mcp-trellis 0.2.1 → 2.1.0

package/dist/mcp/validate.js

@@ -0,0 +1,186 @@
+export const JSON_SCHEMA_TYPES = {
+    string: "string",
+    number: "number",
+    integer: "integer",
+    boolean: "boolean",
+    object: "object",
+    array: "array",
+    null: "null",
+};
+/** `schema.type` as an array either way — a single type is a union of one. */
+const declaredTypesOf = (schema) => schema.type ? (Array.isArray(schema.type) ? schema.type : [schema.type]) : [];
+/**
+ * Direct subschemas the walkers below descend into (`properties.*`, `items`),
+ * each with the path it is reported under.
+ */
+const childSchemas = (schema, path) => [
+    ...Object.entries(schema.properties ?? {}).map(([key, child]) => [
+        child,
+        `${path}.properties.${key}`,
+    ]),
+    ...(schema.items ? [[schema.items, `${path}.items`]] : []),
+];
+/** Keywords `validateAgainstSchema` actually evaluates. */
+export const SUPPORTED_SCHEMA_KEYWORDS = new Set([
+    "type",
+    "enum",
+    "required",
+    "properties",
+    "items",
+    "minimum",
+    "maximum",
+    "additionalProperties",
+]);
+/** Supported only in these value shapes; any other value is reported as unsupported. */
+const SUPPORTED_KEYWORD_VALUES = {
+    additionalProperties: (value) => typeof value === "boolean",
+};
+const isSupportedKeyword = (key, value) => SUPPORTED_SCHEMA_KEYWORDS.has(key) && (SUPPORTED_KEYWORD_VALUES[key]?.(value) ?? true);
+/**
+ * Allowed on inputSchema but never evaluated (tools/list / generator metadata).
+ * Semantically-enforcing keywords (`pattern`, `oneOf`, …) are not ignored —
+ * with `validateArgs: true` they throw at construction.
+ */
+export const IGNORED_SCHEMA_KEYWORDS = new Set([
+    "description",
+    "title",
+    "$schema",
+    "$id",
+    "$comment",
+    "default",
+    "examples",
+    "deprecated",
+    "readOnly",
+    "writeOnly",
+    "format",
+]);
+/**
+ * Paths of keywords outside the evaluated subset, e.g. `args.properties.code.pattern`.
+ * Walks nested `properties` / `items`.
+ */
+export const unsupportedKeywords = (schema, path = "args") => {
+    const local = Object.entries(schema).flatMap(([key, value]) => isSupportedKeyword(key, value) || IGNORED_SCHEMA_KEYWORDS.has(key) ? [] : [`${path}.${key}`]);
+    return [
+        ...local,
+        ...childSchemas(schema, path).flatMap(([child, childPath]) => unsupportedKeywords(child, childPath)),
+    ];
+};
+/**
+ * Paths where `properties`/`required` implies an object shape but `type`
+ * doesn't say so — absent, or a type/union without `"object"`. Such a
+ * schema would otherwise accept any input, `{}` included. Under
+ * `validateArgs: true` this throws at construction; `validateNode`'s
+ * dispatch on the value's runtime type is the backstop for schemas that
+ * reach validation unchecked.
+ */
+export const missingObjectType = (schema, path = "args") => {
+    const impliesObject = schema.properties !== undefined || schema.required !== undefined;
+    const declaresObject = declaredTypesOf(schema).includes(JSON_SCHEMA_TYPES.object);
+    return [
+        ...(impliesObject && !declaresObject ? [path] : []),
+        ...childSchemas(schema, path).flatMap(([child, childPath]) => missingObjectType(child, childPath)),
+    ];
+};
+const runtimeTypeOf = (value) => {
+    if (value === null)
+        return JSON_SCHEMA_TYPES.null;
+    if (Array.isArray(value))
+        return JSON_SCHEMA_TYPES.array;
+    return typeof value;
+};
+const TYPE_MATCHERS = {
+    [JSON_SCHEMA_TYPES.integer]: (actual, value) => actual === JSON_SCHEMA_TYPES.number && Number.isInteger(value),
+};
+const matchesDeclaredType = (actual, value, declared) => TYPE_MATCHERS[declared]?.(actual, value) ?? actual === declared;
+const typeMismatch = (value, schema, path) => {
+    const declared = declaredTypesOf(schema);
+    if (declared.length === 0)
+        return [];
+    const actual = runtimeTypeOf(value);
