@happyvertical/smrt-app-mcp 0.51.37 → 0.51.38

package/dist/auth.js

@@ -0,0 +1,815 @@
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
+function concat(...buffers) {
+	const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
+	let i = 0;
+	for (const buffer of buffers) buf.set(buffer, i), i += buffer.length;
+	return buf;
+}
+var NON_ASCII = /[^\x00-\x7f]/;
+function encode(string) {
+	if (typeof string == "string" && string.length >= 128) {
+		if (NON_ASCII.test(string)) throw new TypeError("non-ASCII string encountered in encode()");
+		return encoder.encode(string);
+	}
+	const bytes = new Uint8Array(string.length);
+	for (let i = 0; i < string.length; i++) {
+		const code = string.charCodeAt(i);
+		if (code > 127) throw new TypeError("non-ASCII string encountered in encode()");
+		bytes[i] = code;
+	}
+	return bytes;
+}
+function decodeBase64(encoded, url = !1) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+	if (url) {
+		if (encoded.includes("+") || encoded.includes("/")) throw new TypeError("Invalid base64url");
+		encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+	}
+	const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+	static code = "ERR_JOSE_GENERIC";
+	code = "ERR_JOSE_GENERIC";
+	constructor(message, options) {
+		super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+var JWTClaimValidationFailed = class extends JOSEError {
+	static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+	code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+	claim;
+	reason;
+	payload;
+	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+		super(message, { cause: {
+			claim,
+			reason,
+			payload
+		} }), this.claim = claim, this.reason = reason, this.payload = payload;
+	}
+};
+var JWTExpired = class extends JOSEError {
+	static code = "ERR_JWT_EXPIRED";
+	code = "ERR_JWT_EXPIRED";
+	claim;
+	reason;
+	payload;
+	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+		super(message, { cause: {
+			claim,
+			reason,
+			payload
+		} }), this.claim = claim, this.reason = reason, this.payload = payload;
+	}
+};
+var JOSEAlgNotAllowed = class extends JOSEError {
+	static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+	code = "ERR_JOSE_ALG_NOT_ALLOWED";
+};
+var JOSENotSupported = class extends JOSEError {
+	static code = "ERR_JOSE_NOT_SUPPORTED";
+	code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWSInvalid = class extends JOSEError {
+	static code = "ERR_JWS_INVALID";
+	code = "ERR_JWS_INVALID";
+};
+var JWTInvalid = class extends JOSEError {
+	static code = "ERR_JWT_INVALID";
+	code = "ERR_JWT_INVALID";
+};
+var JWKSInvalid = class extends JOSEError {
+	static code = "ERR_JWKS_INVALID";
+	code = "ERR_JWKS_INVALID";
+};
+var JWKSNoMatchingKey = class extends JOSEError {
+	static code = "ERR_JWKS_NO_MATCHING_KEY";
+	code = "ERR_JWKS_NO_MATCHING_KEY";
+	constructor(message = "no applicable key found in the JSON Web Key Set", options) {
+		super(message, options);
+	}
+};
+var JWKSMultipleMatchingKeys = class extends JOSEError {
+	[Symbol.asyncIterator] = async function* () {};
+	static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+	code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+	constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+		super(message, options);
+	}
+};
+var JWKSTimeout = class extends JOSEError {
+	static code = "ERR_JWKS_TIMEOUT";
+	code = "ERR_JWKS_TIMEOUT";
+	constructor(message = "request timed out", options) {
+		super(message, options);
+	}
+};
+var JWSSignatureVerificationFailed = class extends JOSEError {
+	static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+	code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+	constructor(message = "signature verification failed", options) {
+		super(message, options);
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js
+var invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+	try {
+		return decodeBase64(typeof input == "string" ? input : decoder.decode(input), !0);
+	} catch (cause) {
+		throw new TypeError(invalid, { cause });
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js
+function isObject(input) {
+	if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") return !1;
+	const prototype = Object.getPrototypeOf(input);
+	return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input) {
+	return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
+}
+function isDisjoint(...headers) {
+	const parameters = /* @__PURE__ */ new Set();
+	for (const header of headers) if (header) for (const parameter of Object.keys(header)) {
