@julr/sesame 0.5.0 → 0.5.1

package/build/{authorize_controller-BGzxPvYU.js → authorize_controller-YUfAy-R2.js}

@@ -1,10 +1,10 @@
-import { i as OAuthAuthorizationCode, n as OAuthPendingAuthorizationRequest, r as OAuthConsent, t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { i as OAuthAuthorizationCode, n as OAuthPendingAuthorizationRequest, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import "./oauth_access_token-bsoM5KeU.js";
 import { d as E_UNSUPPORTED_RESPONSE_TYPE, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-CnJ3L8tf.js";
 import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
 import { t as TokenService } from "./token_service-fhoA4slP.js";
-import { t as ClientService } from "./client_service-C3rfXGk_.js";
+import { t as ClientService } from "./client_service-WTNMqWzY.js";
 import { DateTime } from "luxon";
 import string from "@adonisjs/core/helpers/string";
 import vine from "@vinejs/vine";

package/build/{client_service-C3rfXGk_.js → client_service-WTNMqWzY.js}

@@ -1,4 +1,4 @@
-import { o as BUILTIN_SCOPES } from "./sesame_manager-C-eEFFHM.js";
+import { o as BUILTIN_SCOPES } from "./sesame_manager-DwDZy5Vy.js";
 import { o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE } from "./oauth_error-CnJ3L8tf.js";
 import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";

package/build/commands/sesame_purge.js

@@ -1,4 +1,4 @@
-import { t as SesameManager } from "../sesame_manager-C-eEFFHM.js";
+import { t as SesameManager } from "../sesame_manager-DwDZy5Vy.js";
 import { t as __decorate } from "../decorate-BKZEjPRg.js";
 import "../oauth_access_token-bsoM5KeU.js";
 import { BaseCommand, flags } from "@adonisjs/core/ace";

package/build/{consent_controller-BHoB9mip.js → consent_controller-Dprwd1ed.js}

@@ -1,4 +1,4 @@
-import { i as OAuthAuthorizationCode, n as OAuthPendingAuthorizationRequest, r as OAuthConsent, t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { i as OAuthAuthorizationCode, n as OAuthPendingAuthorizationRequest, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import "./oauth_access_token-bsoM5KeU.js";
 import { a as E_INVALID_GRANT, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT } from "./oauth_error-CnJ3L8tf.js";

package/build/index.js

@@ -1,11 +1,11 @@
 import { configure } from "./configure.js";
-import { a as OAuthRefreshToken, i as OAuthAuthorizationCode, r as OAuthConsent, t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { a as OAuthRefreshToken, i as OAuthAuthorizationCode, r as OAuthConsent, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import { t as OAuthAccessToken } from "./oauth_access_token-bsoM5KeU.js";
 import { a as E_INVALID_GRANT, c as E_INVALID_TOKEN, d as E_UNSUPPORTED_RESPONSE_TYPE, f as OAuthError, i as E_INVALID_CLIENT_METADATA, l as E_SERVER_ERROR, n as E_INSUFFICIENT_SCOPE, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE, t as E_ACCESS_DENIED, u as E_UNSUPPORTED_GRANT_TYPE } from "./oauth_error-CnJ3L8tf.js";
 import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
 import "./token_service-fhoA4slP.js";
-import { i as OAuthGuard, n as oauthUserProvider, r as OAuthLucidUserProvider, t as oauthGuard } from "./main-B3M6ihoS.js";
+import { i as OAuthGuard, n as oauthUserProvider, r as OAuthLucidUserProvider, t as oauthGuard } from "./main-EbeMS5S9.js";
 function defineConfig(config) {
 	return {
 		issuer: config.issuer,

package/build/{introspect_controller-un95fs4y.js → introspect_controller-6bRt9sZt.js}

