mcp-trellis 2.2.0 → 3.1.0

package/dist/oauth/cimd/cimd-ssrf.d.ts

@@ -1,8 +1,12 @@
 /**
- * SSRF guards for CIMD URL fetch: hostname normalization, private/NAT64
- * IP blocks, and DNS lookup before connect.
+ * SSRF address policy for CIMD URL fetch: hostname normalization and
+ * private/NAT64 IP blocks. `url-guard.ts` applies it before connect.
  */
+/** Strip WHATWG brackets from IPv6 hostnames (`[::1]` → `::1`). */
+export declare const normalizeHostname: (hostname: string) => string;
+export declare const isBlockedIp: (ip: string) => boolean;
+export declare const isBlockedHostname: (hostname: string) => boolean;
 export declare const isLoopbackHostname: (hostname: string) => boolean;
-export declare const defaultLookup: (hostname: string) => Promise<string[]>;
-export declare const assertSafeUrl: (url: URL, lookup: (hostname: string) => Promise<string[]>) => Promise<void>;
+/** A canonical IPv4 or well-formed IPv6 literal — nothing for DNS to resolve. */
+export declare const isIpLiteral: (hostname: string) => boolean;
 //# sourceMappingURL=cimd-ssrf.d.ts.map

package/dist/oauth/cimd/cimd-ssrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd-ssrf.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoLH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,OAEL,CAAC;AAElD,eAAO,MAAM,aAAa,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAQtE,CAAC;AAiBF,eAAO,MAAM,aAAa,GACxB,KAAK,GAAG,EACR,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,KAC9C,OAAO,CAAC,IAAI,CASd,CAAC"}
+{"version":3,"file":"cimd-ssrf.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,KAAG,MAGpD,CAAC;AAsJF,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,OAaxC,CAAC;AAKF,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,KAAG,OAKpD,CAAC;AAIF,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,OAEL,CAAC;AAElD,iFAAiF;AACjF,eAAO,MAAM,WAAW,GAAI,UAAU,MAAM,KAAG,OAG9C,CAAC"}

package/dist/oauth/cimd/cimd-ssrf.js

@@ -1,9 +1,9 @@
 /**
- * SSRF guards for CIMD URL fetch: hostname normalization, private/NAT64
- * IP blocks, and DNS lookup before connect.
+ * SSRF address policy for CIMD URL fetch: hostname normalization and
+ * private/NAT64 IP blocks. `url-guard.ts` applies it before connect.
  */
 /** Strip WHATWG brackets from IPv6 hostnames (`[::1]` → `::1`). */
-const normalizeHostname = (hostname) => {
+export const normalizeHostname = (hostname) => {
     const host = hostname.toLowerCase().replace(/\.$/, "");
     return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
 };
@@ -103,7 +103,7 @@ const expandIpv6Hextets = (ip) => {
 const isNonCanonicalIpv4 = (v4) => IPV4_CANDIDATE.test(v4) && !DOTTED_QUAD.test(v4);
 const isPrivateDottedQuad = (v4) => DOTTED_QUAD.test(v4) && isPrivateV4(v4);
 const IPV6_BLOCKED_EXACT = new Set(["::1", "::"]);
-const IPV6_BLOCKED_PREFIXES = ["fe80:", "::ffff:"];
+const IPV6_BLOCKED_PREFIXES = ["::ffff:"];
 /** ULA fc00::/7 and multicast ff00::/8. */
 const IPV6_BLOCKED_PREFIX_RES = [/^f[cd][0-9a-f]{2}:/i, /^ff[0-9a-f]{0,2}:/];
 const isBlockedIpv6Literal = (ip) => IPV6_BLOCKED_EXACT.has(ip) ||
@@ -124,10 +124,13 @@ const isBlockedIpv4Compatible = (n, raw) => {
 const HEXTET_BLOCK_RULES = [
     isIpv4MappedHextets,
     isBlockedIpv4Compatible,
+    (n) => ((n[0] ?? 0) & 0xffc0) === 0xfe80, // link-local fe80::/10 (fe80–febf)
+    (n) => ((n[0] ?? 0) & 0xffc0) === 0xfec0, // deprecated site-local fec0::/10
+    (n) => n[0] === 0x2001 && n[1] === 0, // Teredo 2001::/32
     (n) => n[0] === 0x2002, // 6to4 2002::/16
     (n) => n[0] === 0x64 && n[1] === 0xff9b, // NAT64 64:ff9b::/96
 ];
-const isBlockedIp = (ip) => {
+export const isBlockedIp = (ip) => {
     const normalized = normalizeHostname(ip);
     const v4 = expandIpv4Mapped(normalized) ?? normalized;
     if (isNonCanonicalIpv4(v4) || isPrivateDottedQuad(v4))
@@ -144,7 +147,7 @@ const isBlockedIp = (ip) => {
 };
 const BLOCKED_HOST_EXACT = new Set(["localhost"]);
 const BLOCKED_HOST_SUFFIXES = [".localhost", ".local"];
-const isBlockedHostname = (hostname) => {
+export const isBlockedHostname = (hostname) => {
     const host = normalizeHostname(hostname);
     if (BLOCKED_HOST_EXACT.has(host))
         return true;
@@ -156,38 +159,9 @@ const LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1"]);
 export const isLoopbackHostname = (hostname) => 
 // `localhost` deliberately excluded — RFC 8252 §8.3, same as policy/redirect.ts.
 LOOPBACK_HOSTS.has(normalizeHostname(hostname));
-export const defaultLookup = async (hostname) => {
-    try {
-        const dns = await import("node:dns/promises");
-        const results = await dns.lookup(hostname, { all: true, verbatim: true });
-        return results.map((r) => r.address);
-    }
-    catch {
-        throw new Error("CIMD DNS lookup unavailable");
-    }
-};
-const URL_SAFETY = {
-    https: {
-        ok: (url) => url.protocol === "https:",
-        error: "CIMD client_id must be https",
-    },
-    noCredentials: {
-        ok: (url) => !url.username && !url.password,
-        error: "CIMD URL must not carry credentials",
-    },
-    publicHostname: {
-        ok: (url) => !isBlockedHostname(url.hostname),
-        error: "CIMD hostname is not publicly routable",
-    },
-};
-export const assertSafeUrl = async (url, lookup) => {
-    for (const rule of Object.values(URL_SAFETY)) {
-        if (!rule.ok(url))
-            throw new Error(rule.error);
-    }
-    const addrs = await lookup(normalizeHostname(url.hostname));
-    if (addrs.length === 0 || addrs.some(isBlockedIp)) {
-        throw new Error("CIMD resolved to a non-public address");
-    }
+/** A canonical IPv4 or well-formed IPv6 literal — nothing for DNS to resolve. */
+export const isIpLiteral = (hostname) => {
+    const host = normalizeHostname(hostname);
+    return DOTTED_QUAD.test(host) || expandIpv6Hextets(host) !== null;
 };
 //# sourceMappingURL=cimd-ssrf.js.map

