@12-apps/mcp 3.2.0 → 3.2.1

package/dist/chunk-UIILEGAC.js

@@ -0,0 +1,1247 @@
+import {
+  buildAuthorizationServerMetadata,
+  buildProtectedResourceMetadata
+} from "./chunk-WJJNKKNS.js";
+import {
+  __name
+} from "./chunk-7QVYU63E.js";
+
+// src/oauth/config.ts
+var MCP_SUPPORTED_SCOPES = ["mcp:read", "mcp:write"];
+var DEFAULT_MCP_RESOURCE_PATH = "/api/mcp";
+function issuer(origin) {
+  return origin;
+}
+__name(issuer, "issuer");
+function resourceAudience(origin, resourcePath = DEFAULT_MCP_RESOURCE_PATH) {
+  return `${origin}${resourcePath}`;
+}
+__name(resourceAudience, "resourceAudience");
+var HOST_ONLY = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*(?::\d{1,5})?$/i;
+var SLASH = 47;
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === SLASH) end -= 1;
+  return value.slice(0, end);
+}
+__name(stripTrailingSlashes, "stripTrailingSlashes");
+function normalizeOrigins(origins) {
+  return origins.map((origin) => stripTrailingSlashes(origin.trim())).filter(Boolean);
+}
+__name(normalizeOrigins, "normalizeOrigins");
+function trustedOriginsFromEnv(name) {
+  const raw = typeof process === "undefined" ? void 0 : process.env?.[name];
+  return raw ? normalizeOrigins(raw.split(",")) : [];
+}
+__name(trustedOriginsFromEnv, "trustedOriginsFromEnv");
+function claimedForwardedOrigin(getHeader) {
+  const host = getHeader("x-forwarded-host")?.split(",")[0]?.trim();
+  if (!host || !HOST_ONLY.test(host)) return null;
+  const proto = getHeader("x-forwarded-proto")?.split(",")[0]?.trim();
+  return `${proto === "http" ? "http" : "https"}://${host}`;
+}
+__name(claimedForwardedOrigin, "claimedForwardedOrigin");
+function resolveTrustedOrigin(getHeader, fallbackOrigin, trustedOrigins = []) {
+  const [canonical, ...rest] = normalizeOrigins(trustedOrigins);
+  if (!canonical) return fallbackOrigin;
+  const allowed = [canonical, ...rest];
+  const claimed = claimedForwardedOrigin(getHeader);
+  return claimed && allowed.includes(claimed) ? claimed : canonical;
+}
+__name(resolveTrustedOrigin, "resolveTrustedOrigin");
+function originFromRequest(request, trustedOrigins = []) {
+  const fallback = new URL(request.url).origin;
+  return resolveTrustedOrigin((name) => request.headers.get(name), fallback, trustedOrigins) ?? fallback;
+}
+__name(originFromRequest, "originFromRequest");
+
+// src/oauth/keys.ts
+import { exportJWK, importPKCS8 } from "jose";
+var SIGNING_ALG = "ES256";
+async function parseSigningKey(pem, kid) {
+  const privateKey = await importPKCS8(pem, SIGNING_ALG, { extractable: true });
+  const jwk = await exportJWK(privateKey);
+  const { d: _private, ...publicHalf } = jwk;
+  void _private;
+  const publicJwk = {
+    ...publicHalf,
+    kty: "EC",
+    crv: "P-256",
+    alg: SIGNING_ALG,
+    use: "sig",
+    kid
+  };
+  return { privateKey, publicJwk, kid };
+}
+__name(parseSigningKey, "parseSigningKey");
+function signingKeyProvider(read) {
+  let cache = null;
+  return async () => {
+    const { pem, kid } = read();
+    if (!pem || !kid) return null;
+    const cacheKey = `${kid} ${pem}`;
+    if (cache?.key === cacheKey) return cache.promise;
+    const promise = parseSigningKey(pem, kid);
+    cache = { key: cacheKey, promise };
+    return promise;
+  };
+}
+__name(signingKeyProvider, "signingKeyProvider");
+var DEFAULT_SIGNING_KEY_ENV = "MCP_OAUTH_SIGNING_KEY";
+var DEFAULT_SIGNING_KEY_ID_ENV = "MCP_OAUTH_SIGNING_KEY_ID";
+function loadSigningKeyFromEnv(keyEnv = DEFAULT_SIGNING_KEY_ENV, kidEnv = DEFAULT_SIGNING_KEY_ID_ENV) {
+  return signingKeyProvider(() => ({
+    pem: typeof process === "undefined" ? void 0 : process.env?.[keyEnv],
+    kid: typeof process === "undefined" ? void 0 : process.env?.[kidEnv]
+  }));
+}
+__name(loadSigningKeyFromEnv, "loadSigningKeyFromEnv");
+
+// src/oauth/authorization-code.ts
+import { SignJWT, jwtVerify, importJWK } from "jose";
+var AUTHORIZATION_CODE_AUDIENCE = "oauth:code";
+var AUTHORIZATION_CODE_TTL_SECONDS = 60;
+var CLOCK_TOLERANCE_SECONDS = 5;
+var AuthorizationCodeError = class extends Error {
+  static {
+    __name(this, "AuthorizationCodeError");
+  }
+  code;
+  constructor(message) {
+    super(message ?? "invalid_grant");
+    this.name = "AuthorizationCodeError";
+    this.code = "invalid_grant";
+  }
+};
+function nowSeconds(now) {
+  return Math.floor((now ?? Date.now()) / 1e3);
+}
+__name(nowSeconds, "nowSeconds");
+function stringClaim(payload, key) {
+  const value = payload[key];
+  return typeof value === "string" ? value : null;
+}
+__name(stringClaim, "stringClaim");
+function extractBoundFields(payload) {
+  const sub = stringClaim(payload, "sub");
+  const email = stringClaim(payload, "email");
+  const clientId = stringClaim(payload, "client_id");
+  const redirectUri = stringClaim(payload, "redirect_uri");
+  const codeChallenge = stringClaim(payload, "code_challenge");
+  const scope = stringClaim(payload, "scope");
+  const jti = stringClaim(payload, "jti");
+  if (!sub || !email || !clientId || !redirectUri || !codeChallenge || scope === null || !jti) {
+    throw new AuthorizationCodeError("code is missing required bound fields");
+  }
+  return { sub, email, clientId, redirectUri, codeChallenge, scope, jti };
+}
+__name(extractBoundFields, "extractBoundFields");
+async function mintCode(loadSigningKey, input, options) {
+  const key = await loadSigningKey();
+  if (!key) return null;
+  const iat = nowSeconds(options?.now);
+  const exp = iat + AUTHORIZATION_CODE_TTL_SECONDS;
+  const claims = {
+    email: input.email,
+    client_id: input.clientId,
+    redirect_uri: input.redirectUri,
+    code_challenge: input.codeChallenge,
+    scope: input.scope
+  };
+  return new SignJWT(claims).setProtectedHeader({ alg: SIGNING_ALG, kid: key.kid }).setIssuer(issuer(input.origin)).setAudience(AUTHORIZATION_CODE_AUDIENCE).setSubject(input.sub).setIssuedAt(iat).setExpirationTime(exp).setJti(crypto.randomUUID()).sign(key.privateKey);
+}
+__name(mintCode, "mintCode");
