mcp-trellis 2.2.0 → 3.1.0

package/dist/oauth/endpoints/{consent-page.d.ts → consent/page.d.ts}

@@ -1,5 +1,5 @@
 /** The built-in consent interstitial, used when the host supplies no `consent.render`. */
-import type { ConsentRequest } from "../types.js";
+import type { ConsentRequest } from "../../types.js";
 /** Built-in hardened interstitial — used whenever the host doesn't supply `consent.render`. */
 export declare const renderBuiltInConsent: (input: ConsentRequest) => Response;
-//# sourceMappingURL=consent-page.d.ts.map
+//# sourceMappingURL=page.d.ts.map

package/dist/oauth/endpoints/consent/page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../../src/oauth/endpoints/consent/page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAiFrD,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,GAAI,OAAO,cAAc,KAAG,QAoC5D,CAAC"}

package/dist/oauth/endpoints/consent/page.js

@@ -0,0 +1,106 @@
+/** The built-in consent interstitial, used when the host supplies no `consent.render`. */
+const ESCAPE_HTML = {
+    "&": "&",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;",
+};
+const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ESCAPE_HTML[ch] ?? ch);
+/**
+ * CSP source for the redirect target. A custom-scheme URI (`myapp://cb`, from
+ * `extraRedirectUris`) has the opaque origin `"null"`, which names no source
+ * at all — allow its scheme instead, or the browser blocks the redirect.
+ */
+const formActionSource = (redirectUri) => {
+    const { origin, protocol } = new URL(redirectUri);
+    const source = origin === "null" ? protocol : origin;
+    return isSafeCspSource(source) ? source : null;
+};
+/** `scheme:`, `scheme://host[:port]` or `scheme://[v6][:port]` — nothing that could end a directive. */
+const SAFE_CSP_SOURCE = /^[a-z][a-z0-9+.-]*:(?:\/\/(?:[a-z0-9._-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?)?$/;
+/**
+ * Schemes that must never be granted as a `form-action` source: each runs
+ * script, or reads or writes content under the page's own authority.
+ */
+const FORBIDDEN_CSP_SCHEMES = new Set([
+    "javascript:",
+    "data:",
+    "file:",
+    "blob:",
+    "about:",
+    "filesystem:",
+]);
+/**
+ * The CSP grammar is not the URL grammar: a host can legally carry `;`, `,`
+ * or `'` (`https://a.com;sandbox`), which `new URL` keeps and a header
+ * builder would turn into a second directive. Anything that is not a plain
+ * scheme or scheme + host source is dropped — `'self'` alone then blocks the
+ * redirect back, which fails closed.
+ */
+const isSafeCspSource = (source) => SAFE_CSP_SOURCE.test(source) && !FORBIDDEN_CSP_SCHEMES.has(source);
+/**
+ * A double-clicked Allow sends two POSTs; the browser keeps the second, whose
+ * ticket is already spent, and drops the redirect carrying the code. This
+ * lets one submission through. It blocks the repeat instead of disabling the
+ * buttons, because a disabled submitter leaves `approved` out of the body.
+ */
+const SUBMIT_ONCE_SCRIPT = 'document.getElementById("consent").addEventListener("submit",function(e){if(this.dataset.sent){e.preventDefault();return}this.dataset.sent="1"})';
+/** CSP hash of `SUBMIT_ONCE_SCRIPT`; a consent test hashes the rendered script against it. */
+const SUBMIT_ONCE_SCRIPT_HASH = "'sha256-Zyrf1VNKMSeFmLaVBxdclhFQvemWfC4XvnQBsjOYkOw='";
+/**
+ * `form-action` governs where a form (and the redirect chain it triggers)
+ * may end up — not just the immediate POST target. Chromium enforces it on
+ * the 302 this page's own submission produces, so `'self'` alone blocks the
+ * approve/deny POST to `${oauthPath}/consent` from ever reaching a
+ * `redirectUri` on another origin (the common case — Claude, Gemini,
+ * loopback clients). `redirectUri` is already validated by `authorize.ts`
+ * before this renders, so its origin is safe to add here.
+ */
+const consentSecurityHeaders = (redirectUri) => ({
+    "Content-Security-Policy": `default-src 'none'; style-src 'unsafe-inline'; script-src ${SUBMIT_ONCE_SCRIPT_HASH}; ` +
+        `form-action ${["'self'", formActionSource(redirectUri)].filter(Boolean).join(" ")}; ` +
+        `frame-ancestors 'none'`,
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "no-referrer",
+    "Cache-Control": "no-store",
+});
+/** Built-in hardened interstitial — used whenever the host doesn't supply `consent.render`. */
+export const renderBuiltInConsent = (input) => {
+    const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Authorize access</title>
+<style>
+  body { font: 16px system-ui, sans-serif; max-width: 32rem; margin: 3rem auto; padding: 0 1rem; }
+  dl { display: grid; grid-template-columns: auto 1fr; gap: 0.25rem 1rem; }
+  dt { font-weight: 600; }
+  button { font-size: 1rem; padding: 0.5rem 1.25rem; margin-right: 0.5rem; }
+</style>
+</head>
+<body>
+<h1>Authorize access</h1>
+<p><strong>${escapeHtml(input.clientId)}</strong> is requesting access to your account.</p>
+<dl>
+  <dt>Redirect URI</dt><dd>${escapeHtml(input.redirectUri)}</dd>
+  <dt>Scope</dt><dd>${escapeHtml(input.scope.join(" ") || "(none)")}</dd>
+  <dt>Resource</dt><dd>${escapeHtml(input.resource)}</dd>
+</dl>
+<form id="consent" method="POST" action="${escapeHtml(input.oauthPath)}/consent">
+  <input type="hidden" name="consent_ticket" value="${escapeHtml(input.ticket)}">
+  <button type="submit" name="approved" value="true">Allow</button>
+  <button type="submit" name="approved" value="false">Deny</button>
+</form>
+<script>${SUBMIT_ONCE_SCRIPT}</script>
+</body>
+</html>`;
+    return new Response(html, {
+        status: 200,
+        headers: {
+            "Content-Type": "text/html; charset=utf-8",
+            ...consentSecurityHeaders(input.redirectUri),
+        },
+    });
+};
+//# sourceMappingURL=page.js.map

