@frihet/mcp-server 1.17.0 → 2.0.1

package/dist/logger.d.ts

@@ -41,6 +41,6 @@ export declare function logApiCall(method: string, _path: string, statusCode: nu
 /**
  * Log a rate-limit retry.
  */
-export declare function logRetry(method: string, _path: string, retryCount: number, delayMs: number): void;
+export declare function logRetry(method: string, _path: string, retryCount: number, delayMs: number, delaySource?: "retry_after" | "backoff"): void;
 export {};
 //# sourceMappingURL=logger.d.ts.map

package/dist/logger.js

@@ -211,12 +211,12 @@ export function logApiCall(method, _path, statusCode, durationMs) {
 /**
  * Log a rate-limit retry.
  */
-export function logRetry(method, _path, retryCount, delayMs) {
+export function logRetry(method, _path, retryCount, delayMs, delaySource) {
     log({
         level: "warn",
         message: "MCP API retry scheduled",
         operation: "api_retry",
-        metadata: { method, retryCount: retryCount + 1, delayMs },
+        metadata: { method, retryCount: retryCount + 1, delayMs, delaySource },
     });
 }
 //# sourceMappingURL=logger.js.map

package/dist/muse-profile.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Meta Muse Profile for the Frihet MCP Server.
+ *
+ * Implements the curated 18-tool financial management surface submitted
+ * for the Meta Muse Business Application catalog.
+ *
+ * Requirements:
+ * - Curated catalogue: 18 high-value small business & freelancer tools.
+ * - Human-in-the-loop: Invoices and financial documents are created strictly in draft status.
+ * - Zero unconfirmed destructive actions (no direct AEAT / VeriFactu fiscal submissions).
+ * - Standard output redaction for sensitive fields.
+ */
+export declare const MUSE_CANDIDATE_TOOLS: ReadonlySet<string>;
+export declare const MUSE_CANDIDATE_TOOL_COUNT: number;
+export declare const MUSE_INSTRUCTIONS = "Frihet ERP \u2014 natural-language business and financial management for Meta Muse.\nUse get_business_context for complete company health and plan limits.\nQuery and review invoices, expenses, quotes, clients, and products with pagination.\nAll created invoices are drafts. Confirm parameters with the user before creating records.";
+export declare function museToolResult(result: unknown): unknown;
+export declare const MUSE_FORCED_INPUT_VALUES: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+export declare function applyMuseProfile(server: any): void;
+//# sourceMappingURL=muse-profile.d.ts.map

