authflow-cli 0.3.0 → 0.4.1

package/README.md

@@ -47,7 +47,7 @@ npm run authflow -- --help
 | `AUTHFLOW_ORIGIN_API_KEY` | `--origin-key` | `mint-header`, `probe`, `set-origin` (for its probe) |
 | `AUTHFLOW_RESOURCE` / `AUTHFLOW_GATEWAY_URL` | `--gateway-url` / `--receipt` | curl hint on `mint-header` |
 
-Issuer is the Origin Protocol issuer origin, with no trailing slash: staging is `https://staging.rails.authflow.ai`, local is typically `https://localhost:7175`. For an already-registered resource it is the `issuer` field of the receipt. See [tenant quickstart §1](../../docs/onboarding/tenant-quickstart.md#environments-and-hostnames).
+Issuer is the Origin Protocol issuer origin, with no trailing slash: staging is `https://staging.rails.authflow.ai`, local is typically `https://localhost:7062`. For an already-registered resource it is the `issuer` field of the receipt. See [tenant quickstart §1](../../docs/onboarding/tenant-quickstart.md#environments-and-hostnames).
 
 ## Commands
 
@@ -237,6 +237,19 @@ Run this first when anything looks broken. It separates the two failures that ar
 from the outside: a hostname that is not bound to the rail returns `404` on every path including
 `/healthz`, which reads exactly like a broken endpoint. Exit code is non-zero on any failure.
 
+`--client cursor|claude|chatgpt|all` additionally replays that MCP client's real OAuth registration
+against the authorization server (the failure that presents as "this server does not work in
+Cursor"). `--dry-run` is discovery only and does not POST DCR. Live DCR registrations are stamped
+`authflow-cli doctor-connect` so a cleanup sweep can reclaim them.
+
+A `400` from the rail's DCR endpoint is the interesting result: paste `error=` and
+`error_description=` verbatim into a rail bug. Do not work around it client-side.
+
+```bash
+authflow doctor --issuer https://staging.rails.authflow.ai --slug video --client cursor
+authflow doctor --client all --dry-run
+```
+
 ### `authflow register`
 
 ```bash

package/dist/client-conformance.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Replay what real MCP clients send at the authorization server, from a tenant's point of view.
+ *
+ * This exists because of a real connect failure: tenant #1 could not connect from Cursor because
+ * our DCR endpoint rejected Cursor's actual redirect_uris (private-use `cursor://` scheme,
+ * omitted application_type, three callbacks at once). We only found out because they filed a bug.
+ * Nothing on the rail tested against what clients actually send. These checks do.
+ *
+ * DCR replay creates a real OAuth client row. Registrations are stamped with
+ * `client_name` prefix `authflow-cli doctor-connect` so a cleanup sweep can reclaim them; this
+ * harness does not delete them. Use `--dry-run` to skip POSTs.
+ */
+import { type ClientId } from "./client-fixtures.js";
+import { type DoctorReport } from "./doctor.js";
+export type ClientConformanceOptions = {
+    issuer: string;
+    clients: ClientId[];
+    dryRun?: boolean;
+    slug?: string;
+};
+export type AuthorizationServerMetadata = {
+    issuer?: string;
+    registration_endpoint?: string;
+    client_id_metadata_document_supported?: boolean;
+    token_endpoint_auth_methods_supported?: unknown;
+    code_challenge_methods_supported?: unknown;
+    authorization_response_iss_parameter_supported?: unknown;
+};
+export declare function runDoctorAndConnect(issuer: string, options?: {
+    slug?: string;
+    client?: string;
+    dryRun?: boolean;
+}): Promise<DoctorReport>;
+export declare function runClientConformance(options: ClientConformanceOptions): Promise<DoctorReport>;

package/dist/client-conformance.js

@@ -0,0 +1,379 @@
+/**
+ * Replay what real MCP clients send at the authorization server, from a tenant's point of view.
+ *
+ * This exists because of a real connect failure: tenant #1 could not connect from Cursor because
+ * our DCR endpoint rejected Cursor's actual redirect_uris (private-use `cursor://` scheme,
+ * omitted application_type, three callbacks at once). We only found out because they filed a bug.
+ * Nothing on the rail tested against what clients actually send. These checks do.
+ *
+ * DCR replay creates a real OAuth client row. Registrations are stamped with
+ * `client_name` prefix `authflow-cli doctor-connect` so a cleanup sweep can reclaim them; this
+ * harness does not delete them. Use `--dry-run` to skip POSTs.
