@adonis-agora/agent 0.33.0 → 0.34.0

package/dist/src/authz/authz-tool-authorizer.d.ts

@@ -36,13 +36,13 @@ export interface AuthzToolAuthorizerConfig {
      */
     authz: AuthzServiceLike;
     /**
-     * Maps an {@link Actor} onto the user object authz resolves a `UserRef` from. Defaults to
-     * `{ id: actor.id }` — enough for authz's `defaultResolveUserRef` (which reads `.id`, defaulting
+     * Maps an {@link Actor} onto the user object authz resolves a `SubjectRef` from. Defaults to
+     * `{ id: actor.id }` — enough for authz's `defaultResolveSubjectRef` (which reads `.id`, defaulting
      * the type to `user`). Override to attach a polymorphic `type` or a host user entity.
      */
     userFromActor?: (actor: Actor) => unknown;
 }
-/** Default {@link Actor} → authz user mapping: the minimal `{ id }` authz needs to resolve a `UserRef`. */
+/** Default {@link Actor} → authz subject mapping: the minimal `{ id }` authz needs to resolve a `SubjectRef`. */
 export declare function defaultUserFromActor(actor: Actor): unknown;
 /**
  * A {@link RolesPolicy} (the agent's `ToolAuthorizer` seam) backed by `@adonis-agora/authz`

package/dist/src/authz/authz-tool-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-tool-authorizer.d.ts","sourceRoot":"","sources":["../../../src/authz/authz-tool-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClG;AAED,6EAA6E;AAC7E,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;CAC3C;AAED,2GAA2G;AAC3G,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IAIrD,YAAY,MAAM,EAAE,yBAAyB,EAG5C;IAEK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAYxD;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,mBAAmB,CAE1F"}
+{"version":3,"file":"authz-tool-authorizer.d.ts","sourceRoot":"","sources":["../../../src/authz/authz-tool-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClG;AAED,6EAA6E;AAC7E,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;CAC3C;AAED,iHAAiH;AACjH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IAIrD,YAAY,MAAM,EAAE,yBAAyB,EAG5C;IAEK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAYxD;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,mBAAmB,CAE1F"}

package/dist/src/authz/authz-tool-authorizer.js

@@ -1,4 +1,4 @@
-/** Default {@link Actor} → authz user mapping: the minimal `{ id }` authz needs to resolve a `UserRef`. */
+/** Default {@link Actor} → authz subject mapping: the minimal `{ id }` authz needs to resolve a `SubjectRef`. */
 export function defaultUserFromActor(actor) {
     return { id: actor.id };
 }

package/dist/src/authz/authz-tool-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-tool-authorizer.js","sourceRoot":"","sources":["../../../src/authz/authz-tool-authorizer.ts"],"names":[],"mappings":"AA8CA,2GAA2G;AAC3G,MAAM,UAAU,oBAAoB,CAAC,KAAY;IAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAmB;IACzB,cAAc,CAA4B;IAEnD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAY,EAAE,IAAc;QACpC,kFAAkF;QAClF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,CAAC;YACH,8FAA8F;YAC9F,4FAA4F;YAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACnE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"authz-tool-authorizer.js","sourceRoot":"","sources":["../../../src/authz/authz-tool-authorizer.ts"],"names":[],"mappings":"AA8CA,iHAAiH;AACjH,MAAM,UAAU,oBAAoB,CAAC,KAAY;IAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAmB;IACzB,cAAc,CAA4B;IAEnD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAY,EAAE,IAAc;QACpC,kFAAkF;QAClF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,CAAC;YACH,8FAA8F;YAC9F,4FAA4F;YAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACnE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/dist/src/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.33.0";
+export declare const VERSION = "0.34.0";
 export { configure } from '../configure.js';
 export * from './actor-labels.js';
 export type { AuthActorResolverOptions } from './actor-resolver.js';

package/dist/src/index.js

@@ -1,4 +1,4 @@
-export const VERSION = '0.33.0';
+export const VERSION = '0.34.0';
 // Re-export the configure hook from the package root so `node ace configure` finds it.
 // AdonisJS imports the package MAIN and reads `configure` off the module namespace —
 // the `./configure` subpath alone is never consulted.

