mcp-trellis 1.0.0 → 2.2.0

package/dist/oauth/router.js

@@ -1,119 +1,103 @@
-import { BodyTooLargeError, DEFAULT_OAUTH_BODY_LIMIT, readBoundedText } from "../body.js";
-import { INTERNAL_ERROR, jsonResponse, requireHttpMethod } from "../http.js";
-import { handleAuthorize } from "./authorize.js";
-import { handleConsent } from "./consent.js";
-import { GRANT_TYPES, OAUTH_ERRORS } from "./constants.js";
-import { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
-import { DEFAULT_RESOURCE_PATH, normalizeConfiguredPath } from "./resource.js";
-import { handleRevoke } from "./revoke.js";
-import { seal } from "./sealed.js";
-import { handleToken } from "./token.js";
-import { assertCodeSecret, assertScopeConfig, oauthError, resolveSecret, safeOAuthAudit, unregisteredClientsAllowed, } from "./types.js";
-import { handleWellKnown } from "./wellknown.js";
-const POST_ONLY = new Set(["POST"]);
-const handleRegister = async (request, options) => {
-    const methodError = requireHttpMethod(request, POST_ONLY);
-    if (methodError)
-        return methodError;
-    let suppliedRedirectUris = false;
-    let redirectUris = [];
-    try {
-        const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
-        const body = JSON.parse(text);
-        const raw = body.redirect_uris;
-        if (Array.isArray(raw)) {
-            suppliedRedirectUris = true;
-            redirectUris = raw
-                .map((u) => String(u))
-                .filter((uri) => isAllowedRedirectUri(uri, options.redirect));
-        }
-    }
-    catch (exc) {
-        if (exc instanceof BodyTooLargeError) {
-            return oauthError(OAUTH_ERRORS.invalidRequest, 413, "request body too large");
-        }
-        redirectUris = [];
-    }
-    // No redirect_uris in the body: fall back to the Claude callback only if
-    // this server's own allowlist actually accepts it — never advertise a
-    // redirect_uri that `/authorize` would go on to reject (e.g. `clients`
-    // without `"claude"`, where `createMcpApp` sets `allowClaude: false`).
-    if (!suppliedRedirectUris && isAllowedRedirectUri(CLAUDE_CALLBACK, options.redirect)) {
-        redirectUris = [CLAUDE_CALLBACK];
-    }
-    if (redirectUris.length === 0) {
-        return oauthError(OAUTH_ERRORS.invalidRedirectUri, 400, suppliedRedirectUris
-            ? "no allowed redirect_uris"
-            : "redirect_uris required — this server has no default redirect_uri");
-    }
-    // Zero storage: the client_id *is* the registration record — a sealed,
-    // self-verifying assertion of the redirect_uris this call just validated.
-    // `/authorize` unseals it and binds the client to exactly this list,
-    // the same protection a stored registration would give a pre-registered id.
-    const secret = await resolveSecret(options.ports, request);
-    const clientId = await seal(secret, "client", { redirectUris });
-    return jsonResponse({
-        client_id: clientId,
-        client_id_issued_at: Math.floor(Date.now() / 1000),
-        token_endpoint_auth_method: "none",
-        redirect_uris: redirectUris,
-        grant_types: [GRANT_TYPES.authorizationCode],
-        response_types: ["code"],
-    });
-};
-export const createOAuthRouter = (options) => {
+import { errorReason, INTERNAL_ERROR } from "../http/http.js";
+import { safeOAuthAudit } from "./audit.js";
+import { assertCodeSecret, assertScopeConfig, oauthError, unregisteredClientsAllowed, } from "./config.js";
+import { DEFAULT_OAUTH_PATH, OAUTH_ERRORS } from "./constants.js";
+import { processCodeStore } from "./crypto/codes.js";
+import { handleAuthorize } from "./endpoints/authorize.js";
+import { handleConsent } from "./endpoints/consent.js";
+import { handleRegister } from "./endpoints/register.js";
+import { handleRevoke } from "./endpoints/revoke.js";
+import { handleToken } from "./endpoints/token.js";
+import { handleWellKnown } from "./endpoints/wellknown.js";
+import { DEFAULT_RESOURCE_PATH, normalizeConfiguredPath } from "./policy/resource.js";
+/**
+ * Function-form `codeSecret` is re-validated on every call in
+ * `resolveSecrets`, since its value can vary per request; a string or array
+ * form is fixed for the life of this router, so fail fast at construction
+ * instead of at the first request.
