editmamei 1.9.6 → 1.9.7

package/node_modules/@modelcontextprotocol/core/dist/auth-CmOFayUJ.d.cts

@@ -0,0 +1,293 @@
+import * as z from "zod/v4";
+
+//#region src/auth.d.ts
+
+/**
+ * Reusable URL validation that disallows `javascript:` scheme
+ */
+declare const SafeUrlSchema: z.ZodURL;
+/**
+ * RFC 9728 OAuth Protected Resource Metadata
+ */
+declare const OAuthProtectedResourceMetadataSchema: z.ZodObject<{
+  resource: z.ZodString;
+  authorization_servers: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+  jwks_uri: z.ZodOptional<z.ZodString>;
+  scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  bearer_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  resource_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  resource_name: z.ZodOptional<z.ZodString>;
+  resource_documentation: z.ZodOptional<z.ZodString>;
+  resource_policy_uri: z.ZodOptional<z.ZodString>;
+  resource_tos_uri: z.ZodOptional<z.ZodString>;
+  tls_client_certificate_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+  authorization_details_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  dpop_bound_access_tokens_required: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/**
+ * RFC 8414 OAuth 2.0 Authorization Server Metadata
+ */
+declare const OAuthMetadataSchema: z.ZodObject<{
+  issuer: z.ZodString;
+  authorization_endpoint: z.ZodURL;
+  token_endpoint: z.ZodURL;
+  registration_endpoint: z.ZodOptional<z.ZodURL>;
+  scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types_supported: z.ZodArray<z.ZodString>;
+  response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  service_documentation: z.ZodOptional<z.ZodURL>;
+  revocation_endpoint: z.ZodOptional<z.ZodURL>;
+  revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  revocation_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  introspection_endpoint: z.ZodOptional<z.ZodString>;
+  introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+  /**
+   * RFC 9449 §5.1 (DPoP, SEP-1932): the JWS `alg` values this authorization server accepts for
+   * DPoP proofs at the token endpoint. A server supporting DPoP MUST publish this field.
+   */
+  dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+/**
+ * OpenID Connect Discovery 1.0 Provider Metadata
+ *
+ * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+ */
+declare const OpenIdProviderMetadataSchema: z.ZodObject<{
+  issuer: z.ZodString;
+  authorization_endpoint: z.ZodURL;
+  token_endpoint: z.ZodURL;
+  userinfo_endpoint: z.ZodOptional<z.ZodURL>;
+  jwks_uri: z.ZodURL;
+  registration_endpoint: z.ZodOptional<z.ZodURL>;
+  scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types_supported: z.ZodArray<z.ZodString>;
+  response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  acr_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  subject_types_supported: z.ZodArray<z.ZodString>;
+  id_token_signing_alg_values_supported: z.ZodArray<z.ZodString>;
+  id_token_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  id_token_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claim_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claims_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  service_documentation: z.ZodOptional<z.ZodString>;
+  claims_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claims_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  request_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  request_uri_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  require_request_uri_registration: z.ZodOptional<z.ZodBoolean>;
+  op_policy_uri: z.ZodOptional<z.ZodURL>;
+  op_tos_uri: z.ZodOptional<z.ZodURL>;
+  client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$loose>;
+/**
+ * OpenID Connect Discovery metadata that may include OAuth 2.0 fields
+ * This schema represents the real-world scenario where OIDC providers
+ * return a mix of OpenID Connect and OAuth 2.0 metadata fields
+ */
+declare const OpenIdProviderDiscoveryMetadataSchema: z.ZodObject<{
+  code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  issuer: z.ZodString;
+  authorization_endpoint: z.ZodURL;
+  token_endpoint: z.ZodURL;
+  userinfo_endpoint: z.ZodOptional<z.ZodURL>;
+  jwks_uri: z.ZodURL;
+  registration_endpoint: z.ZodOptional<z.ZodURL>;
+  scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types_supported: z.ZodArray<z.ZodString>;
+  response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  acr_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  subject_types_supported: z.ZodArray<z.ZodString>;
+  id_token_signing_alg_values_supported: z.ZodArray<z.ZodString>;
+  id_token_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  id_token_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  userinfo_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  request_object_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claim_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claims_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  service_documentation: z.ZodOptional<z.ZodString>;
+  claims_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  claims_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  request_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  request_uri_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+  require_request_uri_registration: z.ZodOptional<z.ZodBoolean>;
+  op_policy_uri: z.ZodOptional<z.ZodURL>;
+  op_tos_uri: z.ZodOptional<z.ZodURL>;
+  client_id_metadata_document_supported: z.ZodOptional<z.ZodBoolean>;
+  authorization_response_iss_parameter_supported: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+/**
+ * OAuth 2.1 token response
+ */
+declare const OAuthTokensSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  id_token: z.ZodOptional<z.ZodString>;
+  token_type: z.ZodString;
+  expires_in: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+  scope: z.ZodOptional<z.ZodString>;
+  refresh_token: z.ZodOptional<z.ZodString>;
+  issuer: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * RFC 8693 §2.2.1 Token Exchange response for ID-JAG tokens.
+ *
+ * `token_type` is intentionally optional: per RFC 8693 §2.2.1 it is informational when
+ * the issued token is not an access token, and per RFC 6749 §5.1 it is case-insensitive,
+ * so strict checking rejects conformant IdPs.
