@codelitdev/oauth-server-kit 0.1.0-alpha.1 → 0.2.0

package/README.md

@@ -50,6 +50,8 @@ application.
 
 - OAuth Dynamic Client Registration is disabled unless explicitly enabled.
 - Unauthenticated DCR requires a separate explicit opt-in.
+- MCP client metadata documents (CIMD) are configured through the product's
+  Better Auth plugins; see the integration guide for the secure fetch transport.
 - Issuer and audience/resource are verified for every bearer token.
 - Invalid explicit bearer tokens fail closed.
 - Ordinary-login redirects are restricted to configured origins.
@@ -65,10 +67,10 @@ product requirements and public contract.
 ## Development gates
 
 ```bash
-pnpm check-types
-pnpm test
-pnpm test:coverage
-pnpm build
+bun run check-types
+bun test
+bun run test:coverage
+bun run build
 ```
 
 The coverage release gate is 90% statements, lines, and functions and 80%

package/dist/better-auth.js

@@ -57,9 +57,7 @@ async function resolveBetterAuthSession(options, headers) {
   }
 }
 function uniqueRequired(values, field) {
-  const result = [
-    ...new Set(values.map((value) => value.trim()).filter(Boolean))
-  ];
+  const result = [...new Set(values.map((value) => value.trim()).filter(Boolean))];
   if (result.length === 0) {
     throw new Error(`${field} must contain at least one value`);
   }
@@ -68,9 +66,7 @@ function uniqueRequired(values, field) {
 function assertPageLocation(value, field) {
   if (value.startsWith("/") && !value.startsWith("//")) {
     if (/\s/.test(value)) {
-      throw new Error(
-        `${field} must be an absolute URL or absolute path`
-      );
+      throw new Error(`${field} must be an absolute URL or absolute path`);
     }
     return;
   }
@@ -89,14 +85,10 @@ function assertPageLocation(value, field) {
 }
 function assertScopeSubset(values, scopes, field) {
   if (!values) return void 0;
-  const normalized = [
-    ...new Set(values.map((value) => value.trim()).filter(Boolean))
-  ];
+  const normalized = [...new Set(values.map((value) => value.trim()).filter(Boolean))];
   const invalid = normalized.filter((scope) => !scopes.includes(scope));
   if (invalid.length > 0) {
-    throw new Error(
-      `${field} contains unsupported scopes: ${invalid.join(", ")}`
-    );
+    throw new Error(`${field} contains unsupported scopes: ${invalid.join(", ")}`);
   }
   return normalized;
 }
@@ -105,10 +97,7 @@ function createOAuthProviderOptions(input) {
   assertPageLocation(input.loginPage, "loginPage");
   assertPageLocation(input.consentPage, "consentPage");
   const scopes = uniqueRequired(input.scopes, "scopes");
-  const validAudiences = uniqueRequired(
-    input.validAudiences,
-    "validAudiences"
-  );
+  const validAudiences = uniqueRequired(input.validAudiences, "validAudiences");
   if (input.allowUnauthenticatedDynamicClientRegistration && !input.allowDynamicClientRegistration) {
     throw new Error(
       "unauthenticated dynamic client registration requires dynamic client registration"
@@ -128,7 +117,9 @@ function createOAuthProviderOptions(input) {
     loginPage: input.loginPage,
     consentPage: input.consentPage,
     scopes,
-    validAudiences,
+    resources: validAudiences,
+    clientRegistrationDefaultResources: validAudiences,
+    clientRegistrationAllowedResources: validAudiences,
     allowDynamicClientRegistration: (_a = input.allowDynamicClientRegistration) != null ? _a : false,
     allowUnauthenticatedClientRegistration: (_b = input.allowUnauthenticatedDynamicClientRegistration) != null ? _b : false
   }, clientRegistrationDefaultScopes ? { clientRegistrationDefaultScopes } : {}), clientRegistrationAllowedScopes ? { clientRegistrationAllowedScopes } : {});

package/dist/better-auth.mjs

@@ -1,4 +1,4 @@
-import { __spreadValues } from './chunk-I4E63NIC.mjs';
+import { __spreadValues } from './chunk-FWCSY2DS.mjs';
 
