@benlampson/heimdall-server 0.0.0-stage → 5.5.3

package/README.md

@@ -1,3 +1,20 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @benlampson/heimdall-server
+
+Node 22+ 的 Heimdall 协议与只读目录客户端，版本跟随 Heimdall 整体 Release。支持 public/confidential 授权码、Device Code、服务 Token、刷新、JWT 校验、opaque Token、UserInfo、撤销/内省、退出地址和 MCP 认证头。没有 HTTP 路由、Cookie、UI 或数据库。
+
+机密凭据由调用方的 credentialProvider 提供，不能将此入口打包到浏览器。完整示例与接口见仓库 sdk/README.md 和 sdk/API.md。
+
+```ts
+import { HeimdallServerClient, HeimdallDirectoryClient } from '@benlampson/heimdall-server';
+const server = new HeimdallServerClient({
+  authority: 'https://idp.example.com/tenant-a', clientId: 'directory-service',
+  audience: 'heimdall-directory-api', scope: 'heimdall.directory.read',
+  tenantId: 'tenant-a', applicationId: 'business-app', authenticationMethod: 'client_secret_basic',
+  credentialProvider: async () => ({ clientId: 'directory-service', secret: readSecret(), version: readSecretVersion() }),
+});
+const tokens = await server.getClientCredentialsToken();
+const directory = new HeimdallDirectoryClient(server, 'https://api.example.com', 'tenant-a');
+// const permissions = await directory.getUserPermissions(userId);
+```
+
+服务 Token 可选纯内存缓存，cacheClientCredentials:false 关闭；用户 Token 与登录事务由调用方保存。AK/SK 只提供 Heimdall /mcp 的专用认证头，不转换为 JWT。

package/dist/client.d.ts

@@ -0,0 +1,31 @@
+import { HeimdallProtocolClient, type HeimdallProtocolOptions, type HeimdallTokenSet } from '@benlampson/heimdall-browser/protocol';
+/** 机密凭据只存在服务端入口；回调支持应用自己的密钥轮换。 */
+export interface HeimdallServerOptions extends HeimdallProtocolOptions {
+    authenticationMethod?: 'none' | 'client_secret_basic' | 'client_secret_post';
+    credentialProvider?: () => Promise<{
+        clientId: string;
+        secret: string;
+        version: string;
+    }>;
+    cacheClientCredentials?: boolean;
+    resourceBaseUrls?: readonly string[];
+}
+/** Node/服务端纯协议客户端，无默认数据库、Cookie 或 HTTP 路由。 */
+export declare class HeimdallServerClient extends HeimdallProtocolClient {
+    private readonly serverOptions;
+    private cached?;
+    private tokenRequest?;
+    constructor(serverOptions: HeimdallServerOptions);
+    /** 服务 Token 可选内存缓存；检查当前凭据版本，合并并发换取。 */
+    getClientCredentialsToken(signal?: AbortSignal): Promise<HeimdallTokenSet>;
+    /** 为允许的资源地址附加调用方的用户 Token 或本客户端服务 Token。 */
+    fetch(input: string | URL, init?: RequestInit, accessToken?: string): Promise<Response>;
+    /** 只有同机密客户端可内省 Access Token，不能代 public SPA 查询。 */
+    introspectToken(token: string, signal?: AbortSignal): Promise<Record<string, unknown>>;
+    /** 撤销成功后删除本实例命名服务 Token 缓存。 */
+    revokeToken(token: string, hint: 'access_token' | 'refresh_token', signal?: AbortSignal): Promise<void>;
+    /** 独立 OAuth Basic 对 client_id/secret 先做表单编码，与 MCP Basic 不混用。 */
+    protected authenticate(fields: URLSearchParams, headers: Headers): Promise<void>;
+    private applyAuthentication;
+    private credentials;
+}