+ */
+declare const IdJagTokenExchangeResponseSchema: z.ZodObject<{
+  issued_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:id-jag">;
+  access_token: z.ZodString;
+  token_type: z.ZodOptional<z.ZodString>;
+  expires_in: z.ZodOptional<z.ZodNumber>;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type IdJagTokenExchangeResponse = z.infer<typeof IdJagTokenExchangeResponseSchema>;
+/**
+ * OAuth 2.1 error response
+ */
+declare const OAuthErrorResponseSchema: z.ZodObject<{
+  error: z.ZodString;
+  error_description: z.ZodOptional<z.ZodString>;
+  error_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Optional version of {@linkcode SafeUrlSchema} that allows empty string for backward compatibility on `tos_uri` and `logo_uri`
+ */
+declare const OptionalSafeUrlSchema: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
+ */
+declare const OAuthClientMetadataSchema: z.ZodObject<{
+  redirect_uris: z.ZodArray<z.ZodURL>;
+  token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+  grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  application_type: z.ZodOptional<z.ZodString>;
+  client_name: z.ZodOptional<z.ZodString>;
+  client_uri: z.ZodOptional<z.ZodURL>;
+  logo_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+  scope: z.ZodOptional<z.ZodString>;
+  contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  tos_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+  policy_uri: z.ZodOptional<z.ZodString>;
+  jwks_uri: z.ZodOptional<z.ZodURL>;
+  jwks: z.ZodOptional<z.ZodAny>;
+  software_id: z.ZodOptional<z.ZodString>;
+  software_version: z.ZodOptional<z.ZodString>;
+  software_statement: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration client information
+ */
+declare const OAuthClientInformationSchema: z.ZodObject<{
+  client_id: z.ZodString;
+  client_secret: z.ZodOptional<z.ZodString>;
+  client_id_issued_at: z.ZodOptional<z.ZodNumber>;
+  client_secret_expires_at: z.ZodOptional<z.ZodNumber>;
+  issuer: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
+ */
+declare const OAuthClientInformationFullSchema: z.ZodObject<{
+  redirect_uris: z.ZodArray<z.ZodURL>;
+  token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+  grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  application_type: z.ZodOptional<z.ZodString>;
+  client_name: z.ZodOptional<z.ZodString>;
+  client_uri: z.ZodOptional<z.ZodURL>;
+  logo_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+  scope: z.ZodOptional<z.ZodString>;
+  contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  tos_uri: z.ZodUnion<[z.ZodOptional<z.ZodURL>, z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>]>;
+  policy_uri: z.ZodOptional<z.ZodString>;
+  jwks_uri: z.ZodOptional<z.ZodURL>;
+  jwks: z.ZodOptional<z.ZodAny>;
+  software_id: z.ZodOptional<z.ZodString>;
+  software_version: z.ZodOptional<z.ZodString>;
+  software_statement: z.ZodOptional<z.ZodString>;
+  client_id: z.ZodString;
+  client_secret: z.ZodOptional<z.ZodString>;
+  client_id_issued_at: z.ZodOptional<z.ZodNumber>;
+  client_secret_expires_at: z.ZodOptional<z.ZodNumber>;
+  issuer: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * RFC 7591 OAuth 2.0 Dynamic Client Registration error response
+ */
+declare const OAuthClientRegistrationErrorSchema: z.ZodObject<{
+  error: z.ZodString;
+  error_description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * RFC 7009 OAuth 2.0 Token Revocation request
+ */
+declare const OAuthTokenRevocationRequestSchema: z.ZodObject<{
+  token: z.ZodString;
+  token_type_hint: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type OAuthMetadata = z.infer<typeof OAuthMetadataSchema>;
+type OpenIdProviderMetadata = z.infer<typeof OpenIdProviderMetadataSchema>;
+type OpenIdProviderDiscoveryMetadata = z.infer<typeof OpenIdProviderDiscoveryMetadataSchema>;
+type OAuthTokens = z.infer<typeof OAuthTokensSchema>;
+type OAuthErrorResponse = z.infer<typeof OAuthErrorResponseSchema>;
+type OAuthClientMetadata = z.infer<typeof OAuthClientMetadataSchema>;
+type OAuthClientInformation = z.infer<typeof OAuthClientInformationSchema>;
+type OAuthClientInformationFull = z.infer<typeof OAuthClientInformationFullSchema>;
+type OAuthClientInformationMixed = OAuthClientInformation | OAuthClientInformationFull;
+/**
+ * {@linkcode OAuthTokens} as persisted by an `OAuthClientProvider`. Adds an
+ * SDK-stamped authorization-server `issuer` identifier so stored tokens are
+ * bound to the AS that issued them. The `issuer` field is **not** part of the
+ * RFC 6749 wire response; the client SDK writes it before calling `saveTokens`.
+ */
+type StoredOAuthTokens = OAuthTokens & {
+  issuer?: string | undefined;
+};
+/**
+ * {@linkcode OAuthClientInformationMixed} as persisted by an
+ * `OAuthClientProvider`. Adds an SDK-stamped authorization-server `issuer`
+ * identifier so stored client credentials are bound to the AS that issued them.
+ * The `issuer` field is **not** part of the RFC 7591 wire response; the client SDK
+ * writes it before calling `saveClientInformation`.