+    const matches = declared.some((type) => matchesDeclaredType(actual, value, type));
+    return matches ? [] : [`${path}: expected ${declared.join(" | ")}, got ${actual}`];
+};
+const enumErrors = (value, schema, path) => {
+    if (!schema.enum || schema.enum.includes(value))
+        return [];
+    return [`${path}: value not in enum`];
+};
+const RANGE_BOUNDS = [
+    {
+        key: "minimum",
+        fails: (value, bound) => value < bound,
+        message: (path, bound) => `${path}: below minimum ${bound}`,
+    },
+    {
+        key: "maximum",
+        fails: (value, bound) => value > bound,
+        message: (path, bound) => `${path}: above maximum ${bound}`,
+    },
+];
+const rangeErrors = (value, schema, path) => {
+    if (typeof value !== "number")
+        return [];
+    return RANGE_BOUNDS.flatMap(({ key, fails, message }) => {
+        const bound = schema[key];
+        if (bound === undefined || !fails(value, bound))
+            return [];
+        return [message(path, bound)];
+    });
+};
+const objectErrors = (value, schema, path) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return [];
+    const record = value;
+    // `Object.hasOwn`, not `key in record` — `in` also matches inherited
+    // Object.prototype members (`toString`, `constructor`, `hasOwnProperty`,
+    // …), so `required: ["toString"]` would pass against `{}` and a
+    // `properties: { constructor: {...} }` entry would validate against the
+    // prototype's own `constructor`, neither of which is an actual argument
+    // the caller supplied.
+    const requiredErrors = (schema.required ?? [])
+        .filter((key) => !Object.hasOwn(record, key))
+        .map((key) => `${path}.${key}: required`);
+    const propertyErrors = Object.entries(schema.properties ?? {})
+        .filter(([key]) => Object.hasOwn(record, key))
+        .flatMap(([key, propSchema]) => validateNode(record[key], propSchema, `${path}.${key}`));
+    const extraErrors = schema.additionalProperties === false
+        ? Object.keys(record)
+            .filter((key) => !Object.hasOwn(schema.properties ?? {}, key))
+            .map((key) => `${path}.${key}: not allowed`)
+        : [];
+    return [...requiredErrors, ...propertyErrors, ...extraErrors];
+};
+const arrayErrors = (value, schema, path) => {
+    const items = schema.items;
+    if (!Array.isArray(value) || !items)
+        return [];
+    return value.flatMap((entry, index) => validateNode(entry, items, `${path}[${index}]`));
+};
+const TYPE_CHECKERS = {
+    [JSON_SCHEMA_TYPES.object]: objectErrors,
+    [JSON_SCHEMA_TYPES.array]: arrayErrors,
+    [JSON_SCHEMA_TYPES.number]: rangeErrors,
+    [JSON_SCHEMA_TYPES.integer]: rangeErrors,
+};
+const validateNode = (value, schema, path) => {
+    const typeErrors = typeMismatch(value, schema, path);
+    if (typeErrors.length > 0)
+        return typeErrors;
+    // Dispatch on the value's own runtime shape, not the declared type
+    // string(s). By this point `typeMismatch` has already confirmed `value`
+    // is consistent with whatever was declared (or nothing was declared at
+    // all) — so this is always safe, handles a union type correctly with no
+    // extra cases, and is what makes `objectErrors` run for a type-less
+    // schema whose `properties`/`required` clearly mean "object" even
+    // though `type` doesn't say so (the construction-time
+    // `missingObjectType` check is the primary guard; this is the runtime
+    // backstop for a schema that reaches validation unchecked).
+    const actual = runtimeTypeOf(value);
+    return [
+        ...enumErrors(value, schema, path),
+        ...(TYPE_CHECKERS[actual]?.(value, schema, path) ?? []),
+    ];
+};
+/** Minimal JSON Schema subset used by MCP tool inputSchema. Empty = valid. */
+export const validateAgainstSchema = (value, schema) => validateNode(value, schema, "args");
+//# sourceMappingURL=validate.js.map

