
+   * nothing at all.
+   */
+  async installNow(npmPackage, exactVersion, cleanFirst = true) {
     const pkgDir = join13(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync13(pkgDir)) {
-      console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
+    if (cleanFirst && existsSync13(pkgDir)) {
+      console.error(`[IntegrationManager] Removing ${exactVersion ? "outdated" : "unusable"} install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
       } catch (err) {
@@ -4444,18 +4592,22 @@ var IntegrationManager = class {
     if (!/^(@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*$/i.test(npmPackage)) {
       throw new Error(`Refusing to install unsafe package name: ${JSON.stringify(npmPackage)}`);
     }
-    console.error(`[IntegrationManager] Installing ${npmPackage}...`);
+    if (exactVersion !== void 0 && !isExactSemver(exactVersion)) {
+      throw new Error(`Refusing to install ${npmPackage} at unsafe/non-exact version spec: ${JSON.stringify(exactVersion)}`);
+    }
+    const spec = exactVersion ? `${npmPackage}@${exactVersion}` : npmPackage;
+    console.error(`[IntegrationManager] Installing ${spec}...`);
     const startedAt = Date.now();
     const isWin = process.platform === "win32";
     await new Promise((resolve3, reject) => {
       const child = execFile(
         "npm",
-        ["install", "--no-fund", "--no-audit", npmPackage],
+        ["install", "--no-fund", "--no-audit", spec],
         {
           cwd: INTEGRATIONS_DIR,
           // Windows: a shell so cmd.exe finds npm.cmd (see EINVAL note above).
           // POSIX: no shell — npm is a normal executable and keeping shell off
-          // means the validated package name is still passed as a bare argv.
+          // means the validated package spec is still passed as a bare argv.
           shell: isWin,
           // No timeout: a slow install on a machine with antivirus is not an
           // error, and killing it midway is what created broken installs in
@@ -4465,20 +4617,28 @@ var IntegrationManager = class {
         },
         (err, _stdout, stderr) => {
           if (err) {
-            reject(new Error(`Failed to install ${npmPackage}: ${err.message}${stderr ? ` \u2014 ${stderr.trim()}` : ""}`));
+            reject(new Error(`Failed to install ${spec}: ${err.message}${stderr ? ` \u2014 ${stderr.trim()}` : ""}`));
             return;
           }
           resolve3();
         }
       );
-      child.on("error", (err) => reject(new Error(`Failed to run npm for ${npmPackage}: ${err.message}`)));
+      child.on("error", (err) => reject(new Error(`Failed to run npm for ${spec}: ${err.message}`)));
     });
     if (!this.isUsableInstall(npmPackage)) {
       throw new Error(
-        `Installed ${npmPackage} but it is not usable \u2014 package.json or its bin target is missing. Check ${INTEGRATIONS_DIR} for a partial install.`
+        `Installed ${spec} but it is not usable \u2014 package.json or its bin target is missing. Check ${INTEGRATIONS_DIR} for a partial install.`
       );
     }
-    console.error(`[IntegrationManager] Installed ${npmPackage} (${((Date.now() - startedAt) / 1e3).toFixed(1)}s)`);
+    if (exactVersion !== void 0) {
+      const installed = this.readInstalledVersion(npmPackage);
+      if (installed !== exactVersion) {
+        throw new Error(
+          `Installed ${npmPackage} but got version ${installed ?? "unknown"}, expected the pinned ${exactVersion}.`
+        );
+      }
+    }
+    console.error(`[IntegrationManager] Installed ${spec} (${((Date.now() - startedAt) / 1e3).toFixed(1)}s)`);
   }
   /**
    * Connect a client to its transport, but never wait indefinitely. Resolves
@@ -4537,7 +4697,26 @@ var IntegrationManager = class {
       throw new Error(`${config.id}: ${SIMULATION_BLOCK_REASON}`);
     }
     if (config.npmPackage) {
-      await this.ensureInstalled(config.npmPackage);
+      await this.ensureInstalled(config);
+    }
+    const pinnedVersion = this.pinnedVersionFor(config);
+    if (pinnedVersion && config.command === "npx") {
+      const manifest = getManifest(config.id);
+      const migrated = {
+        command: manifest.mcp.command,
+        args: manifest.mcp.args,
+        env: manifest.mcp.env ?? config.env
+      };
+      console.error(
+        `[IntegrationManager] ${config.id}: command migrated to manifest (was npx ${config.args.join(" ")})`
+      );
+      config = { ...config, ...migrated };
+      this.onConfigMigrated?.(config.id, migrated);
+    }
+    if (pinnedVersion && config.command === "npx") {
+      throw new Error(
+        `${config.id}: refusing to spawn a pinned connector ("${config.npmPackage}"@${pinnedVersion}) via npx \u2014 this would ignore the pinned local install and fetch the package fresh on every start. The manifest's mcp.command must name the installed binary, not "npx".`
+      );
     }
     const env = this.resolveEnvKeys(config);
     if (isSimulationMode()) {
@@ -5091,6 +5270,10 @@ function refreshAllSessions() {
 integrationManager.setOnToolsChanged(() => {
   refreshAllSessions();
 });
+integrationManager.setOnConfigMigrated((id, updates) => {
+  integrationRegistry.update(id, updates);
+  console.error(`[Suveren MCP] ${id}: persisted config migrated (${Object.keys(updates).join(", ")})`);
+});
 var app = express();
 app.use(express.json());
 app.use((_req, res, next) => {