package/dist/oauth/endpoints/consent/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../../../src/oauth/endpoints/consent/page.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAI1F,MAAM,WAAW,GAA2B;IAC1C,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAiB,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC,CAAC;AAEF,wGAAwG;AACxG,MAAM,eAAe,GACnB,4EAA4E,CAAC;AAE/E;;;GAGG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,aAAa;IACb,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,CAAC,MAAc,EAAW,EAAE,CAClD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,kBAAkB,GACtB,kJAAkJ,CAAC;AACrJ,8FAA8F;AAC9F,MAAM,uBAAuB,GAAG,uDAAuD,CAAC;AAExF;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,CAAC,WAAmB,EAA0B,EAAE,CAAC,CAAC;IAC/E,yBAAyB,EACvB,6DAA6D,uBAAuB,IAAI;QACxF,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QACtF,wBAAwB;IAC1B,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAY,EAAE;IACtE,MAAM,IAAI,GAAG;;;;;;;;;;;;;;aAcF,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;6BAEV,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;sBACpC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;yBAC1C,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;;2CAER,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;sDAChB,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;;;;UAIpE,kBAAkB;;QAEpB,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,GAAG,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC;SAC7C;KACF,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/endpoints/metadata.d.ts

@@ -1,5 +1,4 @@
 import { type GrantType, type TokenEndpointAuthMethod } from "../constants.js";
-export type { GrantType } from "../constants.js";
 export type ProtectedResourceMetadata = {
     resource: string;
     authorization_servers: string[];

package/dist/oauth/endpoints/metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,uBAAuB,EAAE,CAAC;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,4BAA4B,EAAE,OAAO,CAAC;IACtC,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0CAA0C,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACvE,oDAAoD;IACpD,8CAA8C,CAAC,EAAE,OAAO,CAAC;IACzD,qDAAqD;IACrD,qCAAqC,CAAC,EAAE,OAAO,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uDAAuD;IACvD,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,GAAG,SAAS,CAAC;IACjE,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,6CAA6C;IAC7C,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAAI,SAAS,eAAe,KAAG,yBAKnE,CAAC;AAEH,eAAO,MAAM,2BAA2B,GACtC,SAAS,eAAe,KACvB,2BA2BF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,qBAAoC,EACpC,cAAa,KACZ,MAIC,CAAC"}
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,uBAAuB,EAAE,CAAC;IACjE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,4BAA4B,EAAE,OAAO,CAAC;IACtC,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0CAA0C,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACvE,oDAAoD;IACpD,8CAA8C,CAAC,EAAE,OAAO,CAAC;IACzD,qDAAqD;IACrD,qCAAqC,CAAC,EAAE,OAAO,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uDAAuD;IACvD,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9B,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,GAAG,SAAS,CAAC;IACjE,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,6CAA6C;IAC7C,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAAI,SAAS,eAAe,KAAG,yBAKnE,CAAC;AAEH,eAAO,MAAM,2BAA2B,GACtC,SAAS,eAAe,KACvB,2BA2BF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,MAAM,EACd,qBAAoC,EACpC,cAAa,KACZ,MAIC,CAAC"}