@@ -1,10 +1,10 @@
-import { a as OAuthRefreshToken, t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { a as OAuthRefreshToken, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import { t as OAuthAccessToken } from "./oauth_access_token-bsoM5KeU.js";
 import "./oauth_error-CnJ3L8tf.js";
 import "./oauth_client-BIoY5jBR.js";
 import { t as TokenService } from "./token_service-fhoA4slP.js";
-import { t as ClientService } from "./client_service-C3rfXGk_.js";
+import { t as ClientService } from "./client_service-WTNMqWzY.js";
 const INACTIVE = { active: false };
 var IntrospectController = class {
 	async handle(ctx) {

package/build/{main-B3M6ihoS.js → main-EbeMS5S9.js}

@@ -150,7 +150,7 @@ var OAuthLucidUserProvider = class {
 function oauthGuard(config) {
 	return { async resolver(name, app) {
 		const emitter = await app.container.make("emitter");
-		const { SesameManager } = await import("./sesame_manager-BQIW2mqt.js");
+		const { SesameManager } = await import("./sesame_manager-Bu4MHqZV.js");
 		const manager = await app.container.make(SesameManager);
 		return (ctx) => new OAuthGuard(name, ctx, emitter, config.provider, manager, config.resource);
 	} };

package/build/{metadata_controller-CJeZG93_.js → metadata_controller-DeaMRnUr.js}

@@ -1,4 +1,4 @@
-import { t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { o as BUILTIN_SCOPES, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import "./oauth_access_token-bsoM5KeU.js";
 import { l as E_SERVER_ERROR } from "./oauth_error-CnJ3L8tf.js";
@@ -63,7 +63,7 @@ var MetadataController = class {
 		return {
 			...base,
 			subject_types_supported: ["public"],
-			scopes_supported: Object.keys(manager.config.scopes)
+			scopes_supported: [...Object.keys(manager.config.scopes), ...BUILTIN_SCOPES]
 		};
 	}
 	async protectedResource(ctx) {
@@ -73,7 +73,7 @@ var MetadataController = class {
 		return {
 			resource: issuer,
 			authorization_servers: [issuer],
-			scopes_supported: Object.keys(manager.config.scopes),
+			scopes_supported: [...Object.keys(manager.config.scopes), ...BUILTIN_SCOPES],
 			bearer_methods_supported: ["header"]
 		};
 	}

package/build/providers/sesame_provider.js

@@ -1,4 +1,4 @@
-import { t as SesameManager } from "../sesame_manager-C-eEFFHM.js";
+import { t as SesameManager } from "../sesame_manager-DwDZy5Vy.js";
 import "../decorate-BKZEjPRg.js";
 import "../oauth_access_token-bsoM5KeU.js";
 var SesameProvider = class {

package/build/{register_controller-Dch4ecyD.js → register_controller-sIJ1rxdM.js}

@@ -1,9 +1,9 @@
-import { t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import "./oauth_access_token-bsoM5KeU.js";
 import { i as E_INVALID_CLIENT_METADATA, o as E_INVALID_REQUEST, s as E_INVALID_SCOPE, t as E_ACCESS_DENIED } from "./oauth_error-CnJ3L8tf.js";
 import { t as OAuthClient } from "./oauth_client-BIoY5jBR.js";
-import { t as ClientService } from "./client_service-C3rfXGk_.js";
+import { t as ClientService } from "./client_service-WTNMqWzY.js";
 import vine from "@vinejs/vine";
 const DANGEROUS_SCHEMES = [
 	"javascript:",

package/build/{revoke_controller-DnPmzYMd.js → revoke_controller-D6isoQCi.js}

@@ -1,10 +1,10 @@
-import { a as OAuthRefreshToken, t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { a as OAuthRefreshToken, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import { t as OAuthAccessToken } from "./oauth_access_token-bsoM5KeU.js";
 import "./oauth_error-CnJ3L8tf.js";
 import "./oauth_client-BIoY5jBR.js";
 import { t as TokenService } from "./token_service-fhoA4slP.js";
-import { t as ClientService } from "./client_service-C3rfXGk_.js";
+import { t as ClientService } from "./client_service-WTNMqWzY.js";
 import { DateTime } from "luxon";
 var RevokeController = class {
 	async handle(ctx) {