+ */
+type StoredOAuthClientInformation = OAuthClientInformationMixed & {
+  issuer?: string | undefined;
+};
+type OAuthClientRegistrationError = z.infer<typeof OAuthClientRegistrationErrorSchema>;
+type OAuthTokenRevocationRequest = z.infer<typeof OAuthTokenRevocationRequestSchema>;
+type OAuthProtectedResourceMetadata = z.infer<typeof OAuthProtectedResourceMetadataSchema>;
+type AuthorizationServerMetadata = OAuthMetadata | OpenIdProviderDiscoveryMetadata;
+//#endregion
+export { StoredOAuthTokens as A, OpenIdProviderDiscoveryMetadata as C, OptionalSafeUrlSchema as D, OpenIdProviderMetadataSchema as E, SafeUrlSchema as O, OAuthTokensSchema as S, OpenIdProviderMetadata as T, OAuthProtectedResourceMetadata as _, OAuthClientInformationFull as a, OAuthTokenRevocationRequestSchema as b, OAuthClientInformationSchema as c, OAuthClientRegistrationError as d, OAuthClientRegistrationErrorSchema as f, OAuthMetadataSchema as g, OAuthMetadata as h, OAuthClientInformation as i, StoredOAuthClientInformation as k, OAuthClientMetadata as l, OAuthErrorResponseSchema as m, IdJagTokenExchangeResponse as n, OAuthClientInformationFullSchema as o, OAuthErrorResponse as p, IdJagTokenExchangeResponseSchema as r, OAuthClientInformationMixed as s, AuthorizationServerMetadata as t, OAuthClientMetadataSchema as u, OAuthProtectedResourceMetadataSchema as v, OpenIdProviderDiscoveryMetadataSchema as w, OAuthTokens as x, OAuthTokenRevocationRequest as y };
+//# sourceMappingURL=auth-CmOFayUJ.d.cts.map

package/node_modules/@modelcontextprotocol/core/dist/auth-CmOFayUJ.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-CmOFayUJ.d.cts","names":[],"sources":["../src/auth.ts"],"sourcesContent":[],"mappings":";;;;;;AAKA;AAwBa,cAxBA,aAwBA,EAxBa,CAAA,CAAA,MAuCxB;;;;cAfW,sCAAoC,CAAA,CAAA;;;;;;;;;;;;;;;;;;;cAoBpC,qBAAmB,CAAA,CAAA;;;;;;;;;;;;EApBiB,mBAAA,eAAA,SAAA,CAAA;EAAA,0CAAA,eAAA,WAAA,YAAA,CAAA,CAAA;EAoBpC,qDA2BX,eAAA,WAAA,YAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;cAOW,8BAA4B,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAlCT,UAAA,eAAA,SAAA,CAAA;EAAA,qCAAA,eAAA,aAAA,CAAA;EAkCnB,8CAuCX,YAAA,cAAA,aAAA,CAAA,CAAA;;;;;;;cAOW,uCAAqC,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAUrC,mBAAiB,CAAA,CAAA;;;;;;;;;;;;;;;;cAwBjB,kCAAgC,CAAA,CAAA;;;;;;;KAUjC,0BAAA,GAA6B,CAAA,CAAE,aAAa;;;;cAK3C,0BAAwB,CAAA,CAAA;;;;;;;;cAUxB,uBAAqB,CAAA,CAAA,UAAA,CAAA,CAAA,YAAA,CAAA,CAAA,SAAA,CAAA,CAAA,QAAA,CAAA,CAAA,gBAAA,CAAA,CAAA;;;;cAKrB,2BAAyB,CAAA,CAAA;;;EA9GG,WAAA,eAAA,WAAA,YAAA,CAAA,CAAA;EAAA,cAAA,eAAA,WAAA,YAAA,CAAA,CAAA;EA8C5B,gBAAA,eAAA,YAKX,CAAA;;;;;;;;;;;;;;;;;cA4FW,8BAA4B,CAAA,CAAA;;;;;;;;;;cAkB5B,kCAAgC,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAKhC,oCAAkC,CAAA,CAAA;;;;;;;cAUlC,mCAAiC,CAAA,CAAA;;;;KAOlC,aAAA,GAAgB,CAAA,CAAE,aAAa;KAC/B,sBAAA,GAAyB,CAAA,CAAE,aAAa;KACxC,+BAAA,GAAkC,CAAA,CAAE,aAAa;KAEjD,WAAA,GAAc,CAAA,CAAE,aAAa;KAC7B,kBAAA,GAAqB,CAAA,CAAE,aAAa;KACpC,mBAAA,GAAsB,CAAA,CAAE,aAAa;KACrC,sBAAA,GAAyB,CAAA,CAAE,aAAa;KACxC,0BAAA,GAA6B,CAAA,CAAE,aAAa;KAC5C,2BAAA,GAA8B,yBAAyB;;;;;;;KAQvD,iBAAA,GAAoB;;;;;;;;;;KASpB,4BAAA,GAA+B;;;KAE/B,4BAAA,GAA+B,CAAA,CAAE,aAAa;KAC9C,2BAAA,GAA8B,CAAA,CAAE,aAAa;AAtKP,KAuKtC,8BAAA,GAAiC,CAAA,CAAE,KAvKG,CAAA,OAuKU,oCAvKV,CAAA;AAAA,KA0KtC,2BAAA,GAA8B,aA1KQ,GA0KQ,+BA1KR"}

package/node_modules/@modelcontextprotocol/core/dist/auth-UMQCo-ad.mjs

@@ -0,0 +1,209 @@
+import * as z from "zod/v4";
+
+//#region src/auth.ts
+/**
+* Reusable URL validation that disallows `javascript:` scheme
+*/
+const SafeUrlSchema = z.url().superRefine((val, ctx) => {
+	if (!URL.canParse(val)) {
+		ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "URL must be parseable",
+			fatal: true
+		});
+		return z.NEVER;
+	}
+}).refine((url) => {
+	const u = new URL(url);
+	return u.protocol !== "javascript:" && u.protocol !== "data:" && u.protocol !== "vbscript:";
+}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" });
+/**
+* RFC 9728 OAuth Protected Resource Metadata
+*/
+const OAuthProtectedResourceMetadataSchema = z.looseObject({
+	resource: z.string().url(),
+	authorization_servers: z.array(SafeUrlSchema).optional(),
+	jwks_uri: z.string().url().optional(),
+	scopes_supported: z.array(z.string()).optional(),
+	bearer_methods_supported: z.array(z.string()).optional(),
+	resource_signing_alg_values_supported: z.array(z.string()).optional(),
+	resource_name: z.string().optional(),
+	resource_documentation: z.string().optional(),
+	resource_policy_uri: z.string().url().optional(),
+	resource_tos_uri: z.string().url().optional(),
+	tls_client_certificate_bound_access_tokens: z.boolean().optional(),
+	authorization_details_types_supported: z.array(z.string()).optional(),
+	dpop_signing_alg_values_supported: z.array(z.string()).optional(),
