npm - @webpieces/core-util - Versions diffs - 0.4.880 → 0.4.881 - Mend

@webpieces/core-util 0.4.880 → 0.4.881

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (39) hide show

package/package.json +1 -1
package/src/errors/ApiCallSite.d.ts +58 -0
package/src/errors/ApiCallSite.js +96 -0
package/src/errors/ApiCallSite.js.map +1 -0
package/src/errors/ApiError.d.ts +9 -0
package/src/errors/ApiError.js.map +1 -1
package/src/errors/ReportableApiFailure.d.ts +43 -0
package/src/errors/ReportableApiFailure.js +75 -0
package/src/errors/ReportableApiFailure.js.map +1 -0
package/src/errors/index.d.ts +3 -0
package/src/errors/index.js +6 -1
package/src/errors/index.js.map +1 -1
package/src/http/WebpiecesDefaultErrorTranslator.d.ts +3 -0
package/src/http/WebpiecesDefaultErrorTranslator.js +10 -0
package/src/http/WebpiecesDefaultErrorTranslator.js.map +1 -1
package/src/http/WebpiecesDefaultFailureClassifier.d.ts +3 -2
package/src/http/WebpiecesDefaultFailureClassifier.js +6 -3
package/src/http/WebpiecesDefaultFailureClassifier.js.map +1 -1
package/src/index.d.ts +8 -2
package/src/index.js +20 -1
package/src/index.js.map +1 -1
package/src/oauth/OAuthAuthorizationErrorRedirect.d.ts +37 -0
package/src/oauth/OAuthAuthorizationErrorRedirect.js +61 -0
package/src/oauth/OAuthAuthorizationErrorRedirect.js.map +1 -0
package/src/oauth/OAuthBearerChallenge.d.ts +31 -0
package/src/oauth/OAuthBearerChallenge.js +52 -0
package/src/oauth/OAuthBearerChallenge.js.map +1 -0
package/src/oauth/OAuthErrorCode.d.ts +69 -0
package/src/oauth/OAuthErrorCode.js +89 -0
package/src/oauth/OAuthErrorCode.js.map +1 -0
package/src/oauth/OAuthErrorResponse.d.ts +34 -0
package/src/oauth/OAuthErrorResponse.js +74 -0
package/src/oauth/OAuthErrorResponse.js.map +1 -0
package/src/oauth/OAuthProtocolError.d.ts +61 -0
package/src/oauth/OAuthProtocolError.js +83 -0
package/src/oauth/OAuthProtocolError.js.map +1 -0
package/src/oauth/OAuthProtocolErrorCompileAssertions.d.ts +10 -0
package/src/oauth/OAuthProtocolErrorCompileAssertions.js +39 -0
package/src/oauth/OAuthProtocolErrorCompileAssertions.js.map +1 -0

package/src/http/WebpiecesDefaultFailureClassifier.js CHANGED Viewed

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WEBPIECES_DEFAULT_FAILURE_CLASSIFIER = exports.WebpiecesDefaultFailureClassifier = void 0;
 const ApiError_1 = require("../errors/ApiError");
+const OAuthProtocolError_1 = require("../oauth/OAuthProtocolError");
 /**
  * The webpieces built-in {@link FailureClassifier} — the terminal tier, used when no app default and
  * no per-apiClass classifier claims an error. It is the SINGLE SOURCE OF TRUTH for the historical
@@ -18,8 +19,9 @@ const ApiError_1 = require("../errors/ApiError");
  * - ApiBadRequestError (400), ApiUnauthorizedError (401), ApiForbiddenError (403),
  *   ApiNotFoundError (404), ApiConflictError (409), ApiPreconditionFailedError (412),
  *   ApiUnsupportedMediaTypeError (415), ApiUnprocessableError (422), and an ApiCodedError whose
- *   `isCallerError()` is true (below 500, except 408/429) → the server is fine, the caller erred →
- *   NON-failure.
+ *   `isCallerError()` is true (below 500, except 408/429), and an OAuthProtocolError below 500 (a
+ *   refused grant or token is the OAuth protocol working, #1176) → the server is fine, the caller
+ *   erred → NON-failure.
  * SERVER — something may actually be WRONG, so SURFACE it (failure):
  * - ApiRequestTimeoutError (408): a 4xx, but the client may NEVER have seen the response — deliberately
  *   absent below, so it counts as a failure. Implementation/dependency failures, ApiNotImplementedError
@@ -54,7 +56,8 @@ class WebpiecesDefaultFailureClassifier {
             error instanceof ApiError_1.ApiUnprocessableError ||
             error instanceof ApiError_1.ApiPreconditionFailedError ||
             error instanceof ApiError_1.ApiUnsupportedMediaTypeError ||
-            (error instanceof ApiError_1.ApiCodedError && error.isCallerError());
+            (error instanceof ApiError_1.ApiCodedError && error.isCallerError()) ||
+            (error instanceof OAuthProtocolError_1.OAuthProtocolError && error.isCallerError());
         return !healthyRejection;
     }
 }

package/src/http/WebpiecesDefaultFailureClassifier.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"WebpiecesDefaultFailureClassifier.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/WebpiecesDefaultFailureClassifier.ts"],"names":[],"mappings":";;;AAAA,iDAW4B;~~AAI5B;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG~~;AACH,MAAa,iCAAiC;IAC1C;;;;;OAKG;IACH,SAAS,CAAC,KAAY,EAAE,UAAyB;QAC7C,gEAAgE;QAChE,IAAI,KAAK,YAAY,0BAAe,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,8EAA8E;QAC9E,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,sFAAsF;QACtF,oGAAoG;QACpG,MAAM,gBAAgB,GAClB,KAAK,YAAY,6BAAkB;YACnC,KAAK,YAAY,+BAAoB;YACrC,KAAK,YAAY,4BAAiB;YAClC,KAAK,YAAY,2BAAgB;YACjC,KAAK,YAAY,2BAAgB;YACjC,KAAK,YAAY,gCAAqB;YACtC,KAAK,YAAY,qCAA0B;YAC3C,KAAK,YAAY,uCAA4B;YAC7C,CAAC,KAAK,YAAY,wBAAa,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;~~QAC9D~~,OAAO,CAAC,gBAAgB,CAAC;IAC7B,CAAC;CACJ;~~AA9BD~~,~~8EA8BC~~;AAED,oFAAoF;AACvE,QAAA,oCAAoC,GAAG,IAAI,iCAAiC,EAAE,CAAC","sourcesContent":["import {\n ApiBadRequestError,\n ApiUnauthorizedError,\n ApiForbiddenError,\n ApiNotFoundError,\n ApiEndUserError,\n ApiConflictError,\n ApiUnprocessableError,\n ApiPreconditionFailedError,\n ApiUnsupportedMediaTypeError,\n ApiCodedError,\n} from '../errors/ApiError';\nimport { ApiMethodInfo } from './ApiMethodInfo';\nimport { FailureClassifier } from './FailureClassifier';\n\n/*\n The webpieces built-in {@link FailureClassifier} — the terminal tier, used when no app default and\n * no per-apiClass classifier claims an error. It is the SINGLE SOURCE OF TRUTH for the historical\n * `LogApiCall.isUserError` behavior (which now delegates here), so the classification lives in one\n * place.\n \n The question is \"are things WORKING?\", NOT \"was it an HTTP 4xx vs 5xx\" — the two differ (see 408).\n * Classification is by portable Error TYPE, never by transport: this runs over in-process calls,\n * pubsub/queue handlers, and HTTP through one code path and only ever sees a thrown Error. The API\n * classes are portable error types that travel with the throw anywhere, so matching the TYPE works\n * with or without any HTTP in the picture.\n \n SERVER — a healthy server correctly rejecting a CLIENT'S mistake is metrics NOISE, not a failure:\n * - ApiBadRequestError (400), ApiUnauthorizedError (401), ApiForbiddenError (403),\n * ApiNotFoundError (404), ApiConflictError (409), ApiPreconditionFailedError (412),\n * ApiUnsupportedMediaTypeError (415), ApiUnprocessableError (422), and an ApiCodedError whose\n * `isCallerError()` is true (below 500, except 408/429) → the server is fine, the caller erred ~~→\n~~ * NON-failure.\n * SERVER — something may actually be WRONG, so SURFACE it (failure):\n * - ApiRequestTimeoutError (408): a 4xx, but the client may NEVER have seen the response — deliberately\n * absent below, so it counts as a failure. Implementation/dependency failures, ApiNotImplementedError\n * (501), an ApiCodedError of 500+ (or 408/429), and non-API errors are failures.\n \n ApiEndUserError (266): ALWAYS a non-failure, server OR client — an expected \"user made a mistake\".\n * CLIENT: receiving ANY error except 266 means the outbound call FAILED → failure.\n /\nexport class WebpiecesDefaultFailureClassifier implements FailureClassifier {\n /\n Terminal tier — NEVER returns undefined (a definitive verdict is required so classification\n * always resolves to a boolean).\n \n @returns true = failure, false = expected/non-failure\n /\n isFailure(error: Error, methodInfo: ApiMethodInfo): boolean {\n // 266 is the one error that is never a failure, on either side.\n if (error instanceof ApiEndUserError) {\n return false;\n }\n // A client that RECEIVED any error (except the 266 above) made a failed call.\n if (methodInfo.side !== 'server') {\n return true;\n }\n // SERVER: only a healthy rejection of the caller's mistake is a non-failure. Note 408\n // (ApiRequestTimeoutError) is intentionally NOT here — the client may never have seen the response.\n const healthyRejection =\n error instanceof ApiBadRequestError \|\|\n error instanceof ApiUnauthorizedError \|\|\n error instanceof ApiForbiddenError \|\|\n error instanceof ApiNotFoundError \|\|\n error instanceof ApiConflictError \|\|\n error instanceof ApiUnprocessableError \|\|\n error instanceof ApiPreconditionFailedError \|\|\n error instanceof ApiUnsupportedMediaTypeError \|\|\n (error instanceof ApiCodedError && error.isCallerError());\n return !healthyRejection;\n }\n}\n\n/* Process-wide built-in instance — stateless, so one shared instance is enough. */\nexport const WEBPIECES_DEFAULT_FAILURE_CLASSIFIER = new WebpiecesDefaultFailureClassifier();\n"]}
1	+ {"version":3,"file":"WebpiecesDefaultFailureClassifier.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/WebpiecesDefaultFailureClassifier.ts"],"names":[],"mappings":";;;AAAA,iDAW4B;AAC5B,oEAAiE;AAIjE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAa,iCAAiC;IAC1C;;;;;OAKG;IACH,SAAS,CAAC,KAAY,EAAE,UAAyB;QAC7C,gEAAgE;QAChE,IAAI,KAAK,YAAY,0BAAe,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,8EAA8E;QAC9E,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,sFAAsF;QACtF,oGAAoG;QACpG,MAAM,gBAAgB,GAClB,KAAK,YAAY,6BAAkB;YACnC,KAAK,YAAY,+BAAoB;YACrC,KAAK,YAAY,4BAAiB;YAClC,KAAK,YAAY,2BAAgB;YACjC,KAAK,YAAY,2BAAgB;YACjC,KAAK,YAAY,gCAAqB;YACtC,KAAK,YAAY,qCAA0B;YAC3C,KAAK,YAAY,uCAA4B;YAC7C,CAAC,KAAK,YAAY,wBAAa,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACzD,CAAC,KAAK,YAAY,uCAAkB,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,gBAAgB,CAAC;IAC7B,CAAC;CACJ;AA/BD,8EA+BC;AAED,oFAAoF;AACvE,QAAA,oCAAoC,GAAG,IAAI,iCAAiC,EAAE,CAAC","sourcesContent":["import {\n ApiBadRequestError,\n ApiUnauthorizedError,\n ApiForbiddenError,\n ApiNotFoundError,\n ApiEndUserError,\n ApiConflictError,\n ApiUnprocessableError,\n ApiPreconditionFailedError,\n ApiUnsupportedMediaTypeError,\n ApiCodedError,\n} from '../errors/ApiError';\nimport { OAuthProtocolError } from '../oauth/OAuthProtocolError';\nimport { ApiMethodInfo } from './ApiMethodInfo';\nimport { FailureClassifier } from './FailureClassifier';\n\n/*\n The webpieces built-in {@link FailureClassifier} — the terminal tier, used when no app default and\n * no per-apiClass classifier claims an error. It is the SINGLE SOURCE OF TRUTH for the historical\n * `LogApiCall.isUserError` behavior (which now delegates here), so the classification lives in one\n * place.\n \n The question is \"are things WORKING?\", NOT \"was it an HTTP 4xx vs 5xx\" — the two differ (see 408).\n * Classification is by portable Error TYPE, never by transport: this runs over in-process calls,\n * pubsub/queue handlers, and HTTP through one code path and only ever sees a thrown Error. The API\n * classes are portable error types that travel with the throw anywhere, so matching the TYPE works\n * with or without any HTTP in the picture.\n \n SERVER — a healthy server correctly rejecting a CLIENT'S mistake is metrics NOISE, not a failure:\n * - ApiBadRequestError (400), ApiUnauthorizedError (401), ApiForbiddenError (403),\n * ApiNotFoundError (404), ApiConflictError (409), ApiPreconditionFailedError (412),\n * ApiUnsupportedMediaTypeError (415), ApiUnprocessableError (422), and an ApiCodedError whose\n * `isCallerError()` is true (below 500, except 408/429), and an OAuthProtocolError below 500 (a\n * refused grant or token is the OAuth protocol working, #1176) → the server is fine, the caller\n * erred → NON-failure.\n * SERVER — something may actually be WRONG, so SURFACE it (failure):\n * - ApiRequestTimeoutError (408): a 4xx, but the client may NEVER have seen the response — deliberately\n * absent below, so it counts as a failure. Implementation/dependency failures, ApiNotImplementedError\n * (501), an ApiCodedError of 500+ (or 408/429), and non-API errors are failures.\n \n ApiEndUserError (266): ALWAYS a non-failure, server OR client — an expected \"user made a mistake\".\n * CLIENT: receiving ANY error except 266 means the outbound call FAILED → failure.\n /\nexport class WebpiecesDefaultFailureClassifier implements FailureClassifier {\n /\n Terminal tier — NEVER returns undefined (a definitive verdict is required so classification\n * always resolves to a boolean).\n \n @returns true = failure, false = expected/non-failure\n /\n isFailure(error: Error, methodInfo: ApiMethodInfo): boolean {\n // 266 is the one error that is never a failure, on either side.\n if (error instanceof ApiEndUserError) {\n return false;\n }\n // A client that RECEIVED any error (except the 266 above) made a failed call.\n if (methodInfo.side !== 'server') {\n return true;\n }\n // SERVER: only a healthy rejection of the caller's mistake is a non-failure. Note 408\n // (ApiRequestTimeoutError) is intentionally NOT here — the client may never have seen the response.\n const healthyRejection =\n error instanceof ApiBadRequestError \|\|\n error instanceof ApiUnauthorizedError \|\|\n error instanceof ApiForbiddenError \|\|\n error instanceof ApiNotFoundError \|\|\n error instanceof ApiConflictError \|\|\n error instanceof ApiUnprocessableError \|\|\n error instanceof ApiPreconditionFailedError \|\|\n error instanceof ApiUnsupportedMediaTypeError \|\|\n (error instanceof ApiCodedError && error.isCallerError()) \|\|\n (error instanceof OAuthProtocolError && error.isCallerError());\n return !healthyRejection;\n }\n}\n\n/* Process-wide built-in instance — stateless, so one shared instance is enough. */\nexport const WEBPIECES_DEFAULT_FAILURE_CLASSIFIER = new WebpiecesDefaultFailureClassifier();\n"]}

