@tianshu-ai/tianshu 0.86.2 → 0.87.0

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth-extensions.d.ts

@@ -42,6 +42,15 @@ export interface ClientCredentialsProviderOptions {
      * Space-separated scopes values requested by the client.
      */
     scope?: string;
+    /**
+     * The issuer URL of the authorization server these credentials were registered with.
+     * When set, `auth()` only presents them to that authorization server and throws if the
+     * MCP server advertises a different URL (one trailing slash aside).
+     *
+     * Omitting it is deprecated: the credentials then go to whichever authorization server
+     * the MCP server advertises first.
+     */
+    expectedIssuer?: string;
 }
 /**
  * OAuth provider for client_credentials grant with client_secret_basic authentication.
@@ -52,7 +61,8 @@ export interface ClientCredentialsProviderOptions {
  * @example
  * const provider = new ClientCredentialsProvider({
  *   clientId: 'my-client',
- *   clientSecret: 'my-secret'
+ *   clientSecret: 'my-secret',
+ *   expectedIssuer: 'https://auth.example.com'
  * });
  *
  * const transport = new StreamableHTTPClientTransport(serverUrl, {
@@ -63,6 +73,10 @@ export declare class ClientCredentialsProvider implements OAuthClientProvider {
     private _tokens?;
     private _clientInfo;
     private _clientMetadata;
+    constructor(options: ClientCredentialsProviderOptions & {
+        expectedIssuer: string;
+    });
+    /** @deprecated Pass `expectedIssuer` so the credentials are only sent to that authorization server. */
     constructor(options: ClientCredentialsProviderOptions);
     get redirectUrl(): undefined;
     get clientMetadata(): OAuthClientMetadata;
@@ -104,6 +118,15 @@ export interface PrivateKeyJwtProviderOptions {
      * Space-separated scopes values requested by the client.
      */
     scope?: string;
+    /**
+     * The issuer URL of the authorization server these credentials were registered with.
+     * When set, `auth()` only presents them to that authorization server and throws if the
+     * MCP server advertises a different URL (one trailing slash aside).
+     *
+     * Omitting it is deprecated: the credentials then go to whichever authorization server
+     * the MCP server advertises first.
+     */
+    expectedIssuer?: string;
 }
 /**
  * OAuth provider for client_credentials grant with private_key_jwt authentication.
@@ -115,7 +138,8 @@ export interface PrivateKeyJwtProviderOptions {
  * const provider = new PrivateKeyJwtProvider({
  *   clientId: 'my-client',
  *   privateKey: pemEncodedPrivateKey,
- *   algorithm: 'RS256'
+ *   algorithm: 'RS256',
+ *   expectedIssuer: 'https://auth.example.com'
  * });
  *
  * const transport = new StreamableHTTPClientTransport(serverUrl, {
@@ -127,6 +151,10 @@ export declare class PrivateKeyJwtProvider implements OAuthClientProvider {
     private _clientInfo;
     private _clientMetadata;
     addClientAuthentication: AddClientAuthentication;
+    constructor(options: PrivateKeyJwtProviderOptions & {
+        expectedIssuer: string;
+    });
+    /** @deprecated Pass `expectedIssuer` so the credentials are only sent to that authorization server. */
     constructor(options: PrivateKeyJwtProviderOptions);
     get redirectUrl(): undefined;
     get clientMetadata(): OAuthClientMetadata;
@@ -162,6 +190,15 @@ export interface StaticPrivateKeyJwtProviderOptions {
      * Space-separated scopes values requested by the client.
      */
     scope?: string;
+    /**
+     * The issuer URL of the authorization server these credentials were registered with.
+     * When set, `auth()` only presents them to that authorization server and throws if the
+     * MCP server advertises a different URL (one trailing slash aside).
+     *
+     * Omitting it is deprecated: the credentials then go to whichever authorization server
+     * the MCP server advertises first.
+     */
+    expectedIssuer?: string;
 }
 /**
  * OAuth provider for client_credentials grant with a static private_key_jwt assertion.
