fastmcp 4.16.14 → 4.17.1

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkKEGPQRWFcjs = require('./chunk-KEGPQRWF.cjs');
+var _chunkSYZRGVQXcjs = require('./chunk-SYZRGVQX.cjs');
 
 
 
@@ -24,7 +24,7 @@ var _chunkKEGPQRWFcjs = require('./chunk-KEGPQRWF.cjs');
 
 
 
-var _chunkYZWUEW3Acjs = require('./chunk-YZWUEW3A.cjs');
+var _chunkE3HXGE2Ocjs = require('./chunk-E3HXGE2O.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkYZWUEW3Acjs = require('./chunk-YZWUEW3A.cjs');
 
 
 
-exports.AuthProvider = _chunkYZWUEW3Acjs.AuthProvider; exports.AzureProvider = _chunkYZWUEW3Acjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkKEGPQRWFcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkKEGPQRWFcjs.FastMCP; exports.FastMCPError = _chunkKEGPQRWFcjs.FastMCPError; exports.FastMCPSession = _chunkKEGPQRWFcjs.FastMCPSession; exports.GitHubProvider = _chunkYZWUEW3Acjs.GitHubProvider; exports.GoogleProvider = _chunkYZWUEW3Acjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkKEGPQRWFcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkYZWUEW3Acjs.OAuthProvider; exports.ServerState = _chunkKEGPQRWFcjs.ServerState; exports.SessionError = _chunkKEGPQRWFcjs.SessionError; exports.UnexpectedStateError = _chunkKEGPQRWFcjs.UnexpectedStateError; exports.UserError = _chunkKEGPQRWFcjs.UserError; exports.audioContent = _chunkKEGPQRWFcjs.audioContent; exports.getAuthSession = _chunkYZWUEW3Acjs.getAuthSession; exports.imageContent = _chunkKEGPQRWFcjs.imageContent; exports.jsonSchemaAdapter = _chunkKEGPQRWFcjs.jsonSchemaAdapter; exports.requireAll = _chunkYZWUEW3Acjs.requireAll; exports.requireAny = _chunkYZWUEW3Acjs.requireAny; exports.requireAuth = _chunkYZWUEW3Acjs.requireAuth; exports.requireRole = _chunkYZWUEW3Acjs.requireRole; exports.requireScopes = _chunkYZWUEW3Acjs.requireScopes;
+exports.AuthProvider = _chunkE3HXGE2Ocjs.AuthProvider; exports.AzureProvider = _chunkE3HXGE2Ocjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkSYZRGVQXcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkSYZRGVQXcjs.FastMCP; exports.FastMCPError = _chunkSYZRGVQXcjs.FastMCPError; exports.FastMCPSession = _chunkSYZRGVQXcjs.FastMCPSession; exports.GitHubProvider = _chunkE3HXGE2Ocjs.GitHubProvider; exports.GoogleProvider = _chunkE3HXGE2Ocjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkSYZRGVQXcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkE3HXGE2Ocjs.OAuthProvider; exports.ServerState = _chunkSYZRGVQXcjs.ServerState; exports.SessionError = _chunkSYZRGVQXcjs.SessionError; exports.UnexpectedStateError = _chunkSYZRGVQXcjs.UnexpectedStateError; exports.UserError = _chunkSYZRGVQXcjs.UserError; exports.audioContent = _chunkSYZRGVQXcjs.audioContent; exports.getAuthSession = _chunkE3HXGE2Ocjs.getAuthSession; exports.imageContent = _chunkSYZRGVQXcjs.imageContent; exports.jsonSchemaAdapter = _chunkSYZRGVQXcjs.jsonSchemaAdapter; exports.requireAll = _chunkE3HXGE2Ocjs.requireAll; exports.requireAny = _chunkE3HXGE2Ocjs.requireAny; exports.requireAuth = _chunkE3HXGE2Ocjs.requireAuth; exports.requireRole = _chunkE3HXGE2Ocjs.requireRole; exports.requireScopes = _chunkE3HXGE2Ocjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Bvt5a7yr.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Bvt5a7yr.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Dy1PbWAT.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Dy1PbWAT.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {
@@ -504,6 +504,7 @@ type ServerOptions<T extends FastMCPSessionAuth> = {
          */
         authorizationServer?: {
             authorizationEndpoint: string;
+            clientIdMetadataDocumentSupported?: boolean;
             codeChallengeMethodsSupported?: string[];
             dpopSigningAlgValuesSupported?: string[];
             grantTypesSupported?: string[];