+ */
+import { chatgptCallbackCimdDocument, chatgptDcrVariants, chatgptStableCimdDocument, cursorDcrVariants, parseClientOption, probeClientName, } from "./client-fixtures.js";
+import { checkGatewayChallenge, fetchOrNull, runDoctor, } from "./doctor.js";
+import { checkGoogleRedirectUri } from "./google-redirect.js";
+const metadataPath = "/.well-known/oauth-authorization-server";
+const cimdNoneRemedy = 'Claude uses CIMD only when the AS advertises both client_id_metadata_document_supported: true ' +
+    'AND "none" in token_endpoint_auth_methods_supported. Missing "none" means Claude silently ' +
+    "ignores CIMD, with no error pointing at the cause.";
+const cimdFetchAdvisoryDetail = "Advisory — not proven. This CLI cannot host a publicly-reachable Client ID Metadata Document " +
+    "(HTTPS URL with a path), which is what Claude sends as client_id. AS advertisement of CIMD " +
+    "support is checked separately. A pass here does not mean the rail fetches, caches, or " +
+    "validates a document.";
+const cimdFetchAdvisoryRemedy = "To fully prove CIMD, host a document at an HTTPS URL whose path is non-empty, use that URL as " +
+    "client_id at /authorize, and confirm the AS fetches it and matches redirect_uris. Until then " +
+    "this check is advisory and does not fail the run.";
+const chatgptCimdFetchAdvisoryDetail = `Advisory — not proven. ChatGPT's CIMD client_id is ${chatgptStableCimdDocument} when this AS ` +
+    `advertises RFC 9207 issuer identification, or ${chatgptCallbackCimdDocument} otherwise. This ` +
+    "CLI does not fetch those documents on the AS's behalf. A pass here does not mean the rail " +
+    "fetches, caches, or validates ChatGPT's document.";
+const dcr400Footer = "A DCR 400 is the interesting result. Paste error= and error_description= verbatim into a rail " +
+    "bug; do not work around it client-side.";
+export async function runDoctorAndConnect(issuer, options = {}) {
+    const report = await runDoctor(issuer, options.slug);
+    if (!options.client) {
+        return report;
+    }
+    const clients = parseClientOption(options.client);
+    const reachable = report.checks.find((c) => c.name === "issuer reachable");
+    if (reachable && !reachable.pass) {
+        return { ...report, clients, dryRun: options.dryRun };
+    }
+    const extra = await runClientConformance({
+        issuer: report.issuer,
+        clients,
+        dryRun: options.dryRun,
+    });
+    const google = await checkGoogleRedirectUri(report.issuer, {
+        slug: options.slug,
+        dryRun: options.dryRun,
+    });
+    const checks = [...report.checks, ...extra.checks, ...google];
+    return {
+        ...report,
+        clients,
+        dryRun: extra.dryRun,
+        checks,
+        pass: checks.every((c) => c.pass),
+    };
+}
+export async function runClientConformance(options) {
+    const base = options.issuer.trim().replace(/\/+$/, "");
+    const dryRun = !!options.dryRun;
+    const checks = [];
+    const metadata = await fetchMetadata(base);
+    checks.push(metadata.check);
+    if (!metadata.document) {
+        return {
+            issuer: base,
+            slug: options.slug,
+            clients: options.clients,
+            dryRun,
+            pass: false,
+            checks,
+        };
+    }
+    const document = metadata.document;
+    const selected = new Set(options.clients);
+    checks.push(checkPkceS256(document));
+    checks.push(checkRfc9207Iss(document));
+    if (selected.has("cursor")) {
+        checks.push(checkRegistrationEndpoint(document, "cursor"));
+    }
+    if (selected.has("chatgpt")) {
+        checks.push(checkRegistrationEndpoint(document, "chatgpt"));
+        checks.push(...checkChatgptCimd(document));
+    }
+    if (selected.has("claude")) {
+        checks.push(...checkClaudeCimd(document));
+    }
+    if (!dryRun) {
+        const endpoint = resolveRegistrationEndpoint(base, document.registration_endpoint);
+        if (selected.has("cursor") && endpoint) {
+            for (const variant of cursorDcrVariants) {
