mcp-trellis 2.1.0 → 3.0.0

package/dist/oauth/cimd/cimd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,aAAa,GAAI,OAAO;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,KAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAG3C,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,KAAG,OAajD,CAAC;AAwGF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAC5B,UAAU,MAAM,EAChB,UAAS,gBAAqB,KAC7B,OAAO,CAAC,YAAY,GAAG,IAAI,CAkB7B,CAAC"}
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAa,KAAK,WAAW,EAAuB,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,aAAa,GAAI,OAAO;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,KAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAG3C,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,KAAG,OAajD,CAAC;AAoGF,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAU,MAAM,EAChB,UAAS,gBAAqB,KAC7B,OAAO,CAAC,WAAW,CAqBrB,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,GAC5B,UAAU,MAAM,EAChB,UAAS,gBAAqB,KAC7B,OAAO,CAAC,YAAY,GAAG,IAAI,CAG7B,CAAC"}

package/dist/oauth/cimd/cimd.js

@@ -8,6 +8,7 @@
 import { readBoundedText } from "../../http/body.js";
 import { parseCacheMaxAge, parseDocument } from "./cimd-parse.js";
 import { assertSafeUrl, defaultLookup } from "./cimd-ssrf.js";
+import { CimdError, classifyCimdFailure } from "./failure.js";
 const CIMD_MAX_BYTES = 5 * 1024;
 const CIMD_TIMEOUT_MS = 10_000;
 const CIMD_MAX_REDIRECTS = 3;
@@ -32,31 +33,30 @@ export const isCimdClientId = (clientId) => {
 };
 const readCimdBody = async (ctx, response, current) => {
     if (!response.ok)
-        return null;
+        throw new CimdError("http_status", `status ${response.status}`);
     // Stream-capped at CIMD_MAX_BYTES; signal cancels the locked reader on hop
     // timeout (body.cancel() is a no-op while getReader() holds the lock).
-    try {
-        const text = await readBoundedText(response, CIMD_MAX_BYTES, ctx.signal);
-        // Re-check DNS after the body — see file-level ponytail on connect pinning.
-        await assertSafeUrl(current, ctx.lookup);
-        return {
-            doc: parseDocument(ctx.clientId, text),
-            maxAge: parseCacheMaxAge(response.headers.get("cache-control")),
-        };
-    }
-    catch {
-        return null;
-    }
+    const text = await readBoundedText(response, CIMD_MAX_BYTES, ctx.signal);
+    // Re-check DNS after the body — see file-level ponytail on connect pinning.
+    await assertSafeUrl(current, ctx.lookup);
+    return {
+        doc: parseDocument(ctx.clientId, text),
+        maxAge: parseCacheMaxAge(response.headers.get("cache-control")),
+    };
 };
 const followRedirect = async (ctx, response, current) => {
     const location = response.headers.get("location");
-    if (!location || ctx.redirect === CIMD_MAX_REDIRECTS)
-        return null;
+    if (!location)
+        throw new CimdError("redirect_refused", "redirect without Location");
+    if (ctx.redirect === CIMD_MAX_REDIRECTS) {
+        throw new CimdError("redirect_refused", "too many redirects");
+    }
     const next = new URL(location, current);
     // Same-origin only: a cross-origin hop would let an open redirect on a
     // reputable host vouch for a document the attacker actually serves.
-    if (next.origin !== new URL(ctx.clientId).origin)
-        return null;
+    if (next.origin !== new URL(ctx.clientId).origin) {
+        throw new CimdError("redirect_refused", "cross-origin redirect");
+    }
     await assertSafeUrl(next, ctx.lookup);
     return next;
 };
@@ -79,8 +79,7 @@ const fetchHop = async (settings, current, redirect) => {
     try {
         const response = await getCimdResponse(settings.fetch, current.toString(), controller.signal);
         if (response.status >= 300 && response.status < 400) {
-            const next = await followRedirect(ctx, response, current);
-            return next ? { next } : { done: null };
+            return { next: await followRedirect(ctx, response, current) };
         }
         // `await` keeps the body read inside this try — without it `finally`
         // clears the timer as soon as headers arrive.
@@ -99,34 +98,41 @@ const fetchCimdDocument = async (settings) => {
             return hop.done;
         current = hop.next;
     }
-    return null;
+    throw new CimdError("redirect_refused", "too many redirects");
 };
 /**
  * Fetch and validate a CIMD document for `clientId` (the HTTPS URL itself).
- * Returns null on any validation / network failure — callers map that to
- * `unauthorized_client` without leaking fetch details to the connector.
+ * Never throws for a fetch / validation problem: the failure comes back as a
+ * code for the operator's audit sink, and callers still answer the connector
+ * with one generic `unauthorized_client` — no fetch details leak to it.
  */
-export const resolveCimdClient = async (clientId, options = {}) => {
-    if (!isCimdClientId(clientId))
-        return null;
+export const resolveCimdOutcome = async (clientId, options = {}) => {
+    if (!isCimdClientId(clientId)) {
+        return { failure: { code: "blocked_url", detail: "client_id is not an https URL" } };
+    }
     const cached = options.cache ? await options.cache.get(clientId) : null;
     if (cached)
-        return cached;
+        return { doc: cached };
+    let fetched;
     try {
-        const result = await fetchCimdDocument({
+        fetched = await fetchCimdDocument({
             clientId,
             fetch: options.fetch ?? globalThis.fetch,
             lookup: options.lookup ?? defaultLookup,
             timeoutMs: options.timeoutMs ?? CIMD_TIMEOUT_MS,
         });
-        if (!result)
-            return null;
-        if (options.cache)
-            await options.cache.set(clientId, result.doc, result.maxAge);
-        return result.doc;
     }
-    catch {
-        return null;
+    catch (caught) {
+        return { failure: classifyCimdFailure(caught) };
     }
+    // Outside the try above: a failing cache is a server fault, not a bad document.
+    if (options.cache)
+        await options.cache.set(clientId, fetched.doc, fetched.maxAge);
+    return { doc: fetched.doc };
+};
+/** `null` on any failure — see `resolveCimdOutcome` for the reason. */
+export const resolveCimdClient = async (clientId, options = {}) => {
+    const outcome = await resolveCimdOutcome(clientId, options);
+    return "doc" in outcome ? outcome.doc : null;
 };
 //# sourceMappingURL=cimd.js.map

