@adonis-agora/agent 0.33.1 → 0.34.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @adonis-agora/agent
 
+## 0.34.1
+
+### Patch Changes
+
+- fix(deps): update dependency @modelcontextprotocol/sdk to v1.30.1 ([#180](https://github.com/DavideCarvalho/adonis-agora-agent/issues/180))
+
+## 0.34.0
+
+### Minor Changes
+
+- [#160](https://github.com/DavideCarvalho/adonis-agora-agent/pull/160) [`7f43115`](https://github.com/DavideCarvalho/adonis-agora-agent/commit/7f4311584268c37f88cb76aa2ebbfafb377735d2) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - The MCP server's auth works behind a proxy, sends clients to the login, and can take more than one kind of token
+  
+  Five things an app putting `/mcp` behind OAuth had to work around, now in the provider:
+  
+  - **Every refused request carries `WWW-Authenticate`.** The MCP Authorization spec has clients start the login from the `401` challenge, and the provider answered `401` without one. With OAuth metadata it is now `Bearer resource_metadata="<origin>/.well-known/oauth-protected-resource/<path>"`, with `error="invalid_token"` when a token was sent and refused; without OAuth — and on the fail-closed `401` of an endpoint with neither `auth` nor `actor` — it is a bare `Bearer`.
+  - **`publicUrl` in `config/mcp.ts`.** The RFC 9728 `resource` (and now the challenge's `resource_metadata`) were built from the request's protocol and `Host`, so behind a TLS-terminating proxy the app does not trust they came out `http://`. `publicUrl: env.get('APP_URL')` names the public origin; omitted, the request is used as before. A value with a path, query, or fragment fails the boot. The metadata document also gains `bearer_methods_supported: ['header']` and `Access-Control-Allow-Origin: *`.
+  - **`authKitAuth()` hands `toActor` the grant.** Besides `accountId`/`scopes`/`clientId`, the resolver now gets `grantId`, the `grant`, the `activeOrg` authkit bound to it at consent, and the token's `extra` claims — so a multi-tenant app resolves the tenant the user actually authorized. Existing resolvers keep working. The grant is loaded per request, and a token whose grant was revoked is refused (`401 authorization revoked`).
+  - **`McpAuthError`, a typed refusal.** Throw it from `toActor` or `verify` to refuse a token you recognized — a client that must not reach MCP, a member who left the org. `new McpAuthError(msg)` is a `401` with `error="invalid_token"`, `{ status: 403 }` a `403` with `error="insufficient_scope"`. An expired authkit token is now one too.
+  - **`anyOf(...strategies)`.** Accepts OAuth tokens and, say, personal access tokens on the same endpoint. Tried in order, first to verify wins; a plain `Error` passes to the next strategy, an `McpAuthError` stops the chain. OAuth metadata comes from the first strategy that exposes it.
+
 ## 0.33.1
 
 ### Patch Changes

package/dist/providers/mcp_provider.d.ts

@@ -7,6 +7,11 @@ import type { ApplicationService } from '@adonisjs/core/types';
  * - `GET /.well-known/oauth-protected-resource{path}` — RFC 9728 protected-resource metadata, mounted
  *   only when `auth.oauth` is set, so MCP clients can discover how to authenticate.
  *
+ * A refused request answers `401` (or `403` for an {@link McpAuthError} with that status) with a
+ * `WWW-Authenticate: Bearer …` challenge; with OAuth it carries `resource_metadata`, which is what makes
+ * an MCP client discover the authorization server and open the login. URLs are built from
+ * `config.publicUrl` when set, else from the request's protocol and `Host`.
+ *
  * Every request is authenticated: the bearer token is verified via `config.auth` (e.g. `authKitAuth()`),
  * the resolved actor attached to the transport's `AuthInfo`, and `tools/list` / `tools/call` run against
  * the SAME `ToolRegistry` singleton the agent loop uses — so a role-checked tool stays role-checked, and

package/dist/providers/mcp_provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp_provider.d.ts","sourceRoot":"","sources":["../../providers/mcp_provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAc/D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,OAAO,OAAO,WAAW;;IAIlB,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAE3C,IAAI,kBAoCT;IAEK,QAAQ,kBAGb;CA4KF"}
+{"version":3,"file":"mcp_provider.d.ts","sourceRoot":"","sources":["../../providers/mcp_provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAqB/D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,OAAO,OAAO,WAAW;;IAQlB,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAE3C,IAAI,kBAmCT;IAEK,QAAQ,kBAGb;CAiNF"}

