@mcp-z/oauth-microsoft 1.0.0 → 1.0.1

package/dist/esm/lib/dcr-router.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/lib/dcr-router.ts"],"sourcesContent":["/**\n * DCR Router - OAuth 2.0 Authorization Server\n *\n * Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)\n * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).\n *\n * Endpoints:\n * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)\n * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)\n * - POST /oauth/register (RFC 7591 client registration)\n * - GET /oauth/authorize (RFC 6749 authorization endpoint)\n * - POST /oauth/token (RFC 6749 token endpoint)\n * - POST /oauth/revoke (RFC 7009 token revocation)\n * - GET /oauth/verify (token verification for Resource Server)\n */\n\nimport type { ProviderTokens, RFC8414Metadata, RFC9728Metadata } from '@mcp-z/oauth';\nimport { createHash, randomUUID } from 'crypto';\nimport type { Request, Response } from 'express';\nimport express from 'express';\nimport type { Keyv } from 'keyv';\nimport { DcrOAuthProvider } from '../providers/dcr.ts';\nimport type { AccessToken, AuthorizationCode, OAuthClientConfig } from '../types.ts';\nimport * as dcrUtils from './dcr-utils.ts';\n\n/**\n * Configuration for DCR Router (self-hosted mode only)\n */\nexport interface DcrRouterConfig {\n  /** Single Keyv store for all DCR data */\n  store: Keyv;\n\n  /** Authorization Server issuer URL */\n  issuerUrl: string;\n\n  /** Base URL for OAuth endpoints */\n  baseUrl: string;\n\n  /** Supported OAuth scopes */\n  scopesSupported: string[];\n\n  /** OAuth client configuration for upstream provider */\n  clientConfig: OAuthClientConfig;\n}\n\n/**\n * Create DCR Router with OAuth 2.0 endpoints (self-hosted mode)\n *\n * For external mode (Auth0/Stitch), don't call this function - no router needed.\n * The server code should check DcrConfig.mode and only call this for 'self-hosted'.\n *\n * @param config - Router configuration\n * @returns Express router with OAuth endpoints\n */\nexport function createDcrRouter(config: DcrRouterConfig): express.Router {\n  const router = express.Router();\n  const { store, issuerUrl, baseUrl, scopesSupported, clientConfig } = config;\n\n  // Apply required middleware for OAuth 2.0 endpoints (RFC 6749)\n  router.use(express.json()); // For /oauth/register (application/json)\n  router.use(express.urlencoded({ extended: true })); // For /oauth/token (application/x-www-form-urlencoded)\n\n  /**\n   * OAuth Authorization Server Metadata (RFC 8414)\n   * GET /.well-known/oauth-authorization-server\n   */\n  router.get('/.well-known/oauth-authorization-server', (_req: Request, res: Response) => {\n    const metadata: RFC8414Metadata = {\n      issuer: issuerUrl,\n      authorization_endpoint: `${baseUrl}/oauth/authorize`,\n      token_endpoint: `${baseUrl}/oauth/token`,\n      registration_endpoint: `${baseUrl}/oauth/register`,\n      revocation_endpoint: `${baseUrl}/oauth/revoke`,\n      scopes_supported: scopesSupported,\n      response_types_supported: ['code'],\n      grant_types_supported: ['authorization_code', 'refresh_token'],\n      token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],\n      code_challenge_methods_supported: ['S256', 'plain'],\n      service_documentation: `${baseUrl}/docs`,\n    };\n    res.json(metadata);\n  });\n\n  /**\n   * OAuth Protected Resource Metadata (RFC 9728 - Root)\n   * GET /.well-known/oauth-protected-resource\n   */\n  router.get('/.well-known/oauth-protected-resource', (_req: Request, res: Response) => {\n    const metadata: RFC9728Metadata = {\n      resource: baseUrl,\n      authorization_servers: [baseUrl],\n      scopes_supported: scopesSupported,\n      bearer_methods_supported: ['header'],\n    };\n    res.json(metadata);\n  });\n\n  /**\n   * OAuth Protected Resource Metadata (RFC 9728 - Sub-path /mcp)\n   * GET /.well-known/oauth-protected-resource/mcp\n   */\n  router.get('/.well-known/oauth-protected-resource/mcp', (_req: Request, res: Response) => {\n    const metadata: RFC9728Metadata = {\n      resource: `${baseUrl}/mcp`,\n      authorization_servers: [baseUrl],\n      scopes_supported: scopesSupported,\n      bearer_methods_supported: ['header'],\n    };\n    res.json(metadata);\n  });\n\n  /**\n   * Dynamic Client Registration (RFC 7591)\n   * POST /oauth/register\n   */\n  router.post('/oauth/register', async (req: Request, res: Response) => {\n    try {\n      const registrationRequest = req.body;\n\n      // Register the client\n      const client = await dcrUtils.registerClient(store, registrationRequest);\n\n      // Return client information (RFC 7591 Section 3.2.1)\n      res.status(201).json(client);\n    } catch (error) {\n      res.status(400).json({\n        error: 'invalid_client_metadata',\n        error_description: error instanceof Error ? error.message : 'Invalid registration request',\n      });\n    }\n  });\n\n  /**\n   * OAuth Authorization Endpoint (RFC 6749 Section 3.1)\n   * GET /oauth/authorize\n   *\n   * Initiates Microsoft OAuth flow, then generates DCR authorization code\n   */\n  router.get('/oauth/authorize', async (req: Request, res: Response) => {\n    const { response_type, client_id, redirect_uri, scope = '', state = '', code_challenge, code_challenge_method } = req.query;\n\n    // Validate required parameters\n    if (response_type !== 'code') {\n      return res.status(400).json({\n        error: 'unsupported_response_type',\n        error_description: 'Only response_type=code is supported',\n      });\n    }\n\n    if (!client_id || typeof client_id !== 'string') {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'client_id is required',\n      });\n    }\n\n    if (!redirect_uri || typeof redirect_uri !== 'string') {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'redirect_uri is required',\n      });\n    }\n\n    // Validate client\n    const client = await dcrUtils.getClient(store, client_id);\n    if (!client) {\n      return res.status(400).json({\n        error: 'invalid_client',\n        error_description: 'Unknown client_id',\n      });\n    }\n\n    // Validate redirect_uri\n    const isValidRedirect = await dcrUtils.validateRedirectUri(store, client_id, redirect_uri);\n    if (!isValidRedirect) {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'Invalid redirect_uri',\n      });\n    }\n\n    // Store DCR request state for Microsoft OAuth callback\n    const msState = randomUUID();\n    const dcrRequestState = {\n      client_id,\n      redirect_uri,\n      scope: typeof scope === 'string' ? scope : '',\n      state: typeof state === 'string' ? state : undefined,\n      code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,\n      code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,\n      created_at: Date.now(),\n      expires_at: Date.now() + 600000, // 10 minutes\n    };\n\n    await store.set(`dcr:ms-state:${msState}`, dcrRequestState, 600000); // 10 min TTL\n\n    // Build Microsoft authorization URL\n    const msAuthUrl = new URL(`https://login.microsoftonline.com/${clientConfig.tenantId || 'common'}/oauth2/v2.0/authorize`);\n    msAuthUrl.searchParams.set('client_id', clientConfig.clientId);\n    msAuthUrl.searchParams.set('response_type', 'code');\n    msAuthUrl.searchParams.set('redirect_uri', `${baseUrl}/oauth/callback`);\n    msAuthUrl.searchParams.set('scope', typeof scope === 'string' ? scope : '');\n    msAuthUrl.searchParams.set('state', msState);\n    msAuthUrl.searchParams.set('response_mode', 'query');\n\n    // Redirect user to Microsoft for authorization\n    return res.redirect(msAuthUrl.toString());\n  });\n\n  /**\n   * OAuth Callback Handler\n   * GET /oauth/callback\n   *\n   * Handles callback from Microsoft after user authorization\n   */\n  router.get('/oauth/callback', async (req: Request, res: Response) => {\n    const { code: msCode, state: msState, error, error_description } = req.query;\n\n    // Handle Microsoft OAuth errors\n    if (error) {\n      return res.status(400).json({\n        error,\n        error_description: error_description || 'Microsoft OAuth authorization failed',\n      });\n    }\n\n    if (!msCode || typeof msCode !== 'string') {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'Authorization code is required',\n      });\n    }\n\n    if (!msState || typeof msState !== 'string') {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'State parameter is required',\n      });\n    }\n\n    // Retrieve original DCR request state\n    const dcrRequestState = await store.get(`dcr:ms-state:${msState}`);\n    if (!dcrRequestState) {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'Invalid or expired state parameter',\n      });\n    }\n\n    // Delete state (one-time use)\n    await store.delete(`dcr:ms-state:${msState}`);\n\n    // Exchange Microsoft authorization code for tokens\n    try {\n      const tokenUrl = `https://login.microsoftonline.com/${clientConfig.tenantId || 'common'}/oauth2/v2.0/token`;\n      const tokenParams = new URLSearchParams({\n        grant_type: 'authorization_code',\n        code: msCode,\n        client_id: clientConfig.clientId,\n        redirect_uri: `${baseUrl}/oauth/callback`,\n        scope: dcrRequestState.scope,\n      });\n\n      // Add client_secret if available (confidential client)\n      if (clientConfig.clientSecret) {\n        tokenParams.set('client_secret', clientConfig.clientSecret);\n      }\n\n      const tokenResponse = await fetch(tokenUrl, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: tokenParams.toString(),\n      });\n\n      if (!tokenResponse.ok) {\n        const errorData = (await tokenResponse.json()) as { error?: string; error_description?: string };\n        throw new Error(`Microsoft token exchange failed: ${errorData.error_description || errorData.error}`);\n      }\n\n      const tokenData = (await tokenResponse.json()) as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in: number;\n        scope: string;\n      };\n\n      // Create provider tokens from Microsoft response\n      const providerTokens: ProviderTokens = {\n        accessToken: tokenData.access_token,\n        ...(tokenData.refresh_token && { refreshToken: tokenData.refresh_token }),\n        expiresAt: Date.now() + tokenData.expires_in * 1000,\n        scope: tokenData.scope,\n      };\n\n      // Generate DCR authorization code with real provider tokens\n      const dcrCode = randomUUID();\n      const authCode: AuthorizationCode = {\n        code: dcrCode,\n        client_id: dcrRequestState.client_id,\n        redirect_uri: dcrRequestState.redirect_uri,\n        scope: dcrRequestState.scope,\n        ...(dcrRequestState.code_challenge && { code_challenge: dcrRequestState.code_challenge }),\n        ...(dcrRequestState.code_challenge_method && { code_challenge_method: dcrRequestState.code_challenge_method }),\n        providerTokens,\n        created_at: Date.now(),\n        expires_at: Date.now() + 600000, // 10 minutes\n      };\n\n      await dcrUtils.setAuthCode(store, dcrCode, authCode);\n\n      // Redirect back to MCP client with DCR authorization code\n      const clientRedirectUrl = new URL(dcrRequestState.redirect_uri);\n      clientRedirectUrl.searchParams.set('code', dcrCode);\n      if (dcrRequestState.state) {\n        clientRedirectUrl.searchParams.set('state', dcrRequestState.state);\n      }\n\n      return res.redirect(clientRedirectUrl.toString());\n    } catch (error) {\n      return res.status(500).json({\n        error: 'server_error',\n        error_description: error instanceof Error ? error.message : 'Failed to exchange authorization code',\n      });\n    }\n  });\n\n  /**\n   * OAuth Token Endpoint (RFC 6749 Section 3.2)\n   * POST /oauth/token\n   */\n  router.post('/oauth/token', async (req: Request, res: Response) => {\n    // Extract client credentials from either body or Basic Auth header\n    let client_id = req.body.client_id;\n    let client_secret = req.body.client_secret;\n\n    // Support client_secret_basic authentication (RFC 6749 Section 2.3.1)\n    const authHeader = req.headers.authorization;\n    if (authHeader && authHeader.startsWith('Basic ')) {\n      const base64Credentials = authHeader.substring(6);\n      const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n      const [id, secret] = credentials.split(':');\n      client_id = id;\n      client_secret = secret;\n    }\n\n    const { grant_type, code, redirect_uri, refresh_token, code_verifier } = req.body;\n\n    // Validate grant_type\n    if (!grant_type) {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'grant_type is required',\n      });\n    }\n\n    if (grant_type === 'authorization_code') {\n      // Authorization Code Grant\n      if (!code || !client_id || !redirect_uri) {\n        return res.status(400).json({\n          error: 'invalid_request',\n          error_description: 'code, client_id, and redirect_uri are required',\n        });\n      }\n\n      // Validate client credentials\n      const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n      if (!isValidClient) {\n        return res.status(401).json({\n          error: 'invalid_client',\n          error_description: 'Invalid client credentials',\n        });\n      }\n\n      // Get authorization code\n      const authCode = await dcrUtils.getAuthCode(store, code);\n      if (!authCode) {\n        return res.status(400).json({\n          error: 'invalid_grant',\n          error_description: 'Invalid or expired authorization code',\n        });\n      }\n\n      // Validate authorization code\n      if (authCode.client_id !