+ */
+const assertRouterOptions = (options) => {
     if (!unregisteredClientsAllowed(options) && !options.ports.clientStore) {
         throw new Error("allowUnregisteredClients: false requires ports.clientStore " +
             "so pre-registered clients can be resolved");
     }
-    // Function-form codeSecret is re-validated on every call in resolveSecret,
-    // since its value can vary per request; a string form is fixed for the
-    // life of this router, so fail fast at construction instead of at the
-    // first request.
+    if (!options.ports.codeStore && !options.allowInMemoryCodeStore) {
+        throw new Error("ports.codeStore is required (shared jti store for auth-code / consent single-use). " +
+            "Pass a CodeStore, or set allowInMemoryCodeStore: true for single-process demos/tests only");
+    }
     if (typeof options.ports.codeSecret === "string") {
         assertCodeSecret(options.ports.codeSecret);
     }
+    if (Array.isArray(options.ports.codeSecret)) {
+        if (options.ports.codeSecret.length === 0) {
+            throw new Error("codeSecret array must not be empty — at least one key is required");
+        }
+        options.ports.codeSecret.forEach(assertCodeSecret);
+    }
     assertScopeConfig(options);
-    // Normalized once here, not per request — "/mcp/" and "/mcp" must never
-    // produce divergent canonical resources (canonicalResource doesn't strip
-    // a trailing slash itself; normalizeResource, used to compare an
-    // incoming request's resource against it, does).
+};
+/**
+ * Normalized once, not per request, so "/mcp/" and "/mcp" yield one
+ * canonical resource, and the routing table, discovery documents and the
+ * consent form action all agree on `oauthPath`.
+ */
+const normalizeRouterPaths = (options) => {
     const resourcePath = normalizeConfiguredPath(options.resourcePath ?? DEFAULT_RESOURCE_PATH);
-    const oauthPath = options.oauthPath ?? "/mcp/oauth";
+    const oauthPath = normalizeConfiguredPath(options.oauthPath ?? DEFAULT_OAUTH_PATH);
     if (oauthPath === resourcePath) {
         throw new Error(`oauthPath (${oauthPath}) must not equal resourcePath — they would shadow each other`);
     }
     if (resourcePath.startsWith("/.well-known")) {
         throw new Error(`resourcePath (${resourcePath}) must not start with /.well-known — reserved for OAuth discovery documents`);
     }
-    const prmPaths = new Set([
-        "/.well-known/oauth-protected-resource",
-        `/.well-known/oauth-protected-resource${resourcePath}`,
-    ]);
-    const asPaths = new Set([
-        "/.well-known/oauth-authorization-server",
-        `/.well-known/oauth-authorization-server${resourcePath}`,
-    ]);
-    const routes = {
-        ...(unregisteredClientsAllowed(options)
-            ? {
-                [`${oauthPath}/register`]: (request) => handleRegister(request, options),
-            }
-            : {}),
-        [`${oauthPath}/authorize`]: (request) => handleAuthorize(request, options),
-        [`${oauthPath}/consent`]: (request) => handleConsent(request, options),
-        [`${oauthPath}/token`]: (request) => handleToken(request, options),
-        ...(options.ports.revokeToken
-            ? {
-                [`${oauthPath}/revoke`]: (request) => handleRevoke(request, options),
-            }
-            : {}),
+    return {
+        resourcePath,
+        oauthPath,
+        prmPaths: new Set([
+            "/.well-known/oauth-protected-resource",
+            `/.well-known/oauth-protected-resource${resourcePath}`,
+        ]),
+        asPaths: new Set([
+            "/.well-known/oauth-authorization-server",
+            `/.well-known/oauth-authorization-server${resourcePath}`,
+        ]),
+    };
+};
+const buildRoutes = (options, normalizedOptions, oauthPath) => ({
+    ...(unregisteredClientsAllowed(options)
+        ? {
+            [`${oauthPath}/register`]: (request) => handleRegister(request, normalizedOptions),
+        }
+        : {}),
+    [`${oauthPath}/authorize`]: (request) => handleAuthorize(request, normalizedOptions),
+    [`${oauthPath}/consent`]: (request) => handleConsent(request, normalizedOptions),
+    [`${oauthPath}/token`]: (request) => handleToken(request, normalizedOptions),
+    ...(options.ports.revokeToken
+        ? {
+            [`${oauthPath}/revoke`]: (request) => handleRevoke(request, normalizedOptions),
+        }
+        : {}),
+});
+export const createOAuthRouter = (options) => {
+    assertRouterOptions(options);
+    // Resolved once; `assertRouterOptions` already required
+    // `allowInMemoryCodeStore` before the process store can be reached.