package/dist/providers/mcp_provider.js

@@ -3,7 +3,8 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { DefaultToolAuthorizer } from '../src/authorizer.js';
 import { actorFromAuthInfo } from '../src/mcp/actor.js';
-import { resolveMcpAuth } from '../src/mcp/auth.js';
+import { McpAuthError, resolveMcpAuth } from '../src/mcp/auth.js';
+import { normalizeMcpPath, protectedResourceMetadata, protectedResourceMetadataUrl, publicOrigin, wwwAuthenticateChallenge, } from '../src/mcp/discovery.js';
 import { createMcpServer } from '../src/mcp/server.js';
 import { ToolRegistry } from '../src/tool-registry.js';
 /**
@@ -14,6 +15,11 @@ import { ToolRegistry } from '../src/tool-registry.js';
  * - `GET /.well-known/oauth-protected-resource{path}` — RFC 9728 protected-resource metadata, mounted
  *   only when `auth.oauth` is set, so MCP clients can discover how to authenticate.
  *
+ * A refused request answers `401` (or `403` for an {@link McpAuthError} with that status) with a
+ * `WWW-Authenticate: Bearer …` challenge; with OAuth it carries `resource_metadata`, which is what makes
+ * an MCP client discover the authorization server and open the login. URLs are built from
+ * `config.publicUrl` when set, else from the request's protocol and `Host`.
+ *
  * Every request is authenticated: the bearer token is verified via `config.auth` (e.g. `authKitAuth()`),
  * the resolved actor attached to the transport's `AuthInfo`, and `tools/list` / `tools/call` run against
  * the SAME `ToolRegistry` singleton the agent loop uses — so a role-checked tool stays role-checked, and
@@ -23,6 +29,10 @@ export default class McpProvider {
     app;
     /** Live session transports, keyed by MCP session id (per-provider in-memory state). */
     #transports = new Map();
+    /** The mounted route prefix, normalized (no leading/trailing slashes). */
+    #path = 'mcp';
+    /** `config.publicUrl` reduced to its origin; `undefined` → derive it from each request. */
+    #publicOrigin;
     constructor(app) {
         this.app = app;
     }
@@ -32,10 +42,13 @@ export default class McpProvider {
         const defaultRoles = config.defaultRoles ?? ['ADMIN'];
         const authorizer = config.authorizer ?? new DefaultToolAuthorizer(defaultRoles);
         const auth = config.auth !== undefined ? await resolveMcpAuth(config.auth, { app: this.app }) : undefined;
+        this.#publicOrigin =
+            config.publicUrl !== undefined ? publicOrigin(config.publicUrl) : undefined;
         // The actor fallback for open/dev mode (no `auth`): a fixed identity, or fail-closed (reject).
         const openActor = config.actor;
         const router = await this.app.container.make('router');
-        const path = (config.path ?? 'mcp').replace(/^\/+|\/+$/g, '');
+        const path = normalizeMcpPath(config.path);
+        this.#path = path;
         const route = `/${path}`;
         router.post(route, (ctx) => this.#handlePost(ctx, config, registry, authorizer, auth, openActor));
         router.get(route, (ctx) => this.#handleGet(ctx, auth, openActor));
@@ -46,13 +59,9 @@ export default class McpProvider {
             router.get(metadataPath, async (ctx) => {
                 // `oauth` may be lazy (authkit needs a fully booted app to resolve) — resolve it on request.
                 const meta = typeof oauth === 'function' ? await oauth() : oauth;
-                const origin = `${ctx.request.protocol()}://${ctx.request.headers().host ?? 'localhost'}`;
-                return ctx.response.json({
-                    resource: `${origin}/${path}`,
-                    authorization_servers: [meta.issuer],
-                    scopes_supported: meta.scopesSupported,
-                    resource_name: meta.resourceName,
-                });
+                // Public and user-free; MCP clients running in a browser fetch it cross-origin.
+                ctx.response.header('access-control-allow-origin', '*');
+                return ctx.response.json(protectedResourceMetadata(meta, this.#origin(ctx), path));
             });
         }
     }
@@ -61,35 +70,56 @@ export default class McpProvider {
         this.#transports.clear();
     }
     // ── auth helpers ──────────────────────────────────────────────────────────
+    /** The public origin: `config.publicUrl` when set, else the request's own protocol and `Host`. */
+    #origin(ctx) {
+        return (this.#publicOrigin ??
+            `${ctx.request.protocol()}://${ctx.request.headers().host ?? 'localhost'}`);
+    }
+    /**
+     * Refuse the request with `status` and the RFC 6750 / RFC 9728 challenge. `hadToken` picks the error
+     * code (no token → none, per RFC 6750 §3.1); `resource_metadata` is added when the auth exposes OAuth.
+     * `auth` is `undefined` on the fail-closed open-mode path, which still gets a bare `Bearer` challenge.
+     */
+    #refuse(ctx, auth, status, message, hadToken) {
+        const challenge = wwwAuthenticateChallenge({
+            ...(status === 403
+                ? { error: 'insufficient_scope' }
+                : hadToken
+                    ? { error: 'invalid_token' }
+                    : {}),
+            ...(auth?.oauth !== undefined
+                ? { resourceMetadataUrl: protectedResourceMetadataUrl(this.#origin(ctx), this.#path) }
+                : {}),
+        });
+        ctx.response.header('WWW-Authenticate', challenge);
+        ctx.response.status(status).json({ error: message });
+        return null;
+    }
     /**
      * Verify the request's `Authorization: Bearer` token against the configured auth, or fall back to the
-     * open-mode `actor`. Returns the `AuthInfo` to attach to the transport, or `null` to reply 401.
+     * open-mode `actor`. Returns the `AuthInfo` to attach to the transport, or `null` once it has replied
+     * 401/403.
      */
     async #authenticate(ctx, auth, openActor) {
         const header = ctx.request.header('authorization');
-        const token = header?.startsWith('Bearer ') ? header.slice(7).trim() : undefined;
+        const token = /^Bearer\s/i.test(header ?? '') ? header?.slice(7).trim() : undefined;
         if (auth !== undefined) {
             if (!token) {
-                ctx.response.status(401).json({ error: 'missing bearer token' });
-                return null;
+                return this.#refuse(ctx, auth, 401, 'missing bearer token', false);
             }
             try {
                 return await auth.verify(token);
             }
             catch (error) {
-                ctx.response
-                    .status(401)
-                    .json({ error: error instanceof Error ? error.message : 'unauthorized' });
-                return null;
+                const status = error instanceof McpAuthError ? error.status : 401;
+                const message = error instanceof Error ? error.message : 'unauthorized';
+                return this.#refuse(ctx, auth, status, message, true);
             }
         }
         if (openActor !== undefined) {
             return { token: '', clientId: '', scopes: [], extra: { actor: openActor } };
         }
-        ctx.response
-            .status(401)
-            .json({ error: 'unauthorized: no auth configured and no fallback actor' });
-        return null;
+        return this.#refuse(ctx, undefined, 401, 'unauthorized: no auth configured and no fallback actor', false);
     }
     // ── route handlers ────────────────────────────────────────────────────────
     async #handlePost(ctx, config, registry, authorizer, auth, openActor) {

