mcp-trellis 0.2.1 → 2.1.0

package/dist/oauth/router.js

@@ -1,88 +1,103 @@
-import { INTERNAL_ERROR, jsonResponse, requireHttpMethod } from "../http.js";
-import { newClientId } from "./codes.js";
-import { GRANT_TYPES, OAUTH_ERRORS } from "./constants.js";
-import { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
-import { DEFAULT_RESOURCE_PATH } from "./resource.js";
-import { oauthError, unregisteredClientsAllowed, } from "./types.js";
-import { handleAuthorize } from "./authorize.js";
-import { handleToken } from "./token.js";
-import { handleRevoke } from "./revoke.js";
-import { handleWellKnown } from "./wellknown.js";
-const POST_ONLY = new Set(["POST"]);
-const handleRegister = async (request, options) => {
-    const methodError = requireHttpMethod(request, POST_ONLY);
-    if (methodError)
-        return methodError;
-    let suppliedRedirectUris = false;
-    let redirectUris = [];
-    try {
-        const body = (await request.json());
-        const raw = body.redirect_uris;
-        if (Array.isArray(raw)) {
-            suppliedRedirectUris = true;
-            redirectUris = raw
-                .map((u) => String(u))
-                .filter((uri) => isAllowedRedirectUri(uri, options.redirect));
-        }
+import { errorReason, INTERNAL_ERROR } from "../http/http.js";
+import { safeOAuthAudit } from "./audit.js";
+import { assertCodeSecret, assertScopeConfig, oauthError, unregisteredClientsAllowed, } from "./config.js";
+import { DEFAULT_OAUTH_PATH, OAUTH_ERRORS } from "./constants.js";
+import { processCodeStore } from "./crypto/codes.js";
+import { handleAuthorize } from "./endpoints/authorize.js";
+import { handleConsent } from "./endpoints/consent.js";
+import { handleRegister } from "./endpoints/register.js";
+import { handleRevoke } from "./endpoints/revoke.js";
+import { handleToken } from "./endpoints/token.js";
+import { handleWellKnown } from "./endpoints/wellknown.js";
+import { DEFAULT_RESOURCE_PATH, normalizeConfiguredPath } from "./policy/resource.js";
+/**
+ * Function-form `codeSecret` is re-validated on every call in
+ * `resolveSecrets`, since its value can vary per request; a string or array
+ * form is fixed for the life of this router, so fail fast at construction
+ * instead of at the first request.
+ */
+const assertRouterOptions = (options) => {
+    if (!unregisteredClientsAllowed(options) && !options.ports.clientStore) {
+        throw new Error("allowUnregisteredClients: false requires ports.clientStore " +
+            "so pre-registered clients can be resolved");
     }
-    catch {
-        redirectUris = [];
+    if (!options.ports.codeStore && !options.allowInMemoryCodeStore) {
+        throw new Error("ports.codeStore is required (shared jti store for auth-code / consent single-use). " +
+            "Pass a CodeStore, or set allowInMemoryCodeStore: true for single-process demos/tests only");
     }
-    // No redirect_uris in the body: fall back to the Claude callback only if
-    // this server's own allowlist actually accepts it — never advertise a
-    // redirect_uri that `/authorize` would go on to reject (e.g. `clients`
-    // without `"claude"`, where `createMcpApp` sets `allowClaude: false`).
-    if (!suppliedRedirectUris && isAllowedRedirectUri(CLAUDE_CALLBACK, options.redirect)) {
-        redirectUris = [CLAUDE_CALLBACK];
+    if (typeof options.ports.codeSecret === "string") {
+        assertCodeSecret(options.ports.codeSecret);
     }
-    if (redirectUris.length === 0) {
-        return oauthError(OAUTH_ERRORS.invalidRedirectUri, 400, suppliedRedirectUris
-            ? "no allowed redirect_uris"
-            : "redirect_uris required — this server has no default redirect_uri");
+    if (Array.isArray(options.ports.codeSecret)) {
+        if (options.ports.codeSecret.length === 0) {
+            throw new Error("codeSecret array must not be empty — at least one key is required");
+        }
+        options.ports.codeSecret.forEach(assertCodeSecret);
     }
-    return jsonResponse({
-        client_id: newClientId(),
-        client_id_issued_at: Math.floor(Date.now() / 1000),
-        token_endpoint_auth_method: "none",
-        redirect_uris: redirectUris,
-        grant_types: [GRANT_TYPES.authorizationCode],
-        response_types: ["code"],
-    });
+    assertScopeConfig(options);
 };
-export const createOAuthRouter = (options) => {
-    if (!unregisteredClientsAllowed(options) && !options.ports.clientStore) {
-        throw new Error("allowUnregisteredClients: false requires ports.clientStore " +
-            "so pre-registered clients can be resolved");
+/**
+ * Normalized once, not per request, so "/mcp/" and "/mcp" yield one
+ * canonical resource, and the routing table, discovery documents and the
+ * consent form action all agree on `oauthPath`.
