@agimon-ai/po-core 0.0.0-alpha.0

package/dist/src/services/sessionMcpAuthorization/index.d.mts

@@ -0,0 +1,125 @@
+//#region src/services/sessionMcpAuthorization/index.d.ts
+export type SessionMcpOAuthErrorCode = 'invalid_client' | 'invalid_grant' | 'invalid_request' | 'unsupported_grant_type';
+export declare class SessionMcpOAuthError extends Error {
+  readonly code: SessionMcpOAuthErrorCode;
+  constructor(code: SessionMcpOAuthErrorCode, message: string);
+}
+export type SessionMcpScope = 'restricted' | 'session';
+export type SessionMcpRouting = 'conversation';
+export interface SessionMcpClient {
+  readonly clientId: string;
+  readonly name: string;
+  readonly redirectUri: string;
+  readonly tokenEndpointAuthMethod: 'client_secret_post' | 'api_key' | 'url_token';
+  readonly createdAt: number;
+}
+export interface CreatedSessionMcpClient extends SessionMcpClient {
+  /** Returned once. Only a SHA-256 digest is retained by the service. */
+  readonly clientSecret: string;
+}
+export interface SessionMcpAuthorizationBinding {
+  readonly clientId: string;
+  readonly sessionId: string;
+  readonly sessionGeneration: number;
+  readonly audience: string;
+  readonly scope: SessionMcpScope;
+  /** Always conversation. Legacy persisted values are normalized at read time. */
+  readonly routing?: SessionMcpRouting;
+  readonly tools: readonly string[];
+  readonly skills: readonly string[];
+  /** Fixed at creation. Absent on legacy registrations, which keep bare tool names. */
+  readonly toolPrefix?: string;
+}
+export type CreateSessionMcpAuthorizationBindingInput = Omit<SessionMcpAuthorizationBinding, 'scope' | 'tools' | 'skills'> & ({
+  readonly scope: 'session';
+  readonly tools?: never;
+  readonly skills?: never;
+} | {
+  readonly scope?: 'restricted';
+  readonly tools: readonly string[];
+  readonly skills: readonly string[];
+});
+export interface SessionMcpGrant extends SessionMcpAuthorizationBinding {
+  readonly id: string;
+  readonly createdAt: number;
+}
+export interface SessionMcpAccessGrant extends SessionMcpGrant {
+  readonly expiresAt: number;
+}
+export interface SessionMcpTokenResponse {
+  readonly accessToken: string;
+  readonly refreshToken: string;
+  readonly tokenType: 'Bearer';
+  readonly expiresIn: number;
+  readonly grant: SessionMcpGrant;
+}
+export interface SessionMcpAuthorizationServiceOptions {
+  readonly now?: () => number;
+  readonly authorizationCodeTtlMs?: number;
+  readonly accessTokenTtlMs?: number;
+  readonly refreshTokenTtlMs?: number;
+  /** Maximum combined authorization codes, grants, tokens, and refresh-token tombstones. */
+  readonly maxRecords?: number;
+}
+export type CreateSessionMcpClientInput = {
+  readonly name: string;
+  readonly redirectUri: string;
+  readonly authMethod?: 'oauth';
+} | {
+  readonly name: string;
+  readonly authMethod: 'api_key' | 'url_token';
+  readonly redirectUri?: never;
+};
+export interface IssueSessionMcpAuthorizationCodeInput {
+  readonly clientId: string;
+  readonly redirectUri: string;
+  readonly codeChallenge: string;
+  readonly codeChallengeMethod: 'S256';
+}
+export type SessionMcpTokenRequest = {
+  readonly grantType: 'authorization_code';
+  readonly clientId: string;
+  readonly clientSecret: string;
+  readonly code: string;
+  readonly redirectUri: string;
+  readonly codeVerifier: string;
+} | {
+  readonly grantType: 'refresh_token';
+  readonly clientId: string;
+  readonly clientSecret: string;
+  readonly refreshToken: string;
+};
+export interface SessionMcpAuthorizationCode {
+  readonly code: string;
+  readonly grant: SessionMcpGrant;
+  readonly expiresAt: number;
+}
+export interface SessionMcpPersistentRegistration {
+  readonly client: SessionMcpClient;