@@ -175,6 +212,10 @@ export declare class StaticPrivateKeyJwtProvider implements OAuthClientProvider
     private _clientInfo;
     private _clientMetadata;
     addClientAuthentication: AddClientAuthentication;
+    constructor(options: StaticPrivateKeyJwtProviderOptions & {
+        expectedIssuer: string;
+    });
+    /** @deprecated Pass `expectedIssuer` so the credentials are only sent to that authorization server. */
     constructor(options: StaticPrivateKeyJwtProviderOptions);
     get redirectUrl(): undefined;
     get clientMetadata(): OAuthClientMetadata;

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth-extensions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-extensions.d.ts","sourceRoot":"","sources":["../../../src/client/auth-extensions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GAAG,uBAAuB,CAgE1B;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC7C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;gBAEjC,OAAO,EAAE,gCAAgC;IAcrD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IACzC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE1D;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,qBAAsB,YAAW,mBAAmB;IAC7D,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;IAC7C,uBAAuB,EAAE,uBAAuB,CAAC;gBAErC,OAAO,EAAE,4BAA4B;IAoBjD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD;AAED;;GAEG;AACH,MAAM,WAAW,kCAAkC;IAC/C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;IAC7C,uBAAuB,EAAE,uBAAuB,CAAC;gBAErC,OAAO,EAAE,kCAAkC;IAmBvD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD"}
+{"version":3,"file":"auth-extensions.d.ts","sourceRoot":"","sources":["../../../src/client/auth-extensions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GAAG,uBAAuB,CAgE1B;AAoBD;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC7C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;gBAEjC,OAAO,EAAE,gCAAgC,GAAG;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE;IAClF,uGAAuG;gBAC3F,OAAO,EAAE,gCAAgC;IAgBrD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IACzC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE1D;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,qBAAsB,YAAW,mBAAmB;IAC7D,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;IAC7C,uBAAuB,EAAE,uBAAuB,CAAC;gBAErC,OAAO,EAAE,4BAA4B,GAAG;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE;IAC9E,uGAAuG;gBAC3F,OAAO,EAAE,4BAA4B;IAsBjD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD;AAED;;GAEG;AACH,MAAM,WAAW,kCAAkC;IAC/C;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAAsB;IAC7C,uBAAuB,EAAE,uBAAuB,CAAC;gBAErC,OAAO,EAAE,kCAAkC,GAAG;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE;IACpF,uGAAuG;gBAC3F,OAAO,EAAE,kCAAkC;IAqBvD,IAAI,WAAW,IAAI,SAAS,CAE3B;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,iBAAiB,IAAI,sBAAsB;IAI3C,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI;IAIzD,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIrC,uBAAuB,IAAI,IAAI;IAI/B,gBAAgB,IAAI,IAAI;IAIxB,YAAY,IAAI,MAAM;IAItB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe;CAKvD"}

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth-extensions.js

@@ -99,6 +99,22 @@ function createPrivateKeyJwtAuth(options) {
         params.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
     };
 }
+/**
+ * The `issuer` stamp for constructor-supplied client information. Omitting `expectedIssuer` is
+ * deprecated: nothing else says which authorization server such credentials belong to.
+ */
+function checkedExpectedIssuer(expectedIssuer) {
+    if (expectedIssuer === undefined) {
+        // eslint-disable-next-line no-console
+        console.warn('[mcp-sdk] Omitting `expectedIssuer` is deprecated. Without it, the MCP server decides which authorization ' +
+            "server receives this client's credentials; pass your authorization server's issuer URL as " +
+            '`expectedIssuer` so they are only sent there.');
+    }
+    else if (typeof expectedIssuer !== 'string' || !expectedIssuer) {
+        throw new Error("expectedIssuer must be the authorization server's issuer URL");
+    }
+    return expectedIssuer;
+}
 /**
  * OAuth provider for client_credentials grant with client_secret_basic authentication.
  *
@@ -108,7 +124,8 @@ function createPrivateKeyJwtAuth(options) {
  * @example
  * const provider = new ClientCredentialsProvider({
  *   clientId: 'my-client',
- *   clientSecret: 'my-secret'
+ *   clientSecret: 'my-secret',
+ *   expectedIssuer: 'https://auth.example.com'
  * });
  *
  * const transport = new StreamableHTTPClientTransport(serverUrl, {
@@ -119,7 +136,8 @@ class ClientCredentialsProvider {
     constructor(options) {
         this._clientInfo = {
             client_id: options.clientId,
-            client_secret: options.clientSecret
+            client_secret: options.clientSecret,
+            issuer: checkedExpectedIssuer(options.expectedIssuer)
         };
         this._clientMetadata = {
             client_name: options.clientName ?? 'client-credentials-client',
@@ -174,7 +192,8 @@ exports.ClientCredentialsProvider = ClientCredentialsProvider;
  * const provider = new PrivateKeyJwtProvider({
  *   clientId: 'my-client',
  *   privateKey: pemEncodedPrivateKey,
- *   algorithm: 'RS256'
+ *   algorithm: 'RS256',
+ *   expectedIssuer: 'https://auth.example.com'
  * });
  *
  * const transport = new StreamableHTTPClientTransport(serverUrl, {
@@ -184,7 +203,8 @@ exports.ClientCredentialsProvider = ClientCredentialsProvider;
 class PrivateKeyJwtProvider {
     constructor(options) {
         this._clientInfo = {
-            client_id: options.clientId
+            client_id: options.clientId,
+            issuer: checkedExpectedIssuer(options.expectedIssuer)
         };
         this._clientMetadata = {
             client_name: options.clientName ?? 'private-key-jwt-client',
@@ -246,7 +266,8 @@ exports.PrivateKeyJwtProvider = PrivateKeyJwtProvider;
 class StaticPrivateKeyJwtProvider {
     constructor(options) {
         this._clientInfo = {
-            client_id: options.clientId
+            client_id: options.clientId,
+            issuer: checkedExpectedIssuer(options.expectedIssuer)
         };
         this._clientMetadata = {
             client_name: options.clientName ?? 'static-private-key-jwt-client',