package/dist/client.js

@@ -0,0 +1,110 @@
+import { HeimdallProtocolClient, HeimdallProtocolError } from '@benlampson/heimdall-browser/protocol';
+/** Node/服务端纯协议客户端，无默认数据库、Cookie 或 HTTP 路由。 */
+export class HeimdallServerClient extends HeimdallProtocolClient {
+    serverOptions;
+    cached;
+    tokenRequest;
+    constructor(serverOptions) {
+        super(serverOptions);
+        this.serverOptions = serverOptions;
+        const method = serverOptions.authenticationMethod ?? 'none';
+        if (!['none', 'client_secret_basic', 'client_secret_post'].includes(method) || (method !== 'none' && !serverOptions.credentialProvider))
+            throw new HeimdallProtocolError('invalid_client_authentication');
+    }
+    /** 服务 Token 可选内存缓存；检查当前凭据版本，合并并发换取。 */
+    async getClientCredentialsToken(signal) {
+        if ((this.serverOptions.authenticationMethod ?? 'none') === 'none')
+            throw new HeimdallProtocolError('confidential_client_required');
+        const credential = await this.credentials();
+        if (this.serverOptions.cacheClientCredentials !== false && this.cached?.version === credential.version && this.cached.refreshAt > Date.now())
+            return { ...this.cached.tokens };
+        if (this.tokenRequest) {
+            const pending = this.tokenRequest;
+            const result = await pending.promise;
+            return pending.version === credential.version ? { ...result } : this.getClientCredentialsToken(signal);
+        }
+        const promise = (async () => {
+            const tokens = await this.requestToken({ grant_type: 'client_credentials', scope: this.options.scope ?? '' }, signal, (fields, headers) => this.applyAuthentication(credential, fields, headers));
+            const claims = await this.validateTokens(tokens, 'BackendService');
+            const scopes = typeof claims?.scope === 'string' ? parseScopes(claims.scope) : Array.isArray(claims?.scope) ? claims.scope : (tokens.scope ?? '').split(' ');
+            if (!(this.options.scope ?? '').split(' ').filter(Boolean).every(scope => scopes.includes(scope)))
+                throw new HeimdallProtocolError('token_scope_mismatch');
+            const expires = Math.min(tokens.obtained_at + tokens.expires_in * 1000, typeof claims?.exp === 'number' ? claims.exp * 1000 : Infinity);
+            const refreshAt = expires - Math.min(30000, (expires - Date.now()) / 2);
+            if (this.serverOptions.cacheClientCredentials !== false)
+                this.cached = { tokens, version: credential.version, refreshAt };
+            return { ...tokens };
+        })().finally(() => { this.tokenRequest = undefined; });
+        this.tokenRequest = { version: credential.version, promise };
+        return promise;
+    }
+    /** 为允许的资源地址附加调用方的用户 Token 或本客户端服务 Token。 */
+    async fetch(input, init = {}, accessToken) {
+        const url = this.trustedUrl(String(input));
+        if (!(this.serverOptions.resourceBaseUrls ?? []).some(base => {
+            const allowed = this.trustedUrl(base);
+            const path = allowed.pathname.replace(/\/$/, '');
+            return url.origin === allowed.origin && (url.pathname === path || url.pathname.startsWith(path + '/'));
+        }))
+            throw new HeimdallProtocolError('untrusted_resource');
+        const token = accessToken ?? (await this.getClientCredentialsToken(init.signal ?? undefined)).access_token;
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `Bearer ${token}`);
+        return globalThis.fetch(url, { ...init, headers, credentials: 'omit', redirect: 'error',
+            signal: init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(15000)]) : AbortSignal.timeout(15000) });
+    }
+    /** 只有同机密客户端可内省 Access Token，不能代 public SPA 查询。 */
+    async introspectToken(token, signal) {
+        if ((this.serverOptions.authenticationMethod ?? 'none') === 'none')
+            throw new HeimdallProtocolError('confidential_client_required');
+        const value = await this.post(await this.endpoint('introspection_endpoint'), { token }, signal);
+        if (typeof value.active !== 'boolean')
+            throw new HeimdallProtocolError('invalid_introspection_response');
+        return value;
+    }
+    /** 撤销成功后删除本实例命名服务 Token 缓存。 */
+    async revokeToken(token, hint, signal) {
+        await super.revokeToken(token, hint, signal);
+        this.cached = undefined;
+    }
+    /** 独立 OAuth Basic 对 client_id/secret 先做表单编码，与 MCP Basic 不混用。 */
+    async authenticate(fields, headers) {