package/src/index.d.ts CHANGED Viewed

@@ -98,7 +98,13 @@ export { RecordSerializer, SerializedMap, SerializedError } from './http/recorde
 export { Filter } from './filters/Filter';
 export type { Service } from './filters/Filter';
 export { FilterChain } from './filters/FilterChain';
-export { ApiError, ApiNotFoundError, ApiDependencyError, ApiBadGatewayError, ApiUnavailableError, ApiDependencyTimeoutError, ApiImplementationError, ApiRateLimitedError, ApiForbiddenError, ApiRequestTimeoutError, ApiEndUserError, ApiBadRequestError, ApiUnauthorizedError, ApiDependencyBackoffError, ApiConnectionError, ApiEndpointNotFoundError, ApiConflictError, ApiUnprocessableError, ApiPreconditionFailedError, ApiUnsupportedMediaTypeError, ApiNotImplementedError, ApiCodedError, ApiClientTooOldError, ApiEndUserNotFoundError, ApiEndUserForbiddenError, ApiEndUserBadRequestError, EndUserErrorCode, EndUserErrorRegistry, ClientRole, ApiErrorCodec, ApiErrorPayload, ApiErrorBoundary, } from './errors';
-export type { ApiErrorKind, ApiStatusCode, EdgeHttpStatus, EndUserErrorFactory, } from './errors';
+export { ApiError, ApiNotFoundError, ApiDependencyError, ApiBadGatewayError, ApiUnavailableError, ApiDependencyTimeoutError, ApiImplementationError, ApiRateLimitedError, ApiForbiddenError, ApiRequestTimeoutError, ApiEndUserError, ApiBadRequestError, ApiUnauthorizedError, ApiDependencyBackoffError, ApiConnectionError, ApiEndpointNotFoundError, ApiConflictError, ApiUnprocessableError, ApiPreconditionFailedError, ApiUnsupportedMediaTypeError, ApiNotImplementedError, ApiCodedError, ApiClientTooOldError, ApiEndUserNotFoundError, ApiEndUserForbiddenError, ApiEndUserBadRequestError, EndUserErrorCode, EndUserErrorRegistry, ClientRole, ApiErrorCodec, ApiErrorPayload, ApiErrorBoundary, ApiCallSite, ReportableApiFailure, RpcCallFailed, } from './errors';
+export type { ApiErrorKind, ApiStatusCode, EdgeHttpStatus, EndUserErrorFactory, CallSiteBoundary, } from './errors';
 export { ApiErrorHttpStatus } from './http/ApiErrorHttpStatus';
+export { OAuthErrorCode, OAuthErrorStatus, OAuthText } from './oauth/OAuthErrorCode';
+export type { OAuthHttpStatus, InvalidClientStatus, OAuthFixedStatusErrorCode, BearerErrorCode, AuthorizationEndpointErrorCode, } from './oauth/OAuthErrorCode';
+export { OAuthProtocolError, OAuthErrorExtras } from './oauth/OAuthProtocolError';
+export { OAuthBearerChallenge } from './oauth/OAuthBearerChallenge';
+export { OAuthErrorBody, OAuthErrorResponse } from './oauth/OAuthErrorResponse';
+export { OAuthAuthorizationErrorRedirect } from './oauth/OAuthAuthorizationErrorRedirect';
 export type { PublishedKind, PublishedApiError } from './http/ApiErrorHttpStatus';

package/src/index.js CHANGED Viewed

@@ -12,7 +12,7 @@ exports.MCP = exports.EXTERNAL_CUSTOMER = exports.SVC_TO_SVC = exports.ApiType =
 exports.InvalidEndpointForMcp = exports.WRITE = exports.WRITE_IDEMPOTENT = exports.READ = exports.EXTERNAL = exports.CRON = exports.CLOUDTASKS = exports.RPC = exports.POST = exports.GET = exports.registerStreamingSchemas = exports.getStreamingEndpoint = exports.WpStream = exports.StreamDirection = exports.StreamWriter = exports.StreamTransportError = exports.StreamEventValidator = exports.StreamingEndpointMetadata = exports.StreamEnvelope = exports.StreamCorrelation = exports.HttpParameterDeclaration = exports.HttpParameterBinding = exports.HttpContractMapper = exports.BoundHttpRequest = exports.StreamDisconnectedError = exports.StreamProtocolError = exports.StreamErrorControl = exports.registerStreamingCatalog = exports.StreamingSchemaCatalog = exports.getAuthorization = exports.WpAuthorization = exports.AuthorizationDeclaration = exports.AuthorizationType = exports.RouteMetadataFactory = exports.RouteMetadata = exports.IPC_METADATA_KEYS = exports.assertNotInternalApi = exports.assertInternalApi = exports.getIpcMaskSpec = exports.getIpcEndpointKind = exports.getIpcEndpoints = exports.getIpcApiId = exports.isInternalApi = exports.WpIpcEndpoint = exports.WpInternal = exports.assertApiTypeMatchesMcpTools = exports.getApiTypeEndpointNames = exports.getApiTypes = exports.DEFAULT_API_TYPES = exports.API_TYPE_METADATA_KEY = void 0;
 exports.NetworkRejectClassifier = exports.NO_REG_CODE = exports.WRONG_COMPANY = exports.WRONG_DOMAIN = exports.EMAIL_NOT_CONFIRMED = exports.NOT_APPROVED = exports.WRONG_LOGIN = exports.WRONG_LOGIN_TYPE = exports.ENTITY_NOT_FOUND = exports.SECRETS = exports.Secrets = exports.getEndpointCaller = exports.isExternalSystemKind = exports.ExternalCaller = exports.DEFAULT_CALLER_KIND = exports.EXTERNAL_SYSTEM_KINDS = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.ENDPOINT_KINDS_BY_API_KIND = exports.Queue = exports.PubSub = exports.Rpc = exports.apiKey = exports.webhook = exports.sharedSecret = exports.oidc = exports.jwt = exports.AuthDeclaration = exports.AuthMeta = exports.GenerateOutputTarget = exports.GenerateOutputLookup = exports.GenerateLayoutProblem = exports.GeneratedApiDocsLayout = exports.McpToolDefinition = exports.McpToolCatalogError = exports.McpToolCatalogFile = exports.ObjectSchemaBuilder = exports.DtoValidationFailure = exports.ApiJsonSchemaValidator = exports.ApiJsonSchemaDiscriminator = exports.ApiJsonSchema = exports.mcpHintsForOperation = exports.getWpMcpTools = exports.getInvalidEndpointsForMcp = exports.WpMcpToolMetadata = exports.WpMcpToolHints = exports.WpMcpTool = exports.InvalidEndpointForMcpMetadata = void 0;
 exports.ApiDependencyTimeoutError = exports.ApiUnavailableError = exports.ApiBadGatewayError = exports.ApiDependencyError = exports.ApiNotFoundError = exports.ApiError = exports.FilterChain = exports.Filter = exports.SerializedError = exports.SerializedMap = exports.RecordSerializer = exports.getDoNotRecordFields = exports.DoNotRecord = exports.RecordedTestCase = exports.RecordedError = exports.RecordedEndpoint = exports.RecorderKeys = exports.ApiMethodInfo = exports.LOG_API_CALL_LOGGER_NAME = exports.ApiCallLogNameImpl = exports.ApiCallLogName = exports.ApiCallInfo = exports.MaskSpec = exports.LogApiCallImpl = exports.ContextMgr = exports.DestinationTrust = exports.WebpiecesCoreHeaders = exports.templateDeriver = exports.WEBPIECES_DEFAULT_FAILURE_CLASSIFIER = exports.WebpiecesDefaultFailureClassifier = exports.KeyedFailureClassifier = exports.ReceivedApiErrorRule = exports.SurfaceEndUserStatus = exports.WEBPIECES_DEFAULT_ERROR_TRANSLATOR = exports.WebpiecesDefaultErrorTranslator = exports.HttpResponseDto = exports.HttpResponseStatus = exports.HttpHeader = exports.RuntimeLocality = exports.ServiceInfo = exports.ApiCallTimeoutError = exports.CallContext = exports.CallDeadline = exports.CallRegistry = exports.ClientRegistry = exports.HeaderRegistry = exports.DateTimeUtil = exports.TimeUtil = exports.DateUtil = exports.InstantUtil = void 0;
-exports.ApiErrorHttpStatus = exports.ApiErrorBoundary = exports.ApiErrorPayload = exports.ApiErrorCodec = exports.ClientRole = exports.EndUserErrorRegistry = exports.EndUserErrorCode = exports.ApiEndUserBadRequestError = exports.ApiEndUserForbiddenError = exports.ApiEndUserNotFoundError = exports.ApiClientTooOldError = exports.ApiCodedError = exports.ApiNotImplementedError = exports.ApiUnsupportedMediaTypeError = exports.ApiPreconditionFailedError = exports.ApiUnprocessableError = exports.ApiConflictError = exports.ApiEndpointNotFoundError = exports.ApiConnectionError = exports.ApiDependencyBackoffError = exports.ApiUnauthorizedError = exports.ApiBadRequestError = exports.ApiEndUserError = exports.ApiRequestTimeoutError = exports.ApiForbiddenError = exports.ApiRateLimitedError = exports.ApiImplementationError = void 0;
+exports.OAuthAuthorizationErrorRedirect = exports.OAuthErrorResponse = exports.OAuthErrorBody = exports.OAuthBearerChallenge = exports.OAuthErrorExtras = exports.OAuthProtocolError = exports.OAuthText = exports.OAuthErrorStatus = exports.OAuthErrorCode = exports.ApiErrorHttpStatus = exports.RpcCallFailed = exports.ReportableApiFailure = exports.ApiCallSite = exports.ApiErrorBoundary = exports.ApiErrorPayload = exports.ApiErrorCodec = exports.ClientRole = exports.EndUserErrorRegistry = exports.EndUserErrorCode = exports.ApiEndUserBadRequestError = exports.ApiEndUserForbiddenError = exports.ApiEndUserNotFoundError = exports.ApiClientTooOldError = exports.ApiCodedError = exports.ApiNotImplementedError = exports.ApiUnsupportedMediaTypeError = exports.ApiPreconditionFailedError = exports.ApiUnprocessableError = exports.ApiConflictError = exports.ApiEndpointNotFoundError = exports.ApiConnectionError = exports.ApiDependencyBackoffError = exports.ApiUnauthorizedError = exports.ApiBadRequestError = exports.ApiEndUserError = exports.ApiRequestTimeoutError = exports.ApiForbiddenError = exports.ApiRateLimitedError = exports.ApiImplementationError = void 0;
 var errorUtils_1 = require("./lib/errorUtils");
 Object.defineProperty(exports, "toError", { enumerable: true, get: function () { return errorUtils_1.toError; } });
 var ContextKey_1 = require("./ContextKey");
@@ -354,6 +354,25 @@ Object.defineProperty(exports, "ClientRole", { enumerable: true, get: function (
 Object.defineProperty(exports, "ApiErrorCodec", { enumerable: true, get: function () { return errors_2.ApiErrorCodec; } });
 Object.defineProperty(exports, "ApiErrorPayload", { enumerable: true, get: function () { return errors_2.ApiErrorPayload; } });
 Object.defineProperty(exports, "ApiErrorBoundary", { enumerable: true, get: function () { return errors_2.ApiErrorBoundary; } });
+Object.defineProperty(exports, "ApiCallSite", { enumerable: true, get: function () { return errors_2.ApiCallSite; } });
+Object.defineProperty(exports, "ReportableApiFailure", { enumerable: true, get: function () { return errors_2.ReportableApiFailure; } });
+Object.defineProperty(exports, "RpcCallFailed", { enumerable: true, get: function () { return errors_2.RpcCallFailed; } });
 var ApiErrorHttpStatus_1 = require("./http/ApiErrorHttpStatus");
 Object.defineProperty(exports, "ApiErrorHttpStatus", { enumerable: true, get: function () { return ApiErrorHttpStatus_1.ApiErrorHttpStatus; } });
+// RFC 6749 / 6750 / 7591 OAuth refusals for app-hosted OAuth endpoints (#1176): the typed error,
+// its one renderer, the Bearer challenge builder and the authorization-endpoint error redirect.
+var OAuthErrorCode_1 = require("./oauth/OAuthErrorCode");
+Object.defineProperty(exports, "OAuthErrorCode", { enumerable: true, get: function () { return OAuthErrorCode_1.OAuthErrorCode; } });
+Object.defineProperty(exports, "OAuthErrorStatus", { enumerable: true, get: function () { return OAuthErrorCode_1.OAuthErrorStatus; } });
+Object.defineProperty(exports, "OAuthText", { enumerable: true, get: function () { return OAuthErrorCode_1.OAuthText; } });
+var OAuthProtocolError_1 = require("./oauth/OAuthProtocolError");
+Object.defineProperty(exports, "OAuthProtocolError", { enumerable: true, get: function () { return OAuthProtocolError_1.OAuthProtocolError; } });
+Object.defineProperty(exports, "OAuthErrorExtras", { enumerable: true, get: function () { return OAuthProtocolError_1.OAuthErrorExtras; } });
+var OAuthBearerChallenge_1 = require("./oauth/OAuthBearerChallenge");
+Object.defineProperty(exports, "OAuthBearerChallenge", { enumerable: true, get: function () { return OAuthBearerChallenge_1.OAuthBearerChallenge; } });
+var OAuthErrorResponse_1 = require("./oauth/OAuthErrorResponse");
+Object.defineProperty(exports, "OAuthErrorBody", { enumerable: true, get: function () { return OAuthErrorResponse_1.OAuthErrorBody; } });
+Object.defineProperty(exports, "OAuthErrorResponse", { enumerable: true, get: function () { return OAuthErrorResponse_1.OAuthErrorResponse; } });
+var OAuthAuthorizationErrorRedirect_1 = require("./oauth/OAuthAuthorizationErrorRedirect");
+Object.defineProperty(exports, "OAuthAuthorizationErrorRedirect", { enumerable: true, get: function () { return OAuthAuthorizationErrorRedirect_1.OAuthAuthorizationErrorRedirect; } });
 //# sourceMappingURL=index.js.map