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth-extensions.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-extensions.js","sourceRoot":"","sources":["../../../src/client/auth-extensions.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;AAaH,0DAwEC;AA/ED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,OAQvC;IACG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;QAC7C,oDAAoD;QACpD,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CACf,qNAAqN,CACxN,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,wDAAa,MAAM,GAAC,CAAC;QAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC;QAEvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,MAAM,UAAU,GAAG;YACf,GAAG,EAAE,OAAO,CAAC,MAAM;YACnB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,GAAG,GAAG,eAAe;YAC1B,GAAG,EAAE,GAAG;YACR,GAAG;SACN,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAElF,yCAAyC;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,GAAY,CAAC;QACjB,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,YAAY,UAAU,EAAE,CAAC;YAClD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACJ,4DAA4D;gBAC5D,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;YACpF,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,eAAe;YACf,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAiB,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,WAAW;QACX,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;aAC3C,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aACvC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;aACzB,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;aAC3B,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,eAAe,CAAC;aACxC,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,GAAwC,CAAC,CAAC;QAEpD,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;IAClG,CAAC,CAAC;AACN,CAAC;AA2BD;;;;;;;;;;;;;;;GAeG;AACH,MAAa,yBAAyB;IAKlC,YAAY,OAAyC;QACjD,IAAI,CAAC,WAAW,GAAG;YACf,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;SACtC,CAAC;QACF,IAAI,CAAC,eAAe,GAAG;YACnB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,2BAA2B;YAC9D,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,0BAA0B,EAAE,qBAAqB;YACjD,KAAK,EAAE,OAAO,CAAC,KAAK;SACvB,CAAC;IACN,CAAC;IAED,IAAI,WAAW;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED,iBAAiB;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,qBAAqB,CAAC,IAA4B;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,MAAmB;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,uBAAuB;QACnB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;IAED,gBAAgB;QACZ,kCAAkC;IACtC,CAAC;IAED,YAAY;QACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC5E,CAAC;IAED,mBAAmB,CAAC,KAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AA5DD,8DA4DC;AAsCD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,qBAAqB;IAM9B,YAAY,OAAqC;QAC7C,IAAI,CAAC,WAAW,GAAG;YACf,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC9B,CAAC;QACF,IAAI,CAAC,eAAe,GAAG;YACnB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,wBAAwB;YAC3D,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,0BAA0B,EAAE,iBAAiB;YAC7C,KAAK,EAAE,OAAO,CAAC,KAAK;SACvB,CAAC;QACF,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;YACnD,MAAM,EAAE,OAAO,CAAC,QAAQ;YACxB,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,EAAE,OAAO,CAAC,SAAS;YACtB,eAAe,EAAE,OAAO,CAAC,kBAAkB;SAC9C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,WAAW;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED,iBAAiB;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,qBAAqB,CAAC,IAA4B;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,MAAmB;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,uBAAuB;QACnB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;IAED,gBAAgB;QACZ,kCAAkC;IACtC,CAAC;IAED,YAAY;QACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC5E,CAAC;IAED,mBAAmB,CAAC,KAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAnED,sDAmEC;AA8BD;;;;;;GAMG;AACH,MAAa,2BAA2B;IAMpC,YAAY,OAA2C;QACnD,IAAI,CAAC,WAAW,GAAG;YACf,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC9B,CAAC;QACF,IAAI,CAAC,eAAe,GAAG;YACnB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,+BAA+B;YAClE,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,0BAA0B,EAAE,iBAAiB;YAC7C,KAAK,EAAE,OAAO,CAAC,KAAK;SACvB,CAAC;QAEF,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC7C,IAAI,CAAC,uBAAuB,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;YACtD,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;QAClG,CAAC,CAAC;IACN,CAAC;IAED,IAAI,WAAW;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED,iBAAiB;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,qBAAqB,CAAC,IAA4B;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,MAAmB;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,uBAAuB;QACnB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;IAED,gBAAgB;QACZ,kCAAkC;IACtC,CAAC;IAED,YAAY;QACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC5E,CAAC;IAED,mBAAmB,CAAC,KAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAlED,kEAkEC"}
+{"version":3,"file":"auth-extensions.js","sourceRoot":"","sources":["../../../src/client/auth-extensions.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;AAaH,0DAwEC;AA/ED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,OAQvC;IACG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;QAC7C,oDAAoD;QACpD,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CACf,qNAAqN,CACxN,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,wDAAa,MAAM,GAAC,CAAC;QAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC;QAEvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,MAAM,UAAU,GAAG;YACf,GAAG,EAAE,OAAO,CAAC,MAAM;YACnB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,GAAG,GAAG,eAAe;YAC1B,GAAG,EAAE,GAAG;YACR,GAAG;SACN,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAElF,yCAAyC;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,GAAY,CAAC;QACjB,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,YAAY,UAAU,EAAE,CAAC;YAClD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACJ,4DAA4D;gBAC5D,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;YACpF,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,eAAe;YACf,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAiB,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,WAAW;QACX,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;aAC3C,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aACvC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;aACzB,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;aAC3B,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,eAAe,CAAC;aACxC,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,GAAwC,CAAC,CAAC;QAEpD,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;IAClG,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