+async function verifyCode(loadSigningKey, code, options) {
+  const key = await loadSigningKey();
+  if (!key) {
+    throw new AuthorizationCodeError("no signing key configured");
+  }
+  const publicKey = await importJWK(key.publicJwk, SIGNING_ALG);
+  let payload;
+  try {
+    const result = await jwtVerify(code, publicKey, {
+      algorithms: [SIGNING_ALG],
+      issuer: issuer(options.origin),
+      audience: AUTHORIZATION_CODE_AUDIENCE,
+      clockTolerance: CLOCK_TOLERANCE_SECONDS,
+      currentDate: options.now === void 0 ? void 0 : new Date(options.now)
+    });
+    payload = result.payload;
+  } catch {
+    throw new AuthorizationCodeError("code verification failed");
+  }
+  return extractBoundFields(payload);
+}
+__name(verifyCode, "verifyCode");
+
+// src/oauth/clients.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+var DEFAULT_GRANT_TYPES = ["authorization_code", "refresh_token"];
+var CLIENT_SECRET_BYTES = 32;
+function hashSecret(secret) {
+  return createHash("sha256").update(secret).digest("hex");
+}
+__name(hashSecret, "hashSecret");
+async function registerClient(store, input) {
+  const clientId = randomUUID();
+  const authMethod = input.tokenEndpointAuthMethod ?? "none";
+  const grantTypes = input.grantTypes ?? [...DEFAULT_GRANT_TYPES];
+  const clientSecret = authMethod === "client_secret_basic" ? randomBytes(CLIENT_SECRET_BYTES).toString("hex") : void 0;
+  const row = await store.create({
+    clientId,
+    clientSecretHash: clientSecret ? hashSecret(clientSecret) : null,
+    redirectUris: input.redirectUris,
+    clientName: input.clientName ?? null,
+    tokenEndpointAuthMethod: authMethod,
+    grantTypes,
+    scopes: input.scopes
+  });
+  return {
+    clientId: row.clientId,
+    ...clientSecret ? { clientSecret } : {},
+    redirectUris: row.redirectUris,
+    clientName: row.clientName,
+    tokenEndpointAuthMethod: row.tokenEndpointAuthMethod,
+    grantTypes: row.grantTypes,
+    scopes: row.scopes
+  };
+}
+__name(registerClient, "registerClient");
+function matchesRedirectUri(client, redirectUri) {
+  if (!redirectUri) return false;
+  return client.redirectUris.includes(redirectUri);
+}
+__name(matchesRedirectUri, "matchesRedirectUri");
+var DEFAULT_PROVIDER_ROOTS = [
+  { roots: ["claude.ai", "anthropic.com"], provider: "claude" },
+  { roots: ["chatgpt.com", "openai.com"], provider: "chatgpt" }
+];
+function hostMatchesRoot(host, root) {
+  return host === root || host.endsWith(`.${root}`);
+}
+__name(hostMatchesRoot, "hostMatchesRoot");
+function providerFromRedirectUris(redirectUris, rules = DEFAULT_PROVIDER_ROOTS) {
+  for (const uri of redirectUris) {
+    let host;
+    try {
+      host = new URL(uri).host.toLowerCase();
+    } catch {
+      continue;
+    }
+    const match = rules.find((rule) => rule.roots.some((root) => hostMatchesRoot(host, root)));
+    if (match) return match.provider;
+  }
+  return null;
+}
+__name(providerFromRedirectUris, "providerFromRedirectUris");
+
+// src/oauth/pkce.ts
+var SUPPORTED_CHALLENGE_METHOD = "S256";
+var UnsupportedChallengeMethodError = class extends Error {
+  static {
+    __name(this, "UnsupportedChallengeMethodError");
+  }
+  method;
+  constructor(method) {
+    super(
+      `unsupported code_challenge_method '${method}' \u2014 only ${SUPPORTED_CHALLENGE_METHOD} is allowed`
+    );
+    this.name = "UnsupportedChallengeMethodError";
+    this.method = method;
+  }
+};
+function base64UrlEncode(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+__name(base64UrlEncode, "base64UrlEncode");
+async function computeChallenge(verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(new Uint8Array(digest));
+}
+__name(computeChallenge, "computeChallenge");
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+__name(constantTimeEquals, "constantTimeEquals");
+async function verifyChallenge(verifier, storedChallenge, method = SUPPORTED_CHALLENGE_METHOD) {
+  if (method !== SUPPORTED_CHALLENGE_METHOD) {
+    throw new UnsupportedChallengeMethodError(method);
+  }
+  if (!storedChallenge) return false;
+  const computed = await computeChallenge(verifier);
+  return constantTimeEquals(computed, storedChallenge);
+}
+__name(verifyChallenge, "verifyChallenge");
+
+// src/oauth/code-replay.ts
+var RETENTION_MS = 9e4;
+function inProcessCodeReplayStore() {
+  const usedJtis = /* @__PURE__ */ new Map();
+  return {
+    consume(jti, nowMs) {
+      for (const [seen, expiresAt] of usedJtis) {
+        if (expiresAt <= nowMs) usedJtis.delete(seen);
+      }
+      if (usedJtis.has(jti)) return false;
+      usedJtis.set(jti, nowMs + RETENTION_MS);
+      return true;
+    }
+  };
+}
+__name(inProcessCodeReplayStore, "inProcessCodeReplayStore");
+
+// src/oauth/access-token.ts
+import { SignJWT as SignJWT2, jwtVerify as jwtVerify2, importJWK as importJWK2 } from "jose";
+var ACCESS_TOKEN_TTL_SECONDS = 15 * 60;
+var CLOCK_TOLERANCE_SECONDS2 = 5;
+var AccessTokenError = class extends Error {
+  static {
+    __name(this, "AccessTokenError");
+  }
+  code;
+  constructor(code, message) {
+    super(message ?? code);
+    this.name = "AccessTokenError";
+    this.code = code;
+  }
+};
+function nowSeconds2(now) {
+  return Math.floor((now ?? Date.now()) / 1e3);
+}
+__name(nowSeconds2, "nowSeconds");
+async function signAccessToken(loadSigningKey, input, options) {
+  const key = await loadSigningKey();
+  if (!key) return null;
+  const iat = nowSeconds2(options?.now);
+  const exp = iat + (input.ttlSeconds ?? ACCESS_TOKEN_TTL_SECONDS);
+  const scope = input.scopes.join(" ");
+  return new SignJWT2({ email: input.email, scope }).setProtectedHeader({ alg: SIGNING_ALG, kid: key.kid }).setIssuer(issuer(input.origin)).setAudience(resourceAudience(input.origin, input.resourcePath ?? DEFAULT_MCP_RESOURCE_PATH)).setSubject(input.subject).setIssuedAt(iat).setExpirationTime(exp).setJti(crypto.randomUUID()).sign(key.privateKey);
+}
+__name(signAccessToken, "signAccessToken");
+function parseScopes(scope) {