package/dist/oauth/cimd/cimd.js.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK9D,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAgB7B,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAG7B,EAA8C,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,YAAY,GAAG,KAAK,EACxB,GAAa,EACb,QAAkB,EAClB,OAAY,EACqB,EAAE;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzE,4EAA4E;QAC5E,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO;YACL,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;YACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;SAChE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,GAAa,EACb,QAAkB,EAClB,OAAY,EACS,EAAE;IACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAAuB,EAAE,GAAW,EAAE,MAAmB,EAAE,EAAE,CACpF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;IAClB,MAAM;IACN,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;CACxC,CAAC,CAAC;AAYL,yCAAyC;AACzC,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAuB,EACvB,OAAY,EACZ,QAAgB,EACI,EAAE;IACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,GAAG,GAAa;QACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,qEAAqE;QACrE,8CAA8C;QAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAuB,EAAmC,EAAE;IAC3F,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,kBAAkB,EAAE,QAAQ,EAAE,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACnC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,QAAgB,EAChB,UAA4B,EAAE,EACA,EAAE;IAChC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;YACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAoB,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKhF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAgB7B,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAG7B,EAA8C,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,YAAY,GAAG,KAAK,EACxB,GAAa,EACb,QAAkB,EAClB,OAAY,EACc,EAAE;IAC5B,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,4EAA4E;IAC5E,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO;QACL,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;QACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAAE,GAAa,EAAE,QAAkB,EAAE,OAAY,EAAgB,EAAE;IAC7F,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAAuB,EAAE,GAAW,EAAE,MAAmB,EAAE,EAAE,CACpF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;IAClB,MAAM;IACN,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;CACxC,CAAC,CAAC;AAYL,yCAAyC;AACzC,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAuB,EACvB,OAAY,EACZ,QAAgB,EACI,EAAE;IACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,GAAG,GAAa;QACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAChE,CAAC;QACD,qEAAqE;QACrE,8CAA8C;QAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAuB,EAA4B,EAAE;IACpF,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,kBAAkB,EAAE,QAAQ,EAAE,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACnC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;AAChE,CAAC,CAAC;AAIF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAgB,EAChB,UAA4B,EAAE,EACR,EAAE;IACxB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAEnC,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,iBAAiB,CAAC;YAChC,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;YACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,gFAAgF;IAChF,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,QAAgB,EAChB,UAA4B,EAAE,EACA,EAAE;IAChC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC,CAAC"}

package/dist/oauth/cimd/failure.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Why a CIMD document could not be resolved. Reasons reach the operator's
+ * audit sink only — the connector always sees one generic error — so a detail
+ * is limited to static text, an HTTP status or a DNS error code: never a
+ * resolved address, a response header or body, or a redirect target.
+ */
+export type CimdFailureCode = "dns_unavailable" | "dns_failed" | "blocked_address" | "blocked_url" | "http_status" | "redirect_refused" | "too_large" | "timeout" | "not_json" | "document_invalid" | "client_id_mismatch" | "auth_method_unsupported" | "redirect_uris_invalid" | "fetch_failed";
+export type CimdFailure = {
+    code: CimdFailureCode;
+    detail?: string;
+};
+export declare class CimdError extends Error {
+    readonly code: CimdFailureCode;
+    constructor(code: CimdFailureCode, message: string);
+}
+/** Maps whatever a fetch attempt threw to a code; unknown errors keep only their class name. */
+export declare const classifyCimdFailure: (caught: unknown) => CimdFailure;
+export declare const formatCimdFailure: ({ code, detail }: CimdFailure) => string;
+//# sourceMappingURL=failure.d.ts.map