package/dist/oauth/cimd/cimd-ssrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"cimd-ssrf.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,oFAAoF;AACpF,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,MAAM,YAAY,GAAG;IACnB,MAAM;IACN,OAAO;IACP,QAAQ;IACR,aAAa;IACb,6BAA6B;IAC7B,aAAa;IACb,2CAA2C;IAC3C,+DAA+D;IAC/D,cAAc;IACd,eAAe;IACf,0DAA0D;IAC1D,gCAAgC;CACjC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpF,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAiB,EAAE;IACrD,MAAM,MAAM,GAAG,0CAA0C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAErC,MAAM,SAAS,GAAG,gDAAgD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;AACzE,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAElC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAiB,EAAE,CAClD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEvD,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAU,EAAiB,EAAE;IACjE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAY,EAAE,CACrD,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAE/C,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAA2B,EAAE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAA0C,CAAC;IAChE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,OAAiB,EAC4D,EAAE,CAC/E,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAmB,EAAE;IACxD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,QAAQ,GAA4B,IAAI,CAAC;IAC7C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC5D,MAAM,OAAO,GAAG;YACd,GAAG,SAAS;YACZ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;YAC7C,GAAG,SAAS;YACZ,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC,CAAC;AAEF,oDAAoD;AAEpD,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAW,EAAE,CACjD,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEnD,MAAM,mBAAmB,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;AAE7F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACnD,2CAA2C;AAC3C,MAAM,uBAAuB,GAAG,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AAE7E,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAW,EAAE,CACnD,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,uBAAuB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpD,MAAM,eAAe,GAAG,CAAC,CAAW,EAAW,EAAE,CAC/C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAErE,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;AAE5F,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,CAAC,CAAW,EAAE,GAAa,EAAW,EAAE;IACtE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAmD;IACzE,mBAAmB;IACnB,uBAAuB;IACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,iBAAiB;IACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,qBAAqB;CAC/D,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;IAEtD,IAAI,kBAAkB,CAAC,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,oBAAoB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IAEzD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAEvD,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAW,EAAE;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE;AAC9D,iFAAiF;AACjF,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAqB,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAiE;IAC/E,KAAK,EAAE;QACL,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACtC,KAAK,EAAE,8BAA8B;KACtC;IACD,aAAa,EAAE;QACb,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC3C,KAAK,EAAE,qCAAqC;KAC7C;IACD,cAAc,EAAE;QACd,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7C,KAAK,EAAE,wCAAwC;KAChD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,GAAQ,EACR,MAA+C,EAChC,EAAE;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"cimd-ssrf.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD,oFAAoF;AACpF,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,MAAM,YAAY,GAAG;IACnB,MAAM;IACN,OAAO;IACP,QAAQ;IACR,aAAa;IACb,6BAA6B;IAC7B,aAAa;IACb,2CAA2C;IAC3C,+DAA+D;IAC/D,cAAc;IACd,eAAe;IACf,0DAA0D;IAC1D,gCAAgC;CACjC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpF,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAiB,EAAE;IACrD,MAAM,MAAM,GAAG,0CAA0C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAErC,MAAM,SAAS,GAAG,gDAAgD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;AACzE,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAElC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAiB,EAAE,CAClD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEvD,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAU,EAAiB,EAAE;IACjE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAY,EAAE,CACrD,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAE/C,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAA2B,EAAE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAA0C,CAAC;IAChE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,OAAiB,EAC4D,EAAE,CAC/E,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAmB,EAAE;IACxD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,QAAQ,GAA4B,IAAI,CAAC;IAC7C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAC5D,MAAM,OAAO,GAAG;YACd,GAAG,SAAS;YACZ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;YAC7C,GAAG,SAAS;YACZ,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC,CAAC;AAEF,oDAAoD;AAEpD,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAW,EAAE,CACjD,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEnD,MAAM,mBAAmB,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;AAE7F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,SAAS,CAAC,CAAC;AAC1C,2CAA2C;AAC3C,MAAM,uBAAuB,GAAG,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AAE7E,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAW,EAAE,CACnD,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,uBAAuB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpD,MAAM,eAAe,GAAG,CAAC,CAAW,EAAW,EAAE,CAC/C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAErE,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;AAE5F,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,CAAC,CAAW,EAAE,GAAa,EAAW,EAAE;IACtE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAmD;IACzE,mBAAmB;IACnB,uBAAuB;IACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,mCAAmC;IAC7E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,kCAAkC;IAC5E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,mBAAmB;IACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,iBAAiB;IACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,qBAAqB;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE;IACjD,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;IAEtD,IAAI,kBAAkB,CAAC,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,oBAAoB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IAEzD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC7D,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE;AAC9D,iFAAiF;AACjF,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAElD,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAW,EAAE;IACvD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACpE,CAAC,CAAC"}