package/dist/muse-profile.js

@@ -0,0 +1,122 @@
+/**
+ * Meta Muse Profile for the Frihet MCP Server.
+ *
+ * Implements the curated 18-tool financial management surface submitted
+ * for the Meta Muse Business Application catalog.
+ *
+ * Requirements:
+ * - Curated catalogue: 18 high-value small business & freelancer tools.
+ * - Human-in-the-loop: Invoices and financial documents are created strictly in draft status.
+ * - Zero unconfirmed destructive actions (no direct AEAT / VeriFactu fiscal submissions).
+ * - Standard output redaction for sensitive fields.
+ */
+import { deepRedact, redactText } from "./redaction.js";
+export const MUSE_CANDIDATE_TOOLS = new Set([
+    "get_business_context",
+    "get_monthly_summary",
+    "get_quarterly_taxes",
+    "list_invoices",
+    "get_invoice",
+    "search_invoices",
+    "list_expenses",
+    "get_expense",
+    "create_expense",
+    "list_clients",
+    "get_client",
+    "create_client",
+    "list_products",
+    "get_product",
+    "list_quotes",
+    "get_quote",
+    "create_quote",
+    "create_invoice",
+]);
+export const MUSE_CANDIDATE_TOOL_COUNT = MUSE_CANDIDATE_TOOLS.size; // 18
+export const MUSE_INSTRUCTIONS = `Frihet ERP — natural-language business and financial management for Meta Muse.
+Use get_business_context for complete company health and plan limits.
+Query and review invoices, expenses, quotes, clients, and products with pagination.
+All created invoices are drafts. Confirm parameters with the user before creating records.`;
+export function museToolResult(result) {
+    if (result === null || typeof result !== "object")
+        return result;
+    const res = result;
+    // Deep-redact structured output if present (in-place deletion of sensitive fields)
+    if (res.structuredContent && typeof res.structuredContent === "object") {
+        deepRedact(res.structuredContent);
+    }
+    // Redact text content items
+    if (Array.isArray(res.content)) {
+        res.content = res.content.map((item) => {
+            if (item && typeof item === "object" && "text" in item && typeof item.text === "string") {
+                return {
+                    ...item,
+                    text: redactText(item.text),
+                };
+            }
+            return item;
+        });
+    }
+    return res;
+}
+export const MUSE_FORCED_INPUT_VALUES = {
+    create_invoice: { status: "draft" },
+    create_quote: { status: "draft" },
+};
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function applyMuseProfile(server) {
+    const registerTool = server.registerTool.bind(server);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    server.registerTool = (name, config, handler) => {
+        if (!MUSE_CANDIDATE_TOOLS.has(name))
+            return undefined;
+        let description = config.description ?? "";
+        let inputSchema = config.inputSchema;
+        if (name === "create_invoice") {
+            description = `${description} [Meta Muse: Generates an invoice strictly in 'draft' status for human review. No irreversible fiscal submission occurs.]`;
+            if (inputSchema && typeof inputSchema === "object" && "status" in inputSchema) {
+                const { status: _omittedStatus, ...rest } = inputSchema;
+                inputSchema = rest;
+            }
+        }
+        else if (name === "create_quote") {
+            description = `${description} [Meta Muse: Generates a quote strictly in 'draft' status for human review.]`;
+            if (inputSchema && typeof inputSchema === "object" && "status" in inputSchema) {
+                const { status: _omittedStatus, ...rest } = inputSchema;
+                inputSchema = rest;
+            }
+        }
+        return registerTool(name, {
+            ...config,
+            description,
+            inputSchema,
+            annotations: {
+                ...config.annotations,
+                ...(config.annotations?.readOnlyHint !== true ? { destructiveHint: true } : {}),
+            },
+        }, 
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        async (...args) => {
+            try {
+                let input = args[0];
+                if (input && typeof input === "object") {
+                    const forced = MUSE_FORCED_INPUT_VALUES[name];
+                    if (forced) {
+                        input = { ...input, ...forced };
+                    }
+                }
+                const res = await handler(input, ...args.slice(1));
+                return museToolResult(res);
+            }
+            catch {
+                return museToolResult({
+                    isError: true,
+                    _meta: { "io.frihet/operationOutcomeUnknown": true },
+                });
+            }
+        });
+    };
+    // Meta Muse profile intentionally registers 0 raw prompts or dynamic resources
+    server.registerResource = () => undefined;
+    server.registerPrompt = () => undefined;
+}
+//# sourceMappingURL=muse-profile.js.map

package/dist/observability.js

@@ -20,6 +20,7 @@
  * Docs: https://langfuse.com/docs/api/reference/overview
  */
 import { log } from "./logger.js";
+import { rejectRedirectResponse } from "./fetch-no-redirect.js";
 const CANONICAL_LANGFUSE_ORIGIN = "https://langfuse.frihet.io";
 /**
  * Langfuse receives a Basic Authorization header, so its authority is exact.
@@ -139,14 +140,14 @@ async function sendBatch(config, batch) {
     const credentials = btoa(`${config.publicKey}:${config.secretKey}`);
     const resp = await fetch(`${config.baseUrl}/api/public/ingestion`, {
         method: "POST",
-        redirect: "error",
+        redirect: "manual",
         headers: {
             "Content-Type": "application/json",
             "Authorization": `Basic ${credentials}`,
         },
         body: JSON.stringify(batch),
         signal: AbortSignal.timeout(5000),
-    });
+    }).then(rejectRedirectResponse);
     if (!resp.ok) {
         // Never read/log the provider response body. Status is sufficient to
         // correlate an operational delivery failure without importing arbitrary