+		if (parameters.has(parameter)) return !1;
+		parameters.add(parameter);
+	}
+	return !0;
+}
+function decodeBase64url(value, label, ErrorClass) {
+	try {
+		return decode(value);
+	} catch {
+		throw new ErrorClass(`Failed to base64url decode the ${label}`);
+	}
+}
+function encodeBase64url(value, label, ErrorClass) {
+	try {
+		return encode(value);
+	} catch {
+		throw new ErrorClass(`The ${label} is not a valid base64url string`);
+	}
+}
+function parseJoseHeader(b64, ErrorClass, message) {
+	let parsed;
+	try {
+		parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+	} catch {
+		throw new ErrorClass(message);
+	}
+	if (!isObject(parsed)) throw new ErrorClass(message);
+	return parsed;
+}
+var JWS_RECOGNIZED = {
+	__proto__: null,
+	b64: !0
+};
+function validateAlgorithms(option, algorithms) {
+	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
+	return algorithms === void 0 ? void 0 : new Set(algorithms);
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
+	if (!protectedHeader || protectedHeader.crit === void 0) return [];
+	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
+	const recognized = recognizedOption === void 0 ? recognizedDefault : {
+		__proto__: null,
+		...recognizedOption,
+		...recognizedDefault
+	};
+	for (const parameter of protectedHeader.crit) {
+		if (!(parameter in recognized)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+		if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+		if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+	}
+	return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+	if (extensions.includes("b64")) {
+		const b64 = protectedHeader.b64;
+		if (typeof b64 != "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
+		return b64;
+	}
+	return !0;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js
+var tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {
+	const { alg } = entry;
+	if (key.use !== void 0) {
+		const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+	}
+	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+	if (Array.isArray(key.key_ops)) {
+		const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+		if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+	}
+};
+async function prepareKey(entry, key, usage) {
+	const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+	if (secret && key instanceof Uint8Array) return key;
+	let normalized, keyObject;
+	if (isObject(key)) {
+		if (normalized = normalizeJwk(key), typeof normalized.kty != "string") throw invalidKeyType(alg, key, secret);
+		if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0))) throw new TypeError(secret ? "JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present" : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+		if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct") return decode(normalized.k);
+		if (!Object.isFrozen(key)) {
+			const { key_ops } = key;
+			Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+		}
+	} else {
+		if (!isKeyLike(key)) throw invalidKeyType(alg, key, secret);
+		const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+		if (key.type !== expectedType && (secret || [
+			"secret",
+			"public",
+			"private"
+		].includes(key.type))) throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+		if (isCryptoKey(key)) return key;
+		if (keyObject = key, keyObject.type === "secret") return keyObject.export();
+	}
+	cache ||= /* @__PURE__ */ new WeakMap();
+	const cacheKey = key;
+	let cached = cache.get(cacheKey);
+	if (cached?.[alg]) return cached[alg];
+	if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+		const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({
+			crv,
+			asymmetricKeyType: keyObject.asymmetricKeyType
+		}) ?? entry.subtle;
+		return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+	}
+	return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+}
+var cache;
+var nist = {
+	__proto__: null,
+	prime256v1: "P-256",
+	secp384r1: "P-384",
+	secp521r1: "P-521"
+};
+var isCryptoKey = (key) => {
+	if (key?.[Symbol.toStringTag] === "CryptoKey") return !0;
+	try {
+		return key instanceof CryptoKey;
+	} catch {
+		return !1;
+	}
+}, isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+	if (types.length > 2) {
+		const last = types.pop();
+		msg += `one of type ${types.join(", ")}, or ${last}.`;
+	} else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+	return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+function invalidKeyType(alg, actual, secret) {
+	const types = [
+		"CryptoKey",