package/dist/providers/mcp_provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp_provider.js","sourceRoot":"","sources":["../../providers/mcp_provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,OAAO,OAAO,WAAW;IAIR,GAAG;IAHzB,uFAAuF;IAC9E,WAAW,GAAG,IAAI,GAAG,EAAyC,CAAC;IAExE,YAAsB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAEjD,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAY,KAAK,EAAE,EAAe,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAChF,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/F,+FAA+F;QAC/F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CACtC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CACrE,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAErF,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,MAAM,YAAY,GAAG,yCAAyC,IAAI,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;gBAClD,6FAA6F;gBAC7F,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjE,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC1F,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACvB,QAAQ,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE;oBAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;oBACpC,gBAAgB,EAAE,IAAI,CAAC,eAAe;oBACtC,aAAa,EAAE,IAAI,CAAC,YAAY;iBACjC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,aAAa,CACjB,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,QAAQ;qBACT,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC5E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,QAAQ;aACT,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,WAAW,CACf,GAAgB,EAChB,MAAiB,EACjB,QAAsB,EACtB,UAAuB,EACvB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,IAAI,CAAC;YACH,IAAI,SAAoD,CAAC;YACzD,IAAI,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,uFAAuF;gBACvF,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;gBAC7C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,8FAA8F;gBAC9F,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;oBACtC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC5B,IAAI,SAAS;4BAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACtD,CAAC;iBACF,CAAC,CAAC;gBACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,MAAM,GAAG,GAAG,SAAS,EAAE,SAAS,CAAC;oBACjC,IAAI,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;wBACnD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC,CAAC;gBACF,MAAM,MAAM,GAAG,eAAe,CAAC;oBAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ;oBACR,MAAM,EAAE,UAAU;oBAClB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnF,aAAa,EAAE,iBAAiB;iBACjC,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAC;gBAC7C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE;oBACpE,EAAE,EAAE,IAAI;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;qBACnE;oBACD,EAAE,EAAE,IAAI;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,yGAAyG;IACzG,YAAY,CAAC,GAAmB;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"mcp_provider.js","sourceRoot":"","sources":["../../providers/mcp_provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,OAAO,OAAO,WAAW;IAQR,GAAG;IAPzB,uFAAuF;IAC9E,WAAW,GAAG,IAAI,GAAG,EAAyC,CAAC;IACxE,0EAA0E;IAC1E,KAAK,GAAG,KAAK,CAAC;IACd,2FAA2F;IAC3F,aAAa,CAAqB;IAElC,YAAsB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAEjD,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAY,KAAK,EAAE,EAAe,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAChF,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9E,+FAA+F;QAC/F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAElB,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CACtC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CACrE,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAErF,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,MAAM,YAAY,GAAG,yCAAyC,IAAI,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;gBAClD,6FAA6F;gBAC7F,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjE,gFAAgF;gBAChF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;gBACxD,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACrF,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E,kGAAkG;IAClG,OAAO,CAAC,GAAgB;QACtB,OAAO,CACL,IAAI,CAAC,aAAa;YAClB,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,WAAW,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CACL,GAAgB,EAChB,IAAyB,EACzB,MAAiB,EACjB,OAAe,EACf,QAAiB;QAEjB,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,EAAE,KAAK,EAAE,oBAA6B,EAAE;gBAC1C,CAAC,CAAC,QAAQ;oBACR,CAAC,CAAC,EAAE,KAAK,EAAE,eAAwB,EAAE;oBACrC,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS;gBAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;gBACtF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;gBAClE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;gBACxE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CACjB,GAAG,EACH,SAAS,EACT,GAAG,EACH,wDAAwD,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,WAAW,CACf,GAAgB,EAChB,MAAiB,EACjB,QAAsB,EACtB,UAAuB,EACvB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,IAAI,CAAC;YACH,IAAI,SAAoD,CAAC;YACzD,IAAI,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,uFAAuF;gBACvF,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;gBAC7C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,8FAA8F;gBAC9F,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;oBACtC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC5B,IAAI,SAAS;4BAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACtD,CAAC;iBACF,CAAC,CAAC;gBACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;oBACvB,MAAM,GAAG,GAAG,SAAS,EAAE,SAAS,CAAC;oBACjC,IAAI,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;wBACnD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC,CAAC;gBACF,MAAM,MAAM,GAAG,eAAe,CAAC;oBAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ;oBACR,MAAM,EAAE,UAAU;oBAClB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnF,aAAa,EAAE,iBAAiB;iBACjC,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAC;gBAC7C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE;oBACpE,EAAE,EAAE,IAAI;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;qBACnE;oBACD,EAAE,EAAE,IAAI;iBACT,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,GAAgB,EAChB,IAAyB,EACzB,SAA6B;QAE7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAgD,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC9B,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QAEpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,yGAAyG;IACzG,YAAY,CAAC,GAAmB;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/authz/authz-tool-authorizer.d.ts

@@ -36,13 +36,13 @@ export interface AuthzToolAuthorizerConfig {
      */
     authz: AuthzServiceLike;
     /**
-     * Maps an {@link Actor} onto the user object authz resolves a `UserRef` from. Defaults to
-     * `{ id: actor.id }` — enough for authz's `defaultResolveUserRef` (which reads `.id`, defaulting
+     * Maps an {@link Actor} onto the user object authz resolves a `SubjectRef` from. Defaults to
+     * `{ id: actor.id }` — enough for authz's `defaultResolveSubjectRef` (which reads `.id`, defaulting
      * the type to `user`). Override to attach a polymorphic `type` or a host user entity.
      */
     userFromActor?: (actor: Actor) => unknown;
 }
-/** Default {@link Actor} → authz user mapping: the minimal `{ id }` authz needs to resolve a `UserRef`. */
+/** Default {@link Actor} → authz subject mapping: the minimal `{ id }` authz needs to resolve a `SubjectRef`. */
 export declare function defaultUserFromActor(actor: Actor): unknown;
 /**
  * A {@link RolesPolicy} (the agent's `ToolAuthorizer` seam) backed by `@adonis-agora/authz`

package/dist/src/authz/authz-tool-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-tool-authorizer.d.ts","sourceRoot":"","sources":["../../../src/authz/authz-tool-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClG;AAED,6EAA6E;AAC7E,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;CAC3C;AAED,2GAA2G;AAC3G,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IAIrD,YAAY,MAAM,EAAE,yBAAyB,EAG5C;IAEK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAYxD;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,mBAAmB,CAE1F"}
+{"version":3,"file":"authz-tool-authorizer.d.ts","sourceRoot":"","sources":["../../../src/authz/authz-tool-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClG;AAED,6EAA6E;AAC7E,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;CAC3C;AAED,iHAAiH;AACjH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IAIrD,YAAY,MAAM,EAAE,yBAAyB,EAG5C;IAEK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAYxD;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,mBAAmB,CAE1F"}

package/dist/src/authz/authz-tool-authorizer.js

@@ -1,4 +1,4 @@
-/** Default {@link Actor} → authz user mapping: the minimal `{ id }` authz needs to resolve a `UserRef`. */
+/** Default {@link Actor} → authz subject mapping: the minimal `{ id }` authz needs to resolve a `SubjectRef`. */
 export function defaultUserFromActor(actor) {
     return { id: actor.id };
 }

