mcp-trellis 1.0.0 → 2.2.0

package/dist/oauth/audit.js

@@ -0,0 +1,29 @@
+/**
+ * Invoke `ports.audit`, swallowing any failure and racing it against
+ * `auditTimeoutMs` — the OAuth-side twin of `methods.ts`'s `safeAudit`.
+ * A hanging sink must not stall `/token` or `/authorize` error responses.
+ */
+import { DEFAULT_AUDIT_TIMEOUT_MS, runAuditBounded } from "../http/http.js";
+export const safeOAuthAudit = async (options, entry) => {
+    const audit = options.ports.audit;
+    if (!audit)
+        return;
+    await runAuditBounded(() => audit(entry), options.auditTimeoutMs ?? DEFAULT_AUDIT_TIMEOUT_MS);
+};
+/**
+ * Fires `legacy_code_secret_used` when a value was recovered with a
+ * rotation-array entry other than the primary (`keyIndex > 0`) — the signal
+ * every codeSecret rotation site (`/authorize`, `/consent`, `/token`,
+ * `firstClientAuthError`) uses to tell an operator which old keys are still
+ * live. A no-op for the common case (`keyIndex === 0`, or none at all).
+ */
+export const auditLegacyKeyUsage = async (options, usage) => {
+    if (!usage.keyIndex)
+        return;
+    await safeOAuthAudit(options, {
+        event: "legacy_code_secret_used",
+        clientId: usage.clientId,
+        reason: `${usage.source} with codeSecret[${usage.keyIndex}]`,
+    });
+};
+//# sourceMappingURL=audit.js.map

package/dist/oauth/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/oauth/audit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAG5E,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAA2B,EAC3B,KAAsB,EACP,EAAE;IACjB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,OAA2B,EAC3B,KAAgF,EACjE,EAAE;IACjB,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO;IAC5B,MAAM,cAAc,CAAC,OAAO,EAAE;QAC5B,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,QAAQ,GAAG;KAC7D,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/cimd/cimd-parse.d.ts

@@ -0,0 +1,4 @@
+import type { CimdDocument } from "./types.js";
+export declare const parseCacheMaxAge: (header: string | null) => number;
+export declare const parseDocument: (clientId: string, text: string) => CimdDocument;
+//# sourceMappingURL=cimd-parse.d.ts.map

package/dist/oauth/cimd/cimd-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-parse.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-parse.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK/C,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,GAAG,IAAI,KAAG,MAGxD,CAAC;AAoCF,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,YAsB9D,CAAC"}