+  if (typeof scope !== "string" || scope.trim() === "") return [];
+  return [...new Set(scope.trim().split(/\s+/))];
+}
+__name(parseScopes, "parseScopes");
+async function verifiedPayload(loadSigningKey, token, options) {
+  const key = await loadSigningKey();
+  if (!key) throw new AccessTokenError("invalid_token", "no signing key configured");
+  try {
+    const { payload } = await jwtVerify2(token, await importJWK2(key.publicJwk, SIGNING_ALG), {
+      algorithms: [SIGNING_ALG],
+      issuer: issuer(options.origin),
+      audience: resourceAudience(options.origin, options.resourcePath ?? DEFAULT_MCP_RESOURCE_PATH),
+      clockTolerance: CLOCK_TOLERANCE_SECONDS2,
+      currentDate: options.now === void 0 ? void 0 : new Date(options.now)
+    });
+    return payload;
+  } catch {
+    throw new AccessTokenError("invalid_token", "token verification failed");
+  }
+}
+__name(verifiedPayload, "verifiedPayload");
+async function verifyAccessToken(loadSigningKey, token, options) {
+  const payload = await verifiedPayload(loadSigningKey, token, options);
+  const email = typeof payload.email === "string" ? payload.email : null;
+  const subject = typeof payload.sub === "string" ? payload.sub : null;
+  if (!email || !subject) {
+    throw new AccessTokenError("invalid_token", "missing subject or email claim");
+  }
+  const scopes = parseScopes(payload.scope);
+  if (options.requiredScope && !scopes.includes(options.requiredScope)) {
+    throw new AccessTokenError(
+      "insufficient_scope",
+      `token lacks required scope '${options.requiredScope}'`
+    );
+  }
+  return { email, subject, scopes };
+}
+__name(verifyAccessToken, "verifyAccessToken");
+
+// src/oauth/refresh.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+var REFRESH_TOKEN_BYTES = 32;
+var REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var RefreshTokenError = class extends Error {
+  static {
+    __name(this, "RefreshTokenError");
+  }
+  code;
+  constructor(code, message) {
+    super(message ?? code);
+    this.name = "RefreshTokenError";
+    this.code = code;
+  }
+};
+function hashToken(token) {
+  return createHash2("sha256").update(token).digest("hex");
+}
+__name(hashToken, "hashToken");
+function generateToken() {
+  return randomBytes2(REFRESH_TOKEN_BYTES).toString("hex");
+}
+__name(generateToken, "generateToken");
+function expiryOf(context) {
+  return new Date(Date.now() + (context.ttlMs ?? REFRESH_TOKEN_TTL_MS));
+}
+__name(expiryOf, "expiryOf");
+async function issueRefreshToken(context, binding) {
+  const refreshToken = generateToken();
+  const row = {
+    tokenHash: hashToken(refreshToken),
+    userEmail: binding.userEmail,
+    userSub: binding.userSub,
+    clientId: binding.clientId,
+    scopes: binding.scopes,
+    expiresAt: expiryOf(context),
+    rotatedFrom: null
+  };
+  await context.store.create(row);
+  return { refreshToken, scopes: binding.scopes };
+}
+__name(issueRefreshToken, "issueRefreshToken");
+function buildLineageIndex(family) {
+  const byHash = /* @__PURE__ */ new Map();
+  const childrenOf = /* @__PURE__ */ new Map();
+  for (const row of family) {
+    byHash.set(row.tokenHash, row);
+    if (!row.rotatedFrom) continue;
+    const siblings = childrenOf.get(row.rotatedFrom) ?? [];
+    siblings.push(row.tokenHash);
+    childrenOf.set(row.rotatedFrom, siblings);
+  }
+  return { byHash, childrenOf };
+}
+__name(buildLineageIndex, "buildLineageIndex");
+function collectLineage(index, seedHash) {
+  const lineage = /* @__PURE__ */ new Set();
+  const queue = [seedHash];
+  while (queue.length > 0) {
+    const hash = queue.shift();
+    if (!hash || lineage.has(hash)) continue;
+    lineage.add(hash);
+    const parent = index.byHash.get(hash)?.rotatedFrom ?? null;
+    if (parent && !lineage.has(parent)) queue.push(parent);
+    const children = (index.childrenOf.get(hash) ?? []).filter((child) => !lineage.has(child));
+    queue.push(...children);
+  }
+  return lineage;
+}
+__name(collectLineage, "collectLineage");
+async function revokeLineage(context, scopedTo, seedHash) {
+  const family = await context.store.listFamily(scopedTo.userEmail, scopedTo.clientId);
+  const lineage = collectLineage(buildLineageIndex(family), seedHash);
+  await context.store.revokeHashes([...lineage], /* @__PURE__ */ new Date());
+}
+__name(revokeLineage, "revokeLineage");
+function narrowedScopes(current, requested) {
+  const scopes = requested ?? current.scopes;
+  const original = new Set(current.scopes);
+  for (const scope of scopes) {
+    if (!original.has(scope)) {
+      throw new RefreshTokenError(
+        "invalid_scope",
+        `scope '${scope}' broadens the refresh token grant`
+      );
+    }
+  }
+  return scopes;
+}
+__name(narrowedScopes, "narrowedScopes");
+async function rotateRefreshToken(context, plaintext, expectedClientId, newScopes) {
+  const tokenHash = hashToken(plaintext);
+  const current = await context.store.findByHash(tokenHash);
+  if (!current) {
+    throw new RefreshTokenError("invalid_grant", "unknown refresh token");
+  }
+  if (current.clientId !== expectedClientId) {
+    throw new RefreshTokenError(
+      "invalid_grant",
+      "refresh token was not issued to this client"
+    );
+  }
+  if (current.expiresAt.getTime() <= Date.now()) {
+    throw new RefreshTokenError("invalid_grant", "refresh token expired");
+  }
+  if (current.revokedAt || await context.store.hasSuccessor(tokenHash)) {
+    await replay(context, current, tokenHash);
+  }
+  const scopes = narrowedScopes(current, newScopes);
+  const successorPlaintext = generateToken();
+  const claimed = await context.store.rotate(
+    {
+      tokenHash: hashToken(successorPlaintext),
+      userEmail: current.userEmail,
+      userSub: current.userSub,
+      clientId: current.clientId,
+      scopes,
+      expiresAt: expiryOf(context),
+      rotatedFrom: tokenHash
+    },
+    tokenHash,
+    /* @__PURE__ */ new Date()
+  );
+  if (!claimed) await replay(context, current, tokenHash);
