mcp-trellis 2.2.0 → 3.1.0

package/dist/oauth/cimd/url-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-guard.js","sourceRoot":"","sources":["../../../src/oauth/cimd/url-guard.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,SAAS,EAAwB,MAAM,cAAc,CAAC;AAI/D,MAAM,UAAU,GAGZ;IACF,KAAK,EAAE;QACL,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACtC,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,8BAA8B;KACtC;IACD,aAAa,EAAE;QACb,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC3C,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,qCAAqC;KAC7C;IACD,cAAc,EAAE;QACd,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7C,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,wCAAwC;KAChD;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAE,MAAc,EAAqB,EAAE;IAChF,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,YAAY,SAAS;YAAE,MAAM,MAAM,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,sBAAsB,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAQ,EAAE,MAAc,EAAiB,EAAE;IAC7E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;IAClF,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/config.d.ts

@@ -1,9 +1,12 @@
 /** OAuth construction asserts and small response helpers. */
+import { type GrantType } from "./constants.js";
 import type { MintedToken, OAuthPorts, OAuthRouterOptions } from "./types.js";
 /** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
 export declare const unregisteredClientsAllowed: (options: OAuthRouterOptions) => boolean;
 /** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
 export declare const registeredClientsRequired: (options: OAuthRouterOptions) => boolean;
+/** The grants this AS handles; metadata, DCR responses and `/token` errors all name this set. */
+export declare const grantTypesOf: (ports: OAuthPorts) => GrantType[];
 /** Scopes this AS advertises and is willing to grant. */
 export declare const advertisedScopes: (options: OAuthRouterOptions) => string[];
 /**

package/dist/oauth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9E,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GAAI,SAAS,kBAAkB,KAAG,OAC7B,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,GAAI,SAAS,kBAAkB,KAAG,OAC5B,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,kBAAkB,KAAG,MAAM,EACd,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,IAY/D,CAAC;AAaF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,IAYjD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,UAAU,EACjB,SAAS,OAAO,KACf,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAUxC,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,QAK7E,CAAC;AAKL,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAGb,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,WAAW,EAAE,eAAe,MAAM,KAAG,QAa1E,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAG7D,OAAO,EAA8B,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE9E,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,GAAI,SAAS,kBAAkB,KAAG,OAC7B,CAAC;AAE7C,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,GAAI,SAAS,kBAAkB,KAAG,OAC5B,CAAC;AAE7C,iGAAiG;AACjG,eAAO,MAAM,YAAY,GAAI,OAAO,UAAU,KAAG,SAAS,EAGrB,CAAC;AAEtC,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAI,SAAS,kBAAkB,KAAG,MAAM,EAClC,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,kBAAkB,KAAG,MAAM,EACd,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,IAY/D,CAAC;AAaF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,IAYjD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,UAAU,EACjB,SAAS,OAAO,KACf,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAUxC,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,QAK7E,CAAC;AAKL,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,GAClC,SAAS,kBAAkB,EAC3B,QAAQ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACvC,QAAQ,GAAG,IAGb,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,WAAW,EAAE,eAAe,MAAM,KAAG,QAa1E,CAAC"}

package/dist/oauth/config.js

@@ -1,10 +1,14 @@
 /** OAuth construction asserts and small response helpers. */
 import { jsonResponse } from "../http/http.js";
-import { DEFAULT_SCOPE } from "./constants.js";
+import { DEFAULT_SCOPE, GRANT_TYPES } from "./constants.js";
 /** Default true — see `OAuthRouterOptions.allowUnregisteredClients`. */
 export const unregisteredClientsAllowed = (options) => options.allowUnregisteredClients !== false;
 /** Default true since 1.0 — see `OAuthRouterOptions.requireRegisteredClients`. */
 export const registeredClientsRequired = (options) => options.requireRegisteredClients !== false;
+/** The grants this AS handles; metadata, DCR responses and `/token` errors all name this set. */
+export const grantTypesOf = (ports) => ports.refreshAccessToken
+    ? [GRANT_TYPES.authorizationCode, GRANT_TYPES.refreshToken]
+    : [GRANT_TYPES.authorizationCode];
 /** Scopes this AS advertises and is willing to grant. */
 export const advertisedScopes = (options) => options.scopes ?? [DEFAULT_SCOPE];
 /**