package/dist/oauth/cimd/cimd-parse.js

@@ -0,0 +1,70 @@
+import { isJsonObject } from "../../util/json.js";
+import { MAX_CLIENT_REDIRECT_URIS } from "../constants.js";
+import { isLoopbackHostname } from "./cimd-ssrf.js";
+const DEFAULT_CACHE_SECONDS = 300;
+const MAX_CACHE_SECONDS = 3600;
+export const parseCacheMaxAge = (header) => {
+    const maxAge = header ? /(?:^|,)\s*max-age=(\d+)/i.exec(header)?.[1] : undefined;
+    return maxAge === undefined ? DEFAULT_CACHE_SECONDS : Math.min(Number(maxAge), MAX_CACHE_SECONDS);
+};
+const assertHttpRedirectUri = (uri) => {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        throw new Error("CIMD redirect_uris entries must be absolute URLs");
+    }
+    if (parsed.username || parsed.password || parsed.hash) {
+        throw new Error("CIMD redirect_uris must not carry credentials or a fragment");
+    }
+    if (parsed.protocol === "https:")
+        return;
+    if (parsed.protocol === "http:") {
+        if (!isLoopbackHostname(parsed.hostname)) {
+            throw new Error("CIMD http redirect_uris must be loopback (127.0.0.1 / ::1)");
+        }
+        return;
+    }
+    throw new Error("CIMD redirect_uris must be http(s)");
+};
+const parseRedirectUris = (rawUris) => {
+    if (!Array.isArray(rawUris) || rawUris.length === 0) {
+        throw new Error("CIMD document must include a non-empty redirect_uris array");
+    }
+    if (rawUris.length > MAX_CLIENT_REDIRECT_URIS) {
+        throw new Error(`CIMD redirect_uris must have at most ${MAX_CLIENT_REDIRECT_URIS} entries`);
+    }
+    return rawUris.map((u) => {
+        if (typeof u !== "string" || !u)
+            throw new Error("CIMD redirect_uris entries must be strings");
+        assertHttpRedirectUri(u);
+        return u;
+    });
+};
+export const parseDocument = (clientId, text) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error("CIMD document is not JSON");
+    }
+    if (!isJsonObject(parsed))
+        throw new Error("CIMD document must be a JSON object");
+    const record = parsed;
+    if (record.client_id !== clientId) {
+        throw new Error("CIMD document client_id must equal the request URL exactly");
+    }
+    const authMethod = record.token_endpoint_auth_method;
+    if (authMethod !== undefined && authMethod !== "none") {
+        throw new Error("CIMD clients must be public (token_endpoint_auth_method none)");
+    }
+    return {
+        client_id: clientId,
+        redirect_uris: parseRedirectUris(record.redirect_uris),
+        ...(typeof record.client_name === "string" ? { client_name: record.client_name } : {}),
+        token_endpoint_auth_method: "none",
+    };
+};
+//# sourceMappingURL=cimd-parse.js.map

package/dist/oauth/cimd/cimd-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-parse.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-parse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAqB,EAAU,EAAE;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACpG,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,GAAW,EAAQ,EAAE;IAClD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,OAAgB,EAAY,EAAE;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,wBAAwB,UAAU,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC/F,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAgB,EAAE;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,0BAA0B,CAAC;IACrD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC;QACtD,GAAG,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,0BAA0B,EAAE,MAAM;KACnC,CAAC;AACJ,CAAC,CAAC"}

package/dist/oauth/cimd/cimd-ssrf.d.ts

@@ -0,0 +1,8 @@
+/**
+ * SSRF guards for CIMD URL fetch: hostname normalization, private/NAT64
+ * IP blocks, and DNS lookup before connect.
+ */
+export declare const isLoopbackHostname: (hostname: string) => boolean;
+export declare const defaultLookup: (hostname: string) => Promise<string[]>;
+export declare const assertSafeUrl: (url: URL, lookup: (hostname: string) => Promise<string[]>) => Promise<void>;
+//# sourceMappingURL=cimd-ssrf.d.ts.map

package/dist/oauth/cimd/cimd-ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-ssrf.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoLH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,OAEL,CAAC;AAElD,eAAO,MAAM,aAAa,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAQtE,CAAC;AAiBF,eAAO,MAAM,aAAa,GACxB,KAAK,GAAG,EACR,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,KAC9C,OAAO,CAAC,IAAI,CASd,CAAC"}