package/dist/oauth/cimd/failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/failure.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,aAAa,GACb,kBAAkB,GAClB,WAAW,GACX,SAAS,GACT,UAAU,GACV,kBAAkB,GAClB,oBAAoB,GACpB,yBAAyB,GACzB,uBAAuB,GACvB,cAAc,CAAC;AAEnB,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;gBAEnB,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKnD;AAID,gGAAgG;AAChG,eAAO,MAAM,mBAAmB,GAAI,QAAQ,OAAO,KAAG,WAKrD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,kBAAkB,WAAW,KAAG,MAC5B,CAAC"}

package/dist/oauth/cimd/failure.js

@@ -0,0 +1,28 @@
+/**
+ * Why a CIMD document could not be resolved. Reasons reach the operator's
+ * audit sink only — the connector always sees one generic error — so a detail
+ * is limited to static text, an HTTP status or a DNS error code: never a
+ * resolved address, a response header or body, or a redirect target.
+ */
+import { BodyTooLargeError } from "../../http/body.js";
+export class CimdError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "CimdError";
+        this.code = code;
+    }
+}
+const TIMEOUT_ERROR_NAMES = new Set(["AbortError", "TimeoutError"]);
+/** Maps whatever a fetch attempt threw to a code; unknown errors keep only their class name. */
+export const classifyCimdFailure = (caught) => {
+    if (caught instanceof CimdError)
+        return { code: caught.code, detail: caught.message };
+    if (caught instanceof BodyTooLargeError)
+        return { code: "too_large" };
+    if (caught instanceof Error && TIMEOUT_ERROR_NAMES.has(caught.name))
+        return { code: "timeout" };
+    return { code: "fetch_failed", ...(caught instanceof Error ? { detail: caught.name } : {}) };
+};
+export const formatCimdFailure = ({ code, detail }) => detail ? `${code}: ${detail}` : code;
+//# sourceMappingURL=failure.js.map

package/dist/oauth/cimd/failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure.js","sourceRoot":"","sources":["../../../src/oauth/cimd/failure.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAoBvD,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAkB;IAE/B,YAAY,IAAqB,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAe,EAAE;IAClE,IAAI,MAAM,YAAY,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACtF,IAAI,MAAM,YAAY,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACtE,IAAI,MAAM,YAAY,KAAK,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChG,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAe,EAAU,EAAE,CACzE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC"}

package/dist/oauth/crypto/clientauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAU9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAIrB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AA6BF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAaf,CAAC;AA2LF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,EAC3B,SAAS,OAAO,KACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAMzB,CAAC"}
+{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAU9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAIrB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AA6BF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAaf,CAAC;AA4LF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,EAC3B,SAAS,OAAO,KACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAMzB,CAAC"}

package/dist/oauth/crypto/clientauth.js

@@ -1,6 +1,6 @@
 /** Token-endpoint client authentication (RFC 6749 §2.3.1). */
-import { auditLegacyKeyUsage, safeOAuthAudit } from "../audit.js";
-import { cimdFetchOpts, isCimdClientId, resolveCimdClient } from "../cimd/cimd.js";
+import { auditCimdFailure, auditLegacyKeyUsage, safeOAuthAudit } from "../audit.js";
+import { cimdFetchOpts, isCimdClientId, resolveCimdOutcome } from "../cimd/cimd.js";
 import { oauthError, registeredClientsRequired, resolveSecrets, unregisteredClientsAllowed, } from "../config.js";
 import { OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "../constants.js";
 import { unsealAny } from "./sealed.js";
@@ -105,14 +105,15 @@ const isSelfRegisteredOrCimdClient = async ({ auth, options, request, }) => {
     }
     if (options.cimd !== true || !isCimdClientId(auth.clientId))
         return false;
-    if (await resolveCimdClient(auth.clientId, cimdFetchOpts(options)))
+    const outcome = await resolveCimdOutcome(auth.clientId, cimdFetchOpts(options));
+    if ("doc" in outcome)
         return true;
     // Without `cimdCache` every refresh/revoke re-fetches — a flaky document
     // host logs users out. Surface that distinctly.
-    await safeOAuthAudit(options, {
-        event: "cimd_resolve_failed",
+    await auditCimdFailure(options, {
         clientId: auth.clientId,
-        reason: "CIMD document could not be resolved at token/revoke time",
+        endpoint: "token/revoke",
+        failure: outcome.failure,
     });
     return false;
 };