+    const codeStore = options.ports.codeStore ?? processCodeStore;
+    const ports = { ...options.ports, codeStore };
+    const { resourcePath, oauthPath, prmPaths, asPaths } = normalizeRouterPaths(options);
+    // Handlers read paths from here, never from the caller's raw options.
+    const normalizedOptions = {
+        ...options,
+        resourcePath,
+        oauthPath,
+        ports,
     };
+    const routes = buildRoutes(options, normalizedOptions, oauthPath);
     return {
         tryHandle: async (request) => {
             try {
                 const path = new URL(request.url).pathname;
-                const known = await handleWellKnown(request, options, {
+                const known = await handleWellKnown(request, normalizedOptions, {
                     prmPaths,
                     asPaths,
                     resourcePath,
@@ -124,31 +108,25 @@ export const createOAuthRouter = (options) => {
                 const route = routes[path];
                 return route ? await route(request) : null;
             }
-            catch (exc) {
-                // A host port (resolveUser/mintAccessToken/clientStore/...) threw,
-                // or codeSecret failed validation (assertCodeSecret, e.g. a
-                // per-request function returning something too short). We only
-                // ever reach here on a route this router owns, so answer with a
-                // real error instead of throwing out of `tryHandle` — the caller
-                // gets the generic server_error; ports.audit gets the real reason.
-                await safeOAuthAudit(options, {
+            catch (caught) {
+                // A host port threw, or a per-request codeSecret failed validation.
+                // Only routes this router owns get here: the caller sees a generic
+                // server_error, ports.audit gets the real reason.
+                await safeOAuthAudit(normalizedOptions, {
                     event: "server_error",
-                    reason: exc instanceof Error ? exc.message : String(exc),
+                    reason: errorReason(caught),
                 });
                 return oauthError(OAUTH_ERRORS.serverError, 500, INTERNAL_ERROR);
             }
         },
     };
 };
-export { firstClientAuthError, readClientAuth } from "./clientauth.js";
-export { consumeAuthCode, issueAuthCode, newClientId, } from "./codes.js";
-export { buildErrorRedirectUrl } from "./consent.js";
+export { isCimdClientId, resolveCimdClient, } from "./cimd/cimd.js";
 export { DEFAULT_SCOPE, GRANT_TYPES, OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
-export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./metadata.js";
-export { randomBase64Url, sha256Base64Url, verifyPkceS256 } from "./pkce.js";
-export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./redirect.js";
-export { canonicalResource, DEFAULT_RESOURCE_PATH, firstResourceError, normalizeConfiguredPath, resourceErrorInfo, resourcesEqual, } from "./resource.js";
-export { firstScopeError, formatScope, parseScope, requestedScopes, scopeErrorInfo, } from "./scope.js";
-export { hashClientSecret, verifyClientSecret } from "./secrethash.js";
-export { advertisedScopes, defaultScopes, registeredClientsRequired, unregisteredClientsAllowed, } from "./types.js";
+export { hashClientSecret, verifyClientSecret } from "./crypto/secrethash.js";
+// Moved to `mcp-trellis/advanced`; deprecated aliases until 3.0.