package/dist/oauth/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAA2B,EAAW,EAAE,CACjF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAA2B,EAAW,EAAE,CAChF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA2B,EAAY,EAAE,CACxE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA2B,EAAY,EAAE,CACrE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IACrE,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,2BAA2B,CAAC,CAAC;IACjF,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,6BAA6B,GAAG,cAAc,CAAC;AACrD,MAAM,aAAa,GAAG,6CAA6C,CAAC;AAEpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAQ,EAAE;IACvD,8EAA8E;IAC9E,IAAI,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,uFAAuF,aAAa,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,+BAA+B,sBAAsB,oBAAoB,MAAM,CAAC,MAAM,OAAO,aAAa,EAAE,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,KAAiB,EACjB,OAAgB,EACyB,EAAE;IAC3C,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClC,yEAAyE;IACzE,OAAO,OAAgC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,WAAoB,EAAY,EAAE,CAC1F,YAAY,CAAC;IACX,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE;IACzE,MAAM;IACN,IAAI,EAAE,KAAK;CACZ,CAAC,CAAC;AAEL,MAAM,+BAA+B,GACnC,oEAAoE,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,MAAwC,EACvB,EAAE;IACnB,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAE,YAAqB,EAAY,EAAE;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC;IAC3C,OAAO,YAAY,CAAC;QAClB,IAAI,EAAE;YACJ,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;YACxC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;QACD,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAkB,MAAM,gBAAgB,CAAC;AAG5E,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAA2B,EAAW,EAAE,CACjF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAA2B,EAAW,EAAE,CAChF,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC;AAE7C,iGAAiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAe,EAAE,CAC7D,KAAK,CAAC,kBAAkB;IACtB,CAAC,CAAC,CAAC,WAAW,CAAC,iBAAiB,EAAE,WAAW,CAAC,YAAY,CAAC;IAC3D,CAAC,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;AAEtC,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA2B,EAAY,EAAE,CACxE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA2B,EAAY,EAAE,CACrE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IACrE,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,2BAA2B,CAAC,CAAC;IACjF,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,6BAA6B,GAAG,cAAc,CAAC;AACrD,MAAM,aAAa,GAAG,6CAA6C,CAAC;AAEpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAQ,EAAE;IACvD,8EAA8E;IAC9E,IAAI,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,uFAAuF,aAAa,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,+BAA+B,sBAAsB,oBAAoB,MAAM,CAAC,MAAM,OAAO,aAAa,EAAE,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,KAAiB,EACjB,OAAgB,EACyB,EAAE;IAC3C,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClC,yEAAyE;IACzE,OAAO,OAAgC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,WAAoB,EAAY,EAAE,CAC1F,YAAY,CAAC;IACX,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE;IACzE,MAAM;IACN,IAAI,EAAE,KAAK;CACZ,CAAC,CAAC;AAEL,MAAM,+BAA+B,GACnC,oEAAoE,CAAC;AAEvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,MAAwC,EACvB,EAAE;IACnB,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAE,YAAqB,EAAY,EAAE;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC;IAC3C,OAAO,YAAY,CAAC;QAClB,IAAI,EAAE;YACJ,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;YACxC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;QACD,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/crypto/clientauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAU9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAIrB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AA6BF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAaf,CAAC;AA2LF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,EAC3B,SAAS,OAAO,KACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAMzB,CAAC"}
+{"version":3,"file":"clientauth.d.ts","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAU9D,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAGV,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAIrB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AA6BF,qEAAqE;AACrE,eAAO,MAAM,cAAc,GACzB,SAAS,OAAO,EAChB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,UAAU,GAAG,IAaf,CAAC;AA4LF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,EAChB,SAAS,kBAAkB,EAC3B,SAAS,OAAO,KACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAMzB,CAAC"}

package/dist/oauth/crypto/clientauth.js

@@ -1,6 +1,6 @@
 /** Token-endpoint client authentication (RFC 6749 §2.3.1). */
-import { auditLegacyKeyUsage, safeOAuthAudit } from "../audit.js";
-import { cimdFetchOpts, isCimdClientId, resolveCimdClient } from "../cimd/cimd.js";
+import { auditCimdFailure, auditLegacyKeyUsage, safeOAuthAudit } from "../audit.js";
+import { cimdFetchOpts, isCimdClientId, resolveCimdOutcome } from "../cimd/cimd.js";
 import { oauthError, registeredClientsRequired, resolveSecrets, unregisteredClientsAllowed, } from "../config.js";
 import { OAUTH_ERRORS, TOKEN_ENDPOINT_AUTH_METHODS, } from "../constants.js";
 import { unsealAny } from "./sealed.js";
@@ -105,14 +105,15 @@ const isSelfRegisteredOrCimdClient = async ({ auth, options, request, }) => {
     }
     if (options.cimd !== true || !isCimdClientId(auth.clientId))
         return false;
-    if (await resolveCimdClient(auth.clientId, cimdFetchOpts(options)))
+    const outcome = await resolveCimdOutcome(auth.clientId, cimdFetchOpts(options));
+    if ("doc" in outcome)
         return true;
     // Without `cimdCache` every refresh/revoke re-fetches — a flaky document
     // host logs users out. Surface that distinctly.
-    await safeOAuthAudit(options, {
-        event: "cimd_resolve_failed",
+    await auditCimdFailure(options, {
         clientId: auth.clientId,
-        reason: "CIMD document could not be resolved at token/revoke time",
+        endpoint: "token/revoke",
+        failure: outcome.failure,
     });
     return false;
 };