== client_id || authCode.redirect_uri !== redirect_uri) {\n        return res.status(400).json({\n          error: 'invalid_grant',\n          error_description: 'Authorization code mismatch',\n        });\n      }\n\n      if (Date.now() > authCode.expires_at) {\n        await dcrUtils.deleteAuthCode(store, code);\n        return res.status(400).json({\n          error: 'invalid_grant',\n          error_description: 'Authorization code expired',\n        });\n      }\n\n      // Validate PKCE if used\n      if (authCode.code_challenge) {\n        if (!code_verifier) {\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description: 'code_verifier is required for PKCE',\n          });\n        }\n\n        // Validate code_verifier against code_challenge\n        const method = authCode.code_challenge_method ?? 'plain';\n        const computedChallenge = method === 'S256' ? createHash('sha256').update(code_verifier).digest('base64url') : code_verifier;\n\n        if (computedChallenge !== authCode.code_challenge) {\n          return res.status(400).json({\n            error: 'invalid_grant',\n            error_description: 'Invalid code_verifier',\n          });\n        }\n      }\n\n      // Delete authorization code (one-time use)\n      await dcrUtils.deleteAuthCode(store, code);\n\n      // Generate DCR access token\n      const accessToken = randomUUID();\n      const refreshTokenValue = randomUUID();\n\n      const tokenData: AccessToken = {\n        access_token: accessToken,\n        token_type: 'Bearer',\n        expires_in: 3600,\n        refresh_token: refreshTokenValue,\n        scope: authCode.scope,\n        client_id,\n        providerTokens: authCode.providerTokens,\n        created_at: Date.now(),\n      };\n\n      await dcrUtils.setAccessToken(store, accessToken, tokenData);\n      await dcrUtils.setRefreshToken(store, refreshTokenValue, tokenData);\n\n      // Store provider tokens indexed by DCR access token\n      await dcrUtils.setProviderTokens(store, accessToken, authCode.providerTokens);\n\n      // Return token response\n      return res.json({\n        access_token: tokenData.access_token,\n        token_type: tokenData.token_type,\n        expires_in: tokenData.expires_in,\n        refresh_token: tokenData.refresh_token,\n        scope: tokenData.scope,\n      });\n    }\n    if (grant_type === 'refresh_token') {\n      // Refresh Token Grant\n      if (!refresh_token || !client_id) {\n        return res.status(400).json({\n          error: 'invalid_request',\n          error_description: 'refresh_token and client_id are required',\n        });\n      }\n\n      // Validate client credentials\n      const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n      if (!isValidClient) {\n        return res.status(401).json({\n          error: 'invalid_client',\n          error_description: 'Invalid client credentials',\n        });\n      }\n\n      // Get refresh token\n      const tokenData = await dcrUtils.getRefreshToken(store, refresh_token);\n      if (!tokenData || tokenData.client_id !== client_id) {\n        return res.status(400).json({\n          error: 'invalid_grant',\n          error_description: 'Invalid refresh token',\n        });\n      }\n\n      // Refresh provider tokens if available\n      let refreshedProviderTokens = tokenData.providerTokens;\n      if (tokenData.providerTokens.refreshToken) {\n        try {\n          // Create DcrOAuthProvider instance to refresh Microsoft tokens\n          const provider = new DcrOAuthProvider({\n            clientId: clientConfig.clientId,\n            ...(clientConfig.clientSecret && { clientSecret: clientConfig.clientSecret }),\n            tenantId: clientConfig.tenantId ?? 'common',\n            scope: tokenData.scope,\n            verifyEndpoint: `${baseUrl}/oauth/verify`,\n            logger: {\n              info: console.log,\n              error: console.error,\n              warn: console.warn,\n              debug: () => {},\n            },\n          });\n\n          // Refresh the Microsoft access token\n          refreshedProviderTokens = await provider.refreshAccessToken(tokenData.providerTokens.refreshToken);\n        } catch (error) {\n          // If refresh fails, continue with existing tokens (they may still be valid)\n          console.warn('Provider token refresh failed, using existing tokens:', error instanceof Error ? error.message : String(error));\n        }\n      }\n\n      // Generate new DCR access token\n      const newAccessToken = randomUUID();\n      const newTokenData: AccessToken = {\n        ...tokenData,\n        access_token: newAccessToken,\n        created_at: Date.now(),\n      };\n\n      await dcrUtils.setAccessToken(store, newAccessToken, newTokenData);\n\n      // Store refreshed provider tokens indexed by new DCR access token\n      await dcrUtils.setProviderTokens(store, newAccessToken, refreshedProviderTokens);\n\n      return res.json({\n        access_token: newTokenData.access_token,\n        token_type: newTokenData.token_type,\n        expires_in: newTokenData.expires_in,\n        scope: newTokenData.scope,\n      });\n    }\n    return res.status(400).json({\n      error: 'unsupported_grant_type',\n      error_description: 'Only authorization_code and refresh_token grants are supported',\n    });\n  });\n\n  /**\n   * OAuth Token Revocation (RFC 7009)\n   * POST /oauth/revoke\n   */\n  router.post('/oauth/revoke', async (req: Request, res: Response) => {\n    const { token, token_type_hint, client_id, client_secret } = req.body;\n\n    if (!token) {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'token is required',\n      });\n    }\n\n    // Validate client if credentials provided\n    if (client_id && client_secret) {\n      const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret);\n      if (!isValidClient) {\n        return res.status(401).json({\n          error: 'invalid_client',\n          error_description: 'Invalid client credentials',\n        });\n      }\n    }\n\n    // Revoke the token\n    if (token_type_hint === 'refresh_token') {\n      await dcrUtils.deleteRefreshToken(store, token);\n    } else if (token_type_hint === 'access_token') {\n      await dcrUtils.deleteAccessToken(store, token);\n      await dcrUtils.deleteProviderTokens(store, token);\n    } else {\n      // No hint - try both\n      await dcrUtils.deleteRefreshToken(store, token);\n      await dcrUtils.deleteAccessToken(store, token);\n      await dcrUtils.deleteProviderTokens(store, token);\n    }\n\n    // RFC 7009: Return 200 even if token not found\n    return res.status(200).send();\n  });\n\n  /**\n   * Token Verification Endpoint\n   * GET /oauth/verify\n   *\n   * Validates bearer tokens for Resource Server.\n   * Returns AuthInfo with provider tokens for stateless DCR pattern.\n   */\n  router.get('/oauth/verify', async (req: Request, res: Response) => {\n    // Extract bearer token from Authorization header\n    const authHeader = req.headers.authorization;\n\n    if (!authHeader || !authHeader.startsWith('Bearer ')) {\n      return res.status(401).json({\n        error: 'invalid_request',\n        error_description: 'Missing or invalid Authorization header',\n      });\n    }\n\n    const token = authHeader.substring(7); // Remove 'Bearer ' prefix\n\n    // Validate token exists in access tokens store\n    const tokenData = await dcrUtils.getAccessToken(store, token);\n\n    if (!tokenData) {\n      return res.status(401).json({\n        error: 'invalid_token',\n        error_description: 'Unknown or expired access token',\n      });\n    }\n\n    // Check if token is expired\n    const now = Date.now();\n    const expiresAt = tokenData.created_at + tokenData.expires_in * 1000;\n\n    if (now > expiresAt) {\n      // Remove expired token\n      await dcrUtils.deleteAccessToken(store, token);\n      await dcrUtils.deleteProviderTokens(store, token);\n      return res.status(401).json({\n        error: 'invalid_token',\n        error_description: 'Access token has expired',\n      });\n    }\n\n    // Return AuthInfo with provider tokens for stateless DCR\n    const authInfo = {\n      token,\n      clientId: tokenData.client_id,\n      scopes: tokenData.scope ? tokenData.scope.split(' ') : [],\n      expiresAt,\n      providerTokens: tokenData.providerTokens,\n    };\n\n    return res.json(authInfo);\n  });\n\n  /**\n   * Debug endpoint to list registered clients (development only)\n   */\n  router.get('/debug/clients', async (_req: Request, res: Response) => {\n    const clients = await dcrUtils.listClients(store);\n    res.json(clients);\n  });\n\n  return router;\n}\n"],"names":["createHash","randomUUID","express","DcrOAuthProvider","dcrUtils","createDcrRouter","config","router","Router","store","issuerUrl","baseUrl","scopesSupported","clientConfig","use","json","urlencoded","extended","get","_req","res","metadata","issuer","authorization_endpoint","token_endpoint","registration_endpoint","revocation_endpoint","scopes_supported","response_types_supported","grant_types_supported","token_endpoint_auth_methods_supported","code_challenge_methods_supported","service_documentation","resource","authorization_servers","bearer_methods_supported","post","req","registrationRequest","body","client","registerClient","status","error","error_description","Error","message","response_type","client_id","redirect_uri","scope","state","code_challenge","code_challenge_method","query","getClient","isValidRedirect","validateRedirectUri","msState","dcrRequestState","undefined","created_at","Date","now","expires_at","set","msAuthUrl","URL","tenantId","searchParams","clientId","redirect","toString","code","msCode","delete","tokenUrl","tokenParams","URLSearchParams","grant_type","clientSecret","tokenResponse","fetch","method","headers","ok","errorData","tokenData","providerTokens","accessToken","access_token","refresh_token","refreshToken","expiresAt","expires_in","dcrCode","authCode","setAuthCode","clientRedirectUrl","client_secret","authHeader","authorization","startsWith","base64Credentials","substring","credentials","Buffer","from","id","secret","split","code_verifier","isValidClient","validateClient","getAuthCode","deleteAuthCode","computedChallenge","update","digest","refreshTokenValue","token_type","setAccessToken","setRefreshToken","setProviderTokens","getRefreshToken","refreshedProviderTokens","provider","verifyEndpoint","logger","info","console","log","warn","debug","refreshAccessToken","String","newAccessToken","newTokenData","token","token_type_hint","deleteRefreshToken","deleteAccessToken","deleteProviderTokens","send","getAccessToken","authInfo","scopes","clients","listClients"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,UAAU,EAAEC,UAAU,QAAQ,SAAS;AAEhD,OAAOC,aAAa,UAAU;AAE9B,SAASC,gBAAgB,QAAQ,sBAAsB;AAEvD,YAAYC,cAAc,iBAAiB;AAsB3C;;;;;;;;CAQC,GACD,OAAO,SAASC,gBAAgBC,MAAuB;IACrD,MAAMC,SAASL,QAAQM,MAAM;IAC7B,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,OAAO,EAAEC,eAAe,EAAEC,YAAY,EAAE,GAAGP;IAErE,+DAA+D;IAC/DC,OAAOO,GAAG,CAACZ,QAAQa,IAAI,KAAK,yCAAyC;IACrER,OAAOO,GAAG,CAACZ,QAAQc,UAAU,CAAC;QAAEC,UAAU;IAAK,KAAK,uDAAuD;IAE3G;;;GAGC,GACDV,OAAOW,GAAG,CAAC,2CAA2C,CAACC,MAAeC;QACpE,MAAMC,WAA4B;YAChCC,QAAQZ;YACRa,wBAAwB,GAAGZ,QAAQ,gBAAgB,CAAC;YACpDa,gBAAgB,GAAGb,QAAQ,YAAY,CAAC;YACxCc,uBAAuB,GAAGd,QAAQ,eAAe,CAAC;YAClDe,qBAAqB,GAAGf,QAAQ,aAAa,CAAC;YAC9CgB,kBAAkBf;YAClBgB,0BAA0B;gBAAC;aAAO;YAClCC,uBAAuB;gBAAC;gBAAsB;aAAgB;YAC9DC,uCAAuC;gBAAC;gBAAuB;aAAqB;YACpFC,kCAAkC;gBAAC;gBAAQ;aAAQ;YACnDC,uBAAuB,GAAGrB,QAAQ,KAAK,CAAC;QAC1C;QACAS,IAAIL,IAAI,CAACM;IACX;IAEA;;;GAGC,GACDd,OAAOW,GAAG,CAAC,yCAAyC,CAACC,MAAeC;QAClE,MAAMC,WAA4B;YAChCY,UAAUtB;YACVuB,uBAAuB;gBAACvB;aAAQ;YAChCgB,kBAAkBf;YAClBuB,0BAA0B;gBAAC;aAAS;QACtC;QACAf,IAAIL,IAAI,CAACM;IACX;IAEA;;;GAGC,GACDd,OAAOW,GAAG,CAAC,6CAA6C,CAACC,MAAeC;QACtE,MAAMC,WAA4B;YAChCY,UAAU,GAAGtB,QAAQ,IAAI,CAAC;YAC1BuB,uBAAuB;gBAACvB;aAAQ;YAChCgB,kBAAkBf;YAClBuB,0BAA0B;gBAAC;aAAS;QACtC;QACAf,IAAIL,IAAI,CAACM;IACX;IAEA;;;GAGC,GACDd,OAAO6B,IAAI,CAAC,mBAAmB,OAAOC,KAAcjB;QAClD,IAAI;YACF,MAAMkB,sBAAsBD,IAAIE,IAAI;YAEpC,sBAAsB;YACtB,MAAMC,SAAS,MAAMpC,SAASqC,cAAc,CAAChC,OAAO6B;YAEpD,qDAAqD;YACrDlB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAACyB;QACvB,EAAE,OAAOG,OAAO;YACdvB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBACnB4B,OAAO;gBACPC,mBAAmBD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;YAC9D;QACF;IACF;IAEA;;;;;GAKC,GACDvC,OAAOW,GAAG,CAAC,oBAAoB,OAAOmB,KAAcjB;QAClD,MAAM,EAAE2B,aAAa,EAAEC,SAAS,EAAEC,YAAY,EAAEC,QAAQ,EAAE,EAAEC,QAAQ,EAAE,EAAEC,cAAc,EAAEC,qBAAqB,EAAE,GAAGhB,IAAIiB,KAAK;QAE3H,+BAA+B;QAC/B,IAAIP,kBAAkB,QAAQ;YAC5B,OAAO3B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACI,aAAa,OAAOA,cAAc,UAAU;YAC/C,OAAO5B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACK,gBAAgB,OAAOA,iBAAiB,UAAU;YACrD,OAAO7B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,kBAAkB;QAClB,MAAMJ,SAAS,MAAMpC,SAASmD,SAAS,CAAC9C,OAAOuC;QAC/C,IAAI,CAACR,QAAQ;YACX,OAAOpB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,wBAAwB;QACxB,MAAMY,kBAAkB,MAAMpD,SAASqD,mBAAmB,CAAChD,OAAOuC,WAAWC;QAC7E,IAAI,CAACO,iBAAiB;YACpB,OAAOpC,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,uDAAuD;QACvD,MAAMc,UAAUzD;QAChB,MAAM0D,kBAAkB;YACtBX;YACAC;YACAC,OAAO,OAAOA,UAAU,WAAWA,QAAQ;YAC3CC,OAAO,OAAOA,UAAU,WAAWA,QAAQS;YAC3CR,gBAAgB,OAAOA,mBAAmB,WAAWA,iBAAiBQ;YACtEP,uBAAuB,OAAOA,0BAA0B,WAAWA,wBAAwBO;YAC3FC,YAAYC,KAAKC,GAAG;YACpBC,YAAYF,KAAKC,GAAG,KAAK;QAC3B;QAEA,MAAMtD,MAAMwD,GAAG,CAAC,CAAC,aAAa,EAAEP,SAAS,EAAEC,iBAAiB,SAAS,aAAa;QAElF,oCAAoC;QACpC,MAAMO,YAAY,IAAIC,IAAI,CAAC,kCAAkC,EAAEtD,aAAauD,QAAQ,IAAI,SAAS,sBAAsB,CAAC;QACxHF,UAAUG,YAAY,CAACJ,GAAG,CAAC,aAAapD,aAAayD,QAAQ;QAC7DJ,UAAUG,YAAY,CAACJ,GAAG,CAAC,iBAAiB;QAC5CC,UAAUG,YAAY,CAACJ,GAAG,CAAC,gBAAgB,GAAGtD,QAAQ,eAAe,CAAC;QACtEuD,UAAUG,YAAY,CAACJ,GAAG,CAAC,SAAS,OAAOf,UAAU,WAAWA,QAAQ;QACxEgB,UAAUG,YAAY,CAACJ,GAAG,CAAC,SAASP;QACpCQ,UAAUG,YAAY,CAACJ,GAAG,CAAC,iBAAiB;QAE5C,+CAA+C;QAC/C,OAAO7C,IAAImD,QAAQ,CAACL,UAAUM,QAAQ;IACxC;IAEA;;;;;GAKC,GACDjE,OAAOW,GAAG,CAAC,mBAAmB,OAAOmB,KAAcjB;QACjD,MAAM,EAAEqD,MAAMC,MAAM,EAAEvB,OAAOO,OAAO,EAAEf,KAAK,EAAEC,iBAAiB,EAAE,GAAGP,IAAIiB,KAAK;QAE5E,gCAAgC;QAChC,IAAIX,OAAO;YACT,OAAOvB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B;gBACAC,mBAAmBA,qBAAqB;YAC1C;QACF;QAEA,IAAI,CAAC8B,UAAU,OAAOA,WAAW,UAAU;YACzC,OAAOtD,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACc,WAAW,OAAOA,YAAY,UAAU;YAC3C,OAAOtC,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,sCAAsC;QACtC,MAAMe,kBAAkB,MAAMlD,MAAMS,GAAG,CAAC,CAAC,aAAa,EAAEwC,SAAS;QACjE,IAAI,CAACC,iBAAiB;YACpB,OAAOvC,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,8BAA8B;QAC9B,MAAMnC,MAAMkE,MAAM,CAAC,CAAC,aAAa,EAAEjB,SAAS;QAE5C,mDAAmD;QACnD,IAAI;YACF,MAAMkB,WAAW,CAAC,kCAAkC,EAAE/D,aAAauD,QAAQ,IAAI,SAAS,kBAAkB,CAAC;YAC3G,MAAMS,cAAc,IAAIC,gBAAgB;gBACtCC,YAAY;gBACZN,MAAMC;gBACN1B,WAAWnC,aAAayD,QAAQ;gBAChCrB,cAAc,GAAGtC,QAAQ,eAAe,CAAC;gBACzCuC,OAAOS,gBAAgBT,KAAK;YAC9B;YAEA,uDAAuD;YACvD,IAAIrC,aAAamE,YAAY,EAAE;gBAC7BH,YAAYZ,GAAG,CAAC,iBAAiBpD,aAAamE,YAAY;YAC5D;YAEA,MAAMC,gBAAgB,MAAMC,MAAMN,UAAU;gBAC1CO,QAAQ;gBACRC,SAAS;oBAAE,gBAAgB;gBAAoC;gBAC/D7C,MAAMsC,YAAYL,QAAQ;YAC5B;YAEA,IAAI,CAACS,cAAcI,EAAE,EAAE;gBACrB,MAAMC,YAAa,MAAML,cAAclE,IAAI;gBAC3C,MAAM,IAAI8B,MAAM,CAAC,iCAAiC,EAAEyC,UAAU1C,iBAAiB,IAAI0C,UAAU3C,KAAK,EAAE;YACtG;YAEA,MAAM4C,YAAa,MAAMN,cAAclE,IAAI;YAO3C,iDAAiD;YACjD,MAAMyE,iBAAiC;gBACrCC,aAAaF,UAAUG,YAAY;gBACnC,GAAIH,UAAUI,aAAa,IAAI;oBAAEC,cAAcL,UAAUI,aAAa;gBAAC,CAAC;gBACxEE,WAAW/B,KAAKC,GAAG,KAAKwB,UAAUO,UAAU,GAAG;gBAC/C5C,OAAOqC,UAAUrC,KAAK;YACxB;YAEA,4DAA4D;YAC5D,MAAM6C,UAAU9F;YAChB,MAAM+F,WAA8B;gBAClCvB,MAAMsB;gBACN/C,WAAWW,gBAAgBX,SAAS;gBACpCC,cAAcU,gBAAgBV,YAAY;gBAC1CC,OAAOS,gBAAgBT,KAAK;gBAC5B,GAAIS,gBAAgBP,cAAc,IAAI;oBAAEA,gBAAgBO,gBAAgBP,cAAc;gBAAC,CAAC;gBACxF,GAAIO,gBAAgBN,qBAAqB,IAAI;oBAAEA,uBAAuBM,gBAAgBN,qBAAqB;gBAAC,CAAC;gBAC7GmC;gBACA3B,YAAYC,KAAKC,GAAG;gBACpBC,YAAYF,KAAKC,GAAG,KAAK;YAC3B;YAEA,MAAM3D,SAAS6F,WAAW,CAACxF,OAAOsF,SAASC;YAE3C,0DAA0D;YAC1D,MAAME,oBAAoB,IAAI/B,IAAIR,gBAAgBV,YAAY;YAC9DiD,kBAAkB7B,YAAY,CAACJ,GAAG,CAAC,QAAQ8B;YAC3C,IAAIpC,gBAAgBR,KAAK,EAAE;gBACzB+C,kBAAkB7B,YAAY,CAACJ,GAAG,CAAC,SAASN,gBAAgBR,KAAK;YACnE;YAEA,OAAO/B,IAAImD,QAAQ,CAAC2B,kBAAkB1B,QAAQ;QAChD,EAAE,OAAO7B,OAAO;YACd,OAAOvB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmBD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;YAC9D;QACF;IACF;IAEA;;;GAGC,GACDvC,OAAO6B,IAAI,CAAC,gBAAgB,OAAOC,KAAcjB;QAC/C,mEAAmE;QACnE,IAAI4B,YAAYX,IAAIE,IAAI,CAACS,SAAS;QAClC,IAAImD,gBAAgB9D,IAAIE,IAAI,CAAC4D,aAAa;QAE1C,sEAAsE;QACtE,MAAMC,aAAa/D,IAAI+C,OAAO,CAACiB,aAAa;QAC5C,IAAID,cAAcA,WAAWE,UAAU,CAAC,WAAW;YACjD,MAAMC,oBAAoBH,WAAWI,SAAS,CAAC;YAC/C,MAAMC,cAAcC,OAAOC,IAAI,CAACJ,mBAAmB,UAAU/B,QAAQ,CAAC;YACtE,MAAM,CAACoC,IAAIC,OAAO,GAAGJ,YAAYK,KAAK,CAAC;YACvC9D,YAAY4D;YACZT,gBAAgBU;QAClB;QAEA,MAAM,EAAE9B,UAAU,EAAEN,IAAI,EAAExB,YAAY,EAAE0C,aAAa,EAAEoB,aAAa,EAAE,GAAG1E,IAAIE,IAAI;QAEjF,sBAAsB;QACtB,IAAI,CAACwC,YAAY;YACf,OAAO3D,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,IAAImC,eAAe,sBAAsB;YACvC,2BAA2B;YAC3B,IAAI,CAACN,QAAQ,CAACzB,aAAa,CAACC,cAAc;gBACxC,OAAO7B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,MAAMoE,gBAAgB,MAAM5G,SAAS6G,cAAc,CAACxG,OAAOuC,WAAWmD,0BAAAA,2BAAAA,gBAAiB;YACvF,IAAI,CAACa,eAAe;gBAClB,OAAO5F,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,yBAAyB;YACzB,MAAMoD,WAAW,MAAM5F,SAAS8G,WAAW,CAACzG,OAAOgE;YACnD,IAAI,CAACuB,UAAU;gBACb,OAAO5E,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,IAAIoD,SAAShD,SAAS,KAAKA,aAAagD,SAAS/C,YAAY,KAAKA,cAAc;gBAC9E,OAAO7B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,IAAIkB,KAAKC,GAAG,KAAKiC,SAAShC,UAAU,EAAE;gBACpC,MAAM5D,SAAS+G,cAAc,CAAC1G,OAAOgE;gBACrC,OAAOrD,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,wBAAwB;YACxB,IAAIoD,SAAS5C,cAAc,EAAE;oBASZ4C;gBARf,IAAI,CAACe,eAAe;oBAClB,OAAO3F,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;wBAC1B4B,OAAO;wBACPC,mBAAmB;oBACrB;gBACF;gBAEA,gDAAgD;gBAChD,MAAMuC,UAASa,kCAAAA,SAAS3C,qBAAqB,cAA9B2C,6CAAAA,kCAAkC;gBACjD,MAAMoB,oBAAoBjC,WAAW,SAASnF,WAAW,UAAUqH,MAAM,CAACN,eAAeO,MAAM,CAAC,eAAeP;gBAE/G,IAAIK,sBAAsBpB,SAAS5C,cAAc,EAAE;oBACjD,OAAOhC,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;wBAC1B4B,OAAO;wBACPC,mBAAmB;oBACrB;gBACF;YACF;YAEA,2CAA2C;YAC3C,MAAMxC,SAAS+G,cAAc,CAAC1G,OAAOgE;YAErC,4BAA4B;YAC5B,MAAMgB,cAAcxF;YACpB,MAAMsH,oBAAoBtH;YAE1B,MAAMsF,YAAyB;gBAC7BG,cAAcD;gBACd+B,YAAY;gBACZ1B,YAAY;gBACZH,eAAe4B;gBACfrE,OAAO8C,SAAS9C,KAAK;gBACrBF;gBACAwC,gBAAgBQ,SAASR,cAAc;gBACvC3B,YAAYC,KAAKC,GAAG;YACtB;YAEA,MAAM3D,SAASqH,cAAc,CAAChH,OAAOgF,aAAaF;YAClD,MAAMnF,SAASsH,eAAe,CAACjH,OAAO8G,mBAAmBhC;YAEzD,oDAAoD;YACpD,MAAMnF,SAASuH,iBAAiB,CAAClH,OAAOgF,aAAaO,SAASR,cAAc;YAE5E,wBAAwB;YACxB,OAAOpE,IAAIL,IAAI,CAAC;gBACd2E,cAAcH,UAAUG,YAAY;gBACpC8B,YAAYjC,UAAUiC,UAAU;gBAChC1B,YAAYP,UAAUO,UAAU;gBAChCH,eAAeJ,UAAUI,aAAa;gBACtCzC,OAAOqC,UAAUrC,KAAK;YACxB;QACF;QACA,IAAI6B,eAAe,iBAAiB;YAClC,sBAAsB;YACtB,IAAI,CAACY,iBAAiB,CAAC3C,WAAW;gBAChC,OAAO5B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,MAAMoE,gBAAgB,MAAM5G,SAAS6G,cAAc,CAACxG,OAAOuC,WAAWmD,0BAAAA,2BAAAA,gBAAiB;YACvF,IAAI,CAACa,eAAe;gBAClB,OAAO5F,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,oBAAoB;YACpB,MAAM2C,YAAY,MAAMnF,SAASwH,eAAe,CAACnH,OAAOkF;YACxD,IAAI,CAACJ,aAAaA,UAAUvC,SAAS,KAAKA,WAAW;gBACnD,OAAO5B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,uCAAuC;YACvC,IAAIiF,0BAA0BtC,UAAUC,cAAc;YACtD,IAAID,UAAUC,cAAc,CAACI,YAAY,EAAE;gBACzC,IAAI;wBAKU/E;oBAJZ,+DAA+D;oBAC/D,MAAMiH,WAAW,IAAI3H,iBAAiB;wBACpCmE,UAAUzD,aAAayD,QAAQ;wBAC/B,GAAIzD,aAAamE,YAAY,IAAI;4BAAEA,cAAcnE,aAAamE,YAAY;wBAAC,CAAC;wBAC5EZ,QAAQ,GAAEvD,yBAAAA,aAAauD,QAAQ,cAArBvD,oCAAAA,yBAAyB;wBACnCqC,OAAOqC,UAAUrC,KAAK;wBACtB6E,gBAAgB,GAAGpH,QAAQ,aAAa,CAAC;wBACzCqH,QAAQ;4BACNC,MAAMC,QAAQC,GAAG;4BACjBxF,OAAOuF,QAAQvF,KAAK;4BACpByF,MAAMF,QAAQE,IAAI;4BAClBC,OAAO,KAAO;wBAChB;oBACF;oBAEA,qCAAqC;oBACrCR,0BAA0B,MAAMC,SAASQ,kBAAkB,CAAC/C,UAAUC,cAAc,CAACI,YAAY;gBACnG,EAAE,OAAOjD,OAAO;oBACd,4EAA4E;oBAC5EuF,QAAQE,IAAI,CAAC,yDAAyDzF,iBAAiBE,QAAQF,MAAMG,OAAO,GAAGyF,OAAO5F;gBACxH;YACF;YAEA,gCAAgC;YAChC,MAAM6F,iBAAiBvI;YACvB,MAAMwI,eAA4B;gBAChC,GAAGlD,SAAS;gBACZG,cAAc8C;gBACd3E,YAAYC,KAAKC,GAAG;YACtB;YAEA,MAAM3D,SAASqH,cAAc,CAAChH,OAAO+H,gBAAgBC;YAErD,kEAAkE;YAClE,MAAMrI,SAASuH,iBAAiB,CAAClH,OAAO+H,gBAAgBX;YAExD,OAAOzG,IAAIL,IAAI,CAAC;gBACd2E,cAAc+C,aAAa/C,YAAY;gBACvC8B,YAAYiB,aAAajB,UAAU;gBACnC1B,YAAY2C,aAAa3C,UAAU;gBACnC5C,OAAOuF,aAAavF,KAAK;YAC3B;QACF;QACA,OAAO9B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;YAC1B4B,OAAO;YACPC,mBAAmB;QACrB;IACF;IAEA;;;GAGC,GACDrC,OAAO6B,IAAI,CAAC,iBAAiB,OAAOC,KAAcjB;QAChD,MAAM,EAAEsH,KAAK,EAAEC,eAAe,EAAE3F,SAAS,EAAEmD,aAAa,EAAE,GAAG9D,IAAIE,IAAI;QAErE,IAAI,CAACmG,OAAO;YACV,OAAOtH,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,0CAA0C;QAC1C,IAAII,aAAamD,eAAe;YAC9B,MAAMa,gBAAgB,MAAM5G,SAAS6G,cAAc,CAACxG,OAAOuC,WAAWmD;YACtE,IAAI,CAACa,eAAe;gBAClB,OAAO5F,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;QACF;QAEA,mBAAmB;QACnB,IAAI+F,oBAAoB,iBAAiB;YACvC,MAAMvI,SAASwI,kBAAkB,CAACnI,OAAOiI;QAC3C,OAAO,IAAIC,oBAAoB,gBAAgB;YAC7C,MAAMvI,SAASyI,iBAAiB,CAACpI,OAAOiI;YACxC,MAAMtI,SAAS0I,oBAAoB,CAACrI,OAAOiI;QAC7C,OAAO;YACL,qBAAqB;YACrB,MAAMtI,SAASwI,kBAAkB,CAACnI,OAAOiI;YACzC,MAAMtI,SAASyI,iBAAiB,CAACpI,OAAOiI;YACxC,MAAMtI,SAAS0I,oBAAoB,CAACrI,OAAOiI;QAC7C;QAEA,+CAA+C;QAC/C,OAAOtH,IAAIsB,MAAM,CAAC,KAAKqG,IAAI;IAC7B;IAEA;;;;;;GAMC,GACDxI,OAAOW,GAAG,CAAC,iBAAiB,OAAOmB,KAAcjB;QAC/C,iDAAiD;QACjD,MAAMgF,aAAa/D,IAAI+C,OAAO,CAACiB,aAAa;QAE5C,IAAI,CAACD,cAAc,CAACA,WAAWE,UAAU,CAAC,YAAY;YACpD,OAAOlF,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,MAAM8F,QAAQtC,WAAWI,SAAS,CAAC,IAAI,0BAA0B;QAEjE,+CAA+C;QAC/C,MAAMjB,YAAY,MAAMnF,SAAS4I,cAAc,CAACvI,OAAOiI;QAEvD,IAAI,CAACnD,WAAW;YACd,OAAOnE,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,4BAA4B;QAC5B,MAAMmB,MAAMD,KAAKC,GAAG;QACpB,MAAM8B,YAAYN,UAAU1B,UAAU,GAAG0B,UAAUO,UAAU,GAAG;QAEhE,IAAI/B,MAAM8B,WAAW;YACnB,uBAAuB;YACvB,MAAMzF,SAASyI,iBAAiB,CAACpI,OAAOiI;YACxC,MAAMtI,SAAS0I,oBAAoB,CAACrI,OAAOiI;YAC3C,OAAOtH,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,yDAAyD;QACzD,MAAMqG,WAAW;YACfP;YACApE,UAAUiB,UAAUvC,SAAS;YAC7BkG,QAAQ3D,UAAUrC,KAAK,GAAGqC,UAAUrC,KAAK,CAAC4D,KAAK,CAAC,OAAO,EAAE;YACzDjB;YACAL,gBAAgBD,UAAUC,cAAc;QAC1C;QAEA,OAAOpE,IAAIL,IAAI,CAACkI;IAClB;IAEA;;GAEC,GACD1I,OAAOW,GAAG,CAAC,kBAAkB,OAAOC,MAAeC;QACjD,MAAM+H,UAAU,MAAM/I,SAASgJ,WAAW,CAAC3I;QAC3CW,IAAIL,IAAI,CAACoI;IACX;IAEA,OAAO5I;AACT"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/dcr-router.ts"],"sourcesContent":["/**\n * DCR Router - OAuth 2.0 Authorization Server\n *\n * Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)\n * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).\n *\n * Endpoints:\n * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)\n * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)\n * - POST /oauth/register (RFC 7591 client registration)\n * - GET /oauth/authorize (RFC 6749 authorization endpoint)\n * - POST /oauth/token (RFC 6749 token endpoint)\n * - POST /oauth/revoke (RFC 7009 token revocation)\n * - GET /oauth/verify (token verification for Resource Server)\n */\n\nimport type { ProviderTokens, RFC8414Metadata, RFC9728Metadata } from '@mcp-z/oauth';\nimport { createHash, randomUUID } from 'crypto';\nimport type { Request, Response } from 'express';\nimport express from 'express';\nimport type { Keyv } from 'keyv';\nimport { DcrOAuthProvider } from '../providers/dcr.ts';\nimport type { AccessToken, AuthorizationCode, OAuthClientConfig } from '../types.ts';\nimport * as dcrUtils from './dcr-utils.ts';\n\n/**\n * Configuration for DCR Router (self-hosted mode only)\n */\nexport interface DcrRouterConfig {\n  /** Single Keyv store for all DCR data */\n  store: Keyv;\n\n  /** Authorization Server issuer URL */\n  issuerUrl: string;\n\n  /** Base URL for OAuth endpoints */\n  baseUrl: string;\n\n  /** Supported OAuth scopes */\n  scopesSupported: string[];\n\n  /** OAuth client configuration for upstream provider */\n  clientConfig: OAuthClientConfig;\n}\n\n/**\n * Create DCR Router with OAuth 2.0 endpoints (self-hosted mode)\n *\n * For external mode (Auth0/Stitch), don't call this function - no router needed.\n * The server code should check DcrConfig.mode and only call this for 'self-hosted'.