+	dpop_bound_access_tokens_required: z.boolean().optional()
+});
+/**
+* RFC 8414 OAuth 2.0 Authorization Server Metadata
+*/
+const OAuthMetadataSchema = z.looseObject({
+	issuer: z.string(),
+	authorization_endpoint: SafeUrlSchema,
+	token_endpoint: SafeUrlSchema,
+	registration_endpoint: SafeUrlSchema.optional(),
+	scopes_supported: z.array(z.string()).optional(),
+	response_types_supported: z.array(z.string()),
+	response_modes_supported: z.array(z.string()).optional(),
+	grant_types_supported: z.array(z.string()).optional(),
+	token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+	token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
+	service_documentation: SafeUrlSchema.optional(),
+	revocation_endpoint: SafeUrlSchema.optional(),
+	revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+	revocation_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
+	introspection_endpoint: z.string().optional(),
+	introspection_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+	introspection_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
+	code_challenge_methods_supported: z.array(z.string()).optional(),
+	client_id_metadata_document_supported: z.boolean().optional(),
+	authorization_response_iss_parameter_supported: z.boolean().optional().catch(void 0),
+	dpop_signing_alg_values_supported: z.array(z.string()).optional()
+});
+/**
+* OpenID Connect Discovery 1.0 Provider Metadata
+*
+* @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+*/
+const OpenIdProviderMetadataSchema = z.looseObject({
+	issuer: z.string(),
+	authorization_endpoint: SafeUrlSchema,
+	token_endpoint: SafeUrlSchema,
+	userinfo_endpoint: SafeUrlSchema.optional(),
+	jwks_uri: SafeUrlSchema,
+	registration_endpoint: SafeUrlSchema.optional(),
+	scopes_supported: z.array(z.string()).optional(),
+	response_types_supported: z.array(z.string()),
+	response_modes_supported: z.array(z.string()).optional(),
+	grant_types_supported: z.array(z.string()).optional(),
+	acr_values_supported: z.array(z.string()).optional(),
+	subject_types_supported: z.array(z.string()),
+	id_token_signing_alg_values_supported: z.array(z.string()),
+	id_token_encryption_alg_values_supported: z.array(z.string()).optional(),
+	id_token_encryption_enc_values_supported: z.array(z.string()).optional(),
+	userinfo_signing_alg_values_supported: z.array(z.string()).optional(),
+	userinfo_encryption_alg_values_supported: z.array(z.string()).optional(),
+	userinfo_encryption_enc_values_supported: z.array(z.string()).optional(),
+	request_object_signing_alg_values_supported: z.array(z.string()).optional(),
+	request_object_encryption_alg_values_supported: z.array(z.string()).optional(),
+	request_object_encryption_enc_values_supported: z.array(z.string()).optional(),
+	token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+	token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
+	display_values_supported: z.array(z.string()).optional(),
+	claim_types_supported: z.array(z.string()).optional(),
+	claims_supported: z.array(z.string()).optional(),
+	service_documentation: z.string().optional(),
+	claims_locales_supported: z.array(z.string()).optional(),
+	ui_locales_supported: z.array(z.string()).optional(),
+	claims_parameter_supported: z.boolean().optional(),
+	request_parameter_supported: z.boolean().optional(),
+	request_uri_parameter_supported: z.boolean().optional(),
+	require_request_uri_registration: z.boolean().optional(),
+	op_policy_uri: SafeUrlSchema.optional(),
+	op_tos_uri: SafeUrlSchema.optional(),
+	client_id_metadata_document_supported: z.boolean().optional(),
+	authorization_response_iss_parameter_supported: z.boolean().optional().catch(void 0)
+});
+/**
+* OpenID Connect Discovery metadata that may include OAuth 2.0 fields
+* This schema represents the real-world scenario where OIDC providers
+* return a mix of OpenID Connect and OAuth 2.0 metadata fields
+*/
+const OpenIdProviderDiscoveryMetadataSchema = z.object({
+	...OpenIdProviderMetadataSchema.shape,
+	...OAuthMetadataSchema.pick({ code_challenge_methods_supported: true }).shape
+});
+/**
+* OAuth 2.1 token response
+*/
+const OAuthTokensSchema = z.object({
+	access_token: z.string(),
+	id_token: z.string().optional(),
+	token_type: z.string(),
+	expires_in: z.coerce.number().optional(),
+	scope: z.string().optional(),
+	refresh_token: z.string().optional(),
+	issuer: z.string().optional().catch(void 0)
+}).strip();
+/**
+* RFC 8693 §2.2.1 Token Exchange response for ID-JAG tokens.
+*
+* `token_type` is intentionally optional: per RFC 8693 §2.2.1 it is informational when
+* the issued token is not an access token, and per RFC 6749 §5.1 it is case-insensitive,
+* so strict checking rejects conformant IdPs.
