@forumone/throughline 2.2.0 → 2.3.0-pr-315-e1a501e

package/dist/mcp-oauth/metadata.js

@@ -0,0 +1,84 @@
+/*
+The two discovery documents, and the exact values clients check.
+
+A client finds everything from the `401` on `/api/mcp`: its `WWW-Authenticate`
+points at the protected-resource metadata (RFC 9728), which names this site as
+the authorization server, whose own metadata (RFC 8414) lists the endpoints.
+
+What each client is strict about, from their documentation:
+
+- Claude uses only the **first** `authorization_servers` entry, and requires
+  `resource` to equal the URL the person typed, path included.
+- Claude picks a client ID metadata document (CIMD) only when **both**
+  `client_id_metadata_document_supported` and `"none"` among the token
+  endpoint's auth methods are present; otherwise it registers (DCR).
+- ChatGPT uses its stable callback only when the authorization response carries
+  `iss` (RFC 9207), and compares it to `issuer` byte for byte.
+- Both append `offline_access` to the scopes when it is listed, which is what
+  gets them a refresh token.
+*/
+export const MCP_SCOPE = 'mcp';
+export function authorizationServerMetadata(runtime) {
+    return {
+        issuer: runtime.issuer,
+        authorization_endpoint: runtime.endpoint('authorize'),
+        token_endpoint: runtime.endpoint('token'),
+        registration_endpoint: runtime.endpoint('register'),
+        revocation_endpoint: runtime.endpoint('revoke'),
+        response_types_supported: ['code'],
+        response_modes_supported: ['query'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        token_endpoint_auth_methods_supported: ['none'],
+        revocation_endpoint_auth_methods_supported: ['none'],
+        code_challenge_methods_supported: ['S256'],
+        scopes_supported: [MCP_SCOPE, 'offline_access'],
+        client_id_metadata_document_supported: true,
+        authorization_response_iss_parameter_supported: true,
+    };
+}
+export function protectedResourceMetadata(runtime) {
+    return {
+        resource: runtime.resource,
+        authorization_servers: [runtime.issuer],
+        bearer_methods_supported: ['header'],
+        scopes_supported: [MCP_SCOPE],
+        resource_name: runtime.serverName,
+    };
+}
+/** Where the protected-resource metadata is served. */
+export function protectedResourceMetadataUrl(runtime) {
+    return `${runtime.origin}/.well-known/oauth-protected-resource${new URL(runtime.resource).pathname}`;
+}
+/**
+ * Rewrites for `next.config`, so the well-known paths at the root reach the
+ * endpoints Payload serves under its API route. Payload only routes under
+ * `/api`; RFC 8414 and RFC 9728 put discovery at `/.well-known`.
+ *
+ * ```js
+ * async rewrites() {
+ *   return mcpOAuthRewrites()
+ * }
+ * ```
+ */
+export function mcpOAuthRewrites({ apiRoute = '/api' } = {}) {
+    const api = apiRoute.replace(/\/+$/, '');
+    return [
+        {
+            source: '/.well-known/oauth-protected-resource',
+            destination: `${api}/oauth/protected-resource`,
+        },
+        {
+            source: '/.well-known/oauth-protected-resource/:path*',
+            destination: `${api}/oauth/protected-resource`,
+        },
+        {
+            source: '/.well-known/oauth-authorization-server',
+            destination: `${api}/oauth/metadata`,
+        },
+        {
+            source: '/.well-known/oauth-authorization-server/:path*',
+            destination: `${api}/oauth/metadata`,
+        },
+    ];
+}
+//# sourceMappingURL=metadata.js.map