package/dist/oauth/cimd/cimd-ssrf.js

@@ -0,0 +1,193 @@
+/**
+ * SSRF guards for CIMD URL fetch: hostname normalization, private/NAT64
+ * IP blocks, and DNS lookup before connect.
+ */
+/** Strip WHATWG brackets from IPv6 hostnames (`[::1]` → `::1`). */
+const normalizeHostname = (hostname) => {
+    const host = hostname.toLowerCase().replace(/\.$/, "");
+    return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+};
+const DOTTED_QUAD = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/** Digits-and-dots only — covers shorthand (`127.1`) and decimal (`2130706433`). */
+const IPV4_CANDIDATE = /^\d+(?:\.\d+)*$/;
+const IPV4_PRIVATE = [
+    /^0\./,
+    /^10\./,
+    /^127\./,
+    /^169\.254\./,
+    /^172\.(1[6-9]|2\d|3[0-1])\./,
+    /^192\.168\./,
+    /^100\.(6[4-9]|[7-9]\d|1[0-1]\d|12[0-7])\./,
+    // IETF protocol assignments 192.0.0/24, benchmarking 198.18/15
+    /^192\.0\.0\./,
+    /^198\.1[89]\./,
+    // Multicast 224/4, reserved 240/4 (incl. 255.255.255.255)
+    /^(22[4-9]|23\d|24\d|25[0-5])\./,
+];
+const isPrivateV4 = (v4) => IPV4_PRIVATE.some((re) => re.test(v4));
+/** IPv4-mapped (`::ffff:a.b.c.d`) and deprecated IPv4-compatible (`::a.b.c.d`) forms. */
+const expandIpv4Mapped = (ip) => {
+    const mapped = /^::(?:ffff:)?(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(ip);
+    if (mapped)
+        return mapped[1] ?? null;
+    const hexMapped = /^::(?:ffff:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(ip);
+    if (!hexMapped)
+        return null;
+    const hi = Number.parseInt(hexMapped[1] ?? "", 16);
+    const lo = Number.parseInt(hexMapped[2] ?? "", 16);
+    return `${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`;
+};
+const HEXTET = /^[0-9a-f]{1,4}$/i;
+const parseHextet = (part) => HEXTET.test(part) ? Number.parseInt(part, 16) : null;
+const hextetPairToIpv4 = (hi, lo) => {
+    const high = parseHextet(hi);
+    const low = parseHextet(lo);
+    if (high === null || low === null)
+        return null;
+    return `${(high >> 8) & 255}.${high & 255}.${(low >> 8) & 255}.${low & 255}`;
+};
+const splitHextetParts = (segment) => segment.length > 0 ? segment.split(":") : [];
+const dottedQuadToHextetPair = (quad) => {
+    const octets = quad.split(".").map(Number);
+    if (octets.length !== 4 || octets.some((n) => !Number.isFinite(n) || n < 0 || n > 255)) {
+        return null;
+    }
+    const [a, b, c, d] = octets;
+    return [((a << 8) | b).toString(16), ((c << 8) | d).toString(16)];
+};
+const isValidHextetList = (hextets) => hextets.length === 8 && hextets.every((h) => parseHextet(h) !== null);
+/**
+ * Expand an IPv6 literal into 8 hextets. Trailing dotted-quad (mapped /
+ * compatible forms) consumes the last two slots. Returns null when the
+ * string is not a well-formed IPv6 address — callers fail closed.
+ */
+const expandIpv6Hextets = (ip) => {
+    if (!ip.includes(":"))
+        return null;
+    let ipv4Tail = null;
+    let core = ip;
+    const lastColon = ip.lastIndexOf(":");
+    const after = ip.slice(lastColon + 1);
+    if (DOTTED_QUAD.test(after)) {
+        ipv4Tail = dottedQuadToHextetPair(after);
+        if (!ipv4Tail)
+            return null;
+        core = ip.slice(0, lastColon);
+    }
+    const slots = 8 - (ipv4Tail ? 2 : 0);
+    if (core.includes("::")) {
+        const pieces = core.split("::");
+        if (pieces.length !== 2)
+            return null;
+        const headParts = splitHextetParts(pieces[0] ?? "");
+        const tailParts = splitHextetParts(pieces[1] ?? "");
+        if (headParts.length + tailParts.length > slots)
+            return null;
+        const missing = slots - headParts.length - tailParts.length;
+        const hextets = [
+            ...headParts,
+            ...Array.from({ length: missing }, () => "0"),
+            ...tailParts,
+            ...(ipv4Tail ?? []),
+        ];
+        return isValidHextetList(hextets) ? hextets : null;
+    }
+    const parts = splitHextetParts(core);
+    if (parts.length !== slots)
+        return null;
+    const hextets = [...parts, ...(ipv4Tail ?? [])];
