@intentface/latch-mcp 0.9.1

package/dist/oauth-fetch.js

@@ -0,0 +1,106 @@
+/** Well-known suffixes for the two discovery document kinds we touch. */
+const PROTECTED_RESOURCE = "oauth-protected-resource";
+const AUTH_SERVER = "oauth-authorization-server";
+const OPENID = "openid-configuration";
+/** Apply `forceScheme` to a URL string, returning it unchanged on parse failure. */
+function withScheme(value, scheme) {
+    if (!scheme || typeof value !== "string")
+        return value;
+    try {
+        const u = new URL(value);
+        if (u.protocol === `${scheme}:`)
+            return value;
+        u.protocol = `${scheme}:`;
+        return u.toString();
+    }
+    catch {
+        return value;
+    }
+}
+/** Strip a single trailing slash so an issuer matches the SDK's bare-origin form. */
+function stripTrailingSlash(value) {
+    return typeof value === "string" && value.endsWith("/")
+        ? value.slice(0, -1)
+        : value;
+}
+function normalizeProtectedResource(doc, scheme) {
+    const out = { ...doc };
+    if (typeof out.resource === "string") {
+        out.resource = withScheme(out.resource, scheme);
+    }
+    if (Array.isArray(out.authorization_servers)) {
+        out.authorization_servers = out.authorization_servers.map((s) => typeof s === "string" ? withScheme(s, scheme) : s);
+    }
+    return out;
+}
+function normalizeAuthorizationServer(doc, scheme) {
+    const out = { ...doc };
+    // The SDK's expected issuer is always trailing-slash-free; canonicalize both
+    // scheme and the slash so `assertMetadataIssuerMatches` succeeds.
+    if (typeof out.issuer === "string") {
+        out.issuer = stripTrailingSlash(withScheme(out.issuer, scheme));
+    }
+    for (const key of [
+        "authorization_endpoint",
+        "token_endpoint",
+        "registration_endpoint",
+        "revocation_endpoint",
+        "introspection_endpoint",
+        "userinfo_endpoint",
+        "jwks_uri",
+    ]) {
+        if (typeof out[key] === "string") {
+            out[key] = withScheme(out[key], scheme);
+        }
+    }
+    return out;
+}
+export function createOAuthDiscoveryFetch(options = {}) {
+    const base = options.baseFetch ?? globalThis.fetch;
+    const hosts = options.hosts?.map((h) => h.toLowerCase());
+    return async (input, init) => {
+        const response = await base(input, init);
+        let url;
+        try {
+            url = new URL(typeof input === "string"
+                ? input
+                : input instanceof URL
+                    ? input.href
+                    : input.url);
+        }
+        catch {
+            return response;
+        }
+        // Only touch successful discovery documents on permitted hosts.
+        if (!response.ok)
+            return response;
+        if (hosts && !hosts.includes(url.hostname.toLowerCase()))
+            return response;
+        const path = url.pathname;
+        const isProtectedResource = path.includes(PROTECTED_RESOURCE);
+        const isAuthServer = path.includes(AUTH_SERVER) || path.includes(OPENID);
+        if (!isProtectedResource && !isAuthServer)
+            return response;
+        let doc;
+        try {
+            doc = await response.clone().json();
+        }
+        catch {
+            return response; // not JSON — leave as-is
+        }
+        if (typeof doc !== "object" || doc === null)
+            return response;
+        const normalized = isProtectedResource
+            ? normalizeProtectedResource(doc, options.forceScheme)
+            : normalizeAuthorizationServer(doc, options.forceScheme);
+        // Preserve status/headers; replace only the body.