package/dist/src/mcp/auth.d.ts

@@ -46,9 +46,42 @@ export interface McpAuthInfo extends Omit<AuthInfo, 'extra'> {
 export interface McpAuth {
     /** OAuth metadata to advertise, resolved lazily (the authkit peer may not be bootable until first use). */
     oauth?: McpOAuthMetadata | (() => McpOAuthMetadata | Promise<McpOAuthMetadata>);
-    /** Validate `token` and resolve the acting actor as a typed `McpAuthInfo`. Throws `Error` on rejection. */
+    /**
+     * Validate `token` and resolve the acting actor as a typed `McpAuthInfo`. Throws on rejection:
+     * {@link McpAuthError} for a deliberate refusal (its `status` and message reach the client), any
+     * other `Error` for a token this strategy does not recognize (→ `401`).
+     */
     verify(token: string): Promise<McpAuthInfo>;
 }
+/**
+ * A typed refusal from an MCP auth strategy: the token was recognized and deliberately refused (a
+ * client that is not allowed on this endpoint, an account that left the tenant, a revoked grant).
+ *
+ * Throw it from `verify` — or from the `toActor` of `authKitAuth()` / `apiKeyAuth()` — and the
+ * provider answers with its `status` and message, plus the matching `WWW-Authenticate` challenge:
+ * `401` → `error="invalid_token"`, `403` → `error="insufficient_scope"`.
+ *
+ * Inside {@link anyOf} it is also a stop signal: a strategy that throws `McpAuthError` has claimed
+ * the token, so the remaining strategies are not tried. Any other error means "not my token" and
+ * the next strategy gets its turn.
+ *
+ * ```ts
+ * authKitAuth({
+ *   toActor: ({ accountId, clientId }) => {
+ *     if (clientId === 'web') throw new McpAuthError('token was not issued for MCP')
+ *     return { id: accountId }
+ *   },
+ * })
+ * ```
+ */
+export declare class McpAuthError extends Error {
+    /** HTTP status of the refusal: `401` (the token does not authenticate) or `403` (it does, but may not do this). */
+    readonly status: 401 | 403;
+    constructor(message: string, options?: {
+        status?: 401 | 403;
+        cause?: unknown;
+    });
+}
 /**
  * A configured MCP auth strategy, as a lazy thunk the provider calls at boot. Each factory lazily
  * imports / resolves its peer inside the thunk, so nothing loads until the strategy is actually selected.
@@ -58,12 +91,48 @@ export type McpAuthFactory = (ctx: McpAuthContext) => McpAuth | Promise<McpAuth>
  * Resolve a `McpAuth` config value (a ready instance or a lazy factory) at provider boot.
  */
 export declare function resolveMcpAuth(auth: McpAuth | McpAuthFactory, ctx: McpAuthContext): Promise<McpAuth>;
-/** How `authKitAuth()` maps an access token to the MCP actor. Defaults to the account id. */
-export type AuthKitActorResolver = (info: {
+/**
+ * The organization authkit bound to a grant at consent time (the active org of the session that
+ * approved it). Stored on the grant as `activeOrg`.
+ */
+export interface AuthKitActiveOrg {
+    orgId: string;
+    orgSlug?: string;
+    orgRole?: string;
+}
+/**
+ * The oidc-provider `Grant` behind an access token — the authorization the user gave to a client.
+ * Duck-typed: only the fields this package reads are named; the rest of the stored grant is there too.
+ */
+export interface AuthKitGrant {
+    accountId?: string;
+    clientId?: string;
+    /** Set by authkit at consent when the session had an active organization. */
+    activeOrg?: unknown;
+    [key: string]: unknown;
+}
+/** What `authKitAuth()` hands `toActor` for a verified access token. */
+export interface AuthKitActorInfo {
+    /** The account the token was issued to. */
     accountId: string;
+    /** The token's granted scopes. */
     scopes: string[];
+    /** The client the token was issued to — refuse clients that should not reach MCP by throwing {@link McpAuthError}. */
     clientId: string | undefined;
-}) => Actor | Promise<Actor>;
+    /** The grant id the token belongs to, when the provider tracks one. */
+    grantId: string | undefined;
+    /** The grant itself (loaded per request, so a revoked grant stops the token right away). */
+    grant: AuthKitGrant | undefined;
+    /** The organization authkit bound to the grant at consent — the tenant the user authorized. */
+    activeOrg: AuthKitActiveOrg | undefined;
+    /** Extra claims stored on the access token (`extraTokenClaims`), if any. */
+    extra: Record<string, unknown> | undefined;
+}
+/**
+ * How `authKitAuth()` maps an access token to the MCP actor. Defaults to the account id. Throw
+ * {@link McpAuthError} to refuse the token (e.g. a client that is not allowed on this endpoint).
+ */
+export type AuthKitActorResolver = (info: AuthKitActorInfo) => Actor | Promise<Actor>;
 /** Options for {@link authKitAuth}. */
 export interface AuthKitMcpAuthOptions {
     /** Scopes the authorization server advertises. Defaults to the standard authkit scopes. */
@@ -99,4 +168,24 @@ export interface ApiKeyMcpAuthOptions {
  * checks the key. Keys are compared with a constant-time compare to resist timing attacks.
  */
 export declare function apiKeyAuth(options: ApiKeyMcpAuthOptions): McpAuthFactory;
+/**
+ * Accept more than one kind of bearer token on the same MCP endpoint — e.g. OAuth access tokens from
+ * MCP clients that logged in through the browser AND personal access tokens for machine integrations:
+ *
+ * ```ts
+ * auth: anyOf(
+ *   authKitAuth({ toActor }),
+ *   { verify: verifyPersonalAccessToken },
+ * )
+ * ```
+ *
+ * Strategies are tried in order and the first that verifies the token wins. A strategy that throws a
+ * plain `Error` passes ("not my token"); one that throws {@link McpAuthError} has claimed the token and
+ * refused it, so the chain stops there with that refusal. When every strategy passes, the last error
+ * is rethrown.
+ *
+ * OAuth metadata comes from the first strategy that exposes it, so the RFC 9728 document and the
+ * `WWW-Authenticate` challenge still point MCP clients at the login flow.
+ */
+export declare function anyOf(...strategies: Array<McpAuth | McpAuthFactory>): McpAuthFactory;
 //# sourceMappingURL=auth.d.ts.map