package/dist/oauth/crypto/clientauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientauth.js","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQxD,iEAAiE;AACjE,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAU,EAAE,CACpD,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEhD,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAqB,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACzD,MAAM,EAAE,2BAA2B,CAAC,KAAK;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAgB,EAChB,IAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI;KAChG,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAS1D,sEAAsE;AACtE,MAAM,aAAa,GAAG,GAAa,EAAE,CACnC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;AAElE,uFAAuF;AACvF,MAAM,oBAAoB,GAAG,KAAK,EAChC,EAAE,IAAI,EAAE,OAAO,EAAqB,EACpC,MAAc,EACK,EAAE;IACrB,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA0B,EAC1B,MAAc,EACK,EAAE;IACrB,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IACtD,MAAM,qBAAqB,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,EAAE,EAC1C,IAAI,EACJ,OAAO,EACP,OAAO,GACW,EAAoB,EAAE;IACxC,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7F,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1E,IAAI,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,cAAc,CAAC,OAAO,EAAE;QAC5B,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,0DAA0D;KACnE,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,2BAA2B,GAAG,KAAK,EACvC,OAA0B,EACA,EAAE;IAC5B,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,MAAM,4BAA4B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,oBAAoB,CACzB,OAAO,EACP,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,KAAK,EAC/B,OAA0B,EAC1B,MAAc,EACd,UAAkD,EACxB,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,CAClD,MAAM,EACN,MAAM,IAAI,iBAAiB,EAC3B,gBAAgB,CACjB,CAAC;IACF,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CACzB,OAAO,EACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,qBAAqB,CAClF,CAAC;AACJ,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA0B,EAC1B,MAAc,EACd,YAAyC,EACf,EAAE;IAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,oBAAoB,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,oBAAoB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,yBAAyB,GAAG,KAAK,EACrC,OAA0B,EAC1B,UAA4B,EACF,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,IAAI,QAAQ,KAAK,2BAA2B,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,wEAAwE;IACxE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,OAAO,KAAK,EAAE,UAAU;QACtB,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC;QAC7D,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAA2B,EAC3B,OAAgB,EACU,EAAE;IAC5B,MAAM,OAAO,GAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IACjF,OAAO,UAAU;QACf,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,CAAC;QAChD,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC"}
+{"version":3,"file":"clientauth.js","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQxD,iEAAiE;AACjE,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAU,EAAE,CACpD,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEhD,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAqB,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACzD,MAAM,EAAE,2BAA2B,CAAC,KAAK;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAgB,EAChB,IAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI;KAChG,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAS1D,sEAAsE;AACtE,MAAM,aAAa,GAAG,GAAa,EAAE,CACnC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;AAElE,uFAAuF;AACvF,MAAM,oBAAoB,GAAG,KAAK,EAChC,EAAE,IAAI,EAAE,OAAO,EAAqB,EACpC,MAAc,EACK,EAAE;IACrB,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA0B,EAC1B,MAAc,EACK,EAAE;IACrB,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IACtD,MAAM,qBAAqB,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,EAAE,EAC1C,IAAI,EACJ,OAAO,EACP,OAAO,GACW,EAAoB,EAAE;IACxC,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7F,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1E,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,IAAI,KAAK,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,gBAAgB,CAAC,OAAO,EAAE;QAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,2BAA2B,GAAG,KAAK,EACvC,OAA0B,EACA,EAAE;IAC5B,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,MAAM,4BAA4B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,oBAAoB,CACzB,OAAO,EACP,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,KAAK,EAC/B,OAA0B,EAC1B,MAAc,EACd,UAAkD,EACxB,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,CAClD,MAAM,EACN,MAAM,IAAI,iBAAiB,EAC3B,gBAAgB,CACjB,CAAC;IACF,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CACzB,OAAO,EACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,qBAAqB,CAClF,CAAC;AACJ,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA0B,EAC1B,MAAc,EACd,YAAyC,EACf,EAAE;IAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,oBAAoB,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,oBAAoB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,yBAAyB,GAAG,KAAK,EACrC,OAA0B,EAC1B,UAA4B,EACF,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,IAAI,QAAQ,KAAK,2BAA2B,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,wEAAwE;IACxE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,OAAO,KAAK,EAAE,UAAU;QACtB,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC;QAC7D,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAA2B,EAC3B,OAAgB,EACU,EAAE;IAC5B,MAAM,OAAO,GAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IACjF,OAAO,UAAU;QACf,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,CAAC;QAChD,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC"}

package/dist/oauth/endpoints/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAKV,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAiPrB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAuClB,CAAC"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAKV,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAqQrB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAuClB,CAAC"}