+		"KeyObject",
+		"JSON Web Key"
+	];
+	return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+var unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+	const { modulusLength } = key.algorithm;
+	if (typeof modulusLength != "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+	const algorithm = key.algorithm;
+	if (algorithm.name !== expected.name) throw unusable(expected.name);
+	if (expected.hash && algorithm.hash?.name !== expected.hash) throw unusable(expected.hash, "algorithm.hash");
+	if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) throw unusable(expected.namedCurve, "algorithm.namedCurve");
+	if (expected.length !== void 0 && algorithm.length !== expected.length) throw unusable(expected.length, "algorithm.length");
+	checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+	return {
+		__proto__: null,
+		...jwk
+	};
+}
+function normalizeJwk(jwk) {
+	const normalized = snapshotJwk(jwk);
+	if (normalized.ext !== void 0 && typeof normalized.ext != "boolean") throw new TypeError("\"ext\" (Extractable) Parameter must be a boolean");
+	if (normalized.key_ops !== void 0) {
+		const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+		if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length) throw new TypeError("\"key_ops\" (Key Operations) Parameter must be an array of unique strings");
+		normalized.key_ops = keyOps;
+	}
+	return normalized;
+}
+async function jwkToKey(entry, jwk, extractable) {
+	if (!entry.kty.includes(jwk.kty)) throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+	const algorithm = entry.resolve?.({
+		kty: jwk.kty,
+		crv: jwk.crv
+	}) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = {
+		...jwk,
+		ext: extractable ?? jwk.ext
+	};
+	return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = !1) {
+	return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+	const out = { __proto__: null };
+	for (const alg in entries) out[alg] = {
+		...entries[alg],
+		alg
+	};
+	return out;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js
+var sig = [["verify"], ["sign"]];
+function hmac(bits) {
+	const subtle = {
+		name: "HMAC",
+		hash: `SHA-${bits}`
+	};
+	return {
+		kty: ["oct"],
+		secret: !0,
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+function rsa(bits, saltLength) {
+	const subtle = {
+		name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+		hash: `SHA-${bits}`
+	};
+	return {
+		kty: ["RSA"],
+		subtle,
+		signing: saltLength ? {
+			...subtle,
+			saltLength
+		} : subtle,
+		usages: sig,
+		minRsaBits: 2048
+	};
+}
+function ecdsa(crv, bits) {
+	return {
+		kty: ["EC"],
+		crv,
+		subtle: {
+			name: "ECDSA",
+			namedCurve: crv
+		},
+		signing: {
+			name: "ECDSA",
+			hash: `SHA-${bits}`
+		},
+		usages: sig
+	};
+}
+function eddsa() {
+	const subtle = { name: "Ed25519" };
+	return {
+		kty: ["OKP"],
+		crv: "Ed25519",
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+function mldsa(bits) {
+	const subtle = { name: `ML-DSA-${bits}` };
+	return {
+		kty: ["AKP"],
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+var JWS = table({
+	HS256: hmac(256),
+	HS384: hmac(384),
+	HS512: hmac(512),
+	RS256: rsa(256),
+	RS384: rsa(384),
+	RS512: rsa(512),
+	PS256: rsa(256, 32),
+	PS384: rsa(384, 48),
+	PS512: rsa(512, 64),
+	ES256: ecdsa("P-256", 256),
+	ES384: ecdsa("P-384", 384),
+	ES512: ecdsa("P-521", 512),
+	EdDSA: eddsa(),
+	Ed25519: eddsa(),
+	"ML-DSA-44": mldsa(44),
+	"ML-DSA-65": mldsa(65),
+	"ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+	const entry = typeof alg == "string" ? JWS[alg] : void 0;
+	if (!entry) throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+	return entry;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js
+function prepareVerify(options) {
+	return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+	return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeCompactUnencodedPayload(payload) {
+	try {
+		return encode(payload);
+	} catch {
+		throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+	}
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+	const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+	if (!isDisjoint(parsedProt, header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+	const joseHeader = {
+		...parsedProt,
+		...header
+	}, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+	if (shared[0] && !shared[0].has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
+	if (b64) {
+		if (typeof inputPayload != "string") throw new JWSInvalid("JWS Payload must be a string");