package/dist/oauth/cimd/cimd.d.ts

@@ -1,25 +1,13 @@
 /**
  * Client ID Metadata Documents (CIMD) — HTTPS URL `client_id` metadata.
- * Off by default (`cimd: true`). SSRF guards live in `cimd-ssrf.ts`.
+ * Off by default (`cimd: true`). SSRF guards live in `url-guard.ts`.
  *
  * ponytail: DNS checked before/after fetch; TCP connect is not pinned (Web
  * fetch). Upgrade: custom dispatcher dialing the resolved IP + Host header.
  */
-import type { CimdCache, CimdDocument } from "./types.js";
-export type { CimdCache, CimdDocument } from "./types.js";
-export type CimdFetchOptions = {
-    /** Override fetch (tests). Defaults to globalThis.fetch. */
-    fetch?: typeof fetch;
-    cache?: CimdCache;
-    /**
-     * DNS lookup for rebinding checks. When omitted, the library tries
-     * `node:dns/promises.lookup` if available; if that is also unavailable
-     * (e.g. some Workers), resolution is refused rather than fetched blind.
-     */
-    lookup?: (hostname: string) => Promise<string[]>;
-    /** Per-hop timeout covering connect **and** body read. Tests only — default 10 s. */
-    timeoutMs?: number;
-};
+import { type CimdFailure } from "./failure.js";
+import type { CimdCache, CimdDocument, CimdFetchOptions } from "./types.js";
+export type { CimdCache, CimdDocument, CimdFetchOptions } from "./types.js";
 /** Build fetch options from router/app CIMD ports. */
 export declare const cimdFetchOpts: (ports: {
     cimdCache?: CimdCache;
@@ -27,10 +15,18 @@ export declare const cimdFetchOpts: (ports: {
 }) => Pick<CimdFetchOptions, "cache" | "lookup">;
 /** True when `client_id` is an HTTPS URL eligible for CIMD resolution. */
 export declare const isCimdClientId: (clientId: string) => boolean;
+export type CimdOutcome = {
+    doc: CimdDocument;
+} | {
+    failure: CimdFailure;
+};
 /**
  * Fetch and validate a CIMD document for `clientId` (the HTTPS URL itself).
- * Returns null on any validation / network failure — callers map that to
- * `unauthorized_client` without leaking fetch details to the connector.
+ * Never throws for a fetch / validation problem: the failure comes back as a
+ * code for the operator's audit sink, and callers still answer the connector
+ * with one generic `unauthorized_client` — no fetch details leak to it.
  */
+export declare const resolveCimdOutcome: (clientId: string, options?: CimdFetchOptions) => Promise<CimdOutcome>;
+/** `null` on any failure — see `resolveCimdOutcome` for the reason. */
 export declare const resolveCimdClient: (clientId: string, options?: CimdFetchOptions) => Promise<CimdDocument | null>;
 //# sourceMappingURL=cimd.d.ts.map