package/dist/oauth/crypto/clientauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientauth.js","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQxD,iEAAiE;AACjE,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAU,EAAE,CACpD,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEhD,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAqB,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACzD,MAAM,EAAE,2BAA2B,CAAC,KAAK;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAgB,EAChB,IAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI;KAChG,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAS1D,sEAAsE;AACtE,MAAM,aAAa,GAAG,GAAa,EAAE,CACnC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;AAElE,uFAAuF;AACvF,MAAM,oBAAoB,GAAG,KAAK,EAChC,EAAE,IAAI,EAAE,OAAO,EAAqB,EACpC,MAAc,EACK,EAAE;IACrB,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA0B,EAC1B,MAAc,EACK,EAAE;IACrB,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IACtD,MAAM,qBAAqB,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,EAAE,EAC1C,IAAI,EACJ,OAAO,EACP,OAAO,GACW,EAAoB,EAAE;IACxC,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7F,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1E,IAAI,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,cAAc,CAAC,OAAO,EAAE;QAC5B,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,0DAA0D;KACnE,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,2BAA2B,GAAG,KAAK,EACvC,OAA0B,EACA,EAAE;IAC5B,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,MAAM,4BAA4B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,oBAAoB,CACzB,OAAO,EACP,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,KAAK,EAC/B,OAA0B,EAC1B,MAAc,EACd,UAAkD,EACxB,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,CAClD,MAAM,EACN,MAAM,IAAI,iBAAiB,EAC3B,gBAAgB,CACjB,CAAC;IACF,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CACzB,OAAO,EACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,qBAAqB,CAClF,CAAC;AACJ,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA0B,EAC1B,MAAc,EACd,YAAyC,EACf,EAAE;IAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,oBAAoB,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,oBAAoB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,yBAAyB,GAAG,KAAK,EACrC,OAA0B,EAC1B,UAA4B,EACF,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,IAAI,QAAQ,KAAK,2BAA2B,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,wEAAwE;IACxE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,OAAO,KAAK,EAAE,UAAU;QACtB,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC;QAC7D,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAA2B,EAC3B,OAAgB,EACU,EAAE;IAC5B,MAAM,OAAO,GAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IACjF,OAAO,UAAU;QACf,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,CAAC;QAChD,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC"}
+{"version":3,"file":"clientauth.js","sourceRoot":"","sources":["../../../src/oauth/crypto/clientauth.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQxD,iEAAiE;AACjE,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAU,EAAE,CACpD,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEhD,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAqB,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACzD,MAAM,EAAE,2BAA2B,CAAC,KAAK;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAgB,EAChB,IAA4B,EACT,EAAE;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI;KAChG,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAS1D,sEAAsE;AACtE,MAAM,aAAa,GAAG,GAAa,EAAE,CACnC,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;AAElE,uFAAuF;AACvF,MAAM,oBAAoB,GAAG,KAAK,EAChC,EAAE,IAAI,EAAE,OAAO,EAAqB,EACpC,MAAc,EACK,EAAE;IACrB,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA0B,EAC1B,MAAc,EACK,EAAE;IACrB,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IACtD,MAAM,qBAAqB,CAAC,SAAS,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,KAAK,EAAE,EAC1C,IAAI,EACJ,OAAO,EACP,OAAO,GACW,EAAoB,EAAE;IACxC,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7F,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1E,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,IAAI,KAAK,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,gBAAgB,CAAC,OAAO,EAAE;QAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,2BAA2B,GAAG,KAAK,EACvC,OAA0B,EACA,EAAE;IAC5B,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,MAAM,4BAA4B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,oBAAoB,CACzB,OAAO,EACP,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,KAAK,EAC/B,OAA0B,EAC1B,MAAc,EACd,UAAkD,EACxB,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,CAClD,MAAM,EACN,MAAM,IAAI,iBAAiB,EAC3B,gBAAgB,CACjB,CAAC;IACF,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,mBAAmB,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CACzB,OAAO,EACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,qBAAqB,CAClF,CAAC;AACJ,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA0B,EAC1B,MAAc,EACd,YAAyC,EACf,EAAE;IAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,oBAAoB,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,oBAAoB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,yBAAyB,GAAG,KAAK,EACrC,OAA0B,EAC1B,UAA4B,EACF,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,IAAI,QAAQ,KAAK,2BAA2B,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,wEAAwE;IACxE,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,OAAO,KAAK,EAAE,UAAU;QACtB,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC;QAC7D,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAA2B,EAC3B,OAAgB,EACU,EAAE;IAC5B,MAAM,OAAO,GAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IACjF,OAAO,UAAU;QACf,CAAC,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,CAAC;QAChD,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC"}

package/dist/oauth/deprecated.d.ts

@@ -1,52 +1,52 @@
 /**
  * `mcp-trellis/oauth` aliases for symbols that moved to
  * `mcp-trellis/advanced`. Declared as consts so `@deprecated` reaches
- * editors. Removed in 3.0.
+ * editors. Removed in the next major release.
  */
 import * as advanced from "../advanced.js";
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const readClientAuth: (request: Request, body: Record<string, string>) => advanced.ClientAuth | null;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const firstClientAuthError: (auth: advanced.ClientAuth, options: import("./types.js").OAuthRouterOptions, request: Request) => Promise<Response | null>;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const firstResourceError: (requested: string, expected: string) => Response | null;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const resourceErrorInfo: (requested: string, expected: string) => import("./types.js").OAuthErrorInfo | null;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const normalizeConfiguredPath: (path: string) => string;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const firstScopeError: (requested: string[], advertised: string[]) => Response | null;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const scopeErrorInfo: (requested: string[], advertised: string[]) => import("./types.js").OAuthErrorInfo | null;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const parseScope: (raw: string) => string[];
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const requestedScopes: (raw: string, fallback: string[]) => string[];
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const formatScope: (scopes: string[]) => string;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const issueAuthCode: (secret: string, record: Omit<advanced.AuthCodeRecord, "exp">, nowMs?: number) => Promise<string>;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const consumeAuthCode: (secret: string | readonly string[], code: string, options?: {
     codeStore?: advanced.CodeStore | undefined;
     nowMs?: number | undefined;
 }) => Promise<advanced.AuthCodeRecord | null>;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const newClientId: () => string;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const randomBase64Url: (byteLen: number) => string;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const sha256Base64Url: (input: string) => Promise<string>;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const verifyPkceS256: (verifier: string, challenge: string) => Promise<boolean>;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const buildErrorRedirectUrl: (redirectUri: string, error: string, description: string, state: string, issuer?: string) => string;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const advertisedScopes: (options: import("./types.js").OAuthRouterOptions) => string[];
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const defaultScopes: (options: import("./types.js").OAuthRouterOptions) => string[];
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const registeredClientsRequired: (options: import("./types.js").OAuthRouterOptions) => boolean;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const unregisteredClientsAllowed: (options: import("./types.js").OAuthRouterOptions) => boolean;
 //# sourceMappingURL=deprecated.d.ts.map