+  return { refreshToken: successorPlaintext, scopes };
+}
+__name(rotateRefreshToken, "rotateRefreshToken");
+async function replay(context, current, tokenHash) {
+  await revokeLineage(context, current, tokenHash);
+  throw new RefreshTokenError(
+    "invalid_grant",
+    "refresh token already used (replay) \u2014 lineage revoked"
+  );
+}
+__name(replay, "replay");
+async function getRefreshTokenIdentity(context, plaintext) {
+  const row = await context.store.findByHash(hashToken(plaintext));
+  return row ? { userEmail: row.userEmail, userSub: row.userSub } : null;
+}
+__name(getRefreshTokenIdentity, "getRefreshTokenIdentity");
+
+// src/oauth/context.ts
+var DEFAULT_OAUTH_PATHS = {
+  // the origin host's paths, and the ones the RFC 8414 document has always advertised.
+  authorize: "/api/oauth/authorize",
+  token: "/api/oauth/token",
+  register: "/api/oauth/register",
+  jwks: "/.well-known/jwks.json",
+  authorizationServerMetadata: "/.well-known/oauth-authorization-server",
+  protectedResourceMetadata: "/.well-known/oauth-protected-resource"
+};
+function resolveSurface(config) {
+  return {
+    scopes: config.scopes ?? [...MCP_SUPPORTED_SCOPES],
+    resourcePath: config.resourcePath ?? DEFAULT_MCP_RESOURCE_PATH,
+    paths: { ...DEFAULT_OAUTH_PATHS, ...config.paths },
+    loginPath: config.loginPath ?? "/login",
+    loginCallbackParam: config.loginCallbackParam ?? "callbackUrl",
+    accessTokenTtlSeconds: config.accessTokenTtlSeconds ?? ACCESS_TOKEN_TTL_SECONDS,
+    refreshTokenTtlMs: config.refreshTokenTtlMs ?? REFRESH_TOKEN_TTL_MS
+  };
+}
+__name(resolveSurface, "resolveSurface");
+function resolveMcpOauthConfig(config) {
+  const enabled = config.enabled ?? true;
+  const trustedOrigins = config.trustedOrigins ?? [];
+  return {
+    stores: config.stores,
+    resolveSession: config.resolveSession,
+    // Mounting is the opt-in, so the gate defaults to ON; a host that ships the
+    // surface dark passes its own flag (the origin host: `MCP_BEARER_ENABLED`).
+    enabled: typeof enabled === "function" ? enabled : () => enabled,
+    // `null` from the provider means "not provisioned": nothing is minted and the
+    // JWKS answers 503 rather than falling back to a weaker mode.
+    signingKey: config.signingKey ?? loadSigningKeyFromEnv(),
+    trustedOrigins,
+    ...resolveSurface(config),
+    // `'in-process'` is an ACKNOWLEDGEMENT, not a default — see the field's docs.
+    codeReplay: config.codeReplay === "in-process" ? inProcessCodeReplayStore() : config.codeReplay,
+    approve: resolveApprover(config),
+    ...config.connections ? { connections: config.connections } : {},
+    originOf: /* @__PURE__ */ __name((request) => originFromRequest(request, trustedOrigins), "originOf")
+  };
+}
+__name(resolveMcpOauthConfig, "resolveMcpOauthConfig");
+function resolveApprover(config) {
+  const preApproved = new Set(config.preApprovedClientIds ?? []);
+  const { resolveApproval } = config;
+  return async (request, client, scopes) => {
+    if (preApproved.has(client.clientId)) return true;
+    if (!resolveApproval) return false;
+    return resolveApproval(request, client, scopes);
+  };
+}
+__name(resolveApprover, "resolveApprover");
+function notFound() {
+  return new Response("Not Found", { status: 404 });
+}
+__name(notFound, "notFound");
+
+// src/oauth/authorize.ts
+function parseParams(url) {
+  const q = url.searchParams;
+  return {
+    responseType: q.get("response_type"),
+    clientId: q.get("client_id"),
+    redirectUri: q.get("redirect_uri"),
+    codeChallenge: q.get("code_challenge"),
+    codeChallengeMethod: q.get("code_challenge_method"),
+    scope: q.get("scope"),
+    state: q.get("state")
+  };
+}
+__name(parseParams, "parseParams");
+function redirectTo(location) {
+  return new Response(null, { status: 302, headers: { location } });
+}
+__name(redirectTo, "redirectTo");
+function badRequest(message) {
+  return new Response(message, {
+    status: 400,
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  });
+}
+__name(badRequest, "badRequest");
+function errorRedirect(redirectUri, error, state) {
+  const target = new URL(redirectUri);
+  target.searchParams.set("error", error);
+  if (state !== null) target.searchParams.set("state", state);
+  return redirectTo(target.toString());
+}
+__name(errorRedirect, "errorRedirect");
+function scopeIsSupported(scope, allowed) {
+  if (!scope) return true;
+  const requested = scope.split(/\s+/).filter(Boolean);
+  const allowedSet = new Set(allowed);
+  return requested.every((candidate) => allowedSet.has(candidate));
+}
+__name(scopeIsSupported, "scopeIsSupported");
+async function validateClientAndRedirect(context, params) {
+  if (!params.clientId) return badRequest("invalid_request: missing client_id");
+  if (!params.redirectUri) return badRequest("invalid_request: missing redirect_uri");
+  const client = await context.stores.clients.findByClientId(params.clientId);
+  if (!client) return badRequest("invalid_client: unknown client_id");
+  if (!matchesRedirectUri(client, params.redirectUri)) {
+    return badRequest("invalid_request: redirect_uri is not registered");
+  }
+  return { client, redirectUri: params.redirectUri };
+}
+__name(validateClientAndRedirect, "validateClientAndRedirect");
+function validateAuthorizeRequest(params, redirectUri, clientScopes) {
+  const { state } = params;
+  if (params.responseType !== "code") {
+    return errorRedirect(redirectUri, "unsupported_response_type", state);
+  }
+  if (!params.codeChallenge || params.codeChallengeMethod !== SUPPORTED_CHALLENGE_METHOD) {
+    return errorRedirect(redirectUri, "invalid_request", state);
+  }
+  if (!scopeIsSupported(params.scope, clientScopes)) {
+    return errorRedirect(redirectUri, "invalid_scope", state);
+  }
+  return null;
+}
+__name(validateAuthorizeRequest, "validateAuthorizeRequest");
+async function authenticateAndMint(context, request, url, origin, validated) {
+  const { redirectUri, state } = validated;