+        const headers = new Headers(response.headers);
+        headers.delete("content-length");
+        return new Response(JSON.stringify(normalized), {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+        });
+    };
+}
+//# sourceMappingURL=oauth-fetch.js.map

package/dist/oauth-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-fetch.js","sourceRoot":"","sources":["../src/oauth-fetch.ts"],"names":[],"mappings":"AAgDA,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,MAAM,MAAM,GAAG,sBAAsB,CAAC;AAEtC,oFAAoF;AACpF,SAAS,UAAU,CAAC,KAAa,EAAE,MAAyB;IAC1D,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,MAAM,GAAG;YAAE,OAAO,KAAK,CAAC;QAC9C,CAAC,CAAC,QAAQ,GAAG,GAAG,MAAM,GAAG,CAAC;QAC1B,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrD,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CACjC,GAA4B,EAC5B,MAAyB;IAEzB,MAAM,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IACvB,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,qBAAqB,GAAG,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9D,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,4BAA4B,CACnC,GAA4B,EAC5B,MAAyB;IAEzB,MAAM,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IACvB,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,GAAG,CAAC,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,wBAAwB;QACxB,gBAAgB;QAChB,uBAAuB;QACvB,qBAAqB;QACrB,wBAAwB;QACxB,mBAAmB;QACnB,UAAU;KACX,EAAE,CAAC;QACF,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAW,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAK,UAAU,CAAC,KAAuB,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAEzC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CACX,OAAO,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,KAAK,YAAY,GAAG;oBACpB,CAAC,CAAC,KAAK,CAAC,IAAI;oBACZ,CAAC,CAAE,KAAiB,CAAC,GAAG,CAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,QAAQ,CAAC;QAE1E,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,mBAAmB,IAAI,CAAC,YAAY;YAAE,OAAO,QAAQ,CAAC;QAE3D,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,CAAC,yBAAyB;QAC5C,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;QAE7D,MAAM,UAAU,GAAG,mBAAmB;YACpC,CAAC,CAAC,0BAA0B,CAAC,GAA8B,EAAE,OAAO,CAAC,WAAW,CAAC;YACjF,CAAC,CAAC,4BAA4B,CAAC,GAA8B,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEtF,kDAAkD;QAClD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,120 @@
+import { type OAuthClientProvider, type OAuthClientMetadata, type OAuthClientInformation } from "@ai-sdk/mcp";
+import type { Vault } from "@intentface/latch-core";
+import type { FetchFunction } from "./oauth-fetch.js";
+/**
+ * MCP OAuth (Authorization Code + PKCE), Vault-backed and per-tenant.
+ *
+ * The consent step is a browser redirect, so this is *chat-initiated,
+ * browser-completed, callback-finalized*: `start()` returns the IdP URL to send
+ * the user to; the host app's callback route calls `finish()` to exchange the
+ * code for tokens. All flow state (tokens, PKCE verifier, CSRF state, DCR client
+ * info) is stored in the Vault under the tenant's scope — never logged, never
+ * sent to the model. An authorization-server allowlist stops a malicious MCP
+ * server from pointing us at an attacker's IdP.
+ */
+export interface McpOAuthConfig<P = unknown> {
+    /** Connection name — namespaces the Vault keys for this server. */
+    name: string;
+    /**
+     * MCP server URL (the protected resource). A function defers the lookup to
+     * flow time, per caller — used by UI-added connections whose URL lives in the
+     * caller's Vault and isn't known when the OAuth client is constructed.
+     */
+    serverUrl: string | ((principal: P) => string | Promise<string>);
+    /** Our callback URL, registered with the IdP. Must be exact. */
+    redirectUrl: string;
+    /** OAuth client metadata (DCR or pre-registered client). */
+    clientMetadata: OAuthClientMetadata;
+    /**
+     * A pre-registered OAuth client. When this resolves to a value,
+     * `clientInformation()` returns it and the SDK SKIPS Dynamic Client
+     * Registration — required for auth servers without DCR (Google, etc.). A
+     * function defers the lookup per caller (e.g. UI connections whose creds live
+     * in the caller's Vault).
+     */
+    clientInformation?: OAuthClientInformation | ((principal: P) => OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>);
+    /** Allowed OAuth authorization-server origins. Empty/undefined = allow any. */
+    allowedAuthorizationServers?: string[];
+    /**
+     * Requested scope string, if the server expects one.
+     *
+     * A function defers the lookup to flow time, per caller — necessary, not
+     * merely symmetric with `serverUrl`: a single `McpOAuth` instance is shared
+     * across callers (UI connections are cached by connection NAME while the
+     * connection record itself is per-caller), so a static string would request
+     * one caller's scope on another caller's behalf. Resolve per principal and
+     * that cannot happen.