package/dist/oauth/endpoints/metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,aAAa,EAEb,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAoDjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAwB,EAA6B,EAAE,CAAC,CAAC;IACjG,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;IACjE,qBAAqB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAAwB,EACK,EAAE;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI;QACnE,2BAA2B,CAAC,IAAI;KACjC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,YAAY;QACjE,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ;QACrD,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,WAAW,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC;gBACE,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,SAAS;gBAC3D,0CAA0C,EAAE,wBAAwB;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QAC9C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,wBAAwB;QAC/D,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;QACnD,4BAA4B,EAAE,IAAI;QAClC,8CAA8C,EAAE,IAAI;QACpD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,YAAY,GAAG,qBAAqB,EACpC,KAAK,GAAG,KAAK,EACL,EAAE,CACV,qBAAqB,CAAC;IACpB,KAAK;IACL,mBAAmB,EAAE,GAAG,MAAM,wCAAwC,YAAY,EAAE;CACrF,CAAC,CAAC"}
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,aAAa,EAEb,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAkDjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAwB,EAA6B,EAAE,CAAC,CAAC;IACjG,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;IACjE,qBAAqB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAAwB,EACK,EAAE;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI;QACnE,2BAA2B,CAAC,IAAI;KACjC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,sBAAsB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,YAAY;QACjE,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,QAAQ;QACrD,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,WAAW,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC;gBACE,mBAAmB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,SAAS;gBAC3D,0CAA0C,EAAE,wBAAwB;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QAC9C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,wBAAwB;QAC/D,gBAAgB,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;QACnD,4BAA4B,EAAE,IAAI;QAClC,8CAA8C,EAAE,IAAI;QACpD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,YAAY,GAAG,qBAAqB,EACpC,KAAK,GAAG,KAAK,EACL,EAAE,CACV,qBAAqB,CAAC;IACpB,KAAK;IACL,mBAAmB,EAAE,GAAG,MAAM,wCAAwC,YAAY,EAAE;CACrF,CAAC,CAAC"}

package/dist/oauth/endpoints/register.js

@@ -8,8 +8,8 @@
 import { DEFAULT_OAUTH_BODY_LIMIT, readBoundedText } from "../../http/body.js";
 import { jsonResponse, POST_ONLY, requireHttpMethod } from "../../http/http.js";
 import { isJsonObject } from "../../util/json.js";
-import { oauthError, resolveSecrets } from "../config.js";
-import { GRANT_TYPES, MAX_CLIENT_REDIRECT_URIS, OAUTH_ERRORS } from "../constants.js";
+import { grantTypesOf, oauthError, resolveSecrets } from "../config.js";
+import { MAX_CLIENT_REDIRECT_URIS, OAUTH_ERRORS } from "../constants.js";
 import { seal } from "../crypto/sealed.js";
 import { CLAUDE_CALLBACK, isAllowedRedirectUri } from "../policy/redirect.js";
 import { readBodyOrError } from "../policy/reqbody.js";
@@ -73,7 +73,7 @@ const issueRegistration = async (request, options, redirectUris) => {
             client_id_issued_at: issuedAt,
             token_endpoint_auth_method: "none",
             redirect_uris: redirectUris,
-            grant_types: [GRANT_TYPES.authorizationCode],
+            grant_types: grantTypesOf(options.ports),
             response_types: ["code"],
         },
     });

package/dist/oauth/endpoints/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/register.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAsC,EAAE;IAC7E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF,kGAAkG;AAClG,MAAM,2BAA2B,GAAG,CAClC,IAA6B,EAC7B,OAA2B,EACN,EAAE;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,OAAO,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC5D,CAAC,CAAC,CAAC,eAAe,CAAC;YACnB,CAAC,CAAC,UAAU,CACR,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,kEAAkE,CACnE,CAAC;IACR,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC1C,OAAO,UAAU,CACf,YAAY,CAAC,qBAAqB,EAClC,GAAG,EACH,mCAAmC,wBAAwB,UAAU,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAC7B,OAAgB,EAChB,OAA2B,EAC3B,YAAsB,EACH,EAAE;IACrB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE;QAChD,YAAY;QACZ,GAAG,EAAE,QAAQ;KACY,CAAC,CAAC;IAE7B,6DAA6D;IAC7D,OAAO,YAAY,CAAC;QAClB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,QAAQ;YAC7B,0BAA0B,EAAE,MAAM;YAClC,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAC5C,cAAc,EAAE,CAAC,MAAM,CAAC;SACzB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,EACxD,YAAY,CAAC,qBAAqB,CACnC,CAAC;IACF,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,YAAY,YAAY,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/register.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAsC,EAAE;IAC7E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;AAChG,CAAC,CAAC;AAEF,kGAAkG;AAClG,MAAM,2BAA2B,GAAG,CAClC,IAA6B,EAC7B,OAA2B,EACN,EAAE;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,OAAO,oBAAoB,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC5D,CAAC,CAAC,CAAC,eAAe,CAAC;YACnB,CAAC,CAAC,UAAU,CACR,YAAY,CAAC,kBAAkB,EAC/B,GAAG,EACH,kEAAkE,CACnE,CAAC;IACR,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC1C,OAAO,UAAU,CACf,YAAY,CAAC,qBAAqB,EAClC,GAAG,EACH,mCAAmC,wBAAwB,UAAU,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAC7B,OAAgB,EAChB,OAA2B,EAC3B,YAAsB,EACH,EAAE;IACrB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE;QAChD,YAAY;QACZ,GAAG,EAAE,QAAQ;KACY,CAAC,CAAC;IAE7B,6DAA6D;IAC7D,OAAO,YAAY,CAAC;QAClB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,QAAQ;YAC7B,0BAA0B,EAAE,MAAM;YAClC,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;YACxC,cAAc,EAAE,CAAC,MAAM,CAAC;SACzB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAAgB,EAChB,OAA2B,EACR,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,EACxD,YAAY,CAAC,qBAAqB,CACnC,CAAC;IACF,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,YAAY,YAAY,QAAQ;QAAE,OAAO,YAAY,CAAC;IAC1D,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC,CAAC"}