package/dist/mcp/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/mcp/validate.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,8EAA8E;AAC9E,MAAM,eAAe,GAAG,CAAC,MAAkB,EAAY,EAAE,CACvD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAEhF;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,MAAkB,EAAE,IAAY,EAA+B,EAAE,CAAC;IACtF,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAwB,EAAE,CAAC;QACrF,KAAK;QACL,GAAG,IAAI,eAAe,GAAG,EAAE;KAC5B,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACnF,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,MAAM;IACN,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO;IACP,SAAS;IACT,SAAS;IACT,sBAAsB;CACvB,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,wBAAwB,GAAgD;IAC5E,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,SAAS;CAC5D,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,KAAc,EAAW,EAAE,CAClE,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAClE,aAAa;IACb,OAAO;IACP,SAAS;IACT,KAAK;IACL,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAkB,EAAE,IAAI,GAAG,MAAM,EAAY,EAAE;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC5D,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAC7F,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAC3D,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CACtC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAkB,EAAE,IAAI,GAAG,MAAM,EAAY,EAAE;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC;IACvF,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClF,OAAO;QACL,GAAG,CAAC,aAAa,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAC3D,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CACpC;KACF,CAAC;AACJ,CAAC,CAAC;AAIF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC;IACzD,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAgE;IACjF,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAC7C,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;CACjE,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,KAAc,EAAE,QAAgB,EAAW,EAAE,CACxF,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,CAAC;AAElE,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,MAAkB,EAAE,IAAY,EAAY,EAAE;IAClF,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,cAAc,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,MAAkB,EAAE,IAAY,EAAY,EAAE;IAChF,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,OAAO,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,YAAY,GAIb;IACH;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK;QACtC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,mBAAmB,KAAK,EAAE;KAC5D;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK;QACtC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,mBAAmB,KAAK,EAAE;KAC5D;CACF,CAAC;AAEF,MAAM,WAAW,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,YAAY,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,qEAAqE;IACrE,yEAAyE;IACzE,gEAAgE;IAChE,wEAAwE;IACxE,wEAAwE;IACxE,uBAAuB;IACvB,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,YAAY,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;SAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SAC7C,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,WAAW,GACf,MAAM,CAAC,oBAAoB,KAAK,KAAK;QACnC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;aAC7D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,eAAe,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,CAAC,GAAG,cAAc,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,WAAW,GAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,aAAa,GAAgC;IACjD,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,YAAY;IACxC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,WAAW;IACtC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW;IACvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,WAAW;CACzC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,MAAkB,EAAE,IAAY,EAAY,EAAE;IAClF,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7C,mEAAmE;IACnE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,sDAAsD;IACtD,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC;QAClC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAc,EAAE,MAAkB,EAAY,EAAE,CACpF,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC"}

package/dist/oauth/audit.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Invoke `ports.audit`, swallowing any failure and racing it against
+ * `auditTimeoutMs` — the OAuth-side twin of `methods.ts`'s `safeAudit`.
+ * A hanging sink must not stall `/token` or `/authorize` error responses.
+ */
+import type { OAuthAuditEntry, OAuthRouterOptions } from "./types.js";
+export declare const safeOAuthAudit: (options: OAuthRouterOptions, entry: OAuthAuditEntry) => Promise<void>;
+/**
+ * Fires `legacy_code_secret_used` when a value was recovered with a
+ * rotation-array entry other than the primary (`keyIndex > 0`) — the signal
+ * every codeSecret rotation site (`/authorize`, `/consent`, `/token`,
+ * `firstClientAuthError`) uses to tell an operator which old keys are still
+ * live. A no-op for the common case (`keyIndex === 0`, or none at all).
+ */
+export declare const auditLegacyKeyUsage: (options: OAuthRouterOptions, usage: {
+    clientId: string;
+    keyIndex: number | null | undefined;
+    source: string;
+}) => Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/oauth/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/oauth/audit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEtE,eAAO,MAAM,cAAc,GACzB,SAAS,kBAAkB,EAC3B,OAAO,eAAe,KACrB,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC9B,SAAS,kBAAkB,EAC3B,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KAC/E,OAAO,CAAC,IAAI,CAOd,CAAC"}