\n *\n * @param config - Router configuration\n * @returns Express router with OAuth endpoints\n */\nexport function createDcrRouter(config: DcrRouterConfig): express.Router {\n  const router = express.Router();\n  const { store, issuerUrl, baseUrl, scopesSupported, clientConfig } = config;\n\n  // Apply required middleware for OAuth 2.0 endpoints (RFC 6749)\n  router.use(express.json()); // For /oauth/register (application/json)\n  router.use(express.urlencoded({ extended: true })); // For /oauth/token (application/x-www-form-urlencoded)\n\n  /**\n   * OAuth Authorization Server Metadata (RFC 8414)\n   * GET /.well-known/oauth-authorization-server\n   */\n  router.get('/.well-known/oauth-authorization-server', (_req: Request, res: Response) => {\n    const metadata: RFC8414Metadata = {\n      issuer: issuerUrl,\n      authorization_endpoint: `${baseUrl}/oauth/authorize`,\n      token_endpoint: `${baseUrl}/oauth/token`,\n      registration_endpoint: `${baseUrl}/oauth/register`,\n      revocation_endpoint: `${baseUrl}/oauth/revoke`,\n      scopes_supported: scopesSupported,\n      response_types_supported: ['code'],\n      grant_types_supported: ['authorization_code', 'refresh_token'],\n      token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],\n      code_challenge_methods_supported: ['S256', 'plain'],\n      service_documentation: `${baseUrl}/docs`,\n    };\n    res.json(metadata);\n  });\n\n  /**\n   * OAuth Protected Resource Metadata (RFC 9728 - Root)\n   * GET /.well-known/oauth-protected-resource\n   */\n  router.get('/.well-known/oauth-protected-resource', (_req: Request, res: Response) => {\n    const metadata: RFC9728Metadata = {\n      resource: baseUrl,\n      authorization_servers: [baseUrl],\n      scopes_supported: scopesSupported,\n      bearer_methods_supported: ['header'],\n    };\n    res.json(metadata);\n  });\n\n  /**\n   * OAuth Protected Resource Metadata (RFC 9728 - Sub-path /mcp)\n   * GET /.well-known/oauth-protected-resource/mcp\n   */\n  router.get('/.well-known/oauth-protected-resource/mcp', (_req: Request, res: Response) => {\n    const metadata: RFC9728Metadata = {\n      resource: `${baseUrl}/mcp`,\n      authorization_servers: [baseUrl],\n      scopes_supported: scopesSupported,\n      bearer_methods_supported: ['header'],\n    };\n    res.json(metadata);\n  });\n\n  /**\n   * Dynamic Client Registration (RFC 7591)\n   * POST /oauth/register\n   */\n  router.post('/oauth/register', async (req: Request, res: Response) => {\n    try {\n      const registrationRequest = req.body;\n\n      // Register the client\n      const client = await dcrUtils.registerClient(store, registrationRequest);\n\n      // Return client information (RFC 7591 Section 3.2.1)\n      res.status(201).json(client);\n    } catch (error) {\n      res.status(400).json({\n        error: 'invalid_client_metadata',\n        error_description: error instanceof Error ? error.message : 'Invalid registration request',\n      });\n    }\n  });\n\n  /**\n   * OAuth Authorization Endpoint (RFC 6749 Section 3.1)\n   * GET /oauth/authorize\n   *\n   * Initiates Microsoft OAuth flow, then generates DCR authorization code\n   */\n  router.get('/oauth/authorize', async (req: Request, res: Response) => {\n    const { response_type, client_id, redirect_uri, scope = '', state = '', code_challenge, code_challenge_method } = req.query;\n\n    // Validate required parameters\n    if (response_type !== 'code') {\n      return res.status(400).json({\n        error: 'unsupported_response_type',\n        error_description: 'Only response_type=code is supported',\n      });\n    }\n\n    if (!client_id || typeof client_id !== 'string') {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'client_id is required',\n      });\n    }\n\n    if (!redirect_uri || typeof redirect_uri !== 'string') {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'redirect_uri is required',\n      });\n    }\n\n    // Validate client\n    const client = await dcrUtils.getClient(store, client_id);\n    if (!client) {\n      return res.status(400).json({\n        error: 'invalid_client',\n        error_description: 'Unknown client_id',\n      });\n    }\n\n    // Validate redirect_uri\n    const isValidRedirect = await dcrUtils.validateRedirectUri(store, client_id, redirect_uri);\n    if (!isValidRedirect) {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'Invalid redirect_uri',\n      });\n    }\n\n    // Store DCR request state for Microsoft OAuth callback\n    const msState = randomUUID();\n    const dcrRequestState = {\n      client_id,\n      redirect_uri,\n      scope: typeof scope === 'string' ? scope : '',\n      state: typeof state === 'string' ? state : undefined,\n      code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,\n      code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,\n      created_at: Date.now(),\n      expires_at: Date.now() + 600000, // 10 minutes\n    };\n\n    await store.set(`dcr:ms-state:${msState}`, dcrRequestState, 600000); // 10 min TTL\n\n    // Build Microsoft authorization URL\n    const msAuthUrl = new URL(`https://login.microsoftonline.com/${clientConfig.tenantId || 'common'}/oauth2/v2.0/authorize`);\n    msAuthUrl.searchParams.set('client_id', clientConfig.clientId);\n    msAuthUrl.searchParams.set('response_type', 'code');\n    msAuthUrl.searchParams.set('redirect_uri', `${baseUrl}/oauth/callback`);\n    msAuthUrl.searchParams.set('scope', typeof scope === 'string' ? scope : '');\n    msAuthUrl.searchParams.set('state', msState);\n    msAuthUrl.searchParams.set('response_mode', 'query');\n\n    // Redirect user to Microsoft for authorization\n    return res.redirect(msAuthUrl.toString());\n  });\n\n  /**\n   * OAuth Callback Handler\n   * GET /oauth/callback\n   *\n   * Handles callback from Microsoft after user authorization\n   */\n  router.get('/oauth/callback', async (req: Request, res: Response) => {\n    const { code: msCode, state: msState, error, error_description } = req.query;\n\n    // Handle Microsoft OAuth errors\n    if (error) {\n      return res.status(400).json({\n        error,\n        error_description: error_description || 'Microsoft OAuth authorization failed',\n      });\n    }\n\n    if (!msCode || typeof msCode !== 'string') {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'Authorization code is required',\n      });\n    }\n\n    if (!msState || typeof msState !== 'string') {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'State parameter is required',\n      });\n    }\n\n    // Retrieve original DCR request state\n    const dcrRequestState = await store.get(`dcr:ms-state:${msState}`);\n    if (!dcrRequestState) {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'Invalid or expired state parameter',\n      });\n    }\n\n    // Delete state (one-time use)\n    await store.delete(`dcr:ms-state:${msState}`);\n\n    // Exchange Microsoft authorization code for tokens\n    try {\n      const tokenUrl = `https://login.microsoftonline.com/${clientConfig.tenantId || 'common'}/oauth2/v2.0/token`;\n      const tokenParams = new URLSearchParams({\n        grant_type: 'authorization_code',\n        code: msCode,\n        client_id: clientConfig.clientId,\n        redirect_uri: `${baseUrl}/oauth/callback`,\n        scope: dcrRequestState.scope,\n      });\n\n      // Add client_secret if available (confidential client)\n      if (clientConfig.clientSecret) {\n        tokenParams.set('client_secret', clientConfig.clientSecret);\n      }\n\n      const tokenResponse = await fetch(tokenUrl, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: tokenParams.toString(),\n      });\n\n      if (!tokenResponse.ok) {\n        const errorData = (await tokenResponse.json()) as { error?: string; error_description?: string };\n        throw new Error(`Microsoft token exchange failed: ${errorData.error_description || errorData.error}`);\n      }\n\n      const tokenData = (await tokenResponse.json()) as {\n        access_token: string;\n        refresh_token?: string;\n        expires_in: number;\n        scope: string;\n      };\n\n      // Create provider tokens from Microsoft response\n      const providerTokens: ProviderTokens = {\n        accessToken: tokenData.access_token,\n        ...(tokenData.refresh_token && { refreshToken: tokenData.refresh_token }),\n        expiresAt: Date.now() + tokenData.expires_in * 1000,\n        scope: tokenData.scope,\n      };\n\n      // Generate DCR authorization code with real provider tokens\n      const dcrCode = randomUUID();\n      const authCode: AuthorizationCode = {\n        code: dcrCode,\n        client_id: dcrRequestState.client_id,\n        redirect_uri: dcrRequestState.redirect_uri,\n        scope: dcrRequestState.scope,\n        ...(dcrRequestState.code_challenge && { code_challenge: dcrRequestState.code_challenge }),\n        ...(dcrRequestState.code_challenge_method && { code_challenge_method: dcrRequestState.code_challenge_method }),\n        providerTokens,\n        created_at: Date.now(),\n        expires_at: Date.now() + 600000, // 10 minutes\n      };\n\n      await dcrUtils.setAuthCode(store, dcrCode, authCode);\n\n      // Redirect back to MCP client with DCR authorization code\n      const clientRedirectUrl = new URL(dcrRequestState.redirect_uri);\n      clientRedirectUrl.searchParams.set('code', dcrCode);\n      if (dcrRequestState.state) {\n        clientRedirectUrl.searchParams.set('state', dcrRequestState.state);\n      }\n\n      return res.redirect(clientRedirectUrl.toString());\n    } catch (error) {\n      return res.status(500).json({\n        error: 'server_error',\n        error_description: error instanceof Error ? error.message : 'Failed to exchange authorization code',\n      });\n    }\n  });\n\n  /**\n   * OAuth Token Endpoint (RFC 6749 Section 3.2)\n   * POST /oauth/token\n   */\n  router.post('/oauth/token', async (req: Request, res: Response) => {\n    // Extract client credentials from either body or Basic Auth header\n    let client_id = req.body.client_id;\n    let client_secret = req.body.client_secret;\n\n    // Support client_secret_basic authentication (RFC 6749 Section 2.3.1)\n    const authHeader = req.headers.authorization;\n    if (authHeader && authHeader.startsWith('Basic ')) {\n      const base64Credentials = authHeader.substring(6);\n      const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n      const [id, secret] = credentials.split(':');\n      client_id = id;\n      client_secret = secret;\n    }\n\n    const { grant_type, code, redirect_uri, refresh_token, code_verifier } = req.body;\n\n    // Validate grant_type\n    if (!grant_type) {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'grant_type is required',\n      });\n    }\n\n    if (grant_type === 'authorization_code') {\n      // Authorization Code Grant\n      if (!code || !client_id || !redirect_uri) {\n        return res.status(400).json({\n          error: 'invalid_request',\n          error_description: 'code, client_id, and redirect_uri are required',\n        });\n      }\n\n      // Validate client credentials\n      const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n      if (!isValidClient) {\n        return res.status(401).json({\n          error: 'invalid_client',\n          error_description: 'Invalid client credentials',\n        });\n      }\n\n      // Get authorization code\n      const authCode = await dcrUtils.getAuthCode(store, code);\n      if (!authCode) {\n        return res.status(400).json({\n          error: 'invalid_grant',\n          error_description: 'Invalid or expired authorization code',\n        });\n      }\n\n      // Validate authorization code\n      if (authCode.client_id !== client_id || authCode.redirect_uri !== redirect_uri) {\n        return res.status(400).json({\n          error: 'invalid_grant',\n          error_description: 'Authorization code mismatch',\n        });\n      }\n\n      if (Date.now() > authCode.expires_at) {\n        await dcrUtils.deleteAuthCode(store, code);\n        return res.status(400).json({\n          error: 'invalid_grant',\n          error_description: 'Authorization code expired',\n        });\n      }\n\n      // Validate PKCE if used\n      if (authCode.code_challenge) {\n        if (!code_verifier) {\n          return res.status(400).json({\n            error: 'invalid_request',\n            error_description: 'code_verifier is required for PKCE',\n          });\n        }\n\n        // Validate code_verifier against code_challenge\n        const method = authCode.code_challenge_method ?? 