package/dist/src/mcp/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yGAAyG;IACzG,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC1D,KAAK,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF,2GAA2G;IAC3G,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,GAAG,cAAc,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,CAKlB;AAuBD,6FAA6F;AAC7F,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAE7B,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iGAAiG;IACjG,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAgD/E;AAmBD,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAE7E,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAcxE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yGAAyG;IACzG,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC1D,KAAK,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAE3B,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,EAIjF;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,GAAG,cAAc,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,CAKlB;AA6BD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sHAAsH;IACtH,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,uEAAuE;IACvE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,+FAA+F;IAC/F,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,gBAAgB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAEtF,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iGAAiG;IACjG,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAgE/E;AA+BD,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAE7E,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAcxE;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,KAAK,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,OAAO,GAAG,cAAc,CAAC,GAAG,cAAc,CAuBpF"}

package/dist/src/mcp/auth.js

@@ -1,3 +1,33 @@
+/**
+ * A typed refusal from an MCP auth strategy: the token was recognized and deliberately refused (a
+ * client that is not allowed on this endpoint, an account that left the tenant, a revoked grant).
+ *
+ * Throw it from `verify` — or from the `toActor` of `authKitAuth()` / `apiKeyAuth()` — and the
+ * provider answers with its `status` and message, plus the matching `WWW-Authenticate` challenge:
+ * `401` → `error="invalid_token"`, `403` → `error="insufficient_scope"`.
+ *
+ * Inside {@link anyOf} it is also a stop signal: a strategy that throws `McpAuthError` has claimed
+ * the token, so the remaining strategies are not tried. Any other error means "not my token" and
+ * the next strategy gets its turn.
+ *
+ * ```ts
+ * authKitAuth({
+ *   toActor: ({ accountId, clientId }) => {
+ *     if (clientId === 'web') throw new McpAuthError('token was not issued for MCP')
+ *     return { id: accountId }
+ *   },
+ * })
+ * ```
+ */
+export class McpAuthError extends Error {
+    /** HTTP status of the refusal: `401` (the token does not authenticate) or `403` (it does, but may not do this). */
+    status;
+    constructor(message, options = {}) {
+        super(message, options.cause !== undefined ? { cause: options.cause } : undefined);
+        this.name = 'McpAuthError';
+        this.status = options.status ?? 401;
+    }
+}
 /**
  * Resolve a `McpAuth` config value (a ready instance or a lazy factory) at provider boot.
  */
@@ -42,14 +72,30 @@ export function authKitAuth(options = {}) {
             async verify(token) {
                 const service = await getService();
                 const at = await service.provider.AccessToken.find(token);
-                if (!at || at.isExpired) {
+                if (!at) {
+                    // Not an access token this issuer knows — plain `Error`, so `anyOf` tries the next strategy.
                     throw new Error('invalid or expired access token');
                 }
+                if (at.isExpired) {
+                    throw new McpAuthError('invalid or expired access token');