+                checks.push(await replayDcr(endpoint, "cursor", variant));
+            }
+        }
+        if (selected.has("chatgpt") && endpoint) {
+            for (const variant of chatgptDcrVariants) {
+                checks.push(await replayDcr(endpoint, "chatgpt", variant));
+            }
+        }
+    }
+    if (options.slug) {
+        checks.push(await checkGatewayChallenge(base, options.slug));
+    }
+    return {
+        issuer: base,
+        slug: options.slug,
+        clients: options.clients,
+        dryRun,
+        pass: checks.every((c) => c.pass),
+        checks,
+    };
+}
+async function fetchMetadata(base) {
+    const url = `${base}${metadataPath}`;
+    const response = await fetchOrNull(url);
+    if (!response.ok && response.error) {
+        return {
+            check: {
+                name: "authorization server metadata",
+                pass: false,
+                detail: `${url} could not be reached: ${response.error}`,
+                remedy: "Check the hostname and DNS. MCP clients cannot start OAuth without this document.",
+            },
+        };
+    }
+    if (response.status !== 200) {
+        return {
+            check: {
+                name: "authorization server metadata",
+                pass: false,
+                detail: `${url} returned ${response.status ?? response.error}, expected 200.`,
+                remedy: "MCP clients discover DCR and CIMD from this document. File a rail bug.",
+            },
+        };
+    }
+    let document;
+    try {
+        document = JSON.parse(response.body ?? "");
+    }
+    catch {
+        return {
+            check: {
+                name: "authorization server metadata",
+                pass: false,
+                detail: `${url} did not return JSON.`,
+                remedy: "File this against the rail.",
+            },
+        };
+    }
+    return {
+        check: {
+            name: "authorization server metadata",
+            pass: true,
+            detail: `${url} returned 200.`,
+        },
+        document,
+    };
+}
+function checkPkceS256(document) {
+    const methods = asStringArray(document.code_challenge_methods_supported);
+    if (methods.includes("S256")) {
+        return {
+            name: "PKCE S256",
+            pass: true,
+            detail: `code_challenge_methods_supported includes S256 (${methods.join(", ")}).`,
+        };
+    }
+    return {
+        name: "PKCE S256",
+        pass: false,
+        detail: `code_challenge_methods_supported is [${methods.join(", ")}], expected to include S256.`,
+        remedy: "MCP clients require S256 PKCE. Advertise it in AS metadata.",
+    };
+}
+function checkRfc9207Iss(document) {
+    if (document.authorization_response_iss_parameter_supported === true) {
+        return {
+            name: "RFC 9207 iss parameter",
+            pass: true,
+            detail: "authorization_response_iss_parameter_supported is true.",
+        };
+    }
+    return {
+        name: "RFC 9207 iss parameter",
+        pass: false,
+        detail: `authorization_response_iss_parameter_supported is ${JSON.stringify(document.authorization_response_iss_parameter_supported)}, expected true.`,
+        remedy: "Advertise authorization_response_iss_parameter_supported: true and return iss on every " +
+            "authorization response. ChatGPT uses this flag to choose connector_platform_oauth_redirect " +
+            "versus connector/oauth/{callback_id}; a regression silently changes the redirect URI.",
+    };
+}
+function checkRegistrationEndpoint(document, client) {
+    const endpoint = (document.registration_endpoint ?? "").trim();
+    const name = `${client}: registration_endpoint`;
+    if (endpoint) {
+        return {
+            name,
+            pass: true,
+            detail: `registration_endpoint is ${endpoint}.`,
+        };
+    }
+    const remedy = client === "cursor"
+        ? "Cursor is DCR-only and has no CIMD timeline. Without registration_endpoint in AS metadata, Cursor cannot connect at all."