+ */
+const normalizeRouterPaths = (options) => {
+    const resourcePath = normalizeConfiguredPath(options.resourcePath ?? DEFAULT_RESOURCE_PATH);
+    const oauthPath = normalizeConfiguredPath(options.oauthPath ?? DEFAULT_OAUTH_PATH);
+    if (oauthPath === resourcePath) {
+        throw new Error(`oauthPath (${oauthPath}) must not equal resourcePath — they would shadow each other`);
     }
-    const resourcePath = options.resourcePath ?? DEFAULT_RESOURCE_PATH;
-    const oauthPath = options.oauthPath ?? "/mcp/oauth";
-    const prmPaths = new Set([
-        "/.well-known/oauth-protected-resource",
-        `/.well-known/oauth-protected-resource${resourcePath}`,
-    ]);
-    const asPaths = new Set([
-        "/.well-known/oauth-authorization-server",
-        `/.well-known/oauth-authorization-server${resourcePath}`,
-    ]);
-    const routes = {
-        ...(unregisteredClientsAllowed(options)
-            ? {
-                [`${oauthPath}/register`]: (request) => handleRegister(request, options),
-            }
-            : {}),
-        [`${oauthPath}/authorize`]: (request) => handleAuthorize(request, options),
-        [`${oauthPath}/token`]: (request) => handleToken(request, options),
-        ...(options.ports.revokeToken
-            ? {
-                [`${oauthPath}/revoke`]: (request) => handleRevoke(request, options),
-            }
-            : {}),
+    if (resourcePath.startsWith("/.well-known")) {
+        throw new Error(`resourcePath (${resourcePath}) must not start with /.well-known — reserved for OAuth discovery documents`);
+    }
+    return {
+        resourcePath,
+        oauthPath,
+        prmPaths: new Set([
+            "/.well-known/oauth-protected-resource",
+            `/.well-known/oauth-protected-resource${resourcePath}`,
+        ]),
+        asPaths: new Set([
+            "/.well-known/oauth-authorization-server",
+            `/.well-known/oauth-authorization-server${resourcePath}`,
+        ]),
     };
+};
+const buildRoutes = (options, normalizedOptions, oauthPath) => ({
+    ...(unregisteredClientsAllowed(options)
+        ? {
+            [`${oauthPath}/register`]: (request) => handleRegister(request, normalizedOptions),
+        }
+        : {}),
+    [`${oauthPath}/authorize`]: (request) => handleAuthorize(request, normalizedOptions),
+    [`${oauthPath}/consent`]: (request) => handleConsent(request, normalizedOptions),
+    [`${oauthPath}/token`]: (request) => handleToken(request, normalizedOptions),
+    ...(options.ports.revokeToken
+        ? {
+            [`${oauthPath}/revoke`]: (request) => handleRevoke(request, normalizedOptions),
+        }
+        : {}),
+});
+export const createOAuthRouter = (options) => {
+    assertRouterOptions(options);
+    // Resolved once; `assertRouterOptions` already required
+    // `allowInMemoryCodeStore` before the process store can be reached.
+    const codeStore = options.ports.codeStore ?? processCodeStore;
+    const ports = { ...options.ports, codeStore };
+    const { resourcePath, oauthPath, prmPaths, asPaths } = normalizeRouterPaths(options);
+    // Handlers read paths from here, never from the caller's raw options.