+                }
+                let grant;
+                if (at.grantId !== undefined && service.provider.Grant !== undefined) {
+                    grant = await service.provider.Grant.find(at.grantId);
+                    if (grant === undefined) {
+                        // The user revoked the authorization; the token must not outlive it.
+                        throw new McpAuthError('authorization revoked');
+                    }
+                }
                 const tokenScopes = (at.scope ?? '').split(' ').filter(Boolean);
                 const actor = await toActor({
                     accountId: at.accountId,
                     scopes: tokenScopes,
                     clientId: at.clientId,
+                    grantId: at.grantId,
+                    grant,
+                    activeOrg: readActiveOrg(grant?.activeOrg),
+                    extra: at.extra,
                 });
                 return {
                     token,
@@ -62,6 +108,19 @@ export function authKitAuth(options = {}) {
         };
     };
 }
+/** Narrow the grant's stored `activeOrg` to {@link AuthKitActiveOrg}; anything without an `orgId` string is no org. */
+function readActiveOrg(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const candidate = value;
+    if (typeof candidate.orgId !== 'string' || candidate.orgId === '')
+        return undefined;
+    return {
+        orgId: candidate.orgId,
+        ...(typeof candidate.orgSlug === 'string' ? { orgSlug: candidate.orgSlug } : {}),
+        ...(typeof candidate.orgRole === 'string' ? { orgRole: candidate.orgRole } : {}),
+    };
+}
 /**
  * Resolve the authkit `OidcService` from the container. `@adonis-agora/authkit-server` augments
  * `ContainerBindings` with `'authkit.server'`, so `make` is fully typed with no cast.
@@ -105,4 +164,50 @@ function timingSafeEqual(a, b) {
     }
     return diff === 0;
 }
+// ── anyOf ───────────────────────────────────────────────────────────────────
+/**
+ * Accept more than one kind of bearer token on the same MCP endpoint — e.g. OAuth access tokens from
+ * MCP clients that logged in through the browser AND personal access tokens for machine integrations:
+ *
+ * ```ts
+ * auth: anyOf(
+ *   authKitAuth({ toActor }),
+ *   { verify: verifyPersonalAccessToken },
+ * )
+ * ```
+ *
+ * Strategies are tried in order and the first that verifies the token wins. A strategy that throws a
+ * plain `Error` passes ("not my token"); one that throws {@link McpAuthError} has claimed the token and
+ * refused it, so the chain stops there with that refusal. When every strategy passes, the last error
+ * is rethrown.
+ *
+ * OAuth metadata comes from the first strategy that exposes it, so the RFC 9728 document and the
+ * `WWW-Authenticate` challenge still point MCP clients at the login flow.
+ */
+export function anyOf(...strategies) {
+    if (strategies.length === 0) {
+        throw new Error('[@adonis-agora/agent] `anyOf()` needs at least one MCP auth strategy');
+    }
+    return async (ctx) => {
+        const resolved = await Promise.all(strategies.map((strategy) => resolveMcpAuth(strategy, ctx)));
+        const oauth = resolved.find((strategy) => strategy.oauth !== undefined)?.oauth;
+        return {
+            ...(oauth !== undefined ? { oauth } : {}),
+            async verify(token) {
+                let lastError;
+                for (const strategy of resolved) {
+                    try {
+                        return await strategy.verify(token);
+                    }
+                    catch (error) {
+                        if (error instanceof McpAuthError)
+                            throw error;
+                        lastError = error;
+                    }
+                }
+                throw lastError;
+            },
+        };
+    };
+}
 //# sourceMappingURL=auth.js.map

