mcp-trellis 1.0.0 → 2.2.0

package/dist/oauth/clientauth.js

@@ -1,119 +0,0 @@
-/** Token-endpoint client authentication (RFC 6749 §2.3.1). */
-import { OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "./constants.js";
-import { verifyClientSecret } from "./secrethash.js";
-import { oauthError, resolveSecret, safeOAuthAudit, unregisteredClientsAllowed, } from "./types.js";
-/** `Authorization: Basic base64(urlencode(id):urlencode(secret))`. */
-const parseBasicAuth = (header) => {
-    if (!header?.startsWith("Basic "))
-        return null;
-    try {
-        const decoded = atob(header.slice("Basic ".length).trim());
-        const separator = decoded.indexOf(":");
-        if (separator < 0)
-            return null;
-        const clientId = decodeURIComponent(decoded.slice(0, separator));
-        if (!clientId)
-            return null;
-        return {
-            clientId,
-            secret: decodeURIComponent(decoded.slice(separator + 1)),
-            method: TOKEN_ENDPOINT_AUTH_METHODS.basic,
-        };
-    }
-    catch {
-        return null;
-    }
-};
-/** Credentials from the Authorization header, else from the body. */
-export const readClientAuth = (request, body) => {
-    const basic = parseBasicAuth(request.headers.get("Authorization"));
-    if (basic)
-        return basic;
-    const clientId = body.client_id ?? "";
-    if (!clientId)
-        return null;
-    const secret = body.client_secret ?? "";
-    return {
-        clientId,
-        secret: secret.length > 0 ? secret : null,
-        method: secret.length > 0 ? TOKEN_ENDPOINT_AUTH_METHODS.post : TOKEN_ENDPOINT_AUTH_METHODS.none,
-    };
-};
-/**
- * Every failure below returns the same code, status, and description.
- * Distinguishable messages here ("client requires client_secret_basic" vs.
- * "unknown client_id" vs. "client_secret required" vs. …) let an
- * unauthenticated caller enumerate which client_ids this server actually
- * knows about and how each is configured, just by reading error text —
- * a real information leak on the one endpoint whose entire job is to
- * reject an untrusted caller. `/authorize`'s `unauthorized_client` stays
- * descriptive on purpose: it's a human debugging an OAuth flow in a
- * browser, not a bare API response, and a locked-down server already
- * announces the same fact by omitting `registration_endpoint` from its
- * metadata.
- */
-const CLIENT_AUTH_FAILED = "client authentication failed";
-/** The generic response every failure below returns to the caller. */
-const invalidClient = () => oauthError(OAUTH_ERRORS.invalidClient, 401, CLIENT_AUTH_FAILED);
-/** The response above, plus the real reason to `ports.audit` — never to the caller. */
-const invalidClientAudited = async (options, clientId, reason) => {
-    await safeOAuthAudit(options, { event: "client_auth_failed", clientId, reason });
-    return invalidClient();
-};
-/**
- * Never a real credential — exists only so the locked-down branch below
- * does the same amount of comparison work whether or not a secret was
- * actually presented, and whether or not a stored hash actually exists.
- */
-const DUMMY_SECRET = "dummy-secret-for-constant-time-padding";
-const DUMMY_STORED_HASH = "hmac-sha256$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-/**
- * Enforce the registered auth method for known clients.
- *
- * An unknown client_id is treated as public — PKCE is its only proof —
- * unless `allowUnregisteredClients` is false, in which case it is rejected
- * rather than silently falling back to "no auth required". On that
- * locked-down path, a dummy secret comparison runs even for a client_id
- * this server has never heard of, so the crypto-verification cost can't be
- * used to distinguish "unknown" from "known, wrong secret" by timing. This
- * only runs on the non-default, already-more-expensive path — public
- * clients (the common case) never pay it.
- */
-export const firstClientAuthError = async (auth, options, request) => {
-    const store = options.ports.clientStore;
-    const registered = (await store?.get(auth.clientId)) ?? null;
-    if (!registered) {
-        if (unregisteredClientsAllowed(options))
-            return null;
-        const codeSecretValue = await resolveSecret(options.ports, request);
-        await verifyClientSecret(auth.secret ?? DUMMY_SECRET, DUMMY_STORED_HASH, codeSecretValue);
-        return invalidClientAudited(options, auth.clientId, "unknown client_id");
-    }
-    const expected = registered.tokenEndpointAuthMethod;
-    if (expected === TOKEN_ENDPOINT_AUTH_METHODS.none)
-        return null;
-    if (auth.method !== expected) {
-        return invalidClientAudited(options, auth.clientId, `client requires ${expected}, got ${auth.method}`);
-    }
-    if (!auth.secret) {
-        return invalidClientAudited(options, auth.clientId, "client_secret required");
-    }
-    if (store?.secretHash) {
-        const codeSecretValue = await resolveSecret(options.ports, request);
-        const stored = await store.secretHash(auth.clientId);
-        // Constant path whether a hash is on file or not — same reasoning as
-        // the unregistered-client branch above.
-        const ok = await verifyClientSecret(auth.secret, stored ?? DUMMY_STORED_HASH, codeSecretValue);
-        if (ok && stored !== null)
-            return null;
-        return invalidClientAudited(options, auth.clientId, stored === null ? "no secretHash on file for this client" : "secretHash mismatch");
-    }
-    if (!store?.verifySecret) {
-        return invalidClientAudited(options, auth.clientId, "clientStore.verifySecret is not configured");
-    }
-    if (!(await store.verifySecret(auth.clientId, auth.secret))) {
-        return invalidClientAudited(options, auth.clientId, "verifySecret returned false");
-    }
-    return null;
-};
-//# sourceMappingURL=clientauth.js.map