+    return isValidHextetList(hextets) ? hextets : null;
+};
+// --- block rules (ordered; first match blocks) ---
+/** Non-canonical IPv4 from a sloppy `cimdLookup` — fail closed, not a public hostname. */
+const isNonCanonicalIpv4 = (v4) => IPV4_CANDIDATE.test(v4) && !DOTTED_QUAD.test(v4);
+const isPrivateDottedQuad = (v4) => DOTTED_QUAD.test(v4) && isPrivateV4(v4);
+const IPV6_BLOCKED_EXACT = new Set(["::1", "::"]);
+const IPV6_BLOCKED_PREFIXES = ["fe80:", "::ffff:"];
+/** ULA fc00::/7 and multicast ff00::/8. */
+const IPV6_BLOCKED_PREFIX_RES = [/^f[cd][0-9a-f]{2}:/i, /^ff[0-9a-f]{0,2}:/];
+const isBlockedIpv6Literal = (ip) => IPV6_BLOCKED_EXACT.has(ip) ||
+    IPV6_BLOCKED_PREFIXES.some((prefix) => ip.startsWith(prefix)) ||
+    IPV6_BLOCKED_PREFIX_RES.some((re) => re.test(ip));
+const leadingFiveZero = (n) => n[0] === 0 && n[1] === 0 && n[2] === 0 && n[3] === 0 && n[4] === 0;
+/** Full-form IPv4-mapped (`0:0:0:0:0:ffff:…`) — same block as `::ffff:` prefix. */
+const isIpv4MappedHextets = (n) => leadingFiveZero(n) && n[5] === 0xffff;
+/** Deprecated IPv4-compatible — private/reserved embeds only (public stays). */
+const isBlockedIpv4Compatible = (n, raw) => {
+    if (!leadingFiveZero(n) || n[5] !== 0)
+        return false;
+    if (n[6] === 0 && (n[7] === 0 || n[7] === 1))
+        return true;
+    const embedded = hextetPairToIpv4(raw[6] ?? "", raw[7] ?? "");
+    return !embedded || isPrivateV4(embedded);
+};
+const HEXTET_BLOCK_RULES = [
+    isIpv4MappedHextets,
+    isBlockedIpv4Compatible,
+    (n) => n[0] === 0x2002, // 6to4 2002::/16
+    (n) => n[0] === 0x64 && n[1] === 0xff9b, // NAT64 64:ff9b::/96
+];
+const isBlockedIp = (ip) => {
+    const normalized = normalizeHostname(ip);
+    const v4 = expandIpv4Mapped(normalized) ?? normalized;
+    if (isNonCanonicalIpv4(v4) || isPrivateDottedQuad(v4))
+        return true;
+    if (!normalized.includes(":"))
+        return false;
+    if (isBlockedIpv6Literal(normalized))
+        return true;
+    const raw = expandIpv6Hextets(normalized);
+    if (!raw)
+        return true; // fail closed on unparseable IPv6
+    const n = raw.map((h) => Number.parseInt(h, 16));
+    return HEXTET_BLOCK_RULES.some((rule) => rule(n, raw));
+};
+const BLOCKED_HOST_EXACT = new Set(["localhost"]);
+const BLOCKED_HOST_SUFFIXES = [".localhost", ".local"];
+const isBlockedHostname = (hostname) => {
+    const host = normalizeHostname(hostname);
+    if (BLOCKED_HOST_EXACT.has(host))
+        return true;
+    if (BLOCKED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix)))
+        return true;
+    return isBlockedIp(host);
+};
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1"]);
+export const isLoopbackHostname = (hostname) => 
+// `localhost` deliberately excluded — RFC 8252 §8.3, same as policy/redirect.ts.
+LOOPBACK_HOSTS.has(normalizeHostname(hostname));
+export const defaultLookup = async (hostname) => {
+    try {
+        const dns = await import("node:dns/promises");
+        const results = await dns.lookup(hostname, { all: true, verbatim: true });
+        return results.map((r) => r.address);
+    }
+    catch {
+        throw new Error("CIMD DNS lookup unavailable");
+    }
+};
+const URL_SAFETY = {
+    https: {
+        ok: (url) => url.protocol === "https:",
+        error: "CIMD client_id must be https",
+    },
+    noCredentials: {
+        ok: (url) => !url.username && !url.password,
+        error: "CIMD URL must not carry credentials",
+    },
+    publicHostname: {
+        ok: (url) => !isBlockedHostname(url.hostname),
+        error: "CIMD hostname is not publicly routable",
+    },
+};
+export const assertSafeUrl = async (url, lookup) => {
+    for (const rule of Object.values(URL_SAFETY)) {
+        if (!rule.ok(url))
+            throw new Error(rule.error);
+    }
+    const addrs = await lookup(normalizeHostname(url.hostname));
+    if (addrs.length === 0 || addrs.some(isBlockedIp)) {
+        throw new Error("CIMD resolved to a non-public address");
+    }
+};
+//# sourceMappingURL=cimd-ssrf.js.map