+	} else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+	const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+	let resolvedKey = !1;
+	typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
+	const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : /* @__PURE__ */ new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+	entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+	let verified = !1;
+	try {
+		verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+	} catch {}
+	if (!verified) throw new JWSSignatureVerificationFailed();
+	const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+	return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{
+		...result,
+		key: k
+	}, b64] : [result, b64];
+}
+async function verifyCompact(jws, shared, key) {
+	if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+	const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+	if (length !== 3) throw new JWSInvalid("Invalid Compact JWS");
+	return verifySignature({
+		payload,
+		protected: protectedHeader,
+		signature
+	}, shared, key, encodeCompactUnencodedPayload);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 86400,
+	w: 604800,
+	y: 31557600
+}, REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = "check_failed";
+function invalidDuration() {
+	throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+	typeof str != "string" && invalidDuration();
+	const matched = REGEX.exec(str);
+	(!matched || matched[4] && matched[1]) && invalidDuration();
+	const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+	return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input) {
+	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
+	return input;
+}
+var normalizeTyp = (value) => {
+	const normalized = value.toLowerCase();
+	return value.includes("/") ? normalized : `application/${normalized}`;
+}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
+function validateNumericDate(payload, claim, required = !1) {
+	const value = payload[claim];
+	if (!(value === void 0 && !required)) {
+		if (typeof value != "number") throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+		return value;
+	}
+}
+function unexpectedClaim(payload, claim) {
+	throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+	let payload;
+	try {
+		payload = JSON.parse(strictDecoder.decode(encodedPayload));
+	} catch {}
+	if (!isObject(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+	const { typ } = options;
+	if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", checkFailed);
+	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+	maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+	for (const claim of new Set(presenceCheck.reverse())) if (!Object.hasOwn(payload, claim)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+	issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+	const { clockTolerance } = options;
+	let tolerance = 0;
+	if (typeof clockTolerance == "string") tolerance = secs(clockTolerance);
+	else if (clockTolerance !== void 0) {
+		if (typeof clockTolerance != "number") throw new TypeError("Invalid clockTolerance option type");
+		tolerance = clockTolerance;
+	}
+	validateInput("clockTolerance option", tolerance);
+	const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+	if (nbf !== void 0 && nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", checkFailed);
+	const exp = validateNumericDate(payload, "exp");
+	if (exp !== void 0 && exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", checkFailed);
+	if (maxTokenAge !== void 0) {
+		const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", checkFailed);
+		if (age < -tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", checkFailed);
+	}
+	return payload;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js
+async function jwtVerify(jwt, key, options) {
+	const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+	if (!b64) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+	const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+	return {
+		...verified,
+		payload
+	};
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/local.js
+function isUsableJWK(jwk, entry, alg, kid) {
+	const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+	return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+}
+async function importWithAlgCache(cache, jwk, entry) {
+	const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
+	if (cached[alg] === void 0) {
+		const pending = jwkToKey(entry, jwk, !0).then((key) => {
+			if (key.type !== "public") throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+			return cached[alg] = key, key;