+    const normalizedOptions = {
+        ...options,
+        resourcePath,
+        oauthPath,
+        ports,
+    };
+    const routes = buildRoutes(options, normalizedOptions, oauthPath);
     return {
         tryHandle: async (request) => {
             try {
                 const path = new URL(request.url).pathname;
-                const known = await handleWellKnown(request, options, {
+                const known = await handleWellKnown(request, normalizedOptions, {
                     prmPaths,
                     asPaths,
                     resourcePath,
@@ -93,22 +108,25 @@ export const createOAuthRouter = (options) => {
                 const route = routes[path];
                 return route ? await route(request) : null;
             }
-            catch {
-                // A host port (resolveUser/mintAccessToken/clientStore/...) threw.
-                // We only ever reach here on a route this router owns, so answer
-                // with a real error instead of throwing out of `tryHandle`.
+            catch (caught) {
+                // A host port threw, or a per-request codeSecret failed validation.
+                // Only routes this router owns get here: the caller sees a generic
+                // server_error, ports.audit gets the real reason.
+                await safeOAuthAudit(normalizedOptions, {
+                    event: "server_error",
+                    reason: errorReason(caught),
+                });
                 return oauthError(OAUTH_ERRORS.serverError, 500, INTERNAL_ERROR);
             }
         },
     };
 };
-export { authorizationServerMetadata, protectedResourceMetadata, mcpWwwAuthenticate, } from "./metadata.js";
-export { canonicalResource, resourcesEqual, DEFAULT_RESOURCE_PATH, firstResourceError, } from "./resource.js";
-export { isAllowedRedirectUri, CLAUDE_CALLBACK } from "./redirect.js";
-export { issueAuthCode, consumeAuthCode, newClientId, } from "./codes.js";
-export { verifyPkceS256, sha256Base64Url, randomBase64Url } from "./pkce.js";
-export { GRANT_TYPES, OAUTH_ERRORS, DEFAULT_SCOPE, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
-export { parseScope, formatScope, requestedScopes, firstScopeError, } from "./scope.js";
-export { readClientAuth, firstClientAuthError } from "./clientauth.js";
-export { unregisteredClientsAllowed } from "./types.js";
+export { isCimdClientId, resolveCimdClient, } from "./cimd/cimd.js";
+export { DEFAULT_SCOPE, GRANT_TYPES, OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
+export { hashClientSecret, verifyClientSecret } from "./crypto/secrethash.js";
+// Moved to `mcp-trellis/advanced`; deprecated aliases until 3.0.
+export * from "./deprecated.js";
+export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./endpoints/metadata.js";
+export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./policy/redirect.js";
+export { canonicalResource, DEFAULT_RESOURCE_PATH, resourcesEqual, } from "./policy/resource.js";
 //# sourceMappingURL=router.js.map

package/dist/oauth/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,UAAU,EACV,0BAA0B,GAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,YAAY,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,oBAAoB;YAClB,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,kEAAkE,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,WAAW,EAAE;QACxB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,0BAA0B,EAAE,MAAM;QAClC,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;QAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAA2B,EACd,EAAE;IACf,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,uCAAuC;QACvC,wCAAwC,YAAY,EAAE;KACvD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,yCAAyC;QACzC,0CAA0C,YAAY,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiC;QAC3C,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC9C,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;YAC3B,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAC5C,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE;oBACpD,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,iEAAiE;gBACjE,4DAA4D;gBAC5D,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,GAGZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAmB,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAkBtF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IAChE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC,CAAC;AASF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAA2B,EAAe,EAAE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEnF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,6EAA6E,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ,EAAE,IAAI,GAAG,CAAC;YAChB,uCAAuC;YACvC,wCAAwC,YAAY,EAAE;SACvD,CAAC;QACF,OAAO,EAAE,IAAI,GAAG,CAAC;YACf,yCAAyC;YACzC,0CAA0C,YAAY,EAAE;SACzD,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,OAA2B,EAC3B,iBAA6C,EAC7C,SAAiB,EACa,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;SAC5F;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC7F,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACzF,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC3B,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC;SACxF;QACH,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,wDAAwD;IACxD,oEAAoE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAC9D,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAE9C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAErF,sEAAsE;IACtE,MAAM,iBAAiB,GAA+B;QACpD,GAAG,OAAO;QACV,YAAY;QACZ,SAAS;QACT,KAAK;KACN,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAElE,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE;oBAC9D,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,cAAc,CAAC,iBAAiB,EAAE;oBACtC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;iBAC5B,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAGL,cAAc,EACd,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,iEAAiE;AACjE,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC"}

package/dist/oauth/types.d.ts

@@ -1,6 +1,7 @@
-import { type TokenEndpointAuthMethod } from "./constants.js";
-import type { CodeStore } from "./codes.js";
-import type { RedirectAllowlistOptions } from "./redirect.js";
+import type { CimdCache } from "./cimd/types.js";
+import type { TokenEndpointAuthMethod } from "./constants.js";
+import type { CodeStore } from "./crypto/codes.js";
+import type { RedirectAllowlistOptions } from "./policy/redirect.js";
 export type OAuthUser = {
     id: string;
 };
@@ -15,15 +16,69 @@ export type RegisteredClient = {
     redirectUris: string[];
     tokenEndpointAuthMethod: TokenEndpointAuthMethod;
 };
+export type ConsentRequest = {
+    clientId: string;
+    registeredClient: RegisteredClient | null;
+    redirectUri: string;
+    scope: string[];
+    resource: string;
+    user: OAuthUser;
+    /** Embed this in your form's `consent_ticket` field (hidden input or POST body). */
+    ticket: string;
+    oauthPath: string;
+};
+export type ConsentOptions = {
+    /**
+     * Render the approval page yourself. Return any `Response` — HTML, or a
+     * redirect to your own route. Omit for the built-in hardened interstitial.
+     *
+     * If your page sets its own `Content-Security-Policy` with `form-action`,
+     * include `new URL(input.redirectUri).origin` in it — Chromium enforces
+     * `form-action` across the redirect your approval POST triggers, not just
+     * the immediate submission target, so `'self'` alone blocks the eventual
+     * redirect back to the client's own callback.
+     */
+    render?: (input: ConsentRequest) => Response | Promise<Response>;
+    /**
+     * Client ids that skip approval. Only honored when `clientStore` actually
+     * resolves the id — a DCR or self-invented id is never trusted.
+     */
+    preApprovedClientIds?: string[];
+};
+/**
+ * The payload sealed into a `client_id` this server itself issued via
+ * `/register` (see `sealed.ts`, type `"client"`). Zero storage: the id
+ * *is* the registration record, self-verifying against `codeSecret`.
+ */
+export type ClientAssertion = {
+    redirectUris: string[];
+    /**
+     * Unix seconds when `/register` sealed this assertion. Informational only
+     * — not enforced as an expiry — so it can help an operator judge how old
+     * a still-valid DCR client is. Optional on read: an assertion sealed
+     * before this field existed still unseals and works.
+     */
+    iat?: number;
+};
 export type ClientStore = {
     /** Resolve a pre-registered client, or null when unknown. */
     get: (clientId: string) => Promise<RegisteredClient | null>;
     /**
-     * Verify a presented client secret. Required for confidential clients.
-     * Secret storage and comparison stay in your implementation — the library
-     * never sees or persists credentials.
+     * Verify a presented client secret yourself. Secret storage and
+     * comparison stay entirely in your implementation — the library never
+     * sees or persists credentials. Prefer `secretHash` below when you can:
+     * a hand-rolled `stored === presented` here is a timing oracle with no
+     * warning from the library.
      */
     verifySecret?: (clientId: string, presented: string) => Promise<boolean>;
+    /**
+     * Preferred over `verifySecret`: return the stored hash (from
+     * `hashClientSecret`) for `clientId`, or `null` when unknown, and the
+     * library does the comparison with the same constant-time primitive it
+     * uses everywhere else. Checked first when both are present. See
+     * `secrethash.ts`.
+     */
+    secretHash?: (clientId: string) => Promise<string | null>;
 };
 export type MintedToken = {
     accessToken: string;
@@ -47,15 +102,47 @@ export type RefreshAccessTokenInput = {
      * Implementations MUST reject refresh tokens not originally issued for this resource.
      */
     resource: string;
+    /**
+     * RFC 6749 §6 — optional scope reduction requested by the client.
+     * When set, the library validates against advertised `scopes` only.
+     * Implementations MUST also reject any scope outside what was originally
+     * granted to this refresh token (the library cannot see opaque RTs).