+  readonly secretHash: string;
+  readonly workspaceId: string;
+  readonly binding: Omit<SessionMcpAuthorizationBinding, 'sessionGeneration'>;
+  readonly verifiedAt: number;
+}
+export interface SessionMcpAuthorizationService {
+  createClient(input: CreateSessionMcpClientInput): CreatedSessionMcpClient;
+  readClient(clientId: string): SessionMcpClient | undefined;
+  listClients(): readonly SessionMcpClient[];
+  revokeClient(clientId: string): boolean;
+  createAuthorizationBinding(input: CreateSessionMcpAuthorizationBindingInput): SessionMcpAuthorizationBinding;
+  readAuthorizationBinding(clientId: string): SessionMcpAuthorizationBinding | undefined;
+  persistentRegistration(clientId: string, workspaceId: string, verifiedAt: number): SessionMcpPersistentRegistration | undefined;
+  restorePersistentRegistration(registration: SessionMcpPersistentRegistration, sessionGeneration: number): boolean;
+  issueAuthorizationCode(input: IssueSessionMcpAuthorizationCodeInput): SessionMcpAuthorizationCode;
+  exchangeToken(request: SessionMcpTokenRequest): SessionMcpTokenResponse;
+  issueUrlToken(clientId: string): string;
+  authenticateUrlToken(token: string, audience: string): SessionMcpAccessGrant | undefined;
+  authenticateAccessToken(token: string, audience: string): SessionMcpAccessGrant | undefined;
+  revokeGrant(grantId: string): boolean;
+  revokeSessionGeneration(sessionId: string, sessionGeneration: number): number;
+  revokeSession(sessionId: string): number;
+}
+/** In-memory restricted OAuth authority. It intentionally has no discovery or client registration surface. */
+export declare function createSessionMcpAuthorizationService(options?: SessionMcpAuthorizationServiceOptions): SessionMcpAuthorizationService;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/sessionMcpAuthorization/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/sessionMcpAuthorization/index.ts"],"mappings":";YAcY;qBAMC,6BAA6B;WAC/B,MAAM;EAEf,YAAY,MAAM,0BAA0B;;YAOlC;YACA;iBAiEK;WACN;WACA;WACA;WACA;WACA;;iBAGM,gCAAgC;;WAEtC;;iBAGM;WACN;WACA;WACA;WACA;WACA,OAAO;;WAEP,UAAU;WACV;WACA;;WAEA;;YAGC,4CAA4C,KACtD;WAIe;WAA2B;WAAwB;;WACnD;WAA+B;WAAmC;;iBAGlE,wBAAwB;WAC9B;WACA;;iBAGM,8BAA8B;WACpC;;iBAGM;WACN;WACA;WACA;WACA;WACA,OAAO;;iBAGD;WACN;WACA;WACA;WACA;;WAEA;;YAGC;WACG;WAAuB;WAA8B;;WACrD;WAAuB;WAA8C;;iBAEnE;WACN;WACA;WACA;WACA;;YAGC;WAEG;WACA;WACA;WACA;WACA;WACA;;WAGA;WACA;WACA;WACA;;iBAGE;WACN;WACA,OAAO;WACP;;iBAGM;WACN,QAAQ;WACR;WACA;WACA,SAAS,KAAK;WACd;;iBAGM;EACf,aAAa,OAAO,8BAA8B;EAClD,WAAW,mBAAmB;EAC9B,wBAAwB;EACxB,aAAa;EACb,2BAA2B,OAAO,4CAA4C;EAC9E,yBAAyB,mBAAmB;EAC5C,uBACE,kBACA,qBACA,qBACC;EACH,8BAA8B,cAAc,kCAAkC;EAC9E,uBAAuB,OAAO,wCAAwC;EACtE,cAAc,SAAS,yBAAyB;EAChD,cAAc;EACd,qBAAqB,eAAe,mBAAmB;EACvD,wBAAwB,eAAe,mBAAmB;EAC1D,YAAY;EACZ,wBAAwB,mBAAmB;EAC3C,cAAc;;;wBA4IA,qCACd,UAAS,wCACR"}

package/dist/src/services/sessionMcpAuthorization/index.mjs

@@ -0,0 +1,469 @@
+import { createHash, createHmac, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
+//#region src/services/sessionMcpAuthorization/index.ts
+const ACCESS_TOKEN_TTL_MS = 9e5;
+const AUTHORIZATION_CODE_TTL_MS = 3e5;
+const CLIENT_ID_BYTES = 18;
+const CLIENT_SECRET_BYTES = 32;
+const DEFAULT_MAX_RECORDS = 1e4;
+const GRANT_ID_BYTES = 18;
+const REFRESH_TOKEN_TTL_MS = 2592e6;
+const TOKEN_BYTES = 32;
+const URL_TOKEN_HEADER = Buffer.from("{\"alg\":\"HS256\",\"typ\":\"JWT\"}").toString("base64url");
+const URL_TOKEN_ISSUER = "po-session-mcp";
+const URL_TOKEN_MAX_LENGTH = 4096;
+var SessionMcpOAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SessionMcpOAuthError";
+		this.code = code;
+	}
+};
+/**
+* Conversation routing is mandatory. Legacy registrations are migrated at read time
+* so they cannot continue to share their parent runtime.