package/dist/oauth/clientauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"clientauth.js","sourceRoot":"","sources":["../../src/oauth/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EACL,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAEL,UAAU,EACV,aAAa,EACb,cAAc,EACd,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAQpB,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAqB,EAAE;IAClE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE,2BAA2B,CAAC,KAAK;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAgB,EAChB,IAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI;KAChG,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAE1D,sEAAsE;AACtE,MAAM,aAAa,GAAG,GAAa,EAAE,CACnC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;AAElE,uFAAuF;AACvF,MAAM,oBAAoB,GAAG,KAAK,EAChC,OAA2B,EAC3B,QAAgB,EAChB,MAAc,EACK,EAAE;IACrB,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAA2B,EAC3B,OAAgB,EACU,EAAE;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,MAAM,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAE7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,0BAA0B,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,IAAI,YAAY,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;QAC1F,OAAO,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,IAAI,QAAQ,KAAK,2BAA2B,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,oBAAoB,CACzB,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,mBAAmB,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,KAAK,EAAE,UAAU,EAAE,CAAC;QACtB,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,qEAAqE;QACrE,wCAAwC;QACxC,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,iBAAiB,EAAE,eAAe,CAAC,CAAC;QAC/F,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,oBAAoB,CACzB,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,qBAAqB,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/oauth/codes.d.ts

@@ -1,30 +0,0 @@
-export type AuthCodeRecord = {
-    clientId: string;
-    redirectUri: string;
-    codeChallenge: string;
-    /** Consenting user id — required so minted tokens are bound. */
-    userId: string;
-    /** RFC 8707 resource indicator — audience for the eventual access token. */
-    resource: string;
-    /** Space-delimited scope granted at authorize time. */
-    scope: string;
-    exp: number;
-};
-export type CodeStore = {
-    /**
-     * Mark a code jti as consumed; return false if already used.
-     * `expMs` is the code expiry (ms since epoch) for TTL-backed stores.
-     */
-    consume: (jti: string, expMs: number) => Promise<boolean> | boolean;
-};
-/**
- * Issue an AES-GCM sealed auth code (v2). Single-use via codeStore, or
- * pruning in-memory Map when omitted.
- */
-export declare const issueAuthCode: (secret: string, record: Omit<AuthCodeRecord, "exp">, nowMs?: number) => Promise<string>;
-export declare const consumeAuthCode: (secret: string, code: string, options?: {
-    codeStore?: CodeStore | undefined;
-    nowMs?: number | undefined;
-}) => Promise<AuthCodeRecord | null>;
-export declare const newClientId: () => string;
-//# sourceMappingURL=codes.d.ts.map

package/dist/oauth/codes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../src/oauth/codes.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACrE,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,EACd,QAAQ,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EACnC,cAAkB,KACjB,OAAO,CAAC,MAAM,CAOhB,CAAC;AAmCF,eAAO,MAAM,eAAe,GAC1B,QAAQ,MAAM,EACd,MAAM,MAAM,EACZ,UAAS;IAAE,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,KAC9E,OAAO,CAAC,cAAc,GAAG,IAAI,CAkB/B,CAAC;AAEF,eAAO,MAAM,WAAW,QAAO,MAA6B,CAAC"}