package/dist/oauth/audit.js

@@ -0,0 +1,29 @@
+/**
+ * Invoke `ports.audit`, swallowing any failure and racing it against
+ * `auditTimeoutMs` — the OAuth-side twin of `methods.ts`'s `safeAudit`.
+ * A hanging sink must not stall `/token` or `/authorize` error responses.
+ */
+import { DEFAULT_AUDIT_TIMEOUT_MS, runAuditBounded } from "../http/http.js";
+export const safeOAuthAudit = async (options, entry) => {
+    const audit = options.ports.audit;
+    if (!audit)
+        return;
+    await runAuditBounded(() => audit(entry), options.auditTimeoutMs ?? DEFAULT_AUDIT_TIMEOUT_MS);
+};
+/**
+ * Fires `legacy_code_secret_used` when a value was recovered with a
+ * rotation-array entry other than the primary (`keyIndex > 0`) — the signal
+ * every codeSecret rotation site (`/authorize`, `/consent`, `/token`,
+ * `firstClientAuthError`) uses to tell an operator which old keys are still
+ * live. A no-op for the common case (`keyIndex === 0`, or none at all).
+ */
+export const auditLegacyKeyUsage = async (options, usage) => {
+    if (!usage.keyIndex)
+        return;
+    await safeOAuthAudit(options, {
+        event: "legacy_code_secret_used",
+        clientId: usage.clientId,
+        reason: `${usage.source} with codeSecret[${usage.keyIndex}]`,
+    });
+};
+//# sourceMappingURL=audit.js.map

package/dist/oauth/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/oauth/audit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAG5E,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAA2B,EAC3B,KAAsB,EACP,EAAE;IACjB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,OAA2B,EAC3B,KAAgF,EACjE,EAAE;IACjB,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO;IAC5B,MAAM,cAAc,CAAC,OAAO,EAAE;QAC5B,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,QAAQ,GAAG;KAC7D,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/cimd/cimd-parse.d.ts

@@ -0,0 +1,4 @@
+import type { CimdDocument } from "./types.js";
+export declare const parseCacheMaxAge: (header: string | null) => number;
+export declare const parseDocument: (clientId: string, text: string) => CimdDocument;
+//# sourceMappingURL=cimd-parse.d.ts.map

package/dist/oauth/cimd/cimd-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-parse.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-parse.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK/C,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,GAAG,IAAI,KAAG,MAGxD,CAAC;AAoCF,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,YAsB9D,CAAC"}

package/dist/oauth/cimd/cimd-parse.js

@@ -0,0 +1,70 @@
+import { isJsonObject } from "../../util/json.js";
+import { MAX_CLIENT_REDIRECT_URIS } from "../constants.js";
+import { isLoopbackHostname } from "./cimd-ssrf.js";
+const DEFAULT_CACHE_SECONDS = 300;
+const MAX_CACHE_SECONDS = 3600;
+export const parseCacheMaxAge = (header) => {
+    const maxAge = header ? /(?:^|,)\s*max-age=(\d+)/i.exec(header)?.[1] : undefined;
+    return maxAge === undefined ? DEFAULT_CACHE_SECONDS : Math.min(Number(maxAge), MAX_CACHE_SECONDS);
+};
+const assertHttpRedirectUri = (uri) => {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        throw new Error("CIMD redirect_uris entries must be absolute URLs");
+    }
+    if (parsed.username || parsed.password || parsed.hash) {
+        throw new Error("CIMD redirect_uris must not carry credentials or a fragment");
+    }
+    if (parsed.protocol === "https:")
+        return;
+    if (parsed.protocol === "http:") {
+        if (!isLoopbackHostname(parsed.hostname)) {
+            throw new Error("CIMD http redirect_uris must be loopback (127.0.0.1 / ::1)");
+        }
+        return;
+    }
+    throw new Error("CIMD redirect_uris must be http(s)");
+};
+const parseRedirectUris = (rawUris) => {
+    if (!Array.isArray(rawUris) || rawUris.length === 0) {
+        throw new Error("CIMD document must include a non-empty redirect_uris array");
+    }
+    if (rawUris.length > MAX_CLIENT_REDIRECT_URIS) {
+        throw new Error(`CIMD redirect_uris must have at most ${MAX_CLIENT_REDIRECT_URIS} entries`);
+    }
+    return rawUris.map((u) => {
+        if (typeof u !== "string" || !u)
+            throw new Error("CIMD redirect_uris entries must be strings");
+        assertHttpRedirectUri(u);
+        return u;
+    });
+};
+export const parseDocument = (clientId, text) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error("CIMD document is not JSON");
+    }
+    if (!isJsonObject(parsed))
+        throw new Error("CIMD document must be a JSON object");
+    const record = parsed;
+    if (record.client_id !== clientId) {
+        throw new Error("CIMD document client_id must equal the request URL exactly");
+    }
+    const authMethod = record.token_endpoint_auth_method;
+    if (authMethod !== undefined && authMethod !== "none") {
+        throw new Error("CIMD clients must be public (token_endpoint_auth_method none)");
+    }
+    return {
+        client_id: clientId,
+        redirect_uris: parseRedirectUris(record.redirect_uris),
+        ...(typeof record.client_name === "string" ? { client_name: record.client_name } : {}),
+        token_endpoint_auth_method: "none",
+    };
+};
+//# sourceMappingURL=cimd-parse.js.map