package/dist/openai-profile.d.ts

@@ -12,7 +12,7 @@
  * 4. Redacts sensitive fields from all tool outputs
  * 5. Updates descriptions to reflect modified behavior + openWorldHint justifications
  *
- * The full MCP server (157 business tools + MCP extras) remains available for Claude, Cursor,
+ * The full MCP server (158 business tools + MCP extras) remains available for Claude, Cursor,
  * Windsurf, Cline, Codex, and all other MCP clients.
  *
  * OpenAI-safe mode: 33 reviewed business tools, 0 prompts, 0 resources, and no
@@ -24,7 +24,7 @@
 /** OAuth requirement advertised on every reviewed business tool. */
 export declare const OPENAI_OAUTH_SECURITY_SCHEMES: readonly [{
     readonly type: "oauth2";
-    readonly scopes: readonly ["frihet:workspace.manage"];
+    readonly scopes: readonly string[];
 }];
 export declare const OPENAI_WORKSPACE_WEBHOOK_EVENT_TOOLS: ReadonlySet<string>;
 export declare const OPENAI_REVIEW_CONFIRM_REQUIRED_TOOLS: ReadonlySet<string>;

package/dist/openai-profile.js

@@ -12,7 +12,7 @@
  * 4. Redacts sensitive fields from all tool outputs
  * 5. Updates descriptions to reflect modified behavior + openWorldHint justifications
  *
- * The full MCP server (157 business tools + MCP extras) remains available for Claude, Cursor,
+ * The full MCP server (158 business tools + MCP extras) remains available for Claude, Cursor,
  * Windsurf, Cline, Codex, and all other MCP clients.
  *
  * OpenAI-safe mode: 33 reviewed business tools, 0 prompts, 0 resources, and no
@@ -26,7 +26,13 @@ import { z } from "zod/v4";
 import { correctToolAnnotations } from "./capability-truth.js";
 import { MCP_RESOURCE_COUNT } from "./resources/register-all.js";
 import { SENSITIVE_FIELD_NAMES, deepRedact, redactText } from "./redaction.js";
-import { FRIHET_CONNECTOR_SCOPE } from "./openai-review-oauth.js";
+import { buildOpenAIUnauthorizedChallenge, hasExactOpenAIReviewScopes, OPENAI_REVIEW_OAUTH_SCOPES, } from "./openai-review-oauth.js";
+const REVIEWED_INVOICE_EVIDENCE_BOUNDARY = " Returns internal invoice records only. Invoice status and issue date do not prove external submission or delivery. " +
+    "Do not call this tool to check Peppol delivery receipts, EN 16931 validation results, or e-invoicing transmission or acceptance status. " +
+    "If the request only concerns that unavailable evidence, explain the limitation without invoking Frihet tools. " +
+    "/ Devuelve solo registros internos de facturas. El estado y la fecha de emision no prueban la presentacion o entrega externa. " +
+    "No invoques esta herramienta para comprobar acuses de entrega Peppol, resultados de validacion EN 16931 ni estados de transmision o aceptacion de facturacion electronica. " +
+    "Si la solicitud solo trata de esas evidencias no disponibles, explica la limitacion sin invocar herramientas de Frihet.";
 const PROFILE = {
     // -- OpenAI-reviewed core surface ----------------------------------------
     //
@@ -125,15 +131,29 @@ const PROFILE = {
             "and regulated filing data are omitted. " +
             "/ Obtiene un contexto conciso del espacio de trabajo sin identificadores oficiales, " +
             "direcciones precisas ni datos de declaraciones reguladas.",
+        list_invoices: "List all invoices with optional pagination and filters. " +
+            "Returns a paginated list sorted by issue date (newest first). " +
+            "Supports filtering by status (draft/sent/paid/overdue/cancelled) and date range. " +
+            "Example: status='paid', from='2026-01-01', to='2026-03-31', limit=20 " +
+            "/ Lista facturas con paginacion y filtros opcionales. " +
+            "Soporta filtrado por estado y rango de fechas." +
+            REVIEWED_INVOICE_EVIDENCE_BOUNDARY,
         get_invoice: "Get one invoice by ID with its stored line items, linked-client context, dates, and status. " +
             "The response contains only stored document fields; a calculated total may be absent. " +
-            "/ Obtiene una factura por ID con sus campos almacenados; el total calculado puede no estar presente.",