package/dist/src/mcp/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AA4DA;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA8B,EAC9B,GAAmB;IAEnB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAwCD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO,GAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAyB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,IAAI,cAAuD,CAAC;QAE5D,MAAM,UAAU,GAAG,GAAgC,EAAE;YACnD,cAAc,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAA+B,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,OAAO;gBACL,MAAM;gBACN,qBAAqB,EAAE,GAAG,MAAM,OAAO;gBACvC,aAAa,EAAE,GAAG,MAAM,QAAQ;gBAChC,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB;aACzD,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO;YACL,KAAK;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;oBAC1B,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;iBACtB,CAAC,CAAC;gBACH,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;oBAC3B,MAAM,EAAE,WAAW;oBACnB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAuB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iFAAiF,OAAO,8FAA8F,CACvL,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,KAAK,IAAI,EAAE;QAChB,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AA0DA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,mHAAmH;IAC1G,MAAM,CAAY;IAE3B,YAAY,OAAe,EAAE,OAAO,GAA4C,EAAE;QAChF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;IACtC,CAAC;CACF;AAQD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA8B,EAC9B,GAAmB;IAEnB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAqFD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO,GAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAyB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,IAAI,cAAuD,CAAC;QAE5D,MAAM,UAAU,GAAG,GAAgC,EAAE;YACnD,cAAc,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAA+B,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,OAAO;gBACL,MAAM;gBACN,qBAAqB,EAAE,GAAG,MAAM,OAAO;gBACvC,aAAa,EAAE,GAAG,MAAM,QAAQ;gBAChC,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB;aACzD,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO;YACL,KAAK;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,6FAA6F;oBAC7F,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBACjB,MAAM,IAAI,YAAY,CAAC,iCAAiC,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,KAA+B,CAAC;gBACpC,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACrE,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;oBACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,qEAAqE;wBACrE,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;oBAC1B,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,KAAK;oBACL,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;oBAC1C,KAAK,EAAE,EAAE,CAAC,KAAK;iBAChB,CAAC,CAAC;gBACH,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;oBAC3B,MAAM,EAAE,WAAW;oBACnB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,uHAAuH;AACvH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpF,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAuB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iFAAiF,OAAO,8FAA8F,CACvL,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,KAAK,IAAI,EAAE;QAChB,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,KAAK,CAAC,GAAG,UAA2C;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,KAAK,CAAC;QAC/E,OAAO;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,SAAkB,CAAC;gBACvB,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACtC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,KAAK,CAAC;wBAC/C,SAAS,GAAG,KAAK,CAAC;oBACpB,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC;YAClB,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/mcp/define_config.d.ts

@@ -1,6 +1,6 @@
 import type { RolesPolicy } from '../spi/roles-policy.js';
 import type { McpAuth, McpAuthFactory } from './auth.js';
-import { apiKeyAuth, authKitAuth } from './auth.js';
+import { anyOf, apiKeyAuth, authKitAuth, McpAuthError } from './auth.js';
 /**
  * Shape of `config/mcp.ts`. The MCP provider exposes the agent's {@link ToolRegistry} over the Model
  * Context Protocol (Streamable HTTP): `tools/list` mirrors the tools the acting actor may call
@@ -27,9 +27,17 @@ export interface McpConfig {
      * OAuth metadata (when `auth.oauth` is set) is served at `/.well-known/oauth-protected-resource{path}`.
      */
     path?: string;
+    /**
+     * The public origin MCP clients reach this app at (e.g. `'https://app.example.com'`) — the base of
+     * the RFC 9728 `resource` and of the `resource_metadata` URL in the `WWW-Authenticate` challenge.
+     * Set it whenever TLS terminates at a proxy the app does not trust (the request then "sees"
+     * `http://`). Omit → both are built from the request's protocol and `Host` header. Must be an
+     * origin only: a path, query, or fragment is rejected at boot.
+     */
+    publicUrl?: string;
     /**
      * How MCP clients authenticate. Pass a ready {@link McpAuth} or a lazy {@link McpAuthFactory} thunk
-     * (`authKitAuth()` / `apiKeyAuth()`). Omit → the server is open (no bearer check); the acting actor
+     * (`authKitAuth()` / `apiKeyAuth()`, or several of them combined with `anyOf()`). Omit → the server is open (no bearer check); the acting actor
      * falls back to `actor`. Fail-closed: with no `auth` AND no `actor`, requests are rejected.
      */
     auth?: McpAuth | McpAuthFactory;
@@ -58,7 +66,7 @@ export interface McpConfig {
 }
 /** Identity helper giving `config/mcp.ts` full type-checking. */
 export declare function defineMcpConfig(config: McpConfig): McpConfig;
-export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActorResolver, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpOAuthMetadata, } from './auth.js';
+export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActiveOrg, AuthKitActorInfo, AuthKitActorResolver, AuthKitGrant, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpOAuthMetadata, } from './auth.js';
 export { resolveMcpAuth } from './auth.js';
-export { apiKeyAuth, authKitAuth };
+export { anyOf, apiKeyAuth, authKitAuth, McpAuthError };
 //# sourceMappingURL=define_config.d.ts.map