,cAAkC;IAC7D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC/B,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACR,4GAA4G;YACxG,4FAA4F;YAC5F,+CAA+C,CACtD,CAAC;IACN,CAAC;SAAM,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,cAAc,CAAC;AAC1B,CAAC;AAqCD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,yBAAyB;IAQlC,YAAY,OAAyC;QACjD,IAAI,CAAC,WAAW,GAAG;YACf,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,cAAc,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,eAAe,GAAG;YACnB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,2BAA2B;YAC9D,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,0BAA0B,EAAE,qBAAqB;YACjD,KAAK,EAAE,OAAO,CAAC,KAAK;SACvB,CAAC;IACN,CAAC;IAED,IAAI,WAAW;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED,iBAAiB;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,qBAAqB,CAAC,IAA4B;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,MAAmB;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,uBAAuB;QACnB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;IAED,gBAAgB;QACZ,kCAAkC;IACtC,CAAC;IAED,YAAY;QACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC5E,CAAC;IAED,mBAAmB,CAAC,KAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAhED,8DAgEC;AAgDD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,qBAAqB;IAS9B,YAAY,OAAqC;QAC7C,IAAI,CAAC,WAAW,GAAG;YACf,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,cAAc,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,eAAe,GAAG;YACnB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,wBAAwB;YAC3D,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,0BAA0B,EAAE,iBAAiB;YAC7C,KAAK,EAAE,OAAO,CAAC,KAAK;SACvB,CAAC;QACF,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;YACnD,MAAM,EAAE,OAAO,CAAC,QAAQ;YACxB,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,EAAE,OAAO,CAAC,SAAS;YACtB,eAAe,EAAE,OAAO,CAAC,kBAAkB;SAC9C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,WAAW;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED,iBAAiB;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,qBAAqB,CAAC,IAA4B;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,MAAmB;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,uBAAuB;QACnB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;IAED,gBAAgB;QACZ,kCAAkC;IACtC,CAAC;IAED,YAAY;QACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC5E,CAAC;IAED,mBAAmB,CAAC,KAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAvED,sDAuEC;AAwCD;;;;;;GAMG;AACH,MAAa,2BAA2B;IASpC,YAAY,OAA2C;QACnD,IAAI,CAAC,WAAW,GAAG;YACf,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,cAAc,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,eAAe,GAAG;YACnB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,+BAA+B;YAClE,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,0BAA0B,EAAE,iBAAiB;YAC7C,KAAK,EAAE,OAAO,CAAC,KAAK;SACvB,CAAC;QAEF,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC7C,IAAI,CAAC,uBAAuB,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;YACtD,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;QAClG,CAAC,CAAC;IACN,CAAC;IAED,IAAI,WAAW;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;IAED,iBAAiB;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,qBAAqB,CAAC,IAA4B;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,MAAM;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,MAAmB;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,uBAAuB;QACnB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;IAED,gBAAgB;QACZ,kCAAkC;IACtC,CAAC;IAED,YAAY;QACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC5E,CAAC;IAED,mBAAmB,CAAC,KAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAtED,kEAsEC"}

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth.d.ts

@@ -35,6 +35,10 @@ export interface OAuthClientProvider {
      * Loads information about this OAuth client, as registered already with the
      * server, or returns `undefined` if the client is not registered with the
      * server.
+     *
+     * A provider that returns pre-registered credentials should include `issuer`, the URL of
+     * the authorization server they were registered with; {@linkcode auth} then does not
+     * present them to any other.
      */
     clientInformation(): OAuthClientInformationMixed | undefined | Promise<OAuthClientInformationMixed | undefined>;
     /**
@@ -44,6 +48,10 @@ export interface OAuthClientProvider {
      *
      * This method is not required to be implemented if client information is
      * statically known (e.g., pre-registered).
+     *
+     * The object carries `issuer`, the authorization server it was obtained from. Store it
+     * unchanged so that {@linkcode auth} does not reuse the registration with a different one.
+     * Client information stored without `issuer` is passed here, with it, after its first successful use.
      */
     saveClientInformation?(clientInformation: OAuthClientInformationMixed): void | Promise<void>;
     /**
@@ -54,6 +62,9 @@ export interface OAuthClientProvider {
     /**
      * Stores new OAuth tokens for the current session, after a successful
      * authorization.
+     *
+     * The object carries `issuer`, the authorization server that issued the tokens. Store it
+     * unchanged so that {@linkcode auth} does not present the refresh token to a different one.
      */
     saveTokens(tokens: OAuthTokens): void | Promise<void>;
     /**
@@ -223,6 +234,17 @@ export declare function auth(provider: OAuthClientProvider, options: {
  * Validate that the client_id is a valid URL with https scheme
  */
 export declare function isHttpsUrl(value?: string): boolean;
+/**
+ * Selects the RFC 8707 resource indicator for an MCP server: the provider's
+ * {@linkcode OAuthClientProvider.validateResourceURL | validateResourceURL} result when
+ * implemented, otherwise the protected resource metadata's `resource` (checked against the
+ * server URL with `checkResourceAllowed`), or `undefined` when there is no metadata.
+ *
+ * The result is a parsed `URL`, so a pathless indicator such as `https://example.com` has
+ * the `href` `https://example.com/`. {@linkcode auth} therefore sends the metadata string
+ * verbatim instead of this URL's `href` (#1968); callers that emit the `resource`
+ * parameter themselves should do the same.
+ */
 export declare function selectResourceURL(serverUrl: string | URL, provider: OAuthClientProvider, resourceMetadata?: OAuthProtectedResourceMetadata): Promise<URL | undefined>;
 /**
  * Extract resource_metadata, scope, and error from WWW-Authenticate header.