+*/
+const IdJagTokenExchangeResponseSchema = z.object({
+	issued_token_type: z.literal("urn:ietf:params:oauth:token-type:id-jag"),
+	access_token: z.string(),
+	token_type: z.string().optional(),
+	expires_in: z.number().optional(),
+	scope: z.string().optional()
+}).strip();
+/**
+* OAuth 2.1 error response
+*/
+const OAuthErrorResponseSchema = z.object({
+	error: z.string(),
+	error_description: z.string().optional(),
+	error_uri: z.string().optional()
+});
+/**
+* Optional version of {@linkcode SafeUrlSchema} that allows empty string for backward compatibility on `tos_uri` and `logo_uri`
+*/
+const OptionalSafeUrlSchema = SafeUrlSchema.optional().or(z.literal("").transform(() => void 0));
+/**
+* RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
+*/
+const OAuthClientMetadataSchema = z.object({
+	redirect_uris: z.array(SafeUrlSchema),
+	token_endpoint_auth_method: z.string().optional(),
+	grant_types: z.array(z.string()).optional(),
+	response_types: z.array(z.string()).optional(),
+	application_type: z.string().optional(),
+	client_name: z.string().optional(),
+	client_uri: SafeUrlSchema.optional(),
+	logo_uri: OptionalSafeUrlSchema,
+	scope: z.string().optional(),
+	contacts: z.array(z.string()).optional(),
+	tos_uri: OptionalSafeUrlSchema,
+	policy_uri: z.string().optional(),
+	jwks_uri: SafeUrlSchema.optional(),
+	jwks: z.any().optional(),
+	software_id: z.string().optional(),
+	software_version: z.string().optional(),
+	software_statement: z.string().optional()
+}).strip();
+/**
+* RFC 7591 OAuth 2.0 Dynamic Client Registration client information
+*/
+const OAuthClientInformationSchema = z.object({
+	client_id: z.string(),
+	client_secret: z.string().optional(),
+	client_id_issued_at: z.number().optional(),
+	client_secret_expires_at: z.number().optional(),
+	issuer: z.string().optional().catch(void 0)
+}).strip();
+/**
+* RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
+*/
+const OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
+/**
+* RFC 7591 OAuth 2.0 Dynamic Client Registration error response
+*/
+const OAuthClientRegistrationErrorSchema = z.object({
+	error: z.string(),
+	error_description: z.string().optional()
+}).strip();
+/**
+* RFC 7009 OAuth 2.0 Token Revocation request
+*/
+const OAuthTokenRevocationRequestSchema = z.object({
+	token: z.string(),
+	token_type_hint: z.string().optional()
+}).strip();
+
+//#endregion
+export { OAuthClientRegistrationErrorSchema as a, OAuthProtectedResourceMetadataSchema as c, OpenIdProviderDiscoveryMetadataSchema as d, OpenIdProviderMetadataSchema as f, OAuthClientMetadataSchema as i, OAuthTokenRevocationRequestSchema as l, SafeUrlSchema as m, OAuthClientInformationFullSchema as n, OAuthErrorResponseSchema as o, OptionalSafeUrlSchema as p, OAuthClientInformationSchema as r, OAuthMetadataSchema as s, IdJagTokenExchangeResponseSchema as t, OAuthTokensSchema as u };
+//# sourceMappingURL=auth-UMQCo-ad.mjs.map

package/node_modules/@modelcontextprotocol/core/dist/auth-UMQCo-ad.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-UMQCo-ad.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import * as z from 'zod/v4';\n\n/**\n * Reusable URL validation that disallows `javascript:` scheme\n */\nexport const SafeUrlSchema = z\n    .url()\n    .superRefine((val, ctx) => {\n        if (!URL.canParse(val)) {\n            ctx.addIssue({\n                code: z.ZodIssueCode.custom,\n                message: 'URL must be parseable',\n                fatal: true\n            });\n\n            return z.NEVER;\n        }\n    })\n    .refine(\n        url => {\n            const u = new URL(url);\n            return u.protocol !== 'javascript:' && u.protocol !== 'data:' && u.protocol !== 'vbscript:';\n        },\n        { message: 'URL cannot use javascript:, data:, or vbscript: scheme' }\n    );\n\n/**\n * RFC 9728 OAuth Protected Resource Metadata\n */\nexport const OAuthProtectedResourceMetadataSchema = z.looseObject({\n    resource: z.string().url(),\n    authorization_servers: z.array(SafeUrlSchema).optional(),\n    jwks_uri: z.string().url().optional(),\n    scopes_supported: z.array(z.string()).optional(),\n    bearer_methods_supported: z.array(z.string()).optional(),\n    resource_signing_alg_values_supported: z.array(z.string()).optional(),\n    resource_name: z.string().optional(),\n    resource_documentation: z.string().optional(),\n    resource_policy_uri: z.string().url().optional(),\n    resource_tos_uri: z.string().url().optional(),\n    tls_client_certificate_bound_access_tokens: z.boolean().optional(),\n    authorization_details_types_supported: z.array(z.string()).optional(),\n    dpop_signing_alg_values_supported: z.array(z.string()).optional(),\n    dpop_bound_access_tokens_required: z.boolean().optional()\n});\n\n/**\n * RFC 8414 OAuth 2.0 Authorization Server Metadata\n */\nexport const OAuthMetadataSchema = z.looseObject({\n    issuer: z.string(),\n    authorization_endpoint: SafeUrlSchema,\n    token_endpoint: SafeUrlSchema,\n    registration_endpoint: SafeUrlSchema.optional(),\n    scopes_supported: z.array(z.string()).optional(),\n    response_types_supported: z.array(z.string()),\n    response_modes_supported: z.array(z.string()).optional(),\n    grant_types_supported: z.array(z.string()).optional(),\n    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n    token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n    service_documentation: SafeUrlSchema.optional(),\n    revocation_endpoint: SafeUrlSchema.optional(),\n    revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n    revocation_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n    introspection_endpoint: z.string().optional(),\n    introspection_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n    introspection_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n    code_challenge_methods_supported: z.array(z.string()).optional(),\n    client_id_metadata_document_supported: z.boolean().optional(),\n    // eslint-disable-next-line unicorn/prefer-top-level-await -- Zod .catch(), not a Promise chain\n    authorization_response_iss_parameter_supported: z.boolean().optional().catch(undefined),\n    /**\n     * RFC 9449 §5.1 (DPoP, SEP-1932): the JWS `alg` values this authorization server accepts for\n     * DPoP proofs at the token endpoint. A server supporting DPoP MUST publish this field.\n     */\n    dpop_signing_alg_values_supported: z.array(z.string()).optional()\n});\n\n/**\n * OpenID Connect Discovery 1.0 Provider Metadata\n *\n * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata\n */\nexport const OpenIdProviderMetadataSchema = z.looseObject({\n    issuer: z.string(),\n    authorization_endpoint: SafeUrlSchema,\n    token_endpoint: SafeUrlSchema,\n    userinfo_endpoint: SafeUrlSchema.optional(),\n    jwks_uri: SafeUrlSchema,\n    registration_endpoint: SafeUrlSchema.optional(),\n    scopes_supported: z.array(z.string()).optional(),\n    response_types_supported: z.array(z.string()),\n    response_modes_supported: z.array(z.string()).optional(),\n    grant_types_supported: z.array(z.string()).optional(),\n    acr_values_supported: z.array(z.string()).optional(),\n    subject_types_supported: z.array(z.string()),\n    id_token_signing_alg_values_supported: z.array(z.string()),\n    id_token_encryption_alg_values_supported: z.array(z.string()).optional(),\n    id_token_encryption_enc_values_supported: z.array(z.string()).optional(),\n    userinfo_signing_alg_values_supported: z.array(z.string()).optional(),\n    userinfo_encryption_alg_values_supported: z.array(z.string()).optional(),\n    userinfo_encryption_enc_values_supported: z.array(z.string()).optional(),\n    request_object_signing_alg_values_supported: z.array(z.string()).optional(),\n    request_object_encryption_alg_values_supported: z.array(z.string()).optional(),\n    request_object_encryption_enc_values_supported: z.array(z.string()).optional(),\n    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n    token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),\n    display_values_supported: z.array(z.string()).optional(),\n    claim_types_supported: z.array(z.string()).optional(),\n    claims_supported: z.array(z.string()).optional(),\n    service_documentation: z.string().optional(),\n    claims_locales_supported: z.array(z.string()).optional(),\n    ui_locales_supported: z.array(z.string()).optional(),\n    claims_parameter_supported: z.boolean().optional(),\n    request_parameter_supported: z.boolean().optional(),\n    request_uri_parameter_supported: z.boolean().optional(),\n    require_request_uri_registration: z.boolean().optional(),\n    op_policy_uri: SafeUrlSchema.optional(),\n    op_tos_uri: SafeUrlSchema.optional(),\n    client_id_metadata_document_supported: z.boolean().optional(),\n    // eslint-disable-next-line unicorn/prefer-top-level-await -- Zod .catch(), not a Promise chain\n    authorization_response_iss_parameter_supported: z.boolean().optional().catch(undefined)\n});\n\n/**\n * OpenID Connect Discovery metadata that may include OAuth 2.0 fields\n * This schema represents the real-world scenario where OIDC providers\n * return a mix of OpenID Connect and OAuth 2.0 metadata fields\n */\nexport const OpenIdProviderDiscoveryMetadataSchema = z.object({\n    ...OpenIdProviderMetadataSchema.shape,\n    ...OAuthMetadataSchema.pick({\n        code_challenge_methods_supported: true\n    }).shape\n});\n\n/**\n * OAuth 2.1 token response\n */\nexport const OAuthTokensSchema = z\n    .object({\n        access_token: z.string(),\n        id_token: z.string().optional(), // Optional for OAuth 2.1, but necessary in OpenID Connect\n        token_type: z.string(),\n        expires_in: z.coerce.number().optional(),\n        scope: z.string().optional(),\n        refresh_token: z.string().optional(),\n        /**\n         * Not part of the wire format: the authorization server this value was obtained from, added by\n         * the client's `auth()` before it is stored and compared when it is read back (SEP-2352).\n         */\n        // eslint-disable-next-line unicorn/prefer-top-level-await -- Zod .catch(), not a Promise chain\n        issuer: z.string().optional().catch(undefined)\n    })\n    .strip();\n\n/**\n * RFC 8693 §2.2.1 Token Exchange response for ID-JAG tokens.\n *\n * `token_type` is intentionally optional: per RFC 8693 §2.2.1 it is informational when\n * the issued token is not an access token, and per RFC 6749 §5.1 it is case-insensitive,\n * so strict checking rejects conformant IdPs.