package/dist/src/mcp/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAE5D;AAED,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAE5D;AAED,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC"}

package/dist/src/mcp/define_config.js

@@ -1,8 +1,8 @@
-import { apiKeyAuth, authKitAuth } from './auth.js';
+import { anyOf, apiKeyAuth, authKitAuth, McpAuthError } from './auth.js';
 /** Identity helper giving `config/mcp.ts` full type-checking. */
 export function defineMcpConfig(config) {
     return config;
 }
 export { resolveMcpAuth } from './auth.js';
-export { apiKeyAuth, authKitAuth };
+export { anyOf, apiKeyAuth, authKitAuth, McpAuthError };
 //# sourceMappingURL=define_config.js.map

package/dist/src/mcp/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAsDpD,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AA8DzE,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAeD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC"}

package/dist/src/mcp/discovery.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The OAuth discovery surface of the MCP server (MCP Authorization spec, RFC 9728, RFC 6750 §3): the
+ * protected-resource metadata document, its well-known URL, and the `WWW-Authenticate` challenge a
+ * `401`/`403` carries so an MCP client knows where to start the login.
+ *
+ * Pure functions over strings — the provider decides which origin to feed them (the configured
+ * `publicUrl`, or the request's own protocol and `Host` as a fallback).
+ */
+import type { McpOAuthMetadata } from './auth.js';
+/** Normalize a route prefix the way the provider mounts it: no leading/trailing slashes. */
+export declare function normalizeMcpPath(path: string | undefined): string;
+/**
+ * Validate `publicUrl` from `config/mcp.ts` and reduce it to its origin (`https://app.example.com`).
+ * Only an origin is meaningful: the MCP endpoint and its well-known document are mounted at fixed
+ * paths on this app, so a path, query, or fragment would advertise URLs the app does not serve.
+ */
+export declare function publicOrigin(publicUrl: string): string;
+/** The protected resource (RFC 9728 `resource`): the URL an MCP client points at, e.g. `https://app.example.com/mcp`. */
+export declare function mcpResourceUrl(origin: string, path: string): string;
+/** Where the protected-resource metadata lives (RFC 9728 §3.1): the well-known segment goes between host and path. */
+export declare function protectedResourceMetadataUrl(origin: string, path: string): string;
+/** The RFC 9728 protected-resource metadata document. */
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: string[];
+    resource_name: string;
+}
+/** Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. */
+export declare function protectedResourceMetadata(meta: McpOAuthMetadata, origin: string, path: string): ProtectedResourceMetadata;
+/** Options for {@link wwwAuthenticateChallenge}. */
+export interface WwwAuthenticateOptions {
+    /**
+     * The RFC 6750 error code. `invalid_token` when the request carried a token that was refused,
+     * `insufficient_scope` for a `403`, omitted when no token was sent at all (RFC 6750 §3.1).
+     */
+    error?: 'invalid_token' | 'insufficient_scope';
+    /** The metadata URL (RFC 9728 §5.1). Set only when the auth strategy exposes OAuth metadata. */
+    resourceMetadataUrl?: string;
+}
+/**
+ * The `WWW-Authenticate` value for a `401`/`403` from the MCP endpoint — e.g.
+ * `Bearer error="invalid_token", resource_metadata="https://app.example.com/.well-known/oauth-protected-resource/mcp"`.
+ * `resource_metadata` is what makes an MCP client discover the authorization server and open the login.
+ */
+export declare function wwwAuthenticateChallenge(options?: WwwAuthenticateOptions): string;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/src/mcp/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAED,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,sHAAsH;AACtH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,yBAAyB,CAQ3B;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAOrF"}