+export * from "./deprecated.js";
+export { authorizationServerMetadata, mcpWwwAuthenticate, protectedResourceMetadata, } from "./endpoints/metadata.js";
+export { CLAUDE_CALLBACK, isAllowedRedirectUri } from "./policy/redirect.js";
+export { canonicalResource, DEFAULT_RESOURCE_PATH, resourcesEqual, } from "./policy/resource.js";
 //# sourceMappingURL=router.js.map

package/dist/oauth/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAGjB,UAAU,EACV,aAAa,EACb,cAAc,EACd,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAUjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,KAAK,EAAE,OAAgB,EAAE,OAA2B,EAAqB,EAAE;IAChG,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,YAAY,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,oBAAoB;YAClB,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,kEAAkE,CACvE,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,YAAY,EAA4B,CAAC,CAAC;IAE1F,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,0BAA0B,EAAE,MAAM;QAClC,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;QAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,iBAAiB;IACjB,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE3B,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,iDAAiD;IACjD,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IAEpD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,6EAA6E,CAC3G,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,uCAAuC;QACvC,wCAAwC,YAAY,EAAE;KACvD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,yCAAyC;QACzC,0CAA0C,YAAY,EAAE;KACzD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAiC;QAC3C,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;aAClF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;QACtE,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;YAC3B,CAAC,CAAC;gBACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;aAC9E;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE;oBACpD,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,4DAA4D;gBAC5D,+DAA+D;gBAC/D,gEAAgE;gBAChE,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,cAAc,CAAC,OAAO,EAAE;oBAC5B,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACzD,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAAmB,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAGL,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAUvE,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAkBtF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IAChE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC,CAAC;AASF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAA2B,EAAe,EAAE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEnF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,6EAA6E,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ,EAAE,IAAI,GAAG,CAAC;YAChB,uCAAuC;YACvC,wCAAwC,YAAY,EAAE;SACvD,CAAC;QACF,OAAO,EAAE,IAAI,GAAG,CAAC;YACf,yCAAyC;YACzC,0CAA0C,YAAY,EAAE;SACzD,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,OAA2B,EAC3B,iBAA6C,EAC7C,SAAiB,EACa,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;SAC5F;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC7F,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACzF,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC3B,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC;SACxF;QACH,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,wDAAwD;IACxD,oEAAoE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAC9D,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAE9C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAErF,sEAAsE;IACtE,MAAM,iBAAiB,GAA+B;QACpD,GAAG,OAAO;QACV,YAAY;QACZ,SAAS;QACT,KAAK;KACN,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAElE,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE;oBAC9D,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,cAAc,CAAC,iBAAiB,EAAE;oBACtC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;iBAC5B,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAGL,cAAc,EACd,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,iEAAiE;AACjE,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC"}

package/dist/oauth/types.d.ts

@@ -1,7 +1,7 @@
-import type { CodeStore } from "./codes.js";
-import type { ConsentOptions } from "./consent.js";
-import { type TokenEndpointAuthMethod } from "./constants.js";
-import type { RedirectAllowlistOptions } from "./redirect.js";
+import type { CimdCache } from "./cimd/types.js";
+import type { TokenEndpointAuthMethod } from "./constants.js";
+import type { CodeStore } from "./crypto/codes.js";
+import type { RedirectAllowlistOptions } from "./policy/redirect.js";
 export type OAuthUser = {
     id: string;
 };
@@ -16,6 +16,35 @@ export type RegisteredClient = {
     redirectUris: string[];
     tokenEndpointAuthMethod: TokenEndpointAuthMethod;
 };
+export type ConsentRequest = {
+    clientId: string;
+    registeredClient: RegisteredClient | null;
+    redirectUri: string;
+    scope: string[];
+    resource: string;
+    user: OAuthUser;
+    /** Embed this in your form's `consent_ticket` field (hidden input or POST body). */
+    ticket: string;
+    oauthPath: string;
+};
+export type ConsentOptions = {
+    /**
+     * Render the approval page yourself. Return any `Response` — HTML, or a
+     * redirect to your own route. Omit for the built-in hardened interstitial.