package/dist/oauth/endpoints/authorize.js

@@ -1,7 +1,7 @@
 import { GET_ONLY, requireHttpMethod } from "../../http/http.js";
-import { auditLegacyKeyUsage } from "../audit.js";
-import { cimdFetchOpts, isCimdClientId, resolveCimdClient } from "../cimd/cimd.js";
-import { advertisedScopes, defaultScopes, oauthError, registeredClientsRequired, resolveSecrets, unregisteredClientError, } from "../config.js";
+import { auditCimdFailure, auditLegacyKeyUsage } from "../audit.js";
+import { cimdFetchOpts, isCimdClientId, resolveCimdOutcome } from "../cimd/cimd.js";
+import { advertisedScopes, defaultScopes, oauthError, registeredClientsRequired, resolveSecrets, unregisteredClientError, unregisteredClientsAllowed, } from "../config.js";
 import { OAUTH_ERRORS } from "../constants.js";
 import { issueAuthCode } from "../crypto/codes.js";
 import { unsealAny } from "../crypto/sealed.js";
@@ -51,11 +51,21 @@ const redirectToLogin = (request, url, options) => {
  */
 const resolveAuthorizeClient = async (options, clientId, secrets) => {
     const registered = (await options.ports.clientStore?.get(clientId)) ?? null;
+    // A router that does not serve unknown clients (no `/register` route, and
+    // `/token` rejects any id `clientStore` does not know) must not honour a
+    // sealed DCR assertion minted by a sibling instance sharing the codeSecret,
+    // nor fetch a CIMD document, for a client it would reject one step later.
+    if (!registered && !unregisteredClientsAllowed(options)) {
+        const rejection = unregisteredClientError(options, {
+            code: OAUTH_ERRORS.unauthorizedClient,
+            status: 400,
+        });
+        if (rejection)
+            return rejection;
+    }
     const assertion = registered ? null : await unsealClientAssertion(options, clientId, secrets);
     const isCimdId = options.cimd === true && isCimdClientId(clientId);
-    const cimdDoc = !registered && !assertion && isCimdId
-        ? await resolveCimdClient(clientId, cimdFetchOpts(options))
-        : null;
+    const cimdDoc = !registered && !assertion && isCimdId ? await resolveCimdDocument(options, clientId) : null;
     if (!registered && !assertion && !cimdDoc) {
         const unknown = unknownClientError(options, isCimdId);
         if (unknown)
@@ -66,6 +76,14 @@ const resolveAuthorizeClient = async (options, clientId, secrets) => {
         boundRedirectUris: registered?.redirectUris ?? assertion?.redirectUris ?? cimdDoc?.redirect_uris ?? null,
     };
 };
+/** The CIMD document for `clientId`, auditing (not surfacing) why it could not be resolved. */
+const resolveCimdDocument = async (options, clientId) => {
+    const outcome = await resolveCimdOutcome(clientId, cimdFetchOpts(options));
+    if ("doc" in outcome)
+        return outcome.doc;
+    await auditCimdFailure(options, { clientId, endpoint: "authorize", failure: outcome.failure });
+    return null;
+};
 /** This server's own `/register` assertion for `clientId`, auditing a legacy-key unseal. */
 const unsealClientAssertion = async (options, clientId, secrets) => {
     const unsealed = await unsealAny(secrets, "client", clientId);