+        const method = this.serverOptions.authenticationMethod ?? 'none';
+        if (method === 'none') {
+            await super.authenticate(fields, headers);
+            return;
+        }
+        const credential = await this.credentials();
+        await this.applyAuthentication(credential, fields, headers);
+    }
+    async applyAuthentication(credential, fields, headers) {
+        const method = this.serverOptions.authenticationMethod;
+        if (method === 'client_secret_basic') {
+            const encode = (value) => new URLSearchParams({ v: value }).toString().slice(2);
+            headers.set('Authorization', `Basic ${btoa(String.fromCharCode(...new TextEncoder().encode(encode(credential.clientId) + ':' + encode(credential.secret))))}`);
+        }
+        else {
+            fields.set('client_id', credential.clientId);
+            fields.set('client_secret', credential.secret);
+        }
+    }
+    async credentials() {
+        const value = await this.serverOptions.credentialProvider?.();
+        if (!value || value.clientId !== this.options.clientId || !value.secret || !value.version)
+            throw new HeimdallProtocolError('invalid_client_credentials');
+        return { clientId: value.clientId, secret: value.secret, version: value.version };
+    }
+}
+/** Asgard scope 可能使用 JSON 数组字符串，也支持 OAuth 空格范围。 */
+function parseScopes(value) {
+    if (!value.trimStart().startsWith('['))
+        return value.split(' ');
+    try {
+        const scopes = JSON.parse(value);
+        if (Array.isArray(scopes) && scopes.every(scope => typeof scope === 'string'))
+            return scopes;
+    }
+    catch { /* 统一公开错误。 */ }
+    throw new HeimdallProtocolError('invalid_scope_claim');
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAuD,MAAM,uCAAuC,CAAC;AAS3J,8CAA8C;AAC9C,MAAM,OAAO,oBAAqB,SAAQ,sBAAsB;IAGjC;IAFrB,MAAM,CAAoE;IAC1E,YAAY,CAA2D;IAC/E,YAA6B,aAAoC;QAC/D,KAAK,CAAC,aAAa,CAAC,CAAC;QADM,kBAAa,GAAb,aAAa,CAAuB;QAE/D,MAAM,MAAM,GAAG,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC;QAC5D,IAAI,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;IAC5M,CAAC;IACD,uCAAuC;IACvC,KAAK,CAAC,yBAAyB,CAAC,MAAoB;QAClD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QACpI,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,aAAa,CAAC,sBAAsB,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/K,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACxE,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,MAAM,EAClH,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7J,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC3J,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,EAAE,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACxI,MAAM,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,IAAI,IAAI,CAAC,aAAa,CAAC,sBAAsB,KAAK,KAAK;gBAAE,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;YAC1H,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,OAAO,CAAC;IAC/E,CAAC;IACD,4CAA4C;IAC5C,KAAK,CAAC,KAAK,CAAC,KAAmB,EAAE,OAAoB,EAAE,EAAE,WAAoB;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAG,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtJ,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QACpK,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QAC3G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;YACrF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,kDAAkD;IAClD,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAoB;QACvD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QACpI,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAChG,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IACzH,CAAC;IACD,+BAA+B;IACtB,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAsC,EAAE,MAAoB;QACpG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IACxE,CAAC;IACD,gEAAgE;IAC7C,KAAK,CAAC,YAAY,CAAC,MAAuB,EAAE,OAAgB;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC;QACjE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACO,KAAK,CAAC,mBAAmB,CAAC,UAAgD,EAAE,MAAuB,EAAE,OAAgB;QAC3H,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC;QACvD,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjK,CAAC;aAAM,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;IAC1G,CAAC;IACO,KAAK,CAAC,WAAW;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;QACzJ,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACpF,CAAC;CACF;AACD,mDAAmD;AACnD,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC;QAAC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;IACxK,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;AACzD,CAAC"}