+     *
+     * If your page sets its own `Content-Security-Policy` with `form-action`,
+     * include `new URL(input.redirectUri).origin` in it — Chromium enforces
+     * `form-action` across the redirect your approval POST triggers, not just
+     * the immediate submission target, so `'self'` alone blocks the eventual
+     * redirect back to the client's own callback.
+     */
+    render?: (input: ConsentRequest) => Response | Promise<Response>;
+    /**
+     * Client ids that skip approval. Only honored when `clientStore` actually
+     * resolves the id — a DCR or self-invented id is never trusted.
+     */
+    preApprovedClientIds?: string[];
+};
 /**
  * The payload sealed into a `client_id` this server itself issued via
  * `/register` (see `sealed.ts`, type `"client"`). Zero storage: the id
@@ -23,6 +52,13 @@ export type RegisteredClient = {
  */
 export type ClientAssertion = {
     redirectUris: string[];
+    /**
+     * Unix seconds when `/register` sealed this assertion. Informational only
+     * — not enforced as an expiry — so it can help an operator judge how old
+     * a still-valid DCR client is. Optional on read: an assertion sealed
+     * before this field existed still unseals and works.
+     */
+    iat?: number;
 };
 export type ClientStore = {
     /** Resolve a pre-registered client, or null when unknown. */
@@ -66,6 +102,13 @@ export type RefreshAccessTokenInput = {
      * Implementations MUST reject refresh tokens not originally issued for this resource.
      */
     resource: string;
+    /**
+     * RFC 6749 §6 — optional scope reduction requested by the client.
+     * When set, the library validates against advertised `scopes` only.
+     * Implementations MUST also reject any scope outside what was originally
+     * granted to this refresh token (the library cannot see opaque RTs).
+     */
+    scope?: string;
 };
 export type RevokeTokenInput = {
     token: string;
@@ -88,8 +131,18 @@ export type OAuthAuditEntry = {
     reason: string;
 };
 export type OAuthPorts = {
-    /** HMAC secret for signing auth codes. */
-    codeSecret: string | ((req: Request) => string | Promise<string>);
+    /**
+     * Secret(s) that seal auth codes, consent tickets, and self-issued DCR
+     * client assertions (`sealed.ts`), and key `ClientStore.secretHash`.
+     *
+     * Pass a single string, or for key rotation an array: the **first** entry seals new material and hashes new client
+     * secrets; **every** entry is tried when unsealing/verifying, so material
+     * sealed under an older key keeps working until you drop it from the
+     * array. `ports.audit` sees a `"legacy_code_secret_used"` event whenever
+     * anything but the first entry was the one that actually verified,
+     * so you know when it's safe to remove.
+     */
+    codeSecret: string | string[] | ((req: Request) => string | string[] | Promise<string | string[]>);
     /** Resolve the logged-in user, or null → redirect to login. */
     resolveUser: (req: Request) => Promise<OAuthUser | null>;
     /** Where to send unauthenticated authorize requests. */
@@ -106,7 +159,7 @@ export type OAuthPorts = {
      * tokens not issued to `clientId` MUST no-op (not throw).
      */
     revokeToken?: ((input: RevokeTokenInput) => Promise<void>) | undefined;
-    /** Shared single-use jti store for multi-instance; in-memory default otherwise. */
+    /** Shared single-use jti store for multi-instance. Required unless `allowInMemoryCodeStore`. */
     codeStore?: CodeStore | undefined;
     /** Pre-registered clients. Required to serve confidential clients. */
     clientStore?: ClientStore | undefined;
@@ -118,14 +171,6 @@ export type OAuthPorts = {
      */
     audit?: ((entry: OAuthAuditEntry) => void | Promise<void>) | undefined;
 };
-/**
- * Invoke `ports.audit`, swallowing any failure — the OAuth-side twin of
- * `methods.ts`'s `safeAudit`. No timeout wrapper here: unlike the MCP
- * side, nothing here is expected to be a slow, request-scoped metrics
- * call in the same way, and adding one would be complexity without a
- * demonstrated need — revisit if that changes.