+*/
+function sessionMcpRouting(value) {
+	if (value === void 0 || value === "session" || value === "conversation") return "conversation";
+	throw new SessionMcpOAuthError("invalid_request", "Session MCP routing is not supported.");
+}
+const SESSION_MCP_TOOL_PREFIX_MAX_LENGTH = 24;
+const SESSION_MCP_TOOL_PREFIX = /^[a-z0-9]+(?:_[a-z0-9]+)*$/u;
+const FALLBACK_TOOL_PREFIXES = Object.freeze([
+	"alba",
+	"bruno",
+	"cora",
+	"dex",
+	"elio",
+	"fern",
+	"gus",
+	"hana",
+	"ivo",
+	"juno",
+	"kai",
+	"lena",
+	"milo",
+	"nora",
+	"otto",
+	"pia"
+]);
+/**
+* Remote tool names are `${prefix}_${name}`. The prefix keeps them distinct from
+* the remote agent's native tools and stays inside OpenAI and MCP name rules.
+*/
+function sessionMcpToolPrefix(value) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || value.length > SESSION_MCP_TOOL_PREFIX_MAX_LENGTH || !SESSION_MCP_TOOL_PREFIX.test(value)) throw new SessionMcpOAuthError("invalid_request", `Tool prefix must be 1 to ${SESSION_MCP_TOOL_PREFIX_MAX_LENGTH} lowercase letters or digits, joined by single underscores.`);
+	return value;
+}
+/** Normalized session name, or a random readable word when the name is empty or the CLI default. */
+function defaultSessionMcpToolPrefix(sessionName) {
+	const prefix = sessionName.normalize("NFKD").replace(/\p{M}/gu, "").toLowerCase().replace(/[^a-z0-9]+/gu, "_").replace(/^_+|_+$/gu, "").slice(0, SESSION_MCP_TOOL_PREFIX_MAX_LENGTH).replace(/_+$/u, "");
+	if (prefix !== "" && prefix !== "untitled") return prefix;
+	return FALLBACK_TOOL_PREFIXES[randomInt(FALLBACK_TOOL_PREFIXES.length)];
+}
+function digest(value) {
+	return createHash("sha256").update(value).digest();
+}
+function tokenKey(value) {
+	return digest(value).toString("hex");
+}
+function opaque(bytes = TOKEN_BYTES) {
+	return randomBytes(bytes).toString("base64url");
+}
+function exactSecret(actual, expectedHash) {
+	return timingSafeEqual(digest(actual), expectedHash);
+}
+function urlTokenSignature(input, key) {
+	return createHmac("sha256", key).update(input).digest();
+}
+function parseUrlToken(token) {
+	if (token.length > URL_TOKEN_MAX_LENGTH) return void 0;
+	const parts = token.split(".");
+	if (parts.length !== 3) return void 0;
+	const [header, payload, encodedSignature] = parts;
+	if (header !== URL_TOKEN_HEADER || !/^[A-Za-z0-9_-]{1,2048}$/u.test(payload) || !/^[A-Za-z0-9_-]{43}$/u.test(encodedSignature)) return void 0;
+	try {
+		const payloadBytes = Buffer.from(payload, "base64url");
+		const signature = Buffer.from(encodedSignature, "base64url");
+		if (payloadBytes.toString("base64url") !== payload || signature.length !== 32 || signature.toString("base64url") !== encodedSignature) return void 0;
+		const value = JSON.parse(payloadBytes.toString("utf8"));
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+		const claims = value;
+		if (Object.keys(value).sort().join(",") !== "aud,iat,iss,sid,sub" || claims.iss !== URL_TOKEN_ISSUER || typeof claims.sub !== "string" || claims.sub === "" || typeof claims.sid !== "string" || claims.sid === "" || typeof claims.aud !== "string" || claims.aud === "" || typeof claims.iat !== "number" || !Number.isSafeInteger(claims.iat)) return void 0;
+		return {
+			claims,
+			input: `${header}.${payload}`,
+			signature
+		};
+	} catch {
+		return;
+	}
+}
+function requireHttpsUrl(value, label, allowQuery) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new SessionMcpOAuthError("invalid_request", `${label} must be an absolute HTTPS URL.`);
+	}
+	if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "" || parsed.hash !== "" || !allowQuery && parsed.search !== "") throw new SessionMcpOAuthError("invalid_request", `${label} must be an absolute HTTPS URL without credentials, a query, or a fragment.`);