package/dist/oauth/codes.js

@@ -1,85 +0,0 @@
-import { randomBase64Url } from "./pkce.js";
-import { seal, unseal } from "./sealed.js";
-const CODE_TTL_MS = 600_000;
-/** AES-GCM sealed auth codes — authenticated and encrypted (see `sealed.ts`). */
-const SEALED_PREFIX = "v2.";
-/**
- * Process-local jti → expMs map when no shared codeStore is provided.
- * ponytail: single-process only; multi-instance → pass ports.codeStore (KV/Redis SET NX EX).
- */
-const memoryUsed = new Map();
-const pruneMemory = (nowMs) => {
-    [...memoryUsed].forEach(([jti, exp]) => {
-        if (exp < nowMs)
-            memoryUsed.delete(jti);
-    });
-};
-const memoryCodeStore = {
-    consume: (jti, expMs) => {
-        const nowMs = Date.now();
-        pruneMemory(nowMs);
-        if (memoryUsed.has(jti))
-            return false;
-        memoryUsed.set(jti, expMs);
-        return true;
-    },
-};
-/**
- * Issue an AES-GCM sealed auth code (v2). Single-use via codeStore, or
- * pruning in-memory Map when omitted.
- */
-export const issueAuthCode = async (secret, record, nowMs = Date.now()) => {
-    const body = {
-        ...record,
-        exp: nowMs + CODE_TTL_MS,
-        jti: randomBase64Url(12),
-    };
-    return `${SEALED_PREFIX}${await seal(secret, "code", body)}`;
-};
-const shapeCheckedRecord = (data, nowMs) => {
-    if (typeof data.clientId !== "string" ||
-        typeof data.redirectUri !== "string" ||
-        typeof data.codeChallenge !== "string" ||
-        typeof data.userId !== "string" ||
-        typeof data.resource !== "string" ||
-        data.resource.length === 0 ||
-        typeof data.scope !== "string" ||
-        typeof data.exp !== "number" ||
-        data.exp < nowMs ||
-        typeof data.jti !== "string" ||
-        data.jti.length === 0) {
-        return null;
-    }
-    return {
-        clientId: data.clientId,
-        redirectUri: data.redirectUri,
-        codeChallenge: data.codeChallenge,
-        userId: data.userId,
-        resource: data.resource,
-        scope: data.scope,
-        exp: data.exp,
-        jti: data.jti,
-    };
-};
-export const consumeAuthCode = async (secret, code, options = {}) => {
-    if (!code || !secret)
-        return null;
-    // 1.0 dropped v1 (HMAC-only) reading — only `v2.` sealed codes redeem.
-    if (!code.startsWith(SEALED_PREFIX))
-        return null;
-    const nowMs = options.nowMs ?? Date.now();
-    const raw = await unseal(secret, "code", code.slice(SEALED_PREFIX.length));
-    if (!raw)
-        return null;
-    const record = shapeCheckedRecord(raw, nowMs);
-    if (!record)
-        return null;
-    const store = options.codeStore ?? memoryCodeStore;
-    const fresh = await store.consume(record.jti, record.exp);
-    if (!fresh)
-        return null;
-    const { jti: _jti, ...rest } = record;
-    return rest;
-};
-export const newClientId = () => randomBase64Url(16);
-//# sourceMappingURL=codes.js.map

package/dist/oauth/codes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/oauth/codes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,iFAAiF;AACjF,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAuB7C,MAAM,WAAW,GAAG,CAAC,KAAa,EAAQ,EAAE;IAC1C,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE;QACrC,IAAI,GAAG,GAAG,KAAK;YAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAc;IACjC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAc,EACd,MAAmC,EACnC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EACD,EAAE;IACnB,MAAM,IAAI,GAAqC;QAC7C,GAAG,MAAM;QACT,GAAG,EAAE,KAAK,GAAG,WAAW;QACxB,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;KACzB,CAAC;IACF,OAAO,GAAG,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AAIF,MAAM,kBAAkB,GAAG,CACzB,IAAiB,EACjB,KAAa,EAC8B,EAAE;IAC7C,IACE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QACtC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAC5B,IAAI,CAAC,GAAG,GAAG,KAAK;QAChB,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EACrB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAc,EACd,IAAY,EACZ,UAA6E,EAAE,EAC/C,EAAE;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,uEAAuE;IACvE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAc,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC"}