package/dist/oauth/endpoints/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AA+G9D,eAAO,MAAM,WAAW,GACtB,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CAgClB,CAAC"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAoH9D,eAAO,MAAM,WAAW,GACtB,SAAS,OAAO,EAChB,SAAS,0BAA0B,KAClC,OAAO,CAAC,QAAQ,CA6BlB,CAAC"}

package/dist/oauth/endpoints/token.js

@@ -1,6 +1,7 @@
 import { NO_CORS, POST_ONLY, requireHttpMethod } from "../../http/http.js";
+import { ownValue } from "../../util/own.js";
 import { auditLegacyKeyUsage } from "../audit.js";
-import { advertisedScopes, oauthError, resolveSecrets, tokenResponse } from "../config.js";
+import { advertisedScopes, grantTypesOf, oauthError, resolveSecrets, tokenResponse, } from "../config.js";
 import { GRANT_TYPES, OAUTH_ERRORS } from "../constants.js";
 import { firstClientAuthError, readClientAuth } from "../crypto/clientauth.js";
 import { consumeAuthCodeDetailed } from "../crypto/codes.js";
@@ -23,6 +24,11 @@ const handleRefresh = async ({ body, options, expectedResource, clientId }) => {
     let requestedScope;
     if (body.scope !== undefined && body.scope !== "") {
         const requested = requestedScopes(body.scope, []);
+        // `scope=" "` parses to nothing: an omitted scope keeps the original grant,
+        // so a whitespace-only one must not reach the port as `""` for it to guess.
+        if (requested.length === 0) {
+            return oauthError(OAUTH_ERRORS.invalidScope, 400, "scope must not be empty");
+        }
         const scopeError = firstScopeError(requested, advertisedScopes(options));
         if (scopeError)
             return scopeError;
@@ -104,12 +110,9 @@ export const handleToken = async (request, options) => {
         return clientAuthError;
     const url = new URL(request.url);
     const expectedResource = canonicalResource(url.origin, options.resourcePath);
-    const handler = GRANT_HANDLERS[body.grant_type ?? ""];
+    const handler = ownValue(GRANT_HANDLERS, body.grant_type ?? "");
     if (!handler) {
-        const supported = [GRANT_TYPES.authorizationCode];
-        if (options.ports.refreshAccessToken) {
-            supported.push(GRANT_TYPES.refreshToken);
-        }
+        const supported = grantTypesOf(options.ports);
         return oauthError(OAUTH_ERRORS.unsupportedGrantType, 400, `supported: ${supported.join(", ")}`);
     }
     return handler({

package/dist/oauth/endpoints/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAkB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAuB,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAcnF,MAAM,aAAa,GAAiB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC1F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,+EAA+E;IAC/E,IAAI,cAAkC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,sGAAsG;IACtG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACpD,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IACD,4EAA4E;IAC5E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAAsB,EACtB,IAA4B,EAC5B,QAAgB,EACC,EAAE;IACnB,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACpD,WAAW,EAAE,uBAAuB;SACrC;QACD;YACE,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAChC,WAAW,EAAE,oBAAoB;SAClC;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiB,KAAK,EAAE,EAC1C,OAAO,EACP,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;QACvE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACtC,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiC;IACnD,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc;IAC/C,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACrC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;QACb,OAAO;QACP,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAuB,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAcnF,MAAM,aAAa,GAAiB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC1F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,+EAA+E;IAC/E,IAAI,cAAkC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,sGAAsG;IACtG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACpD,YAAY;QACZ,QAAQ;QACR,QAAQ,EAAE,gBAAgB;QAC1B,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IACD,4EAA4E;IAC5E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAAsB,EACtB,IAA4B,EAC5B,QAAgB,EACC,EAAE;IACnB,MAAM,IAAI,GAAG;QACX;YACE,EAAE,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YACpD,WAAW,EAAE,uBAAuB;SACrC;QACD;YACE,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAChC,WAAW,EAAE,oBAAoB;SAClC;KACF,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiB,KAAK,EAAE,EAC1C,OAAO,EACP,IAAI,EACJ,OAAO,EACP,gBAAgB,EAChB,QAAQ,GACT,EAAE,EAAE;IACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;QACvE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IACtC,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAiC;IACnD,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc;IAC/C,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,OAAgB,EAChB,OAAmC,EAChB,EAAE;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;QACb,OAAO;QACP,IAAI;QACJ,OAAO;QACP,gBAAgB;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/oauth/endpoints/wellknown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wellknown.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/wellknown.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAalE,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,kBAAkB,EAC3B,OAAO;IACL,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,KACA,OAAO,CAAC,QAAQ,GAAG,IAAI,CAuBzB,CAAC"}
+{"version":3,"file":"wellknown.d.ts","sourceRoot":"","sources":["../../../src/oauth/endpoints/wellknown.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtD,eAAO,MAAM,eAAe,GAC1B,SAAS,OAAO,EAChB,SAAS,kBAAkB,EAC3B,OAAO;IACL,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,KACA,OAAO,CAAC,QAAQ,GAAG,IAAI,CAuBzB,CAAC"}