+	return parsed.href;
+}
+function requireName(value, label) {
+	const normalized = value.trim();
+	if (normalized === "") throw new SessionMcpOAuthError("invalid_request", `${label} must not be empty.`);
+	return normalized;
+}
+function exactUniqueGrants(values, label) {
+	if (values.some((value) => value === "" || value !== value.trim())) throw new SessionMcpOAuthError("invalid_request", `${label} grants must contain exact non-empty names.`);
+	return Object.freeze([...new Set(values)]);
+}
+/** In-memory restricted OAuth authority. It intentionally has no discovery or client registration surface. */
+function createSessionMcpAuthorizationService(options = {}) {
+	const now = options.now ?? Date.now;
+	const codeTtl = options.authorizationCodeTtlMs ?? AUTHORIZATION_CODE_TTL_MS;
+	const accessTtl = options.accessTokenTtlMs ?? ACCESS_TOKEN_TTL_MS;
+	const refreshTtl = options.refreshTokenTtlMs ?? REFRESH_TOKEN_TTL_MS;
+	const maxRecords = options.maxRecords ?? DEFAULT_MAX_RECORDS;
+	if (!Number.isSafeInteger(maxRecords) || maxRecords < 3) throw new Error("Session MCP authorization maxRecords must be a safe integer of at least 3.");
+	const clients = /* @__PURE__ */ new Map();
+	const bindings = /* @__PURE__ */ new Map();
+	const grants = /* @__PURE__ */ new Map();
+	const codes = /* @__PURE__ */ new Map();
+	const accessTokens = /* @__PURE__ */ new Map();
+	const refreshTokens = /* @__PURE__ */ new Map();
+	const consumedRefreshTokens = /* @__PURE__ */ new Map();
+	const publicClient = ({ secretHash: _secretHash, ...client }) => client;
+	const recordCount = () => grants.size + codes.size + accessTokens.size + refreshTokens.size + consumedRefreshTokens.size;
+	const sweep = () => {
+		const currentTime = now();
+		for (const [key, value] of codes) if (value.expiresAt <= currentTime) codes.delete(key);
+		for (const [key, value] of accessTokens) if (value.expiresAt <= currentTime) accessTokens.delete(key);
+		for (const [key, value] of refreshTokens) if (value.expiresAt <= currentTime) refreshTokens.delete(key);
+		for (const [key, value] of consumedRefreshTokens) if (value.expiresAt <= currentTime) consumedRefreshTokens.delete(key);
+		const referencedGrants = /* @__PURE__ */ new Set();
+		for (const value of codes.values()) referencedGrants.add(value.grant.id);
+		for (const value of accessTokens.values()) referencedGrants.add(value.grant.id);
+		for (const value of refreshTokens.values()) referencedGrants.add(value.grant.id);
+		for (const value of consumedRefreshTokens.values()) referencedGrants.add(value.grantId);
+		for (const grantId of grants.keys()) if (!referencedGrants.has(grantId)) grants.delete(grantId);
+	};
+	const requireCapacity = (additionalRecords) => {
+		sweep();
+		if (recordCount() + additionalRecords > maxRecords) throw new SessionMcpOAuthError("invalid_request", "The authorization service is at capacity.");
+	};
+	const authenticateClient = (clientId, clientSecret) => {
+		const client = clients.get(clientId);
+		if (client === void 0 || !exactSecret(clientSecret, client.secretHash)) throw new SessionMcpOAuthError("invalid_client", "Client authentication failed.");
+		return client;
+	};
+	const revokeGrant = (grantId) => {
+		if (!grants.delete(grantId)) return false;
+		for (const [key, value] of codes) if (value.grant.id === grantId) codes.delete(key);
+		for (const [key, value] of accessTokens) if (value.grant.id === grantId) accessTokens.delete(key);
+		for (const [key, value] of refreshTokens) if (value.grant.id === grantId) refreshTokens.delete(key);
+		return true;
+	};
+	const revokeFamily = (familyId, grantId) => {