+        : "ChatGPT prefers CIMD when advertised, but still uses DCR when the plugin builder chooses it or CIMD is unavailable. Without registration_endpoint that fallback cannot register.";
+    return {
+        name,
+        pass: false,
+        detail: "AS metadata has no registration_endpoint.",
+        remedy,
+    };
+}
+function checkClaudeCimd(document) {
+    const advertised = document.client_id_metadata_document_supported === true;
+    const methods = asStringArray(document.token_endpoint_auth_methods_supported);
+    const hasNone = methods.includes("none");
+    const advertisement = advertised
+        ? {
+            name: "claude: CIMD advertisement",
+            pass: true,
+            detail: "client_id_metadata_document_supported is true.",
+        }
+        : {
+            name: "claude: CIMD advertisement",
+            pass: false,
+            detail: `client_id_metadata_document_supported is ${JSON.stringify(document.client_id_metadata_document_supported)}, expected true.`,
+            remedy: cimdNoneRemedy,
+        };
+    const noneMethod = hasNone
+        ? {
+            name: "claude: token endpoint auth none",
+            pass: true,
+            detail: `token_endpoint_auth_methods_supported includes "none" (${methods.join(", ")}).`,
+        }
+        : {
+            name: "claude: token endpoint auth none",
+            pass: false,
+            detail: `token_endpoint_auth_methods_supported is [${methods.join(", ")}], expected to include "none".`,
+            remedy: cimdNoneRemedy,
+        };
+    const fetchValidate = {
+        name: "claude: CIMD fetch-and-validate",
+        pass: true,
+        detail: cimdFetchAdvisoryDetail,
+        remedy: cimdFetchAdvisoryRemedy,
+    };
+    return [advertisement, noneMethod, fetchValidate];
+}
+function checkChatgptCimd(document) {
+    const advertised = document.client_id_metadata_document_supported === true;
+    const advertisement = advertised
+        ? {
+            name: "chatgpt: CIMD advertisement",
+            pass: true,
+            detail: "client_id_metadata_document_supported is true. ChatGPT prefers CIMD when advertised " +
+                `(stable document ${chatgptStableCimdDocument} if RFC 9207 iss is also true).`,
+        }
+        : {
+            name: "chatgpt: CIMD advertisement",
+            pass: false,
+            detail: `client_id_metadata_document_supported is ${JSON.stringify(document.client_id_metadata_document_supported)}, expected true.`,
+            remedy: "ChatGPT prefers CIMD when the AS advertises client_id_metadata_document_supported: true. " +
+                "Without it ChatGPT falls back to DCR (or cannot register if registration_endpoint is also missing).",
+        };
+    const fetchValidate = {
+        name: "chatgpt: CIMD fetch-and-validate",
+        pass: true,
+        detail: chatgptCimdFetchAdvisoryDetail,
+        remedy: cimdFetchAdvisoryRemedy,
+    };
+    return [advertisement, fetchValidate];
+}
+async function replayDcr(endpoint, client, variant) {
+    const sent = variant.payload.redirect_uris;
+    const body = {
+        ...variant.payload,
+        client_name: probeClientName(client, variant.id),
+    };
+    const response = await fetchOrNull(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok && response.error) {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: `POST ${endpoint} could not be reached: ${response.error}`,
+            remedy: "The registration_endpoint was advertised but did not respond. File a rail bug.",
+        };
+    }
+    if (response.status === 400) {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: `DCR 400: ${formatDcrError(response.body)}`,
+            remedy: dcr400Footer,
+        };
+    }
+    if (response.status !== 201) {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: `POST ${endpoint} returned ${response.status ?? response.error}, expected 201. ${formatDcrError(response.body)}`,
+            remedy: "DCR must succeed with 201 for this client's real payload. File a rail bug.",
+        };
+    }
+    let echoed;
+    try {
+        echoed = JSON.parse(response.body ?? "");
+    }
+    catch {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: "DCR returned 201 but the body was not JSON.",
+            remedy: "File this against the rail.",
+        };
+    }
+    const dropped = missingRedirectUris(sent, echoed.redirect_uris);
+    if (dropped.length > 0) {
+        return {
+            name: variant.checkName,
+            pass: false,
+            detail: `DCR returned 201 but dropped redirect_uris: ${dropped.join(", ")}. ` +
+                `Sent [${sent.join(", ")}]; echoed ${JSON.stringify(echoed.redirect_uris)}.`,
+            remedy: "A silently dropped callback fails later at /authorize with a confusing redirect_uri " +
+                "mismatch. Echo every registered URI.",
+        };
+    }
+    const clientId = typeof echoed.client_id === "string" ? echoed.client_id : "(none)";
+    return {
+        name: variant.checkName,
+        pass: true,
+        detail: `DCR 201; client_id=${clientId}; redirect_uris echoed in full. Stamped client_name for cleanup sweep.`,
+    };
+}
+function missingRedirectUris(sent, echoed) {
+    if (!Array.isArray(echoed)) {
+        return [...sent];
+    }
+    const got = new Set(echoed.map((value) => String(value)));
+    return sent.filter((uri) => !got.has(uri));
+}
+function formatDcrError(raw) {
+    if (!raw) {
+        return "error=(empty) error_description=(empty)";
+    }
+    try {
+        const body = JSON.parse(raw);
+        const error = body.error !== undefined ? String(body.error) : "(none)";
+        const description = body.error_description !== undefined ? String(body.error_description) : "(none)";
+        return `error=${error} error_description=${description}`;
+    }
+    catch {
+        return raw.slice(0, 300);