package/dist/oauth/consent.d.ts

@@ -1,65 +0,0 @@
-/**
- * The consent step between a resolved user and code issuance (RFC 6749
- * §4.1.1 "the resource owner grants or denies the ... request").
- *
- * `/authorize` seals everything the eventual `/consent` POST needs into an
- * opaque, single-use ticket — the ticket carries `clientId`, `redirectUri`,
- * `codeChallenge`, `resource`, and `scope` from the *validated* request, so
- * `handleConsent` trusts nothing from the POST body except which ticket and
- * whether the user approved it. Nothing else in that body is read.
- */
-import type { OAuthUser, RegisteredClient } from "./types.js";
-import { type OAuthRouterOptions } from "./types.js";
-export type ConsentRequest = {
-    clientId: string;
-    registeredClient: RegisteredClient | null;
-    redirectUri: string;
-    scope: string[];
-    resource: string;
-    user: OAuthUser;
-    /** Embed this in your form's `consent_ticket` field (hidden input or POST body). */
-    ticket: string;
-    oauthPath: string;
-};
-export type ConsentOptions = {
-    /**
-     * Render the approval page yourself. Return any `Response` — HTML, or a
-     * redirect to your own route. Omit for the built-in hardened interstitial.
-     */
-    render?: (input: ConsentRequest) => Response | Promise<Response>;
-    /**
-     * Client ids that skip approval. Only honored when `clientStore` actually
-     * resolves the id — a DCR or self-invented id is never trusted.
-     */
-    preApprovedClientIds?: string[];
-};
-type ConsentTicketPayload = {
-    clientId: string;
-    redirectUri: string;
-    codeChallenge: string;
-    userId: string;
-    resource: string;
-    scope: string;
-    state: string;
-    exp: number;
-    jti: string;
-};
-export declare const secureRedirect: (location: string) => Response;
-export declare const buildCodeRedirectUrl: (redirectUri: string, code: string, state: string) => string;
-/**
- * RFC 6749 §4.1.2.1 — once `redirect_uri` is trusted, every authorize-time
- * error goes back to the client's own callback, not a bare JSON body the
- * connector never parses. Shared by consent denial (`buildDeniedRedirectUrl`
- * below) and every post-redirect-trust check in `authorize.ts`
- * (`unsupported_response_type`, PKCE, `invalid_scope`, `invalid_target`, …).
- */
-export declare const buildErrorRedirectUrl: (redirectUri: string, error: string, description: string, state: string) => string;
-/** RFC 6749 §4.1.2.1 — denial goes back to the callback, not a bare JSON error. */
-export declare const buildDeniedRedirectUrl: (redirectUri: string, state: string) => string;
-export declare const issueConsentTicket: (secret: string, payload: Omit<ConsentTicketPayload, "exp" | "jti">) => Promise<string>;
-export declare const renderConsent: (options: OAuthRouterOptions, input: ConsentRequest) => Promise<Response>;
-/** Only honored when `clientStore` actually resolves the id — never a self-invented one. */
-export declare const isPreApproved: (options: OAuthRouterOptions, clientId: string, registered: RegisteredClient | null) => boolean;
-export declare const handleConsent: (request: Request, options: OAuthRouterOptions) => Promise<Response>;
-export {};
-//# sourceMappingURL=consent.d.ts.map

package/dist/oauth/consent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/oauth/consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,KAAK,kBAAkB,EAA6B,MAAM,YAAY,CAAC;AAKhF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAgBF,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,KAAG,QAQ9C,CAAC;AAEL,eAAO,MAAM,oBAAoB,GAAI,aAAa,MAAM,EAAE,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,MAKvF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAChC,aAAa,MAAM,EACnB,OAAO,MAAM,EACb,aAAa,MAAM,EACnB,OAAO,MAAM,KACZ,MAMF,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,GAAI,aAAa,MAAM,EAAE,OAAO,MAAM,KAAG,MACF,CAAC;AAE3E,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,SAAS,IAAI,CAAC,oBAAoB,EAAE,KAAK,GAAG,KAAK,CAAC,KACjD,OAAO,CAAC,MAAM,CAKkB,CAAC;AAwDpC,eAAO,MAAM,aAAa,GACxB,SAAS,kBAAkB,EAC3B,OAAO,cAAc,KACpB,OAAO,CAAC,QAAQ,CAA6D,CAAC;AAEjF,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GACxB,SAAS,kBAAkB,EAC3B,UAAU,MAAM,EAChB,YAAY,gBAAgB,GAAG,IAAI,KAClC,OAC0F,CAAC;AAE9F,eAAO,MAAM,aAAa,GACxB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CA2DlB,CAAC"}