package/dist/mcp-oauth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/mcp-oauth/metadata.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;EAkBE;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAA;AAE9B,MAAM,UAAU,2BAA2B,CAAC,OAAwB;IAClE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,sBAAsB,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrD,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzC,qBAAqB,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnD,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;QACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,0CAA0C,EAAE,CAAC,MAAM,CAAC;QACpD,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,gBAAgB,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC;QAC/C,qCAAqC,EAAE,IAAI;QAC3C,8CAA8C,EAAE,IAAI;KACrD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAwB;IAChE,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,gBAAgB,EAAE,CAAC,SAAS,CAAC;QAC7B,aAAa,EAAE,OAAO,CAAC,UAAU;KAClC,CAAA;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,4BAA4B,CAAC,OAAwB;IACnE,OAAO,GAAG,OAAO,CAAC,MAAM,wCAAwC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;AACtG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,QAAQ,GAAG,MAAM,KAA4B,EAAE;IAChF,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACxC,OAAO;QACL;YACE,MAAM,EAAE,uCAAuC;YAC/C,WAAW,EAAE,GAAG,GAAG,2BAA2B;SAC/C;QACD;YACE,MAAM,EAAE,8CAA8C;YACtD,WAAW,EAAE,GAAG,GAAG,2BAA2B;SAC/C;QACD;YACE,MAAM,EAAE,yCAAyC;YACjD,WAAW,EAAE,GAAG,GAAG,iBAAiB;SACrC;QACD;YACE,MAAM,EAAE,gDAAgD;YACxD,WAAW,EAAE,GAAG,GAAG,iBAAiB;SACrC;KACF,CAAA;AACH,CAAC"}

package/dist/mcp-oauth/plugin.d.ts

@@ -0,0 +1,37 @@
+import type { Plugin } from 'payload';
+import { type OverrideAuth } from './auth.js';
+import { type EndpointOptions } from './endpoints.js';
+import { type McpOAuthOptions, type McpOAuthRuntime } from './runtime.js';
+export declare const CONNECT_MCP_VIEW_PATH = "@forumone/throughline/rsc#ConnectMcpView";
+export declare const MCP_AUTHORIZE_VIEW_PATH = "@forumone/throughline/rsc#McpAuthorizeView";
+export interface McpOAuth {
+    /** Registers the endpoints, the collections, the policy and the admin pages. */
+    plugin: Plugin;
+    /** For `mcpPlugin({ overrideAuth })`. */
+    overrideAuth: OverrideAuth;
+    runtime: McpOAuthRuntime;
+}
+/**
+ * OAuth sign-in for `/api/mcp`: a person adds the server's URL to Claude or
+ * ChatGPT, signs in to the admin as themselves, and allows the connection. No
+ * key to copy.
+ *
+ * ```ts
+ * const oauth = mcpOAuth({ serverURL, serverName: 'Example', tools: mcpTools, prompts: mcpPrompts,
+ *   isAdmin, eligible })
+ *
+ * plugins: [
+ *   ...throughline plugins,           // declare the tools first
+ *   oauth.plugin,
+ *   mcpPlugin({ mcp: { tools: mcpTools, prompts: mcpPrompts }, overrideAuth: oauth.overrideAuth }),
+ * ]
+ * ```
+ *
+ * And in `next.config`, `rewrites: async () => mcpOAuthRewrites()`, so the
+ * discovery documents are found at `/.well-known`.
+ *
+ * API keys keep working beside it: a bearer token that is not one of these is
+ * handed to the plugin's own key lookup.
+ */
+export declare function mcpOAuth(options: McpOAuthOptions, endpointOptions?: EndpointOptions): McpOAuth;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/mcp-oauth/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/mcp-oauth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,SAAS,CAAA;AAE7C,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,WAAW,CAAA;AAEjE,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrE,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAA;AAErB,eAAO,MAAM,qBAAqB,6CAA6C,CAAA;AAC/E,eAAO,MAAM,uBAAuB,+CAA+C,CAAA;AAEnF,MAAM,WAAW,QAAQ;IACvB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAA;IACd,yCAAyC;IACzC,YAAY,EAAE,YAAY,CAAA;IAC1B,OAAO,EAAE,eAAe,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,eAAe,EACxB,eAAe,GAAE,eAAoB,GACpC,QAAQ,CAiEV"}