package/dist/oauth/endpoints/wellknown.js

@@ -1,14 +1,7 @@
 import { GET_ONLY, jsonResponse, requireHttpMethod } from "../../http/http.js";
 import { pickDefined } from "../../util/defined.js";
-import { unregisteredClientsAllowed } from "../config.js";
-import { GRANT_TYPES } from "../constants.js";
-import { authorizationServerMetadata, protectedResourceMetadata, } from "./metadata.js";
-const grantTypesOf = (ports) => {
-    const grants = [GRANT_TYPES.authorizationCode];
-    if (ports.refreshAccessToken)
-        grants.push(GRANT_TYPES.refreshToken);
-    return grants;
-};
+import { grantTypesOf, unregisteredClientsAllowed } from "../config.js";
+import { authorizationServerMetadata, protectedResourceMetadata } from "./metadata.js";
 export const handleWellKnown = async (request, options, paths) => {
     const url = new URL(request.url);
     const path = url.pathname;

package/dist/oauth/endpoints/wellknown.js.map

@@ -1 +1 @@
-{"version":3,"file":"wellknown.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EACL,2BAA2B,EAE3B,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAe,EAAE;IACtD,MAAM,MAAM,GAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,kBAAkB;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAA2B,EAC3B,KAKC,EACyB,EAAE;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAC/D,UAAU,EAAE,0BAA0B,CAAC,OAAO,CAAC;QAC/C,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,aAAa,EAAE,OAAO,CAAC,IAAI,KAAK,IAAI;KACrC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC,CAAC"}
+{"version":3,"file":"wellknown.js","sourceRoot":"","sources":["../../../src/oauth/endpoints/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAEvF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAgB,EAChB,OAA2B,EAC3B,KAKC,EACyB,EAAE;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QAC/D,UAAU,EAAE,0BAA0B,CAAC,OAAO,CAAC;QAC/C,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrD,aAAa,EAAE,OAAO,CAAC,IAAI,KAAK,IAAI;KACrC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC,CAAC"}

package/dist/oauth/policy/redirect.d.ts

@@ -1,4 +1,6 @@
 export declare const CLAUDE_CALLBACK = "https://claude.ai/api/mcp/auth_callback";
+/** ChatGPT's stable connector redirect. */
+export declare const CHATGPT_CALLBACK = "https://chatgpt.com/connector_platform_oauth_redirect";
 export type RedirectAllowlistOptions = {
     /** Extra exact-match redirect URIs. */
     extra?: string[];
@@ -11,6 +13,8 @@ export type RedirectAllowlistOptions = {
     allowLoopback?: boolean;
     /** Allow the Claude.ai Custom Connector callback. Default true. */
     allowClaude?: boolean;
+    /** Allow ChatGPT's per-connector callback (`/connector/oauth/{id}`). Default false. */
+    allowChatgptConnector?: boolean;
 };
 export declare const isAllowedRedirectUri: (uri: string, options?: RedirectAllowlistOptions) => boolean;
 //# sourceMappingURL=redirect.d.ts.map

package/dist/oauth/policy/redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4CAA4C,CAAC;AAEzE,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAuCF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,EACX,UAAS,wBAA6B,KACrC,OAGF,CAAC"}
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,4CAA4C,CAAC;AAEzE,2CAA2C;AAC3C,eAAO,MAAM,gBAAgB,0DAA0D,CAAC;AAUxF,MAAM,MAAM,wBAAwB,GAAG;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AA+CF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,EACX,UAAS,wBAA6B,KACrC,OAGF,CAAC"}

package/dist/oauth/policy/redirect.js

@@ -1,5 +1,14 @@
 export const CLAUDE_CALLBACK = "https://claude.ai/api/mcp/auth_callback";
+/** ChatGPT's stable connector redirect. */
+export const CHATGPT_CALLBACK = "https://chatgpt.com/connector_platform_oauth_redirect";
+/**
+ * ChatGPT's per-connector redirect, `https://chatgpt.com/connector/oauth/{id}`.
+ * The id is minted per connector, so it can't be listed ahead of time. Matched
+ * against the raw string: one id segment, no port, query or fragment.
+ */
+const CHATGPT_CONNECTOR_CALLBACK = /^https:\/\/chatgpt\.com\/connector\/oauth\/[A-Za-z0-9_-]{1,128}$/;
 const isClaudeCallback = (uri, options) => options.allowClaude !== false && uri === CLAUDE_CALLBACK;
+const isChatgptConnectorCallback = (uri, options) => options.allowChatgptConnector === true && CHATGPT_CONNECTOR_CALLBACK.test(uri);
 const isExtraAllowed = (uri, options) => Boolean(options.extra?.includes(uri));
 /**
  * WHATWG URL keeps IPv6 hosts bracketed, so `[::1]` is the parsed hostname.
@@ -20,7 +29,12 @@ const isLoopbackHttp = (uri, options) => {
         return false;
     }
 };
-const REDIRECT_PREDICATES = [isClaudeCallback, isExtraAllowed, isLoopbackHttp];
+const REDIRECT_PREDICATES = [
+    isClaudeCallback,
+    isChatgptConnectorCallback,
+    isExtraAllowed,
+    isLoopbackHttp,
+];
 /** RFC 6749 forbids a fragment in redirect_uri; embedded credentials are never legitimate. */
 const carriesFragmentOrCredentials = (uri) => {
     try {