- */
-export declare const safeOAuthAudit: (options: OAuthRouterOptions, entry: OAuthAuditEntry) => Promise<void>;
 export type OAuthRouterOptions = {
     ports: OAuthPorts;
     resourcePath?: string;
@@ -169,44 +214,53 @@ export type OAuthRouterOptions = {
      * not under `ports`. Omit for the built-in hardened interstitial.
      */
     consent?: ConsentOptions;
+    /**
+     * Max time to wait for `ports.audit` before responding anyway. Default
+     * 1000ms — same guarantee as `McpHandlerOptions.auditTimeoutMs`.
+     */
+    auditTimeoutMs?: number;
+    /**
+     * Allow the process-local in-memory jti Map when `ports.codeStore` is
+     * omitted. Default **false** since 2.0 — multi-instance deploys silently
+     * double-redeem auth codes without a shared store. Set true only for
+     * single-process demos and tests.
+     */
+    allowInMemoryCodeStore?: boolean;
+    /**
+     * Resolve Client ID Metadata Documents (HTTPS URL `client_id`s).
+     * Default **false** — opt in with `cimd: true`. Off until connect-pinned
+     * fetch exists; see `cimd.ts` ponytail.
+     */
+    cimd?: boolean;
+    /**
+     * CIMD document cache (respects Cache-Control max-age, capped at 1 h).
+     * **Strongly recommended with `cimd: true`:** without it `/token` and
+     * `/revoke` re-fetch the client's document on every call, so a flaky
+     * document host fails refresh/revoke (audited as `cimd_resolve_failed`).
+     */
+    cimdCache?: CimdCache;
+    /** Optional DNS lookup for CIMD SSRF checks — see `CimdFetchOptions.lookup`. */
+    cimdLookup?: (hostname: string) => Promise<string[]>;
 };
-/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
-export declare const unregisteredClientsAllowed: (options: OAuthRouterOptions) => boolean;
-/** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
-export declare const registeredClientsRequired: (options: OAuthRouterOptions) => boolean;
-/** Scopes this AS advertises and is willing to grant. */
-export declare const advertisedScopes: (options: OAuthRouterOptions) => string[];
 /**
- * Scopes granted when a client omits `scope`. Falls back to the full
- * advertised set only when that set has at most one entry — see
- * `assertScopeConfig`, which forbids the ambiguous multi-scope case at
- * construction instead of silently over-granting here.
+ * `OAuthRouterOptions` after `createOAuthRouter` has resolved them: paths
+ * normalized and `ports.codeStore` always present, so no endpoint handler
+ * can fall back to a store of its own. Internal — not re-exported.
  */
-export declare const defaultScopes: (options: OAuthRouterOptions) => string[];
-/**
- * A multi-scope server MUST say what an omitted `scope` grants — the
- * alternative (silently granting everything advertised) is exactly the
- * escalation least-privilege scoping exists to prevent.
- */
-export declare const assertScopeConfig: (options: OAuthRouterOptions) => void;
-export declare const assertCodeSecret: (secret: string) => void;
-export declare const resolveSecret: (ports: OAuthPorts, req: Request) => Promise<string>;
+export type ResolvedOAuthRouterOptions = OAuthRouterOptions & {
+    resourcePath: string;
+    oauthPath: string;
+    ports: OAuthPorts & {
+        codeStore: CodeStore;
+    };
+};
 /**
  * An OAuth error's code and description without a `Response` built yet —
- * lets a caller choose delivery: `oauthError` below for a direct JSON
- * body, or a redirect to the client's own callback (RFC 6749 §4.1.2.1,
- * see `authorize.ts` and `consent.ts`).