package/dist/mcp-oauth/plugin.js

@@ -0,0 +1,90 @@
+import { REPORTS_NAV_PATH } from '../editorial/plugin.js';
+import { createOverrideAuth } from './auth.js';
+import { accessGlobal, clientsCollection, grantsCollection } from './collections.js';
+import { oauthEndpoints } from './endpoints.js';
+import { createRuntime, MCP_OAUTH_CUSTOM_KEY, } from './runtime.js';
+export const CONNECT_MCP_VIEW_PATH = '@forumone/throughline/rsc#ConnectMcpView';
+export const MCP_AUTHORIZE_VIEW_PATH = '@forumone/throughline/rsc#McpAuthorizeView';
+/**
+ * OAuth sign-in for `/api/mcp`: a person adds the server's URL to Claude or
+ * ChatGPT, signs in to the admin as themselves, and allows the connection. No
+ * key to copy.
+ *
+ * ```ts
+ * const oauth = mcpOAuth({ serverURL, serverName: 'Example', tools: mcpTools, prompts: mcpPrompts,
+ *   isAdmin, eligible })
+ *
+ * plugins: [
+ *   ...throughline plugins,           // declare the tools first
+ *   oauth.plugin,
+ *   mcpPlugin({ mcp: { tools: mcpTools, prompts: mcpPrompts }, overrideAuth: oauth.overrideAuth }),
+ * ]
+ * ```
+ *
+ * And in `next.config`, `rewrites: async () => mcpOAuthRewrites()`, so the
+ * discovery documents are found at `/.well-known`.
+ *
+ * API keys keep working beside it: a bearer token that is not one of these is
+ * handed to the plugin's own key lookup.
+ */
+export function mcpOAuth(options, endpointOptions = {}) {
+    const runtime = createRuntime(options);
+    const plugin = (incoming) => {
+        /*
+        The tool names are read now, not when `mcpOAuth` was called: the modules
+        declare theirs while the config is built, so this plugin has to come after
+        them, and an empty list here means it did not.
+        */
+        if (runtime.tools.length === 0) {
+            throw new Error('mcpOAuth(): no MCP tools had been declared when its plugin ran. Register it after the plugins that declare tools (throughline()), and hand it the same array mcpPlugin serves.');
+        }
+        const served = new Set(runtime.tools.map((tool) => tool.name));
+        runtime.defaults.editorTools = runtime.defaults.editorTools.filter((name) => served.has(name));
+        const group = options.adminGroup ?? 'Admin';
+        const views = incoming.admin?.components?.views ?? {};
+        return {
+            ...incoming,
+            collections: [
+                ...(incoming.collections ?? []),
+                clientsCollection(runtime, group),
+                grantsCollection(runtime, group),
+            ],
+            globals: [...(incoming.globals ?? []), accessGlobal(runtime, group)],
+            endpoints: [...(incoming.endpoints ?? []), ...oauthEndpoints(runtime, endpointOptions)],
+            admin: {
+                ...incoming.admin,
+                components: {
+                    ...incoming.admin?.components,
+                    views: {
+                        ...views,
+                        connectMcp: {
+                            Component: CONNECT_MCP_VIEW_PATH,
+                            path: runtime.connectPath,
+                            exact: true,
+                            meta: { title: 'Connect MCP' },
+                        },
+                        mcpAuthorize: {
+                            Component: MCP_AUTHORIZE_VIEW_PATH,
+                            path: `${runtime.connectPath}/authorize`,
+                            exact: true,
+                            meta: { title: `Connect an app to ${runtime.serverName}` },
+                        },
+                    },
+                    afterNavLinks: [
+                        ...(incoming.admin?.components?.afterNavLinks ?? []),
+                        {
+                            path: REPORTS_NAV_PATH,
+                            clientProps: {
+                                label: 'MCP',
+                                reports: [{ path: runtime.connectPath, label: 'Connect MCP' }],
+                            },
+                        },
+                    ],
+                },
+            },
+            custom: { ...incoming.custom, [MCP_OAUTH_CUSTOM_KEY]: runtime },
+        };
+    };
+    return { plugin, overrideAuth: createOverrideAuth(runtime), runtime };
+}
+//# sourceMappingURL=plugin.js.map