+		revokeGrant(grantId);
+		for (const [key, value] of accessTokens) if (value.familyId === familyId) accessTokens.delete(key);
+		for (const [key, value] of refreshTokens) if (value.familyId === familyId) refreshTokens.delete(key);
+	};
+	const mintTokens = (grant, familyId = opaque(GRANT_ID_BYTES), familyExpiresAt = now() + refreshTtl) => {
+		const issuedAt = now();
+		const accessExpiresAt = Math.min(issuedAt + accessTtl, familyExpiresAt);
+		const accessToken = opaque();
+		const refreshToken = opaque();
+		accessTokens.set(tokenKey(accessToken), {
+			grant,
+			familyId,
+			expiresAt: accessExpiresAt
+		});
+		refreshTokens.set(tokenKey(refreshToken), {
+			grant,
+			familyId,
+			expiresAt: familyExpiresAt,
+			familyExpiresAt
+		});
+		return {
+			accessToken,
+			refreshToken,
+			tokenType: "Bearer",
+			expiresIn: Math.max(0, Math.floor((accessExpiresAt - issuedAt) / 1e3)),
+			grant
+		};
+	};
+	return {
+		createClient(input) {
+			const createdAt = now();
+			const clientId = opaque(CLIENT_ID_BYTES);
+			const clientSecret = opaque(CLIENT_SECRET_BYTES);
+			const urlCredential = input.authMethod === "url_token";
+			const headerCredential = input.authMethod === "api_key";
+			let redirectUri = "";
+			if (!urlCredential && !headerCredential) {
+				if (typeof input.redirectUri !== "string") throw new SessionMcpOAuthError("invalid_request", "Redirect URI must be an absolute HTTPS URL.");
+				redirectUri = requireHttpsUrl(input.redirectUri, "Redirect URI", true);
+			}
+			const client = {
+				clientId,
+				name: requireName(input.name, "Client name"),
+				redirectUri,
+				tokenEndpointAuthMethod: urlCredential ? "url_token" : headerCredential ? "api_key" : "client_secret_post",
+				createdAt,
+				secretHash: digest(clientSecret)
+			};
+			clients.set(clientId, client);
+			return {
+				...publicClient(client),
+				clientSecret
+			};
+		},
+		readClient(clientId) {
+			const client = clients.get(clientId);
+			return client === void 0 ? void 0 : publicClient(client);
+		},
+		listClients() {
+			return [...clients.values()].map(publicClient);
+		},
+		revokeClient(clientId) {
+			if (!clients.delete(clientId)) return false;
+			bindings.delete(clientId);
+			for (const grant of grants.values()) if (grant.clientId === clientId) revokeGrant(grant.id);
+			return true;
+		},
+		createAuthorizationBinding(input) {
+			if (!clients.has(input.clientId)) throw new SessionMcpOAuthError("invalid_client", "Unknown local client.");
+			if (bindings.has(input.clientId)) throw new SessionMcpOAuthError("invalid_request", "Client authorization is already bound.");
+			if (!Number.isSafeInteger(input.sessionGeneration) || input.sessionGeneration < 0) throw new SessionMcpOAuthError("invalid_request", "Session generation must be a non-negative safe integer.");
+			const routing = sessionMcpRouting(input.routing);
+			const scope = input.scope ?? "restricted";
+			if (scope !== "session" && scope !== "restricted") throw new SessionMcpOAuthError("invalid_request", "Authorization scope is not supported.");
+			let tools;
+			let skills;
+			if (scope === "session") {
+				if (input.tools !== void 0 || input.skills !== void 0) throw new SessionMcpOAuthError("invalid_request", "Session scope cannot include capability grants.");
+				tools = Object.freeze([]);
+				skills = Object.freeze([]);
+			} else {
+				if (!Array.isArray(input.tools) || !Array.isArray(input.skills)) throw new SessionMcpOAuthError("invalid_request", "Restricted scope requires tool and skill grants.");
+				tools = exactUniqueGrants(input.tools, "Tool");
+				skills = exactUniqueGrants(input.skills, "Skill");
+			}