+    }
+}
+function resolveRegistrationEndpoint(base, value) {
+    const endpoint = (value ?? "").trim();
+    if (!endpoint) {
+        return undefined;
+    }
+    try {
+        return new URL(endpoint, `${base}/`).href;
+    }
+    catch {
+        return undefined;
+    }
+}
+function asStringArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.map((entry) => String(entry));
+}
+//# sourceMappingURL=client-conformance.js.map

package/dist/client-conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-conformance.js","sourceRoot":"","sources":["../src/client-conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAGhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,SAAS,GAGV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAkB9D,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D,MAAM,cAAc,GAClB,gGAAgG;IAChG,4FAA4F;IAC5F,oDAAoD,CAAC;AAEvD,MAAM,uBAAuB,GAC3B,+FAA+F;IAC/F,6FAA6F;IAC7F,wFAAwF;IACxF,uBAAuB,CAAC;AAE1B,MAAM,uBAAuB,GAC3B,gGAAgG;IAChG,+FAA+F;IAC/F,mDAAmD,CAAC;AAEtD,MAAM,8BAA8B,GAClC,sDAAsD,yBAAyB,gBAAgB;IAC/F,iDAAiD,2BAA2B,mBAAmB;IAC/F,4FAA4F;IAC5F,mDAAmD,CAAC;AAEtD,MAAM,YAAY,GAChB,gGAAgG;IAChG,yCAAyC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,UAAgE,EAAE;IAElE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAC3E,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE;QACzD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;IAC9D,OAAO;QACL,GAAG,MAAM;QACT,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM;YACN,IAAI,EAAE,KAAK;YACX,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,YAAY,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,0BAA0B,QAAQ,CAAC,KAAK,EAAE;gBACxD,MAAM,EAAE,mFAAmF;aAC5F;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,iBAAiB;gBAC7E,MAAM,EAAE,wEAAwE;aACjF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAgC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,GAAG,GAAG,uBAAuB;gBACrC,MAAM,EAAE,6BAA6B;aACtC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,GAAG,gBAAgB;SAC/B;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAqC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mDAAmD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAClF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;QAChG,MAAM,EAAE,6DAA6D;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,IAAI,QAAQ,CAAC,8CAA8C,KAAK,IAAI,EAAE,CAAC;QACrE,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,yDAAyD;SAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,qDAAqD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8CAA8C,CAAC,kBAAkB;QACtJ,MAAM,EACJ,yFAAyF;YACzF,6FAA6F;YAC7F,uFAAuF;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,QAAqC,EACrC,MAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,GAAG,MAAM,yBAAyB,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,4BAA4B,QAAQ,GAAG;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,MAAM,KAAK,QAAQ;QACjB,CAAC,CAAC,0HAA0H;QAC5H,CAAC,CAAC,kLAAkL,CAAC;IAEzL,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,2CAA2C;QACnD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAqC;IAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,aAAa,GAAgB,UAAU;QAC3C,CAAC,CAAC;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,gDAAgD;SACzD;QACH,CAAC,CAAC;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,kBAAkB;YACpI,MAAM,EAAE,cAAc;SACvB,CAAC;IAEN,MAAM,UAAU,GAAgB,OAAO;QACrC,CAAC,CAAC;YACE,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,0DAA0D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACzF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;YACvG,MAAM,EAAE,cAAc;SACvB,CAAC;IAEN,MAAM,aAAa,GAAgB;QACjC,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAqC;IAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,qCAAqC,KAAK,IAAI,CAAC;IAE3E,MAAM,aAAa,GAAgB,UAAU;QAC3C,CAAC,CAAC;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,IAAI;YACV,MAAM,EACJ,sFAAsF;gBACtF,oBAAoB,yBAAyB,iCAAiC;SACjF;QACH,CAAC,CAAC;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,4CAA4C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,kBAAkB;YACpI,MAAM,EACJ,2FAA2F;gBAC3F,qGAAqG;SACxG,CAAC;IAEN,MAAM,aAAa,GAAgB;QACjC,IAAI,EAAE,kCAAkC;QACxC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,uBAAuB;KAChC,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAAgB,EAChB,MAAgB,EAChB,OAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,GAAG,OAAO,CAAC,OAAO;QAClB,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;KACjD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ,QAAQ,0BAA0B,QAAQ,CAAC,KAAK,EAAE;YAClE,MAAM,EAAE,gFAAgF;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,YAAY,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnD,MAAM,EAAE,YAAY;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ,QAAQ,aAAa,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,mBAAmB,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACxH,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,MAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAqD,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,6CAA6C;YACrD,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,IAAI,EAAE,KAAK;YACX,MAAM,EACJ,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACrE,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG;YAC9E,MAAM,EACJ,sFAAsF;gBACtF,sCAAsC;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,SAAS;QACvB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,sBAAsB,QAAQ,wEAAwE;KAC/G,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc,EAAE,MAAe;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqD,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvE,MAAM,WAAW,GACf,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,OAAO,SAAS,KAAK,sBAAsB,WAAW,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,KAAyB;IAC1E,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/client-fixtures.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Canonical OAuth registration payloads as the named MCP clients actually send them.