+		}).catch((error) => {
+			throw cached[alg] === pending && delete cached[alg], error;
+		});
+		cached[alg] = pending;
+	}
+	return cached[alg];
+}
+function createLocalJWKSet(jwks) {
+	let snapshot;
+	try {
+		snapshot = structuredClone(jwks);
+	} catch {}
+	if (!isJwkSet(snapshot)) throw new JWKSInvalid("JSON Web Key Set malformed");
+	const metadata = snapshot.keys.map((jwk) => {
+		const normalized = snapshotJwk(jwk);
+		return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+	}), cached = /* @__PURE__ */ new WeakMap();
+	return Object.defineProperty(async (protectedHeader, token) => {
+		const { alg, kid } = {
+			...protectedHeader,
+			...token?.header
+		}, entry = typeof alg == "string" ? JWS[alg] : void 0;
+		if (!entry || entry.secret) throw new JOSENotSupported("Unsupported \"alg\" value for a JSON Web Key Set");
+		const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+		if (!length) throw new JWKSNoMatchingKey();
+		if (length !== 1) {
+			const error = new JWKSMultipleMatchingKeys();
+			throw error[Symbol.asyncIterator] = async function* () {
+				for (const jwk2 of candidates) try {
+					yield await importWithAlgCache(cached, jwk2, entry);
+				} catch {}
+			}, error;
+		}
+		return importWithAlgCache(cached, jwk, entry);
+	}, "jwks", { value: () => structuredClone(snapshot) });
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwks/remote.js
+function isCloudflareWorkers() {
+	return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
+}
+var USER_AGENT;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+var customFetch = /* @__PURE__ */ Symbol();
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+	const response = await fetchImpl(url, {
+		method: "GET",
+		signal,
+		redirect: "manual",
+		headers
+	}).catch((err) => {
+		throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
+	});
+	if (response.status !== 200) throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+	try {
+		return await response.json();
+	} catch {
+		throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+	}
+}
+var jwksCache = /* @__PURE__ */ Symbol();
+function isFreshFor(timestamp, duration) {
+	return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
+}
+function validateDuration(value, fallback, option) {
+	if (Number.isNaN(value)) throw new TypeError(`"${option}" option must not be NaN`);
+	return typeof value == "number" ? value : fallback;
+}
+function createRemoteJWKSet(url, options) {
+	if (!(url instanceof URL)) throw new TypeError("url must be an instance of URL");
+	const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+	if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0)) throw new TypeError("\"timeoutDuration\" option must be a non-negative integer");
+	const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+	USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+	const fetchImpl = opts[customFetch], cache = opts[jwksCache];
+	let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+	if (cache && typeof cache == "object") {
+		const { uat, jwks } = cache;
+		isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+	}
+	const reload = async () => {
+		if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+			const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+				const next = createLocalJWKSet(json);
+				if (sequence <= appliedSequence) return;
+				local = next;
+				const updatedAt = Date.now();
+				cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
+			}).finally(() => {
+				pendingFetch === current && (pendingFetch = void 0);
+			});
+		}
+		await pendingFetch;
+	};
+	return Object.defineProperties(async (protectedHeader, token) => {
+		(!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
+		try {
+			return await local(protectedHeader, token);
+		} catch (err) {
+			if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) return await reload(), local(protectedHeader, token);
+			throw err;
+		}
+	}, {
+		coolingDown: {
+			get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+			enumerable: !0
+		},
+		fresh: {
+			get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+			enumerable: !0
+		},
+		reload: {
+			value: reload,
+			enumerable: !0
+		},
+		reloading: {
+			get: () => !!pendingFetch,
+			enumerable: !0
+		},
+		jwks: {
+			value: () => local?.jwks(),
+			enumerable: !0
+		}
+	});
+}
+//#endregion
+//#region src/auth.ts
+var scopePattern = /^[\x21\x23-\x5b\x5d-\x7e]+$/u;