package/dist/oauth/cimd/cimd-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-parse.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-parse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAqB,EAAU,EAAE;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACpG,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,GAAW,EAAQ,EAAE;IAClD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,OAAgB,EAAY,EAAE;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,wBAAwB,UAAU,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC/F,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAgB,EAAE;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,0BAA0B,CAAC;IACrD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC;QACtD,GAAG,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,0BAA0B,EAAE,MAAM;KACnC,CAAC;AACJ,CAAC,CAAC"}

package/dist/oauth/cimd/cimd-ssrf.d.ts

@@ -0,0 +1,8 @@
+/**
+ * SSRF guards for CIMD URL fetch: hostname normalization, private/NAT64
+ * IP blocks, and DNS lookup before connect.
+ */
+export declare const isLoopbackHostname: (hostname: string) => boolean;
+export declare const defaultLookup: (hostname: string) => Promise<string[]>;
+export declare const assertSafeUrl: (url: URL, lookup: (hostname: string) => Promise<string[]>) => Promise<void>;
+//# sourceMappingURL=cimd-ssrf.d.ts.map

package/dist/oauth/cimd/cimd-ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-ssrf.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoLH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,OAEL,CAAC;AAElD,eAAO,MAAM,aAAa,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAQtE,CAAC;AAiBF,eAAO,MAAM,aAAa,GACxB,KAAK,GAAG,EACR,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,KAC9C,OAAO,CAAC,IAAI,CASd,CAAC"}