+     */
+    scope?: string;
 };
 export type RevokeTokenInput = {
     token: string;
     clientId: string;
-    tokenTypeHint?: "access_token" | "refresh_token";
+    tokenTypeHint?: "access_token" | "refresh_token" | undefined;
+};
+/**
+ * OAuth-side metrics hook, mirroring `McpPorts.audit` on the MCP side.
+ * `reason` is intentionally more specific than what the caller ever sees —
+ * `/token` and `/revoke` collapse every client-auth failure to one generic
+ * `invalid_client` (closing an enumeration oracle; see `clientauth.ts`),
+ * and a rejected `codeSecret` surfaces to the caller only as `server_error`
+ * — this port is where an operator gets the real reason back, without
+ * handing it to an unauthenticated caller.
+ */
+export type OAuthAuditEntry = {
+    /** Machine-stable event name, e.g. "client_auth_failed", "server_error". */
+    event: string;
+    clientId?: string | undefined;
+    reason: string;
 };
 export type OAuthPorts = {
-    /** HMAC secret for signing auth codes. */
-    codeSecret: string | ((req: Request) => string | Promise<string>);
+    /**
+     * Secret(s) that seal auth codes, consent tickets, and self-issued DCR
+     * client assertions (`sealed.ts`), and key `ClientStore.secretHash`.
+     *
+     * Pass a single string, or for key rotation an array: the **first** entry seals new material and hashes new client
+     * secrets; **every** entry is tried when unsealing/verifying, so material
+     * sealed under an older key keeps working until you drop it from the
+     * array. `ports.audit` sees a `"legacy_code_secret_used"` event whenever
+     * anything but the first entry was the one that actually verified,
+     * so you know when it's safe to remove.
+     */
+    codeSecret: string | string[] | ((req: Request) => string | string[] | Promise<string | string[]>);
     /** Resolve the logged-in user, or null → redirect to login. */
     resolveUser: (req: Request) => Promise<OAuthUser | null>;
     /** Where to send unauthenticated authorize requests. */
@@ -63,7 +150,7 @@ export type OAuthPorts = {
     /** Mint an access token bound to the consenting user and resource audience. */
     mintAccessToken: (input: MintAccessTokenInput) => Promise<MintedToken>;
     /** Optional refresh_token grant. Presence advertises the grant. */
-    refreshAccessToken?: (input: RefreshAccessTokenInput) => Promise<MintedToken | null>;
+    refreshAccessToken?: ((input: RefreshAccessTokenInput) => Promise<MintedToken | null>) | undefined;
     /**
      * RFC 7009. Presence mounts `/revoke` and advertises `revocation_endpoint`.
      * Well-formed authenticated revoke is HTTP 200 even if the token is unknown
@@ -71,11 +158,18 @@ export type OAuthPorts = {
      * `refreshAccessToken` MUST consult the same store; unknown tokens and
      * tokens not issued to `clientId` MUST no-op (not throw).
      */
-    revokeToken?: (input: RevokeTokenInput) => Promise<void>;
-    /** Shared single-use jti store for multi-instance; in-memory default otherwise. */
-    codeStore?: CodeStore;
+    revokeToken?: ((input: RevokeTokenInput) => Promise<void>) | undefined;
+    /** Shared single-use jti store for multi-instance. Required unless `allowInMemoryCodeStore`. */
+    codeStore?: CodeStore | undefined;
     /** Pre-registered clients. Required to serve confidential clients. */
-    clientStore?: ClientStore;
+    clientStore?: ClientStore | undefined;
+    /**
+     * Opt-in metrics hook. Pass any function to see the real reason behind a
+     * collapsed `invalid_client` or a rejected `codeSecret`. Omit it and the
+     * library stays silent. Throwing never fails the request — same
+     * guarantee as `McpPorts.audit`.
+     */
+    audit?: ((entry: OAuthAuditEntry) => void | Promise<void>) | undefined;
 };
 export type OAuthRouterOptions = {
     ports: OAuthPorts;
@@ -83,6 +177,13 @@ export type OAuthRouterOptions = {
     oauthPath?: string;
     realm?: string;
     scopes?: string[];
+    /**
+     * Scopes granted when a client omits `scope` entirely. Required when
+     * `scopes` advertises more than one — with only one advertised scope
+     * there's no escalation to prevent, so it defaults to that scope.