package/dist/mcp-oauth/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/mcp-oauth/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACpF,OAAO,EAAE,cAAc,EAAwB,MAAM,gBAAgB,CAAA;AACrE,OAAO,EACL,aAAa,EACb,oBAAoB,GAGrB,MAAM,cAAc,CAAA;AAErB,MAAM,CAAC,MAAM,qBAAqB,GAAG,0CAA0C,CAAA;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,4CAA4C,CAAA;AAUnF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAwB,EACxB,kBAAmC,EAAE;IAErC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAEtC,MAAM,MAAM,GAAW,CAAC,QAAgB,EAAU,EAAE;QAClD;;;;UAIE;QACF,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,gLAAgL,CACjL,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QAE9F,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAA;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAA;QAErD,OAAO;YACL,GAAG,QAAQ;YACX,WAAW,EAAE;gBACX,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC;gBACjC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;aACjC;YACD,OAAO,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpE,SAAS,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACvF,KAAK,EAAE;gBACL,GAAG,QAAQ,CAAC,KAAK;gBACjB,UAAU,EAAE;oBACV,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU;oBAC7B,KAAK,EAAE;wBACL,GAAG,KAAK;wBACR,UAAU,EAAE;4BACV,SAAS,EAAE,qBAAqB;4BAChC,IAAI,EAAE,OAAO,CAAC,WAA2B;4BACzC,KAAK,EAAE,IAAI;4BACX,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;yBAC/B;wBACD,YAAY,EAAE;4BACZ,SAAS,EAAE,uBAAuB;4BAClC,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,YAA4B;4BACxD,KAAK,EAAE,IAAI;4BACX,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,OAAO,CAAC,UAAU,EAAE,EAAE;yBAC3D;qBACF;oBACD,aAAa,EAAE;wBACb,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC;wBACpD;4BACE,IAAI,EAAE,gBAAgB;4BACtB,WAAW,EAAE;gCACX,KAAK,EAAE,KAAK;gCACZ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;6BAC/D;yBACF;qBACF;iBACF;aACF;YACD,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE;SAChE,CAAA;IACH,CAAC,CAAA;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;AACvE,CAAC"}