package/dist/directory.d.ts

@@ -0,0 +1,58 @@
+import { HeimdallServerClient } from './client.js';
+/** 与 Heimdall 后端只读 VO 的字段保持一致；业务数据交由接入方保存。 */
+export interface DirectoryUser {
+    id: string;
+    tenant_id: string;
+    username?: string | null;
+    display_name?: string | null;
+    email?: string | null;
+    phone?: string | null;
+    avatar_url?: string | null;
+    status: number;
+    updated_at: string;
+}
+export interface DirectoryGroup {
+    id: string;
+    tenant_id: string;
+    code: string;
+    name: string;
+    status: number;
+    member_count: number;
+    updated_at: string;
+}
+export interface DirectoryMember {
+    tenant_user_id: string;
+    directory_group_id: string;
+    active: boolean;
+    updated_at: string;
+}
+export interface DirectoryUserPermissions {
+    tenantUserId: string;
+    status: 'Active' | 'Disabled';
+    permissions: string[];
+    updatedAt?: string;
+}
+export interface HeimdallPage<T> {
+    data: T[];
+    totalCount: number;
+    page: number;
+    size: number;
+}
+/** 目录使用独立服务 Client 与应用边界，权限结果不默认缓存。 */
+export declare class HeimdallDirectoryClient {
+    private readonly tokens;
+    private readonly tenantId;
+    private readonly base;
+    constructor(tokens: HeimdallServerClient, apiBaseUrl: string, tenantId: string, allowLocalhostHttp?: boolean);
+    getUser(userId: string, signal?: AbortSignal): Promise<DirectoryUser>;
+    getUserPermissions(userId: string, signal?: AbortSignal): Promise<DirectoryUserPermissions>;
+    getGroup(groupId: string, signal?: AbortSignal): Promise<DirectoryGroup>;
+    getMembership(groupId: string, userId: string, signal?: AbortSignal): Promise<DirectoryMember>;
+    getUsers(page?: number, size?: number, signal?: AbortSignal): Promise<HeimdallPage<DirectoryUser>>;
+    getGroups(page?: number, size?: number, signal?: AbortSignal): Promise<HeimdallPage<DirectoryGroup>>;
+    getMembers(groupId: string, page?: number, size?: number, signal?: AbortSignal): Promise<HeimdallPage<DirectoryMember>>;
+    enumerateUsers(size?: number, signal?: AbortSignal): AsyncGenerator<DirectoryUser>;
+    private page;
+    private data;
+    private send;
+}