+     */
+    scope?: string | ((principal: P) => string | undefined | Promise<string | undefined>);
+    /**
+     * Optionally validate/normalize the RFC 8707 resource URL discovered from the
+     * server's metadata. Default (when omitted) requires an exact origin match;
+     * override to tolerate e.g. a proxied http/https scheme difference. Return the
+     * resource URL to use, or undefined to omit the resource parameter.
+     */
+    validateResourceURL?: (serverUrl: string | URL, resource?: string) => URL | undefined | Promise<URL | undefined>;
+    /**
+     * Custom fetch for the OAuth flow (discovery, token exchange, refresh). Use
+     * `createOAuthDiscoveryFetch` to normalize a provider's non-conformant
+     * discovery documents. Pass the SAME fetch to the host connection so the
+     * transport's on-401 re-auth uses it too.
+     */
+    fetch?: FetchFunction;
+    /**
+     * Extra query params appended to the authorization redirect URL — provider
+     * extensions the SDK doesn't model, e.g. Google's
+     * `{ access_type: "offline", prompt: "consent" }` to be issued a refresh
+     * token. Applied on top of the SDK-built URL, so they can also override a
+     * standard param if a provider needs that.
+     */
+    authorizationParams?: Record<string, string>;
+}
+/** Decode the app payload baked into an OAuth `state` by `start({ state })`. */
+export declare function decodeOAuthState(state: string | null | undefined): Record<string, unknown> | undefined;
+/**
+ * A Vault-backed `OAuthClientProvider` for one tenant + connection. Returned
+ * alongside `takeAuthorizationUrl()`, which yields the URL captured during a
+ * `REDIRECT` so the route can 302 the browser to it.
+ */
+export declare function createVaultOAuthProvider<P>(opts: {
+    vault: Vault<P>;
+    principal: P;
+    config: McpOAuthConfig<P>;
+    /** App context to bake into the OAuth `state` (recovered on callback). */
+    stateData?: Record<string, unknown>;
+}): {
+    provider: OAuthClientProvider;
+    takeAuthorizationUrl: () => URL | undefined;
+};
+export type StartResult = {
+    status: "redirect";
+    authorizationUrl: string;
+} | {
+    status: "authorized";
+};
+export interface McpOAuth<P> {
+    /** Whether this caller already holds tokens for the connection. */
+    isAuthorized(principal: P): Promise<boolean>;
+    /**
+     * Begin the flow: returns the IdP URL to redirect to, or 'authorized' if
+     * tokens already exist. `state` is app context (e.g. `{ chatId, approvalId }`)
+     * baked into the OAuth state and recoverable on callback via `decodeOAuthState`.
+     */
+    start(principal: P, opts?: {
+        state?: Record<string, unknown>;
+    }): Promise<StartResult>;
+    /** Finalize on the callback: exchange the code for tokens (stored in the Vault). */
+    finish(principal: P, params: {
+        code: string;
+        state?: string;
+    }): Promise<{
+        status: "authorized";
+    }>;
+    /** The Vault-backed provider for the *use* phase (auto-refreshes tokens). */
+    provider(principal: P): OAuthClientProvider;
+}
+export declare function createMcpOAuth<P>(opts: {
+    vault: Vault<P>;
+    config: McpOAuthConfig<P>;
+}): McpOAuth<P>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAG5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,cAAc,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,iBAAiB,CAAC,EACd,sBAAsB,GACtB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC,CAAC;IACzG,+EAA+E;IAC/E,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;IACvC;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACtF;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CACpB,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,QAAQ,CAAC,EAAE,MAAM,KACd,GAAG,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAChD;;;;;OAKG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAgCD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAYrC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,IAAI,EAAE;IAChD,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,SAAS,EAAE,CAAC,CAAC;IACb,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC1B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GAAG;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,oBAAoB,EAAE,MAAM,GAAG,GAAG,SAAS,CAAA;CAAE,CA+GjF;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,mEAAmE;IACnE,YAAY,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtF,oFAAoF;IACpF,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;IAClG,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,mBAAmB,CAAC;CAC7C;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE;IACtC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;CAC3B,GAAG,QAAQ,CAAC,CAAC,CAAC,CA2Dd"}

package/dist/oauth.js

@@ -0,0 +1,202 @@
+import { auth, } from "@ai-sdk/mcp";
+const vaultKey = (name, part) => `mcp_oauth:${name}:${part}`;
+function randomState() {
+    const bytes = crypto.getRandomValues(new Uint8Array(16));
+    let s = "";
+    for (const b of bytes)
+        s += b.toString(16).padStart(2, "0");
+    return s;
+}
+// --- state encoding ---------------------------------------------------------
+// The OAuth `state` is `<csrf>.<payload>`: a random CSRF nonce, then optional
+// base64url JSON carrying app context (which chat/approval to resume after the
+// callback). The SDK round-trips the whole string and checks it against the
+// stored value, so the payload is CSRF-protected too; we decode it on callback.