package/dist/src/mcp/discovery.js

@@ -0,0 +1,70 @@
+/**
+ * The OAuth discovery surface of the MCP server (MCP Authorization spec, RFC 9728, RFC 6750 §3): the
+ * protected-resource metadata document, its well-known URL, and the `WWW-Authenticate` challenge a
+ * `401`/`403` carries so an MCP client knows where to start the login.
+ *
+ * Pure functions over strings — the provider decides which origin to feed them (the configured
+ * `publicUrl`, or the request's own protocol and `Host` as a fallback).
+ */
+/** Normalize a route prefix the way the provider mounts it: no leading/trailing slashes. */
+export function normalizeMcpPath(path) {
+    return (path ?? 'mcp').replace(/^\/+|\/+$/g, '');
+}
+/**
+ * Validate `publicUrl` from `config/mcp.ts` and reduce it to its origin (`https://app.example.com`).
+ * Only an origin is meaningful: the MCP endpoint and its well-known document are mounted at fixed
+ * paths on this app, so a path, query, or fragment would advertise URLs the app does not serve.
+ */
+export function publicOrigin(publicUrl) {
+    let url;
+    try {
+        url = new URL(publicUrl);
+    }
+    catch {
+        throw new Error(`[@adonis-agora/agent] \`publicUrl\` in config/mcp.ts is not an absolute URL: ${JSON.stringify(publicUrl)}`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`[@adonis-agora/agent] \`publicUrl\` in config/mcp.ts must be http(s), got ${JSON.stringify(publicUrl)}`);
+    }
+    if (url.pathname !== '/' || url.search !== '' || url.hash !== '') {
+        throw new Error(`[@adonis-agora/agent] \`publicUrl\` in config/mcp.ts must be an origin only (e.g. "https://app.example.com"), got ${JSON.stringify(publicUrl)}`);
+    }
+    return url.origin;
+}
+/** The protected resource (RFC 9728 `resource`): the URL an MCP client points at, e.g. `https://app.example.com/mcp`. */
+export function mcpResourceUrl(origin, path) {
+    return `${origin}/${normalizeMcpPath(path)}`;
+}
+/** Where the protected-resource metadata lives (RFC 9728 §3.1): the well-known segment goes between host and path. */
+export function protectedResourceMetadataUrl(origin, path) {
+    return `${origin}/.well-known/oauth-protected-resource/${normalizeMcpPath(path)}`;
+}
+/** Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. */
+export function protectedResourceMetadata(meta, origin, path) {
+    return {
+        resource: mcpResourceUrl(origin, path),
+        authorization_servers: [meta.issuer],
+        scopes_supported: meta.scopesSupported,
+        bearer_methods_supported: ['header'],
+        resource_name: meta.resourceName,
+    };
+}
+/**
+ * The `WWW-Authenticate` value for a `401`/`403` from the MCP endpoint — e.g.
+ * `Bearer error="invalid_token", resource_metadata="https://app.example.com/.well-known/oauth-protected-resource/mcp"`.
+ * `resource_metadata` is what makes an MCP client discover the authorization server and open the login.
+ */
+export function wwwAuthenticateChallenge(options = {}) {
+    const params = [];
+    if (options.error !== undefined)
+        params.push(`error="${options.error}"`);
+    if (options.resourceMetadataUrl !== undefined) {
+        params.push(`resource_metadata="${quote(options.resourceMetadataUrl)}"`);
+    }
+    return params.length === 0 ? 'Bearer' : `Bearer ${params.join(', ')}`;
+}
+/** Escape a value for an RFC 7230 quoted-string. */
+function quote(value) {
+    return value.replace(/[\\"]/g, (char) => `\\${char}`);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/src/mcp/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,qHAAqH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACjJ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;IACzD,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,4BAA4B,CAAC,MAAc,EAAE,IAAY;IACvE,OAAO,GAAG,MAAM,yCAAyC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AACpF,CAAC;AAWD,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CACvC,IAAsB,EACtB,MAAc,EACd,IAAY;IAEZ,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;QACpC,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA2B,EAAE;IAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,oDAAoD;AACpD,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/mcp/index.d.ts

@@ -1,8 +1,10 @@
 export { actorFromAuthInfo, isActor } from './actor.js';
-export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActorResolver, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpAuthInfo, McpOAuthMetadata, } from './auth.js';
-export { apiKeyAuth, authKitAuth, resolveMcpAuth } from './auth.js';
+export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActiveOrg, AuthKitActorInfo, AuthKitActorResolver, AuthKitGrant, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpAuthInfo, McpOAuthMetadata, } from './auth.js';
+export { anyOf, apiKeyAuth, authKitAuth, McpAuthError, resolveMcpAuth } from './auth.js';
 export type { McpConfig } from './define_config.js';
 export { defineMcpConfig } from './define_config.js';
+export type { ProtectedResourceMetadata, WwwAuthenticateOptions } from './discovery.js';
+export { mcpResourceUrl, protectedResourceMetadata, protectedResourceMetadataUrl, publicOrigin, wwwAuthenticateChallenge, } from './discovery.js';
 export type { CreateMcpServerOptions, McpToolContextOptions } from './server.js';
 export { createMcpServer } from './server.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzF,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/mcp/index.js