package/dist/oauth/policy/redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAkBzE,MAAM,gBAAgB,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC;AAE3D,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAElG;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAwB,CAAC,gBAAgB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAEpG,8FAA8F;AAC9F,MAAM,4BAA4B,GAAG,CAAC,GAAW,EAAW,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAW,EACX,UAAoC,EAAE,EAC7B,EAAE;IACX,IAAI,4BAA4B,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../../src/oauth/policy/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAEzE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AAExF;;;;GAIG;AACH,MAAM,0BAA0B,GAC9B,kEAAkE,CAAC;AAoBrE,MAAM,gBAAgB,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAC3D,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC;AAE3D,MAAM,0BAA0B,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CACrE,OAAO,CAAC,qBAAqB,KAAK,IAAI,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEjF,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAElG;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD,MAAM,cAAc,GAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;IACzD,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAwB;IAC/C,gBAAgB;IAChB,0BAA0B;IAC1B,cAAc;IACd,cAAc;CACf,CAAC;AAEF,8FAA8F;AAC9F,MAAM,4BAA4B,GAAG,CAAC,GAAW,EAAW,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAW,EACX,UAAoC,EAAE,EAC7B,EAAE;IACX,IAAI,4BAA4B,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}

package/dist/oauth/policy/reqbody.d.ts

@@ -4,7 +4,12 @@
  * `/token` must not get a misleading `token required` and assume the token
  * is dead.
  */
-/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
+/**
+ * JSON when the *media type* is `application/json` (parameters such as
+ * `charset` are ignored); form-encoded otherwise (the RFC 6749 default). A
+ * substring match would also take `text/plain; x=application/json`, a
+ * "simple" content type a cross-site page can send without a preflight.
+ */
 export declare const readOAuthBody: (request: Request) => Promise<Record<string, string>>;
 /**
  * Runs `read` and turns its two failure modes into the `Response` every

package/dist/oauth/policy/reqbody.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reqbody.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyCH,uFAAuF;AACvF,eAAO,MAAM,aAAa,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGpF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,EACrC,MAAM,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,uBAAsB,MAAoC,KACzD,OAAO,CAAC,CAAC,GAAG,QAAQ,CAStB,CAAC"}
+{"version":3,"file":"reqbody.d.ts","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyCH;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGpF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,EACrC,MAAM,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,uBAAsB,MAAoC,KACzD,OAAO,CAAC,CAAC,GAAG,QAAQ,CAStB,CAAC"}

package/dist/oauth/policy/reqbody.js

@@ -41,10 +41,15 @@ const readFormBody = async (request) => {
     }
     return body;
 };
-/** JSON when `Content-Type` says so; form-encoded otherwise (the RFC 6749 default). */
+/**
+ * JSON when the *media type* is `application/json` (parameters such as
+ * `charset` are ignored); form-encoded otherwise (the RFC 6749 default). A
+ * substring match would also take `text/plain; x=application/json`, a
+ * "simple" content type a cross-site page can send without a preflight.
+ */
 export const readOAuthBody = async (request) => {
-    const ctype = request.headers.get("Content-Type") ?? "";
-    return ctype.includes("application/json") ? readJsonBody(request) : readFormBody(request);
+    const mediaType = (request.headers.get("Content-Type") ?? "").split(";")[0]?.trim().toLowerCase();
+    return mediaType === "application/json" ? readJsonBody(request) : readFormBody(request);
 };
 /**
  * Runs `read` and turns its two failure modes into the `Response` every

package/dist/oauth/policy/reqbody.js.map

@@ -1 +1 @@
-{"version":3,"file":"reqbody.js","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAsB,EACtB,uBAA+B,YAAY,CAAC,cAAc,EACnC,EAAE;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"reqbody.js","sourceRoot":"","sources":["../../../src/oauth/policy/reqbody.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACvF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClG,OAAO,SAAS,KAAK,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC1F,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAsB,EACtB,uBAA+B,YAAY,CAAC,cAAc,EACnC,EAAE;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,YAAY,iBAAiB,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CAAC"}

package/dist/oauth/router.js

@@ -4,7 +4,7 @@ import { assertCodeSecret, assertScopeConfig, oauthError, unregisteredClientsAll
 import { DEFAULT_OAUTH_PATH, OAUTH_ERRORS } from "./constants.js";
 import { processCodeStore } from "./crypto/codes.js";
 import { handleAuthorize } from "./endpoints/authorize.js";
-import { handleConsent } from "./endpoints/consent.js";
+import { handleConsent } from "./endpoints/consent/handler.js";
 import { handleRegister } from "./endpoints/register.js";
 import { handleRevoke } from "./endpoints/revoke.js";
 import { handleToken } from "./endpoints/token.js";