package/src/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/core/core-util/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;AAEH,+CAA2C;AAAlC,qGAAA,OAAO,OAAA;AAChB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AAOnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,+EAA+E;AAC/E,kFAAkF;AAClF,yCAAyC;AACzC,mDAA0F;AAAjF,gHAAA,cAAc,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAO/D,yDAAwD;AAA/C,8GAAA,aAAa,OAAA;AACtB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,mDAAkD;AAAzC,wGAAA,UAAU,OAAA;AACnB,mDAM8B;AAL1B,wGAAA,UAAU,OAAA;AACV,4GAAA,cAAc,OAAA;AACd,0GAAA,YAAY,OAAA;AACZ,+GAAA,iBAAiB,OAAA;AACjB,kHAAA,oBAAoB,OAAA;AAGxB,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAElE,4BAA4B;AAC5B,gDA2B2B;AA1BvB,qGAAA,OAAO,OAAA;AACP,sGAAA,QAAQ,OAAA;AACR,mEAAmE;AACnE,0GAAA,YAAY,OAAA;AACZ,oGAAA,MAAM,OAAA;AACN,wHAAA,0BAA0B,OAAA;AAC1B,yGAAA,WAAW,OAAA;AACX,yGAAA,WAAW,OAAA;AACX,qGAAA,OAAO,OAAA;AACP,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,gHAAA,kBAAkB,OAAA;AAClB,kHAAA,oBAAoB,OAAA;AACpB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAChB,yGAAA,WAAW,OAAA;AACX,wGAAA,UAAU,OAAA;AACV,uGAAA,SAAS,OAAA;AACT,uGAAA,SAAS,OAAA;AACT,yGAAA,WAAW,OAAA;AACX,4HAAA,8BAA8B,OAAA;AAC9B,uIAAA,yCAAyC,OAAA;AACzC,sIAAA,wCAAwC,OAAA;AACxC,6HAAA,+BAA+B,OAAA;AAC/B,2GAAA,aAAa,OAAA;AAEjB,8EAI0C;AAHtC,sHAAA,SAAS,OAAA;AACT,uHAAA,UAAU,OAAA;AACV,yIAAA,4BAA4B,OAAA;AAEhC,4EAA6F;AAApF,iHAAA,KAAK,OAAA;AAAE,iHAAA,KAAK,OAAA;AAAE,iHAAA,KAAK,OAAA;AAAE,iIAAA,qBAAqB,OAAA;AAEnD,4CAUyB;AATrB,mGAAA,OAAO,OAAA;AACP,sGAAA,UAAU,OAAA;AACV,6GAAA,iBAAiB,OAAA;AACjB,+FAAA,GAAG,OAAA;AACH,iHAAA,qBAAqB,OAAA;AACrB,6GAAA,iBAAiB,OAAA;AACjB,uGAAA,WAAW,OAAA;AACX,mHAAA,uBAAuB,OAAA;AACvB,wHAAA,4BAA4B,OAAA;AAGhC,qDAW6B;AAVzB,2GAAA,UAAU,OAAA;AACV,8GAAA,aAAa,OAAA;AACb,8GAAA,aAAa,OAAA;AACb,4GAAA,WAAW,OAAA;AACX,gHAAA,eAAe,OAAA;AACf,mHAAA,kBAAkB,OAAA;AAClB,+GAAA,cAAc,OAAA;AACd,kHAAA,iBAAiB,OAAA;AACjB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AAGrB,2FAA2F;AAC3F,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AACtB,oEAAmE;AAA1D,4HAAA,oBAAoB,OAAA;AAC7B,sDAAsH;AAA7G,kHAAA,iBAAiB,OAAA;AAAE,yHAAA,wBAAwB,OAAA;AAAE,gHAAA,eAAe,OAAA;AAAE,iHAAA,gBAAgB,OAAA;AAEvF,wEAAiG;AAAxF,gIAAA,sBAAsB,OAAA;AAAE,kIAAA,wBAAwB,OAAA;AACzD,gEAImC;AAH/B,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,6HAAA,uBAAuB,OAAA;AAE3B,oDAK6B;AAJzB,gHAAA,gBAAgB,OAAA;AAChB,kHAAA,kBAAkB,OAAA;AAClB,oHAAA,oBAAoB,OAAA;AACpB,wHAAA,wBAAwB,OAAA;AAE5B,8DAWkC;AAV9B,sHAAA,iBAAiB,OAAA;AACjB,mHAAA,cAAc,OAAA;AACd,8HAAA,yBAAyB,OAAA;AACzB,yHAAA,oBAAoB,OAAA;AACpB,yHAAA,oBAAoB,OAAA;AACpB,iHAAA,YAAY,OAAA;AACZ,oHAAA,eAAe,OAAA;AACf,6GAAA,QAAQ,OAAA;AACR,yHAAA,oBAAoB,OAAA;AACpB,6HAAA,wBAAwB,OAAA;AAS5B,oDAAgD;AAAvC,mGAAA,GAAG,OAAA;AAAE,oGAAA,IAAI,OAAA;AAOlB,gDAAmG;AAA1F,iGAAA,GAAG,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,kGAAA,IAAI,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,kGAAA,IAAI,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAAE,mGAAA,KAAK,OAAA;AACvE,iDAS2B;AARvB,oHAAA,qBAAqB,OAAA;AACrB,4HAAA,6BAA6B,OAAA;AAC7B,wGAAA,SAAS,OAAA;AACT,6GAAA,cAAc,OAAA;AACd,gHAAA,iBAAiB,OAAA;AACjB,wHAAA,yBAAyB,OAAA;AACzB,4GAAA,aAAa,OAAA;AACb,mHAAA,oBAAoB,OAAA;AAGxB,6CAMyB;AALrB,0GAAA,aAAa,OAAA;AACb,uHAAA,0BAA0B,OAAA;AAC1B,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,gHAAA,mBAAmB,OAAA;AAGvB,+DAIkC;AAH9B,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,uHAAA,iBAAiB,OAAA;AAErB,uEAKsC;AAJlC,gIAAA,sBAAsB,OAAA;AACtB,+HAAA,qBAAqB,OAAA;AACrB,8HAAA,oBAAoB,OAAA;AACpB,8HAAA,oBAAoB,OAAA;AAQxB,+FAA+F;AAC/F,8CAAuG;AAA9F,qGAAA,QAAQ,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,gGAAA,GAAG,OAAA;AAAE,iGAAA,IAAI,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,mGAAA,MAAM,OAAA;AAQ5E,sGAAsG;AACtG,yFAAyF;AACzF,4CASyB;AARrB,+FAAA,GAAG,OAAA;AACH,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,sHAAA,0BAA0B,OAAA;AAC1B,sGAAA,UAAU,OAAA;AACV,yGAAA,aAAa,OAAA;AACb,mHAAA,uBAAuB,OAAA;AACvB,wGAAA,YAAY,OAAA;AAGhB,4DAA4D;AAC5D,sDAAsD;AACtD,mCAAmC;AACnC,0DAMgC;AAL5B,wHAAA,qBAAqB,OAAA;AACrB,sHAAA,mBAAmB,OAAA;AACnB,iHAAA,cAAc,OAAA;AACd,uHAAA,oBAAoB,OAAA;AACpB,oHAAA,iBAAiB,OAAA;AAGrB,4FAA4F;AAC5F,0CAAkD;AAAzC,kGAAA,OAAO,OAAA;AAAE,kGAAA,OAAO,OAAA;AAKzB,oCAAoC;AACpC,mCASkB;AARd,0GAAA,gBAAgB,OAAA;AAChB,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,sGAAA,YAAY,OAAA;AACZ,6GAAA,mBAAmB,OAAA;AACnB,sGAAA,YAAY,OAAA;AACZ,uGAAA,aAAa,OAAA;AACb,qGAAA,WAAW,OAAA;AAGf,sDAA+D;AAAtD,wHAAA,uBAAuB,OAAA;AAEhC,iEAAiE;AACjE,4CASyB;AAJrB,uGAAA,WAAW,OAAA;AACX,oGAAA,QAAQ,OAAA;AACR,oGAAA,QAAQ,OAAA;AACR,wGAAA,YAAY,OAAA;AAGhB,mEAAmE;AACnE,wDAAuD;AAA9C,gHAAA,cAAc,OAAA;AACvB,wDAAuD;AAA9C,gHAAA,cAAc,OAAA;AACvB,oDAAmD;AAA1C,4GAAA,YAAY,OAAA;AACrB,oDAAmD;AAA1C,4GAAA,YAAY,OAAA;AACrB,oDAAkD;AAAzC,2GAAA,WAAW,OAAA;AAEpB,kEAAiE;AAAxD,0HAAA,mBAAmB,OAAA;AAG5B,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAiD;AAAxC,0GAAA,WAAW,OAAA;AACpB,qGAAqG;AACrG,uFAAuF;AACvF,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AAExB,4FAA4F;AAC5F,yFAAyF;AACzF,0DAAyF;AAAhF,6GAAA,UAAU,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAIxD,qGAAqG;AACrG,gFAAgF;AAChF,0FAGgD;AAF5C,kJAAA,+BAA+B,OAAA;AAC/B,qJAAA,kCAAkC,OAAA;AAEtC,iGAAiG;AACjG,qFAAqF;AACrF,0CAAsD;AAA7C,+GAAA,oBAAoB,OAAA;AAE7B,4FAA4F;AAC5F,sEAAqE;AAA5D,4HAAA,oBAAoB,OAAA;AAI7B,8DAAkE;AAAzD,2HAAA,sBAAsB,OAAA;AAC/B,8FAGkD;AAF9C,sJAAA,iCAAiC,OAAA;AACjC,yJAAA,oCAAoC,OAAA;AAExC,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AACxB,oEAAmE;AAA1D,4HAAA,oBAAoB,OAAA;AAI7B,qGAAqG;AACrG,mFAAmF;AACnF,4DAA2D;AAAlD,oHAAA,gBAAgB,OAAA;AAEzB,iGAAiG;AACjG,gGAAgG;AAChG,kEAAkE;AAClE,gDAA+C;AAAtC,wGAAA,UAAU,OAAA;AAEnB,kGAAkG;AAClG,oGAAoG;AACpG,2EAA2E;AAC3E,gDAAmD;AAA1C,4GAAA,cAAc,OAAA;AAEvB,iGAAiG;AACjG,uGAAuG;AACvG,oDAA+C;AAAtC,wGAAA,QAAQ,OAAA;AAGjB,yFAAyF;AACzF,kFAAkF;AAClF,gGAAgG;AAChG,kDAAiD;AAAxC,0GAAA,WAAW,OAAA;AAEpB,oGAAoG;AACpG,wDAI+B;AAH3B,gHAAA,cAAc,OAAA;AACd,oHAAA,kBAAkB,OAAA;AAClB,0HAAA,wBAAwB,OAAA;AAE5B,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AAItB,iFAAiF;AACjF,qEAAkF;AAAvD,gHAAA,YAAY,OAAA;AACvC,qEAI0C;AAHtC,oHAAA,gBAAgB,OAAA;AAChB,iHAAA,aAAa,OAAA;AACb,oHAAA,gBAAgB,OAAA;AAEpB,2DAAgF;AAAvE,0GAAA,WAAW,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAC1C,qEAAoG;AAA3F,oHAAA,gBAAgB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,mHAAA,eAAe,OAAA;AAEzD,gGAAgG;AAChG,2EAA2E;AAC3E,+FAA+F;AAC/F,kGAAkG;AAClG,wFAAwF;AACxF,2CAA0C;AAAjC,gGAAA,MAAM,OAAA;AAEf,qDAAoD;AAA3C,0GAAA,WAAW,OAAA;AAEpB,mCAiCkB;AAhCd,kGAAA,QAAQ,OAAA;AACR,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,4GAAA,kBAAkB,OAAA;AAClB,6GAAA,mBAAmB,OAAA;AACnB,mHAAA,yBAAyB,OAAA;AACzB,gHAAA,sBAAsB,OAAA;AACtB,6GAAA,mBAAmB,OAAA;AACnB,2GAAA,iBAAiB,OAAA;AACjB,gHAAA,sBAAsB,OAAA;AACtB,yGAAA,eAAe,OAAA;AACf,4GAAA,kBAAkB,OAAA;AAClB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,4GAAA,kBAAkB,OAAA;AAClB,kHAAA,wBAAwB,OAAA;AACxB,0GAAA,gBAAgB,OAAA;AAChB,+GAAA,qBAAqB,OAAA;AACrB,oHAAA,0BAA0B,OAAA;AAC1B,sHAAA,4BAA4B,OAAA;AAC5B,gHAAA,sBAAsB,OAAA;AACtB,uGAAA,aAAa,OAAA;AACb,8GAAA,oBAAoB,OAAA;AACpB,iHAAA,uBAAuB,OAAA;AACvB,kHAAA,wBAAwB,OAAA;AACxB,mHAAA,yBAAyB,OAAA;AACzB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,oGAAA,UAAU,OAAA;AACV,uGAAA,aAAa,OAAA;AACb,yGAAA,eAAe,OAAA;AACf,0GAAA,gBAAgB,OAAA;AAQpB,gEAA+D;AAAtD,wHAAA,kBAAkB,OAAA","sourcesContent":["/*\n @webpieces/core-util\n \n Utility functions for WebPieces applications.\n * This package works in both browser and Node.js environments.\n \n @packageDocumentation\n */\n\nexport { toError } from './lib/errorUtils';\nexport { ContextKey } from './ContextKey';\nexport type {\n AnyContextKey,\n AnyTrustedContextKey,\n AnyUntrustedContextKey,\n Trust,\n} from './ContextKey';\nexport { ContextTuple } from './ContextTuple';\n\n// @DocumentDesign — DI-design-root marker. Applies to ANY project kind (server\n// controllers AND library impl classes), so it lives here (browser + Node) rather\n// than in a server-only routing package.\nexport { DocumentDesign, isDocumentDesign, DESIGN_METADATA_KEYS } from './DocumentDesign';\n\n// Logging (merged from former @webpieces/wp-logging).\n// Pluggable logging interface + a browser-safe console default; apps plug in\n// bunyan/winston/pino/etc. via LogManager.setFactory(...). Browser + Node.\nexport type { Logger, LogLevel } from './logging/Logger';\nexport type { LoggerFactory } from './logging/LoggerFactory';\nexport { ConsoleLogger } from './logging/ConsoleLogger';\nexport { ConsoleLoggerFactory } from './logging/ConsoleLoggerFactory';\nexport { LogManager } from './logging/LogManager';\nexport {\n LogChunker,\n LogChunkerImpl,\n LogChunkInfo,\n MAX_GCP_LOG_BYTES,\n GCP_LOG_BUDGET_BYTES,\n} from './logging/LogChunker';\n\n// HTTP API contract (merged from former @webpieces/http-api).\n// Shared HTTP API definition consumed by both client and server: REST\n// decorators, the API error taxonomy, datetime DTOs, platform-header\n// registry/readers, ValidateImplementation, and the test-case recorder\n// contract. Pure definitions — express-free, browser + Node safe.\n\n// API definition decorators\nexport {\n ApiPath,\n Endpoint,\n // Auth mode decorators (clean service-to-service + user JWT model)\n WpAuthPublic,\n WpAuth,\n MISSING_AUTH_DECORATOR_FIX,\n WpLocalOnly,\n isLocalOnly,\n MaskLog,\n getApiPath,\n getEndpoints,\n getEndpointHttpMethod,\n getEndpointOptions,\n getEndpointOperation,\n getEndpointKind,\n getEndpointKinds,\n getMaskSpec,\n isFormPost,\n isRawBody,\n isApiPath,\n getAuthMeta,\n assertEveryEndpointHasAuthMode,\n assertEveryExternalEndpointDeclaresCaller,\n assertEveryWebhookEndpointRetainsRawBody,\n validateNoConflictingDecorators,\n METADATA_KEYS,\n} from './http/decorators';\nexport {\n PathParam,\n QueryParam,\n getHttpParameterDeclarations,\n} from './http/http-parameter-decorators';\nexport { WpInt, WpMin, WpMax, NUMERIC_METADATA_KEYS } from './http/numeric-field-decorators';\nexport type { Integer } from './http/numeric-field-decorators';\nexport {\n ApiType,\n SVC_TO_SVC,\n EXTERNAL_CUSTOMER,\n MCP,\n API_TYPE_METADATA_KEY,\n DEFAULT_API_TYPES,\n getApiTypes,\n getApiTypeEndpointNames,\n assertApiTypeMatchesMcpTools,\n} from './http/api-type';\nexport type { ApiTypeKind } from './http/api-type';\nexport {\n WpInternal,\n WpIpcEndpoint,\n isInternalApi,\n getIpcApiId,\n getIpcEndpoints,\n getIpcEndpointKind,\n getIpcMaskSpec,\n assertInternalApi,\n assertNotInternalApi,\n IPC_METADATA_KEYS,\n} from './ipc/IpcDecorators';\nexport type { IpcApiType, IpcEndpointKind, IpcEndpointOptions } from './ipc/IpcDecorators';\n// The runtime representation of ONE route (split out of decorators.ts for file size only).