\n */\nexport const IdJagTokenExchangeResponseSchema = z\n    .object({\n        issued_token_type: z.literal('urn:ietf:params:oauth:token-type:id-jag'),\n        access_token: z.string(),\n        token_type: z.string().optional(),\n        expires_in: z.number().optional(),\n        scope: z.string().optional()\n    })\n    .strip();\n\nexport type IdJagTokenExchangeResponse = z.infer<typeof IdJagTokenExchangeResponseSchema>;\n\n/**\n * OAuth 2.1 error response\n */\nexport const OAuthErrorResponseSchema = z.object({\n    error: z.string(),\n    error_description: z.string().optional(),\n    error_uri: z.string().optional()\n});\n\n/**\n * Optional version of {@linkcode SafeUrlSchema} that allows empty string for backward compatibility on `tos_uri` and `logo_uri`\n */\n// eslint-disable-next-line unicorn/no-useless-undefined\nexport const OptionalSafeUrlSchema = SafeUrlSchema.optional().or(z.literal('').transform(() => undefined));\n\n/**\n * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata\n */\nexport const OAuthClientMetadataSchema = z\n    .object({\n        redirect_uris: z.array(SafeUrlSchema),\n        token_endpoint_auth_method: z.string().optional(),\n        grant_types: z.array(z.string()).optional(),\n        response_types: z.array(z.string()).optional(),\n        /**\n         * OIDC Dynamic Client Registration `application_type`. MCP clients MUST set\n         * this to `'native'` or `'web'` when registering (SEP-837); the SDK defaults\n         * it from `redirect_uris` when omitted. Typed as `string` (not an enum) so\n         * that parsing an authorization server's registration response — which under\n         * RFC 7591 may echo extension values — never rejects the document on this\n         * field alone.\n         */\n        application_type: z.string().optional(),\n        client_name: z.string().optional(),\n        client_uri: SafeUrlSchema.optional(),\n        logo_uri: OptionalSafeUrlSchema,\n        scope: z.string().optional(),\n        contacts: z.array(z.string()).optional(),\n        tos_uri: OptionalSafeUrlSchema,\n        policy_uri: z.string().optional(),\n        jwks_uri: SafeUrlSchema.optional(),\n        jwks: z.any().optional(),\n        software_id: z.string().optional(),\n        software_version: z.string().optional(),\n        software_statement: z.string().optional()\n    })\n    .strip();\n\n/**\n * RFC 7591 OAuth 2.0 Dynamic Client Registration client information\n */\nexport const OAuthClientInformationSchema = z\n    .object({\n        client_id: z.string(),\n        client_secret: z.string().optional(),\n        client_id_issued_at: z.number().optional(),\n        client_secret_expires_at: z.number().optional(),\n        /**\n         * Not part of the wire format: the authorization server this value was obtained from, added by\n         * the client's `auth()` before it is stored and compared when it is read back (SEP-2352).\n         */\n        // eslint-disable-next-line unicorn/prefer-top-level-await -- Zod .catch(), not a Promise chain\n        issuer: z.string().optional().catch(undefined)\n    })\n    .strip();\n\n/**\n * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)\n */\nexport const OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);\n\n/**\n * RFC 7591 OAuth 2.0 Dynamic Client Registration error response\n */\nexport const OAuthClientRegistrationErrorSchema = z\n    .object({\n        error: z.string(),\n        error_description: z.string().optional()\n    })\n    .strip();\n\n/**\n * RFC 7009 OAuth 2.0 Token Revocation request\n */\nexport const OAuthTokenRevocationRequestSchema = z\n    .object({\n        token: z.string(),\n        token_type_hint: z.string().optional()\n    })\n    .strip();\n\nexport type OAuthMetadata = z.infer<typeof OAuthMetadataSchema>;\nexport type OpenIdProviderMetadata = z.infer<typeof OpenIdProviderMetadataSchema>;\nexport type OpenIdProviderDiscoveryMetadata = z.infer<typeof OpenIdProviderDiscoveryMetadataSchema>;\n\nexport type OAuthTokens = z.infer<typeof OAuthTokensSchema>;\nexport type OAuthErrorResponse = z.infer<typeof OAuthErrorResponseSchema>;\nexport type OAuthClientMetadata = z.infer<typeof OAuthClientMetadataSchema>;\nexport type OAuthClientInformation = z.infer<typeof OAuthClientInformationSchema>;\nexport type OAuthClientInformationFull = z.infer<typeof OAuthClientInformationFullSchema>;\nexport type OAuthClientInformationMixed = OAuthClientInformation | OAuthClientInformationFull;\n\n/**\n * {@linkcode OAuthTokens} as persisted by an `OAuthClientProvider`. Adds an\n * SDK-stamped authorization-server `issuer` identifier so stored tokens are\n * bound to the AS that issued them. The `issuer` field is **not** part of the\n * RFC 6749 wire response; the client SDK writes it before calling `saveTokens`.\n */\nexport type StoredOAuthTokens = OAuthTokens & { issuer?: string | undefined };\n\n/**\n * {@linkcode OAuthClientInformationMixed} as persisted by an\n * `OAuthClientProvider`. Adds an SDK-stamped authorization-server `issuer`\n * identifier so stored client credentials are bound to the AS that issued them.\n * The `issuer` field is **not** part of the RFC 7591 wire response; the client SDK\n * writes it before calling `saveClientInformation`.