+function b64urlEncode(json) {
+    const s = JSON.stringify(json);
+    let bin = "";
+    for (const ch of new TextEncoder().encode(s))
+        bin += String.fromCharCode(ch);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64urlDecode(part) {
+    const b64 = part.replace(/-/g, "+").replace(/_/g, "/");
+    const bin = atob(b64);
+    const bytes = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        bytes[i] = bin.charCodeAt(i);
+    return JSON.parse(new TextDecoder().decode(bytes));
+}
+/** Decode the app payload baked into an OAuth `state` by `start({ state })`. */
+export function decodeOAuthState(state) {
+    if (!state)
+        return undefined;
+    const dot = state.indexOf(".");
+    if (dot === -1)
+        return undefined;
+    try {
+        const decoded = b64urlDecode(state.slice(dot + 1));
+        return typeof decoded === "object" && decoded
+            ? decoded
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * A Vault-backed `OAuthClientProvider` for one tenant + connection. Returned
+ * alongside `takeAuthorizationUrl()`, which yields the URL captured during a
+ * `REDIRECT` so the route can 302 the browser to it.
+ */
+export function createVaultOAuthProvider(opts) {
+    const { vault, principal, config, stateData } = opts;
+    const k = (part) => vaultKey(config.name, part);
+    let captured;
+    const provider = {
+        get redirectUrl() {
+            return config.redirectUrl;
+        },
+        get clientMetadata() {
+            return config.clientMetadata;
+        },
+        async tokens() {
+            const raw = await vault.get(principal, k("tokens"));
+            return raw ? JSON.parse(raw) : undefined;
+        },
+        async saveTokens(tokens) {
+            await vault.set(principal, k("tokens"), JSON.stringify(tokens));
+        },
+        async saveCodeVerifier(verifier) {
+            await vault.set(principal, k("verifier"), verifier);
+        },
+        async codeVerifier() {
+            const v = await vault.get(principal, k("verifier"));
+            if (!v)
+                throw new Error(`MCP OAuth "${config.name}": missing PKCE code verifier`);
+            return v;
+        },
+        async clientInformation() {
+            // A pre-registered client (config) wins and skips DCR; else use the
+            // DCR-registered client stored in the Vault.
+            if (config.clientInformation) {
+                const ci = typeof config.clientInformation === "function"
+                    ? await config.clientInformation(principal)
+                    : config.clientInformation;
+                if (ci)
+                    return ci;
+            }
+            const raw = await vault.get(principal, k("client"));
+            return raw ? JSON.parse(raw) : undefined;
+        },
+        async saveClientInformation(info) {
+            await vault.set(principal, k("client"), JSON.stringify(info));
+        },
+        // Persist the authorization-server metadata discovered during `start` so the
+        // callback's code exchange can read it back. Required for pre-registered
+        // clients (DCR skipped): without these, the SDK would otherwise stash the AS
+        // info onto the client record, which our config-provided `clientInformation`
+        // shadows — leaving the exchange with no stored AS metadata.