package/build/services/main.js

@@ -1,4 +1,4 @@
-import { t as SesameManager } from "../sesame_manager-C-eEFFHM.js";
+import { t as SesameManager } from "../sesame_manager-DwDZy5Vy.js";
 import "../decorate-BKZEjPRg.js";
 import "../oauth_access_token-bsoM5KeU.js";
 import app from "@adonisjs/core/services/app";

package/build/{sesame_manager-BQIW2mqt.js → sesame_manager-Bu4MHqZV.js}

@@ -1,4 +1,4 @@
-import { t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import "./oauth_access_token-bsoM5KeU.js";
 export { SesameManager };

package/build/{sesame_manager-C-eEFFHM.js → sesame_manager-DwDZy5Vy.js}

@@ -4,13 +4,13 @@ import { DateTime } from "luxon";
 import { BaseModel, column } from "@adonisjs/lucid/orm";
 const BUILTIN_SCOPES = new Set(["offline_access"]);
 const controllers = {
-	token: () => import("./token_controller-hGDAYuBS.js"),
-	authorize: () => import("./authorize_controller-BGzxPvYU.js"),
-	consent: () => import("./consent_controller-BHoB9mip.js"),
-	introspect: () => import("./introspect_controller-un95fs4y.js"),
-	revoke: () => import("./revoke_controller-DnPmzYMd.js"),
-	register: () => import("./register_controller-Dch4ecyD.js"),
-	metadata: () => import("./metadata_controller-CJeZG93_.js"),
+	token: () => import("./token_controller-DzcrLMyS.js"),
+	authorize: () => import("./authorize_controller-YUfAy-R2.js"),
+	consent: () => import("./consent_controller-Dprwd1ed.js"),
+	introspect: () => import("./introspect_controller-6bRt9sZt.js"),
+	revoke: () => import("./revoke_controller-D6isoQCi.js"),
+	register: () => import("./register_controller-sIJ1rxdM.js"),
+	metadata: () => import("./metadata_controller-DeaMRnUr.js"),
 	clientInfo: () => import("./client_info_controller-BucHGx4u.js")
 };
 function registerOAuthRoutes(router) {
@@ -155,7 +155,7 @@ var SesameManager = class {
 			return {
 				resource: `${this.#config.issuer}${options.resource}`,
 				authorization_servers: [this.#config.issuer],
-				scopes_supported: options.scopes ?? Object.keys(this.#config.scopes),
+				scopes_supported: [...options.scopes ?? Object.keys(this.#config.scopes), ...BUILTIN_SCOPES],
 				bearer_methods_supported: ["header"]
 			};
 		});

package/build/src/controllers/metadata_controller.d.ts

@@ -1,5 +1,5 @@
 import type { HttpContext } from '@adonisjs/core/http';
-import type { AuthServerMetadata, ResourceServerMetadata } from '../types.ts';
+import { type AuthServerMetadata, type ResourceServerMetadata } from '../types.ts';
 /**
  * Serves OAuth 2.0 discovery metadata documents.
  *

package/build/src/grants/authorization_code_grant.d.ts

@@ -3,17 +3,13 @@ import type { SesameManager } from '../sesame_manager.ts';
 /**
  * Handle the Authorization Code Grant (RFC 6749 §4.1.3).
  *
- * Exchanges an authorization code for an access token (and optionally
- * a refresh token if the `offline_access` scope was granted).
+ * Exchanges an authorization code for an access token and a refresh
+ * token. A refresh token is always issued when the `refresh_token`
+ * grant type is enabled on the server — the client does not need
+ * to request `offline_access` explicitly.
  *
- * Performs the following validations:
- * - Client authentication (Basic header or POST body credentials)
- * - Authorization code existence, expiration, and single-use enforcement
- * - Redirect URI matching against the original authorization request
- * - PKCE code_verifier verification using S256 (RFC 7636 §4.6)
- *
- * All tokens (access tokens, refresh tokens, authorization codes)
- * are opaque values stored as SHA-256 hashes.
+ * This matches the behavior of major OAuth providers and avoids
+ * forcing MCP clients like ClaudeDesktop to know about `offline_access` to get long-lived sessions.
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4.6