+     * Must be a subset of `scopes`.
+     */
+    defaultScopes?: string[];
     redirect?: RedirectAllowlistOptions;
     /** Advertised in AS metadata. Defaults to `["none"]` (public clients only). */
     tokenEndpointAuthMethods?: TokenEndpointAuthMethod[];
@@ -98,18 +199,68 @@ export type OAuthRouterOptions = {
      * `hasDynamicClient`.
      */
     allowUnregisteredClients?: boolean;
+    /**
+     * Require every `client_id` to have gone through `clientStore` or this
+     * server's own `/register` (whose issued ids are self-verifying sealed
+     * assertions — see `sealed.ts`). Unlike `allowUnregisteredClients: false`,
+     * DCR stays mounted; a client just can't invent an id out of thin air.
+     *
+     * Default **true** since 1.0. Set **false** only when you intentionally
+     * accept arbitrary public `client_id`s (pre-CIMD connectors that invent ids).
+     */
+    requireRegisteredClients?: boolean;
+    /**
+     * Consent policy. Policy, not a credential — sits alongside `redirect`,
+     * not under `ports`. Omit for the built-in hardened interstitial.
+     */
+    consent?: ConsentOptions;
+    /**
+     * Max time to wait for `ports.audit` before responding anyway. Default
+     * 1000ms — same guarantee as `McpHandlerOptions.auditTimeoutMs`.
+     */
+    auditTimeoutMs?: number;
+    /**
+     * Allow the process-local in-memory jti Map when `ports.codeStore` is
+     * omitted. Default **false** since 2.0 — multi-instance deploys silently
+     * double-redeem auth codes without a shared store. Set true only for
+     * single-process demos and tests.
+     */
+    allowInMemoryCodeStore?: boolean;
+    /**
+     * Resolve Client ID Metadata Documents (HTTPS URL `client_id`s).
+     * Default **false** — opt in with `cimd: true`. Off until connect-pinned
+     * fetch exists; see `cimd.ts` ponytail.
+     */
+    cimd?: boolean;
+    /**
+     * CIMD document cache (respects Cache-Control max-age, capped at 1 h).
+     * **Strongly recommended with `cimd: true`:** without it `/token` and
+     * `/revoke` re-fetch the client's document on every call, so a flaky
+     * document host fails refresh/revoke (audited as `cimd_resolve_failed`).
+     */
+    cimdCache?: CimdCache;
+    /** Optional DNS lookup for CIMD SSRF checks — see `CimdFetchOptions.lookup`. */
+    cimdLookup?: (hostname: string) => Promise<string[]>;
 };
-/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
-export declare const unregisteredClientsAllowed: (options: OAuthRouterOptions) => boolean;
-/** Scopes this AS advertises and is willing to grant. */
-export declare const advertisedScopes: (options: OAuthRouterOptions) => string[];
-export declare const resolveSecret: (ports: OAuthPorts, req: Request) => Promise<string>;
-export declare const oauthError: (error: string, status: number, description?: string) => Response;
-/** Direct JSON error when this AS does not serve unknown `client_id`s. */
-export declare const unregisteredClientError: (options: OAuthRouterOptions, reject: {
+/**
+ * `OAuthRouterOptions` after `createOAuthRouter` has resolved them: paths
+ * normalized and `ports.codeStore` always present, so no endpoint handler
+ * can fall back to a store of its own. Internal — not re-exported.
+ */
+export type ResolvedOAuthRouterOptions = OAuthRouterOptions & {
+    resourcePath: string;
+    oauthPath: string;
+    ports: OAuthPorts & {
+        codeStore: CodeStore;
+    };
+};
+/**
+ * An OAuth error's code and description without a `Response` built yet —
+ * lets a caller choose delivery: `oauthError` for a direct JSON body, or a
+ * redirect to the client's own callback (RFC 6749 §4.1.2.1).