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Bvt5a7yr.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Bvt5a7yr.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Dy1PbWAT.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Dy1PbWAT.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {
@@ -504,6 +504,7 @@ type ServerOptions<T extends FastMCPSessionAuth> = {
          */
         authorizationServer?: {
             authorizationEndpoint: string;
+            clientIdMetadataDocumentSupported?: boolean;
             codeChallengeMethodsSupported?: string[];
             dpopSigningAlgValuesSupported?: string[];
             grantTypesSupported?: string[];

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-GABSX3WB.js";
+} from "./chunk-UODI5E6U.js";
 import {
   AuthProvider,
   AzureProvider,
@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-IUDWO3A2.js";
+} from "./chunk-KWRV7CHJ.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-Bvt5a7yr.d.cts → OAuthProvider-Dy1PbWAT.d.cts}

@@ -238,6 +238,17 @@ interface OAuthProxyConfig {
      * Default: true (enabled with default settings)
      */
     customClaimsPassthrough?: boolean | CustomClaimsPassthroughConfig;
+    /**
+     * Accept Client ID Metadata Documents (CIMD) as an alternative to Dynamic
+     * Client Registration (default: false).
+     *
+     * When enabled, an unregistered `client_id` that is an HTTPS URL is
+     * resolved by fetching it as a CIMD document (see `resolveCimdClient` in
+     * `utils/cimd.ts` for validation details) and advertised via
+     * `client_id_metadata_document_supported` in the AS metadata. See the MCP
+     * authorization spec's CIMD mechanism (SEP-991).
+     */
+    enableCimd?: boolean;
     /** Enable token swap pattern (default: true) - issues short-lived JWTs instead of passing through upstream tokens */
     enableTokenSwap?: boolean;
     /** Encryption key for token storage (default: auto-generated). Set to false to disable encryption. */
@@ -331,12 +342,25 @@ interface ProxyDCRClient {
     clientId: string;
     /** Proxy-issued client secret (not the upstream provider's client_secret) */
     clientSecret?: string;
+    /**
+     * When set, this is a cached resolution of a live document (CIMD) rather
+     * than a permanent registration: past this instant the copy is dropped and
+     * the document is fetched again.
+     */
+    expiresAt?: Date;
     /** Client metadata from registration request */
     metadata?: DCRClientMetadata;
     /** All redirect URIs registered by this client */
     redirectUris: string[];
     /** Client registration timestamp */
     registeredAt: Date;
+    /**
+     * How this client came to be known, when that changes the rules applied to
+     * it. `"cimd"` marks a public client whose identity is a URL anyone can
+     * name and which holds no secret, so the proxy requires S256 PKCE from it.
+     * Absent for a Dynamic Client Registration.
+     */
+    source?: "cimd";
 }
 /**
  * OAuth refresh token request
@@ -480,9 +504,13 @@ declare class OAuthProxy {
     private ownedTokenStorage;
     /**
      * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
-     * for the defence-in-depth callback checks. A registration never changes
+     * for the defence-in-depth callback checks. A DCR registration never changes
      * after it is written, so caching it locally cannot go stale; it is also
      * persisted, so another instance can hydrate it.
+     *
+     * A CIMD client is not a registration but a snapshot of a document that can
+     * change under us, so it is cached with an `expiresAt` and re-resolved once
+     * that passes.
      */
     private registeredClientsByClientId;
     private stateStore;
@@ -509,6 +537,7 @@ declare class OAuthProxy {
      */
     getAuthorizationServerMetadata(): {
         authorizationEndpoint: string;
+        clientIdMetadataDocumentSupported?: boolean;
         codeChallengeMethodsSupported?: string[];
         dpopSigningAlgValuesSupported?: string[];
         grantTypesSupported?: string[];
@@ -614,6 +643,15 @@ declare class OAuthProxy {
      * Issue swapped tokens for refresh flow
      */
     private issueSwappedTokensForRefresh;
+    /**
+     * Defence in depth for the callback and consent-denial redirects: the
+     * transaction's stored callback URL must still be registered for its client.
+     *
+     * Resolution goes through {@link resolveClient}, so a CIMD registration whose
+     * cached copy lapsed mid-flow is re-fetched rather than mistaken for one that
+     * was revoked.
+     */
+    private isTransactionCallbackRegistered;
     /**
      * Match URI against pattern (supports wildcards)
      */
@@ -631,6 +669,17 @@ declare class OAuthProxy {
      * Refresh upstream tokens with provider
      */
     private refreshUpstreamTokens;
+    /**
+     * Resolve the client behind a `client_id`: a stored registration if there is
+     * one, otherwise — when CIMD is enabled — the client's metadata document.
+     *
+     * A resolved CIMD client is cached like a DCR registration but carries the
+     * `expiresAt` the resolver stamped on it, so the store drops it once it
+     * lapses and the next call re-fetches the document. Every lookup goes
+     * through here, so a lapse always means "re-resolve", never "unknown
+     * client" mid-flow.
+     */
+    private resolveClient;
     /**
      * Put a claimed refresh-token mapping back after a rotation failed, keeping
      * whatever lifetime it had left.