package/dist/oauth/cimd/cimd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,aAAa,GAAI,OAAO;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,KAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAG3C,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,KAAG,OAajD,CAAC;AAwGF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAC5B,UAAU,MAAM,EAChB,UAAS,gBAAqB,KAC7B,OAAO,CAAC,YAAY,GAAG,IAAI,CAkB7B,CAAC"}
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAa,KAAK,WAAW,EAAuB,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG5E,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAM5E,sDAAsD;AACtD,eAAO,MAAM,aAAa,GAAI,OAAO;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,KAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAG3C,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,KAAG,OAajD,CAAC;AAkHF,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAU,MAAM,EAChB,UAAS,gBAAqB,KAC7B,OAAO,CAAC,WAAW,CAoBrB,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,GAC5B,UAAU,MAAM,EAChB,UAAS,gBAAqB,KAC7B,OAAO,CAAC,YAAY,GAAG,IAAI,CAG7B,CAAC"}

package/dist/oauth/cimd/cimd.js

@@ -1,13 +1,15 @@
 /**
  * Client ID Metadata Documents (CIMD) — HTTPS URL `client_id` metadata.
- * Off by default (`cimd: true`). SSRF guards live in `cimd-ssrf.ts`.
+ * Off by default (`cimd: true`). SSRF guards live in `url-guard.ts`.
  *
  * ponytail: DNS checked before/after fetch; TCP connect is not pinned (Web
  * fetch). Upgrade: custom dispatcher dialing the resolved IP + Host header.
  */
 import { readBoundedText } from "../../http/body.js";
 import { parseCacheMaxAge, parseDocument } from "./cimd-parse.js";
-import { assertSafeUrl, defaultLookup } from "./cimd-ssrf.js";
+import { defaultLookup } from "./dns.js";
+import { CimdError, classifyCimdFailure } from "./failure.js";
+import { assertSafeUrl } from "./url-guard.js";
 const CIMD_MAX_BYTES = 5 * 1024;
 const CIMD_TIMEOUT_MS = 10_000;
 const CIMD_MAX_REDIRECTS = 3;
@@ -32,31 +34,31 @@ export const isCimdClientId = (clientId) => {
 };
 const readCimdBody = async (ctx, response, current) => {
     if (!response.ok)
-        return null;
+        throw new CimdError("http_status", `status ${response.status}`);
     // Stream-capped at CIMD_MAX_BYTES; signal cancels the locked reader on hop
     // timeout (body.cancel() is a no-op while getReader() holds the lock).
-    try {
-        const text = await readBoundedText(response, CIMD_MAX_BYTES, ctx.signal);
-        // Re-check DNS after the body — see file-level ponytail on connect pinning.
-        await assertSafeUrl(current, ctx.lookup);
-        return {
-            doc: parseDocument(ctx.clientId, text),
-            maxAge: parseCacheMaxAge(response.headers.get("cache-control")),
-        };
-    }
-    catch {
-        return null;
-    }
+    const text = await readBoundedText(response, CIMD_MAX_BYTES, ctx.signal);
+    // Re-check DNS after the body — see file-level ponytail on connect pinning.
+    await assertSafeUrl(current, ctx.lookup);
+    return {
+        doc: parseDocument(ctx.clientId, text),
+        maxAge: parseCacheMaxAge(response.headers.get("cache-control")),
+    };
 };
 const followRedirect = async (ctx, response, current) => {
     const location = response.headers.get("location");
-    if (!location || ctx.redirect === CIMD_MAX_REDIRECTS)
-        return null;
+    if (!location)
+        throw new CimdError("redirect_refused", "redirect without Location");
+    // Refused before the target is even looked up.
+    if (ctx.redirect === CIMD_MAX_REDIRECTS) {
+        throw new CimdError("redirect_refused", "too many redirects");
+    }
     const next = new URL(location, current);
     // Same-origin only: a cross-origin hop would let an open redirect on a
     // reputable host vouch for a document the attacker actually serves.