package/lib/node-version.d.mts

@@ -0,0 +1,7 @@
+/**
+ * Types for the plain-ESM Node version check (see config.d.mts for why the
+ * .mjs modules ship declarations).
+ */
+
+export declare const MIN_NODE_MAJOR: number;
+export declare function unsupportedNodeReason(version: string): string | null;

package/lib/node-version.mjs

@@ -0,0 +1,28 @@
+/**
+ * Minimum Node.js version for the gateway — checked at start by
+ * bundle/bin/suveren-gateway.js and bundle/server.js.
+ *
+ * The connectors the gateway installs (crm, erp, email, records — all built on
+ * better-sqlite3 13) need Node 22. `engines` in package.json is not enough:
+ * npm only WARNS on a mismatch, and for an unpinned install it silently picks
+ * an older connector that still runs on the old Node. With pinned connector
+ * versions the pinned connector is installed anyway and crashes on its first
+ * database call. Refusing at start, with the reason, is the only visible
+ * failure. Keep MIN_NODE_MAJOR in step with `engines` in package.json.tpl.
+ */
+
+export const MIN_NODE_MAJOR = 22;
+
+/**
+ * Returns null when `version` (e.g. process.versions.node, "22.11.0") is
+ * supported, otherwise a message naming both versions. An unparseable version
+ * is refused — the safe direction.
+ */
+export function unsupportedNodeReason(version) {
+  const major = Number.parseInt(String(version).split('.')[0], 10);
+  if (Number.isInteger(major) && major >= MIN_NODE_MAJOR) return null;
+  return (
+    `Suveren gateway needs Node.js ${MIN_NODE_MAJOR} or newer — this is Node.js ${version}. ` +
+    `Install a current Node.js (https://nodejs.org) and start the gateway again.`
+  );
+}

