@typeship-ax/mcp 0.21.0 → 0.23.0

package/dist/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":";AAuBA,OAAO,EAAoC,KAAK,aAAa,EAAmB,MAAM,YAAY,CAAC;AAenG,OAAO,EAA8C,KAAK,6BAA6B,EAAE,KAAK,kCAAkC,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACpL,YAAY,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9H,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AA6V3D,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,6BAA6B,CAAC;IAC9C;kFAC8E;IAC9E,aAAa,CAAC,EAAE,kCAAkC,CAAC;IACnD;;;;iFAI6E;IAC7E,cAAc,CAAC,SAAS,EAAE,YAAY,GAAG,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACjF;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAMjG;AAED;+EAC+E;AAC/E,wBAAsB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAErE"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":";AAuBA,OAAO,EAAoC,KAAK,aAAa,EAAmB,MAAM,YAAY,CAAC;AAenG,OAAO,EAA8C,KAAK,6BAA6B,EAAE,KAAK,kCAAkC,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACpL,YAAY,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9H,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAoa3D,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,6BAA6B,CAAC;IAC9C;kFAC8E;IAC9E,aAAa,CAAC,EAAE,kCAAkC,CAAC;IACnD;;;;iFAI6E;IAC7E,cAAc,CAAC,SAAS,EAAE,YAAY,GAAG,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACjF;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAMjG;AAED;+EAC+E;AAC/E,wBAAsB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAErE"}