\nexport { RouteMetadata } from './http/RouteMetadata';\nexport { RouteMetadataFactory } from './http/RouteMetadataFactory';\nexport { AuthorizationType, AuthorizationDeclaration, WpAuthorization, getAuthorization } from './http/authorization';\nexport type { AuthorizationRequirement } from './http/authorization';\nexport { StreamingSchemaCatalog, registerStreamingCatalog } from './http/StreamingSchemaCatalog';\nexport {\n StreamErrorControl,\n StreamProtocolError,\n StreamDisconnectedError,\n} from './http/StreamErrorControl';\nexport {\n BoundHttpRequest,\n HttpContractMapper,\n HttpParameterBinding,\n HttpParameterDeclaration,\n} from './http/HttpContract';\nexport {\n StreamCorrelation,\n StreamEnvelope,\n StreamingEndpointMetadata,\n StreamEventValidator,\n StreamTransportError,\n StreamWriter,\n StreamDirection,\n WpStream,\n getStreamingEndpoint,\n registerStreamingSchemas,\n} from './http/StreamingContract';\nexport type { RequestStream, ResponseStream, StreamEnvelopeKind } from './http/StreamingContract';\nexport type {\n EndpointResponseType,\n HttpMethod,\n HttpParameterSource,\n HttpParameterValueType,\n} from './http/HttpContract';\nexport { GET, POST } from './http/HttpContract';\nexport type {\n EndpointKind,\n EndpointOperation,\n EndpointOptions,\n ExternalEndpointOptions,\n} from './http/decorators';\nexport { RPC, CLOUDTASKS, CRON, EXTERNAL, READ, WRITE_IDEMPOTENT, WRITE } from './http/decorators';\nexport {\n InvalidEndpointForMcp,\n InvalidEndpointForMcpMetadata,\n WpMcpTool,\n WpMcpToolHints,\n WpMcpToolMetadata,\n getInvalidEndpointsForMcp,\n getWpMcpTools,\n mcpHintsForOperation,\n} from './mcp/McpMetadata';\nexport type { WpMcpMethodDecorator } from './mcp/McpMetadata';\nexport {\n ApiJsonSchema,\n ApiJsonSchemaDiscriminator,\n ApiJsonSchemaValidator,\n DtoValidationFailure,\n ObjectSchemaBuilder,\n} from './mcp/DtoSchema';\nexport type { ApiJsonSchemaType, DtoValue } from './mcp/DtoSchema';\nexport {\n McpToolCatalogFile,\n McpToolCatalogError,\n McpToolDefinition,\n} from './mcp/McpToolCatalogFile';\nexport {\n GeneratedApiDocsLayout,\n GenerateLayoutProblem,\n GenerateOutputLookup,\n GenerateOutputTarget,\n} from './mcp/GeneratedApiDocsLayout';\nexport type {\n LayoutDependsOn,\n LayoutDependsOnObject,\n LayoutTarget,\n LayoutTargets,\n} from './mcp/GeneratedApiDocsLayout';\n// The TYPE layer of the auth surface — likewise split out of decorators.ts for file size only.\nexport { AuthMeta, AuthDeclaration, jwt, oidc, sharedSecret, webhook, apiKey } from './http/auth-mode';\nexport type {\n AuthMode,\n ApiKeyCredential,\n ApiKeyCredentials,\n AuthMethod,\n AuthMethods,\n} from './http/auth-mode';\n// API kind (RPC vs PubSub/Cloud Tasks) + queue naming. Split out of decorators.ts for file size only;\n// one-way dependency api-kind -> decorators, and the barrel keeps the surface identical.\nexport {\n Rpc,\n PubSub,\n Queue,\n ENDPOINT_KINDS_BY_API_KIND,\n getApiKind,\n assertApiKind,\n assertPubSubConventions,\n getQueueName,\n} from './http/api-kind';\nexport type { ApiKind } from './http/api-kind';\n// WHO calls an `external` endpoint — the caller declaration\n// @Endpoint(POST, ..., WRITE, EXTERNAL, { calledBy })\n// requires, and the reader for it.\nexport {\n EXTERNAL_SYSTEM_KINDS,\n DEFAULT_CALLER_KIND,\n ExternalCaller,\n isExternalSystemKind,\n getEndpointCaller,\n} from './http/external-caller';\nexport type { ExternalSystemKind } from './http/external-caller';\n// Client-side shared-secret store (the value THIS service sends per sharedSecret(...) key).\nexport { Secrets, SECRETS } from './http/Secrets';\n\n// Type validators\nexport { ValidateImplementation } from './http/validators';\n\n// Authentication subtype constants.\nexport {\n ENTITY_NOT_FOUND,\n WRONG_LOGIN_TYPE,\n WRONG_LOGIN,\n NOT_APPROVED,\n EMAIL_NOT_CONFIRMED,\n WRONG_DOMAIN,\n WRONG_COMPANY,\n NO_REG_CODE,\n} from './errors';\n\nexport { NetworkRejectClassifier } from './http/networkReject';\n\n// Date/Time DTOs and Utilities (inspired by Java Time / JSR-310)\nexport {\n InstantDto,\n DateDto,\n TimeDto,\n DateTimeDto,\n InstantUtil,\n DateUtil,\n TimeUtil,\n DateTimeUtil,\n} from './http/datetime';\n\n// Context keys + registry (the global magic-context header system)\nexport { HeaderRegistry } from './http/HeaderRegistry';\nexport { ClientRegistry } from './http/ClientRegistry';\nexport { CallRegistry } from './http/CallRegistry';\nexport { CallDeadline } from './http/CallDeadline';\nexport { CallContext } from './http/CallStrategy';\nexport type { Attempt, CallStrategy } from './http/CallStrategy';\nexport { ApiCallTimeoutError } from './http/ApiCallTimeoutError';\nexport type { ServiceUrlDeriver } from './http/ClientRegistry';\n\n// \"What service am I\" — set once at startup, read by the logging backends and by\n// RequestContextHeaders (to stamp requestIdSource on ids this service mints).\nexport { ServiceInfo } from './http/ServiceInfo';\n// \"Where am I running\" — declared once at startup (setupRuntime, from RuntimeSetupOptions.locality).\n// The ONE input to @WpLocalOnly enforcement. Undeclared reads as DEPLOYED (fail safe).\nexport { RuntimeLocality } from './http/RuntimeLocality';\nexport type { Locality } from './http/RuntimeLocality';\n// The ENTIRE HTTP response as pure data — the ONE form both transports (express, fetch) are\n// normalised into, so an ErrorTranslator implementation is written once and serves both.\nexport { HttpHeader, HttpResponseStatus, HttpResponseDto } from './http/HttpResponseDto';\n// Pluggable, bidirectional error translation (app exception <-> the WHOLE response). Set on\n// ClientRegistry at startup; consulted before the built-in webpieces mapping on BOTH sides.\nexport type { ErrorTranslator } from './http/ErrorTranslator';\n// THE webpieces default translator — always installed, and what an app's own translator delegates to\n// in order to decline an error. ONE class, both halves, node and browser alike.\nexport {\n WebpiecesDefaultErrorTranslator,\n WEBPIECES_DEFAULT_ERROR_TRANSLATOR,\n} from './http/WebpiecesDefaultErrorTranslator';\n// WHICH KIND OF CALLER drove this request (gui / llm / public-api), and the per-request end-user\n// status derived from it — the replacement for the deleted per-router EndUserStatus.\nexport { SurfaceEndUserStatus } from './http/Surface';\nexport type { Surface } from './http/Surface';\n// The ONE rule for an error RECEIVED from another process, shared verbatim by HTTP and IPC.\nexport { ReceivedApiErrorRule } from './errors/ReceivedApiErrorRule';\n// Pluggable per-client failure classification (is a thrown API-call error a real failure or an\n// expected non-failure?). Registered on ClientRegistry at startup; consulted by LogApiCall.\nexport type { FailureClassifier } from './http/FailureClassifier';\nexport { KeyedFailureClassifier } from './http/FailureClassifier';\nexport {\n WebpiecesDefaultFailureClassifier,\n WEBPIECES_DEFAULT_FAILURE_CLASSIFIER,\n} from './http/WebpiecesDefaultFailureClassifier';\nexport { templateDeriver } from './http/templateDeriver';\nexport { WebpiecesCoreHeaders } from './http/WebpiecesCoreHeaders';\nexport { ContextReader } from './http/ContextReader';\nexport { ContextWriter, ContextStore } from './http/ContextWriter';\n\n// The OUTBOUND half of the trust model: whether a TRUSTED context key may ride to the endpoint being\n// called. Built ONLY from the destination endpoint's AuthMode — see the class doc.\nexport { DestinationTrust } from './http/DestinationTrust';\n\n// BROWSER-ONLY outbound-header propagation (app-held store + registry -> outbound HTTP headers).\n// Only @webpieces/http-client-browser may name it; the server reads RequestContext directly via\n// RequestContextHeaders in the Node-only @webpieces/core-context.\nexport { ContextMgr } from './http/ContextMgr';\n\n// API-call logging helper (uses LogManager above). NOT a singleton: construct one per environment\n// with that environment's ApiCallContext — `new LogApiCallImpl(new RequestContextApiCallContext())`\n// on node, `new LogApiCallImpl(new BrowserApiCallContext())` in a browser.\nexport { LogApiCallImpl } from './http/LogApiCall';\n\n// Opt-in field masking for the LogApiCall log path — declare per-api sensitive fields so secrets\n// (OAuth refresh tokens, id-token JWTs) are masked in the logs while the real value stays on the wire.\nexport { MaskSpec } from './http/LogFieldMask';\nexport type { MaskMode } from './http/LogFieldMask';\n\n// The structured `api` tag + the context-writer seam LogApiCall stamps through. The Node\n// RequestContext-backed impl lives in @webpieces/core-context, the browser one in\n// @webpieces/http-client-browser; each is CONSTRUCTED by its package, never installed globally.\nexport { ApiCallInfo } from './http/ApiCallInfo';\nexport type { ApiCallDirection, ApiResult } from './http/ApiCallInfo';\n// Console-render bridge: turns LogApiCall's [LogApiCall] bracket into [API.{side}.{phase}] locally.\nexport {\n ApiCallLogName,\n ApiCallLogNameImpl,\n LOG_API_CALL_LOGGER_NAME,\n} from './http/ApiCallLogName';\nexport { ApiMethodInfo } from './http/ApiMethodInfo';\nexport type { ApiSide } from './http/ApiMethodInfo';\nexport type { ApiCallContext } from './http/ApiCallContext';\n\n// Test-case recording contract (impl lives in http-server; hooks in http-client)\nexport { TestCaseRecorder, RecorderKeys } from './http/recorder/TestCaseRecorder';\nexport {\n RecordedEndpoint,\n RecordedError,\n RecordedTestCase,\n} from './http/recorder/RecordedEndpoint';\nexport { DoNotRecord, getDoNotRecordFields } from './http/recorder/DoNotRecord';\nexport { RecordSerializer, SerializedMap, SerializedError } from './http/recorder/RecordSerializer';\n\n// ---------------------------------------------------------------------------------------------\n// Filter-chain primitives, shared by BOTH chains: the inbound server chain\n// (`Filter<MethodMeta, WpResponse<unknown>>`, @webpieces/http-routing) and the outbound client\n// chain (`Filter<ClientRequest, Response>`, @webpieces/http-client-core). Declared once, here, in\n// the package both depend on — see the class doc for why a second pair would be a shim.\nexport { Filter } from './filters/Filter';\nexport type { Service } from './filters/Filter';\nexport { FilterChain } from './filters/FilterChain';\n\nexport {\n ApiError,\n ApiNotFoundError,\n ApiDependencyError,\n ApiBadGatewayError,\n ApiUnavailableError,\n ApiDependencyTimeoutError,\n ApiImplementationError,\n ApiRateLimitedError,\n ApiForbiddenError,\n ApiRequestTimeoutError,\n ApiEndUserError,\n ApiBadRequestError,\n ApiUnauthorizedError,\n ApiDependencyBackoffError,\n ApiConnectionError,\n ApiEndpointNotFoundError,\n ApiConflictError,\n ApiUnprocessableError,\n ApiPreconditionFailedError,\n ApiUnsupportedMediaTypeError,\n ApiNotImplementedError,\n ApiCodedError,\n ApiClientTooOldError,\n ApiEndUserNotFoundError,\n ApiEndUserForbiddenError,\n ApiEndUserBadRequestError,\n EndUserErrorCode,\n EndUserErrorRegistry,\n ClientRole,\n ApiErrorCodec,\n ApiErrorPayload,\n ApiErrorBoundary,\n} from './errors';\nexport type {\n ApiErrorKind,\n ApiStatusCode,\n EdgeHttpStatus,\n EndUserErrorFactory,\n} from './errors';\nexport { ApiErrorHttpStatus } from './http/ApiErrorHttpStatus';\nexport type { PublishedKind, PublishedApiError } from './http/ApiErrorHttpStatus';\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/core/core-util/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;AAEH,+CAA2C;AAAlC,qGAAA,OAAO,OAAA;AAChB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AAOnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,+EAA+E;AAC/E,kFAAkF;AAClF,yCAAyC;AACzC,mDAA0F;AAAjF,gHAAA,cAAc,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAO/D,yDAAwD;AAA/C,8GAAA,aAAa,OAAA;AACtB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,mDAAkD;AAAzC,wGAAA,UAAU,OAAA;AACnB,mDAM8B;AAL1B,wGAAA,UAAU,OAAA;AACV,4GAAA,cAAc,OAAA;AACd,0GAAA,YAAY,OAAA;AACZ,+GAAA,iBAAiB,OAAA;AACjB,kHAAA,oBAAoB,OAAA;AAGxB,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAElE,4BAA4B;AAC5B,gDA2B2B;AA1BvB,qGAAA,OAAO,OAAA;AACP,sGAAA,QAAQ,OAAA;AACR,mEAAmE;AACnE,0GAAA,YAAY,OAAA;AACZ,oGAAA,MAAM,OAAA;AACN,wHAAA,0BAA0B,OAAA;AAC1B,yGAAA,WAAW,OAAA;AACX,yGAAA,WAAW,OAAA;AACX,qGAAA,OAAO,OAAA;AACP,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,gHAAA,kBAAkB,OAAA;AAClB,kHAAA,oBAAoB,OAAA;AACpB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAChB,yGAAA,WAAW,OAAA;AACX,wGAAA,UAAU,OAAA;AACV,uGAAA,SAAS,OAAA;AACT,uGAAA,SAAS,OAAA;AACT,yGAAA,WAAW,OAAA;AACX,4HAAA,8BAA8B,OAAA;AAC9B,uIAAA,yCAAyC,OAAA;AACzC,sIAAA,wCAAwC,OAAA;AACxC,6HAAA,+BAA+B,OAAA;AAC/B,2GAAA,aAAa,OAAA;AAEjB,8EAI0C;AAHtC,sHAAA,SAAS,OAAA;AACT,uHAAA,UAAU,OAAA;AACV,yIAAA,4BAA4B,OAAA;AAEhC,4EAA6F;AAApF,iHAAA,KAAK,OAAA;AAAE,iHAAA,KAAK,OAAA;AAAE,iHAAA,KAAK,OAAA;AAAE,iIAAA,qBAAqB,OAAA;AAEnD,4CAUyB;AATrB,mGAAA,OAAO,OAAA;AACP,sGAAA,UAAU,OAAA;AACV,6GAAA,iBAAiB,OAAA;AACjB,+FAAA,GAAG,OAAA;AACH,iHAAA,qBAAqB,OAAA;AACrB,6GAAA,iBAAiB,OAAA;AACjB,uGAAA,WAAW,OAAA;AACX,mHAAA,uBAAuB,OAAA;AACvB,wHAAA,4BAA4B,OAAA;AAGhC,qDAW6B;AAVzB,2GAAA,UAAU,OAAA;AACV,8GAAA,aAAa,OAAA;AACb,8GAAA,aAAa,OAAA;AACb,4GAAA,WAAW,OAAA;AACX,gHAAA,eAAe,OAAA;AACf,mHAAA,kBAAkB,OAAA;AAClB,+GAAA,cAAc,OAAA;AACd,kHAAA,iBAAiB,OAAA;AACjB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AAGrB,2FAA2F;AAC3F,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AACtB,oEAAmE;AAA1D,4HAAA,oBAAoB,OAAA;AAC7B,sDAAsH;AAA7G,kHAAA,iBAAiB,OAAA;AAAE,yHAAA,wBAAwB,OAAA;AAAE,gHAAA,eAAe,OAAA;AAAE,iHAAA,gBAAgB,OAAA;AAEvF,wEAAiG;AAAxF,gIAAA,sBAAsB,OAAA;AAAE,kIAAA,wBAAwB,OAAA;AACzD,gEAImC;AAH/B,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,6HAAA,uBAAuB,OAAA;AAE3B,oDAK6B;AAJzB,gHAAA,gBAAgB,OAAA;AAChB,kHAAA,kBAAkB,OAAA;AAClB,oHAAA,oBAAoB,OAAA;AACpB,wHAAA,wBAAwB,OAAA;AAE5B,8DAWkC;AAV9B,sHAAA,iBAAiB,OAAA;AACjB,mHAAA,cAAc,OAAA;AACd,8HAAA,yBAAyB,OAAA;AACzB,yHAAA,oBAAoB,OAAA;AACpB,yHAAA,oBAAoB,OAAA;AACpB,iHAAA,YAAY,OAAA;AACZ,oHAAA,eAAe,OAAA;AACf,6GAAA,QAAQ,OAAA;AACR,yHAAA,oBAAoB,OAAA;AACpB,6HAAA,wBAAwB,OAAA;AAS5B,oDAAgD;AAAvC,mGAAA,GAAG,OAAA;AAAE,oGAAA,IAAI,OAAA;AAOlB,gDAAmG;AAA1F,iGAAA,GAAG,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,kGAAA,IAAI,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,kGAAA,IAAI,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAAE,mGAAA,KAAK,OAAA;AACvE,iDAS2B;AARvB,oHAAA,qBAAqB,OAAA;AACrB,4HAAA,6BAA6B,OAAA;AAC7B,wGAAA,SAAS,OAAA;AACT,6GAAA,cAAc,OAAA;AACd,gHAAA,iBAAiB,OAAA;AACjB,wHAAA,yBAAyB,OAAA;AACzB,4GAAA,aAAa,OAAA;AACb,mHAAA,oBAAoB,OAAA;AAGxB,6CAMyB;AALrB,0GAAA,aAAa,OAAA;AACb,uHAAA,0BAA0B,OAAA;AAC1B,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,gHAAA,mBAAmB,OAAA;AAGvB,+DAIkC;AAH9B,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,uHAAA,iBAAiB,OAAA;AAErB,uEAKsC;AAJlC,gIAAA,sBAAsB,OAAA;AACtB,+HAAA,qBAAqB,OAAA;AACrB,8HAAA,oBAAoB,OAAA;AACpB,8HAAA,oBAAoB,OAAA;AAQxB,+FAA+F;AAC/F,8CAAuG;AAA9F,qGAAA,QAAQ,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,gGAAA,GAAG,OAAA;AAAE,iGAAA,IAAI,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,mGAAA,MAAM,OAAA;AAQ5E,sGAAsG;AACtG,yFAAyF;AACzF,4CASyB;AARrB,+FAAA,GAAG,OAAA;AACH,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,sHAAA,0BAA0B,OAAA;AAC1B,sGAAA,UAAU,OAAA;AACV,yGAAA,aAAa,OAAA;AACb,mHAAA,uBAAuB,OAAA;AACvB,wGAAA,YAAY,OAAA;AAGhB,4DAA4D;AAC5D,sDAAsD;AACtD,mCAAmC;AACnC,0DAMgC;AAL5B,wHAAA,qBAAqB,OAAA;AACrB,sHAAA,mBAAmB,OAAA;AACnB,iHAAA,cAAc,OAAA;AACd,uHAAA,oBAAoB,OAAA;AACpB,oHAAA,iBAAiB,OAAA;AAGrB,4FAA4F;AAC5F,0CAAkD;AAAzC,kGAAA,OAAO,OAAA;AAAE,kGAAA,OAAO,OAAA;AAKzB,oCAAoC;AACpC,mCASkB;AARd,0GAAA,gBAAgB,OAAA;AAChB,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,sGAAA,YAAY,OAAA;AACZ,6GAAA,mBAAmB,OAAA;AACnB,sGAAA,YAAY,OAAA;AACZ,uGAAA,aAAa,OAAA;AACb,qGAAA,WAAW,OAAA;AAGf,sDAA+D;AAAtD,wHAAA,uBAAuB,OAAA;AAEhC,iEAAiE;AACjE,4CASyB;AAJrB,uGAAA,WAAW,OAAA;AACX,oGAAA,QAAQ,OAAA;AACR,oGAAA,QAAQ,OAAA;AACR,wGAAA,YAAY,OAAA;AAGhB,mEAAmE;AACnE,wDAAuD;AAA9C,gHAAA,cAAc,OAAA;AACvB,wDAAuD;AAA9C,gHAAA,cAAc,OAAA;AACvB,oDAAmD;AAA1C,4GAAA,YAAY,OAAA;AACrB,oDAAmD;AAA1C,4GAAA,YAAY,OAAA;AACrB,oDAAkD;AAAzC,2GAAA,WAAW,OAAA;AAEpB,kEAAiE;AAAxD,0HAAA,mBAAmB,OAAA;AAG5B,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAiD;AAAxC,0GAAA,WAAW,OAAA;AACpB,qGAAqG;AACrG,uFAAuF;AACvF,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AAExB,4FAA4F;AAC5F,yFAAyF;AACzF,0DAAyF;AAAhF,6GAAA,UAAU,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAIxD,qGAAqG;AACrG,gFAAgF;AAChF,0FAGgD;AAF5C,kJAAA,+BAA+B,OAAA;AAC/B,qJAAA,kCAAkC,OAAA;AAEtC,iGAAiG;AACjG,qFAAqF;AACrF,0CAAsD;AAA7C,+GAAA,oBAAoB,OAAA;AAE7B,4FAA4F;AAC5F,sEAAqE;AAA5D,4HAAA,oBAAoB,OAAA;AAI7B,8DAAkE;AAAzD,2HAAA,sBAAsB,OAAA;AAC/B,8FAGkD;AAF9C,sJAAA,iCAAiC,OAAA;AACjC,yJAAA,oCAAoC,OAAA;AAExC,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AACxB,oEAAmE;AAA1D,4HAAA,oBAAoB,OAAA;AAI7B,qGAAqG;AACrG,mFAAmF;AACnF,4DAA2D;AAAlD,oHAAA,gBAAgB,OAAA;AAEzB,iGAAiG;AACjG,gGAAgG;AAChG,kEAAkE;AAClE,gDAA+C;AAAtC,wGAAA,UAAU,OAAA;AAEnB,kGAAkG;AAClG,oGAAoG;AACpG,2EAA2E;AAC3E,gDAAmD;AAA1C,4GAAA,cAAc,OAAA;AAEvB,iGAAiG;AACjG,uGAAuG;AACvG,oDAA+C;AAAtC,wGAAA,QAAQ,OAAA;AAGjB,yFAAyF;AACzF,kFAAkF;AAClF,gGAAgG;AAChG,kDAAiD;AAAxC,0GAAA,WAAW,OAAA;AAEpB,oGAAoG;AACpG,wDAI+B;AAH3B,gHAAA,cAAc,OAAA;AACd,oHAAA,kBAAkB,OAAA;AAClB,0HAAA,wBAAwB,OAAA;AAE5B,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AAItB,iFAAiF;AACjF,qEAAkF;AAAvD,gHAAA,YAAY,OAAA;AACvC,qEAI0C;AAHtC,oHAAA,gBAAgB,OAAA;AAChB,iHAAA,aAAa,OAAA;AACb,oHAAA,gBAAgB,OAAA;AAEpB,2DAAgF;AAAvE,0GAAA,WAAW,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAC1C,qEAAoG;AAA3F,oHAAA,gBAAgB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,mHAAA,eAAe,OAAA;AAEzD,gGAAgG;AAChG,2EAA2E;AAC3E,+FAA+F;AAC/F,kGAAkG;AAClG,wFAAwF;AACxF,2CAA0C;AAAjC,gGAAA,MAAM,OAAA;AAEf,qDAAoD;AAA3C,0GAAA,WAAW,OAAA;AAEpB,mCAoCkB;AAnCd,kGAAA,QAAQ,OAAA;AACR,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,4GAAA,kBAAkB,OAAA;AAClB,6GAAA,mBAAmB,OAAA;AACnB,mHAAA,yBAAyB,OAAA;AACzB,gHAAA,sBAAsB,OAAA;AACtB,6GAAA,mBAAmB,OAAA;AACnB,2GAAA,iBAAiB,OAAA;AACjB,gHAAA,sBAAsB,OAAA;AACtB,yGAAA,eAAe,OAAA;AACf,4GAAA,kBAAkB,OAAA;AAClB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,4GAAA,kBAAkB,OAAA;AAClB,kHAAA,wBAAwB,OAAA;AACxB,0GAAA,gBAAgB,OAAA;AAChB,+GAAA,qBAAqB,OAAA;AACrB,oHAAA,0BAA0B,OAAA;AAC1B,sHAAA,4BAA4B,OAAA;AAC5B,gHAAA,sBAAsB,OAAA;AACtB,uGAAA,aAAa,OAAA;AACb,8GAAA,oBAAoB,OAAA;AACpB,iHAAA,uBAAuB,OAAA;AACvB,kHAAA,wBAAwB,OAAA;AACxB,mHAAA,yBAAyB,OAAA;AACzB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,oGAAA,UAAU,OAAA;AACV,uGAAA,aAAa,OAAA;AACb,yGAAA,eAAe,OAAA;AACf,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,8GAAA,oBAAoB,OAAA;AACpB,uGAAA,aAAa,OAAA;AASjB,gEAA+D;AAAtD,wHAAA,kBAAkB,OAAA;AAE3B,iGAAiG;AACjG,gGAAgG;AAChG,yDAAqF;AAA5E,gHAAA,cAAc,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAAE,2GAAA,SAAS,OAAA;AAQpD,iEAAkF;AAAzE,wHAAA,kBAAkB,OAAA;AAAE,sHAAA,gBAAgB,OAAA;AAC7C,qEAAoE;AAA3D,4HAAA,oBAAoB,OAAA;AAC7B,iEAAgF;AAAvE,oHAAA,cAAc,OAAA;AAAE,wHAAA,kBAAkB,OAAA;AAC3C,2FAA0F;AAAjF,kJAAA,+BAA+B,OAAA","sourcesContent":["/*\n @webpieces/core-util\n \n Utility functions for WebPieces applications.\n * This package works in both browser and Node.js environments.\n \n @packageDocumentation\n */\n\nexport { toError } from './lib/errorUtils';\nexport { ContextKey } from './ContextKey';\nexport type {\n AnyContextKey,\n AnyTrustedContextKey,\n AnyUntrustedContextKey,\n Trust,\n} from './ContextKey';\nexport { ContextTuple } from './ContextTuple';\n\n// @DocumentDesign — DI-design-root marker. Applies to ANY project kind (server\n// controllers AND library impl classes), so it lives here (browser + Node) rather\n// than in a server-only routing package.\nexport { DocumentDesign, isDocumentDesign, DESIGN_METADATA_KEYS } from './DocumentDesign';\n\n// Logging (merged from former @webpieces/wp-logging).\n// Pluggable logging interface + a browser-safe console default; apps plug in\n// bunyan/winston/pino/etc. via LogManager.setFactory(...). Browser + Node.\nexport type { Logger, LogLevel } from './logging/Logger';\nexport type { LoggerFactory } from './logging/LoggerFactory';\nexport { ConsoleLogger } from './logging/ConsoleLogger';\nexport { ConsoleLoggerFactory } from './logging/ConsoleLoggerFactory';\nexport { LogManager } from './logging/LogManager';\nexport {\n LogChunker,\n LogChunkerImpl,\n LogChunkInfo,\n MAX_GCP_LOG_BYTES,\n GCP_LOG_BUDGET_BYTES,\n} from './logging/LogChunker';\n\n// HTTP API contract (merged from former @webpieces/http-api).\n// Shared HTTP API definition consumed by both client and server: REST\n// decorators, the API error taxonomy, datetime DTOs, platform-header\n// registry/readers, ValidateImplementation, and the test-case recorder\n// contract. Pure definitions — express-free, browser + Node safe.\n\n// API definition decorators\nexport {\n ApiPath,\n Endpoint,\n // Auth mode decorators (clean service-to-service + user JWT model)\n WpAuthPublic,\n WpAuth,\n MISSING_AUTH_DECORATOR_FIX,\n WpLocalOnly,\n isLocalOnly,\n MaskLog,\n getApiPath,\n getEndpoints,\n getEndpointHttpMethod,\n getEndpointOptions,\n getEndpointOperation,\n getEndpointKind,\n getEndpointKinds,\n getMaskSpec,\n isFormPost,\n isRawBody,\n isApiPath,\n getAuthMeta,\n assertEveryEndpointHasAuthMode,\n assertEveryExternalEndpointDeclaresCaller,\n assertEveryWebhookEndpointRetainsRawBody,\n validateNoConflictingDecorators,\n METADATA_KEYS,\n} from './http/decorators';\nexport {\n PathParam,\n QueryParam,\n getHttpParameterDeclarations,\n} from './http/http-parameter-decorators';\nexport { WpInt, WpMin, WpMax, NUMERIC_METADATA_KEYS } from './http/numeric-field-decorators';\nexport type { Integer } from './http/numeric-field-decorators';\nexport {\n ApiType,\n SVC_TO_SVC,\n EXTERNAL_CUSTOMER,\n MCP,\n API_TYPE_METADATA_KEY,\n DEFAULT_API_TYPES,\n getApiTypes,\n getApiTypeEndpointNames,\n assertApiTypeMatchesMcpTools,\n} from './http/api-type';\nexport type { ApiTypeKind } from './http/api-type';\nexport {\n WpInternal,\n WpIpcEndpoint,\n isInternalApi,\n getIpcApiId,\n getIpcEndpoints,\n getIpcEndpointKind,\n getIpcMaskSpec,\n assertInternalApi,\n assertNotInternalApi,\n IPC_METADATA_KEYS,\n} from './ipc/IpcDecorators';\nexport type { IpcApiType, IpcEndpointKind, IpcEndpointOptions } from './ipc/IpcDecorators';\n// The runtime representation of ONE route (split out of decorators.ts for file size only).