+  const session = await context.resolveSession(request);
+  if (!session?.email) {
+    const loginUrl = new URL(context.loginPath, origin);
+    loginUrl.searchParams.set(context.loginCallbackParam, url.pathname + url.search);
+    return redirectTo(loginUrl.toString());
+  }
+  const scopes = validated.scope.split(/\s+/).filter(Boolean);
+  if (!await context.approve(request, validated.client, scopes)) {
+    return errorRedirect(redirectUri, "access_denied", state);
+  }
+  const code = await mintCode(context.signingKey, {
+    // The subject is the OAuth `sub` the host resolved, NOT a DB id: downstream
+    // guards resolve the user by EMAIL, and the code carries only what the session
+    // verified.
+    sub: session.subject || session.email,
+    email: session.email,
+    clientId: validated.clientId,
+    redirectUri,
+    codeChallenge: validated.codeChallenge,
+    scope: validated.scope,
+    origin
+  });
+  if (!code) {
+    return errorRedirect(redirectUri, "server_error", state);
+  }
+  const success = new URL(redirectUri);
+  success.searchParams.set("code", code);
+  if (state !== null) success.searchParams.set("state", state);
+  return redirectTo(success.toString());
+}
+__name(authenticateAndMint, "authenticateAndMint");
+async function authorizeEndpoint(context, request) {
+  const url = new URL(request.url);
+  const origin = context.originOf(request);
+  const params = parseParams(url);
+  const clientResult = await validateClientAndRedirect(context, params);
+  if (clientResult instanceof Response) return clientResult;
+  const { client, redirectUri } = clientResult;
+  const requestError = validateAuthorizeRequest(params, redirectUri, client.scopes);
+  if (requestError) return requestError;
+  return authenticateAndMint(context, request, url, origin, {
+    client,
+    clientId: params.clientId,
+    redirectUri,
+    codeChallenge: params.codeChallenge,
+    scope: params.scope ?? "",
+    state: params.state
+  });
+}
+__name(authorizeEndpoint, "authorizeEndpoint");
+
+// src/oauth/register.ts
+var SUPPORTED_AUTH_METHODS = [
+  "none",
+  "client_secret_basic"
+];
+var SUPPORTED_GRANT_TYPES = ["authorization_code", "refresh_token"];
+var DEFAULT_GRANT_TYPES2 = ["authorization_code", "refresh_token"];
+var DEFAULT_AUTH_METHOD = "none";
+var JSON_HEADERS = {
+  "content-type": "application/json; charset=utf-8",
+  "cache-control": "no-store"
+};
+function registrationError(error, status, description) {
+  const body = { error };
+  if (description) body.error_description = description;
+  return new Response(JSON.stringify(body), { status, headers: { ...JSON_HEADERS } });
+}
+__name(registrationError, "registrationError");
+function isAbsoluteUri(value) {
+  try {
+    const url = new URL(value);
+    return Boolean(url.protocol) && Boolean(url.host);
+  } catch {
+    return false;
+  }
+}
+__name(isAbsoluteUri, "isAbsoluteUri");
+function accept(value) {
+  return { ok: true, value };
+}
+__name(accept, "accept");
+function reject(response) {
+  return { ok: false, response };
+}
+__name(reject, "reject");
+function validateRedirectUris(raw) {
+  if (!Array.isArray(raw) || raw.length === 0 || !raw.every((uri) => typeof uri === "string" && isAbsoluteUri(uri))) {
+    return reject(
+      registrationError(
+        "invalid_redirect_uri",
+        400,
+        "redirect_uris must be a non-empty array of absolute URIs"
+      )
+    );
+  }
+  return accept([...raw]);
+}
+__name(validateRedirectUris, "validateRedirectUris");
+function validateAuthMethod(raw) {
+  if (raw === void 0 || raw === null) return accept(DEFAULT_AUTH_METHOD);
+  if (typeof raw !== "string" || !SUPPORTED_AUTH_METHODS.includes(raw)) {
+    return reject(
+      registrationError(
+        "invalid_client_metadata",
+        400,
+        `unsupported token_endpoint_auth_method (supported: ${SUPPORTED_AUTH_METHODS.join(", ")})`
+      )
+    );
+  }
+  return accept(raw);
+}
+__name(validateAuthMethod, "validateAuthMethod");
+function validateGrantTypes(raw) {
+  if (raw === void 0 || raw === null) return accept([...DEFAULT_GRANT_TYPES2]);
+  if (!Array.isArray(raw) || raw.length === 0 || !raw.every(
+    (grant) => typeof grant === "string" && SUPPORTED_GRANT_TYPES.includes(grant)
+  )) {
+    return reject(
+      registrationError(
+        "invalid_client_metadata",
+        400,
+        `unsupported grant_types (supported: ${SUPPORTED_GRANT_TYPES.join(", ")})`
+      )
+    );
+  }
+  return accept([...raw]);
+}
+__name(validateGrantTypes, "validateGrantTypes");
+function validateScopes(raw, supportedScopes) {
+  if (raw === void 0 || raw === null) return accept([...supportedScopes]);
+  if (typeof raw !== "string") {
+    return reject(
+      registrationError("invalid_client_metadata", 400, "scope must be a space-delimited string")
+    );
+  }
+  const requested = raw.split(/\s+/).filter(Boolean);
+  const supported = new Set(supportedScopes);
+  if (!requested.every((scope) => supported.has(scope))) {
+    return reject(
+      registrationError(
+        "invalid_client_metadata",
+        400,
+        `scope must be a subset of: ${supportedScopes.join(" ")}`
+      )
+    );
+  }
+  return accept(requested.length > 0 ? requested : [...supportedScopes]);
+}
+__name(validateScopes, "validateScopes");
+function validateMetadata(metadata, supportedScopes) {
+  const redirectUris = validateRedirectUris(metadata.redirect_uris);
+  if (!redirectUris.ok) return redirectUris;
+  const authMethod = validateAuthMethod(metadata.token_endpoint_auth_method);
+  if (!authMethod.ok) return authMethod;
+  const grantTypes = validateGrantTypes(metadata.grant_types);
+  if (!grantTypes.ok) return grantTypes;
+  const scopes = validateScopes(metadata.scope, supportedScopes);
+  if (!scopes.ok) return scopes;
+  const clientNameRaw = metadata.client_name;
+  const clientName = typeof clientNameRaw === "string" ? clientNameRaw : null;
+  return {
+    ok: true,
+    input: {
+      redirectUris: redirectUris.value,