+            "/ Obtiene una factura por ID con sus campos almacenados; el total calculado puede no estar presente." +
+            REVIEWED_INVOICE_EVIDENCE_BOUNDARY,
+        search_invoices: "Search and filter invoices. Supports filtering by status and date range. " +
+            "The query parameter searches across client names and invoice content. " +
+            "Example: query='Acme', status='paid', from='2026-01-01', to='2026-03-31' " +
+            "/ Busca y filtra facturas. Soporta filtrado por estado y rango de fechas. " +
+            "El parametro query busca en nombres de clientes y contenido de facturas." +
+            REVIEWED_INVOICE_EVIDENCE_BOUNDARY,
         get_quote: "Get one quote by ID with its stored line items, linked-client context, dates, and status. " +
             "The response contains only stored document fields; a calculated total may be absent. " +
             "/ Obtiene un presupuesto por ID con sus campos almacenados; el total calculado puede no estar presente.",
         create_invoice: "Prepare a draft invoice that reserves a document number, advances the numbering counter, and may create/link a client; it cannot issue, email, or file it. " +
             "It requires a client name and at least one line item and always forces draft status. It cannot mark paid, cancel, hash, or submit the invoice to an external filing service. " +
-            "This invoice counts toward the workspace's monthly invoice usage and may emit invoice-creation analytics to PostHog's EU-hosted analytics service. Active owner-configured webhooks may receive the resulting full business events. Frihet may create in-app and Novu notifications for eligible workspace admins or accountants whose preferences allow them. For a referred workspace's first invoice, Frihet may award activation credits to the referring Frihet account. " +
+            "This invoice counts toward the workspace's monthly invoice usage and may emit invoice-creation analytics to PostHog's analytics service. Active owner-configured webhooks may receive the resulting full business events. Frihet may create in-app and Novu notifications for eligible workspace admins or accountants whose preferences allow them. For a referred workspace's first invoice, Frihet may award activation credits to the referring Frihet account. " +
             "/ Prepara una nueva factura en borrador. Este conector siempre fuerza el estado borrador " +
             "y reserva un numero interno; puede crear y vincular el cliente si no existe una coincidencia exacta, pero no emite, envia, marca como pagada, cancela, firma ni presenta la factura.",
         create_expense: "Record an expense on an explicit date; its tax-deductible choice affects Frihet's accounting, files nothing, and a new vendor may persist if the expense fails. " +
@@ -214,6 +234,7 @@ const PROFILE = {
             "documentNumber",
             "poNumber",
             "operationType",
+            "fiscalTreatment",
         ],
         create_quote: [
             "clientId",
@@ -281,7 +302,7 @@ const PROFILE = {
 };
 /** OAuth requirement advertised on every reviewed business tool. */
 export const OPENAI_OAUTH_SECURITY_SCHEMES = [
-    { type: "oauth2", scopes: [FRIHET_CONNECTOR_SCOPE] },
+    { type: "oauth2", scopes: [...OPENAI_REVIEW_OAUTH_SCOPES] },
 ];
 /**
  * @modelcontextprotocol/sdk 1.30 accepts unknown registration config fields,
@@ -382,13 +403,12 @@ function installOpenAIToolsListSecurityProjection(server) {
                     || !isRecord(schemes[0])
                     || schemes[0].type !== "oauth2"
                     || !Array.isArray(schemes[0].scopes)
-                    || schemes[0].scopes.length !== 1
-                    || schemes[0].scopes[0] !== FRIHET_CONNECTOR_SCOPE) {
+                    || !hasExactOpenAIReviewScopes(schemes[0].scopes)) {
                     throw new Error(`OpenAI tool ${String(tool.name)} is missing the reviewed OAuth scope`);
                 }