package/dist/oauth/consent.js

@@ -1,173 +0,0 @@
-/**
- * The consent step between a resolved user and code issuance (RFC 6749
- * §4.1.1 "the resource owner grants or denies the ... request").
- *
- * `/authorize` seals everything the eventual `/consent` POST needs into an
- * opaque, single-use ticket — the ticket carries `clientId`, `redirectUri`,
- * `codeChallenge`, `resource`, and `scope` from the *validated* request, so
- * `handleConsent` trusts nothing from the POST body except which ticket and
- * whether the user approved it. Nothing else in that body is read.
- */
-import { BodyTooLargeError } from "../body.js";
-import { requireHttpMethod } from "../http.js";
-import { issueAuthCode } from "./codes.js";
-import { OAUTH_ERRORS } from "./constants.js";
-import { readOAuthBody } from "./reqbody.js";
-import { seal, unseal } from "./sealed.js";
-import { oauthError, resolveSecret } from "./types.js";
-const POST_ONLY = new Set(["POST"]);
-const CONSENT_TICKET_TTL_MS = 300_000;
-/** In-memory single-use map, mirroring `codes.ts`'s default when no `codeStore` is configured. */
-const memoryConsumed = new Map();
-const memoryConsentStore = {
-    consume: (jti, expMs) => {
-        const now = Date.now();
-        for (const [key, exp] of memoryConsumed) {
-            if (exp < now)
-                memoryConsumed.delete(key);
-        }
-        if (memoryConsumed.has(jti))
-            return false;
-        memoryConsumed.set(jti, expMs);
-        return true;
-    },
-};
-export const secureRedirect = (location) => new Response(null, {
-    status: 302,
-    headers: {
-        Location: location,
-        "Referrer-Policy": "no-referrer",
-        "Cache-Control": "no-store",
-    },
-});
-export const buildCodeRedirectUrl = (redirectUri, code, state) => {
-    const target = new URL(redirectUri);
-    target.searchParams.set("code", code);
-    if (state)
-        target.searchParams.set("state", state);
-    return target.toString();
-};
-/**
- * RFC 6749 §4.1.2.1 — once `redirect_uri` is trusted, every authorize-time
- * error goes back to the client's own callback, not a bare JSON body the
- * connector never parses. Shared by consent denial (`buildDeniedRedirectUrl`
- * below) and every post-redirect-trust check in `authorize.ts`
- * (`unsupported_response_type`, PKCE, `invalid_scope`, `invalid_target`, …).
- */
-export const buildErrorRedirectUrl = (redirectUri, error, description, state) => {
-    const target = new URL(redirectUri);
-    target.searchParams.set("error", error);
-    if (description)
-        target.searchParams.set("error_description", description);
-    if (state)
-        target.searchParams.set("state", state);
-    return target.toString();
-};
-/** RFC 6749 §4.1.2.1 — denial goes back to the callback, not a bare JSON error. */
-export const buildDeniedRedirectUrl = (redirectUri, state) => buildErrorRedirectUrl(redirectUri, OAUTH_ERRORS.accessDenied, "", state);
-export const issueConsentTicket = (secret, payload) => seal(secret, "consent", {
-    ...payload,
-    exp: Date.now() + CONSENT_TICKET_TTL_MS,
-    jti: crypto.randomUUID(),
-});
-const ESCAPE_HTML = {
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-    '"': "&quot;",
-    "'": "&#39;",
-};
-const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ESCAPE_HTML[ch] ?? ch);
-const CONSENT_SECURITY_HEADERS = {
-    "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'",
-    "X-Frame-Options": "DENY",
-    "Referrer-Policy": "no-referrer",
-    "Cache-Control": "no-store",
-};
-/** Built-in hardened interstitial — used whenever the host doesn't supply `consent.render`. */
-const renderBuiltInConsent = (input) => {
-    const html = `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<title>Authorize access</title>
-<style>
-  body { font: 16px system-ui, sans-serif; max-width: 32rem; margin: 3rem auto; padding: 0 1rem; }
-  dl { display: grid; grid-template-columns: auto 1fr; gap: 0.25rem 1rem; }
-  dt { font-weight: 600; }
-  button { font-size: 1rem; padding: 0.5rem 1.25rem; margin-right: 0.5rem; }
-</style>
-</head>
-<body>
-<h1>Authorize access</h1>
-<p><strong>${escapeHtml(input.clientId)}</strong> is requesting access to your account.</p>
-<dl>
-  <dt>Redirect URI</dt><dd>${escapeHtml(input.redirectUri)}</dd>
-  <dt>Scope</dt><dd>${escapeHtml(input.scope.join(" ") || "(none)")}</dd>
-  <dt>Resource</dt><dd>${escapeHtml(input.resource)}</dd>
-</dl>
-<form method="POST" action="${escapeHtml(input.oauthPath)}/consent">
-  <input type="hidden" name="consent_ticket" value="${escapeHtml(input.ticket)}">
-  <button type="submit" name="approved" value="true">Allow</button>
-  <button type="submit" name="approved" value="false">Deny</button>
-</form>
-</body>
-</html>`;
-    return new Response(html, {
-        status: 200,
-        headers: { "Content-Type": "text/html; charset=utf-8", ...CONSENT_SECURITY_HEADERS },
-    });
-};
-export const renderConsent = async (options, input) => (options.consent?.render ?? renderBuiltInConsent)(input);
-/** Only honored when `clientStore` actually resolves the id — never a self-invented one. */
-export const isPreApproved = (options, clientId, registered) => Boolean(registered) && (options.consent?.preApprovedClientIds?.includes(clientId) ?? false);
-export const handleConsent = async (request, options) => {
-    const methodError = requireHttpMethod(request, POST_ONLY, { cors: false });
-    if (methodError)
-        return methodError;
-    let body;
-    try {
-        body = await readOAuthBody(request);
-    }
-    catch (exc) {
-        if (exc instanceof BodyTooLargeError) {
-            return oauthError(OAUTH_ERRORS.invalidRequest, 413, "request body too large");
-        }
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "malformed request body");
-    }
-    const ticket = body.consent_ticket ?? "";
-    if (!ticket) {
-        return oauthError(OAUTH_ERRORS.invalidRequest, 400, "consent_ticket required");
-    }
-    const secret = await resolveSecret(options.ports, request);
-    const payload = await unseal(secret, "consent", ticket);
-    if (!payload ||
-        typeof payload.exp !== "number" ||
-        payload.exp < Date.now() ||
-        typeof payload.jti !== "string" ||
-        !payload.jti) {
-        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "invalid or expired consent_ticket");
-    }
-    const store = options.ports.codeStore ?? memoryConsentStore;
-    const fresh = await store.consume(`ct:${payload.jti}`, payload.exp);
-    if (!fresh) {
-        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "consent_ticket already used");
-    }
-    const user = await options.ports.resolveUser(request);
-    if (!user || user.id !== payload.userId) {
-        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "consent_ticket does not match the current user");
-    }
-    if (body.approved !== "true") {
-        return secureRedirect(buildDeniedRedirectUrl(payload.redirectUri, payload.state));
-    }
-    const code = await issueAuthCode(secret, {
-        clientId: payload.clientId,
-        redirectUri: payload.redirectUri,
-        codeChallenge: payload.codeChallenge,
-        userId: user.id,
-        resource: payload.resource,
-        scope: payload.scope,
-    });
-    return secureRedirect(buildCodeRedirectUrl(payload.redirectUri, code, payload.state));
-};
-//# sourceMappingURL=consent.js.map