+function validateUrl(value, profile) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("Invalid MCP authorization URL.");
+	}
+	const loopback = [
+		"127.0.0.1",
+		"[::1]",
+		"localhost"
+	].includes(url.hostname);
+	if (url.username || url.password || url.search || url.hash || /[\s"\\]/u.test(value) || (profile === "local" ? !loopback || !["http:", "https:"].includes(url.protocol) : url.protocol !== "https:")) throw new Error("Invalid MCP authorization URL for deployment profile.");
+	return url;
+}
+function validString(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 1024 && value.trim() === value && [...value].every((character) => character.charCodeAt(0) > 31 && character.charCodeAt(0) !== 127);
+}
+function createMcpResourceAuth(options) {
+	if (![
+		"local",
+		"self-hosted",
+		"cloud"
+	].includes(options.profile)) throw new Error("Unknown MCP deployment profile.");
+	const resourceUrl = validateUrl(options.resource, options.profile);
+	validateUrl(options.issuer, options.profile);
+	validateUrl(options.jwksUri, options.profile);
+	if (!options.algorithms.length || options.algorithms.some((alg) => !["RS256", "ES256"].includes(alg))) throw new Error("Explicit asymmetric MCP token algorithms are required.");
+	if (options.scopes.some((scope) => !scopePattern.test(scope))) throw new Error("Invalid MCP OAuth scope.");
+	if (options.tokenType !== void 0 && !["at+jwt", "JWT"].includes(options.tokenType)) throw new Error("Unsupported MCP access-token type.");
+	const issuer = options.issuer;
+	const resource = options.resource;
+	const scopes = [...new Set(options.scopes)];
+	const algorithms = [...options.algorithms];
+	const tokenType = options.tokenType ?? "at+jwt";
+	const requireTenant = options.requireTenant !== false;
+	const resolvePrincipal = options.resolvePrincipal;
+	const keys = createRemoteJWKSet(new URL(options.jwksUri), { timeoutDuration: 5e3 });
+	const metadataUrl = `${resourceUrl.origin}/.well-known/oauth-protected-resource${resourceUrl.pathname === "/" ? "" : resourceUrl.pathname}`;
+	function deny(error) {
+		const challenge = [
+			`Bearer resource_metadata="${metadataUrl}"`,
+			...scopes.length ? [`scope="${scopes.join(" ")}"`] : [],
+			...error ? [`error="${error}"`] : []
+		].join(", ");
+		return {
+			ok: false,
+			response: new Response(null, {
+				status: error === "insufficient_scope" ? 403 : 401,
+				headers: {
+					"WWW-Authenticate": challenge,
+					"Cache-Control": "no-store"
+				}
+			})
+		};
+	}
+	return {
+		metadataUrl,
+		metadataResponse: () => Response.json({
+			resource,
+			authorization_servers: [issuer],
+			scopes_supported: scopes,
+			bearer_methods_supported: ["header"]
+		}, { headers: { "Cache-Control": "no-store" } }),
+		async authenticate(request) {
+			const authorization = request.headers.get("authorization");
+			if (!authorization) return deny();
+			const match = /^Bearer +([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/iu.exec(authorization);
+			if (!match) return deny("invalid_token");
+			try {
+				const { payload } = await jwtVerify(match[1], keys, {
+					issuer,
+					audience: resource,
+					algorithms,
+					typ: tokenType,
+					requiredClaims: [
+						"iss",
+						"aud",
+						"sub",
+						"exp"
+					],
+					clockTolerance: 0
+				});
+				if (!validString(payload.sub) || typeof payload.scope !== "string") return deny("invalid_token");
+				const granted = payload.scope === "" ? [] : payload.scope.split(" ");
+				if (granted.some((scope) => !scopePattern.test(scope))) return deny("invalid_token");
+				if (scopes.some((scope) => !granted.includes(scope))) return deny("insufficient_scope");
+				const mapping = await resolvePrincipal(Object.freeze({
+					issuer,
+					subject: payload.sub,
+					scopes: Object.freeze([...granted]),
+					claims: Object.freeze(payload)
+				}));
+				if (!mapping || !validString(mapping.id) || requireTenant && !validString(mapping.tenantId) || mapping.tenantId !== void 0 && !validString(mapping.tenantId) || mapping.kind !== void 0 && !validString(mapping.kind) || mapping.roles !== void 0 && (!Array.isArray(mapping.roles) || !mapping.roles.every(validString))) return deny("invalid_token");
+				return {
+					ok: true,
+					principal: {
+						id: mapping.id,
+						tenantId: mapping.tenantId,
+						kind: mapping.kind,
+						roles: mapping.roles ? [...mapping.roles] : void 0,
+						scopes: [...granted]
+					}
+				};
+			} catch {
+				return deny("invalid_token");
+			}
+		}
+	};
+}
+//#endregion
+export { createMcpResourceAuth };
+
+//# sourceMappingURL=auth.js.map