package/dist/mcp-oauth/runtime.d.ts

@@ -0,0 +1,124 @@
+import type { Payload } from 'payload';
+import { type McpClientKind } from './clients.js';
+export declare const MCP_OAUTH_CLIENTS_SLUG = "mcp-oauth-clients";
+export declare const MCP_OAUTH_GRANTS_SLUG = "mcp-oauth-grants";
+export declare const MCP_ACCESS_SLUG = "mcp-access";
+/** The strategy name a person signed in through an OAuth token carries. */
+export declare const MCP_OAUTH_STRATEGY = "mcp-oauth";
+type UserDoc = Record<string, unknown>;
+export interface McpOAuthOptions {
+    /**
+     * The site's public origin, e.g. `https://www.example.com`. The issuer, the
+     * MCP resource and every endpoint are built from it, and a client compares
+     * them byte for byte, so it must be the host people actually use: not an
+     * alias that redirects, and not a deployment URL.
+     */
+    serverURL: string;
+    /** The site's name, as the consent screen and the Connect MCP page say it. */
+    serverName: string;
+    /** The tools `plugin-mcp` serves: the same array the host hands `mcpPlugin`. */
+    tools: readonly {
+        name: string;
+    }[];
+    /** The prompts it serves. Everybody who may connect is offered all of them. */
+    prompts?: readonly {
+        name: string;
+    }[];
+    /** An administrator: chooses the policy, sees every connection, revokes any. */
+    isAdmin: (user: UserDoc) => boolean;
+    /**
+     * Who may connect at all: `true`, or the reason they may not. Asked at
+     * consent, at every token refresh and on every MCP request, so somebody who
+     * loses the role loses the connection with it.
+     */
+    eligible: (user: UserDoc) => true | string;
+    /**
+     * The tools a non-administrator is offered until an administrator changes
+     * it. Defaults to the authoring tools.
+     */
+    editorTools?: readonly string[];
+    /** Which apps may connect until an administrator changes it. Each defaults on. */
+    clients?: Partial<Record<McpClientKind, boolean>>;
+    /**
+     * How people add the server to Claude. `organization` when a Team or
+     * Enterprise Owner has added it for everybody, so members only click
+     * Connect; `personal` (the default) when each person adds it themselves, and
+     * the page links to Claude's add-connector form with the URL filled in.
+     */
+    claudeConnector?: 'organization' | 'personal';
+    /**
+     * The name Claude Code gives the server in the command the Connect MCP page
+     * shows. Defaults to `serverName`, lowercased and hyphenated.
+     */
+    claudeCodeName?: string;
+    /** Default `/api`. */
+    apiRoute?: string;
+    /** Where `plugin-mcp` serves, under `apiRoute`. Default `/mcp`. */
+    mcpPath?: string;
+    /** Default `users`. */
+    users?: string;
+    /** The admin sidebar group for the two collections. Default `Admin`. */
+    adminGroup?: string;
+    /** The Connect MCP page, under the admin route. Default `/connect-mcp`. */
+    connectPath?: string;
+    /** Seconds. Default an hour. */
+    accessTokenTtl?: number;
+    /** Seconds since last use. Default thirty days. */
+    refreshTokenTtl?: number;
+    /**
+     * Also ask `eligible` of the person behind an API key, on every request.
+     * Default true: an API key's holder is otherwise checked only when the key is
+     * made.
+     */
+    recheckApiKeyHolders?: boolean;
+}
+export interface McpOAuthRuntime {
+    serverName: string;
+    claudeConnector: 'organization' | 'personal';
+    claudeCodeName: string;
+    origin: string;
+    issuer: string;
+    resource: string;
+    apiRoute: string;
+    users: string;
+    connectPath: string;
+    accessTokenTtl: number;
+    refreshTokenTtl: number;
+    recheckApiKeyHolders: boolean;
+    isAdmin: (user: UserDoc) => boolean;
+    eligible: (user: UserDoc) => true | string;
+    defaults: {
+        clients: Record<McpClientKind, boolean>;
+        editorTools: readonly string[];
+    };
+    tools: readonly {
+        name: string;
+    }[];
+    prompts: readonly {
+        name: string;
+    }[];
+    endpoint: (name: string) => string;
+}
+export declare const MCP_OAUTH_CUSTOM_KEY = "throughline:mcp-oauth";
+export declare function createRuntime(options: McpOAuthOptions): McpOAuthRuntime;
+/** The runtime `mcpOAuth` stored on the config, for the views. */
+export declare function mcpOAuthRuntime(config: {
+    custom?: Record<string, unknown>;
+}): McpOAuthRuntime;
+export declare function keys(payload: Pick<Payload, 'secret'>): {
+    token: Buffer<ArrayBufferLike>;
+    request: Buffer<ArrayBufferLike>;
+};
+export interface McpAccessPolicy {
+    clients: Record<McpClientKind, boolean>;
+    editorTools: string[];
+    adminAllTools: boolean;
+    adminTools: string[];
+}
+export declare function readPolicy(payload: Payload, runtime: McpOAuthRuntime): Promise<McpAccessPolicy>;
+/** The tools a person is offered under a policy, by served name. */
+export declare function toolsFor(user: UserDoc, policy: McpAccessPolicy, runtime: Pick<McpOAuthRuntime, 'isAdmin' | 'tools'>): string[];
+/** `plugin-mcp`'s key for a tool or prompt name. Its own `toCamelCase`. */
+export declare function toCamelCase(value: string): string;
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/mcp-oauth/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/mcp-oauth/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAGnE,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AACzD,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AACvD,eAAO,MAAM,eAAe,eAAe,CAAA;AAE3C,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,cAAc,CAAA;AAE7C,KAAK,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEtC,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,KAAK,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAClC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACrC,gFAAgF;IAChF,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAA;IACnC;;;;OAIG;IACH,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,CAAA;IAC1C;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAA;IACjD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,cAAc,GAAG,UAAU,CAAA;IAC7C;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gCAAgC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,cAAc,GAAG,UAAU,CAAA;IAC5C,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAA;IACnC,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,CAAA;IAC1C,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IACrF,KAAK,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAClC,OAAO,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACpC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CACnC;AAED,eAAO,MAAM,oBAAoB,0BAA0B,CAAA;AAW3D,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,CAsCvE;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,eAAe,CAI7F;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;;;EAKpD;AAWD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACvC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,aAAa,EAAE,OAAO,CAAA;IACtB,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,eAAe,CAAC,CAgC1B;AAED,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,OAAO,CAAC,GAClD,MAAM,EAAE,CAOV;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjD"}