package/dist/oauth/consent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/oauth/consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAA2B,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAuCtC,kGAAkG;AAClG,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;AACjD,MAAM,kBAAkB,GAAG;IACzB,OAAO,EAAE,CAAC,GAAW,EAAE,KAAa,EAAW,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;YACxC,IAAI,GAAG,GAAG,GAAG;gBAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAY,EAAE,CAC3D,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ;QAClB,iBAAiB,EAAE,aAAa;QAChC,eAAe,EAAE,UAAU;KAC5B;CACF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,WAAmB,EAAE,IAAY,EAAE,KAAa,EAAU,EAAE;IAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,WAAmB,EACnB,KAAa,EACb,WAAmB,EACnB,KAAa,EACL,EAAE;IACV,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,WAAW;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAC3E,IAAI,KAAK;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,WAAmB,EAAE,KAAa,EAAU,EAAE,CACnF,qBAAqB,CAAC,WAAW,EAAE,YAAY,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,OAAkD,EACjC,EAAE,CACnB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE;IACtB,GAAG,OAAO;IACV,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;IACvC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;CACM,CAAC,CAAC;AAEpC,MAAM,WAAW,GAA2B;IAC1C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3D,MAAM,wBAAwB,GAA2B;IACvD,yBAAyB,EACvB,2FAA2F;IAC7F,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC;AAEF,+FAA+F;AAC/F,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAY,EAAE;IAC/D,MAAM,IAAI,GAAG;;;;;;;;;;;;;;aAcF,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;6BAEV,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;sBACpC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;yBAC1C,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;8BAErB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;sDACH,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;;;;;QAKtE,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,GAAG,wBAAwB,EAAE;KACrF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,OAA2B,EAC3B,KAAqB,EACF,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC;AAEjF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAA2B,EAC3B,QAAgB,EAChB,UAAmC,EAC1B,EAAE,CACX,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAuB,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9E,IACE,CAAC,OAAO;QACR,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACxB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,OAAO,CAAC,GAAG,EACZ,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,UAAU,CACf,YAAY,CAAC,YAAY,EACzB,GAAG,EACH,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,cAAc,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;QACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC"}