\nexport { RouteMetadata } from './http/RouteMetadata';\nexport { RouteMetadataFactory } from './http/RouteMetadataFactory';\nexport { AuthorizationType, AuthorizationDeclaration, WpAuthorization, getAuthorization } from './http/authorization';\nexport type { AuthorizationRequirement } from './http/authorization';\nexport { StreamingSchemaCatalog, registerStreamingCatalog } from './http/StreamingSchemaCatalog';\nexport {\n StreamErrorControl,\n StreamProtocolError,\n StreamDisconnectedError,\n} from './http/StreamErrorControl';\nexport {\n BoundHttpRequest,\n HttpContractMapper,\n HttpParameterBinding,\n HttpParameterDeclaration,\n} from './http/HttpContract';\nexport {\n StreamCorrelation,\n StreamEnvelope,\n StreamingEndpointMetadata,\n StreamEventValidator,\n StreamTransportError,\n StreamWriter,\n StreamDirection,\n WpStream,\n getStreamingEndpoint,\n registerStreamingSchemas,\n} from './http/StreamingContract';\nexport type { RequestStream, ResponseStream, StreamEnvelopeKind } from './http/StreamingContract';\nexport type {\n EndpointResponseType,\n HttpMethod,\n HttpParameterSource,\n HttpParameterValueType,\n} from './http/HttpContract';\nexport { GET, POST } from './http/HttpContract';\nexport type {\n EndpointKind,\n EndpointOperation,\n EndpointOptions,\n ExternalEndpointOptions,\n} from './http/decorators';\nexport { RPC, CLOUDTASKS, CRON, EXTERNAL, READ, WRITE_IDEMPOTENT, WRITE } from './http/decorators';\nexport {\n InvalidEndpointForMcp,\n InvalidEndpointForMcpMetadata,\n WpMcpTool,\n WpMcpToolHints,\n WpMcpToolMetadata,\n getInvalidEndpointsForMcp,\n getWpMcpTools,\n mcpHintsForOperation,\n} from './mcp/McpMetadata';\nexport type { WpMcpMethodDecorator } from './mcp/McpMetadata';\nexport {\n ApiJsonSchema,\n ApiJsonSchemaDiscriminator,\n ApiJsonSchemaValidator,\n DtoValidationFailure,\n ObjectSchemaBuilder,\n} from './mcp/DtoSchema';\nexport type { ApiJsonSchemaType, DtoValue } from './mcp/DtoSchema';\nexport {\n McpToolCatalogFile,\n McpToolCatalogError,\n McpToolDefinition,\n} from './mcp/McpToolCatalogFile';\nexport {\n GeneratedApiDocsLayout,\n GenerateLayoutProblem,\n GenerateOutputLookup,\n GenerateOutputTarget,\n} from './mcp/GeneratedApiDocsLayout';\nexport type {\n LayoutDependsOn,\n LayoutDependsOnObject,\n LayoutTarget,\n LayoutTargets,\n} from './mcp/GeneratedApiDocsLayout';\n// The TYPE layer of the auth surface — likewise split out of decorators.ts for file size only.\nexport { AuthMeta, AuthDeclaration, jwt, oidc, sharedSecret, webhook, apiKey } from './http/auth-mode';\nexport type {\n AuthMode,\n ApiKeyCredential,\n ApiKeyCredentials,\n AuthMethod,\n AuthMethods,\n} from './http/auth-mode';\n// API kind (RPC vs PubSub/Cloud Tasks) + queue naming. Split out of decorators.ts for file size only;\n// one-way dependency api-kind -> decorators, and the barrel keeps the surface identical.\nexport {\n Rpc,\n PubSub,\n Queue,\n ENDPOINT_KINDS_BY_API_KIND,\n getApiKind,\n assertApiKind,\n assertPubSubConventions,\n getQueueName,\n} from './http/api-kind';\nexport type { ApiKind } from './http/api-kind';\n// WHO calls an `external` endpoint — the caller declaration\n// @Endpoint(POST, ..., WRITE, EXTERNAL, { calledBy })\n// requires, and the reader for it.\nexport {\n EXTERNAL_SYSTEM_KINDS,\n DEFAULT_CALLER_KIND,\n ExternalCaller,\n isExternalSystemKind,\n getEndpointCaller,\n} from './http/external-caller';\nexport type { ExternalSystemKind } from './http/external-caller';\n// Client-side shared-secret store (the value THIS service sends per sharedSecret(...) key).\nexport { Secrets, SECRETS } from './http/Secrets';\n\n// Type validators\nexport { ValidateImplementation } from './http/validators';\n\n// Authentication subtype constants.\nexport {\n ENTITY_NOT_FOUND,\n WRONG_LOGIN_TYPE,\n WRONG_LOGIN,\n NOT_APPROVED,\n EMAIL_NOT_CONFIRMED,\n WRONG_DOMAIN,\n WRONG_COMPANY,\n NO_REG_CODE,\n} from './errors';\n\nexport { NetworkRejectClassifier } from './http/networkReject';\n\n// Date/Time DTOs and Utilities (inspired by Java Time / JSR-310)\nexport {\n InstantDto,\n DateDto,\n TimeDto,\n DateTimeDto,\n InstantUtil,\n DateUtil,\n TimeUtil,\n DateTimeUtil,\n} from './http/datetime';\n\n// Context keys + registry (the global magic-context header system)\nexport { HeaderRegistry } from './http/HeaderRegistry';\nexport { ClientRegistry } from './http/ClientRegistry';\nexport { CallRegistry } from './http/CallRegistry';\nexport { CallDeadline } from './http/CallDeadline';\nexport { CallContext } from './http/CallStrategy';\nexport type { Attempt, CallStrategy } from './http/CallStrategy';\nexport { ApiCallTimeoutError } from './http/ApiCallTimeoutError';\nexport type { ServiceUrlDeriver } from './http/ClientRegistry';\n\n// \"What service am I\" — set once at startup, read by the logging backends and by\n// RequestContextHeaders (to stamp requestIdSource on ids this service mints).\nexport { ServiceInfo } from './http/ServiceInfo';\n// \"Where am I running\" — declared once at startup (setupRuntime, from RuntimeSetupOptions.locality).\n// The ONE input to @WpLocalOnly enforcement. Undeclared reads as DEPLOYED (fail safe).\nexport { RuntimeLocality } from './http/RuntimeLocality';\nexport type { Locality } from './http/RuntimeLocality';\n// The ENTIRE HTTP response as pure data — the ONE form both transports (express, fetch) are\n// normalised into, so an ErrorTranslator implementation is written once and serves both.\nexport { HttpHeader, HttpResponseStatus, HttpResponseDto } from './http/HttpResponseDto';\n// Pluggable, bidirectional error translation (app exception <-> the WHOLE response). Set on\n// ClientRegistry at startup; consulted before the built-in webpieces mapping on BOTH sides.\nexport type { ErrorTranslator } from './http/ErrorTranslator';\n// THE webpieces default translator — always installed, and what an app's own translator delegates to\n// in order to decline an error. ONE class, both halves, node and browser alike.\nexport {\n WebpiecesDefaultErrorTranslator,\n WEBPIECES_DEFAULT_ERROR_TRANSLATOR,\n} from './http/WebpiecesDefaultErrorTranslator';\n// WHICH KIND OF CALLER drove this request (gui / llm / public-api), and the per-request end-user\n// status derived from it — the replacement for the deleted per-router EndUserStatus.\nexport { SurfaceEndUserStatus } from './http/Surface';\nexport type { Surface } from './http/Surface';\n// The ONE rule for an error RECEIVED from another process, shared verbatim by HTTP and IPC.\nexport { ReceivedApiErrorRule } from './errors/ReceivedApiErrorRule';\n// Pluggable per-client failure classification (is a thrown API-call error a real failure or an\n// expected non-failure?). Registered on ClientRegistry at startup; consulted by LogApiCall.\nexport type { FailureClassifier } from './http/FailureClassifier';\nexport { KeyedFailureClassifier } from './http/FailureClassifier';\nexport {\n WebpiecesDefaultFailureClassifier,\n WEBPIECES_DEFAULT_FAILURE_CLASSIFIER,\n} from './http/WebpiecesDefaultFailureClassifier';\nexport { templateDeriver } from './http/templateDeriver';\nexport { WebpiecesCoreHeaders } from './http/WebpiecesCoreHeaders';\nexport { ContextReader } from './http/ContextReader';\nexport { ContextWriter, ContextStore } from './http/ContextWriter';\n\n// The OUTBOUND half of the trust model: whether a TRUSTED context key may ride to the endpoint being\n// called. Built ONLY from the destination endpoint's AuthMode — see the class doc.\nexport { DestinationTrust } from './http/DestinationTrust';\n\n// BROWSER-ONLY outbound-header propagation (app-held store + registry -> outbound HTTP headers).\n// Only @webpieces/http-client-browser may name it; the server reads RequestContext directly via\n// RequestContextHeaders in the Node-only @webpieces/core-context.\nexport { ContextMgr } from './http/ContextMgr';\n\n// API-call logging helper (uses LogManager above). NOT a singleton: construct one per environment\n// with that environment's ApiCallContext — `new LogApiCallImpl(new RequestContextApiCallContext())`\n// on node, `new LogApiCallImpl(new BrowserApiCallContext())` in a browser.\nexport { LogApiCallImpl } from './http/LogApiCall';\n\n// Opt-in field masking for the LogApiCall log path — declare per-api sensitive fields so secrets\n// (OAuth refresh tokens, id-token JWTs) are masked in the logs while the real value stays on the wire.\nexport { MaskSpec } from './http/LogFieldMask';\nexport type { MaskMode } from './http/LogFieldMask';\n\n// The structured `api` tag + the context-writer seam LogApiCall stamps through. The Node\n// RequestContext-backed impl lives in @webpieces/core-context, the browser one in\n// @webpieces/http-client-browser; each is CONSTRUCTED by its package, never installed globally.\nexport { ApiCallInfo } from './http/ApiCallInfo';\nexport type { ApiCallDirection, ApiResult } from './http/ApiCallInfo';\n// Console-render bridge: turns LogApiCall's [LogApiCall] bracket into [API.{side}.{phase}] locally.\nexport {\n ApiCallLogName,\n ApiCallLogNameImpl,\n LOG_API_CALL_LOGGER_NAME,\n} from './http/ApiCallLogName';\nexport { ApiMethodInfo } from './http/ApiMethodInfo';\nexport type { ApiSide } from './http/ApiMethodInfo';\nexport type { ApiCallContext } from './http/ApiCallContext';\n\n// Test-case recording contract (impl lives in http-server; hooks in http-client)\nexport { TestCaseRecorder, RecorderKeys } from './http/recorder/TestCaseRecorder';\nexport {\n RecordedEndpoint,\n RecordedError,\n RecordedTestCase,\n} from './http/recorder/RecordedEndpoint';\nexport { DoNotRecord, getDoNotRecordFields } from './http/recorder/DoNotRecord';\nexport { RecordSerializer, SerializedMap, SerializedError } from './http/recorder/RecordSerializer';\n\n// ---------------------------------------------------------------------------------------------\n// Filter-chain primitives, shared by BOTH chains: the inbound server chain\n// (`Filter<MethodMeta, WpResponse<unknown>>`, @webpieces/http-routing) and the outbound client\n// chain (`Filter<ClientRequest, Response>`, @webpieces/http-client-core). Declared once, here, in\n// the package both depend on — see the class doc for why a second pair would be a shim.\nexport { Filter } from './filters/Filter';\nexport type { Service } from './filters/Filter';\nexport { FilterChain } from './filters/FilterChain';\n\nexport {\n ApiError,\n ApiNotFoundError,\n ApiDependencyError,\n ApiBadGatewayError,\n ApiUnavailableError,\n ApiDependencyTimeoutError,\n ApiImplementationError,\n ApiRateLimitedError,\n ApiForbiddenError,\n ApiRequestTimeoutError,\n ApiEndUserError,\n ApiBadRequestError,\n ApiUnauthorizedError,\n ApiDependencyBackoffError,\n ApiConnectionError,\n ApiEndpointNotFoundError,\n ApiConflictError,\n ApiUnprocessableError,\n ApiPreconditionFailedError,\n ApiUnsupportedMediaTypeError,\n ApiNotImplementedError,\n ApiCodedError,\n ApiClientTooOldError,\n ApiEndUserNotFoundError,\n ApiEndUserForbiddenError,\n ApiEndUserBadRequestError,\n EndUserErrorCode,\n EndUserErrorRegistry,\n ClientRole,\n ApiErrorCodec,\n ApiErrorPayload,\n ApiErrorBoundary,\n ApiCallSite,\n ReportableApiFailure,\n RpcCallFailed,\n} from './errors';\nexport type {\n ApiErrorKind,\n ApiStatusCode,\n EdgeHttpStatus,\n EndUserErrorFactory,\n CallSiteBoundary,\n} from './errors';\nexport { ApiErrorHttpStatus } from './http/ApiErrorHttpStatus';\n\n// RFC 6749 / 6750 / 7591 OAuth refusals for app-hosted OAuth endpoints (#1176): the typed error,\n// its one renderer, the Bearer challenge builder and the authorization-endpoint error redirect.\nexport { OAuthErrorCode, OAuthErrorStatus, OAuthText } from './oauth/OAuthErrorCode';\nexport type {\n OAuthHttpStatus,\n InvalidClientStatus,\n OAuthFixedStatusErrorCode,\n BearerErrorCode,\n AuthorizationEndpointErrorCode,\n} from './oauth/OAuthErrorCode';\nexport { OAuthProtocolError, OAuthErrorExtras } from './oauth/OAuthProtocolError';\nexport { OAuthBearerChallenge } from './oauth/OAuthBearerChallenge';\nexport { OAuthErrorBody, OAuthErrorResponse } from './oauth/OAuthErrorResponse';\nexport { OAuthAuthorizationErrorRedirect } from './oauth/OAuthAuthorizationErrorRedirect';\nexport type { PublishedKind, PublishedApiError } from './http/ApiErrorHttpStatus';\n"]}