package/dist/mcp.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-// typeship — MCP server. Generated by typeship — https://typeship.dev
+// Typeship — MCP server. Generated by Typeship — https://typeship.dev
 // Speaks MCP 2026-07-28 and accepts the 2025-11-25 initialize handshake.
 // HTTP is stateless (no sessions); the protocol layer and tool surface
-// live in ./mcp-protocol.js, shared with typeship's hosted endpoint. Two
-// transports, zero dependencies:
+// live in ./mcp-protocol.js, shared by both transports. Two transports,
+// zero dependencies:
 //   node mcp.js            stdio (newline-delimited JSON-RPC 2.0)
 //   createMcpHandler()    configured Streamable HTTP handler
 // Surface switches (flags or environment):
@@ -21,20 +21,20 @@ import { homedir, tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { TypeshipClient, formatDebugEvent } from "./index.js";
-import { asApiResult } from "./core/http.js";
-import { GLOBALS, OMITTED_OPS, OPS, buildArgs } from "./ops.js";
-import { DEFAULT_MAX_RESULT_CHARS, SUPPORTED_PROTOCOL_VERSIONS, McpAccountLinkRequired, argumentsError, asJsonRpc, binaryOutcome, callSharedTool, checkRequestHeaders, createStdioRpcHandler, dataOutcome, errorOutcome, handleRpc, isRpcOutcome, pageOutcome, parseIncludeList, prepareCall, resolveReferences, serverInstructions, takeCancelled, textError, toolDefinitions, visibleOps, } from "./mcp-protocol.js";
+import { asApiResult, mediaTypeForPath } from "./core/http.js";
+import { GLOBALS, INPUT_TYPES, OMITTED_OPS, OPS, buildArgs } from "./ops.js";
+import { DEFAULT_MAX_RESULT_CHARS, SUPPORTED_PROTOCOL_VERSIONS, McpAccountLinkRequired, argumentsError, asJsonRpc, binaryOutcome, callSharedTool, checkRequestHeaders, createStdioRpcHandler, dataOutcome, errorOutcome, handleRpc, hiddenOperations, isRpcOutcome, pageOutcome, parseIncludeList, prepareCall, resolveReferences, serverInstructions, requiredScopes, takeCancelled, textError, toolDefinitions, unmatchedIncludes, unsupportedAuthOutcome, visibleOps, } from "./mcp-protocol.js";
 import { fetchDocsText } from "./docs.js";
 import { assertCredentialDestination, assertStoredIdentity } from "./oauth-session.js";
 import { createCredentialStore } from "./credential-storage.js";
-import { parseNamedCredentials, resolveNamedCredentials, namedCredentialAvailability } from "./named-credentials.js";
+import { parseNamedCredentials, resolveNamedCredentials, namedCredentialAvailability, missingCredentials, parseExtraHeaders, applyExtraHeaders } from "./named-credentials.js";
 import { resolveProfile, profileFlag, readProfileConfig } from "./auth-profiles.js";
 import { createMcpAuthorizer, McpAuthorizationError } from "./mcp-authorization.js";
 export { McpAccountLinkRequired } from "./mcp-protocol.js";
 const BIN = "typeship";
 const PKG_NAME = "@typeship-ax/mcp";
 const SERVER_NAME = "typeship-mcp";
-const SERVER_VERSION = "0.21.0";
+const SERVER_VERSION = "0.23.0";
 /** The MCP client's announced name (clientInfo in request _meta), for the User-Agent. */
 let MCP_CLIENT_NAME = null;
 function noteClientInfo(message) {
@@ -49,8 +49,8 @@ const NAMED_SCHEMES = { "apiKey": { "kind": "bearer", "options": ["bearerToken"]
 const AUTH_SCALARS = [{ "option": "bearerToken", "flag": "token", "env": "TYPESHIP_TOKEN" }];
 const BASIC = null;
 const ENVIRONMENTS = {};
-const DOCS_URL_DEFAULT = "https://typeship.dev";
-const DOCS_INDEX_URL_DEFAULT = null;
+const DOCS_URL_DEFAULT = "https://typeship.dev/docs";
+const DOCS_INDEX_URL_DEFAULT = "https://typeship.dev/llms.txt";
 /** "meta" collapses per-operation tools into search/read/execute so huge
  * APIs don't flood agent context with hundreds of tools. */
 const TOOL_MODE = "meta";
@@ -63,6 +63,10 @@ const IDENTITY_TOOL = null;
 const ARGV = process.argv.slice(2);
 const READ_ONLY = ARGV.includes("--read-only") || process.env["TYPESHIP_MCP_READ_ONLY"] === "1" || process.env["TYPESHIP_MCP_READ_ONLY"] === "true";
 const INCLUDE = parseIncludeList(ARGV.includes("--tools") ? ARGV[ARGV.indexOf("--tools") + 1] : process.env["TYPESHIP_MCP_TOOLS"]);
+/** How the operator set each switch, for errors that name it. */
+const READ_ONLY_SWITCH = ARGV.includes("--read-only") ? "--read-only" : "TYPESHIP_MCP_READ_ONLY";
+const TOOLS_SWITCH = ARGV.includes("--tools") ? "--tools" : "TYPESHIP_MCP_TOOLS";
+const HEADER_ARGS = ARGV.flatMap((arg, index) => arg === "--header" && ARGV[index + 1] !== undefined ? [ARGV[index + 1]] : arg.startsWith("--header=") ? [arg.slice("--header=".length)] : []);
 const MAX_RESULT_CHARS = Number(process.env["TYPESHIP_MCP_MAX_RESULT_CHARS"]) || DEFAULT_MAX_RESULT_CHARS;
 /** One sentence on where credentials come from on each transport; goes
  * into the instructions and into 401 results. */
@@ -87,7 +91,7 @@ function readJson(file) {
 }
 function makeClient(op) {
     const profile = LOCAL_CREDENTIALS ? resolveProfile(configRoot(), { flag: profileFlag(ARGV), environment: process.env["TYPESHIP_PROFILE"] }) : null;
-    const store = createCredentialStore(profile?.directory ?? configRoot(), process.env["TYPESHIP_CREDENTIAL_STORE"], "TYPESHIP_CREDENTIAL_STORE");
+    const store = createCredentialStore(profile?.directory ?? configRoot(), BIN, process.env["TYPESHIP_CREDENTIAL_STORE"], "TYPESHIP_CREDENTIAL_STORE");
     if (BASIC && (process.env[BASIC.envUser] !== undefined) !== (process.env[BASIC.envPass] !== undefined))
         throw new Error("Supply both Basic-auth environment variables together, or use a complete named Basic credential.");
     const envNamed = LOCAL_CREDENTIALS && process.env["TYPESHIP_CREDENTIALS"] !== undefined ? parseNamedCredentials(process.env["TYPESHIP_CREDENTIALS"], NAMED_SCHEMES) : {};
@@ -136,28 +140,74 @@ function makeClient(op) {
         { named: stored?.named, options: { ...stored?.scalars, ...(stored?.basic ? { basicAuth: stored.basic } : {}) } },
         { named: envNamed, options: envOptions },
     ]);
+    requireOperationCredentials(op, options);
     for (const g of GLOBALS) {
         const value = process.env["TYPESHIP_" + g.envSuffix];
         if (value !== undefined)
             options[g.option] = value;
     }
     if (process.env["TYPESHIP_DEBUG"] === "1") {
-        options.debug = (event) => process.stderr.write(formatDebugEvent(BIN + "-mcp", event) + "\n");
+        options.debug = (event) => process.stderr.write(formatDebugEvent(SERVER_NAME, event) + "\n");
     }
     // The local MCP server identifies itself (surface + the client it serves, when announced).
-    options.defaultHeaders = { "User-Agent": PKG_NAME + "-mcp/" + SERVER_VERSION + (MCP_CLIENT_NAME ? " (client=" + MCP_CLIENT_NAME + ")" : "") };
+    options.defaultHeaders = { "User-Agent": SERVER_NAME + "/" + SERVER_VERSION + (MCP_CLIENT_NAME ? " (client=" + MCP_CLIENT_NAME + ")" : "") };
+    // --header / TYPESHIP_HEADERS: headers the spec does not declare, applied last.
+    const extraHeaders = LOCAL_CREDENTIALS ? parseExtraHeaders(process.env["TYPESHIP_HEADERS"], HEADER_ARGS, "TYPESHIP_HEADERS") : {};
+    if (Object.keys(extraHeaders).length)