package/build/src/guard/main.js

@@ -2,5 +2,5 @@ import "../../decorate-BKZEjPRg.js";
 import "../../oauth_access_token-bsoM5KeU.js";
 import "../../oauth_client-BIoY5jBR.js";
 import "../../token_service-fhoA4slP.js";
-import { i as OAuthGuard, n as oauthUserProvider, r as OAuthLucidUserProvider, t as oauthGuard } from "../../main-B3M6ihoS.js";
+import { i as OAuthGuard, n as oauthUserProvider, r as OAuthLucidUserProvider, t as oauthGuard } from "../../main-EbeMS5S9.js";
 export { OAuthGuard, OAuthLucidUserProvider, oauthGuard, oauthUserProvider };

package/build/src/types.d.ts

@@ -30,12 +30,21 @@ export type InferScopes<T extends {
  * Standard OAuth/OIDC scopes that are always valid regardless
  * of server or client scope configuration.
  *
+ * These scopes are:
+ * - Accepted during scope validation (client and server level)
+ * - Advertised in `scopes_supported` of all metadata endpoints
+ *   (protected resource, OIDC discovery) so MCP clients know
+ *   they can request them
+ *
  * - `offline_access`: signals that the client needs a refresh token
- *   (OIDC Core §11, OAuth 2.1). Without this built-in treatment,
- *   MCP clients that don't explicitly configure scopes would never
- *   receive a refresh token and would expire after the access token TTL.
+ *   (OIDC Core §11). Note: Sesame issues refresh tokens by default
+ *   when the `refresh_token` grant is enabled, regardless of whether
+ *   the client requests this scope (per RFC 6749 §5.1). This scope
+ *   is still advertised for clients that check metadata before
+ *   building their authorization request.
  *
  * @see https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
  */
 export declare const BUILTIN_SCOPES: Set<string>;
 /**

package/build/{token_controller-hGDAYuBS.js → token_controller-DzcrLMyS.js}

@@ -1,10 +1,10 @@
-import { a as OAuthRefreshToken, i as OAuthAuthorizationCode, o as BUILTIN_SCOPES, t as SesameManager } from "./sesame_manager-C-eEFFHM.js";
+import { a as OAuthRefreshToken, i as OAuthAuthorizationCode, o as BUILTIN_SCOPES, t as SesameManager } from "./sesame_manager-DwDZy5Vy.js";
 import "./decorate-BKZEjPRg.js";
 import { t as OAuthAccessToken } from "./oauth_access_token-bsoM5KeU.js";
 import { a as E_INVALID_GRANT, o as E_INVALID_REQUEST, r as E_INVALID_CLIENT, s as E_INVALID_SCOPE, u as E_UNSUPPORTED_GRANT_TYPE } from "./oauth_error-CnJ3L8tf.js";
 import "./oauth_client-BIoY5jBR.js";
 import { t as TokenService } from "./token_service-fhoA4slP.js";
-import { t as ClientService } from "./client_service-C3rfXGk_.js";
+import { t as ClientService } from "./client_service-WTNMqWzY.js";
 import { DateTime } from "luxon";
 import { createHash } from "node:crypto";
 import string from "@adonisjs/core/helpers/string";
@@ -50,7 +50,7 @@ async function handleAuthorizationCodeGrant(ctx, manager) {
 		expiresAt: DateTime.fromJSDate(expiresAt)
 	});
 	let refreshTokenRaw;
-	if (authCode.scopes.includes("offline_access")) {
+	if (manager.isGrantTypeEnabled("refresh_token")) {
 		const { raw, hash } = tokenService.createRefreshToken();
 		const refreshTtl = string.seconds.parse(manager.config.refreshTokenTtl);
 		await OAuthRefreshToken.create({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@julr/sesame",
   "description": "OAuth 2.1 + OIDC server for AdonisJS",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "engines": {
     "node": ">=24.0.0"
   },