                 const securitySchemes = [{
                         type: "oauth2",
-                        scopes: [FRIHET_CONNECTOR_SCOPE],
+                        scopes: [...OPENAI_REVIEW_OAUTH_SCOPES],
                     }];
                 const descriptionSources = schemaDescriptions.get(tool.name);
                 if (!descriptionSources) {
@@ -887,7 +907,7 @@ function customizeReviewedOutputValue(name, value) {
         }
         if (name === "create_invoice") {
             effects.push("The draft counts toward the workspace's monthly invoice usage.");
-            effects.push("Frihet may have sent invoice-creation usage and activation analytics to PostHog's EU-hosted analytics service.");
+            effects.push("Frihet may have sent invoice-creation usage and activation analytics to PostHog's analytics service.");
             effects.push("Frihet may create in-app and Novu notifications for eligible workspace admins or accountants whose preferences allow them.");
             effects.push("If this was a referred workspace's first invoice, Frihet may have awarded activation credits to the referring Frihet account.");
         }
@@ -1064,7 +1084,7 @@ function constrainReviewedDocumentLineItems(schema, name) {
 }
 function reviewedConfirmationDescription(name) {
     if (name === "create_invoice") {
-        return "Set true only after the user authorizes creating a numbered draft, advancing the numbering counter, consuming monthly invoice usage, sending invoice-creation analytics to PostHog's EU-hosted analytics service, possibly creating/linking the client, delivering owner-configured webhooks, notifying eligible workspace admins/accountants, and possibly awarding first-use referral credits.";
+        return "Set true only after the user authorizes creating a numbered draft, advancing the numbering counter, consuming monthly invoice usage, sending invoice-creation analytics to PostHog's analytics service, possibly creating/linking the client, delivering owner-configured webhooks, notifying eligible workspace admins/accountants, and possibly awarding first-use referral credits.";
     }
     if (name === "create_quote") {
         return "Set true only after the user authorizes creating a numbered draft, advancing the numbering counter, possibly creating/linking the client, and delivering owner-configured webhooks.";
@@ -1193,7 +1213,7 @@ export function applyOpenAIProfile(server) {
             !config.description.includes("openWorldHint")) {
             const ow = config.annotations?.openWorldHint;
             const openWorldRationale = name === "create_invoice"
-                ? "may send invoice analytics to PostHog's EU-hosted analytics service, notify eligible admins/accountants through Novu, award referral credits, and deliver full business events to owner-configured webhook endpoints"
+                ? "may send invoice analytics to PostHog's analytics service, notify eligible admins/accountants through Novu, award referral credits, and deliver full business events to owner-configured webhook endpoints"
                 : name === "create_expense"
                     ? "may notify eligible admins/accountants through Novu, may award referral credits, and may deliver full business events to owner-configured webhook endpoints"
                     : name === "delete_quote"
@@ -1329,6 +1349,12 @@ export function applyOpenAIProfile(server) {
                 };
             }
             const result = await handler(handlerInput);
+            if (result.isError === true
+                && result._meta?.["io.frihet/authenticationRequired"] === true) {
+                result._meta = {
+                    "mcp/www_authenticate": [buildOpenAIUnauthorizedChallenge()],
+                };
+            }
             // A transport/body failure, a 5xx, or an idempotency-in-progress response
             // after a write was sent is ambiguous: the backend may have committed it
             // even though the caller did not receive a usable success response.