package/dist/src/authz/authz-tool-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-tool-authorizer.js","sourceRoot":"","sources":["../../../src/authz/authz-tool-authorizer.ts"],"names":[],"mappings":"AA8CA,2GAA2G;AAC3G,MAAM,UAAU,oBAAoB,CAAC,KAAY;IAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAmB;IACzB,cAAc,CAA4B;IAEnD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAY,EAAE,IAAc;QACpC,kFAAkF;QAClF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,CAAC;YACH,8FAA8F;YAC9F,4FAA4F;YAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACnE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"authz-tool-authorizer.js","sourceRoot":"","sources":["../../../src/authz/authz-tool-authorizer.ts"],"names":[],"mappings":"AA8CA,iHAAiH;AACjH,MAAM,UAAU,oBAAoB,CAAC,KAAY;IAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACrB,MAAM,CAAmB;IACzB,cAAc,CAA4B;IAEnD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAY,EAAE,IAAc;QACpC,kFAAkF;QAClF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7C,IAAI,CAAC;YACH,8FAA8F;YAC9F,4FAA4F;YAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiC;IACnE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/dist/src/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.33.1";
+export declare const VERSION = "0.34.1";
 export { configure } from '../configure.js';
 export * from './actor-labels.js';
 export type { AuthActorResolverOptions } from './actor-resolver.js';

package/dist/src/index.js

@@ -1,4 +1,4 @@
-export const VERSION = '0.33.1';
+export const VERSION = '0.34.1';
 // Re-export the configure hook from the package root so `node ace configure` finds it.
 // AdonisJS imports the package MAIN and reads `configure` off the module namespace —
 // the `./configure` subpath alone is never consulted.

package/dist/src/mcp/auth.d.ts

@@ -46,9 +46,42 @@ export interface McpAuthInfo extends Omit<AuthInfo, 'extra'> {
 export interface McpAuth {
     /** OAuth metadata to advertise, resolved lazily (the authkit peer may not be bootable until first use). */
     oauth?: McpOAuthMetadata | (() => McpOAuthMetadata | Promise<McpOAuthMetadata>);
-    /** Validate `token` and resolve the acting actor as a typed `McpAuthInfo`. Throws `Error` on rejection. */
+    /**
+     * Validate `token` and resolve the acting actor as a typed `McpAuthInfo`. Throws on rejection:
+     * {@link McpAuthError} for a deliberate refusal (its `status` and message reach the client), any
+     * other `Error` for a token this strategy does not recognize (→ `401`).
+     */
     verify(token: string): Promise<McpAuthInfo>;
 }
+/**
+ * A typed refusal from an MCP auth strategy: the token was recognized and deliberately refused (a
+ * client that is not allowed on this endpoint, an account that left the tenant, a revoked grant).
+ *
+ * Throw it from `verify` — or from the `toActor` of `authKitAuth()` / `apiKeyAuth()` — and the
+ * provider answers with its `status` and message, plus the matching `WWW-Authenticate` challenge:
+ * `401` → `error="invalid_token"`, `403` → `error="insufficient_scope"`.
+ *
+ * Inside {@link anyOf} it is also a stop signal: a strategy that throws `McpAuthError` has claimed
+ * the token, so the remaining strategies are not tried. Any other error means "not my token" and
+ * the next strategy gets its turn.
+ *
+ * ```ts
+ * authKitAuth({
+ *   toActor: ({ accountId, clientId }) => {
+ *     if (clientId === 'web') throw new McpAuthError('token was not issued for MCP')
+ *     return { id: accountId }
+ *   },
+ * })
+ * ```
+ */
+export declare class McpAuthError extends Error {
+    /** HTTP status of the refusal: `401` (the token does not authenticate) or `403` (it does, but may not do this). */
+    readonly status: 401 | 403;
+    constructor(message: string, options?: {
+        status?: 401 | 403;
+        cause?: unknown;
+    });
+}
 /**
  * A configured MCP auth strategy, as a lazy thunk the provider calls at boot. Each factory lazily
  * imports / resolves its peer inside the thunk, so nothing loads until the strategy is actually selected.
@@ -58,12 +91,48 @@ export type McpAuthFactory = (ctx: McpAuthContext) => McpAuth | Promise<McpAuth>
  * Resolve a `McpAuth` config value (a ready instance or a lazy factory) at provider boot.
  */
 export declare function resolveMcpAuth(auth: McpAuth | McpAuthFactory, ctx: McpAuthContext): Promise<McpAuth>;
-/** How `authKitAuth()` maps an access token to the MCP actor. Defaults to the account id. */
-export type AuthKitActorResolver = (info: {
+/**
+ * The organization authkit bound to a grant at consent time (the active org of the session that
+ * approved it). Stored on the grant as `activeOrg`.
+ */
+export interface AuthKitActiveOrg {
+    orgId: string;
+    orgSlug?: string;
+    orgRole?: string;
+}
+/**
+ * The oidc-provider `Grant` behind an access token — the authorization the user gave to a client.
+ * Duck-typed: only the fields this package reads are named; the rest of the stored grant is there too.
+ */
+export interface AuthKitGrant {
+    accountId?: string;
+    clientId?: string;
+    /** Set by authkit at consent when the session had an active organization. */
+    activeOrg?: unknown;
+    [key: string]: unknown;
+}
+/** What `authKitAuth()` hands `toActor` for a verified access token. */
+export interface AuthKitActorInfo {
+    /** The account the token was issued to. */
     accountId: string;
+    /** The token's granted scopes. */
     scopes: string[];
+    /** The client the token was issued to — refuse clients that should not reach MCP by throwing {@link McpAuthError}. */
     clientId: string | undefined;
-}) => Actor | Promise<Actor>;
+    /** The grant id the token belongs to, when the provider tracks one. */
+    grantId: string | undefined;
+    /** The grant itself (loaded per request, so a revoked grant stops the token right away). */
+    grant: AuthKitGrant | undefined;
+    /** The organization authkit bound to the grant at consent — the tenant the user authorized. */
+    activeOrg: AuthKitActiveOrg | undefined;
+    /** Extra claims stored on the access token (`extraTokenClaims`), if any. */
+    extra: Record<string, unknown> | undefined;
+}
+/**
+ * How `authKitAuth()` maps an access token to the MCP actor. Defaults to the account id. Throw
+ * {@link McpAuthError} to refuse the token (e.g. a client that is not allowed on this endpoint).
+ */
+export type AuthKitActorResolver = (info: AuthKitActorInfo) => Actor | Promise<Actor>;
 /** Options for {@link authKitAuth}. */
 export interface AuthKitMcpAuthOptions {
     /** Scopes the authorization server advertises. Defaults to the standard authkit scopes. */
@@ -99,4 +168,24 @@ export interface ApiKeyMcpAuthOptions {
  * checks the key. Keys are compared with a constant-time compare to resist timing attacks.
  */
 export declare function apiKeyAuth(options: ApiKeyMcpAuthOptions): McpAuthFactory;
+/**
+ * Accept more than one kind of bearer token on the same MCP endpoint — e.g. OAuth access tokens from
+ * MCP clients that logged in through the browser AND personal access tokens for machine integrations:
+ *
+ * ```ts
+ * auth: anyOf(
+ *   authKitAuth({ toActor }),
+ *   { verify: verifyPersonalAccessToken },
+ * )
+ * ```
+ *
+ * Strategies are tried in order and the first that verifies the token wins. A strategy that throws a
+ * plain `Error` passes ("not my token"); one that throws {@link McpAuthError} has claimed the token and
+ * refused it, so the chain stops there with that refusal. When every strategy passes, the last error
+ * is rethrown.
+ *
+ * OAuth metadata comes from the first strategy that exposes it, so the RFC 9728 document and the
+ * `WWW-Authenticate` challenge still point MCP clients at the login flow.
+ */
+export declare function anyOf(...strategies: Array<McpAuth | McpAuthFactory>): McpAuthFactory;
 //# sourceMappingURL=auth.d.ts.map