\n */\nexport type StoredOAuthClientInformation = OAuthClientInformationMixed & { issuer?: string | undefined };\n\nexport type OAuthClientRegistrationError = z.infer<typeof OAuthClientRegistrationErrorSchema>;\nexport type OAuthTokenRevocationRequest = z.infer<typeof OAuthTokenRevocationRequestSchema>;\nexport type OAuthProtectedResourceMetadata = z.infer<typeof OAuthProtectedResourceMetadataSchema>;\n\n// Unified type for authorization server metadata\nexport type AuthorizationServerMetadata = OAuthMetadata | OpenIdProviderDiscoveryMetadata;\n"],"mappings":";;;;;;AAKA,MAAa,gBAAgB,EACxB,KAAK,CACL,aAAa,KAAK,QAAQ;AACvB,KAAI,CAAC,IAAI,SAAS,IAAI,EAAE;AACpB,MAAI,SAAS;GACT,MAAM,EAAE,aAAa;GACrB,SAAS;GACT,OAAO;GACV,CAAC;AAEF,SAAO,EAAE;;EAEf,CACD,QACG,QAAO;CACH,MAAM,IAAI,IAAI,IAAI,IAAI;AACtB,QAAO,EAAE,aAAa,iBAAiB,EAAE,aAAa,WAAW,EAAE,aAAa;GAEpF,EAAE,SAAS,0DAA0D,CACxE;;;;AAKL,MAAa,uCAAuC,EAAE,YAAY;CAC9D,UAAU,EAAE,QAAQ,CAAC,KAAK;CAC1B,uBAAuB,EAAE,MAAM,cAAc,CAAC,UAAU;CACxD,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACrC,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChD,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,eAAe,EAAE,QAAQ,CAAC,UAAU;CACpC,wBAAwB,EAAE,QAAQ,CAAC,UAAU;CAC7C,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CAChD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CAC7C,4CAA4C,EAAE,SAAS,CAAC,UAAU;CAClE,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,mCAAmC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACjE,mCAAmC,EAAE,SAAS,CAAC,UAAU;CAC5D,CAAC;;;;AAKF,MAAa,sBAAsB,EAAE,YAAY;CAC7C,QAAQ,EAAE,QAAQ;CAClB,wBAAwB;CACxB,gBAAgB;CAChB,uBAAuB,cAAc,UAAU;CAC/C,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChD,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC7C,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,kDAAkD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChF,uBAAuB,cAAc,UAAU;CAC/C,qBAAqB,cAAc,UAAU;CAC7C,4CAA4C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC1E,uDAAuD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrF,wBAAwB,EAAE,QAAQ,CAAC,UAAU;CAC7C,+CAA+C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC7E,0DAA0D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxF,kCAAkC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChE,uCAAuC,EAAE,SAAS,CAAC,UAAU;CAE7D,gDAAgD,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,OAAU;CAKvF,mCAAmC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACpE,CAAC;;;;;;AAOF,MAAa,+BAA+B,EAAE,YAAY;CACtD,QAAQ,EAAE,QAAQ;CAClB,wBAAwB;CACxB,gBAAgB;CAChB,mBAAmB,cAAc,UAAU;CAC3C,UAAU;CACV,uBAAuB,cAAc,UAAU;CAC/C,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChD,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC7C,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACpD,yBAAyB,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC5C,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC;CAC1D,0CAA0C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxE,0CAA0C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxE,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,0CAA0C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxE,0CAA0C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxE,6CAA6C,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC3E,gDAAgD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC9E,gDAAgD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC9E,uCAAuC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrE,kDAAkD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChF,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAChD,uBAAuB,EAAE,QAAQ,CAAC,UAAU;CAC5C,0BAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxD,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACpD,4BAA4B,EAAE,SAAS,CAAC,UAAU;CAClD,6BAA6B,EAAE,SAAS,CAAC,UAAU;CACnD,iCAAiC,EAAE,SAAS,CAAC,UAAU;CACvD,kCAAkC,EAAE,SAAS,CAAC,UAAU;CACxD,eAAe,cAAc,UAAU;CACvC,YAAY,cAAc,UAAU;CACpC,uCAAuC,EAAE,SAAS,CAAC,UAAU;CAE7D,gDAAgD,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,OAAU;CAC1F,CAAC;;;;;;AAOF,MAAa,wCAAwC,EAAE,OAAO;CAC1D,GAAG,6BAA6B;CAChC,GAAG,oBAAoB,KAAK,EACxB,kCAAkC,MACrC,CAAC,CAAC;CACN,CAAC;;;;AAKF,MAAa,oBAAoB,EAC5B,OAAO;CACJ,cAAc,EAAE,QAAQ;CACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,YAAY,EAAE,QAAQ;CACtB,YAAY,EAAE,OAAO,QAAQ,CAAC,UAAU;CACxC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,eAAe,EAAE,QAAQ,CAAC,UAAU;CAMpC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,OAAU;CACjD,CAAC,CACD,OAAO;;;;;;;;AASZ,MAAa,mCAAmC,EAC3C,OAAO;CACJ,mBAAmB,EAAE,QAAQ,0CAA0C;CACvE,cAAc,EAAE,QAAQ;CACxB,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC/B,CAAC,CACD,OAAO;;;;AAOZ,MAAa,2BAA2B,EAAE,OAAO;CAC7C,OAAO,EAAE,QAAQ;CACjB,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CACxC,WAAW,EAAE,QAAQ,CAAC,UAAU;CACnC,CAAC;;;;AAMF,MAAa,wBAAwB,cAAc,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,gBAAgB,OAAU,CAAC;;;;AAK1G,MAAa,4BAA4B,EACpC,OAAO;CACJ,eAAe,EAAE,MAAM,cAAc;CACrC,4BAA4B,EAAE,QAAQ,CAAC,UAAU;CACjD,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC3C,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAS9C,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,YAAY,cAAc,UAAU;CACpC,UAAU;CACV,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CACxC,SAAS;CACT,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,UAAU,cAAc,UAAU;CAClC,MAAM,EAAE,KAAK,CAAC,UAAU;CACxB,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;CACvC,oBAAoB,EAAE,QAAQ,CAAC,UAAU;CAC5C,CAAC,CACD,OAAO;;;;AAKZ,MAAa,+BAA+B,EACvC,OAAO;CACJ,WAAW,EAAE,QAAQ;CACrB,eAAe,EAAE,QAAQ,CAAC,UAAU;CACpC,qBAAqB,EAAE,QAAQ,CAAC,UAAU;CAC1C,0BAA0B,EAAE,QAAQ,CAAC,UAAU;CAM/C,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,OAAU;CACjD,CAAC,CACD,OAAO;;;;AAKZ,MAAa,mCAAmC,0BAA0B,MAAM,6BAA6B;;;;AAK7G,MAAa,qCAAqC,EAC7C,OAAO;CACJ,OAAO,EAAE,QAAQ;CACjB,mBAAmB,EAAE,QAAQ,CAAC,UAAU;CAC3C,CAAC,CACD,OAAO;;;;AAKZ,MAAa,oCAAoC,EAC5C,OAAO;CACJ,OAAO,EAAE,QAAQ;CACjB,iBAAiB,EAAE,QAAQ,CAAC,UAAU;CACzC,CAAC,CACD,OAAO"}