@dain-os/mcp-server 0.12.0 → 0.15.0

package/dist/oauth/handlers.js

@@ -0,0 +1,371 @@
+/**
+ * OAuth 2.1 endpoint handlers for the paste-PAT bridge.
+ *
+ * Endpoints:
+ *   GET  /.well-known/oauth-protected-resource     metadata (RFC 9728)
+ *   GET  /.well-known/oauth-authorization-server    metadata (RFC 8414)
+ *   POST /register                                  Dynamic Client Registration (RFC 7591)
+ *   GET  /authorize                                 consent page (paste PAT)
+ *   POST /authorize                                 issue authorization code
+ *   POST /token                                     code -> token, refresh -> token
+ *
+ * The pure cores (validateAuthorizeRequest, createAuthorizationCode,
+ * exchangeAuthorizationCode, refreshTokens, recoverPat) are exported and unit
+ * tested directly; the handle* wrappers only do req/res plumbing.
+ */
+import { DainOsClient, DainOsApiError } from '../client.js';
+import { PAT_PREFIX, SCOPE, ACCESS_TOKEN_TTL_SECONDS, } from './config.js';
+import { issueAccessToken, issueAuthorizationCode, issueClientId, issueRefreshToken, readAccessToken, readAuthorizationCode, readClientId, readRefreshToken, verifyPkceS256, } from './crypto.js';
+import { authorizationServerMetadata, protectedResourceMetadata } from './metadata.js';
+import { renderConsentPage } from './consent-page.js';
+import { parseFormBody, parseJsonBody, sendHtml, sendJson, sendRedirect, } from '../http-util.js';
+/** An OAuth error renderable as an RFC 6749 error response. */
+export class OAuthError extends Error {
+    error;
+    status;
+    constructor(error, description, status = 400) {
+        super(description);
+        this.name = 'OAuthError';
+        this.error = error;
+        this.status = status;
+    }
+    toBody() {
+        return { error: this.error, error_description: this.message };
+    }
+}
+// ---------------------------------------------------------------------------
+// Pure cores
+// ---------------------------------------------------------------------------
+/**
+ * Validate the inbound /authorize parameters and the dynamically-registered
+ * client. Returns a discriminated result rather than throwing so both the GET
+ * (render) and POST (submit) paths can branch cleanly.
+ */
+export async function validateAuthorizeRequest(params) {
+    const responseType = params['response_type'];
+    const clientId = params['client_id'];
+    const redirectUri = params['redirect_uri'];
+    const codeChallenge = params['code_challenge'];
+    const codeChallengeMethod = params['code_challenge_method'] ?? 'S256';
+    if (responseType !== undefined && responseType !== 'code') {
+        return { ok: false, error: 'unsupported_response_type', description: 'Only response_type=code is supported.' };
+    }
+    if (!clientId) {
+        return { ok: false, error: 'invalid_request', description: 'client_id is required.' };
+    }
+    if (!redirectUri) {
+        return { ok: false, error: 'invalid_request', description: 'redirect_uri is required.' };
+    }
+    if (!codeChallenge) {
+        return { ok: false, error: 'invalid_request', description: 'code_challenge is required (PKCE).' };
+    }
+    if (codeChallengeMethod !== 'S256') {
+        return { ok: false, error: 'invalid_request', description: 'code_challenge_method must be S256.' };
+    }
+    let allowedRedirects;
+    try {
+        const client = await readClientId(clientId);
+        allowedRedirects = client.redirect_uris ?? [];
+    }
+    catch {
+        return { ok: false, error: 'invalid_client', description: 'Unknown or expired client_id. Re-register the connector.' };
+    }
+    if (!allowedRedirects.includes(redirectUri)) {
+        return { ok: false, error: 'invalid_request', description: 'redirect_uri does not match the registered client.' };
+    }
+    return {
+        ok: true,
+        parsed: {
+            clientId,
+            redirectUri,
+            codeChallenge,