package/dist/oauth/deprecated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deprecated.d.ts","sourceRoot":"","sources":["../../src/oauth/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,sEAAsE;AACtE,eAAO,MAAM,cAAc,gFAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,6HAAgC,CAAC;AAClE,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,0DAA8B,CAAC;AAC9D,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,qFAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,0BAAmC,CAAC;AACxE,sEAAsE;AACtE,eAAO,MAAM,eAAe,gEAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,cAAc,2FAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,UAAU,2BAAsB,CAAC;AAC9C,sEAAsE;AACtE,eAAO,MAAM,eAAe,+CAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,WAAW,8BAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,aAAa,mGAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,eAAe;aAmBqzE,CAAC;SAA8B,CAAC;6CAnB1zE,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,WAAW,cAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,eAAe,6BAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,eAAe,oCAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,cAAc,2DAA0B,CAAC;AACtD,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,qGAAiC,CAAC;AACpE,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,gEAA4B,CAAC;AAC1D,sEAAsE;AACtE,eAAO,MAAM,aAAa,gEAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,+DAAqC,CAAC;AAC5E,sEAAsE;AACtE,eAAO,MAAM,0BAA0B,+DAAsC,CAAC"}
+{"version":3,"file":"deprecated.d.ts","sourceRoot":"","sources":["../../src/oauth/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,yFAAyF;AACzF,eAAO,MAAM,cAAc,gFAA0B,CAAC;AACtD,yFAAyF;AACzF,eAAO,MAAM,oBAAoB,6HAAgC,CAAC;AAClE,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,0DAA8B,CAAC;AAC9D,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,qFAA6B,CAAC;AAC5D,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,0BAAmC,CAAC;AACxE,yFAAyF;AACzF,eAAO,MAAM,eAAe,gEAA2B,CAAC;AACxD,yFAAyF;AACzF,eAAO,MAAM,cAAc,2FAA0B,CAAC;AACtD,yFAAyF;AACzF,eAAO,MAAM,UAAU,2BAAsB,CAAC;AAC9C,yFAAyF;AACzF,eAAO,MAAM,eAAe,+CAA2B,CAAC;AACxD,yFAAyF;AACzF,eAAO,MAAM,WAAW,8BAAuB,CAAC;AAChD,yFAAyF;AACzF,eAAO,MAAM,aAAa,mGAAyB,CAAC;AACpD,yFAAyF;AACzF,eAAO,MAAM,eAAe;aAmBm5D,CAAC;SAA8B,CAAC;6CAnBx5D,CAAC;AACxD,yFAAyF;AACzF,eAAO,MAAM,WAAW,cAAuB,CAAC;AAChD,yFAAyF;AACzF,eAAO,MAAM,eAAe,6BAA2B,CAAC;AACxD,yFAAyF;AACzF,eAAO,MAAM,eAAe,oCAA2B,CAAC;AACxD,yFAAyF;AACzF,eAAO,MAAM,cAAc,2DAA0B,CAAC;AACtD,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,qGAAiC,CAAC;AACpE,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,gEAA4B,CAAC;AAC1D,yFAAyF;AACzF,eAAO,MAAM,aAAa,gEAAyB,CAAC;AACpD,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,+DAAqC,CAAC;AAC5E,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,+DAAsC,CAAC"}

package/dist/oauth/deprecated.js

@@ -1,49 +1,49 @@
 /**
  * `mcp-trellis/oauth` aliases for symbols that moved to
  * `mcp-trellis/advanced`. Declared as consts so `@deprecated` reaches
- * editors. Removed in 3.0.
+ * editors. Removed in the next major release.
  */
 import * as advanced from "../advanced.js";
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const readClientAuth = advanced.readClientAuth;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const firstClientAuthError = advanced.firstClientAuthError;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const firstResourceError = advanced.firstResourceError;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const resourceErrorInfo = advanced.resourceErrorInfo;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const normalizeConfiguredPath = advanced.normalizeConfiguredPath;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const firstScopeError = advanced.firstScopeError;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const scopeErrorInfo = advanced.scopeErrorInfo;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const parseScope = advanced.parseScope;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const requestedScopes = advanced.requestedScopes;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const formatScope = advanced.formatScope;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const issueAuthCode = advanced.issueAuthCode;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const consumeAuthCode = advanced.consumeAuthCode;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const newClientId = advanced.newClientId;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const randomBase64Url = advanced.randomBase64Url;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const sha256Base64Url = advanced.sha256Base64Url;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const verifyPkceS256 = advanced.verifyPkceS256;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const buildErrorRedirectUrl = advanced.buildErrorRedirectUrl;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const advertisedScopes = advanced.advertisedScopes;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const defaultScopes = advanced.defaultScopes;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const registeredClientsRequired = advanced.registeredClientsRequired;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const unregisteredClientsAllowed = advanced.unregisteredClientsAllowed;
 //# sourceMappingURL=deprecated.js.map