+        options.onRequest = (context) => { applyExtraHeaders(context.headers, extraHeaders); };
     // Keep the SDK's machine-token cache while re-evaluating local configuration.
     const key = createHash("sha256").update(JSON.stringify([options, config, profile?.name, stored?.oauth?.sessionId, null, process.env["TYPESHIP_DEBUG"]])).digest("hex");
     if (clientInstance && clientKey === key)
         return clientInstance;
     const client = new TypeshipClient(options);
+    CLIENT_BASIC.set(client, { basicAuth: options.basicAuth, credentials: options.credentials });
     clientKey = key;
     CLIENT_CREDENTIALS.set(client, Object.keys(options.credentials ?? {}).length > 0 || AUTH_SCALARS.some((a) => options[a.option] !== undefined) || options.basicAuth !== undefined || options.bearerToken !== undefined || options.clientCredentials !== undefined);
     return (clientInstance = client);
 }
+/** A required operation without one complete credential alternative stops
+ * before any request, as the CLI does, with the variables that supply it.
+ * Operations with no supported alternative are reported separately. */
+class MissingCredentialsError extends Error {
+    outcome;
+    constructor(outcome) {
+        super("Missing credentials");
+        this.outcome = outcome;
+    }
+}
+function requireOperationCredentials(op, options) {
+    if (op.auth !== "required")
+        return;
+    const gap = missingCredentials(NAMED_SCHEMES, op.credentialOptions, options);
+    if (!gap || !gap.alternatives.length)
+        return;
+    const names = new Set(gap.missing.flat());
+    const needs = (option) => [...names].some((name) => NAMED_SCHEMES[name]?.options.includes(option));
+    const scalars = AUTH_SCALARS.filter((scalar) => needs(scalar.option));
+    throw new MissingCredentialsError(textError(op.tool + " needs one complete credential alternative. Missing security schemes: " + gap.missing.map((alternative) => alternative.join(" + ")).join(" OR ") + ". No request was sent.", "NO_AUTH", [
+        ...scalars.map((scalar) => "Set " + scalar.env + " in the MCP server's environment."),
+        ...(BASIC && needs("basicAuth") ? ["Set " + BASIC.envUser + " and " + BASIC.envPass + " in the MCP server's environment."] : []),
+        "Or set TYPESHIP_CREDENTIALS to a JSON object with every scheme in one alternative: " + gap.alternatives.map((alternative) => alternative.join(" + ")).join(" OR ") + ".",
+        "Credentials saved by '" + BIN + " login' are read on the next call without a restart.",
+    ]));
+}
 let clientInstance;
 let clientKey = "";
 const CLIENT_CREDENTIALS = new WeakMap();
+/** Each client's Basic credentials, for path arguments that default to the username. */
+const CLIENT_BASIC = new WeakMap();
+/** The Basic-auth username a path argument of op defaults to (Twilio's
+ * AccountSid): the named scheme's, else basicAuth's. */
+function credentialUsername(op, client) {
+    const scheme = op.params.find((p) => p.credential)?.credential?.scheme;
+    const basic = scheme ? CLIENT_BASIC.get(client) : undefined;
+    if (!basic)
+        return undefined;
+    const named = basic.credentials?.[scheme];
+    const username = named && typeof named === "object" ? named.username
+        : basic.basicAuth?.username;
+    return typeof username === "string" && username !== "" ? username : undefined;
+}
 /** Resolve configuration and credentials for each tool call, including login/logout changes. */
 function getClient(op) {
     return makeClient(op);
@@ -168,10 +218,10 @@ async function callOperationRaw(op, rawArgs, remote, client) {
     // Arguments are checked against the tool's schema first: unknown names,
     // wrong types and missing requirements come back as one isError result,
     // nothing reaches the API half-formed and nothing is dropped silently.
-    const prepared = prepareCall(op, rawArgs, { maxChars: MAX_RESULT_CHARS });
+    const prepared = prepareCall(op, rawArgs, { maxChars: MAX_RESULT_CHARS, credentialUsername: credentialUsername(op, client) });
     if (!prepared.ok)
         return prepared.outcome;
-    const { args, fields, maxChars } = prepared.call;
+    const { args, fields, optionalFields, maxChars } = prepared.call;
     const values = {};
     for (const p of op.params) {
         const argument = p.kind === "header" && p.name === "If-Match" ? "if_match" : p.name;
@@ -184,14 +234,21 @@ async function callOperationRaw(op, rawArgs, remote, client) {
     let rawBody = op.bodyStyle === "data" ? args.body : undefined;
     if (LOCAL_PROCESS && !remote) {
         for (const p of op.params) {
-            if (p.type !== "file" || typeof values[p.name] !== "string")
+            if (p.type !== "file")
                 continue;
-            try {
-                values[p.name] = fileArgument(values[p.name]);
-            }
-            catch (e) {
-                fileIssues.push({ code: "INVALID_ARGUMENT", argument: p.name, message: p.name + ": cannot read " + String(values[p.name]) + " (" + e.message + ")" });
+            const paths = values[p.name];
+            if (typeof paths !== "string" && !(Array.isArray(paths) && paths.every((path) => typeof path === "string")))
+                continue;
+            const files = [];
+            for (const path of Array.isArray(paths) ? paths : [paths]) {
+                try {
+                    files.push(fileArgument(path));
+                }
+                catch (e) {
+                    fileIssues.push({ code: "INVALID_ARGUMENT", argument: p.name, message: p.name + ": cannot read " + path + " (" + e.message + ")" });
+                }
             }
+            values[p.name] = Array.isArray(paths) ? files : files[0];
         }
         if (op.bodyKind === "binary" && typeof rawBody === "string") {
             try {
@@ -204,13 +261,18 @@ async function callOperationRaw(op, rawArgs, remote, client) {
     }
     if (fileIssues.length > 0)
         return argumentsError(op, fileIssues);
+    // A tool result is one value: a streamed response is not available here.
+    if (op.streamMethod && args[op.streamMethod.flag] === op.streamMethod.value) {
+        return argumentsError(op, [{ code: "INVALID_ARGUMENT", argument: op.streamMethod.flag, message: op.streamMethod.flag + ": streaming is not available over MCP, which returns one result per call. Call again without " + op.streamMethod.flag + " " + JSON.stringify(op.streamMethod.value) + " to get the complete response." }]);
+    }
     const callArgs = buildArgs(op, values, rawBody, typeof args.select === "string" ? args.select : undefined);
     const errorContext = {
         authHint: remote ? AUTH_HINT_HTTP : AUTH_HINT_STDIO,
         docsUrl: docsSource.docsUrl(),
         hadCredential: !!remote || CLIENT_CREDENTIALS.get(client) === true,
+        requiredScopes: requiredScopes(op.security),
     };
-    const shape = { fields, maxChars, pagination: op.pagination, args };
+    const shape = { fields, optionalFields, maxChars, pagination: op.pagination, args, safety: op.safety, outputSchema: op.outputSchema };
     try {
         const target = client[op.resource];