+ * lets a caller choose delivery: `oauthError` for a direct JSON body, or a
+ * redirect to the client's own callback (RFC 6749 §4.1.2.1).
  */
 export type OAuthErrorInfo = {
     code: string;
     description: string;
 };
-export declare const oauthError: (error: string, status: number, description?: string) => Response;
-/** Direct JSON error when this AS does not serve unknown `client_id`s. */
-export declare const unregisteredClientError: (options: OAuthRouterOptions, reject: {
-    code: string;
-    status: number;
-}) => Response | null;
-/** `grantedScope` is what the auth code carried; the port may narrow it further. */
-export declare const tokenResponse: (minted: MintedToken, grantedScope?: string) => Response;
 //# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAiB,KAAK,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EACf,CAAC,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,GACjE,SAAS,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE,mFAAmF;IACnF,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GACzB,SAAS,kBAAkB,EAC3B,OAAO,eAAe,KACrB,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GAAI,SAAS,kBAAkB,KAAG,OAC7B,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,GAAI,SAAS,kBAAkB,KAAG,OAC5B,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,kBAAkB,KAAG,MAAM,EACd,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,IAY/D,CAAC;AAgBF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,IAajD,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,OAAO,UAAU,EAAE,KAAK,OAAO,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,QAM9E,CAAC;AAKJ,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAGb,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,aAAa,GAAI,QAAQ,WAAW,EAAE,eAAe,MAAM,KAAG,QAYxE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;OAUG;IACH,UAAU,EACN,MAAM,GACN,MAAM,EAAE,GACR,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EACf,CAAC,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,GACjE,SAAS,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE,gGAAgG;IAChG,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,gFAAgF;IAChF,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,kBAAkB,GAAG;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/oauth/types.js

@@ -1,91 +1,2 @@
-import { jsonResponse } from "../http.js";
-import { DEFAULT_SCOPE } from "./constants.js";
-/**
- * Invoke `ports.audit`, swallowing any failure — the OAuth-side twin of
- * `methods.ts`'s `safeAudit`. No timeout wrapper here: unlike the MCP
- * side, nothing here is expected to be a slow, request-scoped metrics
- * call in the same way, and adding one would be complexity without a
- * demonstrated need — revisit if that changes.
- */
-export const safeOAuthAudit = async (options, entry) => {
-    try {
-        await options.ports.audit?.(entry);
-    }
-    catch {
-        // Intentionally ignored.
-    }
-};
-/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
-export const unregisteredClientsAllowed = (options) => options.allowUnregisteredClients !== false;
-/** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
-export const registeredClientsRequired = (options) => options.requireRegisteredClients !== false;
-/** Scopes this AS advertises and is willing to grant. */
-export const advertisedScopes = (options) => options.scopes ?? [DEFAULT_SCOPE];
-/**
- * Scopes granted when a client omits `scope`. Falls back to the full
- * advertised set only when that set has at most one entry — see
- * `assertScopeConfig`, which forbids the ambiguous multi-scope case at
- * construction instead of silently over-granting here.
- */
-export const defaultScopes = (options) => options.defaultScopes ?? advertisedScopes(options);
-/**
- * A multi-scope server MUST say what an omitted `scope` grants — the
- * alternative (silently granting everything advertised) is exactly the
- * escalation least-privilege scoping exists to prevent.
- */
-export const assertScopeConfig = (options) => {
-    const advertised = advertisedScopes(options);
-    if (advertised.length > 1 && !options.defaultScopes) {
-        throw new Error("scopes has more than one entry — defaultScopes must say what an omitted " +
-            "scope request grants (e.g. defaultScopes: [] for least privilege)");
-    }
-    const unknown = (options.defaultScopes ?? []).find((scope) => !advertised.includes(scope));
-    if (unknown !== undefined) {
-        throw new Error(`defaultScopes contains "${unknown}", which is not in scopes`);
-    }
-};
-/**
- * `codeSecret` can forge an auth code for any userId/scope/resource, so a
- * weak or copy-pasted one is a full authorization bypass, not a footgun.