package/dist/{OAuthProvider-Bvt5a7yr.d.ts → OAuthProvider-Dy1PbWAT.d.ts}

@@ -238,6 +238,17 @@ interface OAuthProxyConfig {
      * Default: true (enabled with default settings)
      */
     customClaimsPassthrough?: boolean | CustomClaimsPassthroughConfig;
+    /**
+     * Accept Client ID Metadata Documents (CIMD) as an alternative to Dynamic
+     * Client Registration (default: false).
+     *
+     * When enabled, an unregistered `client_id` that is an HTTPS URL is
+     * resolved by fetching it as a CIMD document (see `resolveCimdClient` in
+     * `utils/cimd.ts` for validation details) and advertised via
+     * `client_id_metadata_document_supported` in the AS metadata. See the MCP
+     * authorization spec's CIMD mechanism (SEP-991).
+     */
+    enableCimd?: boolean;
     /** Enable token swap pattern (default: true) - issues short-lived JWTs instead of passing through upstream tokens */
     enableTokenSwap?: boolean;
     /** Encryption key for token storage (default: auto-generated). Set to false to disable encryption. */
@@ -331,12 +342,25 @@ interface ProxyDCRClient {
     clientId: string;
     /** Proxy-issued client secret (not the upstream provider's client_secret) */
     clientSecret?: string;
+    /**
+     * When set, this is a cached resolution of a live document (CIMD) rather
+     * than a permanent registration: past this instant the copy is dropped and
+     * the document is fetched again.
+     */
+    expiresAt?: Date;
     /** Client metadata from registration request */
     metadata?: DCRClientMetadata;
     /** All redirect URIs registered by this client */
     redirectUris: string[];
     /** Client registration timestamp */
     registeredAt: Date;
+    /**
+     * How this client came to be known, when that changes the rules applied to
+     * it. `"cimd"` marks a public client whose identity is a URL anyone can
+     * name and which holds no secret, so the proxy requires S256 PKCE from it.
+     * Absent for a Dynamic Client Registration.
+     */
+    source?: "cimd";
 }
 /**
  * OAuth refresh token request
@@ -480,9 +504,13 @@ declare class OAuthProxy {
     private ownedTokenStorage;
     /**
      * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
-     * for the defence-in-depth callback checks. A registration never changes
+     * for the defence-in-depth callback checks. A DCR registration never changes
      * after it is written, so caching it locally cannot go stale; it is also
      * persisted, so another instance can hydrate it.
+     *
+     * A CIMD client is not a registration but a snapshot of a document that can
+     * change under us, so it is cached with an `expiresAt` and re-resolved once
+     * that passes.
      */
     private registeredClientsByClientId;
     private stateStore;
@@ -509,6 +537,7 @@ declare class OAuthProxy {
      */
     getAuthorizationServerMetadata(): {
         authorizationEndpoint: string;
+        clientIdMetadataDocumentSupported?: boolean;
         codeChallengeMethodsSupported?: string[];
         dpopSigningAlgValuesSupported?: string[];
         grantTypesSupported?: string[];
@@ -614,6 +643,15 @@ declare class OAuthProxy {
      * Issue swapped tokens for refresh flow
      */
     private issueSwappedTokensForRefresh;
+    /**
+     * Defence in depth for the callback and consent-denial redirects: the
+     * transaction's stored callback URL must still be registered for its client.
+     *
+     * Resolution goes through {@link resolveClient}, so a CIMD registration whose
+     * cached copy lapsed mid-flow is re-fetched rather than mistaken for one that
+     * was revoked.
+     */
+    private isTransactionCallbackRegistered;
     /**
      * Match URI against pattern (supports wildcards)
      */
@@ -631,6 +669,17 @@ declare class OAuthProxy {
      * Refresh upstream tokens with provider
      */
     private refreshUpstreamTokens;
+    /**
+     * Resolve the client behind a `client_id`: a stored registration if there is
+     * one, otherwise — when CIMD is enabled — the client's metadata document.
+     *
+     * A resolved CIMD client is cached like a DCR registration but carries the
+     * `expiresAt` the resolver stamped on it, so the store drops it once it
+     * lapses and the next call re-fetches the document. Every lookup goes
+     * through here, so a lapse always means "re-resolve", never "unknown
+     * client" mid-flow.
+     */
+    private resolveClient;
     /**
      * Put a claimed refresh-token mapping back after a rotation failed, keeping
      * whatever lifetime it had left.