 // src/better-auth.ts
 function normalizeIssuer(value) {
@@ -40,9 +40,7 @@ async function resolveBetterAuthSession(options, headers) {
   }
 }
 function uniqueRequired(values, field) {
-  const result = [
-    ...new Set(values.map((value) => value.trim()).filter(Boolean))
-  ];
+  const result = [...new Set(values.map((value) => value.trim()).filter(Boolean))];
   if (result.length === 0) {
     throw new Error(`${field} must contain at least one value`);
   }
@@ -51,9 +49,7 @@ function uniqueRequired(values, field) {
 function assertPageLocation(value, field) {
   if (value.startsWith("/") && !value.startsWith("//")) {
     if (/\s/.test(value)) {
-      throw new Error(
-        `${field} must be an absolute URL or absolute path`
-      );
+      throw new Error(`${field} must be an absolute URL or absolute path`);
     }
     return;
   }
@@ -72,14 +68,10 @@ function assertPageLocation(value, field) {
 }
 function assertScopeSubset(values, scopes, field) {
   if (!values) return void 0;
-  const normalized = [
-    ...new Set(values.map((value) => value.trim()).filter(Boolean))
-  ];
+  const normalized = [...new Set(values.map((value) => value.trim()).filter(Boolean))];
   const invalid = normalized.filter((scope) => !scopes.includes(scope));
   if (invalid.length > 0) {
-    throw new Error(
-      `${field} contains unsupported scopes: ${invalid.join(", ")}`
-    );
+    throw new Error(`${field} contains unsupported scopes: ${invalid.join(", ")}`);
   }
   return normalized;
 }
@@ -88,10 +80,7 @@ function createOAuthProviderOptions(input) {
   assertPageLocation(input.loginPage, "loginPage");
   assertPageLocation(input.consentPage, "consentPage");
   const scopes = uniqueRequired(input.scopes, "scopes");
-  const validAudiences = uniqueRequired(
-    input.validAudiences,
-    "validAudiences"
-  );
+  const validAudiences = uniqueRequired(input.validAudiences, "validAudiences");
   if (input.allowUnauthenticatedDynamicClientRegistration && !input.allowDynamicClientRegistration) {
     throw new Error(
       "unauthenticated dynamic client registration requires dynamic client registration"
@@ -111,7 +100,9 @@ function createOAuthProviderOptions(input) {
     loginPage: input.loginPage,
     consentPage: input.consentPage,
     scopes,
-    validAudiences,
+    resources: validAudiences,
+    clientRegistrationDefaultResources: validAudiences,
+    clientRegistrationAllowedResources: validAudiences,
     allowDynamicClientRegistration: (_a = input.allowDynamicClientRegistration) != null ? _a : false,
     allowUnauthenticatedClientRegistration: (_b = input.allowUnauthenticatedDynamicClientRegistration) != null ? _b : false
   }, clientRegistrationDefaultScopes ? { clientRegistrationDefaultScopes } : {}), clientRegistrationAllowedScopes ? { clientRegistrationAllowedScopes } : {});

package/dist/{chunk-I4E63NIC.mjs → chunk-FWCSY2DS.mjs}

@@ -17,5 +17,17 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __objRest = (source, exclude) => {
+  var target = {};
+  for (var prop in source)
+    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
+      target[prop] = source[prop];
+  if (source != null && __getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(source)) {
+      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
+        target[prop] = source[prop];
+    }
+  return target;
+};
 
-export { __spreadProps, __spreadValues };
+export { __objRest, __spreadProps, __spreadValues };

package/dist/{chunk-RJ4ABQXG.mjs → chunk-JENFPLCB.mjs}

@@ -1,4 +1,4 @@
-import { __spreadProps, __spreadValues } from './chunk-I4E63NIC.mjs';
+import { __spreadProps, __spreadValues } from './chunk-FWCSY2DS.mjs';
 
 // src/verify-access-token.ts
 function requireAbsoluteUrl(value, field) {
@@ -44,16 +44,14 @@ async function verifyOAuthAccessToken(options, token) {
   const audiences = normalizedUniqueStrings(options.audiences);
   if (!token.trim()) return { status: "invalid_token" };
   try {
-    const claims = await options.oauthResourceClient.getActions().verifyAccessToken(token, {
+    const claims = await options.oauthResourceClient.getActions().verifyBearerToken(token, {
       verifyOptions: { issuer, audience: audiences },
       resourceMetadataMappings: (_a = options.resourceMetadataMappings) != null ? _a : {}
     });
     const subject = optionalString(claims.sub);
     const claimIssuer = optionalString(claims.iss);
     const clientId = (_b = optionalString(claims.azp)) != null ? _b : optionalString(claims.client_id);
-    const tokenAudiences = normalizedUniqueStrings(
-      claimStrings(claims.aud)
-    );
+    const tokenAudiences = normalizedUniqueStrings(claimStrings(claims.aud));
     const validatedAudiences = tokenAudiences.filter(
       (audience) => audiences.includes(audience)
     );

package/dist/express.d.mts

@@ -1,5 +1,5 @@
 import { RequestHandler, Router } from 'express';
-import { a as AuthenticatedIdentity } from './types-DJxCmhYu.mjs';
+import { a as AuthenticatedIdentity, A as AuthenticationResult } from './types-DJxCmhYu.mjs';
 import { VerifyOAuthAccessTokenOptions } from './index.mjs';
 import '@better-auth/oauth-provider/resource-client';
 