package/dist/src/mcp/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yGAAyG;IACzG,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC1D,KAAK,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF,2GAA2G;IAC3G,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,GAAG,cAAc,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,CAKlB;AAuBD,6FAA6F;AAC7F,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAE7B,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iGAAiG;IACjG,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAgD/E;AAmBD,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAE7E,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAcxE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yGAAyG;IACzG,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC1D,KAAK,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAE3B,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,EAIjF;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,GAAG,cAAc,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,CAKlB;AA6BD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sHAAsH;IACtH,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,uEAAuE;IACvE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,+FAA+F;IAC/F,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,gBAAgB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAEtF,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iGAAiG;IACjG,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAgE/E;AA+BD,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAE7E,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAcxE;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,KAAK,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,OAAO,GAAG,cAAc,CAAC,GAAG,cAAc,CAuBpF"}

package/dist/src/mcp/auth.js

@@ -1,3 +1,33 @@
+/**
+ * A typed refusal from an MCP auth strategy: the token was recognized and deliberately refused (a
+ * client that is not allowed on this endpoint, an account that left the tenant, a revoked grant).
+ *
+ * Throw it from `verify` — or from the `toActor` of `authKitAuth()` / `apiKeyAuth()` — and the
+ * provider answers with its `status` and message, plus the matching `WWW-Authenticate` challenge:
+ * `401` → `error="invalid_token"`, `403` → `error="insufficient_scope"`.
+ *
+ * Inside {@link anyOf} it is also a stop signal: a strategy that throws `McpAuthError` has claimed
+ * the token, so the remaining strategies are not tried. Any other error means "not my token" and
+ * the next strategy gets its turn.
+ *
+ * ```ts
+ * authKitAuth({
+ *   toActor: ({ accountId, clientId }) => {
+ *     if (clientId === 'web') throw new McpAuthError('token was not issued for MCP')
+ *     return { id: accountId }
+ *   },
+ * })
+ * ```
+ */
+export class McpAuthError extends Error {
+    /** HTTP status of the refusal: `401` (the token does not authenticate) or `403` (it does, but may not do this). */
+    status;
+    constructor(message, options = {}) {
+        super(message, options.cause !== undefined ? { cause: options.cause } : undefined);
+        this.name = 'McpAuthError';
+        this.status = options.status ?? 401;
+    }
+}
 /**
  * Resolve a `McpAuth` config value (a ready instance or a lazy factory) at provider boot.
  */
@@ -42,14 +72,30 @@ export function authKitAuth(options = {}) {
             async verify(token) {
                 const service = await getService();
                 const at = await service.provider.AccessToken.find(token);
-                if (!at || at.isExpired) {
+                if (!at) {
+                    // Not an access token this issuer knows — plain `Error`, so `anyOf` tries the next strategy.
                     throw new Error('invalid or expired access token');
                 }
+                if (at.isExpired) {
+                    throw new McpAuthError('invalid or expired access token');
+                }
+                let grant;
+                if (at.grantId !== undefined && service.provider.Grant !== undefined) {
+                    grant = await service.provider.Grant.find(at.grantId);
+                    if (grant === undefined) {
+                        // The user revoked the authorization; the token must not outlive it.
+                        throw new McpAuthError('authorization revoked');
+                    }
+                }
                 const tokenScopes = (at.scope ?? '').split(' ').filter(Boolean);
                 const actor = await toActor({
                     accountId: at.accountId,
                     scopes: tokenScopes,
                     clientId: at.clientId,
+                    grantId: at.grantId,
+                    grant,
+                    activeOrg: readActiveOrg(grant?.activeOrg),
+                    extra: at.extra,
                 });
                 return {
                     token,
@@ -62,6 +108,19 @@ export function authKitAuth(options = {}) {
         };
     };
 }
+/** Narrow the grant's stored `activeOrg` to {@link AuthKitActiveOrg}; anything without an `orgId` string is no org. */
+function readActiveOrg(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const candidate = value;
+    if (typeof candidate.orgId !== 'string' || candidate.orgId === '')
+        return undefined;
+    return {
+        orgId: candidate.orgId,
+        ...(typeof candidate.orgSlug === 'string' ? { orgSlug: candidate.orgSlug } : {}),
+        ...(typeof candidate.orgRole === 'string' ? { orgRole: candidate.orgRole } : {}),
+    };
+}
 /**
  * Resolve the authkit `OidcService` from the container. `@adonis-agora/authkit-server` augments
  * `ContainerBindings` with `'authkit.server'`, so `make` is fully typed with no cast.
@@ -105,4 +164,50 @@ function timingSafeEqual(a, b) {
     }
     return diff === 0;
 }
+// ── anyOf ───────────────────────────────────────────────────────────────────
+/**
+ * Accept more than one kind of bearer token on the same MCP endpoint — e.g. OAuth access tokens from
+ * MCP clients that logged in through the browser AND personal access tokens for machine integrations:
+ *
+ * ```ts
+ * auth: anyOf(
+ *   authKitAuth({ toActor }),
+ *   { verify: verifyPersonalAccessToken },
+ * )
+ * ```
+ *
+ * Strategies are tried in order and the first that verifies the token wins. A strategy that throws a
+ * plain `Error` passes ("not my token"); one that throws {@link McpAuthError} has claimed the token and
+ * refused it, so the chain stops there with that refusal. When every strategy passes, the last error
+ * is rethrown.
+ *
+ * OAuth metadata comes from the first strategy that exposes it, so the RFC 9728 document and the
+ * `WWW-Authenticate` challenge still point MCP clients at the login flow.
+ */
+export function anyOf(...strategies) {
+    if (strategies.length === 0) {
+        throw new Error('[@adonis-agora/agent] `anyOf()` needs at least one MCP auth strategy');
+    }
+    return async (ctx) => {
+        const resolved = await Promise.all(strategies.map((strategy) => resolveMcpAuth(strategy, ctx)));
+        const oauth = resolved.find((strategy) => strategy.oauth !== undefined)?.oauth;
+        return {
+            ...(oauth !== undefined ? { oauth } : {}),
+            async verify(token) {
+                let lastError;
+                for (const strategy of resolved) {
+                    try {
+                        return await strategy.verify(token);
+                    }
+                    catch (error) {
+                        if (error instanceof McpAuthError)
+                            throw error;
+                        lastError = error;
+                    }
+                }
+                throw lastError;
+            },
+        };
+    };
+}
 //# sourceMappingURL=auth.js.map