package/dist/oauth/cimd/cimd-ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-ssrf.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,oFAAoF;AACpF,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,MAAM,YAAY,GAAG;IACnB,MAAM;IACN,OAAO;IACP,QAAQ;IACR,aAAa;IACb,6BAA6B;IAC7B,aAAa;IACb,2CAA2C;IAC3C,+DAA+D;IAC/D,cAAc;IACd,eAAe;IACf,0DAA0D;IAC1D,gCAAgC;CACjC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpF,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAiB,EAAE;IACrD,MAAM,MAAM,GAAG,0CAA0C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAErC,MAAM,SAAS,GAAG,gDAAgD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;AACzE,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAElC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAiB,EAAE,CAClD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEvD,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAU,EAAiB,EAAE;IACjE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAY,EAAE,CACrD,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAE/C,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAA2B,EAAE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAA0C,CAAC;IAChE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,OAAiB,EAC4D,EAAE,CAC/E,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAmB,EAAE;IACxD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,QAAQ,GAA4B,IAAI,CAAC;IAC7C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC5D,MAAM,OAAO,GAAG;YACd,GAAG,SAAS;YACZ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;YAC7C,GAAG,SAAS;YACZ,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC,CAAC;AAEF,oDAAoD;AAEpD,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAW,EAAE,CACjD,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEnD,MAAM,mBAAmB,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;AAE7F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACnD,2CAA2C;AAC3C,MAAM,uBAAuB,GAAG,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AAE7E,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAW,EAAE,CACnD,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,uBAAuB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpD,MAAM,eAAe,GAAG,CAAC,CAAW,EAAW,EAAE,CAC/C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAErE,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;AAE5F,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,CAAC,CAAW,EAAE,GAAa,EAAW,EAAE;IACtE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAmD;IACzE,mBAAmB;IACnB,uBAAuB;IACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,iBAAiB;IACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,qBAAqB;CAC/D,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;IAEtD,IAAI,kBAAkB,CAAC,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,oBAAoB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IAEzD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAEvD,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAW,EAAE;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE;AAC9D,iFAAiF;AACjF,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAqB,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAiE;IAC/E,KAAK,EAAE;QACL,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACtC,KAAK,EAAE,8BAA8B;KACtC;IACD,aAAa,EAAE;QACb,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC3C,KAAK,EAAE,qCAAqC;KAC7C;IACD,cAAc,EAAE;QACd,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7C,KAAK,EAAE,wCAAwC;KAChD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,GAAQ,EACR,MAA+C,EAChC,EAAE;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/cimd/cimd.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Client ID Metadata Documents (CIMD) — HTTPS URL `client_id` metadata.
+ * Off by default (`cimd: true`). SSRF guards live in `cimd-ssrf.ts`.
+ *
+ * ponytail: DNS checked before/after fetch; TCP connect is not pinned (Web
+ * fetch). Upgrade: custom dispatcher dialing the resolved IP + Host header.
+ */
+import type { CimdCache, CimdDocument } from "./types.js";
+export type { CimdCache, CimdDocument } from "./types.js";
+export type CimdFetchOptions = {
+    /** Override fetch (tests). Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    cache?: CimdCache;
+    /**
+     * DNS lookup for rebinding checks. When omitted, the library tries
+     * `node:dns/promises.lookup` if available; if that is also unavailable
+     * (e.g. some Workers), resolution is refused rather than fetched blind.
+     */
+    lookup?: (hostname: string) => Promise<string[]>;
+    /** Per-hop timeout covering connect **and** body read. Tests only — default 10 s. */
+    timeoutMs?: number;
+};
+/** Build fetch options from router/app CIMD ports. */
+export declare const cimdFetchOpts: (ports: {
+    cimdCache?: CimdCache;
+    cimdLookup?: (hostname: string) => Promise<string[]>;
+}) => Pick<CimdFetchOptions, "cache" | "lookup">;
+/** True when `client_id` is an HTTPS URL eligible for CIMD resolution. */
+export declare const isCimdClientId: (clientId: string) => boolean;
+/**
+ * Fetch and validate a CIMD document for `clientId` (the HTTPS URL itself).
+ * Returns null on any validation / network failure — callers map that to
+ * `unauthorized_client` without leaking fetch details to the connector.
+ */
+export declare const resolveCimdClient: (clientId: string, options?: CimdFetchOptions) => Promise<CimdDocument | null>;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/oauth/cimd/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,aAAa,GAAI,OAAO;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,KAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAG3C,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,KAAG,OAajD,CAAC;AAwGF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAC5B,UAAU,MAAM,EAChB,UAAS,gBAAqB,KAC7B,OAAO,CAAC,YAAY,GAAG,IAAI,CAkB7B,CAAC"}