@@ -1,5 +1,6 @@
 export { actorFromAuthInfo, isActor } from './actor.js';
-export { apiKeyAuth, authKitAuth, resolveMcpAuth } from './auth.js';
+export { anyOf, apiKeyAuth, authKitAuth, McpAuthError, resolveMcpAuth } from './auth.js';
 export { defineMcpConfig } from './define_config.js';
+export { mcpResourceUrl, protectedResourceMetadata, protectedResourceMetadataUrl, publicOrigin, wwwAuthenticateChallenge, } from './discovery.js';
 export { createMcpServer } from './server.js';
 //# sourceMappingURL=index.js.map

package/dist/src/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAYxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAexD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEzF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAExD,iGAAiG;AACjG,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,+FAA+F;IAC/F,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;CAChC;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED,uGAAuG;AACvG,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,GAAG,EAAE,YAAY,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,YAAY,CAAC;CACnB;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,YAAY,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,GAAG,EAAE,YAAY,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,qFAAqF;IACrF,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D;;;OAGG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CAC/E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,6FAA6F;IAC7F,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,+EAA+E;IAC/E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,WAAkC,EAClC,MAAc,GACf,EAAE,wBAAwB,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,UAAU,CAAC,CAmFtE;AAUD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,YAAY,CAAC;IAClB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,EAClC,MAAM,EACN,GAAG,EACH,KAAK,GACN,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAiB5C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtC,iGAAiG;IACjG,QAAQ,EAAE,OAAO,CAAC;IAClB,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAC;CAClB;AA2BD,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,qBAAqB,GAAG,MAAM,CAqB9F;AAED,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAwBD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,CAmB5B,CAAC;AAElD,eAAO,MAAM,yBAAyB,yYAC6V,CAAC;AAEpY;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CAOvD;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,sGAAsG;IACtG,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,aAAa,CAkB7E;AAED;;;;;;;;GAQG;AACH,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpC,KAAK,EAAE,KAAK,CAAC;CACd;AAED,wBAAgB,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,mBAAmB,GAAG,aAAa,CAOzF;AAED,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG;;;;;;;GAOG;AACH,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,6FAA6F;IAC7F,MAAM,EAAE,YAAY,CAAC;IACrB,gDAAgD;IAChD,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,WAAW,CAAC,EAChC,MAAM,EACN,MAAM,EACN,IAAI,EACJ,GAAG,EACH,KAAK,GACN,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmChD"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAExD,iGAAiG;AACjG,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,+FAA+F;IAC/F,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;CAChC;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED,uGAAuG;AACvG,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,GAAG,EAAE,YAAY,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,YAAY,CAAC;CACnB;AAED,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,YAAY,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,GAAG,EAAE,YAAY,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,qFAAqF;IACrF,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D;;;OAGG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CAC/E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,6FAA6F;IAC7F,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,4FAA4F;IAC5F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,+EAA+E;IAC/E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,WAAkC,EAClC,MAAc,GACf,EAAE,wBAAwB,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,UAAU,CAAC,CAmFtE;AAUD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,YAAY,CAAC;IAClB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,EAClC,MAAM,EACN,GAAG,EACH,KAAK,GACN,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB5C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtC,iGAAiG;IACjG,QAAQ,EAAE,OAAO,CAAC;IAClB,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAC;CAClB;AA2BD,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,qBAAqB,GAAG,MAAM,CAqB9F;AAED,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAwBD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,CAmB5B,CAAC;AAElD,eAAO,MAAM,yBAAyB,yYAC6V,CAAC;AAEpY;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CAOvD;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,sGAAsG;IACtG,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,aAAa,CAkB7E;AAED;;;;;;;;GAQG;AACH,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpC,KAAK,EAAE,KAAK,CAAC;CACd;AAED,wBAAgB,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,mBAAmB,GAAG,aAAa,CAOzF;AAED,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG;;;;;;;GAOG;AACH,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,6FAA6F;IAC7F,MAAM,EAAE,YAAY,CAAC;IACrB,gDAAgD;IAChD,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,WAAW,CAAC,EAChC,MAAM,EACN,MAAM,EACN,IAAI,EACJ,GAAG,EACH,KAAK,GACN,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAwChD"}