@@ -12,6 +12,7 @@ declare global {
 }
 interface CreateOAuthBearerMiddlewareOptions extends VerifyOAuthAccessTokenOptions {
     resourceMetadataUrl?: string;
+    verifyAccessToken?: (options: VerifyOAuthAccessTokenOptions, token: string) => Promise<AuthenticationResult>;
 }
 declare function createOAuthBearerMiddleware(options: CreateOAuthBearerMiddlewareOptions): RequestHandler;
 

package/dist/express.d.ts

@@ -1,5 +1,5 @@
 import { RequestHandler, Router } from 'express';
-import { a as AuthenticatedIdentity } from './types-DJxCmhYu.js';
+import { a as AuthenticatedIdentity, A as AuthenticationResult } from './types-DJxCmhYu.js';
 import { VerifyOAuthAccessTokenOptions } from './index.js';
 import '@better-auth/oauth-provider/resource-client';
 
@@ -12,6 +12,7 @@ declare global {
 }
 interface CreateOAuthBearerMiddlewareOptions extends VerifyOAuthAccessTokenOptions {
     resourceMetadataUrl?: string;
+    verifyAccessToken?: (options: VerifyOAuthAccessTokenOptions, token: string) => Promise<AuthenticationResult>;
 }
 declare function createOAuthBearerMiddleware(options: CreateOAuthBearerMiddlewareOptions): RequestHandler;
 

package/dist/express.js

@@ -21,6 +21,18 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __objRest = (source, exclude) => {
+  var target = {};
+  for (var prop in source)
+    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
+      target[prop] = source[prop];
+  if (source != null && __getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(source)) {
+      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
+        target[prop] = source[prop];
+    }
+  return target;
+};
 
 // src/verify-access-token.ts
 function requireAbsoluteUrl(value, field) {
@@ -66,16 +78,14 @@ async function verifyOAuthAccessToken(options, token) {
   const audiences = normalizedUniqueStrings(options.audiences);
   if (!token.trim()) return { status: "invalid_token" };
   try {
-    const claims = await options.oauthResourceClient.getActions().verifyAccessToken(token, {
+    const claims = await options.oauthResourceClient.getActions().verifyBearerToken(token, {
       verifyOptions: { issuer, audience: audiences },
       resourceMetadataMappings: (_a = options.resourceMetadataMappings) != null ? _a : {}
     });
     const subject = optionalString(claims.sub);
     const claimIssuer = optionalString(claims.iss);
     const clientId = (_b = optionalString(claims.azp)) != null ? _b : optionalString(claims.client_id);
-    const tokenAudiences = normalizedUniqueStrings(
-      claimStrings(claims.aud)
-    );
+    const tokenAudiences = normalizedUniqueStrings(claimStrings(claims.aud));
     const validatedAudiences = tokenAudiences.filter(
       (audience) => audiences.includes(audience)
     );
@@ -142,7 +152,8 @@ function bearerToken(request) {
   return ((_a = match == null ? void 0 : match[1]) == null ? void 0 : _a.trim()) || null;
 }
 function createOAuthBearerMiddleware(options) {
-  validateOAuthVerificationOptions(options);
+  const _a = options, { verifyAccessToken = verifyOAuthAccessToken } = _a, verificationOptions = __objRest(_a, ["verifyAccessToken"]);
+  validateOAuthVerificationOptions(verificationOptions);
   if (options.resourceMetadataUrl) {
     let metadataUrl;
     try {
@@ -167,13 +178,9 @@ function createOAuthBearerMiddleware(options) {
       );
       return;
     }
-    const result = await verifyOAuthAccessToken(options, token);
+    const result = await verifyAccessToken(verificationOptions, token);
     if (result.status !== "authenticated") {
-      sendAuthenticationError(
-        response,
-        result,
-        options.resourceMetadataUrl
-      );
+      sendAuthenticationError(response, result, options.resourceMetadataUrl);
       return;
     }
     request.auth = result.identity;
@@ -283,9 +290,7 @@ function normalizeOptions(options) {
   for (const method of options.loginMethods) {
     if (method.type === "social") {
       if (!method.providerId.trim() || !method.label.trim()) {
-        throw new Error(
-          "social login methods require providerId and label"
-        );
+        throw new Error("social login methods require providerId and label");
       }
     }
   }

package/dist/express.mjs

@@ -1,5 +1,5 @@
-import { validateOAuthVerificationOptions, verifyOAuthAccessToken } from './chunk-RJ4ABQXG.mjs';
-import { __spreadProps, __spreadValues } from './chunk-I4E63NIC.mjs';
+import { verifyOAuthAccessToken, validateOAuthVerificationOptions } from './chunk-JENFPLCB.mjs';
+import { __objRest, __spreadProps, __spreadValues } from './chunk-FWCSY2DS.mjs';
 import { Router } from 'express';
 