package/dist/oauth/deprecated.js.map

@@ -1 +1 @@
-{"version":3,"file":"deprecated.js","sourceRoot":"","sources":["../../src/oauth/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,oBAAoB,CAAC;AAClE,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;AAC9D,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;AACxE,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;AAC9C,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AACpE,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;AAC1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAC5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,0BAA0B,CAAC"}
+{"version":3,"file":"deprecated.js","sourceRoot":"","sources":["../../src/oauth/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,oBAAoB,CAAC;AAClE,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;AAC9D,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;AACxE,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,yFAAyF;AACzF,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;AAC9C,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,yFAAyF;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,yFAAyF;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;AACtD,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AACpE,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;AAC1D,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAC5E,yFAAyF;AACzF,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,0BAA0B,CAAC"}

package/dist/oauth/endpoints/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAKV,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAiPrB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAuClB,CAAC"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAKV,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAqQrB,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAuClB,CAAC"}

package/dist/oauth/endpoints/authorize.js

@@ -1,7 +1,7 @@
 import { GET_ONLY, requireHttpMethod } from "../../http/http.js";
-import { auditLegacyKeyUsage } from "../audit.js";
-import { cimdFetchOpts, isCimdClientId, resolveCimdClient } from "../cimd/cimd.js";
-import { advertisedScopes, defaultScopes, oauthError, registeredClientsRequired, resolveSecrets, unregisteredClientError, } from "../config.js";
+import { auditCimdFailure, auditLegacyKeyUsage } from "../audit.js";
+import { cimdFetchOpts, isCimdClientId, resolveCimdOutcome } from "../cimd/cimd.js";
+import { advertisedScopes, defaultScopes, oauthError, registeredClientsRequired, resolveSecrets, unregisteredClientError, unregisteredClientsAllowed, } from "../config.js";
 import { OAUTH_ERRORS } from "../constants.js";
 import { issueAuthCode } from "../crypto/codes.js";
 import { unsealAny } from "../crypto/sealed.js";
@@ -9,7 +9,7 @@ import { isAllowedRedirectUri } from "../policy/redirect.js";
 import { canonicalResource, resourceErrorInfo } from "../policy/resource.js";
 import { formatScope, requestedScopes, scopeErrorInfo } from "../policy/scope.js";
 import { codeRedirect, errorRedirect, secureRedirect } from "./callback.js";
-import { isPreApproved, issueConsentTicket, renderConsent } from "./consent.js";
+import { isPreApproved, issueConsentTicket, renderConsent } from "./consent/handler.js";
 /** BASE64URL(SHA-256(verifier)) without padding is always exactly 43 characters. */
 const S256_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
 /** Reflected into `Location` on denial — an unbounded `state` is a header-size DoS knob. */
@@ -51,11 +51,21 @@ const redirectToLogin = (request, url, options) => {
  */
 const resolveAuthorizeClient = async (options, clientId, secrets) => {
     const registered = (await options.ports.clientStore?.get(clientId)) ?? null;
+    // A router that does not serve unknown clients (no `/register` route, and
+    // `/token` rejects any id `clientStore` does not know) must not honour a
+    // sealed DCR assertion minted by a sibling instance sharing the codeSecret,
+    // nor fetch a CIMD document, for a client it would reject one step later.
+    if (!registered && !unregisteredClientsAllowed(options)) {
+        const rejection = unregisteredClientError(options, {
+            code: OAUTH_ERRORS.unauthorizedClient,
+            status: 400,
+        });
+        if (rejection)
+            return rejection;
+    }
     const assertion = registered ? null : await unsealClientAssertion(options, clientId, secrets);
     const isCimdId = options.cimd === true && isCimdClientId(clientId);
-    const cimdDoc = !registered && !assertion && isCimdId
-        ? await resolveCimdClient(clientId, cimdFetchOpts(options))
-        : null;
+    const cimdDoc = !registered && !assertion && isCimdId ? await resolveCimdDocument(options, clientId) : null;
     if (!registered && !assertion && !cimdDoc) {
         const unknown = unknownClientError(options, isCimdId);
         if (unknown)
@@ -66,6 +76,14 @@ const resolveAuthorizeClient = async (options, clientId, secrets) => {
         boundRedirectUris: registered?.redirectUris ?? assertion?.redirectUris ?? cimdDoc?.redirect_uris ?? null,
     };
 };
+/** The CIMD document for `clientId`, auditing (not surfacing) why it could not be resolved. */
+const resolveCimdDocument = async (options, clientId) => {
+    const outcome = await resolveCimdOutcome(clientId, cimdFetchOpts(options));
+    if ("doc" in outcome)
+        return outcome.doc;
+    await auditCimdFailure(options, { clientId, endpoint: "authorize", failure: outcome.failure });
+    return null;
+};
 /** This server's own `/register` assertion for `clientId`, auditing a legacy-key unseal. */
 const unsealClientAssertion = async (options, clientId, secrets) => {
     const unsealed = await unsealAny(secrets, "client", clientId);