         let result = await asApiResult(target[op.method](...callArgs));
@@ -230,7 +292,7 @@ async function callOperationRaw(op, rawArgs, remote, client) {
         }
         if (op.paginated) {
             const page = result.data;
-            return pageOutcome(page.items, page.nextPageParams(), { ...shape, requestId: page.response.requestId });
+            return pageOutcome(page.items, page.nextPageParams(), { ...shape, requestId: page.response.requestId, carryArgs: op.params.filter((p) => p.required || p.credential).map((p) => p.name) });
         }
         // A binary body (the SDK hands back a Blob): an image block, or a file
         // on disk, never "{}".
@@ -257,9 +319,24 @@ function referenceCacheFor(authHeader) {
     return cache;
 }
 async function callOperation(op, rawArgs, remote) {
-    const prepared = prepareCall(op, rawArgs, { maxChars: MAX_RESULT_CHARS });
+    // A path argument that defaults to the Basic-auth username needs the
+    // configured credential before validation; a credential failure is
+    // reported below, after the arguments.
+    let username;
+    if (op.params.some((p) => p.credential && rawArgs[p.name] === undefined)) {
+        try {
+            username = credentialUsername(op, remote ? await remote.client() : getClient(op));
+        }
+        catch {
+            username = undefined;
+        }
+    }
+    const prepared = prepareCall(op, rawArgs, { maxChars: MAX_RESULT_CHARS, credentialUsername: username });
     if (!prepared.ok)
         return prepared.outcome;
+    const unsupported = unsupportedAuthOutcome(op);
+    if (unsupported)
+        return unsupported;
     // One client/session for the entire tool, including name-to-ID lookups.
     // If login changes during a lookup, the token callback rejects the old session.
     let client;
@@ -269,6 +346,8 @@ async function callOperation(op, rawArgs, remote) {
     catch (error) {
         if (remote && error instanceof McpAccountLinkRequired)
             throw error;
+        if (!remote && error instanceof MissingCredentialsError)
+            return error.outcome;
         return textError(remote ? "API access is unavailable for this MCP account. Reconnect your API account or contact the server owner." : error.message);
     }
     const resolved = await resolveReferences(op, prepared.call.args, {
@@ -281,7 +360,7 @@ async function callOperation(op, rawArgs, remote) {
         return resolved.outcome;
     const args = {
         ...resolved.args,
-        ...(prepared.call.fields ? { fields: prepared.call.fields.map((path) => path.join(".")) } : {}),
+        ...(prepared.call.fields ? { fields: prepared.call.fields.map((path) => (prepared.call.optionalFields.includes(path.join(".")) ? "?" : "") + path.join(".")) } : {}),
     };
     return callOperationRaw(op, args, remote, client);
 }
@@ -306,7 +385,7 @@ const HIDDEN_WRITES = READ_ONLY ? visibleOps(OPS, { include: INCLUDE, uploads: L
 const HAS_UPLOADS = MCP_OPS.some((op) => op.bodyKind === "multipart" || op.bodyKind === "binary");
 /** A local file as an upload part (multipart field or raw body). */
 function fileArgument(path) {
-    return new File([readFileSync(path)], basename(path));
+    return new File([readFileSync(path)], basename(path), { type: mediaTypeForPath(path) });
 }
 /** Where binary responses land on a local server: a per-server temp dir. */
 function saveBinary(bytes, _mediaType, suggestedName) {
@@ -319,6 +398,8 @@ function saveBinary(bytes, _mediaType, suggestedName) {
 const docsSource = {
     ops: MCP_OPS,
     omittedOps: OMITTED_OPS,
+    inputTypes: INPUT_TYPES,
+    hiddenOps: hiddenOperations(OPS, { readOnly: READ_ONLY, include: INCLUDE, uploads: LOCAL_PROCESS }, { readOnly: READ_ONLY_SWITCH, include: TOOLS_SWITCH }),
     generatedOperationCount: OPS.length,
     docsUrl: () => readJson("config.json")?.docsUrl ?? DOCS_URL_DEFAULT,
     docsIndexUrl: () => readJson("config.json")?.docsUrl ? null : DOCS_INDEX_URL_DEFAULT,
@@ -329,9 +410,9 @@ function serverFor(remote) {
     const source = remote ? { ...docsSource, ops: operations } : docsSource;
     const website = docsSource.docsUrl();
     return {
-        serverInfo: { name: SERVER_NAME, title: "typeship", version: SERVER_VERSION, ...(website ? { websiteUrl: website } : {}) },
+        serverInfo: { name: SERVER_NAME, title: "Typeship", version: SERVER_VERSION, ...(website ? { websiteUrl: website } : {}) },
         instructions: serverInstructions({
-            title: "typeship",
+            title: "Typeship",
             ops: operations,
             toolCount: operations.length,
             generatedOperationCount: OPS.length,
@@ -451,13 +532,16 @@ async function authorizedHttp(request, authorizer, credentialsFor, apiBaseUrl) {
                 throw new Error("API credentials target a different API URL.");
             const token = request.headers.get("authorization").slice(7);
             const transport = credentials.fetch ?? fetch;
-            return new TypeshipClient({ ...credentials, baseUrl, fetch: async (input, init) => {
+            const created = new TypeshipClient({ ...credentials, baseUrl, fetch: async (input, init) => {
                     const headers = new Headers(init?.headers);
                     const destination = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
                     if ([...headers.values()].some(value => value === token || value === "Bearer " + token) || [...destination.searchParams.values()].includes(token))
                         throw new Error("An MCP connection token cannot authorize an upstream API request.");
                     return transport(input, init);
                 } });
+            const { basicAuth, credentials: named } = credentials;
+            CLIENT_BASIC.set(created, { basicAuth, credentials: named });
+            return created;
         })() };
     let incoming;
     try {
@@ -571,7 +655,23 @@ function invokedDirectly() {
         return /mcp\.(js|mjs|ts)$/.test(entry);
     }
 }
+/** A --tools value that names nothing would start a server with no
+ * operations, which reads to an agent like an empty API. */
+function toolsSwitchProblem() {
+    if (ARGV.includes("--tools") && INCLUDE === undefined)
+        return "--tools needs a comma-separated list of resources, tool names, or resource.method.";
+    const unmatched = unmatchedIncludes(OPS, INCLUDE);
+    if (unmatched.length === 0)
+        return null;
+    const resources = [...new Set(OPS.map((op) => op.resource))];
+    return TOOLS_SWITCH + " names nothing in this API: " + unmatched.join(", ") + ". Resources: " + resources.slice(0, 30).join(", ") + (resources.length > 30 ? ", …" : "") + ".";
+}
 if (invokedDirectly()) {
+    const problem = toolsSwitchProblem();
+    if (problem !== null) {
+        process.stderr.write(SERVER_NAME + ": " + problem + "\n");
+        process.exit(2);
+    }
     const httpFlag = process.argv.indexOf("--http");
     if (httpFlag !== -1) {
         const port = Number(process.argv[httpFlag + 1]) || Number(process.env.PORT) || 3000;