@@ -342,7 +364,7 @@ export declare function startAuthorization(authorizationServerUrl: string | URL,
     redirectUrl: string | URL;
     scope?: string;
     state?: string;
-    resource?: URL;
+    resource?: string | URL;
 }): Promise<{
     authorizationUrl: URL;
     codeVerifier: string;
@@ -377,7 +399,7 @@ export declare function exchangeAuthorization(authorizationServerUrl: string | U
     authorizationCode: string;
     codeVerifier: string;
     redirectUri: string | URL;
-    resource?: URL;
+    resource?: string | URL;
     addClientAuthentication?: OAuthClientProvider['addClientAuthentication'];
     fetchFn?: FetchLike;
 }): Promise<OAuthTokens>;
@@ -397,7 +419,7 @@ export declare function refreshAuthorization(authorizationServerUrl: string | UR
     metadata?: AuthorizationServerMetadata;
     clientInformation: OAuthClientInformationMixed;
     refreshToken: string;
-    resource?: URL;
+    resource?: string | URL;
     addClientAuthentication?: OAuthClientProvider['addClientAuthentication'];
     fetchFn?: FetchLike;
 }): Promise<OAuthTokens>;
@@ -429,7 +451,7 @@ export declare function refreshAuthorization(authorizationServerUrl: string | UR
  */
 export declare function fetchToken(provider: OAuthClientProvider, authorizationServerUrl: string | URL, { metadata, resource, authorizationCode, fetchFn }?: {
     metadata?: AuthorizationServerMetadata;
-    resource?: URL;
+    resource?: string | URL;
     /** Authorization code for the default authorization_code grant flow */
     authorizationCode?: string;
     fetchFn?: FetchLike;

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/client/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,mBAAmB,EAEnB,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,0BAA0B,EAC1B,8BAA8B,EAE9B,2BAA2B,EAE9B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAKH,UAAU,EAGb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,QAAQ,CAAC,EAAE,2BAA2B,KACrC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,IAAI,cAAc,IAAI,mBAAmB,CAAC;IAE1C;;OAEG;IACH,KAAK,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC;;;;OAIG;IACH,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;IAEhH;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,iBAAiB,EAAE,2BAA2B,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F;;;OAGG;IACH,MAAM,IAAI,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAErE;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE;;;OAGG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAElD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAE3F;;;;OAIG;IACH,qBAAqB,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAEzG;;;;;;;;;OASG;IACH,kBAAkB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;CACjG;AAED;;;;;;GAMG;AAIH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IACxD,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,CAAC;AAEnD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC5B,OAAO,CAAC,EAAE,MAAM;CAG/B;AAED,KAAK,gBAAgB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;AAS9E;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAqCnI;AAoED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CActF;AAED;;;;;GAKG;AACH,wBAAsB,IAAI,CACtB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE;IACL,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAgMD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAQlD;AAED,wBAAsB,iBAAiB,CACnC,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,QAAQ,EAAE,mBAAmB,EAC7B,gBAAgB,CAAC,EAAE,8BAA8B,GAClD,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAmB1B;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,QAAQ,GAAG;IAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BzH;AA0BD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,GAAG,SAAS,CAsBzE;AAED;;;;;GAKG;AACH,wBAAsB,sCAAsC,CACxD,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EACvE,OAAO,GAAE,SAAiB,GAC3B,OAAO,CAAC,8BAA8B,CAAC,CAgBzC;AAwFD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACvC,MAAM,EAAE,MAAM,GAAG,GAAG,EACpB,EACI,sBAAsB,EACtB,eAAe,EAClB,GAAE;IACC,sBAAsB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;CACvB,EACN,OAAO,GAAE,SAAiB,GAC3B,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CA4BpC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,sBAAsB,EAAE,MAAM,GAAG,GAAG,GAAG;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,EAAE,CAgD/G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mCAAmC,CACrD,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,OAAe,EACf,eAAyC,EAC5C,GAAE;IACC,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CACvB,GACP,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAyClD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;IAE1D;;;OAGG;IACH,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CACzC,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,IAAI,CAAC,EAAE;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,eAAe,CAAC,CA8B1B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACpC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,EACL,KAAK,EACL,QAAQ,EACX,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,GAAG,CAAC;CAClB,GACF,OAAO,CAAC;IAAE,gBAAgB,EAAE,GAAG,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAkD1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC3C,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAAG,GAAG,GAC1B,eAAe,CAOjB;AAwDD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACvC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,uBAAuB,EACvB,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACtC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,uBAAuB,EACvB,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,UAAU,CAC5B,QAAQ,EAAE,mBAAmB,EAC7B,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,OAAO,EACV,GAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,SAAS,CAAC;CAClB,GACP,OAAO,CAAC,WAAW,CAAC,CA+BtB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAChC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,cAAc,EACd,KAAK,EACL,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,cAAc,EAAE,mBAAmB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,0BAA0B,CAAC,CA6BrC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/client/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,mBAAmB,EAEnB,2BAA2B,EAC3B,WAAW,EACX,aAAa,EACb,0BAA0B,EAC1B,8BAA8B,EAE9B,2BAA2B,EAE9B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAKH,UAAU,EAGb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAyC,MAAM,wBAAwB,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,QAAQ,CAAC,EAAE,2BAA2B,KACrC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,IAAI,WAAW,IAAI,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,IAAI,cAAc,IAAI,mBAAmB,CAAC;IAE1C;;OAEG;IACH,KAAK,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC;;;;;;;;OAQG;IACH,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;IAEhH;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,CAAC,iBAAiB,EAAE,2BAA2B,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F;;;OAGG;IACH,MAAM,IAAI,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE;;;OAGG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAElD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAE3F;;;;OAIG;IACH,qBAAqB,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAEzG;;;;;;;;;OASG;IACH,kBAAkB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;CACjG;AAED;;;;;;GAMG;AAIH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IACxD,gFAAgF;IAChF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,CAAC;AAEnD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC5B,OAAO,CAAC,EAAE,MAAM;CAG/B;AAED,KAAK,gBAAgB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;AAS9E;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAqCnI;AAoED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAetF;AA2CD;;;;;GAKG;AACH,wBAAsB,IAAI,CACtB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE;IACL,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAwOD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAQlD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACnC,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,QAAQ,EAAE,mBAAmB,EAC7B,gBAAgB,CAAC,EAAE,8BAA8B,GAClD,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAmB1B;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,QAAQ,GAAG;IAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BzH;AA0BD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,GAAG,GAAG,GAAG,SAAS,CAsBzE;AAED;;;;;GAKG;AACH,wBAAsB,sCAAsC,CACxD,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EACvE,OAAO,GAAE,SAAiB,GAC3B,OAAO,CAAC,8BAA8B,CAAC,CAgBzC;AAwFD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACvC,MAAM,EAAE,MAAM,GAAG,GAAG,EACpB,EACI,sBAAsB,EACtB,eAAe,EAClB,GAAE;IACC,sBAAsB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;CACvB,EACN,OAAO,GAAE,SAAiB,GAC3B,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CA4BpC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,sBAAsB,EAAE,MAAM,GAAG,GAAG,GAAG;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,EAAE,CAgD/G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mCAAmC,CACrD,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,OAAe,EACf,eAAyC,EAC5C,GAAE;IACC,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CACvB,GACP,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAyClD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;IAE1D;;;OAGG;IACH,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CACzC,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,IAAI,CAAC,EAAE;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,eAAe,CAAC,CA8B1B;AAMD;;GAEG;AACH,wBAAsB,kBAAkB,CACpC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,EACL,KAAK,EACL,QAAQ,EACX,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;CAC3B,GACF,OAAO,CAAC;IAAE,gBAAgB,EAAE,GAAG,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAkD1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC3C,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAAG,GAAG,GAC1B,eAAe,CAOjB;AAwDD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACvC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,uBAAuB,EACvB,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACtC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,uBAAuB,EACvB,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,UAAU,CAC5B,QAAQ,EAAE,mBAAmB,EAC7B,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,OAAO,EACV,GAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,SAAS,CAAC;CAClB,GACP,OAAO,CAAC,WAAW,CAAC,CA2CtB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAChC,sBAAsB,EAAE,MAAM,GAAG,GAAG,EACpC,EACI,QAAQ,EACR,cAAc,EACd,KAAK,EACL,OAAO,EACV,EAAE;IACC,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,cAAc,EAAE,mBAAmB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,SAAS,CAAC;CACvB,GACF,OAAO,CAAC,0BAA0B,CAAC,CA6BrC"}

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth.js

@@ -28,6 +28,7 @@ const auth_js_1 = require("../shared/auth.js");
 const auth_js_2 = require("../shared/auth.js");
 const auth_utils_js_1 = require("../shared/auth-utils.js");
 const errors_js_1 = require("../server/auth/errors.js");
+const transport_js_1 = require("../shared/transport.js");
 class UnauthorizedError extends Error {
     constructor(message) {
         super(message ?? 'Unauthorized');
@@ -158,10 +159,49 @@ async function parseErrorResponse(input) {
     }
     catch (error) {
         // Not a valid OAuth error response, but try to inform the user of the raw data anyway
-        const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ''}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+        const redirect = input instanceof Response ? (0, transport_js_1.unfollowedRedirect)(input, input.url) : undefined;
+        const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ''}${redirect ?? `Invalid OAuth error response: ${error}. Raw body: ${body}`}`;
         return new errors_js_1.ServerError(errorMessage);
     }
 }
+/**
+ * Compares two authorization server identifiers, tolerating a single trailing `/`
+ * difference (`String(new URL(...))` is slash-suffixed, advertised values often are not).
+ */
+function issuersMatch(a, b) {
+    let [x, y] = [a, b];
+    try {
+        // Two URLs are compared as parsed, so the spelling of scheme, host or default port does not matter.
+        [x, y] = [new URL(a).href, new URL(b).href];
+    }
+    catch {
+        // Not two URLs: compared as written.
+    }
+    return x === y || (x.endsWith('/') && x.slice(0, -1) === y) || (y.endsWith('/') && y.slice(0, -1) === x);
+}
+/**
+ * {@linkcode auth} stamps everything it passes to `saveClientInformation` / `saveTokens` with
+ * `issuer`, the authorization server URL used for discovery. This returns `stored` unless its
+ * stamp names a different authorization server, in which case the caller behaves as if nothing
+ * were stored. A value without a stamp (saved by an earlier version) is returned as-is, and
+ * is stamped once this authorization server has accepted it.
+ */
+function discardIfIssuerMismatch(stored, issuer) {
+    // `null`: a `JSON.parse(storage.getItem(...))`-style getter with nothing stored.
+    if (!stored)
+        return undefined;
+    // A stamp that is not a string (raw storage) counts as no stamp.
+    if (typeof stored.issuer !== 'string')
+        return stored.issuer == null ? stored : { ...stored, issuer: undefined };
+    return issuersMatch(stored.issuer, issuer) ? stored : undefined;
+}
+// `issuer` is added by the client when it stores a value; authorization server responses are parsed without it.