package/dist/oauth/endpoints/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAiC,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQlF,OAAO,EAAiB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhF,oFAAoF;AACpF,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CACtB,WAAmB,EACnB,iBAAkC,EAClC,SAA+C,EACtC,EAAE;IACX,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,OAAO,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAQ,EAAE,OAA2B,EAAY,EAAE;IAC5F,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC;AAOF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACF,EAAE;IACvC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,OAAO,GACX,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,QAAQ;QACnC,CAAC,CAAC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,UAAU;QACV,iBAAiB,EACf,UAAU,EAAE,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,IAAI,IAAI;KACxF,CAAC;AACJ,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACN,EAAE;IACnC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,mBAAmB,CAAC,OAAO,EAAE;QACjC,QAAQ;QACR,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,MAAM,EAAE,2BAA2B;KACpC,CAAC,CAAC;IACH,OAAO,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;AACjC,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,CAAC,OAA2B,EAAE,QAAiB,EAAmB,EAAE;IAC7F,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,EAAE;QACpD,IAAI,EAAE,YAAY,CAAC,kBAAkB;QACrC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,CACzB,QAAkB,EAClB,iBAAkC,EAClC,OAA2B,EACV,EAAE;IACnB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,yBAAyB,gBAAgB,aAAa,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAcF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAC1B,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAoB,EACrD,OAA2B,EACW,EAAE;IACxC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAY,EAAE,CACpE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,YAAY,CAAC,uBAAuB,EAAE,4BAA4B,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,YAAY,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,aAAa,CAClB,YAAY,CAAC,cAAc,EAC3B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClG,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAEvF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC,CAAC;AAUF,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAAmC,EACnC,OAAuC,EACvC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAyB,EACnE,EAAE;IACrB,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,aAAa;QACb,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;KAC5B,CAAC;IAEF,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,aAAa,CAAC,OAAO,EAAE;QAC5B,QAAQ;QACR,gBAAgB,EAAE,UAAU;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,gBAAgB;QAC1B,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClF,IAAI,gBAAgB,YAAY,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC;IAE3D,MAAM,QAAQ,GAAa;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QACvD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC/E,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAqB,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,SAAS,YAAY,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzD,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QAC7C,GAAG,SAAS;QACZ,OAAO;QACP,QAAQ;QACR,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,yBAAyB,EACzB,cAAc,EACd,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAiC,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQlF,OAAO,EAAiB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAExF,oFAAoF;AACpF,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CACtB,WAAmB,EACnB,iBAAkC,EAClC,SAA+C,EACtC,EAAE;IACX,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,OAAO,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAQ,EAAE,OAA2B,EAAY,EAAE;IAC5F,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC;AAOF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACF,EAAE;IACvC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE;YACjD,IAAI,EAAE,YAAY,CAAC,kBAAkB;YACrC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,OAAO,GACX,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9F,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,UAAU;QACV,iBAAiB,EACf,UAAU,EAAE,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,IAAI,IAAI;KACxF,CAAC;AACJ,CAAC,CAAC;AAEF,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,KAAK,EAC/B,OAA2B,EAC3B,QAAgB,EACc,EAAE;IAChC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,KAAK,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACzC,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAA2B,EAC3B,QAAgB,EAChB,OAAuC,EACN,EAAE;IACnC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAkB,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,mBAAmB,CAAC,OAAO,EAAE;QACjC,QAAQ;QACR,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,MAAM,EAAE,2BAA2B;KACpC,CAAC,CAAC;IACH,OAAO,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;AACjC,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,CAAC,OAA2B,EAAE,QAAiB,EAAmB,EAAE;IAC7F,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,EAAE;QACpD,IAAI,EAAE,YAAY,CAAC,kBAAkB;QACrC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,UAAU,CACf,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,qEAAqE,CACtE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,CACzB,QAAkB,EAClB,iBAAkC,EAClC,OAA2B,EACV,EAAE;IACnB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,YAAY,CAAC,cAAc,EAC3B,GAAG,EACH,yBAAyB,gBAAgB,aAAa,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAcF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAC1B,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAoB,EACrD,OAA2B,EACW,EAAE;IACxC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAY,EAAE,CACpE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,YAAY,CAAC,uBAAuB,EAAE,4BAA4B,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,YAAY,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,aAAa,CAClB,YAAY,CAAC,cAAc,EAC3B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClG,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAEvF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC,CAAC;AAUF,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,KAAK,EACjC,OAAmC,EACnC,OAAuC,EACvC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAyB,EACnE,EAAE;IACrB,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,aAAa;QACb,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC;KAC5B,CAAC;IAEF,IAAI,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,aAAa,CAAC,OAAO,EAAE;QAC5B,QAAQ;QACR,gBAAgB,EAAE,UAAU;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,gBAAgB;QAC1B,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClF,IAAI,gBAAgB,YAAY,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAClE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC;IAE3D,MAAM,QAAQ,GAAa;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QACvD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IACF,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC/E,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAqB,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,SAAS,YAAY,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzD,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QAC7C,GAAG,SAAS;QACZ,OAAO;QACP,QAAQ;QACR,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/endpoints/consent/error-page.d.ts

@@ -0,0 +1,6 @@
+/** What a browser shows when the consent POST cannot be honoured; the status is 400 either way. */
+export type ConsentFailureKind = "expired" | "session" | "used";
+/** True only for an explicit `text/html` range with q > 0; `*\/*` and no header keep the JSON. */
+export declare const acceptsHtml: (accept: string | null) => boolean;
+export declare const renderConsentError: (kind: ConsentFailureKind) => Response;
+//# sourceMappingURL=error-page.d.ts.map

package/dist/oauth/endpoints/consent/error-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-page.d.ts","sourceRoot":"","sources":["../../../../src/oauth/endpoints/consent/error-page.ts"],"names":[],"mappings":"AAAA,mGAAmG;AAEnG,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAuChE,kGAAkG;AAClG,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,GAAG,IAAI,KAAG,OAMhD,CAAC;AAEL,eAAO,MAAM,kBAAkB,GAAI,MAAM,kBAAkB,KAAG,QAiB7D,CAAC"}