package/dist/oauth/endpoints/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAiC,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQlF,OAAO,EAAiB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhF,oFAAoF;AACpF,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CACtB,WAAmB,EACnB,iBAAkC,EAClC,SAA+C,EACtC,EAAE;IACX,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,OAAO,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAQ,EAAE,OAA2B,EAAY,EAAE;IAC5F,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC;AAOF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACF,EAAE;IACvC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,OAAO,GACX,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,QAAQ;QACnC,CAAC,CAAC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,UAAU;QACV,iBAAiB,EACf,UAAU,EAAE,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,IAAI,IAAI;KACxF,CAAC;AACJ,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACN,EAAE;IACnC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,mBAAmB,CAAC,OAAO,EAAE;QACjC,QAAQ;QACR,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,MAAM,EAAE,2BAA2B;KACpC,CAAC,CAAC;IACH,OAAO,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;AACjC,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,CAAC,OAA2B,EAAE,QAAiB,EAAmB,EAAE;IAC7F,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,EAAE;QACpD,IAAI,EAAE,YAAY,CAAC,kBAAkB;QACrC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,CACzB,QAAkB,EAClB,iBAAkC,EAClC,OAA2B,EACV,EAAE;IACnB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,yBAAyB,gBAAgB,aAAa,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAcF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAC1B,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAoB,EACrD,OAA2B,EACW,EAAE;IACxC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAY,EAAE,CACpE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,YAAY,CAAC,uBAAuB,EAAE,4BAA4B,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,YAAY,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,aAAa,CAClB,YAAY,CAAC,cAAc,EAC3B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClG,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAEvF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC,CAAC;AAUF,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAAmC,EACnC,OAAuC,EACvC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAyB,EACnE,EAAE;IACrB,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,aAAa;QACb,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;KAC5B,CAAC;IAEF,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,aAAa,CAAC,OAAO,EAAE;QAC5B,QAAQ;QACR,gBAAgB,EAAE,UAAU;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,gBAAgB;QAC1B,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClF,IAAI,gBAAgB,YAAY,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC;IAE3D,MAAM,QAAQ,GAAa;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QACvD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC/E,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAqB,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,SAAS,YAAY,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzD,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QAC7C,GAAG,SAAS;QACZ,OAAO;QACP,QAAQ;QACR,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAiC,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQlF,OAAO,EAAiB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhF,oFAAoF;AACpF,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CACtB,WAAmB,EACnB,iBAAkC,EAClC,SAA+C,EACtC,EAAE;IACX,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,OAAO,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAQ,EAAE,OAA2B,EAAY,EAAE;IAC5F,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC;AAOF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACF,EAAE;IACvC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE;YACjD,IAAI,EAAE,YAAY,CAAC,kBAAkB;YACrC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,OAAO,GACX,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9F,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,UAAU;QACV,iBAAiB,EACf,UAAU,EAAE,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,IAAI,IAAI;KACxF,CAAC;AACJ,CAAC,CAAC;AAEF,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,KAAK,EAC/B,OAA2B,EAC3B,QAAgB,EACc,EAAE;IAChC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,KAAK,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACzC,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACN,EAAE;IACnC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,mBAAmB,CAAC,OAAO,EAAE;QACjC,QAAQ;QACR,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,MAAM,EAAE,2BAA2B;KACpC,CAAC,CAAC;IACH,OAAO,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;AACjC,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,CAAC,OAA2B,EAAE,QAAiB,EAAmB,EAAE;IAC7F,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,EAAE;QACpD,IAAI,EAAE,YAAY,CAAC,kBAAkB;QACrC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,CACzB,QAAkB,EAClB,iBAAkC,EAClC,OAA2B,EACV,EAAE;IACnB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,yBAAyB,gBAAgB,aAAa,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAcF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAC1B,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAoB,EACrD,OAA2B,EACW,EAAE;IACxC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAY,EAAE,CACpE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,YAAY,CAAC,uBAAuB,EAAE,4BAA4B,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,YAAY,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,aAAa,CAClB,YAAY,CAAC,cAAc,EAC3B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClG,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAEvF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC,CAAC;AAUF,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAAmC,EACnC,OAAuC,EACvC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAyB,EACnE,EAAE;IACrB,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,aAAa;QACb,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;KAC5B,CAAC;IAEF,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,aAAa,CAAC,OAAO,EAAE;QAC5B,QAAQ;QACR,gBAAgB,EAAE,UAAU;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,gBAAgB;QAC1B,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClF,IAAI,gBAAgB,YAAY,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC;IAE3D,MAAM,QAAQ,GAAa;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QACvD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC/E,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAqB,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,SAAS,YAAY,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzD,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QAC7C,GAAG,SAAS;QACZ,OAAO;QACP,QAAQ;QACR,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/endpoints/consent-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent-page.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent-page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA+BlD,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,GAAI,OAAO,cAAc,KAAG,QAmC5D,CAAC"}
+{"version":3,"file":"consent-page.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent-page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAsElD,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,GAAI,OAAO,cAAc,KAAG,QAmC5D,CAAC"}

package/dist/oauth/endpoints/consent-page.js

@@ -7,6 +7,38 @@ const ESCAPE_HTML = {
     "'": "'",
 };
 const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ESCAPE_HTML[ch] ?? ch);
+/**
+ * CSP source for the redirect target. A custom-scheme URI (`myapp://cb`, from
+ * `extraRedirectUris`) has the opaque origin `"null"`, which names no source
+ * at all — allow its scheme instead, or the browser blocks the redirect.
+ */
+const formActionSource = (redirectUri) => {
+    const { origin, protocol } = new URL(redirectUri);
+    const source = origin === "null" ? protocol : origin;
+    return isSafeCspSource(source) ? source : null;
+};
+/** `scheme:`, `scheme://host[:port]` or `scheme://[v6][:port]` — nothing that could end a directive. */
+const SAFE_CSP_SOURCE = /^[a-z][a-z0-9+.-]*:(?:\/\/(?:[a-z0-9._-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?)?$/;
+/**
+ * Schemes that must never be granted as a `form-action` source: each runs
+ * script, or reads or writes content under the page's own authority.
+ */
+const FORBIDDEN_CSP_SCHEMES = new Set([
+    "javascript:",
+    "data:",
+    "file:",
+    "blob:",
+    "about:",
+    "filesystem:",
+]);
+/**
+ * The CSP grammar is not the URL grammar: a host can legally carry `;`, `,`
+ * or `'` (`https://a.com;sandbox`), which `new URL` keeps and a header
+ * builder would turn into a second directive. Anything that is not a plain
+ * scheme or scheme + host source is dropped — `'self'` alone then blocks the
+ * redirect back, which fails closed.
+ */
+const isSafeCspSource = (source) => SAFE_CSP_SOURCE.test(source) && !FORBIDDEN_CSP_SCHEMES.has(source);
 /**
  * `form-action` governs where a form (and the redirect chain it triggers)
  * may end up — not just the immediate POST target. Chromium enforces it on
@@ -18,7 +50,8 @@ const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ESCAPE_HTML[ch]
  */
 const consentSecurityHeaders = (redirectUri) => ({
     "Content-Security-Policy": `default-src 'none'; style-src 'unsafe-inline'; ` +
-        `form-action 'self' ${new URL(redirectUri).origin}; frame-ancestors 'none'`,
+        `form-action ${["'self'", formActionSource(redirectUri)].filter(Boolean).join(" ")}; ` +
+        `frame-ancestors 'none'`,
     "X-Frame-Options": "DENY",
     "Referrer-Policy": "no-referrer",
     "Cache-Control": "no-store",