 // src/express.ts
@@ -39,7 +39,8 @@ function bearerToken(request) {
   return ((_a = match == null ? void 0 : match[1]) == null ? void 0 : _a.trim()) || null;
 }
 function createOAuthBearerMiddleware(options) {
-  validateOAuthVerificationOptions(options);
+  const _a = options, { verifyAccessToken = verifyOAuthAccessToken } = _a, verificationOptions = __objRest(_a, ["verifyAccessToken"]);
+  validateOAuthVerificationOptions(verificationOptions);
   if (options.resourceMetadataUrl) {
     let metadataUrl;
     try {
@@ -64,13 +65,9 @@ function createOAuthBearerMiddleware(options) {
       );
       return;
     }
-    const result = await verifyOAuthAccessToken(options, token);
+    const result = await verifyAccessToken(verificationOptions, token);
     if (result.status !== "authenticated") {
-      sendAuthenticationError(
-        response,
-        result,
-        options.resourceMetadataUrl
-      );
+      sendAuthenticationError(response, result, options.resourceMetadataUrl);
       return;
     }
     request.auth = result.identity;
@@ -180,9 +177,7 @@ function normalizeOptions(options) {
   for (const method of options.loginMethods) {
     if (method.type === "social") {
       if (!method.providerId.trim() || !method.label.trim()) {
-        throw new Error(
-          "social login methods require providerId and label"
-        );
+        throw new Error("social login methods require providerId and label");
       }
     }
   }

package/dist/index.js

@@ -64,16 +64,14 @@ async function verifyOAuthAccessToken(options, token) {
   const audiences = normalizedUniqueStrings(options.audiences);
   if (!token.trim()) return { status: "invalid_token" };
   try {
-    const claims = await options.oauthResourceClient.getActions().verifyAccessToken(token, {
+    const claims = await options.oauthResourceClient.getActions().verifyBearerToken(token, {
       verifyOptions: { issuer, audience: audiences },
       resourceMetadataMappings: (_a = options.resourceMetadataMappings) != null ? _a : {}
     });
     const subject = optionalString(claims.sub);
     const claimIssuer = optionalString(claims.iss);
     const clientId = (_b = optionalString(claims.azp)) != null ? _b : optionalString(claims.client_id);
-    const tokenAudiences = normalizedUniqueStrings(
-      claimStrings(claims.aud)
-    );
+    const tokenAudiences = normalizedUniqueStrings(claimStrings(claims.aud));
     const validatedAudiences = tokenAudiences.filter(
       (audience) => audiences.includes(audience)
     );

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { verifyOAuthAccessToken } from './chunk-RJ4ABQXG.mjs';
-import './chunk-I4E63NIC.mjs';
+export { verifyOAuthAccessToken } from './chunk-JENFPLCB.mjs';
+import './chunk-FWCSY2DS.mjs';

package/dist/mcp.d.mts

@@ -4,7 +4,11 @@ import '@better-auth/oauth-provider/resource-client';
 
 interface BetterAuthMetadataApi {
     options: {
-        baseURL?: string;
+        /**
+         * Better Auth 1.7 also accepts a dynamic base URL config; discovery
+         * metadata needs one static origin, so only a string is accepted.
+         */
+        baseURL?: unknown;
         basePath?: string;
     };
     api: {
@@ -18,6 +22,10 @@ interface CreateMcpOAuthDiscoveryRoutesOptions {
     resourceUrl: string;
     scopesSupported: readonly string[];
     allowedOrigins: readonly string[] | "*";
+    metadataHandlers?: {
+        authorizationServer: (auth: BetterAuthMetadataApi) => (request: Request) => Promise<Response>;
+        openId: (auth: BetterAuthMetadataApi) => (request: Request) => Promise<Response>;
+    };
 }
 declare function createMcpOAuthDiscoveryRoutes(rawOptions: CreateMcpOAuthDiscoveryRoutesOptions): Router;
 

package/dist/mcp.d.ts

@@ -4,7 +4,11 @@ import '@better-auth/oauth-provider/resource-client';
 