+ */
+export type OAuthErrorInfo = {
     code: string;
-    status: number;
-}) => Response | null;
-/** `grantedScope` is what the auth code carried; the port may narrow it further. */
-export declare const tokenResponse: (minted: MintedToken, grantedScope?: string) => Response;
+    description: string;
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1E,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,CACnB,KAAK,EAAE,uBAAuB,KAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GACrC,SAAS,kBAAkB,KAC1B,OAAqD,CAAC;AAEzD,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC,eAAO,MAAM,aAAa,GACxB,OAAO,UAAU,EACjB,KAAK,OAAO,KACX,OAAO,CAAC,MAAM,CAGhB,CAAC;AAEF,eAAO,MAAM,UAAU,GACrB,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,cAAc,MAAM,KACnB,QAMA,CAAC;AAKJ,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAOb,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,aAAa,GACxB,QAAQ,WAAW,EACnB,eAAe,MAAM,KACpB,QAYA,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;OAUG;IACH,UAAU,EACN,MAAM,GACN,MAAM,EAAE,GACR,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EACf,CAAC,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,GACjE,SAAS,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE,gGAAgG;IAChG,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,gFAAgF;IAChF,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,kBAAkB,GAAG;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/oauth/types.js

@@ -1,28 +1,2 @@
-import { DEFAULT_SCOPE } from "./constants.js";
-import { jsonResponse } from "../http.js";
-/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
-export const unregisteredClientsAllowed = (options) => options.allowUnregisteredClients !== false;
-/** Scopes this AS advertises and is willing to grant. */
-export const advertisedScopes = (options) => options.scopes ?? [DEFAULT_SCOPE];
-export const resolveSecret = async (ports, req) => {
-    if (typeof ports.codeSecret === "string")
-        return ports.codeSecret;
-    return ports.codeSecret(req);
-};
-export const oauthError = (error, status, description) => jsonResponse(description ? { error, error_description: description } : { error }, status, undefined, { cors: false });
-const UNREGISTERED_CLIENT_DESCRIPTION = "unknown client_id — this server only serves pre-registered clients";
-/** Direct JSON error when this AS does not serve unknown `client_id`s. */
-export const unregisteredClientError = (options, reject) => {
-    if (unregisteredClientsAllowed(options))
-        return null;
-    return oauthError(reject.code, reject.status, UNREGISTERED_CLIENT_DESCRIPTION);
-};
-/** `grantedScope` is what the auth code carried; the port may narrow it further. */
-export const tokenResponse = (minted, grantedScope) => jsonResponse({
-    access_token: minted.accessToken,
-    token_type: minted.tokenType ?? "bearer",
-    expires_in: minted.expiresIn,
-    scope: minted.scope ?? grantedScope ?? DEFAULT_SCOPE,
-    ...(minted.refreshToken ? { refresh_token: minted.refreshToken } : {}),
-}, 200, undefined, { cors: false });
+export {};
 //# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAgC,MAAM,gBAAgB,CAAC;AAG7E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6G1C,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,OAA2B,EAClB,EAAE,CAAC,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAEzD,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA2B,EAAY,EAAE,CACxE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,KAAiB,EACjB,GAAY,EACK,EAAE;IACnB,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IAClE,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAAa,EACb,MAAc,EACd,WAAoB,EACV,EAAE,CACZ,YAAY,CACV,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACnE,MAAM,EACN,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AAEJ,MAAM,+BAA+B,GACnC,oEAAoE,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,MAAwC,EACvB,EAAE;IACnB,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CACf,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,MAAM,EACb,+BAA+B,CAChC,CAAC;AACJ,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAmB,EACnB,YAAqB,EACX,EAAE,CACZ,YAAY,CACV;IACE,YAAY,EAAE,MAAM,CAAC,WAAW;IAChC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;IACxC,UAAU,EAAE,MAAM,CAAC,SAAS;IAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY,IAAI,aAAa;IACpD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACvE,EACD,GAAG,EACH,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":""}