+			const toolPrefix = sessionMcpToolPrefix(input.toolPrefix);
+			const binding = Object.freeze({
+				clientId: input.clientId,
+				sessionId: requireName(input.sessionId, "Session ID"),
+				sessionGeneration: input.sessionGeneration,
+				audience: requireHttpsUrl(input.audience, "Audience", false),
+				scope,
+				routing,
+				tools,
+				skills,
+				...toolPrefix === void 0 ? {} : { toolPrefix }
+			});
+			bindings.set(input.clientId, binding);
+			return binding;
+		},
+		readAuthorizationBinding(clientId) {
+			return bindings.get(clientId);
+		},
+		persistentRegistration(clientId, workspaceId, verifiedAt) {
+			const client = clients.get(clientId);
+			const binding = bindings.get(clientId);
+			if (client === void 0 || binding === void 0 || !Number.isSafeInteger(verifiedAt)) return void 0;
+			const { sessionGeneration: _sessionGeneration, ...persistentBinding } = binding;
+			return {
+				client: publicClient(client),
+				secretHash: client.secretHash.toString("hex"),
+				workspaceId: requireName(workspaceId, "Workspace ID"),
+				binding: persistentBinding,
+				verifiedAt
+			};
+		},
+		restorePersistentRegistration(registration, sessionGeneration) {
+			if (bindings.has(registration.client.clientId) || !/^[a-f0-9]{64}$/u.test(registration.secretHash) || !Number.isSafeInteger(sessionGeneration) || sessionGeneration < 0 || registration.client.clientId !== registration.binding.clientId) return false;
+			try {
+				const held = clients.get(registration.client.clientId);
+				if (held && (held.redirectUri !== registration.client.redirectUri || held.tokenEndpointAuthMethod !== registration.client.tokenEndpointAuthMethod || !timingSafeEqual(held.secretHash, Buffer.from(registration.secretHash, "hex")))) return false;
+				if (registration.client.tokenEndpointAuthMethod !== "client_secret_post" && registration.client.tokenEndpointAuthMethod !== "api_key" && registration.client.tokenEndpointAuthMethod !== "url_token" || registration.client.tokenEndpointAuthMethod !== "client_secret_post" && (registration.client.redirectUri !== "" || registration.binding.scope !== "session")) return false;
+				const client = {
+					clientId: requireName(registration.client.clientId, "Client ID"),
+					name: requireName(registration.client.name, "Client name"),
+					redirectUri: registration.client.tokenEndpointAuthMethod === "client_secret_post" ? requireHttpsUrl(registration.client.redirectUri, "Redirect URI", true) : registration.client.redirectUri,
+					tokenEndpointAuthMethod: registration.client.tokenEndpointAuthMethod,
+					createdAt: registration.client.createdAt,
+					secretHash: Buffer.from(registration.secretHash, "hex")
+				};
+				const routing = sessionMcpRouting(registration.binding.routing);
+				const toolPrefix = sessionMcpToolPrefix(registration.binding.toolPrefix);
+				const scope = registration.binding.scope;
+				const tools = scope === "session" ? Object.freeze([]) : exactUniqueGrants(registration.binding.tools, "Tool");
+				const skills = scope === "session" ? Object.freeze([]) : exactUniqueGrants(registration.binding.skills, "Skill");
+				if (scope !== "session" && scope !== "restricted" || scope === "session" && (registration.binding.tools.length !== 0 || registration.binding.skills.length !== 0)) throw new SessionMcpOAuthError("invalid_request", "Stored Session MCP authorization is invalid.");
+				clients.set(client.clientId, client);
+				bindings.set(client.clientId, Object.freeze({
+					clientId: client.clientId,
+					sessionId: requireName(registration.binding.sessionId, "Session ID"),
+					sessionGeneration,
+					audience: requireHttpsUrl(registration.binding.audience, "Audience", false),
+					scope,