package/dist/mcp-oauth/runtime.js

@@ -0,0 +1,111 @@
+import { AUTHORING_TOOL_DESCRIPTORS } from '../authoring/descriptors.js';
+import { MCP_CLIENT_KINDS } from './clients.js';
+import { deriveKey } from './crypto.js';
+export const MCP_OAUTH_CLIENTS_SLUG = 'mcp-oauth-clients';
+export const MCP_OAUTH_GRANTS_SLUG = 'mcp-oauth-grants';
+export const MCP_ACCESS_SLUG = 'mcp-access';
+/** The strategy name a person signed in through an OAuth token carries. */
+export const MCP_OAUTH_STRATEGY = 'mcp-oauth';
+export const MCP_OAUTH_CUSTOM_KEY = 'throughline:mcp-oauth';
+function slug(name) {
+    return (name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '') || 'site');
+}
+export function createRuntime(options) {
+    let origin;
+    try {
+        origin = new URL(options.serverURL).origin;
+    }
+    catch {
+        throw new Error(`mcpOAuth(): serverURL "${options.serverURL}" is not a URL.`);
+    }
+    const apiRoute = (options.apiRoute ?? '/api').replace(/\/+$/, '');
+    const mcpPath = options.mcpPath ?? '/mcp';
+    const served = new Set(options.tools.map((tool) => tool.name));
+    const authoring = AUTHORING_TOOL_DESCRIPTORS.map((tool) => tool.name);
+    return {
+        serverName: options.serverName,
+        claudeConnector: options.claudeConnector ?? 'personal',
+        claudeCodeName: options.claudeCodeName ?? slug(options.serverName),
+        origin,
+        issuer: origin,
+        resource: `${origin}${apiRoute}${mcpPath}`,
+        apiRoute,
+        users: options.users ?? 'users',
+        connectPath: options.connectPath ?? '/connect-mcp',
+        accessTokenTtl: options.accessTokenTtl ?? 60 * 60,
+        refreshTokenTtl: options.refreshTokenTtl ?? 30 * 24 * 60 * 60,
+        recheckApiKeyHolders: options.recheckApiKeyHolders ?? true,
+        isAdmin: options.isAdmin,
+        eligible: options.eligible,
+        defaults: {
+            clients: Object.fromEntries(MCP_CLIENT_KINDS.map((kind) => [kind, options.clients?.[kind] ?? true])),
+            editorTools: options.editorTools ?? authoring.filter((name) => served.size === 0 || served.has(name)),
+        },
+        tools: options.tools,
+        prompts: options.prompts ?? [],
+        endpoint: (name) => `${origin}${apiRoute}/oauth/${name}`,
+    };
+}
+/** The runtime `mcpOAuth` stored on the config, for the views. */
+export function mcpOAuthRuntime(config) {
+    const runtime = config.custom?.[MCP_OAUTH_CUSTOM_KEY];
+    if (!runtime)
+        throw new Error('mcpOAuth() is not registered in this Payload config.');
+    return runtime;
+}
+export function keys(payload) {
+    return {
+        token: deriveKey(payload.secret, 'token'),
+        request: deriveKey(payload.secret, 'request'),
+    };
+}
+export async function readPolicy(payload, runtime) {
+    let doc;
+    try {
+        doc = (await payload.findGlobal({
+            slug: MCP_ACCESS_SLUG,
+            depth: 0,
+            overrideAccess: true,
+        }));
+    }
+    catch {
+        doc = {};
+    }
+    const clients = (doc['clients'] ?? {});
+    const editors = (doc['editors'] ?? {});
+    const admins = (doc['admins'] ?? {});
+    const names = (value, fallback) => Array.isArray(value)
+        ? value.filter((each) => typeof each === 'string')
+        : [...fallback];
+    return {
+        clients: Object.fromEntries(MCP_CLIENT_KINDS.map((kind) => [
+            kind,
+            typeof clients[kind] === 'boolean'
+                ? clients[kind]
+                : runtime.defaults.clients[kind],
+        ])),
+        editorTools: names(editors['tools'], runtime.defaults.editorTools),
+        adminAllTools: typeof admins['allTools'] === 'boolean' ? admins['allTools'] : true,
+        adminTools: names(admins['tools'], []),
+    };
+}
+/** The tools a person is offered under a policy, by served name. */
+export function toolsFor(user, policy, runtime) {
+    const served = runtime.tools.map((tool) => tool.name);
+    if (runtime.isAdmin(user)) {
+        if (policy.adminAllTools)
+            return served;
+        return served.filter((name) => policy.adminTools.includes(name));
+    }
+    return served.filter((name) => policy.editorTools.includes(name));
+}
+/** `plugin-mcp`'s key for a tool or prompt name. Its own `toCamelCase`. */
+export function toCamelCase(value) {
+    return value
+        .replace(/[-_\s]+(.)?/g, (_, chr) => (chr ? chr.toUpperCase() : ''))
+        .replace(/^(.)/, (_, chr) => chr.toLowerCase());
+}
+//# sourceMappingURL=runtime.js.map