package/dist/openai-review-contract.d.ts

@@ -8,7 +8,7 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare const OPENAI_REVIEW_CONTRACT_VERSION = 6;
+export declare const OPENAI_REVIEW_CONTRACT_VERSION = 7;
 export declare const OPENAI_REVIEW_BUSINESS_TOOL_COUNT = 33;
 export declare const OPENAI_REVIEW_TOTAL_TOOL_COUNT = 33;
 export type JsonValue = null | boolean | number | string | JsonValue[] | {

package/dist/openai-review-contract.js

@@ -10,9 +10,9 @@ import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { OPENAI_REVIEW_BUSINESS_CONTEXT_TOP_CLIENTS_MAX, OPENAI_REVIEW_DOCUMENT_LINE_ITEM_MAX, OPENAI_REVIEW_FREE_TEXT_WARNING, OPENAI_REVIEW_FREE_TEXT_WARNING_PATHS, OPENAI_REVIEW_LIST_OUTPUT_FIELDS, OPENAI_REVIEW_OFFSET_MAX, OPENAI_REVIEW_PAGINATION_LIMITS, OPENAI_REVIEW_TEXT_INPUT_LIMITS, OPENAI_REVIEW_CONFIRM_REQUIRED_TOOLS, OPENAI_REVIEWED_TOOL_ALLOWLIST, OPENAI_WORKSPACE_WEBHOOK_EVENT_TOOLS, } from "./openai-profile.js";
 import { SENSITIVE_FIELD_NAMES } from "./redaction.js";
-import { FRIHET_CONNECTOR_SCOPE } from "./openai-review-oauth.js";
+import { hasExactOpenAIReviewScopes } from "./openai-review-oauth.js";
 import { registerMcpSurface, remoteMcpSurfaceComposition, } from "./server-composition.js";
-export const OPENAI_REVIEW_CONTRACT_VERSION = 6;
+export const OPENAI_REVIEW_CONTRACT_VERSION = 7;
 export const OPENAI_REVIEW_BUSINESS_TOOL_COUNT = 33;
 export const OPENAI_REVIEW_TOTAL_TOOL_COUNT = OPENAI_REVIEW_BUSINESS_TOOL_COUNT;
 const FORBIDDEN_REVIEW_TOOLS = [
@@ -296,9 +296,8 @@ function assertReviewedOAuthSecuritySchemes(value, path) {
         || Object.keys(scheme).sort().join(",") !== "scopes,type"
         || scheme.type !== "oauth2"
         || !Array.isArray(scheme.scopes)
-        || scheme.scopes.length !== 1
-        || scheme.scopes[0] !== FRIHET_CONNECTOR_SCOPE) {
-        throw new Error(`${path} must require only the reviewed connector OAuth scope`);
+        || !hasExactOpenAIReviewScopes(scheme.scopes)) {
+        throw new Error(`${path} must require exactly the reviewed OpenAI OAuth scopes`);
     }
 }
 function reviewedInputFieldSchema(tool, path) {