-    if (next.origin !== new URL(ctx.clientId).origin)
-        return null;
+    if (next.origin !== new URL(ctx.clientId).origin) {
+        throw new CimdError("redirect_refused", "cross-origin redirect");
+    }
     await assertSafeUrl(next, ctx.lookup);
     return next;
 };
@@ -79,8 +81,7 @@ const fetchHop = async (settings, current, redirect) => {
     try {
         const response = await getCimdResponse(settings.fetch, current.toString(), controller.signal);
         if (response.status >= 300 && response.status < 400) {
-            const next = await followRedirect(ctx, response, current);
-            return next ? { next } : { done: null };
+            return { next: await followRedirect(ctx, response, current) };
         }
         // `await` keeps the body read inside this try — without it `finally`
         // clears the timer as soon as headers arrive.
@@ -93,40 +94,55 @@ const fetchHop = async (settings, current, redirect) => {
 const fetchCimdDocument = async (settings) => {
     let current = new URL(settings.clientId);
     await assertSafeUrl(current, settings.lookup);
-    for (let redirect = 0; redirect <= CIMD_MAX_REDIRECTS; redirect++) {
+    // Ends: followRedirect refuses any redirect past CIMD_MAX_REDIRECTS.
+    for (let redirect = 0;; redirect += 1) {
         const hop = await fetchHop(settings, current, redirect);
         if ("done" in hop)
             return hop.done;
         current = hop.next;
     }
-    return null;
+};
+/** The document is already valid; a failed write only means the next call re-fetches. */
+const cacheBestEffort = async (cache, clientId, fetched) => {
+    try {
+        await cache.set(clientId, fetched.doc, fetched.maxAge);
+    }
+    catch {
+        // Best-effort by design — see above.
+    }
 };
 /**
  * Fetch and validate a CIMD document for `clientId` (the HTTPS URL itself).
- * Returns null on any validation / network failure — callers map that to
- * `unauthorized_client` without leaking fetch details to the connector.
+ * Never throws for a fetch / validation problem: the failure comes back as a
+ * code for the operator's audit sink, and callers still answer the connector
+ * with one generic `unauthorized_client` — no fetch details leak to it.
  */
-export const resolveCimdClient = async (clientId, options = {}) => {
-    if (!isCimdClientId(clientId))
-        return null;
+export const resolveCimdOutcome = async (clientId, options = {}) => {
+    if (!isCimdClientId(clientId)) {
+        return { failure: { code: "blocked_url", detail: "client_id is not an https URL" } };
+    }
     const cached = options.cache ? await options.cache.get(clientId) : null;
     if (cached)
-        return cached;
+        return { doc: cached };
+    let fetched;
     try {
-        const result = await fetchCimdDocument({
+        fetched = await fetchCimdDocument({
             clientId,
             fetch: options.fetch ?? globalThis.fetch,
             lookup: options.lookup ?? defaultLookup,
             timeoutMs: options.timeoutMs ?? CIMD_TIMEOUT_MS,
         });
-        if (!result)
-            return null;
-        if (options.cache)
-            await options.cache.set(clientId, result.doc, result.maxAge);
-        return result.doc;
     }
-    catch {
-        return null;
+    catch (caught) {
+        return { failure: classifyCimdFailure(caught) };
     }
+    if (options.cache)
+        await cacheBestEffort(options.cache, clientId, fetched);
+    return { doc: fetched.doc };
+};
+/** `null` on any failure — see `resolveCimdOutcome` for the reason. */
+export const resolveCimdClient = async (clientId, options = {}) => {
+    const outcome = await resolveCimdOutcome(clientId, options);
+    return "doc" in outcome ? outcome.doc : null;
 };
 //# sourceMappingURL=cimd.js.map