+const TokenResponseSchema = auth_js_2.OAuthTokensSchema.omit({ issuer: true });
+const RegistrationResponseSchema = auth_js_2.OAuthClientInformationFullSchema.omit({ issuer: true });
+function boundElsewhereError(stored, issuer) {
+    return new Error(`OAuth client information is bound to authorization server ${stored.issuer} and is not presented to ${issuer}. ` +
+        'Clear the stored client information, or correct `expectedIssuer`, if the authorization server has moved.');
+}
 /**
  * Orchestrates the full auth flow with a server.
  *
@@ -240,15 +280,45 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
             authorizationServerMetadata: metadata
         });
     }
-    const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+    // Binding key for stored credentials: the authorization server URL that discovery used
+    // (advertised by the resource server, restored from discoveryState(), or the legacy
+    // resource-origin fallback). `metadata.issuer` is deliberately not used: this version does
+    // not check that the metadata document echoes the URL it was fetched from.
+    const issuer = String(authorizationServerUrl);
+    // Send the metadata's resource indicator verbatim: `selectResourceURL` returns a parsed
+    // `URL`, and `URL.href` appends "/" to a pathless indicator such as `https://example.com`,
+    // which exact-match authorization servers reject (#1968). A URL returned by the
+    // provider's own `validateResourceURL` is used as returned.
+    const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+    const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
     // Apply scope selection strategy (SEP-835):
     // 1. WWW-Authenticate scope (passed via `scope` param)
     // 2. PRM scopes_supported
     // 3. Client metadata scope (user-configured fallback)
     // The resolved scope is used consistently for both DCR and the authorization request.
     const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
-    // Handle client registration if needed
-    let clientInformation = await Promise.resolve(provider.clientInformation());
+    // Handle client registration if needed. Client information stamped for a different
+    // authorization server reads back as `undefined`, so the flow re-registers exactly as if
+    // nothing were stored.
+    const storedClientInformation = await Promise.resolve(provider.clientInformation());
+    let clientInformation = discardIfIssuerMismatch(storedClientInformation, issuer);
+    const canRegisterAgain = provider.saveClientInformation !== undefined && !!provider.redirectUrl;
+    if (storedClientInformation && !clientInformation && !canRegisterAgain) {
+        // Pre-registered credentials, or a non-interactive client running on configured
+        // credentials: neither can be re-created by registering with this authorization server.
+        throw boundElsewhereError(storedClientInformation, issuer);
+    }
+    // Saved by an earlier version: bound to the first authorization server that accepts it.
+    const unstampedClientInformation = clientInformation?.issuer == null ? clientInformation : undefined;
+    const bindClientInformation = async () => {
+        try {
+            if (unstampedClientInformation)
+                await provider.saveClientInformation?.({ ...unstampedClientInformation, issuer });
+        }
+        catch {
+            // A provider that only expects this call after a registration keeps working, unbound.
+        }
+    };
     if (!clientInformation) {
         if (authorizationCode !== undefined) {
             throw new Error('Existing OAuth client information is required when exchanging an authorization code');
@@ -261,9 +331,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
         if (shouldUseUrlBasedClientId) {
             // SEP-991: URL-based Client IDs
-            clientInformation = {
-                client_id: clientMetadataUrl
-            };
+            clientInformation = { client_id: clientMetadataUrl, issuer };
             await provider.saveClientInformation?.(clientInformation);
         }
         else {
@@ -277,8 +345,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
                 scope: resolvedScope,
                 fetchFn
             });
-            await provider.saveClientInformation(fullInformation);
-            clientInformation = fullInformation;
+            clientInformation = { ...fullInformation, issuer };
+            await provider.saveClientInformation(clientInformation);
         }
     }
     // Non-interactive flows (e.g., client_credentials, jwt-bearer) don't need a redirect URL
@@ -291,10 +359,19 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
             authorizationCode,
             fetchFn
         });
-        await provider.saveTokens(tokens);
+        await bindClientInformation();
+        await provider.saveTokens({ ...tokens, issuer });
         return 'AUTHORIZED';
     }
-    const tokens = await provider.tokens();
+    // A refresh token stamped for a different authorization server reads back as `undefined`,
+    // so it is never posted to this one's token endpoint.
+    const tokens = discardIfIssuerMismatch(await provider.tokens(), issuer);
+    if (tokens?.refresh_token && tokens.issuer == null) {
+        // eslint-disable-next-line no-console
+        console.warn("[mcp-sdk] stored OAuth tokens have no 'issuer' property (saved by an earlier version, or by a provider that " +
+            'does not keep it) and are used as-is; make sure your OAuthClientProvider stores what saveTokens() and ' +
+            'saveClientInformation() receive unchanged.');
+    }
     // Handle token refresh or new authorization
     if (tokens?.refresh_token) {
         try {
@@ -307,7 +384,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
                 addClientAuthentication: provider.addClientAuthentication,
                 fetchFn
             });
-            await provider.saveTokens(newTokens);
+            await bindClientInformation();
+            await provider.saveTokens({ ...newTokens, issuer });
             return 'AUTHORIZED';
         }
         catch (error) {
@@ -350,6 +428,17 @@ function isHttpsUrl(value) {
         return false;
     }
 }
+/**
+ * Selects the RFC 8707 resource indicator for an MCP server: the provider's
+ * {@linkcode OAuthClientProvider.validateResourceURL | validateResourceURL} result when
+ * implemented, otherwise the protected resource metadata's `resource` (checked against the
+ * server URL with `checkResourceAllowed`), or `undefined` when there is no metadata.