+ *
+ * A wrong fixture is worse than no test: it would certify the rail against a made-up client.
+ * Keep `.cursor/skills/mcp-oauth-paywall/references/client-compatibility.md` in sync with this file.
+ */
+export declare const clientIds: readonly ["cursor", "claude", "chatgpt"];
+export type ClientId = (typeof clientIds)[number];
+export type DcrPayload = {
+    redirect_uris: string[];
+    token_endpoint_auth_method: string;
+    grant_types: string[];
+    response_types: string[];
+    application_type?: string;
+};
+export type DcrVariant = {
+    id: string;
+    /** Stable check name; included in the doctor report. */
+    checkName: string;
+    payload: DcrPayload;
+};
+export declare const dcrProbeClientNamePrefix = "authflow-cli doctor-connect";
+/**
+ * Cursor is DCR-only. The three-URI set is what it has sent since ~May 2026
+ * (https://forum.cursor.com/t/mcp-server-regression-mcp-oauth-registration-fails/159910,
+ * https://cursor.com/docs/mcp.md). `application_type` is deliberately absent — Cursor omits it
+ * (https://forum.cursor.com/t/cursor-does-not-send-application-type-native-when-registering-mcp-oauth-clients/136907).
+ */
+export declare const cursorCanonicalDcr: DcrVariant;
+/** Same callbacks with `application_type: "web"` stated explicitly — a shape Cursor has also sent. */
+export declare const cursorApplicationTypeWebDcr: DcrVariant;
+/** Older Cursor registrations sent only the private-use callback. */
+export declare const cursorSchemeOnlyDcr: DcrVariant;
+export declare const cursorDcrVariants: DcrVariant[];
+/**
+ * Obviously-fake callback id. ChatGPT mints a real one per connector; we cannot capture it.
+ * Used only to pin the documented URL shape.
+ */
+export declare const chatgptCallbackIdPlaceholder = "CALLBACK_ID_PLACEHOLDER";
+export declare const chatgptStableRedirectUri = "https://chatgpt.com/connector_platform_oauth_redirect";
+export declare const chatgptCallbackRedirectUri = "https://chatgpt.com/connector/oauth/CALLBACK_ID_PLACEHOLDER";
+export declare const chatgptStableCimdDocument = "https://chatgpt.com/oauth/client.json";
+export declare const chatgptCallbackCimdDocument = "https://chatgpt.com/oauth/CALLBACK_ID_PLACEHOLDER/client.json";
+/**
+ * Primary ChatGPT DCR shape for this rail. Our AS advertises
+ * `authorization_response_iss_parameter_supported: true` and uses the same issuer in PRM, so
+ * ChatGPT selects this stable callback
+ * (https://developers.openai.com/plugins/build/auth, https://developers.openai.com/plugins/changelog
+ * 2026-08-21). A regression in that metadata flag silently switches ChatGPT to the callback-ID URI
+ * below. The rest of the body is the RFC 7591 public-client shape, not a captured ChatGPT POST.
+ *
+ * The Apps SDK page still calls this URI "legacy" for already-published apps and names
+ * `connector/oauth/{callback_id}` as the production allowlist entry
+ * (https://developers.openai.com/apps-sdk/build/auth). Both pages agree both URIs exist; they
+ * disagree on which is current. We replay both.