package/dist/oauth/cimd/cimd.js

@@ -0,0 +1,132 @@
+/**
+ * Client ID Metadata Documents (CIMD) — HTTPS URL `client_id` metadata.
+ * Off by default (`cimd: true`). SSRF guards live in `cimd-ssrf.ts`.
+ *
+ * ponytail: DNS checked before/after fetch; TCP connect is not pinned (Web
+ * fetch). Upgrade: custom dispatcher dialing the resolved IP + Host header.
+ */
+import { readBoundedText } from "../../http/body.js";
+import { parseCacheMaxAge, parseDocument } from "./cimd-parse.js";
+import { assertSafeUrl, defaultLookup } from "./cimd-ssrf.js";
+const CIMD_MAX_BYTES = 5 * 1024;
+const CIMD_TIMEOUT_MS = 10_000;
+const CIMD_MAX_REDIRECTS = 3;
+/** Build fetch options from router/app CIMD ports. */
+export const cimdFetchOpts = (ports) => ({
+    ...(ports.cimdCache !== undefined ? { cache: ports.cimdCache } : {}),
+    ...(ports.cimdLookup !== undefined ? { lookup: ports.cimdLookup } : {}),
+});
+/** True when `client_id` is an HTTPS URL eligible for CIMD resolution. */
+export const isCimdClientId = (clientId) => {
+    try {
+        const url = new URL(clientId);
+        return (url.protocol === "https:" &&
+            url.username === "" &&
+            url.password === "" &&
+            url.hash === "" &&
+            Boolean(url.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+const readCimdBody = async (ctx, response, current) => {
+    if (!response.ok)
+        return null;
+    // Stream-capped at CIMD_MAX_BYTES; signal cancels the locked reader on hop
+    // timeout (body.cancel() is a no-op while getReader() holds the lock).
+    try {
+        const text = await readBoundedText(response, CIMD_MAX_BYTES, ctx.signal);
+        // Re-check DNS after the body — see file-level ponytail on connect pinning.
+        await assertSafeUrl(current, ctx.lookup);
+        return {
+            doc: parseDocument(ctx.clientId, text),
+            maxAge: parseCacheMaxAge(response.headers.get("cache-control")),
+        };
+    }
+    catch {
+        return null;
+    }
+};
+const followRedirect = async (ctx, response, current) => {
+    const location = response.headers.get("location");
+    if (!location || ctx.redirect === CIMD_MAX_REDIRECTS)
+        return null;
+    const next = new URL(location, current);
+    // Same-origin only: a cross-origin hop would let an open redirect on a
+    // reputable host vouch for a document the attacker actually serves.
+    if (next.origin !== new URL(ctx.clientId).origin)
+        return null;
+    await assertSafeUrl(next, ctx.lookup);
+    return next;
+};
+const getCimdResponse = (fetchImpl, url, signal) => fetchImpl(url, {
+    method: "GET",
+    redirect: "manual",
+    signal,
+    headers: { Accept: "application/json" },
+});
+/** One request under its own timeout. */
+const fetchHop = async (settings, current, redirect) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), settings.timeoutMs);
+    const ctx = {
+        clientId: settings.clientId,
+        lookup: settings.lookup,
+        redirect,
+        signal: controller.signal,
+    };
+    try {
+        const response = await getCimdResponse(settings.fetch, current.toString(), controller.signal);
+        if (response.status >= 300 && response.status < 400) {
+            const next = await followRedirect(ctx, response, current);