package/dist/named-credentials.d.ts

@@ -16,6 +16,25 @@ export declare function resolveNamedCredentials(schemes: CredentialSchemes, laye
 }[]): NamedCredentials;
 /** Make convenience and named inputs comparable without expanding combinations. */
 export declare function namedCredentialAvailability(schemes: CredentialSchemes, options: Set<string>, named: NamedCredentials): Set<string>;
+/** The schemes an interactive OAuth login session authenticates by name. When
+ * the API also declares a separate non-OAuth bearer scheme, the convenience
+ * bearer token belongs to that scheme, so the session must be passed to each
+ * OAuth scheme by name. Empty: the session is the convenience bearer token. */
+export declare function oauthSessionSchemes(schemes: CredentialSchemes): string[];
+/** Whether resolved client options satisfy one complete credential alternative
+ * of an operation. Returns null when satisfied (or when no credential is
+ * required); otherwise the named alternatives and the schemes each lacks. */
+export declare function missingCredentials(schemes: CredentialSchemes, credentialOptions: string[][] | undefined, options: Record<string, unknown>): {
+    alternatives: string[][];
+    missing: string[][];
+} | null;
 /** Bound file/stdin reads before allocating a full credential document. */
 export declare function readNamedCredentialsFile(input: string, schemes: CredentialSchemes): NamedCredentials;
+/** Extra request headers from repeated `--header "Name: value"` flags and a
+ * `<PREFIX>_HEADERS` variable (a JSON object, or one `Name: value` per line).
+ * The escape hatch for credentials a spec does not declare. Flags win over
+ * the environment; values never appear in errors. */
+export declare function parseExtraHeaders(environment: string | undefined, flags: readonly string[], variable: string): Record<string, string>;
+/** Apply extra headers last, replacing any header of the same name. */
+export declare function applyExtraHeaders(target: Record<string, string>, extra: Record<string, string>): void;
 //# sourceMappingURL=named-credentials.d.ts.map

package/dist/named-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"named-credentials.d.ts","sourceRoot":"","sources":["../src/named-credentials.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9E,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAEpF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAqBlG;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAAE,GAAG,gBAAgB,CAa/J;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAKlI;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAkBpG"}
+{"version":3,"file":"named-credentials.d.ts","sourceRoot":"","sources":["../src/named-credentials.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9E,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAEpF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAqBlG;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAAE,GAAG,gBAAgB,CAa/J;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAKlI;AAED;;;+EAG+E;AAC/E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAExE;AAED;;6EAE6E;AAC7E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAA;CAAE,GAAG,IAAI,CASpM;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAkBpG;AAKD;;;qDAGqD;AACrD,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BrI;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAKrG"}