package/dist/oauth/metadata.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,uBAAuB,EAAE,CAAC;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,4BAA4B,EAAE,OAAO,CAAC;IACtC,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0CAA0C,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uDAAuD;IACvD,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,GAAG,SAAS,CAAC;IACjE,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAAI,SAAS,eAAe,KAAG,yBAKnE,CAAC;AAEH,eAAO,MAAM,2BAA2B,GACtC,SAAS,eAAe,KACvB,2BAyBF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,qBAAoC,EACpC,cAAa,KACZ,MAC2G,CAAC"}

package/dist/oauth/metadata.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAEb,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AA8CzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAwB,EAA6B,EAAE,CAAC,CAAC;IACjG,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;IACjE,qBAAqB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAAwB,EACK,EAAE;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI;QACnE,2BAA2B,CAAC,IAAI;KACjC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,YAAY;QACjE,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ;QACrD,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,WAAW,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC;gBACE,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,SAAS;gBAC3D,0CAA0C,EAAE,wBAAwB;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QAC9C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,wBAAwB;QAC/D,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;QACnD,4BAA4B,EAAE,IAAI;KACnC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,YAAY,GAAG,qBAAqB,EACpC,KAAK,GAAG,KAAK,EACL,EAAE,CACV,iBAAiB,KAAK,yBAAyB,MAAM,wCAAwC,YAAY,GAAG,CAAC"}

package/dist/oauth/pkce.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAGnE,CAAC;AAEF,eAAO,MAAM,cAAc,GAAU,UAAU,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CAIzF,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,KAAG,MAGjD,CAAC"}

package/dist/oauth/pkce.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAmB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,SAAiB,EAAoB,EAAE;IAC5F,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC,CAAC"}

package/dist/oauth/redirect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/oauth/redirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4CAA4C,CAAC;AAEzE,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAuCF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,EACX,UAAS,wBAA6B,KACrC,OAGF,CAAC"}

package/dist/oauth/redirect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../src/oauth/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAkBzE,MAAM,gBAAgB,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC;AAE3D,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAElG;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAwB,CAAC,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAEpG,8FAA8F;AAC9F,MAAM,4BAA4B,GAAG,CAAC,GAAW,EAAW,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAW,EACX,UAAoC,EAAE,EAC7B,EAAE;IACX,IAAI,4BAA4B,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}

package/dist/oauth/reqbody.d.ts

@@ -1,10 +0,0 @@
-/**
- * Shared JSON/form body reader for `/token` and `/revoke`. `/token` has
- * always accepted both; `/revoke` used to parse form-only, so a client that
- * revoked with `Content-Type: application/json` (matching how it likely
- * called `/token`) got a silent `invalid_request "token required"` — the
- * caller believes the token is dead when the request was never understood.
- */
-/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
-export declare const readOAuthBody: (request: Request) => Promise<Record<string, string>>;
-//# sourceMappingURL=reqbody.d.ts.map

package/dist/oauth/reqbody.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reqbody.d.ts","sourceRoot":"","sources":["../../src/oauth/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH,uFAAuF;AACvF,eAAO,MAAM,aAAa,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGpF,CAAC"}