 interface BetterAuthMetadataApi {
     options: {
-        baseURL?: string;
+        /**
+         * Better Auth 1.7 also accepts a dynamic base URL config; discovery
+         * metadata needs one static origin, so only a string is accepted.
+         */
+        baseURL?: unknown;
         basePath?: string;
     };
     api: {
@@ -18,6 +22,10 @@ interface CreateMcpOAuthDiscoveryRoutesOptions {
     resourceUrl: string;
     scopesSupported: readonly string[];
     allowedOrigins: readonly string[] | "*";
+    metadataHandlers?: {
+        authorizationServer: (auth: BetterAuthMetadataApi) => (request: Request) => Promise<Response>;
+        openId: (auth: BetterAuthMetadataApi) => (request: Request) => Promise<Response>;
+    };
 }
 declare function createMcpOAuthDiscoveryRoutes(rawOptions: CreateMcpOAuthDiscoveryRoutesOptions): Router;
 

package/dist/mcp.js

@@ -33,19 +33,21 @@ function normalizeOptions(options) {
     throw new Error("resourceUrl must use http or https");
   }
   if (resource.username || resource.password || resource.search || resource.hash) {
-    throw new Error(
-      "resourceUrl must not include credentials, query, or fragment"
-    );
+    throw new Error("resourceUrl must not include credentials, query, or fragment");
   }
   if (process.env.NODE_ENV === "production" && resource.protocol !== "https:") {
     throw new Error("resourceUrl must use https in production");
   }
-  if (!options.auth.options.baseURL) {
+  const baseURL = options.auth.options.baseURL;
+  if (!baseURL) {
     throw new Error("auth.options.baseURL must be configured");
   }
+  if (typeof baseURL !== "string") {
+    throw new Error("auth.options.baseURL must be a static URL string");
+  }
   let authorizationServerBase;
   try {
-    authorizationServerBase = new URL(options.auth.options.baseURL);
+    authorizationServerBase = new URL(baseURL);
   } catch (e) {
     throw new Error("auth.options.baseURL must be an absolute URL");
   }
@@ -65,9 +67,7 @@ function normalizeOptions(options) {
   const authorizationServerPath = rawAuthorizationServerPath === "/" ? "" : rawAuthorizationServerPath.replace(/\/+$/, "");
   const authorizationServerUrl = `${authorizationServerBase.toString().replace(/\/$/, "")}${authorizationServerPath}`;
   const scopesSupported = [
-    ...new Set(
-      options.scopesSupported.map((scope) => scope.trim()).filter(Boolean)
-    )
+    ...new Set(options.scopesSupported.map((scope) => scope.trim()).filter(Boolean))
   ];
   const allowedOrigins = options.allowedOrigins === "*" ? "*" : new Set(
     options.allowedOrigins.map((origin) => {
@@ -75,24 +75,16 @@ function normalizeOptions(options) {
       try {
         url = new URL(origin);
       } catch (e) {
-        throw new Error(
-          "allowedOrigins must contain absolute origins"
-        );
+        throw new Error("allowedOrigins must contain absolute origins");
       }
       if (!["http:", "https:"].includes(url.protocol)) {
-        throw new Error(
-          "allowedOrigins must use http or https"
-        );
+        throw new Error("allowedOrigins must use http or https");
       }
       if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
-        throw new Error(
-          "allowedOrigins must contain origins without paths"
-        );