package/dist/directory.js

@@ -0,0 +1,86 @@
+import { HeimdallProtocolError } from '@benlampson/heimdall-browser/protocol';
+/** 目录使用独立服务 Client 与应用边界，权限结果不默认缓存。 */
+export class HeimdallDirectoryClient {
+    tokens;
+    tenantId;
+    base;
+    constructor(tokens, apiBaseUrl, tenantId, allowLocalhostHttp = false) {
+        this.tokens = tokens;
+        this.tenantId = tenantId;
+        this.base = new URL(apiBaseUrl.replace(/\/$/, '') + '/');
+        if (!(this.base.protocol === 'https:' || (allowLocalhostHttp && this.base.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(this.base.hostname)))
+            || this.base.username || this.base.password || this.base.hash || this.base.search || !tenantId)
+            throw new HeimdallProtocolError('invalid_directory_configuration');
+    }
+    async getUser(userId, signal) {
+        const value = await this.data('users/' + id(userId), signal);
+        if (value.id !== userId || value.tenant_id !== this.tenantId || ![0, 1].includes(value.status))
+            throw new HeimdallProtocolError('invalid_user_response');
+        return value;
+    }
+    async getUserPermissions(userId, signal) {
+        const value = await this.data('users/' + id(userId) + '/permissions', signal);
+        if (value.tenantUserId !== userId || !['Active', 'Disabled'].includes(value.status) || !Array.isArray(value.permissions)
+            || value.permissions.some(p => typeof p !== 'string' || !p.trim()) || (value.status === 'Disabled' && value.permissions.length))
+            throw new HeimdallProtocolError('invalid_permissions_response');
+        return value;
+    }
+    async getGroup(groupId, signal) {
+        const value = await this.data('groups/' + id(groupId), signal);
+        if (value.id !== groupId || value.tenant_id !== this.tenantId || ![0, 1].includes(value.status))
+            throw new HeimdallProtocolError('invalid_group_response');
+        return value;
+    }
+    async getMembership(groupId, userId, signal) {
+        const value = await this.data('groups/' + id(groupId) + '/members/' + id(userId), signal);
+        if (value.tenant_user_id !== userId || value.directory_group_id !== groupId || typeof value.active !== 'boolean')
+            throw new HeimdallProtocolError('invalid_member_response');
+        return value;
+    }
+    getUsers(page = 1, size = 100, signal) { return this.page('users', page, size, signal); }
+    getGroups(page = 1, size = 100, signal) { return this.page('groups', page, size, signal); }
+    getMembers(groupId, page = 1, size = 100, signal) { return this.page('groups/' + id(groupId) + '/members', page, size, signal); }
+    async *enumerateUsers(size = 100, signal) {
+        for (let page = 1;; page++) {
+            const result = await this.getUsers(page, size, signal);
+            yield* result.data;
+            if (!result.data.length || page * result.size >= result.totalCount)
+                return;
+        }
+    }
+    async page(path, page, size, signal) {
+        if (!Number.isSafeInteger(page) || page < 1 || !Number.isSafeInteger(size) || size < 1 || size > 500)
+            throw new HeimdallProtocolError('invalid_pagination');
+        const value = await this.send(path + `?page=${page}&size=${size}`, signal);
+        if (!Array.isArray(value.data) || value.page !== page || value.size !== size || !Number.isSafeInteger(value.totalCount) || value.totalCount < 0 || value.data.length > size)
+            throw new HeimdallProtocolError('invalid_page');
+        return value;
+    }
+    async data(path, signal) {
+        const value = await this.send(path, signal);
+        if (!value.data || typeof value.data !== 'object' || Array.isArray(value.data))
+            throw new HeimdallProtocolError('invalid_response');
+        return value.data;
+    }
+    async send(path, signal) {
+        const token = await this.tokens.getClientCredentialsToken(signal);
+        const response = await fetch(new URL('api/backend/directory/' + path, this.base), { headers: { Authorization: `Bearer ${token.access_token}` }, redirect: 'error', credentials: 'omit',
+            signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15000)]) : AbortSignal.timeout(15000) });
+        if (!response.ok)
+            throw new HeimdallProtocolError(`http_${response.status}`, response.status);
+        let value;
+        try {
+            value = await response.json();
+        }
+        catch {
+            throw new HeimdallProtocolError('invalid_response');
+        }
+        if (!value || typeof value !== 'object' || value.code !== 200)
+            throw new HeimdallProtocolError('resource_error');
+        return value;
+    }
+}
+/** 拒绝 URL 点段，编码普通标识。 */
+function id(value) { if (!value || value === '.' || value === '..')
+    throw new HeimdallProtocolError('invalid_identifier'); return encodeURIComponent(value); }
+//# sourceMappingURL=directory.js.map

package/dist/directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory.js","sourceRoot":"","sources":["../src/directory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAU9E,uCAAuC;AACvC,MAAM,OAAO,uBAAuB;IAEL;IAAmE;IAD/E,IAAI,CAAM;IAC3B,YAA6B,MAA4B,EAAE,UAAkB,EAAmB,QAAgB,EAAE,kBAAkB,GAAG,KAAK;QAA/G,WAAM,GAAN,MAAM,CAAsB;QAAuC,aAAQ,GAAR,QAAQ,CAAQ;QAC9G,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;eAC/J,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,CAAC,CAAC;IACvK,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAAoB;QAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAgB,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IACzK,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,MAAoB;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAA2B,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC;QACxG,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;eACnH,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IACnN,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,MAAoB;QAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAiB,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAC3K,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAc,EAAE,MAAoB;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAkB,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3G,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAC7L,CAAC;IACD,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,MAAoB,IAA0C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7I,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,MAAoB,IAA2C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAChJ,UAAU,CAAC,OAAe,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,MAAoB,IAA4C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/L,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,GAAG,GAAG,EAAE,MAAoB;QACpD,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACxG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU;gBAAE,OAAO;QAAC,CAAC;IACjF,CAAC;IACO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,MAAoB;QAClF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG;YAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAC5J,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,SAAS,IAAI,SAAS,IAAI,EAAE,EAAE,MAAM,CAA+B,CAAC;QACzG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAC7O,CAAC;IACO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAoB;QAAgB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClH,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC,IAAS,CAAC;IAAC,CAAC;IACxJ,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,MAAoB;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,wBAAwB,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM;YACpL,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,KAAc,CAAC;QAAC,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAAC,CAAC;QACzH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAiC,CAAC,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QAAC,OAAO,KAAgC,CAAC;IACzL,CAAC;CACF;AACD,wBAAwB;AACxB,SAAS,EAAE,CAAC,KAAa,IAAY,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;IAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { HeimdallServerClient } from './client.js';
+export type { HeimdallServerOptions } from './client.js';
+export { HeimdallDirectoryClient } from './directory.js';
+export type { DirectoryUser, DirectoryGroup, DirectoryMember, DirectoryUserPermissions, HeimdallPage } from './directory.js';
+export { createMcpAuthenticationHeaders } from './mcp.js';
+export { HeimdallProtocolError } from '@benlampson/heimdall-browser/protocol';
+export type { HeimdallProtocolOptions, HeimdallTokenSet, HeimdallLoginRequest, HeimdallLoginOptions, HeimdallDeviceAuthorization, HeimdallDeviceTokenResult, HeimdallJwtValidation } from '@benlampson/heimdall-browser/protocol';