+            codeChallengeMethod,
+            state: params['state'],
+            scope: params['scope'],
+        },
+    };
+}
+/** Mint a short-lived authorization code embedding the PAT + PKCE challenge. */
+export async function createAuthorizationCode(input) {
+    return issueAuthorizationCode({
+        pat: input.pat,
+        client_id: input.clientId,
+        redirect_uri: input.redirectUri,
+        code_challenge: input.codeChallenge,
+    });
+}
+async function buildTokenResponse(pat) {
+    const [access, refresh] = await Promise.all([
+        issueAccessToken({ pat }),
+        issueRefreshToken({ pat }),
+    ]);
+    return {
+        access_token: access,
+        token_type: 'Bearer',
+        expires_in: ACCESS_TOKEN_TTL_SECONDS,
+        refresh_token: refresh,
+        scope: SCOPE,
+    };
+}
+/** authorization_code grant: verify the code + PKCE, return fresh tokens. */
+export async function exchangeAuthorizationCode(form) {
+    const code = form['code'];
+    const verifier = form['code_verifier'];
+    if (!code)
+        throw new OAuthError('invalid_request', 'code is required.');
+    if (!verifier)
+        throw new OAuthError('invalid_request', 'code_verifier is required (PKCE).');
+    let claims;
+    try {
+        claims = await readAuthorizationCode(code);
+    }
+    catch {
+        throw new OAuthError('invalid_grant', 'Authorization code is invalid or has expired.');
+    }
+    // OAuth 2.1 / RFC 9700: the client_id and redirect_uri presented here MUST
+    // match the values bound into the code. These are mandatory, not best-effort
+    // — skipping them when the fields are absent lets a code be redeemed by a
+    // client other than the one it was issued to.
+    const clientId = form['client_id'];
+    const redirectUri = form['redirect_uri'];
+    if (!clientId) {
+        throw new OAuthError('invalid_request', 'client_id is required.');
+    }
+    if (claims.client_id !== clientId) {
+        throw new OAuthError('invalid_grant', 'client_id does not match the authorization code.');
+    }
+    if (claims.redirect_uri !== redirectUri) {
+        throw new OAuthError('invalid_grant', 'redirect_uri does not match the authorization code.');
+    }
+    if (!verifyPkceS256(verifier, claims.code_challenge)) {
+        throw new OAuthError('invalid_grant', 'PKCE verification failed.');
+    }
+    return buildTokenResponse(claims.pat);
+}
+/** refresh_token grant: re-issue an access token (and rotate the refresh token). */
+export async function refreshTokens(form) {
+    const refreshToken = form['refresh_token'];
+    if (!refreshToken)
+        throw new OAuthError('invalid_request', 'refresh_token is required.');
+    let claims;
+    try {
+        claims = await readRefreshToken(refreshToken);
+    }
+    catch {
+        throw new OAuthError('invalid_grant', 'Refresh token is invalid or has expired.');
+    }
+    return buildTokenResponse(claims.pat);
+}
+/**
+ * Recover the underlying PAT from an inbound Authorization Bearer value.
+ *
+ * Accepts either a raw `dain_pat_...` (Claude Code path, unchanged) or an
+ * OAuth access token (encrypted JWT minted by /token). Returns null when the
+ * value is neither, so the caller can emit a 401 + WWW-Authenticate challenge.
+ */
+export async function recoverPat(bearer) {
+    if (!bearer)
+        return null;
+    if (bearer.startsWith(PAT_PREFIX))
+        return bearer;
+    try {
+        const { pat } = await readAccessToken(bearer);
+        return typeof pat === 'string' && pat.startsWith(PAT_PREFIX) ? pat : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Probe the pasted PAT against the API so an obviously wrong token fails on the
+ * consent page rather than silently later. A network blip returns 'unknown',
+ * which the caller treats as "let it through" so an API hiccup never blocks a
+ * genuine connection — the first /mcp call would still reject a bad token.