package/dist/server.d.ts

@@ -1,15 +1,16 @@
-export { createMcpApp, type McpApp, type McpAppOptions, type McpAppAuth, type VerifiedToken, } from "./app.js";
-/** Auth-port types used by `McpAppAuth` — annotate extracted stores/callbacks. */
-export type { ClientStore, RegisteredClient, MintAccessTokenInput, RefreshAccessTokenInput, RevokeTokenInput, MintedToken, OAuthUser, } from "./oauth/types.js";
-export type { CodeStore } from "./oauth/codes.js";
-export { CLIENT_PROFILES, DEFAULT_CLIENTS, authMethodsFor, redirectUrisFor, preRegisteredClients, hasDynamicClient, type ClientName, type ClientProfile, } from "./clients.js";
-export { createMcpHandler, type McpHandler, type McpHandlerOptions, type McpPorts, type Principal, type AuditEntry, type ServerInfo, } from "./dispatch.js";
+export { createMcpApp, type McpApp, type McpAppAuth, type McpAppOptions, type UnifiedAuditEntry, type VerifiedToken, } from "./app.js";
 export { consoleAudit } from "./audit.js";
-export { createToolRegistry, type ToolDef, type ToolHandler, type ToolResult, type ToolRegistry, type ToolListEntry, type RegistryOptions, } from "./registry.js";
-export { defineTool, apiTool, type StandardSchemaV1, type DefineToolOptions, type ApiToolOptions, type ApiRequest, } from "./tools.js";
-export { rpcResult, rpcError, JSONRPC_PARSE_ERROR, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_INVALID_PARAMS, JSONRPC_INTERNAL_ERROR, JSONRPC_UNAUTHORIZED, type JsonRpcId, type JsonRpcRequest, type JsonRpcResponse, } from "./jsonrpc.js";
-export { pickProtocolVersion, PROTOCOL_VERSIONS, DEFAULT_PROTOCOL_VERSION, } from "./protocol.js";
-export { parseBearer, timingSafeEqual, matchesAny, wwwAuthenticateHeader, rejectQueryToken, type WwwAuthenticateOptions, } from "./auth/bearer.js";
-export { validateAgainstSchema, JSON_SCHEMA_TYPES, SUPPORTED_SCHEMA_KEYWORDS, IGNORED_SCHEMA_KEYWORDS, unsupportedKeywords, type JsonSchema, } from "./validate.js";
-export { jsonResponse, emptyResponse, optionsResponse, corsHeaders, methodNotAllowed, } from "./http.js";
+export { parseBearer, rejectQueryToken, type WwwAuthenticateOptions, wwwAuthenticateHeader, } from "./auth/bearer.js";
+export { authMethodsFor, CLIENT_PROFILES, type ClientName, type ClientProfile, DEFAULT_CLIENTS, hasDynamicClient, preRegisteredClients, redirectUrisFor, } from "./clients.js";
+export * from "./deprecated.js";
+export { type JsonResponseInput, type JsonResponseOptions, jsonResponse, } from "./http/http.js";
+export { type AuditEntry, createMcpHandler, type McpHandler, type McpHandlerOptions, type McpPorts, type Principal, type ServerInfo, } from "./mcp/dispatch.js";
+export { JSONRPC_INTERNAL_ERROR, JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_PARSE_ERROR, JSONRPC_UNAUTHORIZED, type JsonRpcId, type JsonRpcRequest, type JsonRpcResponse, rpcError, rpcResult, } from "./mcp/jsonrpc.js";
+export { DEFAULT_PROTOCOL_VERSION, PROTOCOL_VERSIONS } from "./mcp/protocol.js";
+export { createToolRegistry, type RegistryOptions, type ToolDef, type ToolHandler, type ToolListEntry, type ToolRegistry, type ToolResult, } from "./mcp/registry.js";
+export { type ApiRequest, type ApiToolOptions, apiTool, type DefineToolOptions, defineTool, type StandardSchemaV1, } from "./mcp/tools.js";
+export type { JsonSchema } from "./mcp/validate.js";
+export type { CodeStore } from "./oauth/crypto/codes.js";
+/** Auth-port types used by `McpAppAuth` — annotate extracted stores/callbacks. */
+export type { ClientStore, ConsentOptions, ConsentRequest, MintAccessTokenInput, MintedToken, OAuthUser, RefreshAccessTokenInput, RegisteredClient, RevokeTokenInput, } from "./oauth/types.js";
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAElB,kFAAkF;AAClF,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EACL,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,OAAO,EACP,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,cAAc,EACd,eAAe,EACf,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,QAAQ,EACR,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,iBAAiB,EACtB,UAAU,EACV,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,kFAAkF;AAClF,YAAY,EACV,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}