package/dist/index.js

@@ -0,0 +1,5 @@
+export { HeimdallServerClient } from './client.js';
+export { HeimdallDirectoryClient } from './directory.js';
+export { createMcpAuthenticationHeaders } from './mcp.js';
+export { HeimdallProtocolError } from '@benlampson/heimdall-browser/protocol';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,10 @@
+/** 返回 MCP 专用认证头，调用方交给标准 MCP 客户端；不重写 MCP 传输。 */
+export declare function createMcpAuthenticationHeaders(mcpUrl: string, authentication: {
+    type: 'ak-sk';
+    accessKey: string;
+    secretKey: string;
+    method?: 'basic' | 'headers';
+} | {
+    type: 'bearer';
+    accessToken: string;
+}): Headers;

package/dist/mcp.js

@@ -0,0 +1,25 @@
+import { HeimdallProtocolError } from '@benlampson/heimdall-browser/protocol';
+/** 返回 MCP 专用认证头，调用方交给标准 MCP 客户端；不重写 MCP 传输。 */
+export function createMcpAuthenticationHeaders(mcpUrl, authentication) {
+    const url = new URL(mcpUrl);
+    if (url.protocol !== 'https:' || url.pathname !== '/mcp' || url.username || url.password || url.hash || url.search)
+        throw new HeimdallProtocolError('invalid_mcp_endpoint');
+    const headers = new Headers();
+    if (authentication.type === 'bearer') {
+        if (!authentication.accessToken || /[\r\n]/.test(authentication.accessToken))
+            throw new HeimdallProtocolError('invalid_mcp_credentials');
+        headers.set('Authorization', `Bearer ${authentication.accessToken}`);
+    }
+    else {
+        if (!/^hmcp_[pt]_[^:\s]+$/.test(authentication.accessKey) || !authentication.secretKey || /[\r\n]/.test(authentication.secretKey))
+            throw new HeimdallProtocolError('invalid_mcp_credentials');
+        if (authentication.method === 'headers') {
+            headers.set('X-Heimdall-Access-Key', authentication.accessKey);
+            headers.set('X-Heimdall-Secret-Key', authentication.secretKey);
+        }
+        else
+            headers.set('Authorization', `Basic ${btoa(String.fromCharCode(...new TextEncoder().encode(authentication.accessKey + ':' + authentication.secretKey)))}`);
+    }
+    return headers;
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,+CAA+C;AAC/C,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,cACkE;IAC/H,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IAC5K,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,cAAc,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,cAAc,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QACzI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC9L,IAAI,cAAc,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;;YACvK,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,GAAG,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClK,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,36 @@
-{
-  "name": "@benlampson/heimdall-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@benlampson/heimdall-server",
+  "version": "5.5.3",
+  "type": "module",
+  "description": "Heimdall server OAuth, read-only directory and MCP authentication adapters.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/BenLampson/Asgard.Heimdall.git",
+    "directory": "sdk/typescript/packages/server"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "@benlampson/heimdall-browser": "5.5.3"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  }
+}