'plain';\n        const computedChallenge = method === 'S256' ? createHash('sha256').update(code_verifier).digest('base64url') : code_verifier;\n\n        if (computedChallenge !== authCode.code_challenge) {\n          return res.status(400).json({\n            error: 'invalid_grant',\n            error_description: 'Invalid code_verifier',\n          });\n        }\n      }\n\n      // Delete authorization code (one-time use)\n      await dcrUtils.deleteAuthCode(store, code);\n\n      // Generate DCR access token\n      const accessToken = randomUUID();\n      const refreshTokenValue = randomUUID();\n\n      const tokenData: AccessToken = {\n        access_token: accessToken,\n        token_type: 'Bearer',\n        expires_in: 3600,\n        refresh_token: refreshTokenValue,\n        scope: authCode.scope,\n        client_id,\n        providerTokens: authCode.providerTokens,\n        created_at: Date.now(),\n      };\n\n      await dcrUtils.setAccessToken(store, accessToken, tokenData);\n      await dcrUtils.setRefreshToken(store, refreshTokenValue, tokenData);\n\n      // Store provider tokens indexed by DCR access token\n      await dcrUtils.setProviderTokens(store, accessToken, authCode.providerTokens);\n\n      // Return token response\n      return res.json({\n        access_token: tokenData.access_token,\n        token_type: tokenData.token_type,\n        expires_in: tokenData.expires_in,\n        refresh_token: tokenData.refresh_token,\n        scope: tokenData.scope,\n      });\n    }\n    if (grant_type === 'refresh_token') {\n      // Refresh Token Grant\n      if (!refresh_token || !client_id) {\n        return res.status(400).json({\n          error: 'invalid_request',\n          error_description: 'refresh_token and client_id are required',\n        });\n      }\n\n      // Validate client credentials\n      const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n      if (!isValidClient) {\n        return res.status(401).json({\n          error: 'invalid_client',\n          error_description: 'Invalid client credentials',\n        });\n      }\n\n      // Get refresh token\n      const tokenData = await dcrUtils.getRefreshToken(store, refresh_token);\n      if (!tokenData || tokenData.client_id !== client_id) {\n        return res.status(400).json({\n          error: 'invalid_grant',\n          error_description: 'Invalid refresh token',\n        });\n      }\n\n      // Refresh provider tokens if available\n      let refreshedProviderTokens = tokenData.providerTokens;\n      if (tokenData.providerTokens.refreshToken) {\n        try {\n          // Create DcrOAuthProvider instance to refresh Microsoft tokens\n          const provider = new DcrOAuthProvider({\n            clientId: clientConfig.clientId,\n            ...(clientConfig.clientSecret && { clientSecret: clientConfig.clientSecret }),\n            tenantId: clientConfig.tenantId ?? 'common',\n            scope: tokenData.scope,\n            verifyEndpoint: `${baseUrl}/oauth/verify`,\n            logger: {\n              info: console.log,\n              error: console.error,\n              warn: console.warn,\n              debug: () => {},\n            },\n          });\n\n          // Refresh the Microsoft access token\n          refreshedProviderTokens = await provider.refreshAccessToken(tokenData.providerTokens.refreshToken);\n        } catch (error) {\n          // If refresh fails, continue with existing tokens (they may still be valid)\n          console.warn('Provider token refresh failed, using existing tokens:', error instanceof Error ? error.message : String(error));\n        }\n      }\n\n      // Generate new DCR access token\n      const newAccessToken = randomUUID();\n      const newTokenData: AccessToken = {\n        ...tokenData,\n        access_token: newAccessToken,\n        created_at: Date.now(),\n      };\n\n      await dcrUtils.setAccessToken(store, newAccessToken, newTokenData);\n\n      // Store refreshed provider tokens indexed by new DCR access token\n      await dcrUtils.setProviderTokens(store, newAccessToken, refreshedProviderTokens);\n\n      return res.json({\n        access_token: newTokenData.access_token,\n        token_type: newTokenData.token_type,\n        expires_in: newTokenData.expires_in,\n        scope: newTokenData.scope,\n      });\n    }\n    return res.status(400).json({\n      error: 'unsupported_grant_type',\n      error_description: 'Only authorization_code and refresh_token grants are supported',\n    });\n  });\n\n  /**\n   * OAuth Token Revocation (RFC 7009)\n   * POST /oauth/revoke\n   */\n  router.post('/oauth/revoke', async (req: Request, res: Response) => {\n    const { token, token_type_hint, client_id, client_secret } = req.body;\n\n    if (!token) {\n      return res.status(400).json({\n        error: 'invalid_request',\n        error_description: 'token is required',\n      });\n    }\n\n    // Validate client if credentials provided\n    if (client_id && client_secret) {\n      const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret);\n      if (!isValidClient) {\n        return res.status(401).json({\n          error: 'invalid_client',\n          error_description: 'Invalid client credentials',\n        });\n      }\n    }\n\n    // Revoke the token\n    if (token_type_hint === 'refresh_token') {\n      await dcrUtils.deleteRefreshToken(store, token);\n    } else if (token_type_hint === 'access_token') {\n      await dcrUtils.deleteAccessToken(store, token);\n      await dcrUtils.deleteProviderTokens(store, token);\n    } else {\n      // No hint - try both\n      await dcrUtils.deleteRefreshToken(store, token);\n      await dcrUtils.deleteAccessToken(store, token);\n      await dcrUtils.deleteProviderTokens(store, token);\n    }\n\n    // RFC 7009: Return 200 even if token not found\n    return res.status(200).send();\n  });\n\n  /**\n   * Token Verification Endpoint\n   * GET /oauth/verify\n   *\n   * Validates bearer tokens for Resource Server.\n   * Returns AuthInfo with provider tokens for stateless DCR pattern.\n   */\n  router.get('/oauth/verify', async (req: Request, res: Response) => {\n    // Extract bearer token from Authorization header\n    const authHeader = req.headers.authorization;\n\n    if (!authHeader || !authHeader.startsWith('Bearer ')) {\n      return res.status(401).json({\n        error: 'invalid_request',\n        error_description: 'Missing or invalid Authorization header',\n      });\n    }\n\n    const token = authHeader.substring(7); // Remove 'Bearer ' prefix\n\n    // Validate token exists in access tokens store\n    const tokenData = await dcrUtils.getAccessToken(store, token);\n\n    if (!tokenData) {\n      return res.status(401).json({\n        error: 'invalid_token',\n        error_description: 'Unknown or expired access token',\n      });\n    }\n\n    // Check if token is expired\n    const now = Date.now();\n    const expiresAt = tokenData.created_at + tokenData.expires_in * 1000;\n\n    if (now > expiresAt) {\n      // Remove expired token\n      await dcrUtils.deleteAccessToken(store, token);\n      await dcrUtils.deleteProviderTokens(store, token);\n      return res.status(401).json({\n        error: 'invalid_token',\n        error_description: 'Access token has expired',\n      });\n    }\n\n    // Return AuthInfo with provider tokens for stateless DCR\n    const authInfo = {\n      token,\n      clientId: tokenData.client_id,\n      scopes: tokenData.scope ? tokenData.scope.split(' ') : [],\n      expiresAt,\n      providerTokens: tokenData.providerTokens,\n    };\n\n    return res.json(authInfo);\n  });\n\n  /**\n   * Debug endpoint to list registered clients (development only)\n   */\n  router.get('/debug/clients', async (_req: Request, res: Response) => {\n    const clients = await dcrUtils.listClients(store);\n    res.json(clients);\n  });\n\n  return router;\n}\n"],"names":["createHash","randomUUID","express","DcrOAuthProvider","dcrUtils","createDcrRouter","config","router","Router","store","issuerUrl","baseUrl","scopesSupported","clientConfig","use","json","urlencoded","extended","get","_req","res","metadata","issuer","authorization_endpoint","token_endpoint","registration_endpoint","revocation_endpoint","scopes_supported","response_types_supported","grant_types_supported","token_endpoint_auth_methods_supported","code_challenge_methods_supported","service_documentation","resource","authorization_servers","bearer_methods_supported","post","req","registrationRequest","body","client","registerClient","status","error","error_description","Error","message","response_type","client_id","redirect_uri","scope","state","code_challenge","code_challenge_method","query","getClient","isValidRedirect","validateRedirectUri","msState","dcrRequestState","undefined","created_at","Date","now","expires_at","set","msAuthUrl","URL","tenantId","searchParams","clientId","redirect","toString","code","msCode","delete","tokenUrl","tokenParams","URLSearchParams","grant_type","clientSecret","tokenResponse","fetch","method","headers","ok","errorData","tokenData","providerTokens","accessToken","access_token","refresh_token","refreshToken","expiresAt","expires_in","dcrCode","authCode","setAuthCode","clientRedirectUrl","client_secret","authHeader","authorization","startsWith","base64Credentials","substring","credentials","Buffer","from","id","secret","split","code_verifier","isValidClient","validateClient","getAuthCode","deleteAuthCode","computedChallenge","update","digest","refreshTokenValue","token_type","setAccessToken","setRefreshToken","setProviderTokens","getRefreshToken","refreshedProviderTokens","provider","verifyEndpoint","logger","info","console","log","warn","debug","refreshAccessToken","String","newAccessToken","newTokenData","token","token_type_hint","deleteRefreshToken","deleteAccessToken","deleteProviderTokens","send","getAccessToken","authInfo","scopes","clients","listClients"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,UAAU,EAAEC,UAAU,QAAQ,SAAS;AAEhD,OAAOC,aAAa,UAAU;AAE9B,SAASC,gBAAgB,QAAQ,sBAAsB;AAEvD,YAAYC,cAAc,iBAAiB;AAsB3C;;;;;;;;CAQC,GACD,OAAO,SAASC,gBAAgBC,MAAuB;IACrD,MAAMC,SAASL,QAAQM,MAAM;IAC7B,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,OAAO,EAAEC,eAAe,EAAEC,YAAY,EAAE,GAAGP;IAErE,+DAA+D;IAC/DC,OAAOO,GAAG,CAACZ,QAAQa,IAAI,KAAK,yCAAyC;IACrER,OAAOO,GAAG,CAACZ,QAAQc,UAAU,CAAC;QAAEC,UAAU;IAAK,KAAK,uDAAuD;IAE3G;;;GAGC,GACDV,OAAOW,GAAG,CAAC,2CAA2C,CAACC,MAAeC;QACpE,MAAMC,WAA4B;YAChCC,QAAQZ;YACRa,wBAAwB,GAAGZ,QAAQ,gBAAgB,CAAC;YACpDa,gBAAgB,GAAGb,QAAQ,YAAY,CAAC;YACxCc,uBAAuB,GAAGd,QAAQ,eAAe,CAAC;YAClDe,qBAAqB,GAAGf,QAAQ,aAAa,CAAC;YAC9CgB,kBAAkBf;YAClBgB,0BAA0B;gBAAC;aAAO;YAClCC,uBAAuB;gBAAC;gBAAsB;aAAgB;YAC9DC,uCAAuC;gBAAC;gBAAuB;aAAqB;YACpFC,kCAAkC;gBAAC;gBAAQ;aAAQ;YACnDC,uBAAuB,GAAGrB,QAAQ,KAAK,CAAC;QAC1C;QACAS,IAAIL,IAAI,CAACM;IACX;IAEA;;;GAGC,GACDd,OAAOW,GAAG,CAAC,yCAAyC,CAACC,MAAeC;QAClE,MAAMC,WAA4B;YAChCY,UAAUtB;YACVuB,uBAAuB;gBAACvB;aAAQ;YAChCgB,kBAAkBf;YAClBuB,0BAA0B;gBAAC;aAAS;QACtC;QACAf,IAAIL,IAAI,CAACM;IACX;IAEA;;;GAGC,GACDd,OAAOW,GAAG,CAAC,6CAA6C,CAACC,MAAeC;QACtE,MAAMC,WAA4B;YAChCY,UAAU,GAAGtB,QAAQ,IAAI,CAAC;YAC1BuB,uBAAuB;gBAACvB;aAAQ;YAChCgB,kBAAkBf;YAClBuB,0BAA0B;gBAAC;aAAS;QACtC;QACAf,IAAIL,IAAI,CAACM;IACX;IAEA;;;GAGC,GACDd,OAAO6B,IAAI,CAAC,mBAAmB,OAAOC,KAAcjB;QAClD,IAAI;YACF,MAAMkB,sBAAsBD,IAAIE,IAAI;YAEpC,sBAAsB;YACtB,MAAMC,SAAS,MAAMpC,SAASqC,cAAc,CAAChC,OAAO6B;YAEpD,qDAAqD;YACrDlB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAACyB;QACvB,EAAE,OAAOG,OAAO;YACdvB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBACnB4B,OAAO;gBACPC,mBAAmBD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;YAC9D;QACF;IACF;IAEA;;;;;GAKC,GACDvC,OAAOW,GAAG,CAAC,oBAAoB,OAAOmB,KAAcjB;QAClD,MAAM,EAAE2B,aAAa,EAAEC,SAAS,EAAEC,YAAY,EAAEC,QAAQ,EAAE,EAAEC,QAAQ,EAAE,EAAEC,cAAc,EAAEC,qBAAqB,EAAE,GAAGhB,IAAIiB,KAAK;QAE3H,+BAA+B;QAC/B,IAAIP,kBAAkB,QAAQ;YAC5B,OAAO3B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACI,aAAa,OAAOA,cAAc,UAAU;YAC/C,OAAO5B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACK,gBAAgB,OAAOA,iBAAiB,UAAU;YACrD,OAAO7B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,kBAAkB;QAClB,MAAMJ,SAAS,MAAMpC,SAASmD,SAAS,CAAC9C,OAAOuC;QAC/C,IAAI,CAACR,QAAQ;YACX,OAAOpB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,wBAAwB;QACxB,MAAMY,kBAAkB,MAAMpD,SAASqD,mBAAmB,CAAChD,OAAOuC,WAAWC;QAC7E,IAAI,CAACO,iBAAiB;YACpB,OAAOpC,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,uDAAuD;QACvD,MAAMc,UAAUzD;QAChB,MAAM0D,kBAAkB;YACtBX;YACAC;YACAC,OAAO,OAAOA,UAAU,WAAWA,QAAQ;YAC3CC,OAAO,OAAOA,UAAU,WAAWA,QAAQS;YAC3CR,gBAAgB,OAAOA,mBAAmB,WAAWA,iBAAiBQ;YACtEP,uBAAuB,OAAOA,0BAA0B,WAAWA,wBAAwBO;YAC3FC,YAAYC,KAAKC,GAAG;YACpBC,YAAYF,KAAKC,GAAG,KAAK;QAC3B;QAEA,MAAMtD,MAAMwD,GAAG,CAAC,CAAC,aAAa,EAAEP,SAAS,EAAEC,iBAAiB,SAAS,aAAa;QAElF,oCAAoC;QACpC,MAAMO,YAAY,IAAIC,IAAI,CAAC,kCAAkC,EAAEtD,aAAauD,QAAQ,IAAI,SAAS,sBAAsB,CAAC;QACxHF,UAAUG,YAAY,CAACJ,GAAG,CAAC,aAAapD,aAAayD,QAAQ;QAC7DJ,UAAUG,YAAY,CAACJ,GAAG,CAAC,iBAAiB;QAC5CC,UAAUG,YAAY,CAACJ,GAAG,CAAC,gBAAgB,GAAGtD,QAAQ,eAAe,CAAC;QACtEuD,UAAUG,YAAY,CAACJ,GAAG,CAAC,SAAS,OAAOf,UAAU,WAAWA,QAAQ;QACxEgB,UAAUG,YAAY,CAACJ,GAAG,CAAC,SAASP;QACpCQ,UAAUG,YAAY,CAACJ,GAAG,CAAC,iBAAiB;QAE5C,+CAA+C;QAC/C,OAAO7C,IAAImD,QAAQ,CAACL,UAAUM,QAAQ;IACxC;IAEA;;;;;GAKC,GACDjE,OAAOW,GAAG,CAAC,mBAAmB,OAAOmB,KAAcjB;QACjD,MAAM,EAAEqD,MAAMC,MAAM,EAAEvB,OAAOO,OAAO,EAAEf,KAAK,EAAEC,iBAAiB,EAAE,GAAGP,IAAIiB,KAAK;QAE5E,gCAAgC;QAChC,IAAIX,OAAO;YACT,OAAOvB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B;gBACAC,mBAAmBA,qBAAqB;YAC1C;QACF;QAEA,IAAI,CAAC8B,UAAU,OAAOA,WAAW,UAAU;YACzC,OAAOtD,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACc,WAAW,OAAOA,YAAY,UAAU;YAC3C,OAAOtC,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,sCAAsC;QACtC,MAAMe,kBAAkB,MAAMlD,MAAMS,GAAG,CAAC,CAAC,aAAa,EAAEwC,SAAS;QACjE,IAAI,CAACC,iBAAiB;YACpB,OAAOvC,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,8BAA8B;QAC9B,MAAMnC,MAAMkE,MAAM,CAAC,CAAC,aAAa,EAAEjB,SAAS;QAE5C,mDAAmD;QACnD,IAAI;YACF,MAAMkB,WAAW,CAAC,kCAAkC,EAAE/D,aAAauD,QAAQ,IAAI,SAAS,kBAAkB,CAAC;YAC3G,MAAMS,cAAc,IAAIC,gBAAgB;gBACtCC,YAAY;gBACZN,MAAMC;gBACN1B,WAAWnC,aAAayD,QAAQ;gBAChCrB,cAAc,GAAGtC,QAAQ,eAAe,CAAC;gBACzCuC,OAAOS,gBAAgBT,KAAK;YAC9B;YAEA,uDAAuD;YACvD,IAAIrC,aAAamE,YAAY,EAAE;gBAC7BH,YAAYZ,GAAG,CAAC,iBAAiBpD,aAAamE,YAAY;YAC5D;YAEA,MAAMC,gBAAgB,MAAMC,MAAMN,UAAU;gBAC1CO,QAAQ;gBACRC,SAAS;oBAAE,gBAAgB;gBAAoC;gBAC/D7C,MAAMsC,YAAYL,QAAQ;YAC5B;YAEA,IAAI,CAACS,cAAcI,EAAE,EAAE;gBACrB,MAAMC,YAAa,MAAML,cAAclE,IAAI;gBAC3C,MAAM,IAAI8B,MAAM,CAAC,iCAAiC,EAAEyC,UAAU1C,iBAAiB,IAAI0C,UAAU3C,KAAK,EAAE;YACtG;YAEA,MAAM4C,YAAa,MAAMN,cAAclE,IAAI;YAO3C,iDAAiD;YACjD,MAAMyE,iBAAiC;gBACrCC,aAAaF,UAAUG,YAAY;gBACnC,GAAIH,UAAUI,aAAa,IAAI;oBAAEC,cAAcL,UAAUI,aAAa;gBAAC,CAAC;gBACxEE,WAAW/B,KAAKC,GAAG,KAAKwB,UAAUO,UAAU,GAAG;gBAC/C5C,OAAOqC,UAAUrC,KAAK;YACxB;YAEA,4DAA4D;YAC5D,MAAM6C,UAAU9F;YAChB,MAAM+F,WAA8B;gBAClCvB,MAAMsB;gBACN/C,WAAWW,gBAAgBX,SAAS;gBACpCC,cAAcU,gBAAgBV,YAAY;gBAC1CC,OAAOS,gBAAgBT,KAAK;gBAC5B,GAAIS,gBAAgBP,cAAc,IAAI;oBAAEA,gBAAgBO,gBAAgBP,cAAc;gBAAC,CAAC;gBACxF,GAAIO,gBAAgBN,qBAAqB,IAAI;oBAAEA,uBAAuBM,gBAAgBN,qBAAqB;gBAAC,CAAC;gBAC7GmC;gBACA3B,YAAYC,KAAKC,GAAG;gBACpBC,YAAYF,KAAKC,GAAG,KAAK;YAC3B;YAEA,MAAM3D,SAAS6F,WAAW,CAACxF,OAAOsF,SAASC;YAE3C,0DAA0D;YAC1D,MAAME,oBAAoB,IAAI/B,IAAIR,gBAAgBV,YAAY;YAC9DiD,kBAAkB7B,YAAY,CAACJ,GAAG,CAAC,QAAQ8B;YAC3C,IAAIpC,gBAAgBR,KAAK,EAAE;gBACzB+C,kBAAkB7B,YAAY,CAACJ,GAAG,CAAC,SAASN,gBAAgBR,KAAK;YACnE;YAEA,OAAO/B,IAAImD,QAAQ,CAAC2B,kBAAkB1B,QAAQ;QAChD,EAAE,OAAO7B,OAAO;YACd,OAAOvB,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmBD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;YAC9D;QACF;IACF;IAEA;;;GAGC,GACDvC,OAAO6B,IAAI,CAAC,gBAAgB,OAAOC,KAAcjB;QAC/C,mEAAmE;QACnE,IAAI4B,YAAYX,IAAIE,IAAI,CAACS,SAAS;QAClC,IAAImD,gBAAgB9D,IAAIE,IAAI,CAAC4D,aAAa;QAE1C,sEAAsE;QACtE,MAAMC,aAAa/D,IAAI+C,OAAO,CAACiB,aAAa;QAC5C,IAAID,cAAcA,WAAWE,UAAU,CAAC,WAAW;YACjD,MAAMC,oBAAoBH,WAAWI,SAAS,CAAC;YAC/C,MAAMC,cAAcC,OAAOC,IAAI,CAACJ,mBAAmB,UAAU/B,QAAQ,CAAC;YACtE,MAAM,CAACoC,IAAIC,OAAO,GAAGJ,YAAYK,KAAK,CAAC;YACvC9D,YAAY4D;YACZT,gBAAgBU;QAClB;QAEA,MAAM,EAAE9B,UAAU,EAAEN,IAAI,EAAExB,YAAY,EAAE0C,aAAa,EAAEoB,aAAa,EAAE,GAAG1E,IAAIE,IAAI;QAEjF,sBAAsB;QACtB,IAAI,CAACwC,YAAY;YACf,OAAO3D,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,IAAImC,eAAe,sBAAsB;YACvC,2BAA2B;YAC3B,IAAI,CAACN,QAAQ,CAACzB,aAAa,CAACC,cAAc;gBACxC,OAAO7B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,MAAMoE,gBAAgB,MAAM5G,SAAS6G,cAAc,CAACxG,OAAOuC,WAAWmD,0BAAAA,2BAAAA,gBAAiB;YACvF,IAAI,CAACa,eAAe;gBAClB,OAAO5F,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,yBAAyB;YACzB,MAAMoD,WAAW,MAAM5F,SAAS8G,WAAW,CAACzG,OAAOgE;YACnD,IAAI,CAACuB,UAAU;gBACb,OAAO5E,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,IAAIoD,SAAShD,SAAS,KAAKA,aAAagD,SAAS/C,YAAY,KAAKA,cAAc;gBAC9E,OAAO7B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,IAAIkB,KAAKC,GAAG,KAAKiC,SAAShC,UAAU,EAAE;gBACpC,MAAM5D,SAAS+G,cAAc,CAAC1G,OAAOgE;gBACrC,OAAOrD,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,wBAAwB;YACxB,IAAIoD,SAAS5C,cAAc,EAAE;oBASZ4C;gBARf,IAAI,CAACe,eAAe;oBAClB,OAAO3F,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;wBAC1B4B,OAAO;wBACPC,mBAAmB;oBACrB;gBACF;gBAEA,gDAAgD;gBAChD,MAAMuC,UAASa,kCAAAA,SAAS3C,qBAAqB,cAA9B2C,6CAAAA,kCAAkC;gBACjD,MAAMoB,oBAAoBjC,WAAW,SAASnF,WAAW,UAAUqH,MAAM,CAACN,eAAeO,MAAM,CAAC,eAAeP;gBAE/G,IAAIK,sBAAsBpB,SAAS5C,cAAc,EAAE;oBACjD,OAAOhC,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;wBAC1B4B,OAAO;wBACPC,mBAAmB;oBACrB;gBACF;YACF;YAEA,2CAA2C;YAC3C,MAAMxC,SAAS+G,cAAc,CAAC1G,OAAOgE;YAErC,4BAA4B;YAC5B,MAAMgB,cAAcxF;YACpB,MAAMsH,oBAAoBtH;YAE1B,MAAMsF,YAAyB;gBAC7BG,cAAcD;gBACd+B,YAAY;gBACZ1B,YAAY;gBACZH,eAAe4B;gBACfrE,OAAO8C,SAAS9C,KAAK;gBACrBF;gBACAwC,gBAAgBQ,SAASR,cAAc;gBACvC3B,YAAYC,KAAKC,GAAG;YACtB;YAEA,MAAM3D,SAASqH,cAAc,CAAChH,OAAOgF,aAAaF;YAClD,MAAMnF,SAASsH,eAAe,CAACjH,OAAO8G,mBAAmBhC;YAEzD,oDAAoD;YACpD,MAAMnF,SAASuH,iBAAiB,CAAClH,OAAOgF,aAAaO,SAASR,cAAc;YAE5E,wBAAwB;YACxB,OAAOpE,IAAIL,IAAI,CAAC;gBACd2E,cAAcH,UAAUG,YAAY;gBACpC8B,YAAYjC,UAAUiC,UAAU;gBAChC1B,YAAYP,UAAUO,UAAU;gBAChCH,eAAeJ,UAAUI,aAAa;gBACtCzC,OAAOqC,UAAUrC,KAAK;YACxB;QACF;QACA,IAAI6B,eAAe,iBAAiB;YAClC,sBAAsB;YACtB,IAAI,CAACY,iBAAiB,CAAC3C,WAAW;gBAChC,OAAO5B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,MAAMoE,gBAAgB,MAAM5G,SAAS6G,cAAc,CAACxG,OAAOuC,WAAWmD,0BAAAA,2BAAAA,gBAAiB;YACvF,IAAI,CAACa,eAAe;gBAClB,OAAO5F,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,oBAAoB;YACpB,MAAM2C,YAAY,MAAMnF,SAASwH,eAAe,CAACnH,OAAOkF;YACxD,IAAI,CAACJ,aAAaA,UAAUvC,SAAS,KAAKA,WAAW;gBACnD,OAAO5B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;YAEA,uCAAuC;YACvC,IAAIiF,0BAA0BtC,UAAUC,cAAc;YACtD,IAAID,UAAUC,cAAc,CAACI,YAAY,EAAE;gBACzC,IAAI;wBAKU/E;oBAJZ,+DAA+D;oBAC/D,MAAMiH,WAAW,IAAI3H,iBAAiB;wBACpCmE,UAAUzD,aAAayD,QAAQ;wBAC/B,GAAIzD,aAAamE,YAAY,IAAI;4BAAEA,cAAcnE,aAAamE,YAAY;wBAAC,CAAC;wBAC5EZ,QAAQ,GAAEvD,yBAAAA,aAAauD,QAAQ,cAArBvD,oCAAAA,yBAAyB;wBACnCqC,OAAOqC,UAAUrC,KAAK;wBACtB6E,gBAAgB,GAAGpH,QAAQ,aAAa,CAAC;wBACzCqH,QAAQ;4BACNC,MAAMC,QAAQC,GAAG;4BACjBxF,OAAOuF,QAAQvF,KAAK;4BACpByF,MAAMF,QAAQE,IAAI;4BAClBC,OAAO,KAAO;wBAChB;oBACF;oBAEA,qCAAqC;oBACrCR,0BAA0B,MAAMC,SAASQ,kBAAkB,CAAC/C,UAAUC,cAAc,CAACI,YAAY;gBACnG,EAAE,OAAOjD,OAAO;oBACd,4EAA4E;oBAC5EuF,QAAQE,IAAI,CAAC,yDAAyDzF,iBAAiBE,QAAQF,MAAMG,OAAO,GAAGyF,OAAO5F;gBACxH;YACF;YAEA,gCAAgC;YAChC,MAAM6F,iBAAiBvI;YACvB,MAAMwI,eAA4B;gBAChC,GAAGlD,SAAS;gBACZG,cAAc8C;gBACd3E,YAAYC,KAAKC,GAAG;YACtB;YAEA,MAAM3D,SAASqH,cAAc,CAAChH,OAAO+H,gBAAgBC;YAErD,kEAAkE;YAClE,MAAMrI,SAASuH,iBAAiB,CAAClH,OAAO+H,gBAAgBX;YAExD,OAAOzG,IAAIL,IAAI,CAAC;gBACd2E,cAAc+C,aAAa/C,YAAY;gBACvC8B,YAAYiB,aAAajB,UAAU;gBACnC1B,YAAY2C,aAAa3C,UAAU;gBACnC5C,OAAOuF,aAAavF,KAAK;YAC3B;QACF;QACA,OAAO9B,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;YAC1B4B,OAAO;YACPC,mBAAmB;QACrB;IACF;IAEA;;;GAGC,GACDrC,OAAO6B,IAAI,CAAC,iBAAiB,OAAOC,KAAcjB;QAChD,MAAM,EAAEsH,KAAK,EAAEC,eAAe,EAAE3F,SAAS,EAAEmD,aAAa,EAAE,GAAG9D,IAAIE,IAAI;QAErE,IAAI,CAACmG,OAAO;YACV,OAAOtH,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,0CAA0C;QAC1C,IAAII,aAAamD,eAAe;YAC9B,MAAMa,gBAAgB,MAAM5G,SAAS6G,cAAc,CAACxG,OAAOuC,WAAWmD;YACtE,IAAI,CAACa,eAAe;gBAClB,OAAO5F,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;oBAC1B4B,OAAO;oBACPC,mBAAmB;gBACrB;YACF;QACF;QAEA,mBAAmB;QACnB,IAAI+F,oBAAoB,iBAAiB;YACvC,MAAMvI,SAASwI,kBAAkB,CAACnI,OAAOiI;QAC3C,OAAO,IAAIC,oBAAoB,gBAAgB;YAC7C,MAAMvI,SAASyI,iBAAiB,CAACpI,OAAOiI;YACxC,MAAMtI,SAAS0I,oBAAoB,CAACrI,OAAOiI;QAC7C,OAAO;YACL,qBAAqB;YACrB,MAAMtI,SAASwI,kBAAkB,CAACnI,OAAOiI;YACzC,MAAMtI,SAASyI,iBAAiB,CAACpI,OAAOiI;YACxC,MAAMtI,SAAS0I,oBAAoB,CAACrI,OAAOiI;QAC7C;QAEA,+CAA+C;QAC/C,OAAOtH,IAAIsB,MAAM,CAAC,KAAKqG,IAAI;IAC7B;IAEA;;;;;;GAMC,GACDxI,OAAOW,GAAG,CAAC,iBAAiB,OAAOmB,KAAcjB;QAC/C,iDAAiD;QACjD,MAAMgF,aAAa/D,IAAI+C,OAAO,CAACiB,aAAa;QAE5C,IAAI,CAACD,cAAc,CAACA,WAAWE,UAAU,CAAC,YAAY;YACpD,OAAOlF,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,MAAM8F,QAAQtC,WAAWI,SAAS,CAAC,IAAI,0BAA0B;QAEjE,+CAA+C;QAC/C,MAAMjB,YAAY,MAAMnF,SAAS4I,cAAc,CAACvI,OAAOiI;QAEvD,IAAI,CAACnD,WAAW;YACd,OAAOnE,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,4BAA4B;QAC5B,MAAMmB,MAAMD,KAAKC,GAAG;QACpB,MAAM8B,YAAYN,UAAU1B,UAAU,GAAG0B,UAAUO,UAAU,GAAG;QAEhE,IAAI/B,MAAM8B,WAAW;YACnB,uBAAuB;YACvB,MAAMzF,SAASyI,iBAAiB,CAACpI,OAAOiI;YACxC,MAAMtI,SAAS0I,oBAAoB,CAACrI,OAAOiI;YAC3C,OAAOtH,IAAIsB,MAAM,CAAC,KAAK3B,IAAI,CAAC;gBAC1B4B,OAAO;gBACPC,mBAAmB;YACrB;QACF;QAEA,yDAAyD;QACzD,MAAMqG,WAAW;YACfP;YACApE,UAAUiB,UAAUvC,SAAS;YAC7BkG,QAAQ3D,UAAUrC,KAAK,GAAGqC,UAAUrC,KAAK,CAAC4D,KAAK,CAAC,OAAO,EAAE;YACzDjB;YACAL,gBAAgBD,UAAUC,cAAc;QAC1C;QAEA,OAAOpE,IAAIL,IAAI,CAACkI;IAClB;IAEA;;GAEC,GACD1I,OAAOW,GAAG,CAAC,kBAAkB,OAAOC,MAAeC;QACjD,MAAM+H,UAAU,MAAM/I,SAASgJ,WAAW,CAAC3I;QAC3CW,IAAIL,IAAI,CAACoI;IACX;IAEA,OAAO5I;AACT"}

package/dist/esm/lib/dcr-utils.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/lib/dcr-utils.ts"],"sourcesContent":["/**\n * DCR Storage Utilities\n *\n * Keyv-based storage utilities for Dynamic Client Registration.\n * Follows @mcp-z/oauth pattern: single Keyv store with compound keys.\n *\n * Key Patterns:\n * - dcr:client:{clientId} -> RegisteredClient\n * - dcr:provider:{dcrToken} -> ProviderTokens\n * - dcr:authcode:{code} -> AuthorizationCode\n * - dcr:access:{token} -> AccessToken\n * - dcr:refresh:{token} -> AccessToken\n */\n\nimport type { DcrClientInformation, DcrClientMetadata, ProviderTokens } from '@mcp-z/oauth';\nimport { randomUUID } from 'crypto';\nimport type { Keyv } from 'keyv';\nimport type { AccessToken, AuthorizationCode, RegisteredClient } from '../types.ts';\n\n// ============================================================================\n// Client Operations\n// ============================================================================\n\n/**\n * Register a new OAuth client (RFC 7591 Section 3.1)\n *\n * @param store - Keyv store for all DCR data\n * @param metadata - Client registration metadata\n * @returns Registered client with credentials\n * @throws Error if validation fails\n */\nexport async function registerClient(store: Keyv, metadata: DcrClientMetadata): Promise<DcrClientInformation> {\n  // Validate redirect URIs (required per RFC 7591)\n  if (!metadata.redirect_uris || metadata.redirect_uris.length === 0) {\n    throw new Error('redirect_uris is required');\n  }\n\n  // Generate client credentials\n  const client_id = `dcr_${randomUUID()}`;\n  const client_secret = randomUUID();\n\n  // Default grant types and response types per RFC 7591 Section 2\n  const grant_types = metadata.grant_types ?? ['authorization_code', 'refresh_token'];\n  const response_types = metadata.response_types ?? ['code'];\n\n  // Build registered client - only include optional fields if they have values\n  const client: RegisteredClient = {\n    client_id,\n    client_secret,\n    client_id_issued_at: Math.floor(Date.now() / 1000),\n    client_secret_expires_at: 0, // Never expires\n    redirect_uris: metadata.redirect_uris,\n    token_endpoint_auth_method: metadata.token_endpoint_auth_method ?? 'client_secret_basic',\n    grant_types,\n    response_types,\n    ...(metadata.client_name !== undefined && { client_name: metadata.client_name }),\n    ...(metadata.client_uri !== undefined && { client_uri: metadata.client_uri }),\n    ...(metadata.logo_uri !== undefined && { logo_uri: metadata.logo_uri }),\n    ...(metadata.scope !== undefined && { scope: metadata.scope }),\n    ...(metadata.contacts !== undefined && { contacts: metadata.contacts }),\n    ...(metadata.tos_uri !== undefined && { tos_uri: metadata.tos_uri }),\n    ...(metadata.policy_uri !== undefined && { policy_uri: metadata.policy_uri }),\n    ...(metadata.jwks_uri !== undefined && { jwks_uri: metadata.jwks_uri }),\n    ...(metadata.jwks !== undefined && { jwks: metadata.jwks }),\n    ...(metadata.software_id !== undefined && { software_id: metadata.software_id }),\n    ...(metadata.software_version !