+ *
+ * The result is a parsed `URL`, so a pathless indicator such as `https://example.com` has
+ * the `href` `https://example.com/`. {@linkcode auth} therefore sends the metadata string
+ * verbatim instead of this URL's `href` (#1968); callers that emit the `resource`
+ * parameter themselves should do the same.
+ */
 async function selectResourceURL(serverUrl, provider, resourceMetadata) {
     const defaultResource = (0, auth_utils_js_1.resourceUrlFromServerUrl)(serverUrl);
     // If provider has custom validation, delegate to it
@@ -468,7 +557,7 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
  */
 async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
     try {
-        return await fetchFn(url, { headers });
+        return await (0, transport_js_1.fetchWithinOrigin)(fetchFn)(url, { headers });
     }
     catch (error) {
         if (error instanceof TypeError) {
@@ -507,7 +596,7 @@ async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
  * Determines if fallback to root discovery should be attempted
  */
 function shouldAttemptFallback(response, pathname) {
-    return !response || (response.status >= 400 && response.status < 500 && pathname !== '/');
+    return !response || (!response.ok && response.status < 500 && pathname !== '/');
 }
 /**
  * Generic function for discovering OAuth metadata with fallback support
@@ -648,8 +737,8 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
         }
         if (!response.ok) {
             await response.body?.cancel();
-            // Continue looking for any 4xx response code.
-            if (response.status >= 400 && response.status < 500) {
+            // Continue looking for any 4xx response code, or a redirect that was not followed.
+            if (response.status < 500) {
                 continue; // Try next URL
             }
             throw new Error(`HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`);
@@ -708,6 +797,9 @@ async function discoverOAuthServerInfo(serverUrl, opts) {
         resourceMetadata
     };
 }
+function resourceIndicatorToString(resource) {
+    return typeof resource === 'string' ? resource : resource.href;
+}
 /**
  * Begins the authorization flow with the given server, by generating a PKCE challenge and constructing the authorization URL.
  */
@@ -748,7 +840,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
         authorizationUrl.searchParams.append('prompt', 'consent');
     }
     if (resource) {
-        authorizationUrl.searchParams.set('resource', resource.href);
+        authorizationUrl.searchParams.set('resource', resourceIndicatorToString(resource));
     }
     return { authorizationUrl, codeVerifier };
 }
@@ -782,7 +874,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
         Accept: 'application/json'
     });
     if (resource) {
-        tokenRequestParams.set('resource', resource.href);
+        tokenRequestParams.set('resource', resourceIndicatorToString(resource));
     }
     if (addClientAuthentication) {
         await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
@@ -792,7 +884,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
         const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
         applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
     }
-    const response = await (fetchFn ?? fetch)(tokenUrl, {
+    const response = await (0, transport_js_1.fetchWithinOrigin)(fetchFn ?? fetch)(tokenUrl, {
         method: 'POST',
         headers,
         body: tokenRequestParams
@@ -800,7 +892,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     if (!response.ok) {
         throw await parseErrorResponse(response);
     }
-    return auth_js_2.OAuthTokensSchema.parse(await response.json());
+    return TokenResponseSchema.parse(await response.json());
 }
 /**
  * Exchanges an authorization code for an access token with the given server.
@@ -880,6 +972,16 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
  * const tokens = await fetchToken(provider, authServerUrl, { metadata });
  */
 async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+    // Nothing is sent to an authorization server other than the one the client information is stamped for.
+    const readClientInformation = async () => {
+        const storedClientInformation = await provider.clientInformation();
+        const checked = discardIfIssuerMismatch(storedClientInformation, String(authorizationServerUrl));
+        if (storedClientInformation && !checked) {
+            throw boundElsewhereError(storedClientInformation, String(authorizationServerUrl));
+        }
+        return checked;
+    };
+    let clientInformation = await readClientInformation();
     const scope = provider.clientMetadata.scope;
     // Use provider's prepareTokenRequest if available, otherwise fall back to authorization_code
     let tokenRequestParams;
@@ -897,11 +999,12 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
         const codeVerifier = await provider.codeVerifier();
         tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
     }
-    const clientInformation = await provider.clientInformation();
+    // A provider may fill in its client information while the request is prepared.
+    clientInformation ?? (clientInformation = await readClientInformation());
     return executeTokenRequest(authorizationServerUrl, {
         metadata,
         tokenRequestParams,
-        clientInformation: clientInformation ?? undefined,
+        clientInformation,
         addClientAuthentication: provider.addClientAuthentication,
         resource,
         fetchFn
@@ -925,7 +1028,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     else {
         registrationUrl = new URL('/register', authorizationServerUrl);
     }
-    const response = await (fetchFn ?? fetch)(registrationUrl, {
+    const response = await (0, transport_js_1.fetchWithinOrigin)(fetchFn ?? fetch)(registrationUrl, {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json'
@@ -938,6 +1041,6 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     if (!response.ok) {
         throw await parseErrorResponse(response);
     }
-    return auth_js_2.OAuthClientInformationFullSchema.parse(await response.json());
+    return RegistrationResponseSchema.parse(await response.json());
 }
 //# sourceMappingURL=auth.js.map