+        throw new Error("allowedOrigins must contain origins without paths");
       }
       if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
-        throw new Error(
-          "allowedOrigins must use https in production"
-        );
+        throw new Error("allowedOrigins must use https in production");
       }
       return url.origin;
     })
@@ -128,9 +120,9 @@ function applyCors(request, response, allowedOrigins) {
 }
 async function sendFetchResponse(response, fetchResponse) {
   response.status(fetchResponse.status);
-  fetchResponse.headers.forEach(
-    (value, key) => response.setHeader(key, value)
-  );
+  fetchResponse.headers.forEach((value, key) => {
+    response.setHeader(key, value);
+  });
   response.send(await fetchResponse.text());
 }
 function asyncHandler(handler) {
@@ -149,10 +141,7 @@ function createMcpOAuthDiscoveryRoutes(rawOptions) {
     "/.well-known/openid-configuration",
     `${options.authorizationServerPath}/.well-known/openid-configuration`
   ]);
-  const resourcePath = new URL(options.resourceUrl).pathname.replace(
-    /\/$/,
-    ""
-  );
+  const resourcePath = new URL(options.resourceUrl).pathname.replace(/\/$/, "");
   const protectedResourcePaths = /* @__PURE__ */ new Set([
     "/.well-known/oauth-protected-resource",
     `/.well-known/oauth-protected-resource${resourcePath}`
@@ -178,7 +167,8 @@ function createMcpOAuthDiscoveryRoutes(rawOptions) {
     next();
   });
   async function authorizationServerMetadata(request, response) {
-    const handler = oauthProvider.oauthProviderAuthServerMetadata(options.auth);
+    var _a, _b;
+    const handler = ((_b = (_a = options.metadataHandlers) == null ? void 0 : _a.authorizationServer) != null ? _b : oauthProvider.oauthProviderAuthServerMetadata)(options.auth);
     await sendFetchResponse(
       response,
       await handler(
@@ -190,7 +180,8 @@ function createMcpOAuthDiscoveryRoutes(rawOptions) {
     );
   }
   async function openIdMetadata(request, response) {
-    const handler = oauthProvider.oauthProviderOpenIdConfigMetadata(options.auth);
+    var _a, _b;
+    const handler = ((_b = (_a = options.metadataHandlers) == null ? void 0 : _a.openId) != null ? _b : oauthProvider.oauthProviderOpenIdConfigMetadata)(options.auth);
     await sendFetchResponse(
       response,
       await handler(
@@ -208,15 +199,12 @@ function createMcpOAuthDiscoveryRoutes(rawOptions) {
     router.get(path, asyncHandler(openIdMetadata));
   }
   async function protectedResourceMetadata(_request, response) {
-    const metadata = await options.oauthResourceClient.getActions().getProtectedResourceMetadata(
-      {
-        resource: options.resourceUrl,
-        authorization_servers: [options.authorizationServerUrl],
-        scopes_supported: options.scopesSupported,
-        bearer_methods_supported: ["header"]
-      },
-      { silenceWarnings: { oidcScopes: true } }
-    );
+    const metadata = await options.oauthResourceClient.getActions().getProtectedResourceMetadata({
+      resource: options.resourceUrl,
+      authorization_servers: [options.authorizationServerUrl],
+      scopes_supported: options.scopesSupported,
+      bearer_methods_supported: ["header"]
+    });
     response.json(metadata);
   }
   for (const path of protectedResourcePaths) {