== undefined && { software_version: metadata.software_version }),\n    created_at: Date.now(),\n  };\n\n  // Store client\n  await store.set(`dcr:client:${client_id}`, client);\n\n  // Return client information (excluding internal created_at)\n  const { created_at, ...clientInfo } = client;\n  return clientInfo;\n}\n\n/**\n * Get a registered client by ID\n *\n * @param store - Keyv store for all DCR data\n * @param clientId - Client identifier\n * @returns Registered client or undefined if not found\n */\nexport async function getClient(store: Keyv, clientId: string): Promise<RegisteredClient | undefined> {\n  return await store.get(`dcr:client:${clientId}`);\n}\n\n/**\n * Validate client credentials\n *\n * @param store - Keyv store for all DCR data\n * @param clientId - Client identifier\n * @param clientSecret - Client secret\n * @returns True if credentials are valid\n */\nexport async function validateClient(store: Keyv, clientId: string, clientSecret: string): Promise<boolean> {\n  const client = await getClient(store, clientId);\n  if (!client) return false;\n  return client.client_secret === clientSecret;\n}\n\n/**\n * Validate redirect URI for a client\n *\n * @param store - Keyv store for all DCR data\n * @param clientId - Client identifier\n * @param redirectUri - Redirect URI to validate\n * @returns True if redirect URI is registered\n */\nexport async function validateRedirectUri(store: Keyv, clientId: string, redirectUri: string): Promise<boolean> {\n  const client = await getClient(store, clientId);\n  if (!client || !client.redirect_uris) return false;\n  return client.redirect_uris.includes(redirectUri);\n}\n\n/**\n * List all registered clients (for debugging)\n *\n * Note: This method uses Keyv's iterator which may not be available on all storage adapters.\n * For production use, consider maintaining a separate index of client IDs.\n *\n * @param store - Keyv store for all DCR data\n * @returns Array of all registered clients\n */\nexport async function listClients(store: Keyv): Promise<RegisteredClient[]> {\n  const clients: RegisteredClient[] = [];\n\n  // Check if iterator is available on the store\n  if (store.iterator) {\n    // Use iterator with namespace to iterate through dcr:client: keys\n    const iterator = store.iterator('dcr:client:');\n    for await (const [_key, value] of iterator) {\n      if (value !== undefined) {\n        clients.push(value as RegisteredClient);\n      }\n    }\n  }\n\n  return clients;\n}\n\n/**\n * Delete a registered client\n *\n * @param store - Keyv store for all DCR data\n * @param clientId - Client identifier\n */\nexport async function deleteClient(store: Keyv, clientId: string): Promise<void> {\n  await store.delete(`dcr:client:${clientId}`);\n}\n\n// ============================================================================\n// Provider Token Operations\n// ============================================================================\n\n/**\n * Store provider tokens for a DCR access token\n *\n * @param store - Keyv store for all DCR data\n * @param dcrToken - DCR-issued access token (used as key)\n * @param tokens - Microsoft provider tokens (access, refresh, expiry)\n */\nexport async function setProviderTokens(store: Keyv, dcrToken: string, tokens: ProviderTokens): Promise<void> {\n  await store.set(`dcr:provider:${dcrToken}`, tokens);\n}\n\n/**\n * Retrieve provider tokens for a DCR access token\n *\n * @param store - Keyv store for all DCR data\n * @param dcrToken - DCR-issued access token\n * @returns Provider tokens or undefined if not found\n */\nexport async function getProviderTokens(store: Keyv, dcrToken: string): Promise<ProviderTokens | undefined> {\n  return await store.get(`dcr:provider:${dcrToken}`);\n}\n\n/**\n * Delete provider tokens for a DCR access token\n *\n * @param store - Keyv store for all DCR data\n * @param dcrToken - DCR-issued access token\n */\nexport async function deleteProviderTokens(store: Keyv, dcrToken: string): Promise<void> {\n  await store.delete(`dcr:provider:${dcrToken}`);\n}\n\n// ============================================================================\n// Authorization Code Operations\n// ============================================================================\n\n/**\n * Store an authorization code\n *\n * @param store - Keyv store for all DCR data\n * @param code - Authorization code\n * @param authCode - Authorization code data\n */\nexport async function setAuthCode(store: Keyv, code: string, authCode: AuthorizationCode): Promise<void> {\n  await store.set(`dcr:authcode:${code}`, authCode);\n}\n\n/**\n * Get an authorization code\n *\n * @param store - Keyv store for all DCR data\n * @param code - Authorization code\n * @returns Authorization code data or undefined if not found\n */\nexport async function getAuthCode(store: Keyv, code: string): Promise<AuthorizationCode | undefined> {\n  return await store.get(`dcr:authcode:${code}`);\n}\n\n/**\n * Delete an authorization code\n *\n * @param store - Keyv store for all DCR data\n * @param code - Authorization code\n */\nexport async function deleteAuthCode(store: Keyv, code: string): Promise<void> {\n  await store.delete(`dcr:authcode:${code}`);\n}\n\n// ============================================================================\n// Access Token Operations\n// ============================================================================\n\n/**\n * Store an access token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Access token\n * @param tokenData - Access token data\n */\nexport async function setAccessToken(store: Keyv, token: string, tokenData: AccessToken): Promise<void> {\n  await store.set(`dcr:access:${token}`, tokenData);\n}\n\n/**\n * Get an access token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Access token\n * @returns Access token data or undefined if not found\n */\nexport async function getAccessToken(store: Keyv, token: string): Promise<AccessToken | undefined> {\n  return await store.get(`dcr:access:${token}`);\n}\n\n/**\n * Delete an access token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Access token\n */\nexport async function deleteAccessToken(store: Keyv, token: string): Promise<void> {\n  await store.delete(`dcr:access:${token}`);\n}\n\n// ============================================================================\n// Refresh Token Operations\n// ============================================================================\n\n/**\n * Store a refresh token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Refresh token\n * @param tokenData - Access token data (contains refresh token context)\n */\nexport async function setRefreshToken(store: Keyv, token: string, tokenData: AccessToken): Promise<void> {\n  await store.set(`dcr:refresh:${token}`, tokenData);\n}\n\n/**\n * Get a refresh token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Refresh token\n * @returns Access token data or undefined if not found\n */\nexport async function getRefreshToken(store: Keyv, token: string): Promise<AccessToken | undefined> {\n  return await store.get(`dcr:refresh:${token}`);\n}\n\n/**\n * Delete a refresh token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Refresh token\n */\nexport async function deleteRefreshToken(store: Keyv, token: string): Promise<void> {\n  await store.delete(`dcr:refresh:${token}`);\n}\n"],"names":["randomUUID","registerClient","store","metadata","redirect_uris","length","Error","client_id","client_secret","grant_types","response_types","client","client_id_issued_at","Math","floor","Date","now","client_secret_expires_at","token_endpoint_auth_method","client_name","undefined","client_uri","logo_uri","scope","contacts","tos_uri","policy_uri","jwks_uri","jwks","software_id","software_version","created_at","set","clientInfo","getClient","clientId","get","validateClient","clientSecret","validateRedirectUri","redirectUri","includes","listClients","clients","iterator","_key","value","push","deleteClient","delete","setProviderTokens","dcrToken","tokens","getProviderTokens","deleteProviderTokens","setAuthCode","code","authCode","getAuthCode","deleteAuthCode","setAccessToken","token","tokenData","getAccessToken","deleteAccessToken","setRefreshToken","getRefreshToken","deleteRefreshToken"],"mappings":"AAAA;;;;;;;;;;;;CAYC,GAGD,SAASA,UAAU,QAAQ,SAAS;AAIpC,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;;;CAOC,GACD,OAAO,eAAeC,eAAeC,KAAW,EAAEC,QAA2B;QAWvDA,uBACGA,0BASOA;IApB9B,iDAAiD;IACjD,IAAI,CAACA,SAASC,aAAa,IAAID,SAASC,aAAa,CAACC,MAAM,KAAK,GAAG;QAClE,MAAM,IAAIC,MAAM;IAClB;IAEA,8BAA8B;IAC9B,MAAMC,YAAY,CAAC,IAAI,EAAEP,cAAc;IACvC,MAAMQ,gBAAgBR;IAEtB,gEAAgE;IAChE,MAAMS,eAAcN,wBAAAA,SAASM,WAAW,cAApBN,mCAAAA,wBAAwB;QAAC;QAAsB;KAAgB;IACnF,MAAMO,kBAAiBP,2BAAAA,SAASO,cAAc,cAAvBP,sCAAAA,2BAA2B;QAAC;KAAO;IAE1D,6EAA6E;IAC7E,MAAMQ,SAA2B;QAC/BJ;QACAC;QACAI,qBAAqBC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;QAC7CC,0BAA0B;QAC1Bb,eAAeD,SAASC,aAAa;QACrCc,0BAA0B,GAAEf,uCAAAA,SAASe,0BAA0B,cAAnCf,kDAAAA,uCAAuC;QACnEM;QACAC;QACA,GAAIP,SAASgB,WAAW,KAAKC,aAAa;YAAED,aAAahB,SAASgB,WAAW;QAAC,CAAC;QAC/E,GAAIhB,SAASkB,UAAU,KAAKD,aAAa;YAAEC,YAAYlB,SAASkB,UAAU;QAAC,CAAC;QAC5E,GAAIlB,SAASmB,QAAQ,KAAKF,aAAa;YAAEE,UAAUnB,SAASmB,QAAQ;QAAC,CAAC;QACtE,GAAInB,SAASoB,KAAK,KAAKH,aAAa;YAAEG,OAAOpB,SAASoB,KAAK;QAAC,CAAC;QAC7D,GAAIpB,SAASqB,QAAQ,KAAKJ,aAAa;YAAEI,UAAUrB,SAASqB,QAAQ;QAAC,CAAC;QACtE,GAAIrB,SAASsB,OAAO,KAAKL,aAAa;YAAEK,SAAStB,SAASsB,OAAO;QAAC,CAAC;QACnE,GAAItB,SAASuB,UAAU,KAAKN,aAAa;YAAEM,YAAYvB,SAASuB,UAAU;QAAC,CAAC;QAC5E,GAAIvB,SAASwB,QAAQ,KAAKP,aAAa;YAAEO,UAAUxB,SAASwB,QAAQ;QAAC,CAAC;QACtE,GAAIxB,SAASyB,IAAI,KAAKR,aAAa;YAAEQ,MAAMzB,SAASyB,IAAI;QAAC,CAAC;QAC1D,GAAIzB,SAAS0B,WAAW,KAAKT,aAAa;YAAES,aAAa1B,SAAS0B,WAAW;QAAC,CAAC;QAC/E,GAAI1B,SAAS2B,gBAAgB,KAAKV,aAAa;YAAEU,kBAAkB3B,SAAS2B,gBAAgB;QAAC,CAAC;QAC9FC,YAAYhB,KAAKC,GAAG;IACtB;IAEA,eAAe;IACf,MAAMd,MAAM8B,GAAG,CAAC,CAAC,WAAW,EAAEzB,WAAW,EAAEI;IAE3C,4DAA4D;IAC5D,MAAM,EAAEoB,UAAU,EAAE,GAAGE,YAAY,GAAGtB;IACtC,OAAOsB;AACT;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,UAAUhC,KAAW,EAAEiC,QAAgB;IAC3D,OAAO,MAAMjC,MAAMkC,GAAG,CAAC,CAAC,WAAW,EAAED,UAAU;AACjD;AAEA;;;;;;;CAOC,GACD,OAAO,eAAeE,eAAenC,KAAW,EAAEiC,QAAgB,EAAEG,YAAoB;IACtF,MAAM3B,SAAS,MAAMuB,UAAUhC,OAAOiC;IACtC,IAAI,CAACxB,QAAQ,OAAO;IACpB,OAAOA,OAAOH,aAAa,KAAK8B;AAClC;AAEA;;;;;;;CAOC,GACD,OAAO,eAAeC,oBAAoBrC,KAAW,EAAEiC,QAAgB,EAAEK,WAAmB;IAC1F,MAAM7B,SAAS,MAAMuB,UAAUhC,OAAOiC;IACtC,IAAI,CAACxB,UAAU,CAACA,OAAOP,aAAa,EAAE,OAAO;IAC7C,OAAOO,OAAOP,aAAa,CAACqC,QAAQ,CAACD;AACvC;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeE,YAAYxC,KAAW;IAC3C,MAAMyC,UAA8B,EAAE;IAEtC,8CAA8C;IAC9C,IAAIzC,MAAM0C,QAAQ,EAAE;QAClB,kEAAkE;QAClE,MAAMA,WAAW1C,MAAM0C,QAAQ,CAAC;QAChC,WAAW,MAAM,CAACC,MAAMC,MAAM,IAAIF,SAAU;YAC1C,IAAIE,UAAU1B,WAAW;gBACvBuB,QAAQI,IAAI,CAACD;YACf;QACF;IACF;IAEA,OAAOH;AACT;AAEA;;;;;CAKC,GACD,OAAO,eAAeK,aAAa9C,KAAW,EAAEiC,QAAgB;IAC9D,MAAMjC,MAAM+C,MAAM,CAAC,CAAC,WAAW,EAAEd,UAAU;AAC7C;AAEA,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;CAMC,GACD,OAAO,eAAee,kBAAkBhD,KAAW,EAAEiD,QAAgB,EAAEC,MAAsB;IAC3F,MAAMlD,MAAM8B,GAAG,CAAC,CAAC,aAAa,EAAEmB,UAAU,EAAEC;AAC9C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,kBAAkBnD,KAAW,EAAEiD,QAAgB;IACnE,OAAO,MAAMjD,MAAMkC,GAAG,CAAC,CAAC,aAAa,EAAEe,UAAU;AACnD;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,qBAAqBpD,KAAW,EAAEiD,QAAgB;IACtE,MAAMjD,MAAM+C,MAAM,CAAC,CAAC,aAAa,EAAEE,UAAU;AAC/C;AAEA,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E;;;;;;CAMC,GACD,OAAO,eAAeI,YAAYrD,KAAW,EAAEsD,IAAY,EAAEC,QAA2B;IACtF,MAAMvD,MAAM8B,GAAG,CAAC,CAAC,aAAa,EAAEwB,MAAM,EAAEC;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,YAAYxD,KAAW,EAAEsD,IAAY;IACzD,OAAO,MAAMtD,MAAMkC,GAAG,CAAC,CAAC,aAAa,EAAEoB,MAAM;AAC/C;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,eAAezD,KAAW,EAAEsD,IAAY;IAC5D,MAAMtD,MAAM+C,MAAM,CAAC,CAAC,aAAa,EAAEO,MAAM;AAC3C;AAEA,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;CAMC,GACD,OAAO,eAAeI,eAAe1D,KAAW,EAAE2D,KAAa,EAAEC,SAAsB;IACrF,MAAM5D,MAAM8B,GAAG,CAAC,CAAC,WAAW,EAAE6B,OAAO,EAAEC;AACzC;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,eAAe7D,KAAW,EAAE2D,KAAa;IAC7D,OAAO,MAAM3D,MAAMkC,GAAG,CAAC,CAAC,WAAW,EAAEyB,OAAO;AAC9C;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,kBAAkB9D,KAAW,EAAE2D,KAAa;IAChE,MAAM3D,MAAM+C,MAAM,CAAC,CAAC,WAAW,EAAEY,OAAO;AAC1C;AAEA,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;;;;;CAMC,GACD,OAAO,eAAeI,gBAAgB/D,KAAW,EAAE2D,KAAa,EAAEC,SAAsB;IACtF,MAAM5D,MAAM8B,GAAG,CAAC,CAAC,YAAY,EAAE6B,OAAO,EAAEC;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeI,gBAAgBhE,KAAW,EAAE2D,KAAa;IAC9D,OAAO,MAAM3D,MAAMkC,GAAG,CAAC,CAAC,YAAY,EAAEyB,OAAO;AAC/C;AAEA;;;;;CAKC,GACD,OAAO,eAAeM,mBAAmBjE,KAAW,EAAE2D,KAAa;IACjE,MAAM3D,MAAM+C,MAAM,CAAC,CAAC,YAAY,EAAEY,OAAO;AAC3C"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/dcr-utils.ts"],"sourcesContent":["/**\n * DCR Storage Utilities\n *\n * Keyv-based storage utilities for Dynamic Client Registration.\n * Follows @mcp-z/oauth pattern: single Keyv store with compound keys.