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/client/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,mBAAmB,EAEnB,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,0BAA0B,EAC1B,8BAA8B,EAE9B,2BAA2B,EAE9B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAKH,UAAU,EAGb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,QAAQ,CAAC,EAAE,2BAA2B,KACrC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,IAAI,cAAc,IAAI,mBAAmB,CAAC;IAE1C;;OAEG;IACH,KAAK,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC;;;;;;;;OAQG;IACH,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;IAEhH;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,CAAC,iBAAiB,EAAE,2BAA2B,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F;;;OAGG;IACH,MAAM,IAAI,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE;;;OAGG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAElD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAE3F;;;;OAIG;IACH,qBAAqB,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAEzG;;;;;;;;;OASG;IACH,kBAAkB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;CACjG;AAED;;;;;;GAMG;AAIH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IACxD,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,CAAC;AAEnD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC5B,OAAO,CAAC,EAAE,MAAM;CAG/B;AAED,KAAK,gBAAgB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;AAS9E;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAqCnI;AAoED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CActF;AA2CD;;;;;GAKG;AACH,wBAAsB,IAAI,CACtB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE;IACL,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAwOD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAQlD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACnC,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,QAAQ,EAAE,mBAAmB,EAC7B,gBAAgB,CAAC,EAAE,8BAA8B,GAClD,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAmB1B;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,QAAQ,GAAG;IAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BzH;AA0BD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,GAAG,SAAS,CAsBzE;AAED;;;;;GAKG;AACH,wBAAsB,sCAAsC,CACxD,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EACvE,OAAO,GAAE,SAAiB,GAC3B,OAAO,CAAC,8BAA8B,CAAC,CAgBzC;AAwFD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACvC,MAAM,EAAE,MAAM,GAAG,GAAG,EACpB,EACI,sBAAsB,EACtB,eAAe,EAClB,GAAE;IACC,sBAAsB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;CACvB,EACN,OAAO,GAAE,SAAiB,GAC3B,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CA4BpC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,sBAAsB,EAAE,MAAM,GAAG,GAAG,GAAG;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,EAAE,CAgD/G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mCAAmC,CACrD,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,OAAe,EACf,eAAyC,EAC5C,GAAE;IACC,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CACvB,GACP,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAyClD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;IAE1D;;;OAGG;IACH,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CACzC,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,IAAI,CAAC,EAAE;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,eAAe,CAAC,CA8B1B;AAMD;;GAEG;AACH,wBAAsB,kBAAkB,CACpC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,EACL,KAAK,EACL,QAAQ,EACX,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;CAC3B,GACF,OAAO,CAAC;IAAE,gBAAgB,EAAE,GAAG,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAkD1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC3C,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAAG,GAAG,GAC1B,eAAe,CAOjB;AAwDD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACvC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,uBAAuB,EACvB,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACtC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,uBAAuB,EACvB,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,UAAU,CAC5B,QAAQ,EAAE,mBAAmB,EAC7B,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,OAAO,EACV,GAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,SAAS,CAAC;CAClB,GACP,OAAO,CAAC,WAAW,CAAC,CA2CtB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAChC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,cAAc,EACd,KAAK,EACL,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,cAAc,EAAE,mBAAmB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,0BAA0B,CAAC,CA6BrC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/client/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,mBAAmB,EAEnB,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,0BAA0B,EAC1B,8BAA8B,EAE9B,2BAA2B,EAE9B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAKH,UAAU,EAGb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAyC,MAAM,wBAAwB,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,QAAQ,CAAC,EAAE,2BAA2B,KACrC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,IAAI,cAAc,IAAI,mBAAmB,CAAC;IAE1C;;OAEG;IACH,KAAK,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC;;;;;;;;OAQG;IACH,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;IAEhH;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,CAAC,iBAAiB,EAAE,2BAA2B,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F;;;OAGG;IACH,MAAM,IAAI,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE;;;OAGG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAElD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAE3F;;;;OAIG;IACH,qBAAqB,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAEzG;;;;;;;;;OASG;IACH,kBAAkB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;CACjG;AAED;;;;;;GAMG;AAIH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IACxD,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,CAAC;AAEnD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC5B,OAAO,CAAC,EAAE,MAAM;CAG/B;AAED,KAAK,gBAAgB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;AAS9E;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAqCnI;AAoED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAetF;AA2CD;;;;;GAKG;AACH,wBAAsB,IAAI,CACtB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE;IACL,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAwOD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAQlD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACnC,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,QAAQ,EAAE,mBAAmB,EAC7B,gBAAgB,CAAC,EAAE,8BAA8B,GAClD,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAmB1B;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,QAAQ,GAAG;IAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BzH;AA0BD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,GAAG,SAAS,CAsBzE;AAED;;;;;GAKG;AACH,wBAAsB,sCAAsC,CACxD,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EACvE,OAAO,GAAE,SAAiB,GAC3B,OAAO,CAAC,8BAA8B,CAAC,CAgBzC;AAwFD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACvC,MAAM,EAAE,MAAM,GAAG,GAAG,EACpB,EACI,sBAAsB,EACtB,eAAe,EAClB,GAAE;IACC,sBAAsB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;CACvB,EACN,OAAO,GAAE,SAAiB,GAC3B,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CA4BpC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,sBAAsB,EAAE,MAAM,GAAG,GAAG,GAAG;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,EAAE,CAgD/G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mCAAmC,CACrD,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,OAAe,EACf,eAAyC,EAC5C,GAAE;IACC,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CACvB,GACP,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAyClD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;IAE1D;;;OAGG;IACH,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CACzC,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,IAAI,CAAC,EAAE;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,eAAe,CAAC,CA8B1B;AAMD;;GAEG;AACH,wBAAsB,kBAAkB,CACpC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,EACL,KAAK,EACL,QAAQ,EACX,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;CAC3B,GACF,OAAO,CAAC;IAAE,gBAAgB,EAAE,GAAG,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAkD1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC3C,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAAG,GAAG,GAC1B,eAAe,CAOjB;AAwDD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACvC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,uBAAuB,EACvB,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACtC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,uBAAuB,EACvB,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,UAAU,CAC5B,QAAQ,EAAE,mBAAmB,EAC7B,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,OAAO,EACV,GAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,SAAS,CAAC;CAClB,GACP,OAAO,CAAC,WAAW,CAAC,CA2CtB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAChC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,cAAc,EACd,KAAK,EACL,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,cAAc,EAAE,mBAAmB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,0BAA0B,CAAC,CA6BrC"}