package/dist/oauth/endpoints/consent-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-page.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent-page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAI1F,MAAM,WAAW,GAA2B;IAC1C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,CAAC,WAAmB,EAA0B,EAAE,CAAC,CAAC;IAC/E,yBAAyB,EACvB,iDAAiD;QACjD,sBAAsB,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,0BAA0B;IAC7E,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAY,EAAE;IACtE,MAAM,IAAI,GAAG;;;;;;;;;;;;;;aAcF,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;6BAEV,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;sBACpC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;yBAC1C,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;8BAErB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;sDACH,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;;;;;QAKtE,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC;SAC7C;KACF,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"consent-page.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/consent-page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAI1F,MAAM,WAAW,GAA2B;IAC1C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAiB,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC,CAAC;AAEF,wGAAwG;AACxG,MAAM,eAAe,GACnB,4EAA4E,CAAC;AAE/E;;;GAGG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,aAAa;IACb,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,CAAC,MAAc,EAAW,EAAE,CAClD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,CAAC,WAAmB,EAA0B,EAAE,CAAC,CAAC;IAC/E,yBAAyB,EACvB,iDAAiD;QACjD,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QACtF,wBAAwB;IAC1B,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAY,EAAE;IACtE,MAAM,IAAI,GAAG;;;;;;;;;;;;;;aAcF,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;6BAEV,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;sBACpC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;yBAC1C,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;8BAErB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;sDACH,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;;;;;QAKtE,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC;SAC7C;KACF,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/endpoints/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AA+G9D,eAAO,MAAM,WAAW,GACtB,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAgClB,CAAC"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAoH9D,eAAO,MAAM,WAAW,GACtB,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAgClB,CAAC"}

package/dist/oauth/endpoints/token.js

@@ -1,4 +1,5 @@
 import { NO_CORS, POST_ONLY, requireHttpMethod } from "../../http/http.js";
+import { ownValue } from "../../util/own.js";
 import { auditLegacyKeyUsage } from "../audit.js";
 import { advertisedScopes, oauthError, resolveSecrets, tokenResponse } from "../config.js";
 import { GRANT_TYPES, OAUTH_ERRORS } from "../constants.js";
@@ -23,6 +24,11 @@ const handleRefresh = async ({ body, options, expectedResource, clientId }) => {
     let requestedScope;
     if (body.scope !== undefined && body.scope !== "") {
         const requested = requestedScopes(body.scope, []);
+        // `scope=" "` parses to nothing: an omitted scope keeps the original grant,
+        // so a whitespace-only one must not reach the port as `""` for it to guess.
+        if (requested.length === 0) {
+            return oauthError(OAUTH_ERRORS.invalidScope, 400, "scope must not be empty");
+        }
         const scopeError = firstScopeError(requested, advertisedScopes(options));
         if (scopeError)
             return scopeError;
@@ -104,7 +110,7 @@ export const handleToken = async (request, options) => {
         return clientAuthError;
     const url = new URL(request.url);
     const expectedResource = canonicalResource(url.origin, options.resourcePath);
-    const handler = GRANT_HANDLERS[body.grant_type ?? ""];
+    const handler = ownValue(GRANT_HANDLERS, body.grant_type ?? "");
     if (!handler) {
         const supported = [GRANT_TYPES.authorizationCode];
         if (options.ports.refreshAccessToken) {

package/dist/oauth/endpoints/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAkB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAuB,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAcnF,MAAM,aAAa,GAAiB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC1F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,+EAA+E;IAC/E,IAAI,cAAkC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,sGAAsG;IACtG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACpD,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IACD,4EAA4E;IAC5E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAAsB,EACtB,IAA4B,EAC5B,QAAgB,EACC,EAAE;IACnB,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACpD,WAAW,EAAE,uBAAuB;SACrC;QACD;YACE,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAChC,WAAW,EAAE,oBAAoB;SAClC;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiB,KAAK,EAAE,EAC1C,OAAO,EACP,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;QACvE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACtC,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiC;IACnD,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc;IAC/C,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;QACb,OAAO;QACP,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAkB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAuB,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAcnF,MAAM,aAAa,GAAiB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC1F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,+EAA+E;IAC/E,IAAI,cAAkC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,sGAAsG;IACtG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACpD,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IACD,4EAA4E;IAC5E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAAsB,EACtB,IAA4B,EAC5B,QAAgB,EACC,EAAE;IACnB,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACpD,WAAW,EAAE,uBAAuB;SACrC;QACD;YACE,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAChC,WAAW,EAAE,oBAAoB;SAClC;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiB,KAAK,EAAE,EAC1C,OAAO,EACP,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;QACvE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACtC,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiC;IACnD,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc;IAC/C,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;QACb,OAAO;QACP,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/policy/redirect.d.ts