+					routing,
+					tools,
+					skills,
+					...toolPrefix === void 0 ? {} : { toolPrefix }
+				}));
+				return true;
+			} catch {
+				clients.delete(registration.client.clientId);
+				return false;
+			}
+		},
+		issueAuthorizationCode(input) {
+			const client = clients.get(input.clientId);
+			if (client === void 0) throw new SessionMcpOAuthError("invalid_client", "Unknown local client.");
+			const binding = bindings.get(input.clientId);
+			if (binding === void 0) throw new SessionMcpOAuthError("invalid_request", "Client authorization has not been preauthorized.");
+			if (client.tokenEndpointAuthMethod !== "client_secret_post") throw new SessionMcpOAuthError("invalid_client", "This client does not support OAuth authorization.");
+			if (input.redirectUri !== client.redirectUri) throw new SessionMcpOAuthError("invalid_request", "Redirect URI does not exactly match the registered callback.");
+			if (input.codeChallengeMethod !== "S256" || !/^[A-Za-z0-9_-]{43}$/u.test(input.codeChallenge)) throw new SessionMcpOAuthError("invalid_request", "A valid S256 PKCE challenge is required.");
+			requireCapacity(2);
+			const issuedAt = now();
+			const grant = Object.freeze({
+				id: opaque(GRANT_ID_BYTES),
+				...binding,
+				createdAt: issuedAt
+			});
+			const code = opaque();
+			const expiresAt = issuedAt + codeTtl;
+			grants.set(grant.id, grant);
+			codes.set(tokenKey(code), {
+				clientId: client.clientId,
+				redirectUri: client.redirectUri,
+				challenge: input.codeChallenge,
+				grant,
+				expiresAt
+			});
+			return {
+				code,
+				grant,
+				expiresAt
+			};
+		},
+		exchangeToken(request) {
+			if (authenticateClient(request.clientId, request.clientSecret).tokenEndpointAuthMethod !== "client_secret_post") throw new SessionMcpOAuthError("invalid_client", "This client does not support OAuth tokens.");
+			sweep();
+			if (request.grantType === "authorization_code") {
+				const codeKey = tokenKey(request.code);
+				const stored = codes.get(codeKey);
+				if (stored === void 0 || stored.expiresAt <= now() || stored.clientId !== request.clientId || stored.redirectUri !== request.redirectUri || !/^[A-Za-z0-9\-._~]{43,128}$/u.test(request.codeVerifier) || createHash("sha256").update(request.codeVerifier).digest("base64url") !== stored.challenge || !grants.has(stored.grant.id)) {
+					codes.delete(codeKey);
+					if (stored !== void 0) revokeGrant(stored.grant.id);
+					throw new SessionMcpOAuthError("invalid_grant", "Authorization code is invalid or expired.");
+				}
+				requireCapacity(1);
+				codes.delete(codeKey);
+				return mintTokens(stored.grant);
+			}
+			if (request.grantType === "refresh_token") {
+				const refreshKey = tokenKey(request.refreshToken);
+				const replayed = consumedRefreshTokens.get(refreshKey);
+				if (replayed !== void 0) {
+					if (replayed.clientId === request.clientId && replayed.expiresAt > now()) revokeFamily(replayed.familyId, replayed.grantId);
+					throw new SessionMcpOAuthError("invalid_grant", "Refresh token is invalid or expired.");
+				}
+				const stored = refreshTokens.get(refreshKey);
+				if (stored === void 0 || stored.expiresAt <= now() || stored.grant.clientId !== request.clientId || !grants.has(stored.grant.id)) {
+					refreshTokens.delete(refreshKey);
+					throw new SessionMcpOAuthError("invalid_grant", "Refresh token is invalid or expired.");
+				}
+				requireCapacity(2);
+				refreshTokens.delete(refreshKey);
+				consumedRefreshTokens.set(refreshKey, {
+					clientId: stored.grant.clientId,
+					grantId: stored.grant.id,
+					familyId: stored.familyId,
+					expiresAt: stored.familyExpiresAt
+				});