- * The literals here are the exact strings this package's own docs/examples
- * publish — copy-paste is the realistic failure mode.
- */
-const MIN_CODE_SECRET_LENGTH = 32;
-const DENYLISTED_CODE_SECRETS = new Set([
-    "e2e-code-secret-value",
-    "change-me",
-    "test-secret-value",
-]);
-const GENERATE_HINT = "generate one with `openssl rand -base64 32`";
-export const assertCodeSecret = (secret) => {
-    // Checked before the length rule so a denylisted literal is always named
-    // for what it is, even if a future literal happens to be 32+ characters.
-    if (DENYLISTED_CODE_SECRETS.has(secret)) {
-        throw new Error(`codeSecret must not be a literal published in this package's own docs or examples — ${GENERATE_HINT}`);
-    }
-    if (secret.length < MIN_CODE_SECRET_LENGTH) {
-        throw new Error(`codeSecret must be at least ${MIN_CODE_SECRET_LENGTH} characters (got ${secret.length}) — ${GENERATE_HINT}`);
-    }
-};
-export const resolveSecret = async (ports, req) => {
-    const secret = typeof ports.codeSecret === "string" ? ports.codeSecret : await ports.codeSecret(req);
-    assertCodeSecret(secret);
-    return secret;
-};
-export const oauthError = (error, status, description) => jsonResponse(description ? { error, error_description: description } : { error }, status, undefined, { cors: false });
-const UNREGISTERED_CLIENT_DESCRIPTION = "unknown client_id — this server only serves pre-registered clients";
-/** Direct JSON error when this AS does not serve unknown `client_id`s. */
-export const unregisteredClientError = (options, reject) => {
-    if (unregisteredClientsAllowed(options))
-        return null;
-    return oauthError(reject.code, reject.status, UNREGISTERED_CLIENT_DESCRIPTION);
-};
-/** `grantedScope` is what the auth code carried; the port may narrow it further. */
-export const tokenResponse = (minted, grantedScope) => jsonResponse({
-    access_token: minted.accessToken,
-    token_type: minted.tokenType ?? "bearer",
-    expires_in: minted.expiresIn,
-    scope: minted.scope ?? grantedScope ?? DEFAULT_SCOPE,
-    ...(minted.refreshToken ? { refresh_token: minted.refreshToken } : {}),
-}, 200, undefined, { cors: false });
+export {};
 //# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1C,OAAO,EAAE,aAAa,EAAgC,MAAM,gBAAgB,CAAC;AAiI7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAA2B,EAC3B,KAAsB,EACP,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC,CAAC;AA+CF,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAA2B,EAAW,EAAE,CACjF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAA2B,EAAW,EAAE,CAChF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA2B,EAAY,EAAE,CACxE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA2B,EAAY,EAAE,CACrE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IACrE,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,2BAA2B,CAAC,CAAC;IACjF,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,uBAAuB;IACvB,WAAW;IACX,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,6CAA6C,CAAC;AAEpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAQ,EAAE;IACvD,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,uFAAuF,aAAa,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,+BAA+B,sBAAsB,oBAAoB,MAAM,CAAC,MAAM,OAAO,aAAa,EAAE,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,KAAiB,EAAE,GAAY,EAAmB,EAAE;IACtF,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxF,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,WAAoB,EAAY,EAAE,CAC1F,YAAY,CACV,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACnE,MAAM,EACN,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AAEJ,MAAM,+BAA+B,GACnC,oEAAoE,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,MAAwC,EACvB,EAAE;IACnB,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAE,YAAqB,EAAY,EAAE,CACpF,YAAY,CACV;IACE,YAAY,EAAE,MAAM,CAAC,WAAW;IAChC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;IACxC,UAAU,EAAE,MAAM,CAAC,SAAS;IAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY,IAAI,aAAa;IACpD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACvE,EACD,GAAG,EACH,SAAS,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":""}