+ */
+export declare const chatgptStableRedirectDcr: DcrVariant;
+/**
+ * Callback-ID DCR shape. `{callback_id}` is a placeholder, not a captured id. ChatGPT sends this
+ * when the AS does not meet RFC 9207 issuer identification, or when the Apps SDK path is in play.
+ */
+export declare const chatgptCallbackIdDcr: DcrVariant;
+export declare const chatgptDcrVariants: DcrVariant[];
+export declare function isClientId(value: string): value is ClientId;
+export declare function parseClientOption(value: string): ClientId[];
+export declare function dcrVariantsFor(client: ClientId): DcrVariant[];
+export declare function probeClientName(client: ClientId, variantId: string): string;

package/dist/client-fixtures.js

@@ -0,0 +1,130 @@
+/**
+ * Canonical OAuth registration payloads as the named MCP clients actually send them.
+ *
+ * A wrong fixture is worse than no test: it would certify the rail against a made-up client.
+ * Keep `.cursor/skills/mcp-oauth-paywall/references/client-compatibility.md` in sync with this file.
+ */
+export const clientIds = ["cursor", "claude", "chatgpt"];
+export const dcrProbeClientNamePrefix = "authflow-cli doctor-connect";
+/**
+ * Cursor is DCR-only. The three-URI set is what it has sent since ~May 2026
+ * (https://forum.cursor.com/t/mcp-server-regression-mcp-oauth-registration-fails/159910,
+ * https://cursor.com/docs/mcp.md). `application_type` is deliberately absent — Cursor omits it
+ * (https://forum.cursor.com/t/cursor-does-not-send-application-type-native-when-registering-mcp-oauth-clients/136907).
+ */
+export const cursorCanonicalDcr = {
+    id: "canonical",
+    checkName: "cursor: DCR canonical",
+    payload: {
+        redirect_uris: [
+            "cursor://anysphere.cursor-mcp/oauth/callback",
+            "https://www.cursor.com/agents/mcp/oauth/callback",
+            "http://localhost:8787/callback",
+        ],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+    },
+};
+/** Same callbacks with `application_type: "web"` stated explicitly — a shape Cursor has also sent. */
+export const cursorApplicationTypeWebDcr = {
+    id: "application_type-web",
+    checkName: "cursor: DCR application_type web",
+    payload: {
+        ...cursorCanonicalDcr.payload,
+        redirect_uris: [...cursorCanonicalDcr.payload.redirect_uris],
+        grant_types: [...cursorCanonicalDcr.payload.grant_types],
+        response_types: [...cursorCanonicalDcr.payload.response_types],
+        application_type: "web",
+    },
+};
+/** Older Cursor registrations sent only the private-use callback. */
+export const cursorSchemeOnlyDcr = {
+    id: "cursor-scheme-only",
+    checkName: "cursor: DCR cursor-scheme only",
+    payload: {
+        redirect_uris: ["cursor://anysphere.cursor-mcp/oauth/callback"],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+    },
+};
+export const cursorDcrVariants = [
+    cursorCanonicalDcr,
+    cursorApplicationTypeWebDcr,
+    cursorSchemeOnlyDcr,
+];
+/**
+ * Obviously-fake callback id. ChatGPT mints a real one per connector; we cannot capture it.
+ * Used only to pin the documented URL shape.
+ */
+export const chatgptCallbackIdPlaceholder = "CALLBACK_ID_PLACEHOLDER";
+export const chatgptStableRedirectUri = "https://chatgpt.com/connector_platform_oauth_redirect";
+export const chatgptCallbackRedirectUri = `https://chatgpt.com/connector/oauth/${chatgptCallbackIdPlaceholder}`;
+export const chatgptStableCimdDocument = "https://chatgpt.com/oauth/client.json";
+export const chatgptCallbackCimdDocument = `https://chatgpt.com/oauth/${chatgptCallbackIdPlaceholder}/client.json`;
+/**
+ * Primary ChatGPT DCR shape for this rail. Our AS advertises
+ * `authorization_response_iss_parameter_supported: true` and uses the same issuer in PRM, so
+ * ChatGPT selects this stable callback
+ * (https://developers.openai.com/plugins/build/auth, https://developers.openai.com/plugins/changelog
+ * 2026-08-21). A regression in that metadata flag silently switches ChatGPT to the callback-ID URI
+ * below. The rest of the body is the RFC 7591 public-client shape, not a captured ChatGPT POST.