+      clientName,
+      tokenEndpointAuthMethod: authMethod.value,
+      grantTypes: grantTypes.value,
+      scopes: scopes.value
+    }
+  };
+}
+__name(validateMetadata, "validateMetadata");
+function registrationDisabled() {
+  return new Response(
+    JSON.stringify({
+      error: "access_denied",
+      error_description: "dynamic client registration is disabled"
+    }),
+    { status: 403, headers: { ...JSON_HEADERS } }
+  );
+}
+__name(registrationDisabled, "registrationDisabled");
+async function registerEndpoint(context, request) {
+  let metadata;
+  try {
+    const parsed = await request.json();
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return registrationError(
+        "invalid_client_metadata",
+        400,
+        "request body must be a JSON object"
+      );
+    }
+    metadata = parsed;
+  } catch {
+    return registrationError("invalid_client_metadata", 400, "request body must be valid JSON");
+  }
+  const validated = validateMetadata(metadata, context.scopes);
+  if (!validated.ok) return validated.response;
+  const registered = await registerClient(context.stores.clients, validated.input);
+  const responseBody = {
+    client_id: registered.clientId,
+    ...registered.clientSecret ? { client_secret: registered.clientSecret } : {},
+    client_id_issued_at: Math.floor(Date.now() / 1e3),
+    token_endpoint_auth_method: registered.tokenEndpointAuthMethod,
+    redirect_uris: registered.redirectUris,
+    grant_types: registered.grantTypes,
+    scope: registered.scopes.join(" "),
+    ...registered.clientName ? { client_name: registered.clientName } : {}
+  };
+  return new Response(JSON.stringify(responseBody), {
+    status: 201,
+    headers: { ...JSON_HEADERS }
+  });
+}
+__name(registerEndpoint, "registerEndpoint");
+
+// src/oauth/token-response.ts
+import { createHash as createHash3, timingSafeEqual } from "crypto";
+var JSON_HEADERS2 = {
+  "content-type": "application/json; charset=utf-8",
+  "cache-control": "no-store"
+};
+function tokenError(error, status, description, headers = {}) {
+  const body = { error };
+  if (description) body.error_description = description;
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { ...JSON_HEADERS2, ...headers }
+  });
+}
+__name(tokenError, "tokenError");
+function tokenSuccess(payload) {
+  return new Response(JSON.stringify(payload), { status: 200, headers: { ...JSON_HEADERS2 } });
+}
+__name(tokenSuccess, "tokenSuccess");
+function hashesEqual(a, b) {
+  const bufA = Buffer.from(a, "hex");
+  const bufB = Buffer.from(b, "hex");
+  if (bufA.length !== bufB.length || bufA.length === 0) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+__name(hashesEqual, "hashesEqual");
+function sha256Hex(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+__name(sha256Hex, "sha256Hex");
+function readClientCredentials(request, form) {
+  const authorization = request.headers.get("authorization");
+  if (authorization && authorization.startsWith("Basic ")) {
+    const decoded = Buffer.from(authorization.slice(6), "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator !== -1) {
+      return {
+        clientId: decoded.slice(0, separator),
+        clientSecret: decoded.slice(separator + 1)
+      };
+    }
+  }
+  return { clientId: form.get("client_id"), clientSecret: form.get("client_secret") };
+}
+__name(readClientCredentials, "readClientCredentials");
+var CLIENT_AUTH_CHALLENGE = { "www-authenticate": 'Basic realm="oauth-token"' };
+async function authenticateClient(clients, credentials, expectedClientId) {
+  const clientId = credentials.clientId;
+  if (!clientId) {
+    return tokenError("invalid_client", 401, "missing client_id", CLIENT_AUTH_CHALLENGE);
+  }
+  if (expectedClientId && clientId !== expectedClientId) {
+    return tokenError(
+      "invalid_client",
+      401,
+      "client_id does not match the grant",
+      CLIENT_AUTH_CHALLENGE
+    );
+  }
+  const client = await clients.findByClientId(clientId);
+  if (!client) {
+    return tokenError("invalid_client", 401, "unknown client", CLIENT_AUTH_CHALLENGE);
+  }
+  if (client.tokenEndpointAuthMethod === "client_secret_basic") {
+    const secret = credentials.clientSecret;
+    if (!secret || !client.clientSecretHash) {
+      return tokenError(
+        "invalid_client",
+        401,
+        "client authentication required",
+        CLIENT_AUTH_CHALLENGE
+      );
+    }
+    if (!hashesEqual(sha256Hex(secret), client.clientSecretHash)) {
+      return tokenError(
+        "invalid_client",
+        401,
+        "invalid client credentials",
+        CLIENT_AUTH_CHALLENGE
+      );
+    }
+  }
+  return null;
+}
+__name(authenticateClient, "authenticateClient");
+
+// src/oauth/token-grants.ts
+var DEFAULT_ACTIVITY_THROTTLE_MS = 6e4;
+async function recordHostConnection(context, email, clientId) {
+  const recording = context.connections;
+  const store = context.stores.connections;
+  if (!recording || !store) return;
+  try {
+    await writeConnectionActivity(context, { recording, store }, email, clientId);
+  } catch {
+  }
+}
+__name(recordHostConnection, "recordHostConnection");
+async function writeConnectionActivity(context, ports, email, clientId) {
+  const { recording, store } = ports;
+  const [userId, client] = await Promise.all([
+    recording.resolveUserId(email),
+    context.stores.clients.findByClientId(clientId)
+  ]);
+  if (!userId) return;
+  const throttleMs = recording.activityThrottleMs ?? DEFAULT_ACTIVITY_THROTTLE_MS;
+  const lastActiveAt = await store.lastActiveAt(userId, clientId);
+  const now = /* @__PURE__ */ new Date();
+  if (lastActiveAt && now.getTime() - lastActiveAt.getTime() < throttleMs) return;
+  await store.recordActivity({
+    userId,
+    oauthClientId: clientId,
+    clientName: client?.clientName ?? null,
+    // Attribute to a provider from the client's redirect URIs (claude.ai →
+    // claude, chatgpt.com → chatgpt) so an account page lights the right card.