package/src/oauth/OAuthAuthorizationErrorRedirect.d.ts ADDED Viewed

@@ -0,0 +1,37 @@
+import { AuthorizationEndpointErrorCode } from './OAuthErrorCode';
+/**
+ * The AUTHORIZATION endpoint's error answer, RFC 6749 §4.1.2.1: not a status code at all, but a
+ * redirect of the user agent back to the client's `redirect_uri` carrying
+ * `error`, `error_description?`, `error_uri?`, `state` and (RFC 9207) `iss?` as query parameters.
+ *
+ * ```ts
+ * const url = new OAuthAuthorizationErrorRedirect(
+ *     client.redirectUri, OAuthErrorCode.ACCESS_DENIED, requestState, 'The user declined',
+ * ).toUrl();
+ * res.redirect(302, url);
+ * ```
+ *
+ * `requestState` above is the request's `state` narrowed to `string | undefined` (express types a
+ * query value more widely). `state` is a REQUIRED argument that may be `undefined`: the RFC requires it back exactly when the
+ * client sent it, so every caller must hand over what the request carried rather than forget it.
+ * An existing query on `redirectUri` is kept, as the RFC requires.
+ *
+ * Only redirect to a `redirect_uri` you have VALIDATED against the client's registration. When the
+ * `redirect_uri` or `client_id` is missing, invalid or mismatched, RFC 6749 §4.1.2.1 forbids the
+ * redirect (it would be an open redirector) — answer the resource owner directly instead, for
+ * example with an `OAuthProtocolError` rendered as JSON.
+ */
+export declare class OAuthAuthorizationErrorRedirect {
+    readonly redirectUri: string;
+    readonly error: AuthorizationEndpointErrorCode;
+    readonly state: string | undefined;
+    readonly description?: string | undefined;
+    readonly errorUri?: string | undefined;
+    /** RFC 9207 `iss`: the authorization server's issuer identifier, for mix-up defence. */
+    readonly issuer?: string | undefined;
+    constructor(redirectUri: string, error: AuthorizationEndpointErrorCode, state: string | undefined, description?: string | undefined, errorUri?: string | undefined,
+    /** RFC 9207 `iss`: the authorization server's issuer identifier, for mix-up defence. */
+    issuer?: string | undefined);
+    /** The absolute redirect URL. Throws `TypeError` (from `URL`) if `redirectUri` is not absolute. */
+    toUrl(): string;
+}

package/src/oauth/OAuthAuthorizationErrorRedirect.js ADDED Viewed

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthAuthorizationErrorRedirect = void 0;
+const OAuthErrorCode_1 = require("./OAuthErrorCode");
+/**
+ * The AUTHORIZATION endpoint's error answer, RFC 6749 §4.1.2.1: not a status code at all, but a
+ * redirect of the user agent back to the client's `redirect_uri` carrying
+ * `error`, `error_description?`, `error_uri?`, `state` and (RFC 9207) `iss?` as query parameters.
+ *
+ * ```ts
+ * const url = new OAuthAuthorizationErrorRedirect(
+ *     client.redirectUri, OAuthErrorCode.ACCESS_DENIED, requestState, 'The user declined',
+ * ).toUrl();
+ * res.redirect(302, url);
+ * ```
+ *
+ * `requestState` above is the request's `state` narrowed to `string | undefined` (express types a
+ * query value more widely). `state` is a REQUIRED argument that may be `undefined`: the RFC requires it back exactly when the
+ * client sent it, so every caller must hand over what the request carried rather than forget it.
+ * An existing query on `redirectUri` is kept, as the RFC requires.
+ *
+ * Only redirect to a `redirect_uri` you have VALIDATED against the client's registration. When the
+ * `redirect_uri` or `client_id` is missing, invalid or mismatched, RFC 6749 §4.1.2.1 forbids the
+ * redirect (it would be an open redirector) — answer the resource owner directly instead, for
+ * example with an `OAuthProtocolError` rendered as JSON.
+ */
+class OAuthAuthorizationErrorRedirect {
+    redirectUri;
+    error;
+    state;
+    description;
+    errorUri;
+    issuer;
+    constructor(redirectUri, error, state, description, errorUri,
+    /** RFC 9207 `iss`: the authorization server's issuer identifier, for mix-up defence. */
+    issuer) {
+        this.redirectUri = redirectUri;
+        this.error = error;
+        this.state = state;
+        this.description = description;
+        this.errorUri = errorUri;
+        this.issuer = issuer;
+    }
+    /** The absolute redirect URL. Throws `TypeError` (from `URL`) if `redirectUri` is not absolute. */
+    toUrl() {
+        const url = new URL(this.redirectUri);
+        url.searchParams.set('error', this.error);
+        if (this.description !== undefined) {
+            url.searchParams.set('error_description', OAuthErrorCode_1.OAuthText.sanitize(this.description));
+        }
+        if (this.errorUri !== undefined)
+            url.searchParams.set('error_uri', this.errorUri);
+        if (this.state !== undefined)
+            url.searchParams.set('state', this.state);
+        if (this.issuer !== undefined)
+            url.searchParams.set('iss', this.issuer);
+        return url.toString();
+    }
+}
+exports.OAuthAuthorizationErrorRedirect = OAuthAuthorizationErrorRedirect;
+//# sourceMappingURL=OAuthAuthorizationErrorRedirect.js.map

package/src/oauth/OAuthAuthorizationErrorRedirect.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"OAuthAuthorizationErrorRedirect.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/oauth/OAuthAuthorizationErrorRedirect.ts"],"names":[],"mappings":";;;AAAA,qDAA6E;AAE7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAa,+BAA+B;IAEpB;IACA;IACA;IACA;IACA;IAEA;IAPpB,YACoB,WAAmB,EACnB,KAAqC,EACrC,KAAyB,EACzB,WAAoB,EACpB,QAAiB;IACjC,wFAAwF;IACxE,MAAe;QANf,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAgC;QACrC,UAAK,GAAL,KAAK,CAAoB;QACzB,gBAAW,GAAX,WAAW,CAAS;QACpB,aAAQ,GAAR,QAAQ,CAAS;QAEjB,WAAM,GAAN,MAAM,CAAS;IAChC,CAAC;IAEJ,mGAAmG;IACnG,KAAK;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,0BAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;CACJ;AAvBD,0EAuBC","sourcesContent":["import { AuthorizationEndpointErrorCode, OAuthText } from './OAuthErrorCode';\n\n/**\n * The AUTHORIZATION endpoint's error answer, RFC 6749 §4.1.2.1: not a status code at all, but a\n * redirect of the user agent back to the client's `redirect_uri` carrying\n * `error`, `error_description?`, `error_uri?`, `state` and (RFC 9207) `iss?` as query parameters.\n *\n * ```ts\n * const url = new OAuthAuthorizationErrorRedirect(\n * client.redirectUri, OAuthErrorCode.ACCESS_DENIED, requestState, 'The user declined',\n * ).toUrl();\n * res.redirect(302, url);\n * ```\n *\n * `requestState` above is the request's `state` narrowed to `string | undefined` (express types a\n * query value more widely). `state` is a REQUIRED argument that may be `undefined`: the RFC requires it back exactly when the\n * client sent it, so every caller must hand over what the request carried rather than forget it.\n * An existing query on `redirectUri` is kept, as the RFC requires.\n *\n * Only redirect to a `redirect_uri` you have VALIDATED against the client's registration. When the\n * `redirect_uri` or `client_id` is missing, invalid or mismatched, RFC 6749 §4.1.2.1 forbids the\n * redirect (it would be an open redirector) — answer the resource owner directly instead, for\n * example with an `OAuthProtocolError` rendered as JSON.\n */\nexport class OAuthAuthorizationErrorRedirect {\n constructor(\n public readonly redirectUri: string,\n public readonly error: AuthorizationEndpointErrorCode,\n public readonly state: string | undefined,\n public readonly description?: string,\n public readonly errorUri?: string,\n /** RFC 9207 `iss`: the authorization server's issuer identifier, for mix-up defence. */\n public readonly issuer?: string,\n ) {}\n\n /** The absolute redirect URL. Throws `TypeError` (from `URL`) if `redirectUri` is not absolute. */\n toUrl(): string {\n const url = new URL(this.redirectUri);\n url.searchParams.set('error', this.error);\n if (this.description !== undefined) {\n url.searchParams.set('error_description', OAuthText.sanitize(this.description));\n }\n if (this.errorUri !== undefined) url.searchParams.set('error_uri', this.errorUri);\n if (this.state !== undefined) url.searchParams.set('state', this.state);\n if (this.issuer !== undefined) url.searchParams.set('iss', this.issuer);\n return url.toString();\n }\n}\n"]}

package/src/oauth/OAuthBearerChallenge.d.ts ADDED Viewed

@@ -0,0 +1,31 @@
+import { BearerErrorCode } from './OAuthErrorCode';
+/**
+ * Builds the RFC 6750 §3 `WWW-Authenticate: Bearer ...` value a protected resource answers a refused
+ * bearer token with:
+ *
+ * ```ts
+ * new OAuthBearerChallenge(OAuthErrorCode.INVALID_TOKEN, 'The access token expired', undefined, 'mcp').toHeaderValue();
+ * // Bearer realm="mcp", error="invalid_token", error_description="The access token expired"
+ * ```
+ *
+ * `error` is `undefined` for a request that carried NO credential at all: RFC 6750 §3.1 says such a
+ * challenge SHOULD NOT include an error code. `resourceMetadata` is the RFC 9728 attribute MCP
+ * clients follow to discover the authorization server. Every attribute value is sanitized to the
+ * RFC's quoted-string character set, so app text can never break the header.
+ */
+export declare class OAuthBearerChallenge {
+    readonly error: BearerErrorCode | undefined;
+    readonly description?: string | undefined;
+    /** Space-delimited scopes the resource requires (RFC 6750 `scope`), for `insufficient_scope`. */
+    readonly scope?: string | undefined;
+    readonly realm?: string | undefined;
+    /** RFC 9728 `resource_metadata`: the protected-resource metadata URL. */
+    readonly resourceMetadata?: string | undefined;
+    constructor(error: BearerErrorCode | undefined, description?: string | undefined,
+    /** Space-delimited scopes the resource requires (RFC 6750 `scope`), for `insufficient_scope`. */
+    scope?: string | undefined, realm?: string | undefined,
+    /** RFC 9728 `resource_metadata`: the protected-resource metadata URL. */
+    resourceMetadata?: string | undefined);
+    toHeaderValue(): string;
+    private add;
+}

package/src/oauth/OAuthBearerChallenge.js ADDED Viewed

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthBearerChallenge = void 0;
+const OAuthErrorCode_1 = require("./OAuthErrorCode");
+/**
+ * Builds the RFC 6750 §3 `WWW-Authenticate: Bearer ...` value a protected resource answers a refused
+ * bearer token with:
+ *
+ * ```ts
+ * new OAuthBearerChallenge(OAuthErrorCode.INVALID_TOKEN, 'The access token expired', undefined, 'mcp').toHeaderValue();
+ * // Bearer realm="mcp", error="invalid_token", error_description="The access token expired"
+ * ```
+ *
+ * `error` is `undefined` for a request that carried NO credential at all: RFC 6750 §3.1 says such a
+ * challenge SHOULD NOT include an error code. `resourceMetadata` is the RFC 9728 attribute MCP
+ * clients follow to discover the authorization server. Every attribute value is sanitized to the
+ * RFC's quoted-string character set, so app text can never break the header.
+ */
+class OAuthBearerChallenge {
+    error;
+    description;
+    scope;
+    realm;
+    resourceMetadata;
+    constructor(error, description,
+    /** Space-delimited scopes the resource requires (RFC 6750 `scope`), for `insufficient_scope`. */
+    scope, realm,
+    /** RFC 9728 `resource_metadata`: the protected-resource metadata URL. */
+    resourceMetadata) {
+        this.error = error;
+        this.description = description;
+        this.scope = scope;
+        this.realm = realm;
+        this.resourceMetadata = resourceMetadata;
+    }
+    toHeaderValue() {
+        const attributes = [];
+        this.add(attributes, 'realm', this.realm);
+        this.add(attributes, 'error', this.error);
+        this.add(attributes, 'error_description', this.description);
+        this.add(attributes, 'scope', this.scope);
+        this.add(attributes, 'resource_metadata', this.resourceMetadata);
+        return attributes.length === 0 ? 'Bearer' : `Bearer ${attributes.join(', ')}`;
+    }
+    add(attributes, name, value) {
+        if (value !== undefined) {
+            attributes.push(`${name}="${OAuthErrorCode_1.OAuthText.sanitize(value)}"`);
+        }
+    }
+}
+exports.OAuthBearerChallenge = OAuthBearerChallenge;
+//# sourceMappingURL=OAuthBearerChallenge.js.map