package/dist/oauth/cimd/cimd.js.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK9D,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAgB7B,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAG7B,EAA8C,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,YAAY,GAAG,KAAK,EACxB,GAAa,EACb,QAAkB,EAClB,OAAY,EACqB,EAAE;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzE,4EAA4E;QAC5E,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO;YACL,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;YACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;SAChE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,GAAa,EACb,QAAkB,EAClB,OAAY,EACS,EAAE;IACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAAuB,EAAE,GAAW,EAAE,MAAmB,EAAE,EAAE,CACpF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;IAClB,MAAM;IACN,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;CACxC,CAAC,CAAC;AAYL,yCAAyC;AACzC,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAuB,EACvB,OAAY,EACZ,QAAgB,EACI,EAAE;IACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,GAAG,GAAa;QACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,qEAAqE;QACrE,8CAA8C;QAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAuB,EAAmC,EAAE;IAC3F,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,kBAAkB,EAAE,QAAQ,EAAE,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACnC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,QAAgB,EAChB,UAA4B,EAAE,EACA,EAAE;IAChC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;YACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAoB,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAI/C,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAG7B,EAA8C,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,YAAY,GAAG,KAAK,EACxB,GAAa,EACb,QAAkB,EAClB,OAAY,EACc,EAAE;IAC5B,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,4EAA4E;IAC5E,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO;QACL,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;QACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAAE,GAAa,EAAE,QAAkB,EAAE,OAAY,EAAgB,EAAE;IAC7F,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,CAAC;IACpF,+CAA+C;IAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAAuB,EAAE,GAAW,EAAE,MAAmB,EAAE,EAAE,CACpF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,QAAQ;IAClB,MAAM;IACN,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;CACxC,CAAC,CAAC;AAYL,yCAAyC;AACzC,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAuB,EACvB,OAAY,EACZ,QAAgB,EACI,EAAE;IACtB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,GAAG,GAAa;QACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAChE,CAAC;QACD,qEAAqE;QACrE,8CAA8C;QAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAuB,EAA4B,EAAE;IACpF,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,qEAAqE;IACrE,KAAK,IAAI,QAAQ,GAAG,CAAC,GAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACnC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF,yFAAyF;AACzF,MAAM,eAAe,GAAG,KAAK,EAC3B,KAAgB,EAChB,QAAgB,EAChB,OAAwB,EACT,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;AACH,CAAC,CAAC;AAIF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAgB,EAChB,UAA4B,EAAE,EACR,EAAE;IACxB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAEnC,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,iBAAiB,CAAC;YAChC,QAAQ;YACR,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;YACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,eAAe;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,QAAgB,EAChB,UAA4B,EAAE,EACA,EAAE;IAChC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC,CAAC"}

package/dist/oauth/cimd/dns.d.ts

@@ -0,0 +1,4 @@
+/** Default DNS resolution for CIMD SSRF checks, across Node and Workers. */
+export declare const dnsErrorCode: (caught: unknown) => string;
+export declare const defaultLookup: (hostname: string) => Promise<string[]>;
+//# sourceMappingURL=dns.d.ts.map

package/dist/oauth/cimd/dns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/dns.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAiB5E,eAAO,MAAM,YAAY,GAAI,QAAQ,OAAO,KAAG,MAG9C,CAAC;AAqBF,eAAO,MAAM,aAAa,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAUtE,CAAC"}

package/dist/oauth/cimd/dns.js

@@ -0,0 +1,45 @@
+/** Default DNS resolution for CIMD SSRF checks, across Node and Workers. */
+import { CimdError } from "./failure.js";
+const importDns = async () => {
+    try {
+        return await import("node:dns/promises");
+    }
+    catch {
+        throw new CimdError("dns_unavailable", "no node:dns on this platform; pass cimdLookup");
+    }
+};
+/** Resolver error codes only (`ENOTFOUND`, `ETIMEOUT`) — never free text from the error. */
+const DNS_ERROR_CODE = /^[A-Z][A-Z0-9_]{0,31}$/;
+export const dnsErrorCode = (caught) => {
+    const code = caught instanceof Error && "code" in caught ? caught.code : undefined;
+    return typeof code === "string" && DNS_ERROR_CODE.test(code) ? code : "unknown";
+};
+/** Workers (nodejs_compat) ships `node:dns` with `lookup` stubbed out to throw. */
+const isLookupNotImplemented = (caught) => caught instanceof Error && /not implemented/i.test(caught.message);
+/**
+ * ponytail: `resolve4`/`resolve6` return A/AAAA only (no hosts file, no
+ * search domains) — enough for a public HTTPS client_id host. Upgrade: a
+ * host-supplied `cimdLookup` backed by its own resolver.
+ */
+const resolveAddresses = async (dns, hostname) => {
+    const settled = await Promise.allSettled([dns.resolve4(hostname), dns.resolve6(hostname)]);
+    const addresses = settled.flatMap((result) => result.status === "fulfilled" ? result.value : []);
+    if (addresses.length > 0)
+        return addresses;
+    const rejected = settled.find((result) => result.status === "rejected");
+    throw new CimdError("dns_failed", `DNS resolution failed (${dnsErrorCode(rejected?.reason)})`);
+};
+export const defaultLookup = async (hostname) => {
+    const dns = await importDns();
+    try {
+        const results = await dns.lookup(hostname, { all: true, verbatim: true });
+        return results.map((r) => r.address);
+    }
+    catch (caught) {
+        if (isLookupNotImplemented(caught))
+            return resolveAddresses(dns, hostname);
+        // url-guard.ts turns any lookup failure into `dns_failed` with its code.
+        throw caught;
+    }
+};
+//# sourceMappingURL=dns.js.map