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth.js

@@ -28,6 +28,7 @@ const auth_js_1 = require("../shared/auth.js");
 const auth_js_2 = require("../shared/auth.js");
 const auth_utils_js_1 = require("../shared/auth-utils.js");
 const errors_js_1 = require("../server/auth/errors.js");
+const transport_js_1 = require("../shared/transport.js");
 class UnauthorizedError extends Error {
     constructor(message) {
         super(message ?? 'Unauthorized');
@@ -158,7 +159,8 @@ async function parseErrorResponse(input) {
     }
     catch (error) {
         // Not a valid OAuth error response, but try to inform the user of the raw data anyway
-        const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ''}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+        const redirect = input instanceof Response ? (0, transport_js_1.unfollowedRedirect)(input, input.url) : undefined;
+        const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ''}${redirect ?? `Invalid OAuth error response: ${error}. Raw body: ${body}`}`;
         return new errors_js_1.ServerError(errorMessage);
     }
 }
@@ -555,7 +557,7 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
  */
 async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
     try {
-        return await fetchFn(url, { headers });
+        return await (0, transport_js_1.fetchWithinOrigin)(fetchFn)(url, { headers });
     }
     catch (error) {
         if (error instanceof TypeError) {
@@ -594,7 +596,7 @@ async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
  * Determines if fallback to root discovery should be attempted
  */
 function shouldAttemptFallback(response, pathname) {
-    return !response || (response.status >= 400 && response.status < 500 && pathname !== '/');
+    return !response || (!response.ok && response.status < 500 && pathname !== '/');
 }
 /**
  * Generic function for discovering OAuth metadata with fallback support
@@ -735,8 +737,8 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
         }
         if (!response.ok) {
             await response.body?.cancel();
-            // Continue looking for any 4xx response code.
-            if (response.status >= 400 && response.status < 500) {
+            // Continue looking for any 4xx response code, or a redirect that was not followed.
+            if (response.status < 500) {
                 continue; // Try next URL
             }
             throw new Error(`HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`);
@@ -882,7 +884,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
         const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
         applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
     }
-    const response = await (fetchFn ?? fetch)(tokenUrl, {
+    const response = await (0, transport_js_1.fetchWithinOrigin)(fetchFn ?? fetch)(tokenUrl, {
         method: 'POST',
         headers,
         body: tokenRequestParams
@@ -1026,7 +1028,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     else {
         registrationUrl = new URL('/register', authorizationServerUrl);
     }
-    const response = await (fetchFn ?? fetch)(registrationUrl, {
+    const response = await (0, transport_js_1.fetchWithinOrigin)(fetchFn ?? fetch)(registrationUrl, {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json'