+            return next ? { next } : { done: null };
+        }
+        // `await` keeps the body read inside this try — without it `finally`
+        // clears the timer as soon as headers arrive.
+        return { done: await readCimdBody(ctx, response, current) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+};
+const fetchCimdDocument = async (settings) => {
+    let current = new URL(settings.clientId);
+    await assertSafeUrl(current, settings.lookup);
+    for (let redirect = 0; redirect <= CIMD_MAX_REDIRECTS; redirect++) {
+        const hop = await fetchHop(settings, current, redirect);
+        if ("done" in hop)
+            return hop.done;
+        current = hop.next;
+    }
+    return null;
+};
+/**
+ * Fetch and validate a CIMD document for `clientId` (the HTTPS URL itself).
+ * Returns null on any validation / network failure — callers map that to
+ * `unauthorized_client` without leaking fetch details to the connector.
+ */
+export const resolveCimdClient = async (clientId, options = {}) => {
+    if (!isCimdClientId(clientId))
+        return null;
+    const cached = options.cache ? await options.cache.get(clientId) : null;
+    if (cached)
+        return cached;
+    try {
+        const result = await fetchCimdDocument({
+            clientId,
+            fetch: options.fetch ?? globalThis.fetch,
+            lookup: options.lookup ?? defaultLookup,
+            timeoutMs: options.timeoutMs ?? CIMD_TIMEOUT_MS,
+        });
+        if (!result)
+            return null;
+        if (options.cache)
+            await options.cache.set(clientId, result.doc, result.maxAge);
+        return result.doc;
+    }
+    catch {
+        return null;
+    }
+};
+//# sourceMappingURL=cimd.js.map

package/dist/oauth/cimd/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK9D,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAgB7B,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAG7B,EAA8C,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,YAAY,GAAG,KAAK,EACxB,GAAa,EACb,QAAkB,EAClB,OAAY,EACqB,EAAE;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzE,4EAA4E;QAC5E,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO;YACL,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;YACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;SAChE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,GAAa,EACb,QAAkB,EAClB,OAAY,EACS,EAAE;IACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAAuB,EAAE,GAAW,EAAE,MAAmB,EAAE,EAAE,CACpF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;IAClB,MAAM;IACN,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;CACxC,CAAC,CAAC;AAYL,yCAAyC;AACzC,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAuB,EACvB,OAAY,EACZ,QAAgB,EACI,EAAE;IACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,GAAG,GAAa;QACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,qEAAqE;QACrE,8CAA8C;QAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAuB,EAAmC,EAAE;IAC3F,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,kBAAkB,EAAE,QAAQ,EAAE,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACnC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,QAAgB,EAChB,UAA4B,EAAE,EACA,EAAE;IAChC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;YACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/cimd/types.d.ts