package/dist/oauth/endpoints/consent/error-page.js

@@ -0,0 +1,60 @@
+/** What a browser shows when the consent POST cannot be honoured; the status is 400 either way. */
+/**
+ * Fixed text only. Nothing from the request, the ticket or the session may
+ * reach this page, and "no session" and "a different user" share one kind
+ * so the page cannot be used to probe whose ticket it was.
+ */
+const MESSAGES = {
+    expired: {
+        title: "This approval request expired",
+        detail: "Close this tab, go back to the app you were connecting and start the connection again.",
+    },
+    session: {
+        title: "Your sign-in changed or expired",
+        detail: "Sign in to the app again, then start the connection again from the app you were connecting.",
+    },
+    used: {
+        title: "This approval was already submitted",
+        detail: "If the connection did not complete, start it again from the app you were connecting.",
+    },
+};
+/**
+ * `form-action 'none'` and `base-uri 'none'` are not covered by
+ * `default-src`; this page has no form and no link, so it grants neither.
+ */
+const ERROR_PAGE_HEADERS = {
+    "Content-Type": "text/html; charset=utf-8",
+    "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; " +
+        "form-action 'none'; frame-ancestors 'none'",
+    "X-Frame-Options": "DENY",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    "Cache-Control": "no-store",
+};
+/** True only for an explicit `text/html` range with q > 0; `*\/*` and no header keep the JSON. */
+export const acceptsHtml = (accept) => (accept ?? "").split(",").some((range) => {
+    const [type, ...params] = range.split(";").map((part) => part.trim().toLowerCase());
+    if (type !== "text/html")
+        return false;
+    const quality = params.find((param) => param.startsWith("q="));
+    return quality === undefined || Number(quality.slice(2)) > 0;
+});
+export const renderConsentError = (kind) => {
+    const { title, detail } = MESSAGES[kind];
+    const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>${title}</title>
+<style>
+  body { font: 16px system-ui, sans-serif; max-width: 32rem; margin: 3rem auto; padding: 0 1rem; }
+</style>
+</head>
+<body>
+<h1>${title}</h1>
+<p>${detail}</p>
+</body>
+</html>`;
+    return new Response(html, { status: 400, headers: ERROR_PAGE_HEADERS });
+};
+//# sourceMappingURL=error-page.js.map

package/dist/oauth/endpoints/consent/error-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-page.js","sourceRoot":"","sources":["../../../../src/oauth/endpoints/consent/error-page.ts"],"names":[],"mappings":"AAAA,mGAAmG;AAInG;;;;GAIG;AACH,MAAM,QAAQ,GAAkE;IAC9E,OAAO,EAAE;QACP,KAAK,EAAE,+BAA+B;QACtC,MAAM,EACJ,wFAAwF;KAC3F;IACD,OAAO,EAAE;QACP,KAAK,EAAE,iCAAiC;QACxC,MAAM,EACJ,6FAA6F;KAChG;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,qCAAqC;QAC5C,MAAM,EAAE,sFAAsF;KAC/F;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,kBAAkB,GAA2B;IACjD,cAAc,EAAE,0BAA0B;IAC1C,yBAAyB,EACvB,kEAAkE;QAClE,4CAA4C;IAC9C,iBAAiB,EAAE,MAAM;IACzB,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC;AAEF,kGAAkG;AAClG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAqB,EAAW,EAAE,CAC5D,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;IACvC,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACpF,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAwB,EAAY,EAAE;IACvE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG;;;;SAIN,KAAK;;;;;;MAMR,KAAK;KACN,MAAM;;QAEH,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC"}

package/dist/oauth/endpoints/{consent.d.ts → consent/handler.d.ts}

@@ -8,7 +8,7 @@
  * `handleConsent` trusts nothing from the POST body except which ticket and
  * whether the user approved it. Nothing else in that body is read.
  */
-import type { ConsentRequest, OAuthRouterOptions, RegisteredClient, ResolvedOAuthRouterOptions } from "../types.js";
+import type { ConsentRequest, OAuthRouterOptions, RegisteredClient, ResolvedOAuthRouterOptions } from "../../types.js";
 type ConsentTicketPayload = {
     clientId: string;
     redirectUri: string;
@@ -26,4 +26,4 @@ export declare const renderConsent: (options: OAuthRouterOptions, input: Consent
 export declare const isPreApproved: (options: OAuthRouterOptions, clientId: string, registered: RegisteredClient | null) => boolean;
 export declare const handleConsent: (request: Request, options: ResolvedOAuthRouterOptions) => Promise<Response>;
 export {};
-//# sourceMappingURL=consent.d.ts.map
+//# sourceMappingURL=handler.d.ts.map

package/dist/oauth/endpoints/consent/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/oauth/endpoints/consent/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAElB,gBAAgB,EAChB,0BAA0B,EAC3B,MAAM,gBAAgB,CAAC;AAOxB,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,SAAS,IAAI,CAAC,oBAAoB,EAAE,KAAK,GAAG,KAAK,CAAC,KACjD,OAAO,CAAC,MAAM,CAKkB,CAAC;AAYpC,eAAO,MAAM,aAAa,GACxB,SAAS,kBAAkB,EAC3B,OAAO,cAAc,KACpB,OAAO,CAAC,QAAQ,CAA6D,CAAC;AAEjF,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GACxB,SAAS,kBAAkB,EAC3B,UAAU,MAAM,EAChB,YAAY,gBAAgB,GAAG,IAAI,KAClC,OAC0F,CAAC;AAqD9F,eAAO,MAAM,aAAa,GACxB,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAmClB,CAAC"}