package/dist/oauth/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAkBtF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IAChE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC,CAAC;AASF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAA2B,EAAe,EAAE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEnF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,6EAA6E,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ,EAAE,IAAI,GAAG,CAAC;YAChB,uCAAuC;YACvC,wCAAwC,YAAY,EAAE;SACvD,CAAC;QACF,OAAO,EAAE,IAAI,GAAG,CAAC;YACf,yCAAyC;YACzC,0CAA0C,YAAY,EAAE;SACzD,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,OAA2B,EAC3B,iBAA6C,EAC7C,SAAiB,EACa,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;SAC5F;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC7F,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACzF,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC3B,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC;SACxF;QACH,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,wDAAwD;IACxD,oEAAoE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAC9D,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAE9C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAErF,sEAAsE;IACtE,MAAM,iBAAiB,GAA+B;QACpD,GAAG,OAAO;QACV,YAAY;QACZ,SAAS;QACT,KAAK;KACN,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAElE,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE;oBAC9D,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,cAAc,CAAC,iBAAiB,EAAE;oBACtC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;iBAC5B,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAGL,cAAc,EACd,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,iEAAiE;AACjE,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAkBtF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAA2B,EAAQ,EAAE;IAChE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC,CAAC;AASF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,OAA2B,EAAe,EAAE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAEnF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iBAAiB,YAAY,6EAA6E,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ,EAAE,IAAI,GAAG,CAAC;YAChB,uCAAuC;YACvC,wCAAwC,YAAY,EAAE;SACvD,CAAC;QACF,OAAO,EAAE,IAAI,GAAG,CAAC;YACf,yCAAyC;YACzC,0CAA0C,YAAY,EAAE;SACzD,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,OAA2B,EAC3B,iBAA6C,EAC7C,SAAiB,EACa,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,WAAW,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;SAC5F;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,GAAG,SAAS,YAAY,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAC7F,CAAC,GAAG,SAAS,UAAU,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACzF,CAAC,GAAG,SAAS,QAAQ,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW;QAC3B,CAAC,CAAC;YACE,CAAC,GAAG,SAAS,SAAS,CAAC,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,iBAAiB,CAAC;SACxF;QACH,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,wDAAwD;IACxD,oEAAoE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAC9D,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAE9C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAErF,sEAAsE;IACtE,MAAM,iBAAiB,GAA+B;QACpD,GAAG,OAAO;QACV,YAAY;QACZ,SAAS;QACT,KAAK;KACN,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAElE,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,OAAgB,EAA4B,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE;oBAC9D,QAAQ;oBACR,OAAO;oBACP,YAAY;oBACZ,SAAS;iBACV,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAExB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,cAAc,CAAC,iBAAiB,EAAE;oBACtC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC;iBAC5B,CAAC,CAAC;gBACH,OAAO,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAGL,cAAc,EACd,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,iEAAiE;AACjE,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC"}

package/dist/oauth/types.d.ts

@@ -33,7 +33,9 @@ export type ConsentOptions = {
      * redirect to your own route. Omit for the built-in hardened interstitial.
      *
      * If your page sets its own `Content-Security-Policy` with `form-action`,
-     * include `new URL(input.redirectUri).origin` in it — Chromium enforces
+     * include the redirect target's origin in it (`new URL(input.redirectUri).origin`;
+     * for a custom-scheme URI such as `myapp://cb` that origin is the opaque
+     * `"null"`, so use the scheme `myapp:` instead) — Chromium enforces
      * `form-action` across the redirect your approval POST triggers, not just
      * the immediate submission target, so `'self'` alone blocks the eventual
      * redirect back to the client's own callback.

package/dist/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;OAUG;IACH,UAAU,EACN,MAAM,GACN,MAAM,EAAE,GACR,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EACf,CAAC,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,GACjE,SAAS,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE,gGAAgG;IAChG,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,gFAAgF;IAChF,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,kBAAkB,GAAG;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,6DAA6D;IAC7D,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;OAUG;IACH,UAAU,EACN,MAAM,GACN,MAAM,EAAE,GACR,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,+DAA+D;IAC/D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,+EAA+E;IAC/E,eAAe,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,mEAAmE;IACnE,kBAAkB,CAAC,EACf,CAAC,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,GACjE,SAAS,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE,gGAAgG;IAChG,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,sEAAsE;IACtE,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrD;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,gFAAgF;IAChF,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,kBAAkB,GAAG;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 export { createMcpApp, type McpApp, type McpAppAuth, type McpAppOptions, type UnifiedAuditEntry, type VerifiedToken, } from "./app.js";
 export { consoleAudit } from "./audit.js";
 export { parseBearer, rejectQueryToken, type WwwAuthenticateOptions, wwwAuthenticateHeader, } from "./auth/bearer.js";
-export { type SignedTokenAuthOptions, signedTokenAuth, } from "./auth/signed-token.js";
+export { type SignedTokenAuthOptions, signedTokenAuth, } from "./auth/signed/token.js";
 export { authMethodsFor, CLIENT_PROFILES, type ClientName, type ClientProfile, DEFAULT_CLIENTS, hasDynamicClient, preRegisteredClients, redirectUrisFor, } from "./clients.js";
 export * from "./deprecated.js";
 export { type JsonResponseInput, type JsonResponseOptions, jsonResponse, } from "./http/http.js";