package/dist/named-credentials.js

@@ -37,7 +37,7 @@ export function resolveNamedCredentials(schemes, layers) {
     for (const layer of layers) {
         for (const [name, scheme] of Object.entries(schemes)) {
             for (const option of scheme.options) {
-                if (option === "clientCredentials")
+                if (option === "clientCredentials" || option === "refreshToken")
                     continue;
                 const value = layer.options?.[option];
                 if (value !== undefined)
@@ -57,6 +57,27 @@ export function namedCredentialAvailability(schemes, options, named) {
     }
     return options;
 }
+/** The schemes an interactive OAuth login session authenticates by name. When
+ * the API also declares a separate non-OAuth bearer scheme, the convenience
+ * bearer token belongs to that scheme, so the session must be passed to each
+ * OAuth scheme by name. Empty: the session is the convenience bearer token. */
+export function oauthSessionSchemes(schemes) {
+    return Object.entries(schemes).filter(([, scheme]) => (scheme.options.includes("clientCredentials") || scheme.options.includes("refreshToken")) && !scheme.options.includes("bearerToken")).map(([name]) => name);
+}
+/** Whether resolved client options satisfy one complete credential alternative
+ * of an operation. Returns null when satisfied (or when no credential is
+ * required); otherwise the named alternatives and the schemes each lacks. */
+export function missingCredentials(schemes, credentialOptions, options) {
+    const supplied = (key, value) => typeof value === "function" || (typeof value === "string" && value.length > 0)
+        || (key === "clientCredentials" && value !== null && typeof value === "object")
+        || (value !== null && typeof value === "object" && "username" in value && "password" in value && typeof value.username === "string" && value.username.length > 0 && typeof value.password === "string" && value.password.length > 0);
+    const named = Object.fromEntries(Object.entries((options.credentials ?? {})).filter(([name, value]) => supplied(name, value)));
+    const available = namedCredentialAvailability(schemes, new Set(Object.keys(options).filter((key) => key !== "credentials" && supplied(key, options[key]))), named);
+    if (credentialOptions?.some((alternative) => alternative.length > 0 && alternative.every((option) => available.has(option))))
+        return null;
+    const alternatives = (credentialOptions ?? []).filter((alternative) => alternative.length > 0 && alternative.every((option) => option.startsWith("credentials."))).map((alternative) => alternative.map((option) => option.slice("credentials.".length)));
+    return { alternatives, missing: alternatives.map((alternative) => alternative.filter((name) => !available.has("credentials." + name))) };
+}
 /** Bound file/stdin reads before allocating a full credential document. */
 export function readNamedCredentialsFile(input, schemes) {
     let fd;
@@ -84,3 +105,62 @@ export function readNamedCredentialsFile(input, schemes) {
     }
     return parseNamedCredentials(Buffer.concat(chunks).toString("utf8"), schemes);
 }
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const TRANSPORT_HEADERS = new Set(["host", "content-length", "content-type", "transfer-encoding", "connection"]);
+/** Extra request headers from repeated `--header "Name: value"` flags and a
+ * `<PREFIX>_HEADERS` variable (a JSON object, or one `Name: value` per line).
+ * The escape hatch for credentials a spec does not declare. Flags win over
+ * the environment; values never appear in errors. */
+export function parseExtraHeaders(environment, flags, variable) {
+    const entries = [];
+    const line = (text, source) => {
+        const colon = text.indexOf(":");
+        if (colon <= 0)
+            throw new Error(source + " expects \"Name: value\".");
+        entries.push([text.slice(0, colon).trim(), text.slice(colon + 1).trim()]);
+    };
+    if (environment !== undefined && environment.trim()) {
+        const text = environment.trim();
+        if (text.startsWith("{")) {
+            let value;
+            try {
+                value = JSON.parse(text);
+            }
+            catch {
+                throw new Error(variable + " must be a JSON object of header names to values, or one \"Name: value\" per line.");
+            }
+            if (!value || typeof value !== "object" || Array.isArray(value) || Object.values(value).some((entry) => typeof entry !== "string"))
+                throw new Error(variable + " must map header names to string values.");
+            entries.push(...Object.entries(value));
+        }
+        else
+            for (const part of text.split(/\r?\n/))
+                if (part.trim())
+                    line(part, variable);
+    }
+    for (const flag of flags)
+        line(flag, "--header");
+    const headers = {};
+    for (const [name, value] of entries) {
+        if (!HEADER_NAME.test(name))
+            throw new Error("Header names may contain only token characters. Check --header and " + variable + ".");
+        if (TRANSPORT_HEADERS.has(name.toLowerCase()))
+            throw new Error("The " + name + " header is set by the client and cannot be overridden.");
+        if (/[\r\n\0]/.test(value))
+            throw new Error("Header values cannot contain line breaks. Check --header and " + variable + ".");
+        for (const existing of Object.keys(headers))
+            if (existing.toLowerCase() === name.toLowerCase())
+                delete headers[existing];
+        headers[name] = value;
+    }
+    return headers;
+}
+/** Apply extra headers last, replacing any header of the same name. */
+export function applyExtraHeaders(target, extra) {
+    for (const [name, value] of Object.entries(extra)) {
+        for (const existing of Object.keys(target))
+            if (existing.toLowerCase() === name.toLowerCase())
+                delete target[existing];
+        target[name] = value;
+    }
+}

