@gydr-ai/mcp-oauth 0.1.1 → 0.1.3

package/dist/types/core/grant-expiry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/interfaces/options.d.ts

@@ -57,6 +57,13 @@ export interface Lifetimes {
      * (90 days).
      */
     readonly grant?: number;
+    /**
+     * Sliding limit on a grant: it also ends when it has not been renewed with
+     * a refresh token for this long, and each renewal extends it again, never
+     * beyond `grant`. `0` (off), or from `accessToken` up to 34,560,000.
+     * Default: 0.
+     */
+    readonly grantIdle?: number;
     /** Authorization code lifetime, 1 to 600. Default: 60. */
     readonly authorizationCode?: number;
     /** Time allowed for sign-in plus consent, 1 to 3600. Default: 900 (15 minutes). */
@@ -291,6 +298,16 @@ export interface McpAuthOptions {
     readonly scopes?: readonly string[];
     /** Scopes granted when a client asks for none. Default: all `scopes`. */
     readonly defaultScopes?: readonly string[];
+    /**
+     * Grant types a registered client or metadata document gets when it names
+     * none. RFC 7591 § 2 reads an absent `grant_types` as
+     * `["authorization_code"]`, so such a client receives no refresh token;
+     * `["authorization_code", "refresh_token"]` gives it one. Must include
+     * `authorization_code`. Applies when a client registers or a metadata
+     * document is fetched, not to clients already registered, and not to
+     * `clients`, which default to both. Default: `["authorization_code"]`.
+     */
+    readonly defaultGrantTypes?: readonly ("authorization_code" | "refresh_token")[];
     /**
      * Plain-language description per scope, shown on the consent screen (and
      * escaped). Keys must be listed in `scopes`. Default: none.

package/dist/types/interfaces/records.d.ts

@@ -279,9 +279,14 @@ export interface GrantRecord {
      * or `McpAuth.updateGrantData` (JSON, at most `limits.grantDataBytes`).
      */
     readonly data?: unknown;
+    /** The redirect URI the approved authorization was sent to. */
+    readonly redirectUri?: string;
     /** When the person approved. */
     readonly createdAt: number;
-    /** Absolute end of the grant; no token outlives it. */
+    /**
+     * End of the grant; no token outlives it. With `lifetimes.grantIdle` it
+     * moves forward on each refresh, never past `createdAt + lifetimes.grant`.
+     */
     readonly expiresAt: number;
 }
 /**
@@ -305,6 +310,8 @@ export interface GrantUpstreamUpdate {
     readonly upstreamAccessTokenExpiresAt?: number;
     /** New integrator data for the grant (see `GrantRecord.data`). */
     readonly data?: unknown;
+    /** New end of the grant, after a refresh under `lifetimes.grantIdle`. */
+    readonly expiresAt?: number;
 }
 /**
  * An issued access token, stored by hash.

package/dist/types/interfaces/store.d.ts

@@ -147,8 +147,10 @@ export interface OAuthStore {
     /** Read a grant. */
     getGrant(grantId: string): Promise<GrantRecord | undefined>;
     /**
-     * Update the upstream-token fields of an existing grant. Resolves `false`,
-     * writing nothing, when the grant no longer exists.
+     * Update fields of an existing grant: the upstream tokens, `data`, or
+     * `expiresAt` (a refresh under `lifetimes.grantIdle`). Save every field
+     * given. Resolves `false`, writing nothing, when the grant no longer
+     * exists.
      */
     updateGrant(grantId: string, update: GrantUpstreamUpdate): Promise<boolean>;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gydr-ai/mcp-oauth",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "OAuth 2.1 authorization server and resource-server guard for remote MCP servers, in front of any OIDC identity provider. No token passthrough, consent on every authorization, DCR and Client ID Metadata Documents.",
   "keywords": [
     "mcp",
@@ -56,11 +56,11 @@
   },
   "dependencies": {
     "@gydr-ai/safe-fetch": "^0.1.1",
-    "jose": "^6.2.13"
+    "jose": "^6.2.14"
   },
   "devDependencies": {
     "@types/node": "26.6.6",
-    "@vitest/coverage-v8": "4.1.12",
+    "@vitest/coverage-v8": "5.0.5",
     "@vitest/eslint-plugin": "1.6.28",
     "esbuild": "0.28.2",
     "eslint": "10.13.0",
@@ -68,6 +68,6 @@
     "prettier": "3.9.10",
     "typescript": "6.0.3",
     "typescript-eslint": "8.72.1",
-    "vitest": "4.1.12"
+    "vitest": "5.0.5"
   }
 }