+ */
+async function validatePat(pat) {
+    // Reuse the vetted DainOS client (fixed allowlisted host derivation) rather
+    // than a raw fetch, so the only network egress in this package stays in one
+    // place. `/auth/me` is the cheapest PAT-authenticated endpoint.
+    const client = new DainOsClient(process.env['DAINOS_API_URL'], pat);
+    try {
+        await client.request('GET', '/auth/me');
+        return 'valid';
+    }
+    catch (error) {
+        if (error instanceof DainOsApiError && (error.status === 401 || error.status === 403)) {
+            return 'invalid';
+        }
+        return 'unknown';
+    }
+}
+// The only OAuth client of this server is Claude, so registered redirect URIs
+// are locked to its callback domains (overridable via env for other clients or
+// local testing). Without this, Dynamic Client Registration accepts ANY
+// redirect_uri, so an attacker could register `https://attacker.example/cb`,
+// phish a user into pasting their PAT on the consent page, and have the
+// resulting authorization code (and thus an impersonating token) delivered to
+// their own server.
+const DEFAULT_REDIRECT_HOSTS = ['claude.ai', 'claude.com', 'anthropic.com'];
+function allowedRedirectHosts() {
+    const env = process.env['MCP_ALLOWED_REDIRECT_HOSTS'];
+    if (env && env.trim()) {
+        return env.split(',').map((h) => h.trim().toLowerCase()).filter(Boolean);
+    }
+    return DEFAULT_REDIRECT_HOSTS;
+}
+function isLoopback(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+/** Accept https on an allowlisted host, or http on loopback (local testing). */
+export function isAllowedRedirectUri(uri) {
+    let url;
+    try {
+        url = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase();
+    if (url.protocol === 'http:' && isLoopback(host))
+        return true;
+    if (url.protocol !== 'https:')
+        return false;
+    return allowedRedirectHosts().some((allowed) => host === allowed || host.endsWith(`.${allowed}`));
+}
+function extractRedirectUris(body) {
+    if (typeof body !== 'object' || body === null)
+        return [];
+    const record = body;
+    const raw = Array.isArray(record['redirect_uris'])
+        ? record['redirect_uris']
+        : typeof record['redirect_uri'] === 'string'
+            ? [record['redirect_uri']]
+            : [];
+    return raw.filter((u) => typeof u === 'string' && isAllowedRedirectUri(u));
+}
+// ---------------------------------------------------------------------------
+// req/res handlers
+// ---------------------------------------------------------------------------
+export function handleProtectedResourceMetadata(res, baseUrl) {
+    sendJson(res, 200, protectedResourceMetadata(baseUrl));
+}
+export function handleAuthorizationServerMetadata(res, baseUrl) {
+    sendJson(res, 200, authorizationServerMetadata(baseUrl));
+}
+export async function handleRegister(req, res) {
+    let body;
+    try {
+        body = await parseJsonBody(req);
+    }
+    catch {
+        sendJson(res, 400, { error: 'invalid_request', error_description: 'Request body must be valid JSON.' });
+        return;
+    }
+    const redirectUris = extractRedirectUris(body);
+    if (redirectUris.length === 0) {
+        sendJson(res, 400, {
+            error: 'invalid_redirect_uri',
+            error_description: 'redirect_uris is required and must contain at least one URI.',
+        });
+        return;
+    }
+    const clientId = await issueClientId({ redirect_uris: redirectUris });
+    sendJson(res, 201, {
+        client_id: clientId,
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+        redirect_uris: redirectUris,
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+        scope: SCOPE,
+    });
+}
+function renderError(res, description) {
+    sendHtml(res, 400, `<!DOCTYPE html><html lang="en-GB"><head><meta charset="utf-8" /><title>Connection error</title></head>` +
+        `<body style="font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 24px">` +
+        `<h1>Could not start the connection</h1><p>${description.replace(/</g, '&lt;')}</p>` +
+        `<p>Please remove the connector and add it again.</p></body></html>`);
+}
+/** GET shows the paste-PAT page; POST validates the PAT and issues a code. */
+export async function handleAuthorize(req, res, query) {
+    if (req.method === 'GET') {
+        const validation = await validateAuthorizeRequest(query);
+        if (!validation.ok) {
+            renderError(res, validation.description);
+            return;
+        }
+        const { parsed } = validation;
+        sendHtml(res, 200, renderConsentPage({
+            clientId: parsed.clientId,
+            redirectUri: parsed.redirectUri,
+            codeChallenge: parsed.codeChallenge,
+            codeChallengeMethod: parsed.codeChallengeMethod,
+            state: parsed.state,
+            scope: parsed.scope,
+        }));
+        return;
+    }
+    // POST — form submission from the consent page.