package/dist/server.js

@@ -1,7 +1,7 @@
 export { createMcpApp, } from "./app.js";
 export { consoleAudit } from "./audit.js";
 export { parseBearer, rejectQueryToken, wwwAuthenticateHeader, } from "./auth/bearer.js";
-export { signedTokenAuth, } from "./auth/signed-token.js";
+export { signedTokenAuth, } from "./auth/signed/token.js";
 export { authMethodsFor, CLIENT_PROFILES, DEFAULT_CLIENTS, hasDynamicClient, preRegisteredClients, redirectUrisFor, } from "./clients.js";
 // Moved to `mcp-trellis/advanced`; deprecated aliases until 3.0.
 export * from "./deprecated.js";

package/dist/util/clip.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The first `max` UTF-16 units of `value`, without leaving half a surrogate
+ * pair at the cut — a lone surrogate is invalid in JSON and many DB sinks.
+ * `suffix` is appended only when something was cut.
+ */
+export declare const clipText: (value: string, max: number, suffix?: string) => string;
+//# sourceMappingURL=clip.d.ts.map

package/dist/util/clip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clip.d.ts","sourceRoot":"","sources":["../../src/util/clip.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,EAAE,KAAK,MAAM,EAAE,eAAW,KAAG,MAKlE,CAAC"}

package/dist/util/clip.js

@@ -0,0 +1,13 @@
+/**
+ * The first `max` UTF-16 units of `value`, without leaving half a surrogate
+ * pair at the cut — a lone surrogate is invalid in JSON and many DB sinks.
+ * `suffix` is appended only when something was cut.
+ */
+export const clipText = (value, max, suffix = "") => {
+    if (value.length <= max)
+        return value;
+    const last = value.charCodeAt(max - 1);
+    const cut = last >= 0xd800 && last <= 0xdbff ? max - 1 : max;
+    return `${value.slice(0, cut)}${suffix}`;
+};
+//# sourceMappingURL=clip.js.map

package/dist/util/clip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clip.js","sourceRoot":"","sources":["../../src/util/clip.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,MAAM,GAAG,EAAE,EAAU,EAAE;IAC1E,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;AAC3C,CAAC,CAAC"}

package/dist/util/json.d.ts

@@ -1,3 +1,8 @@
 /** A parsed JSON object — not `null`, not an array. */
 export declare const isJsonObject: (value: unknown) => value is Record<string, unknown>;
+/**
+ * True when two JSON values match structurally (object key order ignored).
+ * ponytail: assumes acyclic JSON-parsed inputs; upgrade = depth/cycle guard.
+ */
+export declare const areJsonValuesEqual: (value: unknown, other: unknown) => boolean;
 //# sourceMappingURL=json.d.ts.map

package/dist/util/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/util/json.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACP,CAAC"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/util/json.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACP,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,EAAE,OAAO,OAAO,KAAG,OAqBnE,CAAC"}

package/dist/util/json.js

@@ -1,3 +1,24 @@
 /** A parsed JSON object — not `null`, not an array. */
 export const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * True when two JSON values match structurally (object key order ignored).
+ * ponytail: assumes acyclic JSON-parsed inputs; upgrade = depth/cycle guard.
+ */
+export const areJsonValuesEqual = (value, other) => {
+    // `===` (not `Object.is`): JSON `-0` must still equal `0`, as `enum.includes` always did.
+    if (value === other)
+        return true;
+    if (Array.isArray(value) || Array.isArray(other)) {
+        return (Array.isArray(value) &&
+            Array.isArray(other) &&
+            value.length === other.length &&
+            value.every((item, index) => areJsonValuesEqual(item, other[index])));
+    }
+    if (!isJsonObject(value) || !isJsonObject(other))
+        return false;
+    const valueKeys = Object.keys(value);
+    const otherKeys = Object.keys(other);
+    return (valueKeys.length === otherKeys.length &&
+        valueKeys.every((key) => Object.hasOwn(other, key) && areJsonValuesEqual(value[key], other[key])));
+};
 //# sourceMappingURL=json.js.map

package/dist/util/json.js.map

@@ -1 +1 @@
-{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/util/json.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAoC,EAAE,CAC/E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/util/json.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAoC,EAAE,CAC/E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAE,KAAc,EAAW,EAAE;IAC5E,0FAA0F;IAC1F,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC7B,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QACrC,SAAS,CAAC,KAAK,CACb,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CACjF,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/util/own.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `record[key]` for an attacker-supplied `key`: only an own property counts.
+ * A plain object literal also answers `"constructor"`, `"toString"` and
+ * `"__proto__"` from `Object.prototype`, which would otherwise be mistaken
+ * for a registered handler.
+ */
+export declare const ownValue: <V>(record: Readonly<Record<string, V>>, key: string) => V | undefined;
+//# sourceMappingURL=own.d.ts.map

package/dist/util/own.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"own.d.ts","sourceRoot":"","sources":["../../src/util/own.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,QAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,KAAG,CAAC,GAAG,SAC7B,CAAC"}