package/dist/oauth/cimd/dns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns.js","sourceRoot":"","sources":["../../../src/oauth/cimd/dns.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,MAAM,SAAS,GAAG,KAAK,IAAsB,EAAE;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAEhD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAe,EAAU,EAAE;IACtD,MAAM,IAAI,GAAG,MAAM,YAAY,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,sBAAsB,GAAG,CAAC,MAAe,EAAW,EAAE,CAC1D,MAAM,YAAY,KAAK,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAErE;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAqB,EAAE;IACnF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAClD,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IACxE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,0BAA0B,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACjG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAqB,EAAE;IACzE,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,sBAAsB,CAAC,MAAM,CAAC;YAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3E,yEAAyE;QACzE,MAAM,MAAM,CAAC;IACf,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/cimd/failure.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Why a CIMD document could not be resolved. Reasons reach the operator's
+ * audit sink only — the connector always sees one generic error — so a detail
+ * is limited to static text, an HTTP status or a DNS error code: never a
+ * resolved address, a response header or body, or a redirect target.
+ */
+export type CimdFailureCode = "dns_unavailable" | "dns_failed" | "blocked_address" | "blocked_url" | "http_status" | "redirect_refused" | "too_large" | "timeout" | "not_json" | "document_invalid" | "client_id_mismatch" | "auth_method_unsupported" | "redirect_uris_invalid" | "fetch_failed";
+export type CimdFailure = {
+    code: CimdFailureCode;
+    detail?: string;
+};
+export declare class CimdError extends Error {
+    readonly code: CimdFailureCode;
+    constructor(code: CimdFailureCode, message: string);
+}
+/** Maps whatever a fetch attempt threw to a code; unknown errors keep only their class name. */
+export declare const classifyCimdFailure: (caught: unknown) => CimdFailure;
+export declare const formatCimdFailure: ({ code, detail }: CimdFailure) => string;
+//# sourceMappingURL=failure.d.ts.map

package/dist/oauth/cimd/failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/failure.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,aAAa,GACb,kBAAkB,GAClB,WAAW,GACX,SAAS,GACT,UAAU,GACV,kBAAkB,GAClB,oBAAoB,GACpB,yBAAyB,GACzB,uBAAuB,GACvB,cAAc,CAAC;AAEnB,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;gBAEnB,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKnD;AAID,gGAAgG;AAChG,eAAO,MAAM,mBAAmB,GAAI,QAAQ,OAAO,KAAG,WAOrD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,kBAAkB,WAAW,KAAG,MAC5B,CAAC"}

package/dist/oauth/cimd/failure.js

@@ -0,0 +1,31 @@
+/**
+ * Why a CIMD document could not be resolved. Reasons reach the operator's
+ * audit sink only — the connector always sees one generic error — so a detail
+ * is limited to static text, an HTTP status or a DNS error code: never a
+ * resolved address, a response header or body, or a redirect target.
+ */
+import { BodyReadAbortedError, BodyTooLargeError } from "../../http/body.js";
+export class CimdError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "CimdError";
+        this.code = code;
+    }
+}
+const TIMEOUT_ERROR_NAMES = new Set(["AbortError", "TimeoutError"]);
+/** Maps whatever a fetch attempt threw to a code; unknown errors keep only their class name. */
+export const classifyCimdFailure = (caught) => {
+    if (caught instanceof CimdError)
+        return { code: caught.code, detail: caught.message };
+    if (caught instanceof BodyTooLargeError)
+        return { code: "too_large" };
+    // The hop timer is the only thing that aborts a CIMD body read.
+    if (caught instanceof BodyReadAbortedError)
+        return { code: "timeout" };
+    if (caught instanceof Error && TIMEOUT_ERROR_NAMES.has(caught.name))
+        return { code: "timeout" };
+    return { code: "fetch_failed", ...(caught instanceof Error ? { detail: caught.name } : {}) };
+};
+export const formatCimdFailure = ({ code, detail }) => detail ? `${code}: ${detail}` : code;
+//# sourceMappingURL=failure.js.map

package/dist/oauth/cimd/failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure.js","sourceRoot":"","sources":["../../../src/oauth/cimd/failure.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAoB7E,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAkB;IAE/B,YAAY,IAAqB,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAe,EAAE;IAClE,IAAI,MAAM,YAAY,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACtF,IAAI,MAAM,YAAY,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACtE,gEAAgE;IAChE,IAAI,MAAM,YAAY,oBAAoB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,IAAI,MAAM,YAAY,KAAK,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChG,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAe,EAAU,EAAE,CACzE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC"}

package/dist/oauth/cimd/types.d.ts

@@ -1,4 +1,4 @@
-/** CIMD document and cache shapes, shared by the fetcher and the parser. */
+/** CIMD document, cache and fetch-option shapes, shared by the fetcher and the parser. */
 export type CimdDocument = {
     client_id: string;
     redirect_uris: string[];
@@ -9,4 +9,18 @@ export type CimdCache = {
     get: (clientId: string) => Promise<CimdDocument | null> | CimdDocument | null;
     set: (clientId: string, doc: CimdDocument, maxAgeSeconds: number) => Promise<void> | void;
 };
+export type CimdFetchOptions = {
+    /** Override fetch (tests). Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    cache?: CimdCache;
+    /**
+     * DNS lookup for rebinding checks. When omitted, the library uses
+     * `node:dns/promises.lookup`, falling back to `resolve4` / `resolve6` where
+     * `lookup` is stubbed (Workers `nodejs_compat`); with no `node:dns` at all,
+     * resolution is refused rather than fetched blind.
+     */
+    lookup?: (hostname: string) => Promise<string[]>;
+    /** Per-hop timeout covering connect **and** body read. Tests only — default 10 s. */
+    timeoutMs?: number;
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/oauth/cimd/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/types.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3F,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/types.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3F,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC"}

package/dist/oauth/cimd/types.js

@@ -1,3 +1,3 @@
-/** CIMD document and cache shapes, shared by the fetcher and the parser. */
+/** CIMD document, cache and fetch-option shapes, shared by the fetcher and the parser. */
 export {};
 //# sourceMappingURL=types.js.map

package/dist/oauth/cimd/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/oauth/cimd/types.ts"],"names":[],"mappings":"AAAA,4EAA4E"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/oauth/cimd/types.ts"],"names":[],"mappings":"AAAA,0FAA0F"}

package/dist/oauth/cimd/url-guard.d.ts

@@ -0,0 +1,5 @@
+/** Applies the SSRF address policy to a CIMD URL before (and after) it is fetched. */
+type Lookup = (hostname: string) => Promise<string[]>;
+export declare const assertSafeUrl: (url: URL, lookup: Lookup) => Promise<void>;
+export {};
+//# sourceMappingURL=url-guard.d.ts.map

package/dist/oauth/cimd/url-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-guard.d.ts","sourceRoot":"","sources":["../../../src/oauth/cimd/url-guard.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAMtF,KAAK,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAyCtD,eAAO,MAAM,aAAa,GAAU,KAAK,GAAG,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAS1E,CAAC"}

package/dist/oauth/cimd/url-guard.js

@@ -0,0 +1,53 @@
+/** Applies the SSRF address policy to a CIMD URL before (and after) it is fetched. */
+import { isBlockedHostname, isBlockedIp, isIpLiteral, normalizeHostname } from "./cimd-ssrf.js";
+import { dnsErrorCode } from "./dns.js";
+import { CimdError } from "./failure.js";
+const URL_SAFETY = {
+    https: {
+        ok: (url) => url.protocol === "https:",
+        code: "blocked_url",
+        error: "CIMD client_id must be https",
+    },
+    noCredentials: {
+        ok: (url) => !url.username && !url.password,
+        code: "blocked_url",
+        error: "CIMD URL must not carry credentials",
+    },
+    publicHostname: {
+        ok: (url) => !isBlockedHostname(url.hostname),
+        code: "blocked_address",
+        error: "CIMD hostname is not publicly routable",
+    },
+};
+/**
+ * The addresses `hostname` resolves to. An IP literal is its own answer, and
+ * any lookup failure — the default's or a host-supplied `cimdLookup`'s — is a
+ * `dns_failed`, never mistaken for a fetch error or a blocked address.
+ */
+const resolveHost = async (hostname, lookup) => {
+    if (isIpLiteral(hostname))
+        return [hostname];
+    let addrs;
+    try {
+        addrs = await lookup(hostname);
+    }
+    catch (caught) {
+        if (caught instanceof CimdError)
+            throw caught;
+        throw new CimdError("dns_failed", `DNS lookup failed (${dnsErrorCode(caught)})`);
+    }
+    if (addrs.length === 0)
+        throw new CimdError("dns_failed", "DNS lookup returned no addresses");
+    return addrs;
+};
+export const assertSafeUrl = async (url, lookup) => {
+    for (const rule of Object.values(URL_SAFETY)) {
+        if (!rule.ok(url))
+            throw new CimdError(rule.code, rule.error);
+    }
+    const addrs = await resolveHost(normalizeHostname(url.hostname), lookup);
+    if (addrs.some(isBlockedIp)) {
+        throw new CimdError("blocked_address", "CIMD resolved to a non-public address");
+    }
+};
+//# sourceMappingURL=url-guard.js.map