package/dist/oauth/cimd/cimd-ssrf.js

@@ -0,0 +1,193 @@
+/**
+ * SSRF guards for CIMD URL fetch: hostname normalization, private/NAT64
+ * IP blocks, and DNS lookup before connect.
+ */
+/** Strip WHATWG brackets from IPv6 hostnames (`[::1]` → `::1`). */
+const normalizeHostname = (hostname) => {
+    const host = hostname.toLowerCase().replace(/\.$/, "");
+    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+};
+const DOTTED_QUAD = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/** Digits-and-dots only — covers shorthand (`127.1`) and decimal (`2130706433`). */
+const IPV4_CANDIDATE = /^\d+(?:\.\d+)*$/;
+const IPV4_PRIVATE = [
+    /^0\./,
+    /^10\./,
+    /^127\./,
+    /^169\.254\./,
+    /^172\.(1[6-9]|2\d|3[0-1])\./,
+    /^192\.168\./,
+    /^100\.(6[4-9]|[7-9]\d|1[0-1]\d|12[0-7])\./,
+    // IETF protocol assignments 192.0.0/24, benchmarking 198.18/15
+    /^192\.0\.0\./,
+    /^198\.1[89]\./,
+    // Multicast 224/4, reserved 240/4 (incl. 255.255.255.255)
+    /^(22[4-9]|23\d|24\d|25[0-5])\./,
+];
+const isPrivateV4 = (v4) => IPV4_PRIVATE.some((re) => re.test(v4));
+/** IPv4-mapped (`::ffff:a.b.c.d`) and deprecated IPv4-compatible (`::a.b.c.d`) forms. */
+const expandIpv4Mapped = (ip) => {
+    const mapped = /^::(?:ffff:)?(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(ip);
+    if (mapped)
+        return mapped[1] ?? null;
+    const hexMapped = /^::(?:ffff:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(ip);
+    if (!hexMapped)
+        return null;
+    const hi = Number.parseInt(hexMapped[1] ?? "", 16);
+    const lo = Number.parseInt(hexMapped[2] ?? "", 16);
+    return `${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`;
+};
+const HEXTET = /^[0-9a-f]{1,4}$/i;
+const parseHextet = (part) => HEXTET.test(part) ? Number.parseInt(part, 16) : null;
+const hextetPairToIpv4 = (hi, lo) => {
+    const high = parseHextet(hi);
+    const low = parseHextet(lo);
+    if (high === null || low === null)
+        return null;
+    return `${(high >> 8) & 255}.${high & 255}.${(low >> 8) & 255}.${low & 255}`;
+};
+const splitHextetParts = (segment) => segment.length > 0 ? segment.split(":") : [];
+const dottedQuadToHextetPair = (quad) => {
+    const octets = quad.split(".").map(Number);
+    if (octets.length !== 4 || octets.some((n) => !Number.isFinite(n) || n < 0 || n > 255)) {
+        return null;
+    }
+    const [a, b, c, d] = octets;
+    return [((a << 8) | b).toString(16), ((c << 8) | d).toString(16)];
+};
+const isValidHextetList = (hextets) => hextets.length === 8 && hextets.every((h) => parseHextet(h) !== null);
+/**
+ * Expand an IPv6 literal into 8 hextets. Trailing dotted-quad (mapped /
+ * compatible forms) consumes the last two slots. Returns null when the
+ * string is not a well-formed IPv6 address — callers fail closed.
+ */
+const expandIpv6Hextets = (ip) => {
+    if (!ip.includes(":"))
+        return null;
+    let ipv4Tail = null;
+    let core = ip;
+    const lastColon = ip.lastIndexOf(":");
+    const after = ip.slice(lastColon + 1);
+    if (DOTTED_QUAD.test(after)) {
+        ipv4Tail = dottedQuadToHextetPair(after);
+        if (!ipv4Tail)
+            return null;
+        core = ip.slice(0, lastColon);
+    }
+    const slots = 8 - (ipv4Tail ? 2 : 0);
+    if (core.includes("::")) {
+        const pieces = core.split("::");
+        if (pieces.length !== 2)
+            return null;
+        const headParts = splitHextetParts(pieces[0] ?? "");
+        const tailParts = splitHextetParts(pieces[1] ?? "");
+        if (headParts.length + tailParts.length > slots)
+            return null;
+        const missing = slots - headParts.length - tailParts.length;
+        const hextets = [
+            ...headParts,
+            ...Array.from({ length: missing }, () => "0"),
+            ...tailParts,
+            ...(ipv4Tail ?? []),
+        ];
+        return isValidHextetList(hextets) ? hextets : null;
+    }
+    const parts = splitHextetParts(core);
+    if (parts.length !== slots)
+        return null;
+    const hextets = [...parts, ...(ipv4Tail ?? [])];