+        async authorizationServerInformation() {
+            const raw = await vault.get(principal, k("as_info"));
+            return raw ? JSON.parse(raw) : undefined;
+        },
+        async saveAuthorizationServerInformation(info) {
+            await vault.set(principal, k("as_info"), JSON.stringify(info));
+        },
+        state() {
+            const csrf = randomState();
+            return stateData && Object.keys(stateData).length > 0
+                ? `${csrf}.${b64urlEncode(stateData)}`
+                : csrf;
+        },
+        async saveState(state) {
+            await vault.set(principal, k("state"), state);
+        },
+        async storedState() {
+            return (await vault.get(principal, k("state"))) ?? undefined;
+        },
+        redirectToAuthorization(url) {
+            captured = url; // the route reads this and issues the 302
+        },
+        // Passthrough: omitted → SDK default (exact origin match).
+        validateResourceURL: config.validateResourceURL
+            ? async (serverUrl, resource) => config.validateResourceURL(serverUrl, resource)
+            : undefined,
+        validateAuthorizationServerURL(serverUrl, authorizationServerUrl) {
+            const allow = config.allowedAuthorizationServers;
+            if (!allow || allow.length === 0)
+                return; // not configured → allow
+            const origin = new URL(authorizationServerUrl).origin;
+            if (!allow.includes(origin)) {
+                throw new Error(`MCP OAuth "${config.name}": authorization server ${origin} is not allowed`);
+            }
+        },
+        async invalidateCredentials(which) {
+            const parts = which === "all"
+                ? ["tokens", "verifier", "state", "client", "as_info"]
+                : which === "tokens"
+                    ? ["tokens"]
+                    : which === "verifier"
+                        ? ["verifier"]
+                        : ["client"];
+            await Promise.all(parts.map((p) => vault.delete(principal, k(p))));
+        },
+    };
+    return { provider, takeAuthorizationUrl: () => captured };
+}
+export function createMcpOAuth(opts) {
+    const { vault, config } = opts;
+    const resolveServerUrl = (principal) => typeof config.serverUrl === "function" ? config.serverUrl(principal) : config.serverUrl;
+    const resolveScope = (principal) => typeof config.scope === "function" ? config.scope(principal) : config.scope;
+    return {
+        async isAuthorized(principal) {
+            return vault.has(principal, vaultKey(config.name, "tokens"));
+        },
+        async start(principal, opts) {
+            const { provider, takeAuthorizationUrl } = createVaultOAuthProvider({
+                vault,
+                principal,
+                config,
+                stateData: opts?.state,
+            });
+            const result = await auth(provider, {
+                serverUrl: await resolveServerUrl(principal),
+                scope: await resolveScope(principal),
+                fetchFn: config.fetch,
+            });
+            if (result === "AUTHORIZED")
+                return { status: "authorized" };
+            const url = takeAuthorizationUrl();
+            if (!url) {
+                throw new Error(`MCP OAuth "${config.name}": authorization required but no redirect URL was produced`);
+            }
+            for (const [key, value] of Object.entries(config.authorizationParams ?? {})) {
+                url.searchParams.set(key, value);
+            }
+            return { status: "redirect", authorizationUrl: url.toString() };
+        },
+        async finish(principal, params) {
+            const { provider } = createVaultOAuthProvider({ vault, principal, config });
+            await auth(provider, {
+                serverUrl: await resolveServerUrl(principal),
+                authorizationCode: params.code,
+                callbackState: params.state,
+                fetchFn: config.fetch,
+            });
+            // Single-use flow state: the CSRF state and PKCE verifier are spent the
+            // moment the exchange succeeds — delete them so a replayed callback URL
+            // finds no stored flow material to validate against. (The platform's
+            // oauth2 path already does this; tokens/client/as_info must survive.)