package/dist/oauth-request.d.ts

@@ -7,8 +7,14 @@ interface AuthenticationResponse {
     status: number;
     data?: Record<string, unknown>;
     error?: DeviceOAuthError;
+    /** RFC 6749 `error` and `error_description` from a 400 or 401 body, as
+     * "code: description". Only those two fields, printable ASCII, bounded. */
+    providerError?: string;
 }
-/** Error bodies and transport causes may contain credentials and are discarded. */
+/** The provider's standard error fields, never any other body content. */
+export declare function providerErrorOf(data: Record<string, unknown>): string | undefined;
+/** Transport causes and error bodies beyond the standard OAuth `error` and
+ * `error_description` fields may contain credentials and are discarded. */
 export declare function oauthJsonRequest(url: string | URL, init?: RequestInit, timeoutMs?: number): Promise<AuthenticationResponse>;
 /** Device polling needs four protocol errors. Return only their exact names,
  * never descriptions, error URIs, arbitrary error codes or other body fields. */

package/dist/oauth-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-request.d.ts","sourceRoot":"","sources":["../src/oauth-request.ts"],"names":[],"mappings":"AACA,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,WAAW,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;gBAC5F,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;CAY7C;AAED,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,GAAG,WAAW,GAAG,eAAe,GAAG,eAAe,CAAC;AACzG,UAAU,sBAAsB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAE;AAE7G,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,WAAgB,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAE/H;AACD;iFACiF;AACjF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,WAAgB,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAEjI;AACD,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,WAAgB,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7H"}
+{"version":3,"file":"oauth-request.d.ts","sourceRoot":"","sources":["../src/oauth-request.ts"],"names":[],"mappings":"AACA,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,WAAW,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;gBAC5F,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;CAY7C;AAED,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,GAAG,WAAW,GAAG,eAAe,GAAG,eAAe,CAAC;AACzG,UAAU,sBAAsB;IAC9B,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzE;+EAC2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAKjF;AAED;2EAC2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,WAAgB,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAE/H;AACD;iFACiF;AACjF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,WAAgB,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAEjI;AACD,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,WAAgB,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7H"}

package/dist/oauth-request.js

@@ -13,7 +13,16 @@ export class OAuthResponseError extends Error {
         this.name = "OAuthResponseError";
     }
 }
-/** Error bodies and transport causes may contain credentials and are discarded. */
+/** The provider's standard error fields, never any other body content. */
+export function providerErrorOf(data) {
+    const code = typeof data.error === "string" && /^[\x20-\x21\x23-\x5b\x5d-\x7e]{1,64}$/.test(data.error) ? data.error : undefined;
+    if (!code)
+        return undefined;
+    const description = typeof data.error_description === "string" ? data.error_description.replace(/[^\x20-\x7e]/g, " ").trim().slice(0, 300) : "";
+    return description ? code + ": " + description : code;
+}
+/** Transport causes and error bodies beyond the standard OAuth `error` and
+ * `error_description` fields may contain credentials and are discarded. */
 export function oauthJsonRequest(url, init = {}, timeoutMs = 30_000) {
     return boundedRequest(url, init, timeoutMs, "json");
 }
@@ -34,6 +43,9 @@ async function boundedRequest(url, init, timeoutMs, mode) {
     let reader;
     let timer;
     let interrupted;
+    // An error status is already an answer: its body only adds the provider's
+    // explanation, so a stalled or malformed error body never becomes a failure.
+    let errorStatus;
     let rejectDeadline;
     const deadline = new Promise((_, reject) => { rejectDeadline = reject; });
     const stop = (code) => { interrupted ??= code; rejectDeadline(new OAuthResponseError(interrupted)); controller.abort(); };
@@ -56,10 +68,12 @@ async function boundedRequest(url, init, timeoutMs, mode) {
             void response.body?.cancel().catch(() => { });
             throw new OAuthResponseError("request_failed");
         }
-        if (mode === "status" || response.status !== 200 && !(mode === "device" && response.status === 400)) {
+        if (mode === "status" || response.status !== 200 && response.status !== 400 && response.status !== 401) {
             void response.body?.cancel().catch(() => { });
             return { status: response.status };
         }
+        if (response.status !== 200)
+            errorStatus = response.status;
         if (!response.body)
             throw new OAuthResponseError("invalid_response");
         reader = response.body.getReader();
@@ -90,17 +104,25 @@ async function boundedRequest(url, init, timeoutMs, mode) {
             data = JSON.parse(text);
         }
         catch {
+            if (response.status !== 200)
+                return { status: response.status };
             throw new OAuthResponseError("invalid_response");
         }
-        if (!data || typeof data !== "object" || Array.isArray(data))
+        if (!data || typeof data !== "object" || Array.isArray(data)) {
+            if (response.status !== 200)
+                return { status: response.status };
             throw new OAuthResponseError("invalid_response");
+        }
         if (response.status !== 200) {
             const error = data.error;
-            return { status: response.status, ...(["authorization_pending", "slow_down", "access_denied", "expired_token"].includes(String(error)) && typeof error === "string" ? { error: error } : {}) };
+            const providerError = providerErrorOf(data);
+            return { status: response.status, ...(providerError ? { providerError } : {}), ...(mode === "device" && ["authorization_pending", "slow_down", "access_denied", "expired_token"].includes(String(error)) && typeof error === "string" ? { error: error } : {}) };
         }
         return { status: response.status, data: data };
     }
     catch (error) {
+        if (errorStatus !== undefined && interrupted !== "cancelled")
+            return { status: errorStatus };
         if (interrupted)
             throw new OAuthResponseError(interrupted);
         if (error instanceof OAuthResponseError)