package/src/oauth/OAuthBearerChallenge.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"OAuthBearerChallenge.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/oauth/OAuthBearerChallenge.ts"],"names":[],"mappings":";;;AAAA,qDAA8D;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAa,oBAAoB;IAET;IACA;IAEA;IACA;IAEA;IAPpB,YACoB,KAAkC,EAClC,WAAoB;IACpC,iGAAiG;IACjF,KAAc,EACd,KAAc;IAC9B,yEAAyE;IACzD,gBAAyB;QANzB,UAAK,GAAL,KAAK,CAA6B;QAClC,gBAAW,GAAX,WAAW,CAAS;QAEpB,UAAK,GAAL,KAAK,CAAS;QACd,UAAK,GAAL,KAAK,CAAS;QAEd,qBAAgB,GAAhB,gBAAgB,CAAS;IAC1C,CAAC;IAEJ,aAAa;QACT,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjE,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAClF,CAAC;IAEO,GAAG,CAAC,UAAoB,EAAE,IAAY,EAAE,KAAyB;QACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,0BAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC;CACJ;AA1BD,oDA0BC","sourcesContent":["import { BearerErrorCode, OAuthText } from './OAuthErrorCode';\n\n/**\n * Builds the RFC 6750 §3 `WWW-Authenticate: Bearer ...` value a protected resource answers a refused\n * bearer token with:\n *\n * ```ts\n * new OAuthBearerChallenge(OAuthErrorCode.INVALID_TOKEN, 'The access token expired', undefined, 'mcp').toHeaderValue();\n * // Bearer realm=\"mcp\", error=\"invalid_token\", error_description=\"The access token expired\"\n * ```\n *\n * `error` is `undefined` for a request that carried NO credential at all: RFC 6750 §3.1 says such a\n * challenge SHOULD NOT include an error code. `resourceMetadata` is the RFC 9728 attribute MCP\n * clients follow to discover the authorization server. Every attribute value is sanitized to the\n * RFC's quoted-string character set, so app text can never break the header.\n */\nexport class OAuthBearerChallenge {\n constructor(\n public readonly error: BearerErrorCode | undefined,\n public readonly description?: string,\n /** Space-delimited scopes the resource requires (RFC 6750 `scope`), for `insufficient_scope`. */\n public readonly scope?: string,\n public readonly realm?: string,\n /** RFC 9728 `resource_metadata`: the protected-resource metadata URL. */\n public readonly resourceMetadata?: string,\n ) {}\n\n toHeaderValue(): string {\n const attributes: string[] = [];\n this.add(attributes, 'realm', this.realm);\n this.add(attributes, 'error', this.error);\n this.add(attributes, 'error_description', this.description);\n this.add(attributes, 'scope', this.scope);\n this.add(attributes, 'resource_metadata', this.resourceMetadata);\n return attributes.length === 0 ? 'Bearer' : `Bearer ${attributes.join(', ')}`;\n }\n\n private add(attributes: string[], name: string, value: string | undefined): void {\n if (value !== undefined) {\n attributes.push(`${name}=\"${OAuthText.sanitize(value)}\"`);\n }\n }\n}\n"]}

package/src/oauth/OAuthErrorCode.d.ts ADDED Viewed

@@ -0,0 +1,69 @@
+/**
+ * The fixed OAuth 2.x error vocabulary. A throw site picks a member; it cannot invent a code (an
+ * `invalid_credential` that no OAuth client understands) because the type has no such member.
+ *
+ * Sources, by the endpoint that answers with them:
+ * - RFC 6749 §5.2, the TOKEN endpoint: `invalid_request`, `invalid_client`, `invalid_grant`,
+ *   `unauthorized_client`, `unsupported_grant_type`, `invalid_scope`.
+ * - RFC 6750 §3.1, a PROTECTED RESOURCE (bearer token): `invalid_request`, `invalid_token`,
+ *   `insufficient_scope`.
+ * - RFC 6749 §4.1.2.1, the AUTHORIZATION endpoint (answered as a redirect, see
+ *   `OAuthAuthorizationErrorRedirect`): `invalid_request`, `unauthorized_client`, `access_denied`,
+ *   `unsupported_response_type`, `invalid_scope`, `server_error`, `temporarily_unavailable`.
+ * - RFC 7591 §3.2.2, DYNAMIC CLIENT REGISTRATION (which MCP clients use to register themselves):
+ *   `invalid_redirect_uri`, `invalid_client_metadata`, `invalid_software_statement`,
+ *   `unapproved_software_statement`.
+ *
+ * A string enum, every member initialised with its wire value, per the one-spelling rule for API
+ * vocabularies in this repo.
+ */
+export declare enum OAuthErrorCode {
+    INVALID_REQUEST = "invalid_request",
+    INVALID_CLIENT = "invalid_client",
+    INVALID_GRANT = "invalid_grant",
+    UNAUTHORIZED_CLIENT = "unauthorized_client",
+    UNSUPPORTED_GRANT_TYPE = "unsupported_grant_type",
+    INVALID_SCOPE = "invalid_scope",
+    INVALID_TOKEN = "invalid_token",
+    INSUFFICIENT_SCOPE = "insufficient_scope",
+    ACCESS_DENIED = "access_denied",
+    UNSUPPORTED_RESPONSE_TYPE = "unsupported_response_type",
+    SERVER_ERROR = "server_error",
+    TEMPORARILY_UNAVAILABLE = "temporarily_unavailable",
+    INVALID_REDIRECT_URI = "invalid_redirect_uri",
+    INVALID_CLIENT_METADATA = "invalid_client_metadata",
+    INVALID_SOFTWARE_STATEMENT = "invalid_software_statement",
+    UNAPPROVED_SOFTWARE_STATEMENT = "unapproved_software_statement"
+}
+/** Every status an OAuth error is answered with when it is rendered as JSON. */
+export type OAuthHttpStatus = 400 | 401 | 403 | 500 | 503;
+/**
+ * The two statuses RFC 6749 §5.2 permits for `invalid_client`: 401 by default, and REQUIRED (with a
+ * `WWW-Authenticate` header) when the client authenticated through the `Authorization` header; 400
+ * is allowed otherwise. It is the ONLY code whose status the RFCs leave to the server.
+ */
+export type InvalidClientStatus = 400 | 401;
+/** Every code whose status is fixed by the RFCs — all of them except `invalid_client`. */
+export type OAuthFixedStatusErrorCode = Exclude<OAuthErrorCode, OAuthErrorCode.INVALID_CLIENT>;
+/** The codes RFC 6750 §3.1 defines for a `WWW-Authenticate: Bearer` challenge. */
+export type BearerErrorCode = OAuthErrorCode.INVALID_REQUEST | OAuthErrorCode.INVALID_TOKEN | OAuthErrorCode.INSUFFICIENT_SCOPE;
+/** The codes RFC 6749 §4.1.2.1 defines for the authorization endpoint's error redirect. */
+export type AuthorizationEndpointErrorCode = OAuthErrorCode.INVALID_REQUEST | OAuthErrorCode.UNAUTHORIZED_CLIENT | OAuthErrorCode.ACCESS_DENIED | OAuthErrorCode.UNSUPPORTED_RESPONSE_TYPE | OAuthErrorCode.INVALID_SCOPE | OAuthErrorCode.SERVER_ERROR | OAuthErrorCode.TEMPORARILY_UNAVAILABLE;
+/**
+ * The status each fixed code is answered with. The RFCs fix the token-endpoint and bearer codes;
+ * the authorization-endpoint codes are normally a REDIRECT, not a status, so their status here is
+ * only used when one is rendered as JSON (an authorization request whose `redirect_uri` could not be
+ * trusted, where RFC 6749 §4.1.2.1 forbids redirecting): the closest HTTP meaning of each.
+ */
+export declare class OAuthErrorStatus {
+    static of(code: OAuthFixedStatusErrorCode): OAuthHttpStatus;
+}
+/**
+ * RFC 6749 restricts `error_description` (and RFC 6750 every quoted challenge attribute) to
+ * printable ASCII without `"` and `\` (%x20-21 / %x23-5B / %x5D-7E). Anything else is replaced with
+ * `?` at RENDER time — the error itself keeps the original text for the operator log — so an app's
+ * description can never break a header or the RFC's character set.
+ */
+export declare class OAuthText {
+    static sanitize(value: string): string;
+}

package/src/oauth/OAuthErrorCode.js ADDED Viewed

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthText = exports.OAuthErrorStatus = exports.OAuthErrorCode = void 0;
+/**
+ * The fixed OAuth 2.x error vocabulary. A throw site picks a member; it cannot invent a code (an
+ * `invalid_credential` that no OAuth client understands) because the type has no such member.
+ *
+ * Sources, by the endpoint that answers with them:
+ * - RFC 6749 §5.2, the TOKEN endpoint: `invalid_request`, `invalid_client`, `invalid_grant`,
+ *   `unauthorized_client`, `unsupported_grant_type`, `invalid_scope`.
+ * - RFC 6750 §3.1, a PROTECTED RESOURCE (bearer token): `invalid_request`, `invalid_token`,
+ *   `insufficient_scope`.
+ * - RFC 6749 §4.1.2.1, the AUTHORIZATION endpoint (answered as a redirect, see
+ *   `OAuthAuthorizationErrorRedirect`): `invalid_request`, `unauthorized_client`, `access_denied`,
+ *   `unsupported_response_type`, `invalid_scope`, `server_error`, `temporarily_unavailable`.
+ * - RFC 7591 §3.2.2, DYNAMIC CLIENT REGISTRATION (which MCP clients use to register themselves):
+ *   `invalid_redirect_uri`, `invalid_client_metadata`, `invalid_software_statement`,
+ *   `unapproved_software_statement`.
+ *
+ * A string enum, every member initialised with its wire value, per the one-spelling rule for API
+ * vocabularies in this repo.
+ */
+var OAuthErrorCode;
+(function (OAuthErrorCode) {
+    OAuthErrorCode["INVALID_REQUEST"] = "invalid_request";
+    OAuthErrorCode["INVALID_CLIENT"] = "invalid_client";
+    OAuthErrorCode["INVALID_GRANT"] = "invalid_grant";
+    OAuthErrorCode["UNAUTHORIZED_CLIENT"] = "unauthorized_client";
+    OAuthErrorCode["UNSUPPORTED_GRANT_TYPE"] = "unsupported_grant_type";
+    OAuthErrorCode["INVALID_SCOPE"] = "invalid_scope";
+    OAuthErrorCode["INVALID_TOKEN"] = "invalid_token";
+    OAuthErrorCode["INSUFFICIENT_SCOPE"] = "insufficient_scope";
+    OAuthErrorCode["ACCESS_DENIED"] = "access_denied";
+    OAuthErrorCode["UNSUPPORTED_RESPONSE_TYPE"] = "unsupported_response_type";
+    OAuthErrorCode["SERVER_ERROR"] = "server_error";
+    OAuthErrorCode["TEMPORARILY_UNAVAILABLE"] = "temporarily_unavailable";
+    OAuthErrorCode["INVALID_REDIRECT_URI"] = "invalid_redirect_uri";
+    OAuthErrorCode["INVALID_CLIENT_METADATA"] = "invalid_client_metadata";
+    OAuthErrorCode["INVALID_SOFTWARE_STATEMENT"] = "invalid_software_statement";
+    OAuthErrorCode["UNAPPROVED_SOFTWARE_STATEMENT"] = "unapproved_software_statement";
+})(OAuthErrorCode || (exports.OAuthErrorCode = OAuthErrorCode = {}));
+/**
+ * The status each fixed code is answered with. The RFCs fix the token-endpoint and bearer codes;
+ * the authorization-endpoint codes are normally a REDIRECT, not a status, so their status here is
+ * only used when one is rendered as JSON (an authorization request whose `redirect_uri` could not be
+ * trusted, where RFC 6749 §4.1.2.1 forbids redirecting): the closest HTTP meaning of each.
+ */
+class OAuthErrorStatus {
+    // webpieces-disable no-function-outside-class -- pure, exhaustive code -> status table
+    static of(code) {
+        switch (code) {
+            case OAuthErrorCode.INVALID_TOKEN:
+                return 401;
+            case OAuthErrorCode.INSUFFICIENT_SCOPE:
+            case OAuthErrorCode.ACCESS_DENIED:
+                return 403;
+            case OAuthErrorCode.SERVER_ERROR:
+                return 500;
+            case OAuthErrorCode.TEMPORARILY_UNAVAILABLE:
+                return 503;
+            case OAuthErrorCode.INVALID_REQUEST:
+            case OAuthErrorCode.INVALID_GRANT:
+            case OAuthErrorCode.UNAUTHORIZED_CLIENT:
+            case OAuthErrorCode.UNSUPPORTED_GRANT_TYPE:
+            case OAuthErrorCode.INVALID_SCOPE:
+            case OAuthErrorCode.UNSUPPORTED_RESPONSE_TYPE:
+            case OAuthErrorCode.INVALID_REDIRECT_URI:
+            case OAuthErrorCode.INVALID_CLIENT_METADATA:
+            case OAuthErrorCode.INVALID_SOFTWARE_STATEMENT:
+            case OAuthErrorCode.UNAPPROVED_SOFTWARE_STATEMENT:
+                return 400;
+        }
+    }
+}
+exports.OAuthErrorStatus = OAuthErrorStatus;
+/**
+ * RFC 6749 restricts `error_description` (and RFC 6750 every quoted challenge attribute) to
+ * printable ASCII without `"` and `\` (%x20-21 / %x23-5B / %x5D-7E). Anything else is replaced with
+ * `?` at RENDER time — the error itself keeps the original text for the operator log — so an app's
+ * description can never break a header or the RFC's character set.
+ */
+class OAuthText {
+    // webpieces-disable no-function-outside-class -- pure character-set filter shared by every OAuth renderer
+    static sanitize(value) {
+        return value.replace(/[^\x20-\x21\x23-\x5B\x5D-\x7E]/g, '?');
+    }
+}
+exports.OAuthText = OAuthText;
+//# sourceMappingURL=OAuthErrorCode.js.map