+ *
+ * The Apps SDK page still calls this URI "legacy" for already-published apps and names
+ * `connector/oauth/{callback_id}` as the production allowlist entry
+ * (https://developers.openai.com/apps-sdk/build/auth). Both pages agree both URIs exist; they
+ * disagree on which is current. We replay both.
+ */
+export const chatgptStableRedirectDcr = {
+    id: "stable-redirect",
+    checkName: "chatgpt: DCR stable redirect",
+    payload: {
+        redirect_uris: [chatgptStableRedirectUri],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+    },
+};
+/**
+ * Callback-ID DCR shape. `{callback_id}` is a placeholder, not a captured id. ChatGPT sends this
+ * when the AS does not meet RFC 9207 issuer identification, or when the Apps SDK path is in play.
+ */
+export const chatgptCallbackIdDcr = {
+    id: "callback-id",
+    checkName: "chatgpt: DCR callback-id redirect",
+    payload: {
+        redirect_uris: [chatgptCallbackRedirectUri],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+    },
+};
+export const chatgptDcrVariants = [chatgptStableRedirectDcr, chatgptCallbackIdDcr];
+export function isClientId(value) {
+    return clientIds.includes(value);
+}
+export function parseClientOption(value) {
+    const key = value.trim().toLowerCase();
+    if (key === "all") {
+        return [...clientIds];
+    }
+    if (isClientId(key)) {
+        return [key];
+    }
+    throw new Error(`Unknown --client '${value}'. Use cursor, claude, chatgpt, or all.`);
+}
+export function dcrVariantsFor(client) {
+    switch (client) {
+        case "cursor":
+            return cursorDcrVariants;
+        case "chatgpt":
+            return chatgptDcrVariants;
+        case "claude":
+            return [];
+    }
+}
+export function probeClientName(client, variantId) {
+    return `${dcrProbeClientNamePrefix} ${client} ${variantId}`;
+}
+//# sourceMappingURL=client-fixtures.js.map

package/dist/client-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-fixtures.js","sourceRoot":"","sources":["../src/client-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAkBlE,MAAM,CAAC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAe;IAC5C,EAAE,EAAE,WAAW;IACf,SAAS,EAAE,uBAAuB;IAClC,OAAO,EAAE;QACP,aAAa,EAAE;YACb,8CAA8C;YAC9C,kDAAkD;YAClD,gCAAgC;SACjC;QACD,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB;CACF,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,2BAA2B,GAAe;IACrD,EAAE,EAAE,sBAAsB;IAC1B,SAAS,EAAE,kCAAkC;IAC7C,OAAO,EAAE;QACP,GAAG,kBAAkB,CAAC,OAAO;QAC7B,aAAa,EAAE,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5D,WAAW,EAAE,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC;QACxD,cAAc,EAAE,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QAC9D,gBAAgB,EAAE,KAAK;KACxB;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,EAAE,EAAE,oBAAoB;IACxB,SAAS,EAAE,gCAAgC;IAC3C,OAAO,EAAE;QACP,aAAa,EAAE,CAAC,8CAA8C,CAAC;QAC/D,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,kBAAkB;IAClB,2BAA2B;IAC3B,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAEtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,uDAAuD,CAAC;AAChG,MAAM,CAAC,MAAM,0BAA0B,GAAG,uCAAuC,4BAA4B,EAAE,CAAC;AAChH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uCAAuC,CAAC;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,4BAA4B,cAAc,CAAC;AAEnH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe;IAClD,EAAE,EAAE,iBAAiB;IACrB,SAAS,EAAE,8BAA8B;IACzC,OAAO,EAAE;QACP,aAAa,EAAE,CAAC,wBAAwB,CAAC;QACzC,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAe;IAC9C,EAAE,EAAE,aAAa;IACjB,SAAS,EAAE,mCAAmC;IAC9C,OAAO,EAAE;QACP,aAAa,EAAE,CAAC,0BAA0B,CAAC;QAC3C,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAiB,CAAC,wBAAwB,EAAE,oBAAoB,CAAC,CAAC;AAEjG,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAQ,SAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,yCAAyC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAgB;IAC7C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC;QAC3B,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAgB,EAAE,SAAiB;IACjE,OAAO,GAAG,wBAAwB,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;AAC9D,CAAC"}