+    const form = await parseFormBody(req);
+    const validation = await validateAuthorizeRequest(form);
+    if (!validation.ok) {
+        renderError(res, validation.description);
+        return;
+    }
+    const { parsed } = validation;
+    const pat = (form['pat'] ?? '').trim();
+    const reRender = (error) => sendHtml(res, 200, renderConsentPage({
+        clientId: parsed.clientId,
+        redirectUri: parsed.redirectUri,
+        codeChallenge: parsed.codeChallenge,
+        codeChallengeMethod: parsed.codeChallengeMethod,
+        state: parsed.state,
+        scope: parsed.scope,
+        error,
+    }));
+    if (!pat.startsWith(PAT_PREFIX)) {
+        reRender('That does not look like a DainOS API token. It should start with "dain_pat_".');
+        return;
+    }
+    const status = await validatePat(pat);
+    if (status === 'invalid') {
+        reRender('That token was rejected by DainOS. Create a fresh one and try again.');
+        return;
+    }
+    const code = await createAuthorizationCode({
+        pat,
+        clientId: parsed.clientId,
+        redirectUri: parsed.redirectUri,
+        codeChallenge: parsed.codeChallenge,
+    });
+    const redirect = new URL(parsed.redirectUri);
+    redirect.searchParams.set('code', code);
+    if (parsed.state !== undefined)
+        redirect.searchParams.set('state', parsed.state);
+    sendRedirect(res, redirect.toString());
+}
+export async function handleToken(req, res) {
+    const form = await parseFormBody(req);
+    const grantType = form['grant_type'];
+    try {
+        let tokens;
+        if (grantType === 'authorization_code') {
+            tokens = await exchangeAuthorizationCode(form);
+        }
+        else if (grantType === 'refresh_token') {
+            tokens = await refreshTokens(form);
+        }
+        else {
+            throw new OAuthError('unsupported_grant_type', `Unsupported grant_type: ${String(grantType)}`);
+        }
+        sendJson(res, 200, tokens, { 'Cache-Control': 'no-store', Pragma: 'no-cache' });
+    }
+    catch (error) {
+        if (error instanceof OAuthError) {
+            sendJson(res, error.status, error.toBody(), { 'Cache-Control': 'no-store' });
+            return;
+        }
+        sendJson(res, 500, { error: 'server_error', error_description: 'Unexpected error issuing token.' });
+    }
+}
+//# sourceMappingURL=handlers.js.map

package/dist/oauth/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/oauth/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,UAAU,EACV,KAAK,EACL,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,aAAa,EACb,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,YAAY,GACb,MAAM,iBAAiB,CAAC;AAEzB,+DAA+D;AAC/D,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,KAAK,CAAS;IACd,MAAM,CAAS;IACxB,YAAY,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG;QAC1D,KAAK,CAAC,WAAW,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,MAAM;QACJ,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC;CACF;AAuBD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA0C;IAE1C,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,mBAAmB,GAAG,MAAM,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;IAEtE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;IACjH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACrG,CAAC;IAED,IAAI,gBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,gBAAgB,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,oDAAoD,EAAE,CAAC;IACpH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,QAAQ;YACR,WAAW;YACX,aAAa;YACb,mBAAmB;YACnB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;YACtB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;SACvB;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAK7C;IACC,OAAO,sBAAsB,CAAC;QAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,cAAc,EAAE,KAAK,CAAC,aAAa;KACpC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1C,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC;QACzB,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,wBAAwB;QACpC,aAAa,EAAE,OAAO;QACtB,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAA4B;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IAE5F,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IACzF,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA4B;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAqB;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAID;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,4EAA4E;IAC5E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACtF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,oBAAoB;AACpB,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;AAE5E,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACtD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,oBAAoB,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC,CAAE,MAAM,CAAC,eAAe,CAAe;QACxC,CAAC,CAAC,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ;YAC1C,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1B,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,UAAU,+BAA+B,CAAC,GAAmB,EAAE,OAAe;IAClF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,GAAmB,EAAE,OAAe;IACpF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAyC,EACzC,GAAmB;IAEnB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACxG,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,KAAK,EAAE,sBAAsB;YAC7B,iBAAiB,EAAE,8DAA8D;SAClF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;IACtE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,MAAM;QAClC,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,WAAmB;IAC3D,QAAQ,CACN,GAAG,EACH,GAAG,EACH,wGAAwG;QACtG,uFAAuF;QACvF,6CAA6C,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM;QACpF,oEAAoE,CACvE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAyC,EACzC,GAAmB,EACnB,KAAyC;IAEzC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;QAC9B,QAAQ,CACN,GAAG,EACH,GAAG,EACH,iBAAiB,CAAC;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,gDAAgD;IAChD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IAE9B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAQ,EAAE,CACvC,QAAQ,CACN,GAAG,EACH,GAAG,EACH,iBAAiB,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK;KACN,CAAC,CACH,CAAC;IAEJ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,+EAA+E,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,QAAQ,CAAC,sEAAsE,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC;QACzC,GAAG;QACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAyC,EACzC,GAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,MAAqB,CAAC;QAC1B,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACzC,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,2BAA2B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YAChC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC"}

package/dist/oauth/metadata.d.ts

@@ -0,0 +1,29 @@
+/**
+ * OAuth discovery documents.
+ *
+ * Claude's browser connector bootstraps the flow by fetching:
+ *   1. /.well-known/oauth-protected-resource   (RFC 9728) — points at the AS
+ *   2. /.well-known/oauth-authorization-server (RFC 8414) — lists endpoints
+ *
+ * For a single-origin server like ours, the protected resource and the
+ * authorization server are the same origin.
+ */
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+}
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    scopes_supported: string[];
+}
+export declare function protectedResourceMetadata(baseUrl: string): ProtectedResourceMetadata;
+export declare function authorizationServerMetadata(baseUrl: string): AuthorizationServerMetadata;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/oauth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,yBAAyB,CAMpF;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,2BAA2B,CAaxF"}

package/dist/oauth/metadata.js

@@ -0,0 +1,33 @@
+/**
+ * OAuth discovery documents.
+ *
+ * Claude's browser connector bootstraps the flow by fetching:
+ *   1. /.well-known/oauth-protected-resource   (RFC 9728) — points at the AS
+ *   2. /.well-known/oauth-authorization-server (RFC 8414) — lists endpoints
+ *
+ * For a single-origin server like ours, the protected resource and the
+ * authorization server are the same origin.
+ */
+import { SCOPE } from './config.js';
+export function protectedResourceMetadata(baseUrl) {
+    return {
+        resource: baseUrl,
+        authorization_servers: [baseUrl],
+        scopes_supported: [SCOPE],
+    };
+}
+export function authorizationServerMetadata(baseUrl) {
+    return {
+        issuer: baseUrl,
+        authorization_endpoint: `${baseUrl}/authorize`,
+        token_endpoint: `${baseUrl}/token`,
+        registration_endpoint: `${baseUrl}/register`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        // Public client + PKCE. We do not issue client secrets.