+    return isValidHextetList(hextets) ? hextets : null;
+};
+// --- block rules (ordered; first match blocks) ---
+/** Non-canonical IPv4 from a sloppy `cimdLookup` — fail closed, not a public hostname. */
+const isNonCanonicalIpv4 = (v4) => IPV4_CANDIDATE.test(v4) && !DOTTED_QUAD.test(v4);
+const isPrivateDottedQuad = (v4) => DOTTED_QUAD.test(v4) && isPrivateV4(v4);
+const IPV6_BLOCKED_EXACT = new Set(["::1", "::"]);
+const IPV6_BLOCKED_PREFIXES = ["fe80:", "::ffff:"];
+/** ULA fc00::/7 and multicast ff00::/8. */
+const IPV6_BLOCKED_PREFIX_RES = [/^f[cd][0-9a-f]{2}:/i, /^ff[0-9a-f]{0,2}:/];
+const isBlockedIpv6Literal = (ip) => IPV6_BLOCKED_EXACT.has(ip) ||
+    IPV6_BLOCKED_PREFIXES.some((prefix) => ip.startsWith(prefix)) ||
+    IPV6_BLOCKED_PREFIX_RES.some((re) => re.test(ip));
+const leadingFiveZero = (n) => n[0] === 0 && n[1] === 0 && n[2] === 0 && n[3] === 0 && n[4] === 0;
+/** Full-form IPv4-mapped (`0:0:0:0:0:ffff:…`) — same block as `::ffff:` prefix. */
+const isIpv4MappedHextets = (n) => leadingFiveZero(n) && n[5] === 0xffff;
+/** Deprecated IPv4-compatible — private/reserved embeds only (public stays). */
+const isBlockedIpv4Compatible = (n, raw) => {
+    if (!leadingFiveZero(n) || n[5] !== 0)
+        return false;
+    if (n[6] === 0 && (n[7] === 0 || n[7] === 1))
+        return true;
+    const embedded = hextetPairToIpv4(raw[6] ?? "", raw[7] ?? "");
+    return !embedded || isPrivateV4(embedded);
+};
+const HEXTET_BLOCK_RULES = [
+    isIpv4MappedHextets,
+    isBlockedIpv4Compatible,
+    (n) => n[0] === 0x2002, // 6to4 2002::/16
+    (n) => n[0] === 0x64 && n[1] === 0xff9b, // NAT64 64:ff9b::/96
+];
+const isBlockedIp = (ip) => {
+    const normalized = normalizeHostname(ip);
+    const v4 = expandIpv4Mapped(normalized) ?? normalized;
+    if (isNonCanonicalIpv4(v4) || isPrivateDottedQuad(v4))
+        return true;
+    if (!normalized.includes(":"))
+        return false;
+    if (isBlockedIpv6Literal(normalized))
+        return true;
+    const raw = expandIpv6Hextets(normalized);
+    if (!raw)
+        return true; // fail closed on unparseable IPv6
+    const n = raw.map((h) => Number.parseInt(h, 16));
+    return HEXTET_BLOCK_RULES.some((rule) => rule(n, raw));
+};
+const BLOCKED_HOST_EXACT = new Set(["localhost"]);
+const BLOCKED_HOST_SUFFIXES = [".localhost", ".local"];
+const isBlockedHostname = (hostname) => {
+    const host = normalizeHostname(hostname);
+    if (BLOCKED_HOST_EXACT.has(host))
+        return true;
+    if (BLOCKED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix)))
+        return true;
+    return isBlockedIp(host);
+};
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1"]);
+export const isLoopbackHostname = (hostname) => 
+// `localhost` deliberately excluded — RFC 8252 §8.3, same as policy/redirect.ts.
+LOOPBACK_HOSTS.has(normalizeHostname(hostname));
+export const defaultLookup = async (hostname) => {
+    try {
+        const dns = await import("node:dns/promises");
+        const results = await dns.lookup(hostname, { all: true, verbatim: true });
+        return results.map((r) => r.address);
+    }
+    catch {
+        throw new Error("CIMD DNS lookup unavailable");
+    }
+};
+const URL_SAFETY = {
+    https: {
+        ok: (url) => url.protocol === "https:",
+        error: "CIMD client_id must be https",
+    },
+    noCredentials: {
+        ok: (url) => !url.username && !url.password,
+        error: "CIMD URL must not carry credentials",
+    },
+    publicHostname: {
+        ok: (url) => !isBlockedHostname(url.hostname),
+        error: "CIMD hostname is not publicly routable",
+    },
+};
+export const assertSafeUrl = async (url, lookup) => {
+    for (const rule of Object.values(URL_SAFETY)) {
+        if (!rule.ok(url))
+            throw new Error(rule.error);
+    }
+    const addrs = await lookup(normalizeHostname(url.hostname));
+    if (addrs.length === 0 || addrs.some(isBlockedIp)) {
+        throw new Error("CIMD resolved to a non-public address");
+    }
+};
+//# sourceMappingURL=cimd-ssrf.js.map