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkYZWUEW3Acjs = require('../chunk-YZWUEW3A.cjs');
+var _chunkE3HXGE2Ocjs = require('../chunk-E3HXGE2O.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkYZWUEW3Acjs = require('../chunk-YZWUEW3A.cjs');
 
 
 
-exports.AuthProvider = _chunkYZWUEW3Acjs.AuthProvider; exports.AzureProvider = _chunkYZWUEW3Acjs.AzureProvider; exports.ConsentManager = _chunkYZWUEW3Acjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkYZWUEW3Acjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkYZWUEW3Acjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkYZWUEW3Acjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkYZWUEW3Acjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkYZWUEW3Acjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkYZWUEW3Acjs.DiskStore; exports.EncryptedTokenStorage = _chunkYZWUEW3Acjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkYZWUEW3Acjs.GitHubProvider; exports.GoogleProvider = _chunkYZWUEW3Acjs.GoogleProvider; exports.JWKSVerifier = _chunkYZWUEW3Acjs.JWKSVerifier; exports.JWTIssuer = _chunkYZWUEW3Acjs.JWTIssuer; exports.MemoryTokenStorage = _chunkYZWUEW3Acjs.MemoryTokenStorage; exports.OAuthProvider = _chunkYZWUEW3Acjs.OAuthProvider; exports.OAuthProxy = _chunkYZWUEW3Acjs.OAuthProxy; exports.OAuthProxyError = _chunkYZWUEW3Acjs.OAuthProxyError; exports.PKCEUtils = _chunkYZWUEW3Acjs.PKCEUtils; exports.getAuthSession = _chunkYZWUEW3Acjs.getAuthSession; exports.requireAll = _chunkYZWUEW3Acjs.requireAll; exports.requireAny = _chunkYZWUEW3Acjs.requireAny; exports.requireAuth = _chunkYZWUEW3Acjs.requireAuth; exports.requireRole = _chunkYZWUEW3Acjs.requireRole; exports.requireScopes = _chunkYZWUEW3Acjs.requireScopes;
+exports.AuthProvider = _chunkE3HXGE2Ocjs.AuthProvider; exports.AzureProvider = _chunkE3HXGE2Ocjs.AzureProvider; exports.ConsentManager = _chunkE3HXGE2Ocjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkE3HXGE2Ocjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkE3HXGE2Ocjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkE3HXGE2Ocjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkE3HXGE2Ocjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkE3HXGE2Ocjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkE3HXGE2Ocjs.DiskStore; exports.EncryptedTokenStorage = _chunkE3HXGE2Ocjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkE3HXGE2Ocjs.GitHubProvider; exports.GoogleProvider = _chunkE3HXGE2Ocjs.GoogleProvider; exports.JWKSVerifier = _chunkE3HXGE2Ocjs.JWKSVerifier; exports.JWTIssuer = _chunkE3HXGE2Ocjs.JWTIssuer; exports.MemoryTokenStorage = _chunkE3HXGE2Ocjs.MemoryTokenStorage; exports.OAuthProvider = _chunkE3HXGE2Ocjs.OAuthProvider; exports.OAuthProxy = _chunkE3HXGE2Ocjs.OAuthProxy; exports.OAuthProxyError = _chunkE3HXGE2Ocjs.OAuthProxyError; exports.PKCEUtils = _chunkE3HXGE2Ocjs.PKCEUtils; exports.getAuthSession = _chunkE3HXGE2Ocjs.getAuthSession; exports.requireAll = _chunkE3HXGE2Ocjs.requireAll; exports.requireAny = _chunkE3HXGE2Ocjs.requireAny; exports.requireAuth = _chunkE3HXGE2Ocjs.requireAuth; exports.requireRole = _chunkE3HXGE2Ocjs.requireRole; exports.requireScopes = _chunkE3HXGE2Ocjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Bvt5a7yr.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Bvt5a7yr.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Dy1PbWAT.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Dy1PbWAT.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Bvt5a7yr.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Bvt5a7yr.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Dy1PbWAT.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Dy1PbWAT.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-IUDWO3A2.js";
+} from "../chunk-KWRV7CHJ.js";
 export {
   AuthProvider,
   AzureProvider,