package/dist/src/mcp/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AA4DA;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA8B,EAC9B,GAAmB;IAEnB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAwCD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO,GAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAyB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,IAAI,cAAuD,CAAC;QAE5D,MAAM,UAAU,GAAG,GAAgC,EAAE;YACnD,cAAc,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAA+B,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,OAAO;gBACL,MAAM;gBACN,qBAAqB,EAAE,GAAG,MAAM,OAAO;gBACvC,aAAa,EAAE,GAAG,MAAM,QAAQ;gBAChC,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB;aACzD,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO;YACL,KAAK;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;oBAC1B,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;iBACtB,CAAC,CAAC;gBACH,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;oBAC3B,MAAM,EAAE,WAAW;oBACnB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAuB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iFAAiF,OAAO,8FAA8F,CACvL,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,KAAK,IAAI,EAAE;QAChB,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AA0DA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,mHAAmH;IAC1G,MAAM,CAAY;IAE3B,YAAY,OAAe,EAAE,OAAO,GAA4C,EAAE;QAChF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;IACtC,CAAC;CACF;AAQD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA8B,EAC9B,GAAmB;IAEnB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAqFD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO,GAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAyB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,IAAI,cAAuD,CAAC;QAE5D,MAAM,UAAU,GAAG,GAAgC,EAAE;YACnD,cAAc,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAA+B,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,OAAO;gBACL,MAAM;gBACN,qBAAqB,EAAE,GAAG,MAAM,OAAO;gBACvC,aAAa,EAAE,GAAG,MAAM,QAAQ;gBAChC,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB;aACzD,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO;YACL,KAAK;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,6FAA6F;oBAC7F,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBACjB,MAAM,IAAI,YAAY,CAAC,iCAAiC,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,KAA+B,CAAC;gBACpC,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACrE,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;oBACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,qEAAqE;wBACrE,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;oBAC1B,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,KAAK;oBACL,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;oBAC1C,KAAK,EAAE,EAAE,CAAC,KAAK;iBAChB,CAAC,CAAC;gBACH,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;oBAC3B,MAAM,EAAE,WAAW;oBACnB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,uHAAuH;AACvH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpF,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAuB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iFAAiF,OAAO,8FAA8F,CACvL,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,KAAK,IAAI,EAAE;QAChB,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,KAAK,CAAC,GAAG,UAA2C;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,KAAK,CAAC;QAC/E,OAAO;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,SAAkB,CAAC;gBACvB,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACtC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,KAAK,CAAC;wBAC/C,SAAS,GAAG,KAAK,CAAC;oBACpB,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC;YAClB,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/mcp/define_config.d.ts

@@ -1,6 +1,6 @@
 import type { RolesPolicy } from '../spi/roles-policy.js';
 import type { McpAuth, McpAuthFactory } from './auth.js';
-import { apiKeyAuth, authKitAuth } from './auth.js';
+import { anyOf, apiKeyAuth, authKitAuth, McpAuthError } from './auth.js';
 /**
  * Shape of `config/mcp.ts`. The MCP provider exposes the agent's {@link ToolRegistry} over the Model
  * Context Protocol (Streamable HTTP): `tools/list` mirrors the tools the acting actor may call
@@ -27,9 +27,17 @@ export interface McpConfig {
      * OAuth metadata (when `auth.oauth` is set) is served at `/.well-known/oauth-protected-resource{path}`.
      */
     path?: string;
+    /**
+     * The public origin MCP clients reach this app at (e.g. `'https://app.example.com'`) — the base of
+     * the RFC 9728 `resource` and of the `resource_metadata` URL in the `WWW-Authenticate` challenge.
+     * Set it whenever TLS terminates at a proxy the app does not trust (the request then "sees"
+     * `http://`). Omit → both are built from the request's protocol and `Host` header. Must be an
+     * origin only: a path, query, or fragment is rejected at boot.
+     */
+    publicUrl?: string;
     /**
      * How MCP clients authenticate. Pass a ready {@link McpAuth} or a lazy {@link McpAuthFactory} thunk
-     * (`authKitAuth()` / `apiKeyAuth()`). Omit → the server is open (no bearer check); the acting actor
+     * (`authKitAuth()` / `apiKeyAuth()`, or several of them combined with `anyOf()`). Omit → the server is open (no bearer check); the acting actor
      * falls back to `actor`. Fail-closed: with no `auth` AND no `actor`, requests are rejected.
      */
     auth?: McpAuth | McpAuthFactory;
@@ -58,7 +66,7 @@ export interface McpConfig {
 }
 /** Identity helper giving `config/mcp.ts` full type-checking. */
 export declare function defineMcpConfig(config: McpConfig): McpConfig;
-export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActorResolver, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpOAuthMetadata, } from './auth.js';
+export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActiveOrg, AuthKitActorInfo, AuthKitActorResolver, AuthKitGrant, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpOAuthMetadata, } from './auth.js';
 export { resolveMcpAuth } from './auth.js';
-export { apiKeyAuth, authKitAuth };
+export { anyOf, apiKeyAuth, authKitAuth, McpAuthError };
 //# sourceMappingURL=define_config.d.ts.map

package/dist/src/mcp/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAE5D;AAED,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAE5D;AAED,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC"}