@@ -0,0 +1,12 @@
+/** CIMD document and cache shapes, shared by the fetcher and the parser. */
+export type CimdDocument = {
+    client_id: string;
+    redirect_uris: string[];
+    client_name?: string;
+    token_endpoint_auth_method?: string;
+};
+export type CimdCache = {
+    get: (clientId: string) => Promise<CimdDocument | null> | CimdDocument | null;
+    set: (clientId: string, doc: CimdDocument, maxAgeSeconds: number) => Promise<void> | void;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/oauth/cimd/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/types.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3F,CAAC"}

package/dist/oauth/cimd/types.js

@@ -0,0 +1,3 @@
+/** CIMD document and cache shapes, shared by the fetcher and the parser. */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/oauth/cimd/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/oauth/cimd/types.ts"],"names":[],"mappings":"AAAA,4EAA4E"}

package/dist/oauth/config.d.ts

@@ -0,0 +1,51 @@
+/** OAuth construction asserts and small response helpers. */
+import type { MintedToken, OAuthPorts, OAuthRouterOptions } from "./types.js";
+/** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
+export declare const unregisteredClientsAllowed: (options: OAuthRouterOptions) => boolean;
+/** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
+export declare const registeredClientsRequired: (options: OAuthRouterOptions) => boolean;
+/** Scopes this AS advertises and is willing to grant. */
+export declare const advertisedScopes: (options: OAuthRouterOptions) => string[];
+/**
+ * Scopes granted when a client omits `scope`. Falls back to the full
+ * advertised set only when that set has at most one entry — see
+ * `assertScopeConfig`, which forbids the ambiguous multi-scope case at
+ * construction instead of silently over-granting here.
+ */
+export declare const defaultScopes: (options: OAuthRouterOptions) => string[];
+/**
+ * A multi-scope server MUST say what an omitted `scope` grants — the
+ * alternative (silently granting everything advertised) is exactly the
+ * escalation least-privilege scoping exists to prevent.
+ *
+ * This controls only what a *token* is granted at authorize time —
+ * `defaultScopes: []` still leaves any tool that omits `ToolDef.scope`
+ * callable by a principal holding zero scopes, since that check happens
+ * per tool-call, not here. `createMcpApp` has the matching guard on the
+ * tool side: it refuses to construct with an unscoped tool once `scopes`
+ * has more than one entry (`assertToolScopesConfigured` in `app.ts`).
+ */
+export declare const assertScopeConfig: (options: OAuthRouterOptions) => void;
+export declare const assertCodeSecret: (secret: string) => void;
+/**
+ * Resolves `codeSecret` to a non-empty key list — a single string becomes a
+ * one-element array. The **first** entry is the one every caller here uses
+ * to seal new material or hash new client secrets; the full array is what a
+ * caller trying to unseal/verify existing material tries in order (see
+ * `unsealAny`, `verifyClientSecretAny`). Every entry is validated the same
+ * way a lone string always was.
+ */
+export declare const resolveSecrets: (ports: OAuthPorts, request: Request) => Promise<readonly [string, ...string[]]>;
+export declare const oauthError: (error: string, status: number, description?: string) => Response;
+/** Direct JSON error when this AS does not serve unknown `client_id`s. */
+export declare const unregisteredClientError: (options: OAuthRouterOptions, reject: {
+    code: string;
+    status: number;
+}) => Response | null;
+/**
+ * `grantedScope` is what the auth code carried (or a narrowed refresh
+ * request); the port may narrow it further. With neither, `scope` is
+ * omitted (optional when unchanged, RFC 6749 §5.1) rather than guessed.
+ */
+export declare const tokenResponse: (minted: MintedToken, grantedScope?: string) => Response;
+//# sourceMappingURL=config.d.ts.map

package/dist/oauth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9E,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GAAI,SAAS,kBAAkB,KAAG,OAC7B,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,GAAI,SAAS,kBAAkB,KAAG,OAC5B,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,kBAAkB,KAAG,MAAM,EACd,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,IAY/D,CAAC;AAaF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,IAYjD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,UAAU,EACjB,SAAS,OAAO,KACf,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAUxC,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,QAK7E,CAAC;AAKL,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAGb,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,WAAW,EAAE,eAAe,MAAM,KAAG,QAa1E,CAAC"}