package/dist/oauth-session.d.ts

@@ -70,7 +70,13 @@ export interface CredentialStore {
     read(): StoredCredentials | null;
     withLock<T>(work: (store: LockedCredentials) => Promise<T>): Promise<T>;
 }
+/** The OS credential store or the saved credential file cannot be used. */
 export declare class CredentialStorageError extends Error {
+    constructor(message?: string);
+}
+/** A saved login cannot be used as is; the remedy is to sign in again. */
+export declare class OAuthSessionError extends Error {
+    constructor(message?: string);
 }
 export interface CredentialCodec {
     readonly name: string;
@@ -101,6 +107,12 @@ export declare class FileCredentialStore implements CredentialStore {
 /** Re-read on every request attempt; only one process may rotate the token.
  * A failed or interrupted exchange requires login, since the server may have
  * consumed its refresh token even when no response reached this process. */
-export declare function oauthSessionToken(store: CredentialStore, config: SessionConfiguration, sessionId: string, tokenParams?: Record<string, string>): Promise<string>;
+export declare function oauthSessionToken(store: CredentialStore, config: SessionConfiguration, sessionId: string, tokenParams?: Record<string, string>, rejected?: string): Promise<string>;
+/** A saved-session token for the request runtime: resolved before every
+ * attempt, and after a 401 (invalidate) the next resolve forces one refresh
+ * of the token the API rejected. */
+export declare function sessionCredential(resolve: (rejected?: string) => Promise<string>): (() => Promise<string>) & {
+    invalidate(): void;
+};
 export {};
 //# sourceMappingURL=oauth-session.d.ts.map

package/dist/oauth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-session.d.ts","sourceRoot":"","sources":["../src/oauth-session.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGzG,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;AAErG,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAKpH;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,CAAC,EAAE,gBAAgB,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxF;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,cAAc,GAAG,iBAAiB,CAAC;CAC5D;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAMjH;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAK3G;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAUnE;AAED,UAAU,iBAAiB;IACzB,IAAI,IAAI,iBAAiB,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,iBAAiB,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACzE;AAOD,qBAAa,sBAAuB,SAAQ,KAAK;CAAG;AAEpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,IAAI,IAAI,CAAC;IAChB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED;oFACoF;AACpF,qBAAa,mBAAoB,YAAW,eAAe;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,OAAO,CAAC,QAAQ,CAAC,aAAa;IAAW,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAA9E,IAAI,EAAE,MAAM,EAAmB,aAAa,SAAS,EAAmB,KAAK,CAAC,EAAE,eAAe,YAAA;IAEpH,IAAI,OAAO,IAAI,MAAM,CAAyD;IAE9E,iEAAiE;IAC3D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,IAAI,IAAI,iBAAiB,GAAG,IAAI;IAahC,OAAO,CAAC,KAAK;IAUP,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA0B7E,OAAO,CAAC,gBAAgB;IAelB,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,6EAA6E;IACvE,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,8EAA8E;IACxE,IAAI,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAGhD;AAeD;;4EAE4E;AAC5E,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0C1K"}
+{"version":3,"file":"oauth-session.d.ts","sourceRoot":"","sources":["../src/oauth-session.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGzG,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;AAErG,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAKpH;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,CAAC,EAAE,gBAAgB,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxF;AAED,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,cAAc,GAAG,iBAAiB,CAAC;CAC5D;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAMjH;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAK3G;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAUnE;AAED,UAAU,iBAAiB;IACzB,IAAI,IAAI,iBAAiB,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,iBAAiB,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACzE;AAOD,2EAA2E;AAC3E,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,CAAC,EAAE,MAAM;CAC7B;AACD,0EAA0E;AAC1E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,CAAC,EAAE,MAAM;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,IAAI,IAAI,CAAC;IAChB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED;oFACoF;AACpF,qBAAa,mBAAoB,YAAW,eAAe;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,OAAO,CAAC,QAAQ,CAAC,aAAa;IAAW,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAA9E,IAAI,EAAE,MAAM,EAAmB,aAAa,SAAS,EAAmB,KAAK,CAAC,EAAE,eAAe,YAAA;IAEpH,IAAI,OAAO,IAAI,MAAM,CAAyD;IAE9E,iEAAiE;IAC3D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,IAAI,IAAI,iBAAiB,GAAG,IAAI;IAahC,OAAO,CAAC,KAAK;IAUP,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA0B7E,OAAO,CAAC,gBAAgB;IAelB,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,6EAA6E;IACvE,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,8EAA8E;IACxE,IAAI,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAGhD;AAeD;;4EAE4E;AAC5E,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C7L;AAED;;oCAEoC;AACpC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG;IAAE,UAAU,IAAI,IAAI,CAAA;CAAE,CAInI"}