package/dist/mcp.mjs

@@ -1,4 +1,4 @@
-import { __spreadProps, __spreadValues } from './chunk-I4E63NIC.mjs';
+import { __spreadProps, __spreadValues } from './chunk-FWCSY2DS.mjs';
 import { oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata } from '@better-auth/oauth-provider';
 import { Router } from 'express';
 
@@ -13,19 +13,21 @@ function normalizeOptions(options) {
     throw new Error("resourceUrl must use http or https");
   }
   if (resource.username || resource.password || resource.search || resource.hash) {
-    throw new Error(
-      "resourceUrl must not include credentials, query, or fragment"
-    );
+    throw new Error("resourceUrl must not include credentials, query, or fragment");
   }
   if (process.env.NODE_ENV === "production" && resource.protocol !== "https:") {
     throw new Error("resourceUrl must use https in production");
   }
-  if (!options.auth.options.baseURL) {
+  const baseURL = options.auth.options.baseURL;
+  if (!baseURL) {
     throw new Error("auth.options.baseURL must be configured");
   }
+  if (typeof baseURL !== "string") {
+    throw new Error("auth.options.baseURL must be a static URL string");
+  }
   let authorizationServerBase;
   try {
-    authorizationServerBase = new URL(options.auth.options.baseURL);
+    authorizationServerBase = new URL(baseURL);
   } catch (e) {
     throw new Error("auth.options.baseURL must be an absolute URL");
   }
@@ -45,9 +47,7 @@ function normalizeOptions(options) {
   const authorizationServerPath = rawAuthorizationServerPath === "/" ? "" : rawAuthorizationServerPath.replace(/\/+$/, "");
   const authorizationServerUrl = `${authorizationServerBase.toString().replace(/\/$/, "")}${authorizationServerPath}`;
   const scopesSupported = [
-    ...new Set(
-      options.scopesSupported.map((scope) => scope.trim()).filter(Boolean)
-    )
+    ...new Set(options.scopesSupported.map((scope) => scope.trim()).filter(Boolean))
   ];
   const allowedOrigins = options.allowedOrigins === "*" ? "*" : new Set(
     options.allowedOrigins.map((origin) => {
@@ -55,24 +55,16 @@ function normalizeOptions(options) {
       try {
         url = new URL(origin);
       } catch (e) {
-        throw new Error(
-          "allowedOrigins must contain absolute origins"
-        );
+        throw new Error("allowedOrigins must contain absolute origins");
       }
       if (!["http:", "https:"].includes(url.protocol)) {
-        throw new Error(
-          "allowedOrigins must use http or https"
-        );
+        throw new Error("allowedOrigins must use http or https");
       }
       if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
-        throw new Error(
-          "allowedOrigins must contain origins without paths"
-        );
+        throw new Error("allowedOrigins must contain origins without paths");
       }
       if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
-        throw new Error(
-          "allowedOrigins must use https in production"
-        );
+        throw new Error("allowedOrigins must use https in production");
       }
       return url.origin;
     })
@@ -108,9 +100,9 @@ function applyCors(request, response, allowedOrigins) {
 }
 async function sendFetchResponse(response, fetchResponse) {
   response.status(fetchResponse.status);
-  fetchResponse.headers.forEach(
-    (value, key) => response.setHeader(key, value)
-  );
+  fetchResponse.headers.forEach((value, key) => {
+    response.setHeader(key, value);
+  });
   response.send(await fetchResponse.text());
 }
 function asyncHandler(handler) {
@@ -129,10 +121,7 @@ function createMcpOAuthDiscoveryRoutes(rawOptions) {
     "/.well-known/openid-configuration",
     `${options.authorizationServerPath}/.well-known/openid-configuration`
   ]);
-  const resourcePath = new URL(options.resourceUrl).pathname.replace(
-    /\/$/,
-    ""
-  );
+  const resourcePath = new URL(options.resourceUrl).pathname.replace(/\/$/, "");
   const protectedResourcePaths = /* @__PURE__ */ new Set([
     "/.well-known/oauth-protected-resource",
     `/.well-known/oauth-protected-resource${resourcePath}`
@@ -158,7 +147,8 @@ function createMcpOAuthDiscoveryRoutes(rawOptions) {
     next();
   });
   async function authorizationServerMetadata(request, response) {
-    const handler = oauthProviderAuthServerMetadata(options.auth);
+    var _a, _b;
+    const handler = ((_b = (_a = options.metadataHandlers) == null ? void 0 : _a.authorizationServer) != null ? _b : oauthProviderAuthServerMetadata)(options.auth);
     await sendFetchResponse(
       response,
       await handler(
@@ -170,7 +160,8 @@ function createMcpOAuthDiscoveryRoutes(rawOptions) {
     );
   }
   async function openIdMetadata(request, response) {
-    const handler = oauthProviderOpenIdConfigMetadata(options.auth);
+    var _a, _b;
+    const handler = ((_b = (_a = options.metadataHandlers) == null ? void 0 : _a.openId) != null ? _b : oauthProviderOpenIdConfigMetadata)(options.auth);
     await sendFetchResponse(
       response,
       await handler(
@@ -188,15 +179,12 @@ function createMcpOAuthDiscoveryRoutes(rawOptions) {
     router.get(path, asyncHandler(openIdMetadata));
   }
   async function protectedResourceMetadata(_request, response) {
-    const metadata = await options.oauthResourceClient.getActions().getProtectedResourceMetadata(
-      {
-        resource: options.resourceUrl,
-        authorization_servers: [options.authorizationServerUrl],
-        scopes_supported: options.scopesSupported,
-        bearer_methods_supported: ["header"]
-      },
-      { silenceWarnings: { oidcScopes: true } }
-    );
+    const metadata = await options.oauthResourceClient.getActions().getProtectedResourceMetadata({
+      resource: options.resourceUrl,
+      authorization_servers: [options.authorizationServerUrl],
+      scopes_supported: options.scopesSupported,
+      bearer_methods_supported: ["header"]
+    });
     response.json(metadata);
   }
   for (const path of protectedResourcePaths) {