+    host: client ? providerFromRedirectUris(client.redirectUris, recording.providerRules) : null,
+    at: now
+  });
+}
+__name(writeConnectionActivity, "writeConnectionActivity");
+function readAuthorizationCodeParams(form) {
+  const code = form.get("code");
+  const redirectUri = form.get("redirect_uri");
+  const codeVerifier = form.get("code_verifier");
+  if (!code) return tokenError("invalid_request", 400, "missing code");
+  if (!redirectUri) return tokenError("invalid_request", 400, "missing redirect_uri");
+  if (!codeVerifier) return tokenError("invalid_request", 400, "missing code_verifier");
+  return { code, redirectUri, codeVerifier };
+}
+__name(readAuthorizationCodeParams, "readAuthorizationCodeParams");
+async function redeemCode(context, params, credentials, origin) {
+  const { code, redirectUri, codeVerifier } = params;
+  let verified;
+  try {
+    verified = await verifyCode(context.signingKey, code, { origin });
+  } catch (error) {
+    if (error instanceof AuthorizationCodeError) {
+      return tokenError("invalid_grant", 400, "invalid or expired authorization code");
+    }
+    throw error;
+  }
+  const authError = await authenticateClient(
+    context.stores.clients,
+    credentials,
+    verified.clientId
+  );
+  if (authError) return authError;
+  if (redirectUri !== verified.redirectUri) {
+    return tokenError("invalid_grant", 400, "redirect_uri mismatch");
+  }
+  if (!await verifyChallenge(codeVerifier, verified.codeChallenge)) {
+    return tokenError("invalid_grant", 400, "PKCE verification failed");
+  }
+  if (!await context.codeReplay.consume(verified.jti, Date.now())) {
+    return tokenError("invalid_grant", 400, "authorization code already used");
+  }
+  return verified;
+}
+__name(redeemCode, "redeemCode");
+async function handleAuthorizationCode(context, form, credentials, origin) {
+  const params = readAuthorizationCodeParams(form);
+  if (params instanceof Response) return params;
+  const verified = await redeemCode(context, params, credentials, origin);
+  if (verified instanceof Response) return verified;
+  const scopes = verified.scope.split(/\s+/).filter(Boolean);
+  const accessToken = await signAccessToken(context.signingKey, {
+    email: verified.email,
+    subject: verified.sub,
+    scopes,
+    origin,
+    resourcePath: context.resourcePath,
+    ttlSeconds: context.accessTokenTtlSeconds
+  });
+  if (!accessToken) {
+    return tokenError("invalid_request", 400, "token issuance unavailable");
+  }
+  const refresh = await issueRefreshToken(
+    { store: context.stores.refreshTokens, ttlMs: context.refreshTokenTtlMs },
+    {
+      userEmail: verified.email,
+      userSub: verified.sub,
+      clientId: verified.clientId,
+      scopes
+    }
+  );
+  await recordHostConnection(context, verified.email, verified.clientId);
+  return tokenSuccess({
+    access_token: accessToken,
+    token_type: "Bearer",
+    expires_in: context.accessTokenTtlSeconds ?? ACCESS_TOKEN_TTL_SECONDS,
+    refresh_token: refresh.refreshToken,
+    scope: refresh.scopes.join(" ")
+  });
+}
+__name(handleAuthorizationCode, "handleAuthorizationCode");
+async function handleRefreshToken(context, form, credentials, origin) {
+  const refreshToken = form.get("refresh_token");
+  const requestedScope = form.get("scope");
+  if (!refreshToken) return tokenError("invalid_request", 400, "missing refresh_token");
+  const authError = await authenticateClient(context.stores.clients, credentials);
+  if (authError) return authError;
+  const clientId = credentials.clientId;
+  const newScopes = requestedScope ? requestedScope.split(/\s+/).filter(Boolean) : void 0;
+  const refreshContext = {
+    store: context.stores.refreshTokens,
+    ttlMs: context.refreshTokenTtlMs
+  };
+  let rotated;
+  try {
+    rotated = await rotateRefreshToken(refreshContext, refreshToken, clientId, newScopes);
+  } catch (error) {
+    if (error instanceof RefreshTokenError) {
+      return tokenError(error.code, 400, error.message);
+    }
+    throw error;
+  }
+  const identity = await getRefreshTokenIdentity(refreshContext, rotated.refreshToken);
+  if (!identity) return tokenError("invalid_grant", 400, "refresh token binding not found");
+  const accessToken = await signAccessToken(context.signingKey, {
+    email: identity.userEmail,
+    subject: identity.userSub,
+    scopes: rotated.scopes,
+    origin,
+    resourcePath: context.resourcePath,
+    ttlSeconds: context.accessTokenTtlSeconds
+  });
+  if (!accessToken) return tokenError("invalid_request", 400, "token issuance unavailable");
+  await recordHostConnection(context, identity.userEmail, clientId);
+  return tokenSuccess({
+    access_token: accessToken,
+    token_type: "Bearer",
+    expires_in: context.accessTokenTtlSeconds ?? ACCESS_TOKEN_TTL_SECONDS,
+    refresh_token: rotated.refreshToken,
+    scope: rotated.scopes.join(" ")
+  });
+}
+__name(handleRefreshToken, "handleRefreshToken");
+async function tokenEndpoint(context, request) {
+  const origin = context.originOf(request);
+  let form;
+  try {
+    form = new URLSearchParams(await request.text());
+  } catch {
+    return tokenError("invalid_request", 400, "malformed request body");
+  }
+  const grantType = form.get("grant_type");
+  if (!grantType) return tokenError("invalid_request", 400, "missing grant_type");
+  const credentials = readClientCredentials(request, form);
+  switch (grantType) {
+    case "authorization_code":
+      return handleAuthorizationCode(context, form, credentials, origin);
+    case "refresh_token":
+      return handleRefreshToken(context, form, credentials, origin);
+    default:
+      return tokenError(
+        "unsupported_grant_type",
+        400,
+        `grant_type '${grantType}' is not supported`
+      );
+  }
+}
+__name(tokenEndpoint, "tokenEndpoint");
+
+// src/oauth/create-api-mcp-oauth.ts
+function jsonResponse(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8", ...headers }
+  });
+}
+__name(jsonResponse, "jsonResponse");
+async function jwksResponse(context) {
+  const key = await context.signingKey();
+  if (!key) return jsonResponse({ error: "signing_key_unavailable" }, 503);
+  return jsonResponse({ keys: [key.publicJwk] }, 200, {
+    // Public, cacheable key set; hosts may cache it and re-fetch on a `kid` miss
+    // (rotation). A short max-age keeps the rotation overlap tight.