package/dist/src/mcp/define_config.js

@@ -1,8 +1,8 @@
-import { apiKeyAuth, authKitAuth } from './auth.js';
+import { anyOf, apiKeyAuth, authKitAuth, McpAuthError } from './auth.js';
 /** Identity helper giving `config/mcp.ts` full type-checking. */
 export function defineMcpConfig(config) {
     return config;
 }
 export { resolveMcpAuth } from './auth.js';
-export { apiKeyAuth, authKitAuth };
+export { anyOf, apiKeyAuth, authKitAuth, McpAuthError };
 //# sourceMappingURL=define_config.js.map

package/dist/src/mcp/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAsDpD,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AA8DzE,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAeD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC"}

package/dist/src/mcp/discovery.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The OAuth discovery surface of the MCP server (MCP Authorization spec, RFC 9728, RFC 6750 §3): the
+ * protected-resource metadata document, its well-known URL, and the `WWW-Authenticate` challenge a
+ * `401`/`403` carries so an MCP client knows where to start the login.
+ *
+ * Pure functions over strings — the provider decides which origin to feed them (the configured
+ * `publicUrl`, or the request's own protocol and `Host` as a fallback).
+ */
+import type { McpOAuthMetadata } from './auth.js';
+/** Normalize a route prefix the way the provider mounts it: no leading/trailing slashes. */
+export declare function normalizeMcpPath(path: string | undefined): string;
+/**
+ * Validate `publicUrl` from `config/mcp.ts` and reduce it to its origin (`https://app.example.com`).
+ * Only an origin is meaningful: the MCP endpoint and its well-known document are mounted at fixed
+ * paths on this app, so a path, query, or fragment would advertise URLs the app does not serve.
+ */
+export declare function publicOrigin(publicUrl: string): string;
+/** The protected resource (RFC 9728 `resource`): the URL an MCP client points at, e.g. `https://app.example.com/mcp`. */
+export declare function mcpResourceUrl(origin: string, path: string): string;
+/** Where the protected-resource metadata lives (RFC 9728 §3.1): the well-known segment goes between host and path. */
+export declare function protectedResourceMetadataUrl(origin: string, path: string): string;
+/** The RFC 9728 protected-resource metadata document. */
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: string[];
+    resource_name: string;
+}
+/** Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. */
+export declare function protectedResourceMetadata(meta: McpOAuthMetadata, origin: string, path: string): ProtectedResourceMetadata;
+/** Options for {@link wwwAuthenticateChallenge}. */
+export interface WwwAuthenticateOptions {
+    /**
+     * The RFC 6750 error code. `invalid_token` when the request carried a token that was refused,
+     * `insufficient_scope` for a `403`, omitted when no token was sent at all (RFC 6750 §3.1).
+     */
+    error?: 'invalid_token' | 'insufficient_scope';
+    /** The metadata URL (RFC 9728 §5.1). Set only when the auth strategy exposes OAuth metadata. */
+    resourceMetadataUrl?: string;
+}
+/**
+ * The `WWW-Authenticate` value for a `401`/`403` from the MCP endpoint — e.g.
+ * `Bearer error="invalid_token", resource_metadata="https://app.example.com/.well-known/oauth-protected-resource/mcp"`.
+ * `resource_metadata` is what makes an MCP client discover the authorization server and open the login.
+ */
+export declare function wwwAuthenticateChallenge(options?: WwwAuthenticateOptions): string;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/src/mcp/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAED,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,sHAAsH;AACtH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,yBAAyB,CAQ3B;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAOrF"}

package/dist/src/mcp/discovery.js

@@ -0,0 +1,70 @@
+/**
+ * The OAuth discovery surface of the MCP server (MCP Authorization spec, RFC 9728, RFC 6750 §3): the
+ * protected-resource metadata document, its well-known URL, and the `WWW-Authenticate` challenge a
+ * `401`/`403` carries so an MCP client knows where to start the login.
+ *
+ * Pure functions over strings — the provider decides which origin to feed them (the configured
+ * `publicUrl`, or the request's own protocol and `Host` as a fallback).
+ */
+/** Normalize a route prefix the way the provider mounts it: no leading/trailing slashes. */
+export function normalizeMcpPath(path) {
+    return (path ?? 'mcp').replace(/^\/+|\/+$/g, '');
+}
+/**
+ * Validate `publicUrl` from `config/mcp.ts` and reduce it to its origin (`https://app.example.com`).
+ * Only an origin is meaningful: the MCP endpoint and its well-known document are mounted at fixed
+ * paths on this app, so a path, query, or fragment would advertise URLs the app does not serve.
+ */
+export function publicOrigin(publicUrl) {
+    let url;
+    try {
+        url = new URL(publicUrl);
+    }
+    catch {
+        throw new Error(`[@adonis-agora/agent] \`publicUrl\` in config/mcp.ts is not an absolute URL: ${JSON.stringify(publicUrl)}`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`[@adonis-agora/agent] \`publicUrl\` in config/mcp.ts must be http(s), got ${JSON.stringify(publicUrl)}`);
+    }
+    if (url.pathname !== '/' || url.search !== '' || url.hash !== '') {
+        throw new Error(`[@adonis-agora/agent] \`publicUrl\` in config/mcp.ts must be an origin only (e.g. "https://app.example.com"), got ${JSON.stringify(publicUrl)}`);
+    }
+    return url.origin;
+}
+/** The protected resource (RFC 9728 `resource`): the URL an MCP client points at, e.g. `https://app.example.com/mcp`. */
+export function mcpResourceUrl(origin, path) {
+    return `${origin}/${normalizeMcpPath(path)}`;
+}
+/** Where the protected-resource metadata lives (RFC 9728 §3.1): the well-known segment goes between host and path. */
+export function protectedResourceMetadataUrl(origin, path) {
+    return `${origin}/.well-known/oauth-protected-resource/${normalizeMcpPath(path)}`;
+}
+/** Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. */
+export function protectedResourceMetadata(meta, origin, path) {
+    return {
+        resource: mcpResourceUrl(origin, path),
+        authorization_servers: [meta.issuer],
+        scopes_supported: meta.scopesSupported,
+        bearer_methods_supported: ['header'],
+        resource_name: meta.resourceName,
+    };
+}
+/**
+ * The `WWW-Authenticate` value for a `401`/`403` from the MCP endpoint — e.g.
+ * `Bearer error="invalid_token", resource_metadata="https://app.example.com/.well-known/oauth-protected-resource/mcp"`.
+ * `resource_metadata` is what makes an MCP client discover the authorization server and open the login.
+ */
+export function wwwAuthenticateChallenge(options = {}) {
+    const params = [];
+    if (options.error !== undefined)
+        params.push(`error="${options.error}"`);
+    if (options.resourceMetadataUrl !== undefined) {
+        params.push(`resource_metadata="${quote(options.resourceMetadataUrl)}"`);
+    }
+    return params.length === 0 ? 'Bearer' : `Bearer ${params.join(', ')}`;
+}
+/** Escape a value for an RFC 7230 quoted-string. */
+function quote(value) {
+    return value.replace(/[\\"]/g, (char) => `\\${char}`);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/src/mcp/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,qHAAqH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACjJ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;IACzD,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,4BAA4B,CAAC,MAAc,EAAE,IAAY;IACvE,OAAO,GAAG,MAAM,yCAAyC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AACpF,CAAC;AAWD,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CACvC,IAAsB,EACtB,MAAc,EACd,IAAY;IAEZ,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;QACpC,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA2B,EAAE;IAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,oDAAoD;AACpD,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/mcp/index.d.ts