package/package.json

@@ -1,101 +1,101 @@
 {
-    "name": "@codelitdev/oauth-server-kit",
-    "version": "0.1.0-alpha.1",
-    "description": "Lean Better Auth OAuth authentication framework for web, mobile, REST, and MCP surfaces.",
-    "author": "CodeLit",
-    "license": "MIT",
-    "main": "dist/index.js",
-    "types": "dist/index.d.ts",
-    "files": [
-        "dist"
-    ],
-    "exports": {
-        ".": {
-            "import": {
-                "types": "./dist/index.d.mts",
-                "default": "./dist/index.mjs"
-            },
-            "require": {
-                "types": "./dist/index.d.ts",
-                "default": "./dist/index.js"
-            }
-        },
-        "./better-auth": {
-            "import": {
-                "types": "./dist/better-auth.d.mts",
-                "default": "./dist/better-auth.mjs"
-            },
-            "require": {
-                "types": "./dist/better-auth.d.ts",
-                "default": "./dist/better-auth.js"
-            }
-        },
-        "./express": {
-            "import": {
-                "types": "./dist/express.d.mts",
-                "default": "./dist/express.mjs"
-            },
-            "require": {
-                "types": "./dist/express.d.ts",
-                "default": "./dist/express.js"
-            }
-        },
-        "./mcp": {
-            "import": {
-                "types": "./dist/mcp.d.mts",
-                "default": "./dist/mcp.mjs"
-            },
-            "require": {
-                "types": "./dist/mcp.d.ts",
-                "default": "./dist/mcp.js"
-            }
-        }
+  "name": "@codelitdev/oauth-server-kit",
+  "version": "0.2.0",
+  "description": "Lean Better Auth OAuth authentication framework for web, mobile, REST, and MCP surfaces.",
+  "author": "CodeLit",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/codelitdev/platform.git",
+    "directory": "packages/oauth-server-kit"
+  },
+  "homepage": "https://github.com/codelitdev/platform/tree/main/packages/oauth-server-kit#readme",
+  "bugs": {
+    "url": "https://github.com/codelitdev/platform/issues"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
     },
-    "scripts": {
-        "clean": "rimraf dist/",
-        "build": "tsup",
-        "dev": "tsup --watch",
-        "check-types": "tsc --noEmit",
-        "test": "vitest run",
-        "test:watch": "vitest",
-        "test:coverage": "vitest run --coverage",
-        "lint": "eslint src test --quiet",
-        "lint:fix": "pnpm lint --fix",
-        "prettier": "prettier --write src test docs *.md *.json",
-        "format": "pnpm prettier",
-        "format:check": "prettier --check src test docs *.md *.json",
-        "quality": "pnpm format:check && pnpm lint && pnpm check-types",
-        "prepare": "husky",
-        "release:alpha": "pnpm quality && pnpm test:coverage && pnpm build && pnpm publish --tag alpha --access public --no-git-checks"
+    "./better-auth": {
+      "import": {
+        "types": "./dist/better-auth.d.mts",
+        "default": "./dist/better-auth.mjs"
+      },
+      "require": {
+        "types": "./dist/better-auth.d.ts",
+        "default": "./dist/better-auth.js"
+      }
     },
-    "publishConfig": {
-        "access": "public",
-        "tag": "alpha"
+    "./express": {
+      "import": {
+        "types": "./dist/express.d.mts",
+        "default": "./dist/express.mjs"
+      },
+      "require": {
+        "types": "./dist/express.d.ts",
+        "default": "./dist/express.js"
+      }
     },
-    "peerDependencies": {
-        "@better-auth/oauth-provider": "^1.6.23",
-        "better-auth": "^1.6.23",
-        "express": "^4.21.2"
-    },
-    "devDependencies": {
-        "@better-auth/oauth-provider": "^1.6.23",
-        "@types/express": "^4.17.20",
-        "@types/node": "^22.14.1",
-        "@vitest/coverage-v8": "3.2.7",
-        "better-auth": "^1.6.23",
-        "eslint": "^10.8.0",
-        "eslint-config-prettier": "^10.1.8",
-        "eslint-plugin-unused-imports": "^4.3.0",
-        "express": "^4.21.2",
-        "globals": "^15.15.0",
-        "husky": "^9.1.7",
-        "lint-staged": "^15.2.2",
-        "prettier": "^3.9.6",
-        "rimraf": "^5.0.0",
-        "tsup": "^8.3.0",
-        "typescript": "^5.9.3",
-        "typescript-eslint": "^8.46.0",
-        "vitest": "^3.2.7"
-    },
-    "packageManager": "pnpm@11.10.0"
+    "./mcp": {
+      "import": {
+        "types": "./dist/mcp.d.mts",
+        "default": "./dist/mcp.mjs"
+      },
+      "require": {
+        "types": "./dist/mcp.d.ts",
+        "default": "./dist/mcp.js"
+      }
+    }
+  },
+  "scripts": {
+    "clean": "rimraf dist/",
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "check-types": "tsc -p tsconfig.test.json --noEmit",
+    "test": "bun test --timeout 60000 src",
+    "test:watch": "bun test --watch --timeout 60000 src",
+    "test:coverage": "bun test --coverage --timeout 60000 src",
+    "lint": "biome lint .",
+    "lint:fix": "biome lint --write .",
+    "format": "biome format --write .",
+    "format:check": "biome ci --linter-enabled=false .",
+    "quality": "bun run format:check && bun run lint && bun run check-types"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "peerDependencies": {
+    "@better-auth/oauth-provider": "^1.7.2",
+    "better-auth": "^1.7.2",
+    "express": "^4.21.2"
+  },
+  "devDependencies": {
+    "@better-auth/core": "1.7.2",
+    "@better-auth/oauth-provider": "1.7.2",
+    "@better-auth/utils": "0.4.2",
+    "@better-fetch/fetch": "1.3.1",
+    "@types/express": "^4.17.20",
+    "@types/node": "^22.14.1",
+    "@types/bun": "^1.4.1",
+    "better-auth": "1.7.2",
+    "better-call": "1.4.0",
+    "express": "^4.21.2",
+    "rimraf": "^5.0.0",
+    "tsup": "^8.3.0",
+    "typescript": "^5.9.3"
+  }
 }