package/dist/oauth/endpoints/{consent.js → consent/handler.js}

@@ -8,21 +8,28 @@
  * `handleConsent` trusts nothing from the POST body except which ticket and
  * whether the user approved it. Nothing else in that body is read.
  */
-import { NO_CORS, POST_ONLY, requireHttpMethod } from "../../http/http.js";
-import { auditLegacyKeyUsage } from "../audit.js";
-import { oauthError, resolveSecrets } from "../config.js";
-import { OAUTH_ERRORS } from "../constants.js";
-import { issueAuthCode } from "../crypto/codes.js";
-import { seal, unsealAny } from "../crypto/sealed.js";
-import { readBodyOrError, readOAuthBody } from "../policy/reqbody.js";
-import { codeRedirect, errorRedirect } from "./callback.js";
-import { renderBuiltInConsent } from "./consent-page.js";
+import { NO_CORS, POST_ONLY, requireHttpMethod } from "../../../http/http.js";
+import { auditLegacyKeyUsage } from "../../audit.js";
+import { oauthError, resolveSecrets } from "../../config.js";
+import { OAUTH_ERRORS } from "../../constants.js";
+import { issueAuthCode } from "../../crypto/codes.js";
+import { seal, unsealAny } from "../../crypto/sealed.js";
+import { readBodyOrError, readOAuthBody } from "../../policy/reqbody.js";
+import { codeRedirect, errorRedirect } from "../callback.js";
+import { acceptsHtml, renderConsentError } from "./error-page.js";
+import { renderBuiltInConsent } from "./page.js";
 const CONSENT_TICKET_TTL_MS = 300_000;
 export const issueConsentTicket = (secret, payload) => seal(secret, "consent", {
     ...payload,
     exp: Date.now() + CONSENT_TICKET_TTL_MS,
     jti: crypto.randomUUID(),
 });
+/** A rejected ticket: a browser form gets a readable page, an API caller the JSON error. */
+const ticketFailure = (request, kind, description) => {
+    if (acceptsHtml(request.headers.get("accept")))
+        return renderConsentError(kind);
+    return oauthError(OAUTH_ERRORS.invalidGrant, 400, description);
+};
 export const renderConsent = async (options, input) => (options.consent?.render ?? renderBuiltInConsent)(input);
 /** Only honored when `clientStore` actually resolves the id — never a self-invented one. */
 export const isPreApproved = (options, clientId, registered) => Boolean(registered) && (options.consent?.preApprovedClientIds?.includes(clientId) ?? false);
@@ -36,7 +43,7 @@ const readValidTicket = async (request, options, ticket) => {
         payload.exp < Date.now() ||
         typeof payload.jti !== "string" ||
         !payload.jti) {
-        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "invalid or expired consent_ticket");
+        return ticketFailure(request, "expired", "invalid or expired consent_ticket");
     }
     await auditLegacyKeyUsage(options, {
         clientId: payload.clientId,
@@ -55,10 +62,10 @@ const readValidTicket = async (request, options, ticket) => {
 const consumeTicketForUser = async (request, options, payload) => {
     const user = await options.ports.resolveUser(request);
     if (!user || user.id !== payload.userId) {
-        return oauthError(OAUTH_ERRORS.invalidGrant, 400, "consent_ticket does not match the current user");
+        return ticketFailure(request, "session", "consent_ticket does not match the current user");
     }
     const fresh = await options.ports.codeStore.consume(`ct:${payload.jti}`, payload.exp);
-    return fresh ? user : oauthError(OAUTH_ERRORS.invalidGrant, 400, "consent_ticket already used");
+    return fresh ? user : ticketFailure(request, "used", "consent_ticket already used");
 };
 export const handleConsent = async (request, options) => {
     const methodError = requireHttpMethod(request, POST_ONLY, NO_CORS);
@@ -95,4 +102,4 @@ export const handleConsent = async (request, options) => {
     });
     return codeRedirect(callback, code);
 };
-//# sourceMappingURL=consent.js.map
+//# sourceMappingURL=handler.js.map

package/dist/oauth/endpoints/consent/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../../src/oauth/endpoints/consent/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAQzE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAA2B,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,qBAAqB,GAAG,OAAO,CAAC;AActC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,OAAkD,EACjC,EAAE,CACnB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE;IACtB,GAAG,OAAO;IACV,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;IACvC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;CACM,CAAC,CAAC;AAEpC,4FAA4F;AAC5F,MAAM,aAAa,GAAG,CACpB,OAAgB,EAChB,IAAwB,EACxB,WAAmB,EACT,EAAE;IACZ,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,OAA2B,EAC3B,KAAqB,EACF,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC;AAEjF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAA2B,EAC3B,QAAgB,EAChB,UAAmC,EAC1B,EAAE,CACX,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;AAO9F,qFAAqF;AACrF,MAAM,eAAe,GAAG,KAAK,EAC3B,OAAgB,EAChB,OAA2B,EAC3B,MAAc,EACuB,EAAE;IACvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAuB,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IACxC,IACE,CAAC,OAAO;QACR,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACxB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,CAAC,OAAO,CAAC,GAAG,EACZ,CAAC;QACD,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,mCAAmC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,mBAAmB,CAAC,OAAO,EAAE;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,KAAK,EAChC,OAAgB,EAChB,OAAmC,EACnC,OAA6B,EACE,EAAE;IACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,gDAAgD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,QAAQ,YAAY,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,QAAQ,GAAG;QACf,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;KACpC,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IAExF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC,CAAC"}