@@ -1,8 +1,10 @@
 export { actorFromAuthInfo, isActor } from './actor.js';
-export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActorResolver, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpAuthInfo, McpOAuthMetadata, } from './auth.js';
-export { apiKeyAuth, authKitAuth, resolveMcpAuth } from './auth.js';
+export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActiveOrg, AuthKitActorInfo, AuthKitActorResolver, AuthKitGrant, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpAuthInfo, McpOAuthMetadata, } from './auth.js';
+export { anyOf, apiKeyAuth, authKitAuth, McpAuthError, resolveMcpAuth } from './auth.js';
 export type { McpConfig } from './define_config.js';
 export { defineMcpConfig } from './define_config.js';
+export type { ProtectedResourceMetadata, WwwAuthenticateOptions } from './discovery.js';
+export { mcpResourceUrl, protectedResourceMetadata, protectedResourceMetadataUrl, publicOrigin, wwwAuthenticateChallenge, } from './discovery.js';
 export type { CreateMcpServerOptions, McpToolContextOptions } from './server.js';
 export { createMcpServer } from './server.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzF,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/mcp/index.js

@@ -1,5 +1,6 @@
 export { actorFromAuthInfo, isActor } from './actor.js';
-export { apiKeyAuth, authKitAuth, resolveMcpAuth } from './auth.js';
+export { anyOf, apiKeyAuth, authKitAuth, McpAuthError, resolveMcpAuth } from './auth.js';
 export { defineMcpConfig } from './define_config.js';
+export { mcpResourceUrl, protectedResourceMetadata, protectedResourceMetadataUrl, publicOrigin, wwwAuthenticateChallenge, } from './discovery.js';
 export { createMcpServer } from './server.js';
 //# sourceMappingURL=index.js.map

package/dist/src/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAYxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAexD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEzF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/stubs/config/mcp.stub

@@ -2,7 +2,8 @@
   exports({ to: app.configPath('mcp.ts') })
 }}}
 import { defineMcpConfig, authKitAuth } from '@adonis-agora/agent/mcp'
-// import { apiKeyAuth } from '@adonis-agora/agent/mcp'
+// import { anyOf, apiKeyAuth } from '@adonis-agora/agent/mcp'
+// import env from '#start/env'
 
 /**
  * Configuration for the MCP (Model Context Protocol) endpoint. The provider exposes the agent's tool
@@ -26,6 +27,10 @@ export default defineMcpConfig({
 
   // path: 'mcp',
 
+  // The public origin clients reach the app at. Set it when TLS terminates at a proxy, or the OAuth
+  // discovery URLs are built from the request and come out \`http://\`.
+  // publicUrl: env.get('APP_URL'),
+
   // Authenticate MCP clients against @adonis-agora/authkit-server (OAuth OIDC): verifies the bearer
   // token against the authkit provider and advertises OAuth metadata so clients can log in.
   auth: authKitAuth(),
@@ -33,6 +38,9 @@ export default defineMcpConfig({
   // Or static API keys for trusted gateway integrations (no OAuth metadata):
   // auth: apiKeyAuth({ apiKeys: ['mcp_xxx'] }),
 
+  // Or both on the same endpoint (first to verify wins; OAuth metadata from authKitAuth):
+  // auth: anyOf(authKitAuth(), apiKeyAuth({ apiKeys: ['mcp_xxx'] })),
+
   // Open/dev mode — run every request under a fixed identity. Fail-closed: omit this (and auth) and
   // requests are rejected 401.
   // actor: { id: 'mcp', roles: ['ADMIN'] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/agent",
-  "version": "0.33.1",
+  "version": "0.34.1",
   "description": "Governed, durable-backed AI agent (chat + tool-calling + governance) for AdonisJS — part of the Agora ecosystem.",
   "license": "MIT",
   "repository": {
@@ -144,7 +144,7 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.30.1",
     "@standard-schema/spec": "1.1.0"
   },
   "peerDependencies": {
@@ -204,26 +204,26 @@
     }
   },
   "devDependencies": {
-    "@adonis-agora/authz": "0.13.3",
-    "@adonis-agora/diagnostics": "0.2.9",
-    "@adonis-agora/durable": "0.39.1",
-    "@adonis-agora/telescope": "0.21.0",
-    "@adonisjs/assembler": "8.5.1",
-    "@adonisjs/core": "7.5.0",
+    "@adonis-agora/authz": "0.16.1",
+    "@adonis-agora/diagnostics": "0.2.10",
+    "@adonis-agora/durable": "0.41.1",
+    "@adonis-agora/telescope": "0.21.1",
+    "@adonisjs/assembler": "8.5.2",
+    "@adonisjs/core": "7.5.2",
     "@adonisjs/lucid": "22.4.2",
     "@adonisjs/redis": "11.0.0",
     "@qdrant/js-client-rest": "1.19.0",
     "@tanstack/intent": "0.4.0",
-    "@types/node": "26.5.1",
+    "@types/node": "26.6.2",
     "@types/react": "19.3.0",
-    "ai": "7.0.97",
+    "ai": "7.0.102",
     "better-sqlite3": "13.0.3",
     "luxon": "3.7.2",
     "node-sql-parser": "5.4.0",
     "react": "19.3.0",
     "typescript": "7.0.2",
-    "vitest": "5.0.0",
-    "zod": "4.6.2"
+    "vitest": "5.0.1",
+    "zod": "4.6.5"
   },
   "engines": {
     "node": ">=20.6.0"