package/dist/openai-review-oauth.d.ts

@@ -5,6 +5,37 @@
 export declare const OPENAI_REVIEW_ORIGIN = "https://openai-mcp.frihet.io";
 export declare const FULL_MCP_ORIGIN = "https://mcp.frihet.io";
 export declare const FRIHET_CONNECTOR_SCOPE = "frihet:workspace.manage";
+export declare const OPENAI_REVIEW_OAUTH_SCOPES: readonly string[];
+/**
+ * RFC 8707 resource identifier of the reviewed MCP endpoint. Claude's
+ * connector guide requires protected-resource metadata to name the connector
+ * URL a user enters, including its path; OpenAI documents that ChatGPT takes
+ * the `resource` value it sends from that metadata.
+ */
+export declare const OPENAI_REVIEW_MCP_RESOURCE = "https://openai-mcp.frihet.io/mcp";
+/** RFC 9728 section 3.1 path-inserted location of the metadata for
+ * OPENAI_REVIEW_MCP_RESOURCE. The 401 challenge points here. */
+export declare const OPENAI_REVIEW_MCP_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource/mcp";
+/**
+ * The only RFC 8707 resource values the reviewed authorization boundary
+ * accepts. The canonical MCP URL comes first; the bare origin is the value the
+ * root metadata document still publishes (and the only one it published before
+ * the path-inserted document existed), so clients using it keep working. Both
+ * name this Worker only: the pinned provider matches a token audience by exact
+ * origin plus path prefix, so neither value can authorize the full host.
+ * The runtime checks that use this set are validateOAuthBoundary (below) and
+ * the /token rotation guard in workers/remote-mcp/src/oauth-token-family.ts.
+ * The inventory test in workers/remote-mcp/src/__tests__/openai-review-oauth.test.ts
+ * lists every runtime line that reads a field named `resource` or `audience`
+ * (dot access, string-literal bracket access, or single-line destructuring)
+ * and fails on any new such line, whatever it compares or calls. It does not
+ * follow a value after it is copied into another variable, multi-line
+ * destructuring, or computed property names.
+ * Grant props keep `oauthResource: OPENAI_REVIEW_ORIGIN` as the host-binding
+ * identity checked at session init and API-key provisioning; that field is not
+ * the RFC 8707 value, which the provider stores on the grant itself.
+ */
+export declare const OPENAI_REVIEW_OAUTH_RESOURCES: readonly string[];
 /** RFC 7636 S256 challenges are the 32-byte SHA-256 digest encoded as
  * unpadded base64url, which is always exactly 43 characters. */
 export declare function isValidS256CodeChallenge(value: string): boolean;
@@ -53,19 +84,33 @@ interface OAuthBoundaryParameters {
      * requests may omit it because the provider reuses the validated grant. */
     requireScope: boolean;
 }
+export declare function hasExactOpenAIReviewScopes(value: unknown): value is string[];
 /**
  * Validate the two OAuth values that form the reviewed-host authorization
- * boundary. RFC 8707 resource comparison is exact by design: accepting an
- * arbitrary absolute URI would let a token minted by one Frihet Worker target
- * the other Worker. Unknown or empty scopes are rejected instead of silently
- * downscoping to an empty token.
+ * boundary. RFC 8707 resource comparison is exact string membership by design:
+ * accepting an arbitrary absolute URI would let a token minted by one Frihet
+ * Worker target the other Worker. Unknown or empty scopes are rejected instead
+ * of silently downscoping to an empty token.
  */
-export declare function validateOAuthBoundary(parameters: OAuthBoundaryParameters, expectedResource: string): OAuthBoundaryResult;
+export declare function validateOAuthBoundary(parameters: OAuthBoundaryParameters, acceptedResources: readonly string[]): OAuthBoundaryResult;
 export declare function buildOpenAIUnauthorizedChallenge(origin?: string): string;
+/**
+ * Path-inserted protected-resource metadata for the reviewed MCP endpoint,
+ * served by the Worker itself (the pinned provider only serves the root
+ * document). It differs from the root document only in `resource`.
+ */
+export declare function buildReviewedMcpProtectedResourceMetadata(origin?: string): {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: string[];
+    resource_name: string;
+};
 /**
  * Materialize the public metadata generated by workers-oauth-provider 0.3.0
- * from the same options used by the Worker. The dependency version is pinned
- * separately in the canonical descriptor snapshot.
+ * from the same options used by the Worker, plus the path-inserted document
+ * the Worker serves itself. The dependency version is pinned separately in
+ * the canonical descriptor snapshot.
  */
 export declare function buildOpenAIReviewOAuthContract(origin?: string): {
     authorizationServer: {
@@ -89,10 +134,65 @@ export declare function buildOpenAIReviewOAuthContract(origin?: string): {
         bearer_methods_supported: string[];
         resource_name: string;
     };
+    protectedResourceMcp: {
+        resource: string;
+        authorization_servers: string[];
+        scopes_supported: string[];
+        bearer_methods_supported: string[];
+        resource_name: string;
+    };
+    openidConfiguration: {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        userinfo_endpoint: string;
+        registration_endpoint: string;
+        scopes_supported: string[];
+        response_types_supported: string[];
+        response_modes_supported: string[];
+        grant_types_supported: string[];
+        subject_types_supported: string[];
+        token_endpoint_auth_methods_supported: string[];
+        code_challenge_methods_supported: string[];
+    };
     wwwAuthenticate: {
         resourceMetadataUrl: string;
         missingTokenHeader: string;
     };
 };
+interface ReviewedAccessTokenSummary {
+    userId?: unknown;
+    expiresAt?: unknown;
+    audience?: unknown;
+    scope?: unknown;
+    grant?: {
+        scope?: unknown;
+        props?: unknown;
+    };
+}
+export declare function isVerifiedOpenAIIdentity(value: {
+    uid?: unknown;
+    email?: unknown;
+    emailVerified?: unknown;
+}): value is {
+    uid: string;
+    email: string;
+    emailVerified: true;
+};
+export type OpenAIUserInfo = {
+    sub: string;
+    email: string;
+    email_verified: true;
+};
+/**
+ * Validate the provider's opaque access-token summary before serving OIDC
+ * UserInfo. The provider already verifies the encrypted token and KV expiry;
+ * this second boundary deliberately rechecks every OpenAI-specific binding.
+ */
+export declare function buildOpenAIUserInfo(token: ReviewedAccessTokenSummary | null, nowEpochSeconds?: number, boundary?: Readonly<{
+    accessProfile: "openai" | "claude";
+    origin: string;
+    acceptedResources: readonly string[];
+}>): OpenAIUserInfo | undefined;
 export {};
 //# sourceMappingURL=openai-review-oauth.d.ts.map