package/dist/oauth/reqbody.js

@@ -1,29 +0,0 @@
-/**
- * Shared JSON/form body reader for `/token` and `/revoke`. `/token` has
- * always accepted both; `/revoke` used to parse form-only, so a client that
- * revoked with `Content-Type: application/json` (matching how it likely
- * called `/token`) got a silent `invalid_request "token required"` — the
- * caller believes the token is dead when the request was never understood.
- */
-import { DEFAULT_OAUTH_BODY_LIMIT, readBoundedText } from "../body.js";
-const readJsonBody = async (request) => {
-    const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
-    const body = JSON.parse(text);
-    if (!body || typeof body !== "object" || Array.isArray(body)) {
-        throw new Error("malformed request body");
-    }
-    return Object.fromEntries(Object.entries(body)
-        .filter(([, value]) => value != null)
-        .map(([key, value]) => [key, String(value)]));
-};
-const readFormBody = async (request) => {
-    const text = await readBoundedText(request, DEFAULT_OAUTH_BODY_LIMIT);
-    const params = new URLSearchParams(text);
-    return Object.fromEntries([...params.entries()]);
-};
-/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
-export const readOAuthBody = async (request) => {
-    const ctype = request.headers.get("Content-Type") ?? "";
-    return ctype.includes("application/json") ? readJsonBody(request) : readFormBody(request);
-};
-//# sourceMappingURL=reqbody.js.map

package/dist/oauth/reqbody.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"reqbody.js","sourceRoot":"","sources":["../../src/oauth/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEvE,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC,CAAC"}

package/dist/oauth/resource.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAGxD,OAAO,EAAE,KAAK,cAAc,EAAc,MAAM,YAAY,CAAC;AAE7D,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,MAAM,MAAM,KAAG,MACA,CAAC;AAExD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,EAAE,qBAAoC,KAAG,MAIxF,CAAC;AAmBF,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,OAGpE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,cAAc,GAAG,IAQxF,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,QAAQ,GAAG,IAGnF,CAAC"}

package/dist/oauth/resource.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../src/oauth/resource.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAuB,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAU,EAAE,CAC9D,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAExD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,YAAY,GAAG,qBAAqB,EAAU,EAAE;IAChG,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;IAC1F,OAAO,GAAG,IAAI,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAiB,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAW,EAAE;IAC7E,MAAM,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAyB,EAAE;IAC9F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,cAAc,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,aAAa,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAmB,EAAE;IACzF,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC,CAAC"}

package/dist/oauth/revoke.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAOjC,OAAO,EAAE,KAAK,kBAAkB,EAAc,MAAM,YAAY,CAAC;AAQjE,eAAO,MAAM,YAAY,GACvB,SAAS,OAAO,EAChB,SAAS,kBAAkB,KAC1B,OAAO,CAAC,QAAQ,CA8BlB,CAAC"}

package/dist/oauth/revoke.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/oauth/revoke.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAA2B,UAAU,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAEzC,MAAM,eAAe,GAAG,CAAC,IAAwB,EAAgD,EAAE,CACjG,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAEzE,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAElF,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAErF,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;IAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC,CAAC"}

package/dist/oauth/scope.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/oauth/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAGnE,OAAO,EAAE,KAAK,cAAc,EAAc,MAAM,YAAY,CAAC;AAE7D,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAAM,EAIP,CAAC;AAEzC,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,EAAE,KAAG,MAA0B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,UAAU,MAAM,EAAE,KAAG,MAAM,EAGvE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,WAAW,MAAM,EAAE,EACnB,YAAY,MAAM,EAAE,KACnB,cAAc,GAAG,IAKnB,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,eAAe,GAAI,WAAW,MAAM,EAAE,EAAE,YAAY,MAAM,EAAE,KAAG,QAAQ,GAAG,IAGtF,CAAC"}

package/dist/oauth/scope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/oauth/scope.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAuB,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAY,EAAE,CAClD,GAAG;KACA,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;KAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAgB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,QAAkB,EAAY,EAAE;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAmB,EACnB,UAAoB,EACG,EAAE;IACzB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,sBAAsB,OAAO,EAAE,EAAE,CAAC;AACxF,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAmB,EAAE,UAAoB,EAAmB,EAAE;IAC5F,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC,CAAC"}

package/dist/oauth/sealed.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sealed.d.ts","sourceRoot":"","sources":["../../src/oauth/sealed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AA+BvD,uDAAuD;AACvD,eAAO,MAAM,IAAI,GAAU,CAAC,EAAE,QAAQ,MAAM,EAAE,MAAM,UAAU,EAAE,SAAS,CAAC,KAAG,OAAO,CAAC,MAAM,CAW1F,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,MAAM,GAAU,CAAC,EAC5B,QAAQ,MAAM,EACd,MAAM,UAAU,EAChB,QAAQ,MAAM,KACb,OAAO,CAAC,CAAC,GAAG,IAAI,CAsBlB,CAAC"}