package/dist/mcp-oauth/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/mcp-oauth/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAsB,MAAM,cAAc,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAA;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAA;AAE3C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAwF7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAA;AAE3D,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,CACL,IAAI;SACD,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CACrC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,SAAS,iBAAiB,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAA;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAErE,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,UAAU;QACtD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAClE,MAAM;QACN,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,EAAE;QAC1C,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;QAC/B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,cAAc;QAClD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,GAAG,EAAE;QACjD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QAC7D,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,IAAI;QAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE;YACR,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CACtC;YACnC,WAAW,EACT,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAC3F;QACD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,QAAQ,UAAU,IAAI,EAAE;KACzD,CAAA;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,MAA4C;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAgC,CAAA;IACpF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACrF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAgC;IACnD,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;QACzC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;KAC9C,CAAA;AACH,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAgB,EAChB,OAAwB;IAExB,IAAI,GAA4B,CAAA;IAChC,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC;YAC9B,IAAI,EAAE,eAAwB;YAC9B,KAAK,EAAE,CAAC;YACR,cAAc,EAAE,IAAI;SACrB,CAAC,CAAuC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAA;IACjE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAA;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;IAC/D,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,QAA2B,EAAE,EAAE,CAC5D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAClB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAA;IAEnB,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7B,IAAI;YACJ,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;gBAChC,CAAC,CAAE,OAAO,CAAC,IAAI,CAAa;gBAC5B,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACnC,CAAC,CAC+B;QACnC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClE,aAAa,EAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAE,MAAM,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,IAAI;QAC/F,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;KACvC,CAAA;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CACtB,IAAa,EACb,MAAuB,EACvB,OAAmD;IAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,aAAa;YAAE,OAAO,MAAM,CAAA;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AACnE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,GAAuB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACvF,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;AAC3D,CAAC"}