@@ -1,4 +1,10 @@
 export declare const CLAUDE_CALLBACK = "https://claude.ai/api/mcp/auth_callback";
+/**
+ * ChatGPT's stable connector redirect. The callback-specific form
+ * (`https://chatgpt.com/connector/oauth/{id}`) cannot be listed ahead of time;
+ * a CIMD client binds it through its document instead.
+ */
+export declare const CHATGPT_CALLBACK = "https://chatgpt.com/connector_platform_oauth_redirect";
 export type RedirectAllowlistOptions = {
     /** Extra exact-match redirect URIs. */
     extra?: string[];

package/dist/oauth/policy/redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4CAA4C,CAAC;AAEzE,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAuCF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,EACX,UAAS,wBAA6B,KACrC,OAGF,CAAC"}
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4CAA4C,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,0DAA0D,CAAC;AAExF,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAuCF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,EACX,UAAS,wBAA6B,KACrC,OAGF,CAAC"}

package/dist/oauth/policy/redirect.js

@@ -1,4 +1,10 @@
 export const CLAUDE_CALLBACK = "https://claude.ai/api/mcp/auth_callback";
+/**
+ * ChatGPT's stable connector redirect. The callback-specific form
+ * (`https://chatgpt.com/connector/oauth/{id}`) cannot be listed ahead of time;
+ * a CIMD client binds it through its document instead.
+ */
+export const CHATGPT_CALLBACK = "https://chatgpt.com/connector_platform_oauth_redirect";
 const isClaudeCallback = (uri, options) => options.allowClaude !== false && uri === CLAUDE_CALLBACK;
 const isExtraAllowed = (uri, options) => Boolean(options.extra?.includes(uri));
 /**

package/dist/oauth/policy/redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAkBzE,MAAM,gBAAgB,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC;AAE3D,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAElG;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAwB,CAAC,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAEpG,8FAA8F;AAC9F,MAAM,4BAA4B,GAAG,CAAC,GAAW,EAAW,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAW,EACX,UAAoC,EAAE,EAC7B,EAAE;IACX,IAAI,4BAA4B,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AAkBxF,MAAM,gBAAgB,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC;AAE3D,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAElG;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAwB,CAAC,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAEpG,8FAA8F;AAC9F,MAAM,4BAA4B,GAAG,CAAC,GAAW,EAAW,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAW,EACX,UAAoC,EAAE,EAC7B,EAAE;IACX,IAAI,4BAA4B,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}

package/dist/oauth/policy/reqbody.d.ts

@@ -4,7 +4,12 @@
  * `/token` must not get a misleading `token required` and assume the token
  * is dead.
  */
-/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
+/**
+ * JSON when the *media type* is `application/json` (parameters such as
+ * `charset` are ignored); form-encoded otherwise (the RFC 6749 default). A
+ * substring match would also take `text/plain; x=application/json`, a
+ * "simple" content type a cross-site page can send without a preflight.
+ */
 export declare const readOAuthBody: (request: Request) => Promise<Record<string, string>>;
 /**
  * Runs `read` and turns its two failure modes into the `Response` every

package/dist/oauth/policy/reqbody.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reqbody.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyCH,uFAAuF;AACvF,eAAO,MAAM,aAAa,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGpF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,EACrC,MAAM,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,uBAAsB,MAAoC,KACzD,OAAO,CAAC,CAAC,GAAG,QAAQ,CAStB,CAAC"}
+{"version":3,"file":"reqbody.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyCH;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGpF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,EACrC,MAAM,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,uBAAsB,MAAoC,KACzD,OAAO,CAAC,CAAC,GAAG,QAAQ,CAStB,CAAC"}

package/dist/oauth/policy/reqbody.js

@@ -41,10 +41,15 @@ const readFormBody = async (request) => {
     }
     return body;
 };
-/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
+/**
+ * JSON when the *media type* is `application/json` (parameters such as
+ * `charset` are ignored); form-encoded otherwise (the RFC 6749 default). A
+ * substring match would also take `text/plain; x=application/json`, a
+ * "simple" content type a cross-site page can send without a preflight.
+ */
 export const readOAuthBody = async (request) => {
-    const ctype = request.headers.get("Content-Type") ?? "";
-    return ctype.includes("application/json") ? readJsonBody(request) : readFormBody(request);
+    const mediaType = (request.headers.get("Content-Type") ?? "").split(";")[0]?.trim().toLowerCase();
+    return mediaType === "application/json" ? readJsonBody(request) : readFormBody(request);
 };
 /**
  * Runs `read` and turns its two failure modes into the `Response` every

package/dist/oauth/policy/reqbody.js.map

@@ -1 +1 @@
-{"version":3,"file":"reqbody.js","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAsB,EACtB,uBAA+B,YAAY,CAAC,cAAc,EACnC,EAAE;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"reqbody.js","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACvF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClG,OAAO,SAAS,KAAK,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC1F,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAsB,EACtB,uBAA+B,YAAY,CAAC,cAAc,EACnC,EAAE;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CAAC"}