+        token_endpoint_auth_methods_supported: ['none'],
+        scopes_supported: [SCOPE],
+    };
+}
+//# sourceMappingURL=metadata.js.map

package/dist/oauth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAoBpC,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,qBAAqB,EAAE,CAAC,OAAO,CAAC;QAChC,gBAAgB,EAAE,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,OAAO;QACL,MAAM,EAAE,OAAO;QACf,sBAAsB,EAAE,GAAG,OAAO,YAAY;QAC9C,cAAc,EAAE,GAAG,OAAO,QAAQ;QAClC,qBAAqB,EAAE,GAAG,OAAO,WAAW;QAC5C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,wDAAwD;QACxD,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC"}

package/dist/tools/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/tools/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,KAAK,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAErF,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,qDAAqD;IACrD,UAAU,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACpE,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;IAC/B,WAAW,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;CACjE;AAKD,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CA2VjD,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,iBAAiB,CAC/B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/tools/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,KAAK,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAErF,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,qDAAqD;IACrD,UAAU,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACpE,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;IAC/B,WAAW,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;CACjE;AAKD,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAoXjD,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,iBAAiB,CAC/B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB"}

package/dist/tools/registry.js

@@ -79,21 +79,31 @@ export const RESOURCES = {
             descriptionJson: { type: 'json', description: 'Plate JSON for internal editor', nullable: true },
             descriptionClientJson: { type: 'json', description: 'Plate JSON for client editor', nullable: true },
             clientViewLocked: { type: 'boolean', description: 'Lock client view from auto-regen' },
-            status: { type: 'enum', description: 'Task status', filterable: true, enumValues: ['backlog', 'todo', 'in_progress', 'in_review', 'blocked', 'done', 'cancelled'] },
+            status: { type: 'enum', description: 'Task status', filterable: true, enumValues: ['backlog', 'todo', 'in_progress', 'review', 'production_ready', 'blocked', 'done', 'cancelled'] },
+            taskType: { type: 'enum', description: 'Conventional-commit type', filterable: true, nullable: true, enumValues: ['feat', 'fix', 'chore', 'refactor', 'docs', 'test'] },
             projectId: { type: 'uuid', description: 'Parent project', filterable: true },
+            sprintId: { type: 'uuid', description: 'Parent sprint', filterable: true, nullable: true },
             milestoneId: { type: 'uuid', description: 'Parent milestone', filterable: true, nullable: true },
+            parentTaskId: { type: 'uuid', description: 'Parent task (for subtasks)', filterable: true, nullable: true },
             assigneeId: { type: 'uuid', description: 'Assigned user', filterable: true, nullable: true },
             portalAssigneeId: { type: 'uuid', description: 'Portal-user assignee', nullable: true },
+            clientCompanyId: { type: 'uuid', description: 'Client company override', nullable: true },
             priorityMoscow: { type: 'enum', description: 'MoSCoW priority', filterable: true, enumValues: ['must', 'should', 'could', 'wont'] },
+            priorityScore: { type: 'number', description: 'Priority score (0-100)' },
+            effortLevel: { type: 'enum', description: 'Effort estimate', filterable: true, nullable: true, enumValues: ['xs', 's', 'sm', 'm', 'ml', 'l', 'xl'] },
+            impactLevel: { type: 'enum', description: 'Impact estimate', filterable: true, nullable: true, enumValues: ['none', 'very_low', 'low', 'medium', 'high', 'very_high', 'maximum'] },
+            sizeEstimate: { type: 'enum', description: 'T-shirt size estimate', nullable: true, enumValues: ['xs', 's', 'm', 'l', 'xl'] },
             storyPoints: { type: 'number', description: 'Story points (0-100)' },
             estimatedHours: { type: 'number', description: 'Estimated hours' },
             actualHoursDelta: { type: 'number', description: 'Additive hours increment. actual_hours += delta' },
             isBillable: { type: 'boolean', description: 'Whether task is billable', filterable: true },