+				return mintTokens(stored.grant, stored.familyId, stored.familyExpiresAt);
+			}
+			throw new SessionMcpOAuthError("unsupported_grant_type", "Only authorization_code and refresh_token are supported.");
+		},
+		issueUrlToken(clientId) {
+			const client = clients.get(clientId);
+			if (client === void 0 || client.tokenEndpointAuthMethod !== "url_token") throw new SessionMcpOAuthError("invalid_client", "This client does not support signed MCP URLs.");
+			const binding = bindings.get(clientId);
+			if (binding === void 0) throw new SessionMcpOAuthError("invalid_request", "Client authorization has not been preauthorized.");
+			const payload = Buffer.from(JSON.stringify({
+				aud: binding.audience,
+				iat: Math.floor(client.createdAt / 1e3),
+				iss: URL_TOKEN_ISSUER,
+				sid: binding.sessionId,
+				sub: client.clientId
+			})).toString("base64url");
+			const input = `${URL_TOKEN_HEADER}.${payload}`;
+			return `${input}.${urlTokenSignature(input, client.secretHash).toString("base64url")}`;
+		},
+		authenticateUrlToken(token, audience) {
+			const parsed = parseUrlToken(token);
+			if (parsed === void 0) return void 0;
+			const client = clients.get(parsed.claims.sub);
+			if (client === void 0 || client.tokenEndpointAuthMethod !== "url_token") return void 0;
+			const binding = bindings.get(client.clientId);
+			if (binding === void 0 || binding.audience !== audience || parsed.claims.aud !== audience || parsed.claims.sid !== binding.sessionId || parsed.claims.iat !== Math.floor(client.createdAt / 1e3)) return void 0;
+			const expected = urlTokenSignature(parsed.input, client.secretHash);
+			if (!timingSafeEqual(expected, parsed.signature)) return void 0;
+			return {
+				id: client.clientId,
+				...binding,
+				createdAt: client.createdAt,
+				expiresAt: Number.MAX_SAFE_INTEGER
+			};
+		},
+		authenticateAccessToken(token, audience) {
+			sweep();
+			const key = tokenKey(token);
+			const presentedHash = digest(token);
+			for (const client of clients.values()) {
+				if (client.tokenEndpointAuthMethod !== "api_key" || !timingSafeEqual(presentedHash, client.secretHash)) continue;
+				const binding = bindings.get(client.clientId);
+				if (binding === void 0 || binding.audience !== audience) return void 0;
+				return {
+					id: client.clientId,
+					...binding,
+					createdAt: client.createdAt,
+					expiresAt: Number.MAX_SAFE_INTEGER
+				};
+			}
+			const stored = accessTokens.get(key);
+			if (stored === void 0) return void 0;
+			if (stored.expiresAt <= now() || !grants.has(stored.grant.id)) {
+				accessTokens.delete(key);
+				return;
+			}
+			if (stored.grant.audience !== audience) return void 0;
+			return {
+				...stored.grant,
+				expiresAt: stored.expiresAt
+			};
+		},
+		revokeGrant,
+		revokeSessionGeneration(sessionId, sessionGeneration) {
+			let revoked = 0;
+			for (const grant of grants.values()) if (grant.sessionId === sessionId && grant.sessionGeneration === sessionGeneration && revokeGrant(grant.id)) revoked += 1;
+			for (const [clientId, binding] of bindings) if (binding.sessionId === sessionId && binding.sessionGeneration === sessionGeneration) bindings.delete(clientId);
+			return revoked;
+		},
+		revokeSession(sessionId) {
+			let revoked = 0;
+			for (const grant of grants.values()) if (grant.sessionId === sessionId && revokeGrant(grant.id)) revoked += 1;
+			for (const [clientId, binding] of bindings) if (binding.sessionId === sessionId) bindings.delete(clientId);
+			return revoked;
+		}
+	};
+}
+//#endregion
+export { SessionMcpOAuthError, createSessionMcpAuthorizationService, defaultSessionMcpToolPrefix, sessionMcpRouting, sessionMcpToolPrefix };
+
+//# sourceMappingURL=index.mjs.map