package/dist/oauth/cimd/cimd-ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-ssrf.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,oFAAoF;AACpF,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,MAAM,YAAY,GAAG;IACnB,MAAM;IACN,OAAO;IACP,QAAQ;IACR,aAAa;IACb,6BAA6B;IAC7B,aAAa;IACb,2CAA2C;IAC3C,+DAA+D;IAC/D,cAAc;IACd,eAAe;IACf,0DAA0D;IAC1D,gCAAgC;CACjC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpF,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAiB,EAAE;IACrD,MAAM,MAAM,GAAG,0CAA0C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAErC,MAAM,SAAS,GAAG,gDAAgD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;AACzE,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAElC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAiB,EAAE,CAClD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEvD,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAU,EAAiB,EAAE;IACjE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAY,EAAE,CACrD,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAE/C,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAA2B,EAAE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAA0C,CAAC;IAChE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,OAAiB,EAC4D,EAAE,CAC/E,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAmB,EAAE;IACxD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,QAAQ,GAA4B,IAAI,CAAC;IAC7C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC5D,MAAM,OAAO,GAAG;YACd,GAAG,SAAS;YACZ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;YAC7C,GAAG,SAAS;YACZ,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC,CAAC;AAEF,oDAAoD;AAEpD,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAW,EAAE,CACjD,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEnD,MAAM,mBAAmB,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;AAE7F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACnD,2CAA2C;AAC3C,MAAM,uBAAuB,GAAG,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AAE7E,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAW,EAAE,CACnD,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,uBAAuB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpD,MAAM,eAAe,GAAG,CAAC,CAAW,EAAW,EAAE,CAC/C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAErE,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;AAE5F,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,CAAC,CAAW,EAAE,GAAa,EAAW,EAAE;IACtE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAmD;IACzE,mBAAmB;IACnB,uBAAuB;IACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,iBAAiB;IACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,qBAAqB;CAC/D,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;IAEtD,IAAI,kBAAkB,CAAC,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,oBAAoB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IAEzD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAEvD,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAW,EAAE;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE;AAC9D,iFAAiF;AACjF,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAqB,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAiE;IAC/E,KAAK,EAAE;QACL,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACtC,KAAK,EAAE,8BAA8B;KACtC;IACD,aAAa,EAAE;QACb,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC3C,KAAK,EAAE,qCAAqC;KAC7C;IACD,cAAc,EAAE;QACd,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7C,KAAK,EAAE,wCAAwC;KAChD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,GAAQ,EACR,MAA+C,EAChC,EAAE;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/cimd/cimd.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Client ID Metadata Documents (CIMD) — HTTPS URL `client_id` metadata.
+ * Off by default (`cimd: true`). SSRF guards live in `cimd-ssrf.ts`.
+ *
+ * ponytail: DNS checked before/after fetch; TCP connect is not pinned (Web
+ * fetch). Upgrade: custom dispatcher dialing the resolved IP + Host header.
+ */
+import type { CimdCache, CimdDocument } from "./types.js";
+export type { CimdCache, CimdDocument } from "./types.js";
+export type CimdFetchOptions = {
+    /** Override fetch (tests). Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    cache?: CimdCache;
+    /**
+     * DNS lookup for rebinding checks. When omitted, the library tries
+     * `node:dns/promises.lookup` if available; if that is also unavailable
+     * (e.g. some Workers), resolution is refused rather than fetched blind.
+     */
+    lookup?: (hostname: string) => Promise<string[]>;
+    /** Per-hop timeout covering connect **and** body read. Tests only — default 10 s. */
+    timeoutMs?: number;
+};
+/** Build fetch options from router/app CIMD ports. */
+export declare const cimdFetchOpts: (ports: {
+    cimdCache?: CimdCache;
+    cimdLookup?: (hostname: string) => Promise<string[]>;
+}) => Pick<CimdFetchOptions, "cache" | "lookup">;
+/** True when `client_id` is an HTTPS URL eligible for CIMD resolution. */
+export declare const isCimdClientId: (clientId: string) => boolean;
+/**
+ * Fetch and validate a CIMD document for `clientId` (the HTTPS URL itself).
+ * Returns null on any validation / network failure — callers map that to
+ * `unauthorized_client` without leaking fetch details to the connector.
+ */
+export declare const resolveCimdClient: (clientId: string, options?: CimdFetchOptions) => Promise<CimdDocument | null>;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/oauth/cimd/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,aAAa,GAAI,OAAO;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,KAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAG3C,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,KAAG,OAajD,CAAC;AAwGF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAC5B,UAAU,MAAM,EAChB,UAAS,gBAAqB,KAC7B,OAAO,CAAC,YAAY,GAAG,IAAI,CAkB7B,CAAC"}