+            category: { type: 'string', description: 'Free-text category', filterable: true, nullable: true },
             dueDate: { type: 'date', description: 'Due date (ISO 8601)', filterable: true, nullable: true },
             startDate: { type: 'date', description: 'Start date (ISO 8601)', nullable: true },
             completedAt: { type: 'date', description: 'Completion timestamp (auto-set on done)', nullable: true },
             completedBy: { type: 'uuid', description: 'User who completed', nullable: true },
             tags: { type: 'json', description: 'Array of string tags' },
+            pillarTags: { type: 'json', description: 'Array of pillar tag strings' },
         },
     },
     task_comments: {
@@ -195,6 +205,8 @@ export const RESOURCES = {
             product_id: { type: 'uuid', description: 'Linked product UUID', nullable: true },
             task_ids: { type: 'json', description: 'Array of task UUIDs (max 100)', nullable: true },
             operator_iam_user_id: { type: 'uuid', description: 'Operator IAM user UUID', nullable: true },
+            client_id: { type: 'uuid', description: 'DainOS client company UUID (crm.companies.id)', nullable: true },
+            project_ids: { type: 'json', description: 'Array of DainOS project UUIDs', nullable: true },
         },
     },
     developer_changelog: {
@@ -220,18 +232,27 @@ export const RESOURCES = {
             pr_number: { type: 'number', description: 'PR number', nullable: true },
             pr_url: { type: 'string', description: 'PR URL', nullable: true },
             tags: { type: 'json', description: 'Array of string tags', nullable: true },
+            client_id: { type: 'uuid', description: 'DainOS client company UUID (crm.companies.id)', nullable: true },
+            project_ids: { type: 'json', description: 'Array of DainOS project UUIDs', nullable: true },
+            task_ids: { type: 'json', description: 'Array of DainOS task UUIDs', nullable: true },
         },
     },
     developer_knowledge_base: {
         basePath: '/developer/knowledge-base',
-        description: 'Dev knowledge base: gotchas, patterns, lessons, decisions, workarounds. For batch-inserting use log_knowledge_base_entry.',
+        description: 'Dev knowledge base: gotchas, patterns, lessons, decisions, workarounds. ' +
+            'Read with query — pass `search` for free-text (whitespace terms are ANDed across title+description), ' +
+            'or omit it to list recent entries. The `project` filter is OPTIONAL: omit it to search across ALL projects. ' +
+            'When you do pass `project` it must be a real slug (e.g. "dain-os", "herbert") — an unknown value returns a 422 ' +
+            'listing the valid slugs, not an empty result. Max 50 per call. For batch-inserting use log_knowledge_base_entry.',
         searchable: true,
         searchPath: '/developer/knowledge-base/search',
         updateMethod: 'PATCH',
-        operations: ['update'],
+        operations: ['list', 'update'],
+        defaultLimit: 10,
+        maxLimit: 50,
         fields: {
             id: { type: 'uuid', description: 'Entry ID', writable: false },
-            project: { type: 'string', description: 'Project slug', filterable: true },
+            project: { type: 'string', description: 'Project slug, e.g. "dain-os". OPTIONAL filter — omit to search all projects. Unknown slug returns a 422 with the valid list.', filterable: true },
             module: { type: 'string', description: 'Code module', filterable: true },
             category: { type: 'enum', description: 'Entry category', filterable: true, enumValues: ['gotcha', 'pattern', 'lesson', 'decision', 'workaround'] },
             severity: { type: 'enum', description: 'Severity', filterable: true, enumValues: ['critical', 'high', 'medium', 'low'] },
@@ -243,6 +264,9 @@ export const RESOURCES = {
             source_refs: { type: 'json', description: 'Array of links/paths', nullable: true },
             tags: { type: 'json', description: 'Array of tags', nullable: true },
             platform: { type: 'string', description: 'e.g. "supabase"', nullable: true },
+            client_id: { type: 'uuid', description: 'DainOS client company UUID (crm.companies.id)', nullable: true },
+            project_ids: { type: 'json', description: 'Array of DainOS project UUIDs', nullable: true },
+            task_ids: { type: 'json', description: 'Array of DainOS task UUIDs', nullable: true },
         },
     },
     // ── IAM ───────────────────────────────────────────────────────────