package/dist/mcp-oauth/store.d.ts

@@ -0,0 +1,75 @@
+import type { Payload } from 'payload';
+import { type FetchLike } from './cimd.js';
+import { type McpClientKind } from './clients.js';
+import { type McpAccessPolicy, type McpOAuthRuntime } from './runtime.js';
+type Doc = Record<string, unknown>;
+export interface ClientRecord {
+    id: number | string;
+    clientId: string;
+    name?: string;
+    kind: McpClientKind;
+    method: 'dcr' | 'cimd';
+    redirectUris: string[];
+}
+/**
+ * A registration request's client, registered — or the one already registered
+ * with the same name and redirects. Registering is unauthenticated by design
+ * (RFC 7591), so identical requests share a row rather than each adding one.
+ */
+export declare function registerClient(payload: Payload, policy: McpAccessPolicy, request: {
+    redirectUris: unknown[];
+    name?: string;
+}): Promise<ClientRecord | {
+    error: string;
+}>;
+/**
+ * The client a `client_id` names: a registered one, or a metadata document,
+ * fetched (and cached for a day) and held to the same allowlist.
+ */
+export declare function resolveClient(payload: Payload, policy: McpAccessPolicy, clientId: unknown, fetchImpl?: FetchLike): Promise<ClientRecord | {
+    error: string;
+}>;
+export interface PendingRequest {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    state?: string;
+}
+/** Consent: a pending grant and the code that completes it. */
+export declare function createPendingGrant(payload: Payload, user: Doc, client: ClientRecord, request: PendingRequest): Promise<string>;
+export interface IssuedTokens {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+}
+export type TokenError = {
+    error: 'invalid_grant' | 'invalid_request' | 'invalid_target';
+    error_description: string;
+};
+/** Ends a grant: its tokens stop working at once. */
+export declare function revokeGrant(payload: Payload, grant: Doc, reason: string): Promise<void>;
+/** `grant_type=authorization_code`. */
+export declare function exchangeCode(payload: Payload, runtime: McpOAuthRuntime, policy: McpAccessPolicy, params: {
+    code?: string;
+    clientId?: string;
+    redirectUri?: string;
+    codeVerifier?: string;
+}): Promise<IssuedTokens | TokenError>;
+/** `grant_type=refresh_token`. */
+export declare function refresh(payload: Payload, runtime: McpOAuthRuntime, policy: McpAccessPolicy, params: {
+    refreshToken?: string;
+    clientId?: string;
+}): Promise<IssuedTokens | TokenError>;
+/** RFC 7009. Unknown tokens are not an error. */
+export declare function revokeToken(payload: Payload, token: unknown): Promise<void>;
+/** An access token's grant and person, if it is live and still allowed. */
+export declare function authenticateAccessToken(payload: Payload, runtime: McpOAuthRuntime, policy: McpAccessPolicy, token: string): Promise<{
+    user: Doc;
+    grant: Doc;
+} | {
+    reason: string;
+}>;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/mcp-oauth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/mcp-oauth/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAA8C,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AACtF,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAEtF,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAA;AAWrB,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAElC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,aAAa,CAAA;IACnB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AA2BD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE;IAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAsC3C;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,OAAO,EACjB,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwD3C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,QAAQ,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,CAAA;IAC7D,iBAAiB,EAAE,MAAM,CAAA;CAC1B,CAAA;AAmCD,qDAAqD;AACrD,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc7F;AAqDD,uCAAuC;AACvC,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,CA+DpC;AAWD,kCAAkC;AAClC,wBAAsB,OAAO,CAC3B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,CAiDpC;AAED,iDAAiD;AACjD,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CASjF;AAED,2EAA2E;AAC3E,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BzD"}