+            await Promise.all([
+                vault.delete(principal, vaultKey(config.name, "state")),
+                vault.delete(principal, vaultKey(config.name, "verifier")),
+            ]);
+            return { status: "authorized" };
+        },
+        provider(principal) {
+            return createVaultOAuthProvider({ vault, principal, config }).provider;
+        },
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,GAML,MAAM,aAAa,CAAC;AA8ErB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,aAAa,IAAI,IAAI,IAAI,EAAE,CAAC;AAE7E,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAEhF,SAAS,YAAY,CAAC,IAAa;IACjC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAC9B,KAAgC;IAEhC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;YAC3C,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAI,IAM3C;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,QAAyB,CAAC;IAE9B,MAAM,QAAQ,GAAwB;QACpC,IAAI,WAAW;YACb,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QACD,IAAI,cAAc;YAChB,OAAO,MAAM,CAAC,cAAc,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,QAAQ;YAC7B,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,YAAY;YAChB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,IAAI,+BAA+B,CAAC,CAAC;YAClF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,CAAC,iBAAiB;YACrB,oEAAoE;YACpE,6CAA6C;YAC7C,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,MAAM,EAAE,GACN,OAAO,MAAM,CAAC,iBAAiB,KAAK,UAAU;oBAC5C,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;oBAC3C,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC/B,IAAI,EAAE;oBAAE,OAAO,EAAE,CAAC;YACpB,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,IAAI;YAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,6EAA6E;QAC7E,yEAAyE;QACzE,6EAA6E;QAC7E,6EAA6E;QAC7E,6DAA6D;QAC7D,KAAK,CAAC,8BAA8B;YAGlC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,kCAAkC,CAAC,IAAI;YAC3C,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,KAAK;YACH,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;YAC3B,OAAO,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,GAAG,IAAI,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE;gBACtC,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,WAAW;YACf,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QAC/D,CAAC;QAED,uBAAuB,CAAC,GAAG;YACzB,QAAQ,GAAG,GAAG,CAAC,CAAC,0CAA0C;QAC5D,CAAC;QAED,2DAA2D;QAC3D,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC7C,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAC5B,MAAM,CAAC,mBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC;YACpD,CAAC,CAAC,SAAS;QAEb,8BAA8B,CAAC,SAAS,EAAE,sBAAsB;YAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,2BAA2B,CAAC;YACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,yBAAyB;YACnE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC;YACtD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,IAAI,2BAA2B,MAAM,iBAAiB,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,KAAK;YAC/B,MAAM,KAAK,GACT,KAAK,KAAK,KAAK;gBACb,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;gBACtD,CAAC,CAAC,KAAK,KAAK,QAAQ;oBAClB,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACZ,CAAC,CAAC,KAAK,KAAK,UAAU;wBACpB,CAAC,CAAC,CAAC,UAAU,CAAC;wBACd,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAqBD,MAAM,UAAU,cAAc,CAAI,IAGjC;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,gBAAgB,GAAG,CAAC,SAAY,EAA4B,EAAE,CAClE,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAC1F,MAAM,YAAY,GAAG,CAAC,SAAY,EAAoD,EAAE,CACtF,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAC9E,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,SAAS;YAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI;YACzB,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,wBAAwB,CAAC;gBAClE,KAAK;gBACL,SAAS;gBACT,MAAM;gBACN,SAAS,EAAE,IAAI,EAAE,KAAK;aACvB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;gBAClC,SAAS,EAAE,MAAM,gBAAgB,CAAC,SAAS,CAAC;gBAC5C,KAAK,EAAE,MAAM,YAAY,CAAC,SAAS,CAAC;gBACpC,OAAO,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,IAAI,4DAA4D,CACtF,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM;YAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,MAAM,IAAI,CAAC,QAAQ,EAAE;gBACnB,SAAS,EAAE,MAAM,gBAAgB,CAAC,SAAS,CAAC;gBAC5C,iBAAiB,EAAE,MAAM,CAAC,IAAI;gBAC9B,aAAa,EAAE,MAAM,CAAC,KAAK;gBAC3B,OAAO,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACvD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;aAC3D,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAClC,CAAC;QAED,QAAQ,CAAC,SAAS;YAChB,OAAO,wBAAwB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/oauth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth.test.d.ts.map

package/dist/oauth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.test.d.ts","sourceRoot":"","sources":["../src/oauth.test.ts"],"names":[],"mappings":""}