+    "cache-control": "public, max-age=300"
+  });
+}
+__name(jwksResponse, "jwksResponse");
+function discoveryHandlers(context) {
+  return {
+    authorizationServerMetadata: /* @__PURE__ */ __name(async (request) => jsonResponse(
+      buildAuthorizationServerMetadata({
+        issuer: issuer(context.originOf(request)),
+        scopesSupported: [...context.scopes],
+        // The RESOLVED paths, so what a connector reads before its first request
+        // is where the endpoints actually are.
+        paths: context.paths
+      })
+    ), "authorizationServerMetadata"),
+    protectedResourceMetadata: /* @__PURE__ */ __name(async (request) => {
+      const origin = context.originOf(request);
+      return jsonResponse(
+        buildProtectedResourceMetadata({
+          resource: resourceAudience(origin, context.resourcePath),
+          authorizationServers: [issuer(origin)],
+          scopesSupported: [...context.scopes]
+        })
+      );
+    }, "protectedResourceMetadata")
+  };
+}
+__name(discoveryHandlers, "discoveryHandlers");
+function buildHandlers(context) {
+  const gated = /* @__PURE__ */ __name((handler) => async (request) => context.enabled() ? handler(request) : notFound(), "gated");
+  const discovery = discoveryHandlers(context);
+  return {
+    authorize: gated((request) => authorizeEndpoint(context, request)),
+    token: gated((request) => tokenEndpoint(context, request)),
+    register: /* @__PURE__ */ __name(async (request) => context.enabled() ? registerEndpoint(context, request) : registrationDisabled(), "register"),
+    jwks: gated(() => jwksResponse(context)),
+    authorizationServerMetadata: gated(discovery.authorizationServerMetadata),
+    protectedResourceMetadata: gated(discovery.protectedResourceMetadata)
+  };
+}
+__name(buildHandlers, "buildHandlers");
+function buildRoutes(context, handlers) {
+  const { paths } = context;
+  return [
+    {
+      method: "GET",
+      path: paths.authorizationServerMetadata,
+      handle: handlers.authorizationServerMetadata
+    },
+    {
+      method: "GET",
+      path: paths.protectedResourceMetadata,
+      handle: handlers.protectedResourceMetadata
+    },
+    { method: "GET", path: paths.jwks, handle: handlers.jwks },
+    { method: "GET", path: paths.authorize, handle: handlers.authorize },
+    { method: "POST", path: paths.token, handle: handlers.token },
+    { method: "POST", path: paths.register, handle: handlers.register }
+  ];
+}
+__name(buildRoutes, "buildRoutes");
+function createApiMcpOauth(config) {
+  const context = resolveMcpOauthConfig(config);
+  const handlers = buildHandlers(context);
+  return {
+    routes: buildRoutes(context, handlers),
+    handlers,
+    verifyBearer: /* @__PURE__ */ __name((token, request, options) => verifyAccessToken(context.signingKey, token, {
+      ...options,
+      origin: context.originOf(request),
+      resourcePath: context.resourcePath
+    }), "verifyBearer"),
+    context
+  };
+}
+__name(createApiMcpOauth, "createApiMcpOauth");
+
+export {
+  MCP_SUPPORTED_SCOPES,
+  DEFAULT_MCP_RESOURCE_PATH,
+  issuer,
+  resourceAudience,
+  trustedOriginsFromEnv,
+  resolveTrustedOrigin,
+  originFromRequest,
+  SIGNING_ALG,
+  signingKeyProvider,
+  DEFAULT_SIGNING_KEY_ENV,
+  DEFAULT_SIGNING_KEY_ID_ENV,
+  loadSigningKeyFromEnv,
+  AUTHORIZATION_CODE_AUDIENCE,
+  AUTHORIZATION_CODE_TTL_SECONDS,
+  AuthorizationCodeError,
+  mintCode,
+  verifyCode,
+  hashSecret,
+  registerClient,
+  matchesRedirectUri,
+  DEFAULT_PROVIDER_ROOTS,
+  providerFromRedirectUris,
+  SUPPORTED_CHALLENGE_METHOD,
+  UnsupportedChallengeMethodError,
+  computeChallenge,
+  verifyChallenge,
+  inProcessCodeReplayStore,
+  ACCESS_TOKEN_TTL_SECONDS,
+  AccessTokenError,
+  signAccessToken,
+  verifyAccessToken,
+  REFRESH_TOKEN_TTL_MS,
+  RefreshTokenError,
+  hashToken,
+  issueRefreshToken,
+  rotateRefreshToken,
+  getRefreshTokenIdentity,
+  DEFAULT_OAUTH_PATHS,
+  resolveMcpOauthConfig,
+  createApiMcpOauth
+};
+//# sourceMappingURL=chunk-UIILEGAC.js.map