\n *\n * Key Patterns:\n * - dcr:client:{clientId} -> RegisteredClient\n * - dcr:provider:{dcrToken} -> ProviderTokens\n * - dcr:authcode:{code} -> AuthorizationCode\n * - dcr:access:{token} -> AccessToken\n * - dcr:refresh:{token} -> AccessToken\n */\n\nimport type { DcrClientInformation, DcrClientMetadata, ProviderTokens } from '@mcp-z/oauth';\nimport { randomUUID } from 'crypto';\nimport type { Keyv } from 'keyv';\nimport type { AccessToken, AuthorizationCode, RegisteredClient } from '../types.ts';\n\n// ============================================================================\n// Client Operations\n// ============================================================================\n\n/**\n * Register a new OAuth client (RFC 7591 Section 3.1)\n *\n * @param store - Keyv store for all DCR data\n * @param metadata - Client registration metadata\n * @returns Registered client with credentials\n * @throws Error if validation fails\n */\nexport async function registerClient(store: Keyv, metadata: DcrClientMetadata): Promise<DcrClientInformation> {\n  // Validate redirect URIs (required per RFC 7591)\n  if (!metadata.redirect_uris || metadata.redirect_uris.length === 0) {\n    throw new Error('redirect_uris is required');\n  }\n\n  // Generate client credentials\n  const client_id = `dcr_${randomUUID()}`;\n  const client_secret = randomUUID();\n\n  // Default grant types and response types per RFC 7591 Section 2\n  const grant_types = metadata.grant_types ?? ['authorization_code', 'refresh_token'];\n  const response_types = metadata.response_types ?? ['code'];\n\n  // Build registered client - only include optional fields if they have values\n  const client: RegisteredClient = {\n    client_id,\n    client_secret,\n    client_id_issued_at: Math.floor(Date.now() / 1000),\n    client_secret_expires_at: 0, // Never expires\n    redirect_uris: metadata.redirect_uris,\n    token_endpoint_auth_method: metadata.token_endpoint_auth_method ?? 'client_secret_basic',\n    grant_types,\n    response_types,\n    ...(metadata.client_name !== undefined && { client_name: metadata.client_name }),\n    ...(metadata.client_uri !== undefined && { client_uri: metadata.client_uri }),\n    ...(metadata.logo_uri !== undefined && { logo_uri: metadata.logo_uri }),\n    ...(metadata.scope !== undefined && { scope: metadata.scope }),\n    ...(metadata.contacts !== undefined && { contacts: metadata.contacts }),\n    ...(metadata.tos_uri !== undefined && { tos_uri: metadata.tos_uri }),\n    ...(metadata.policy_uri !== undefined && { policy_uri: metadata.policy_uri }),\n    ...(metadata.jwks_uri !== undefined && { jwks_uri: metadata.jwks_uri }),\n    ...(metadata.jwks !== undefined && { jwks: metadata.jwks }),\n    ...(metadata.software_id !== undefined && { software_id: metadata.software_id }),\n    ...(metadata.software_version !== undefined && { software_version: metadata.software_version }),\n    created_at: Date.now(),\n  };\n\n  // Store client\n  await store.set(`dcr:client:${client_id}`, client);\n\n  // Return client information (excluding internal created_at)\n  const { created_at, ...clientInfo } = client;\n  return clientInfo;\n}\n\n/**\n * Get a registered client by ID\n *\n * @param store - Keyv store for all DCR data\n * @param clientId - Client identifier\n * @returns Registered client or undefined if not found\n */\nexport async function getClient(store: Keyv, clientId: string): Promise<RegisteredClient | undefined> {\n  return await store.get(`dcr:client:${clientId}`);\n}\n\n/**\n * Validate client credentials\n *\n * @param store - Keyv store for all DCR data\n * @param clientId - Client identifier\n * @param clientSecret - Client secret\n * @returns True if credentials are valid\n */\nexport async function validateClient(store: Keyv, clientId: string, clientSecret: string): Promise<boolean> {\n  const client = await getClient(store, clientId);\n  if (!client) return false;\n  return client.client_secret === clientSecret;\n}\n\n/**\n * Validate redirect URI for a client\n *\n * @param store - Keyv store for all DCR data\n * @param clientId - Client identifier\n * @param redirectUri - Redirect URI to validate\n * @returns True if redirect URI is registered\n */\nexport async function validateRedirectUri(store: Keyv, clientId: string, redirectUri: string): Promise<boolean> {\n  const client = await getClient(store, clientId);\n  if (!client || !client.redirect_uris) return false;\n  return client.redirect_uris.includes(redirectUri);\n}\n\n/**\n * List all registered clients (for debugging)\n *\n * Note: This method uses Keyv's iterator which may not be available on all storage adapters.\n * For production use, consider maintaining a separate index of client IDs.\n *\n * @param store - Keyv store for all DCR data\n * @returns Array of all registered clients\n */\nexport async function listClients(store: Keyv): Promise<RegisteredClient[]> {\n  const clients: RegisteredClient[] = [];\n\n  // Check if iterator is available on the store\n  if (store.iterator) {\n    // Use iterator with namespace to iterate through dcr:client: keys\n    const iterator = store.iterator('dcr:client:');\n    for await (const [_key, value] of iterator) {\n      if (value !== undefined) {\n        clients.push(value as RegisteredClient);\n      }\n    }\n  }\n\n  return clients;\n}\n\n/**\n * Delete a registered client\n *\n * @param store - Keyv store for all DCR data\n * @param clientId - Client identifier\n */\nexport async function deleteClient(store: Keyv, clientId: string): Promise<void> {\n  await store.delete(`dcr:client:${clientId}`);\n}\n\n// ============================================================================\n// Provider Token Operations\n// ============================================================================\n\n/**\n * Store provider tokens for a DCR access token\n *\n * @param store - Keyv store for all DCR data\n * @param dcrToken - DCR-issued access token (used as key)\n * @param tokens - Microsoft provider tokens (access, refresh, expiry)\n */\nexport async function setProviderTokens(store: Keyv, dcrToken: string, tokens: ProviderTokens): Promise<void> {\n  await store.set(`dcr:provider:${dcrToken}`, tokens);\n}\n\n/**\n * Retrieve provider tokens for a DCR access token\n *\n * @param store - Keyv store for all DCR data\n * @param dcrToken - DCR-issued access token\n * @returns Provider tokens or undefined if not found\n */\nexport async function getProviderTokens(store: Keyv, dcrToken: string): Promise<ProviderTokens | undefined> {\n  return await store.get(`dcr:provider:${dcrToken}`);\n}\n\n/**\n * Delete provider tokens for a DCR access token\n *\n * @param store - Keyv store for all DCR data\n * @param dcrToken - DCR-issued access token\n */\nexport async function deleteProviderTokens(store: Keyv, dcrToken: string): Promise<void> {\n  await store.delete(`dcr:provider:${dcrToken}`);\n}\n\n// ============================================================================\n// Authorization Code Operations\n// ============================================================================\n\n/**\n * Store an authorization code\n *\n * @param store - Keyv store for all DCR data\n * @param code - Authorization code\n * @param authCode - Authorization code data\n */\nexport async function setAuthCode(store: Keyv, code: string, authCode: AuthorizationCode): Promise<void> {\n  await store.set(`dcr:authcode:${code}`, authCode);\n}\n\n/**\n * Get an authorization code\n *\n * @param store - Keyv store for all DCR data\n * @param code - Authorization code\n * @returns Authorization code data or undefined if not found\n */\nexport async function getAuthCode(store: Keyv, code: string): Promise<AuthorizationCode | undefined> {\n  return await store.get(`dcr:authcode:${code}`);\n}\n\n/**\n * Delete an authorization code\n *\n * @param store - Keyv store for all DCR data\n * @param code - Authorization code\n */\nexport async function deleteAuthCode(store: Keyv, code: string): Promise<void> {\n  await store.delete(`dcr:authcode:${code}`);\n}\n\n// ============================================================================\n// Access Token Operations\n// ============================================================================\n\n/**\n * Store an access token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Access token\n * @param tokenData - Access token data\n */\nexport async function setAccessToken(store: Keyv, token: string, tokenData: AccessToken): Promise<void> {\n  await store.set(`dcr:access:${token}`, tokenData);\n}\n\n/**\n * Get an access token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Access token\n * @returns Access token data or undefined if not found\n */\nexport async function getAccessToken(store: Keyv, token: string): Promise<AccessToken | undefined> {\n  return await store.get(`dcr:access:${token}`);\n}\n\n/**\n * Delete an access token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Access token\n */\nexport async function deleteAccessToken(store: Keyv, token: string): Promise<void> {\n  await store.delete(`dcr:access:${token}`);\n}\n\n// ============================================================================\n// Refresh Token Operations\n// ============================================================================\n\n/**\n * Store a refresh token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Refresh token\n * @param tokenData - Access token data (contains refresh token context)\n */\nexport async function setRefreshToken(store: Keyv, token: string, tokenData: AccessToken): Promise<void> {\n  await store.set(`dcr:refresh:${token}`, tokenData);\n}\n\n/**\n * Get a refresh token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Refresh token\n * @returns Access token data or undefined if not found\n */\nexport async function getRefreshToken(store: Keyv, token: string): Promise<AccessToken | undefined> {\n  return await store.get(`dcr:refresh:${token}`);\n}\n\n/**\n * Delete a refresh token\n *\n * @param store - Keyv store for all DCR data\n * @param token - Refresh token\n */\nexport async function deleteRefreshToken(store: Keyv, token: string): Promise<void> {\n  await store.delete(`dcr:refresh:${token}`);\n}\n"],"names":["randomUUID","registerClient","store","metadata","redirect_uris","length","Error","client_id","client_secret","grant_types","response_types","client","client_id_issued_at","Math","floor","Date","now","client_secret_expires_at","token_endpoint_auth_method","client_name","undefined","client_uri","logo_uri","scope","contacts","tos_uri","policy_uri","jwks_uri","jwks","software_id","software_version","created_at","set","clientInfo","getClient","clientId","get","validateClient","clientSecret","validateRedirectUri","redirectUri","includes","listClients","clients","iterator","_key","value","push","deleteClient","delete","setProviderTokens","dcrToken","tokens","getProviderTokens","deleteProviderTokens","setAuthCode","code","authCode","getAuthCode","deleteAuthCode","setAccessToken","token","tokenData","getAccessToken","deleteAccessToken","setRefreshToken","getRefreshToken","deleteRefreshToken"],"mappings":"AAAA;;;;;;;;;;;;CAYC,GAGD,SAASA,UAAU,QAAQ,SAAS;AAIpC,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;;;CAOC,GACD,OAAO,eAAeC,eAAeC,KAAW,EAAEC,QAA2B;QAWvDA,uBACGA,0BASOA;IApB9B,iDAAiD;IACjD,IAAI,CAACA,SAASC,aAAa,IAAID,SAASC,aAAa,CAACC,MAAM,KAAK,GAAG;QAClE,MAAM,IAAIC,MAAM;IAClB;IAEA,8BAA8B;IAC9B,MAAMC,YAAY,CAAC,IAAI,EAAEP,cAAc;IACvC,MAAMQ,gBAAgBR;IAEtB,gEAAgE;IAChE,MAAMS,eAAcN,wBAAAA,SAASM,WAAW,cAApBN,mCAAAA,wBAAwB;QAAC;QAAsB;KAAgB;IACnF,MAAMO,kBAAiBP,2BAAAA,SAASO,cAAc,cAAvBP,sCAAAA,2BAA2B;QAAC;KAAO;IAE1D,6EAA6E;IAC7E,MAAMQ,SAA2B;QAC/BJ;QACAC;QACAI,qBAAqBC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;QAC7CC,0BAA0B;QAC1Bb,eAAeD,SAASC,aAAa;QACrCc,0BAA0B,GAAEf,uCAAAA,SAASe,0BAA0B,cAAnCf,kDAAAA,uCAAuC;QACnEM;QACAC;QACA,GAAIP,SAASgB,WAAW,KAAKC,aAAa;YAAED,aAAahB,SAASgB,WAAW;QAAC,CAAC;QAC/E,GAAIhB,SAASkB,UAAU,KAAKD,aAAa;YAAEC,YAAYlB,SAASkB,UAAU;QAAC,CAAC;QAC5E,GAAIlB,SAASmB,QAAQ,KAAKF,aAAa;YAAEE,UAAUnB,SAASmB,QAAQ;QAAC,CAAC;QACtE,GAAInB,SAASoB,KAAK,KAAKH,aAAa;YAAEG,OAAOpB,SAASoB,KAAK;QAAC,CAAC;QAC7D,GAAIpB,SAASqB,QAAQ,KAAKJ,aAAa;YAAEI,UAAUrB,SAASqB,QAAQ;QAAC,CAAC;QACtE,GAAIrB,SAASsB,OAAO,KAAKL,aAAa;YAAEK,SAAStB,SAASsB,OAAO;QAAC,CAAC;QACnE,GAAItB,SAASuB,UAAU,KAAKN,aAAa;YAAEM,YAAYvB,SAASuB,UAAU;QAAC,CAAC;QAC5E,GAAIvB,SAASwB,QAAQ,KAAKP,aAAa;YAAEO,UAAUxB,SAASwB,QAAQ;QAAC,CAAC;QACtE,GAAIxB,SAASyB,IAAI,KAAKR,aAAa;YAAEQ,MAAMzB,SAASyB,IAAI;QAAC,CAAC;QAC1D,GAAIzB,SAAS0B,WAAW,KAAKT,aAAa;YAAES,aAAa1B,SAAS0B,WAAW;QAAC,CAAC;QAC/E,GAAI1B,SAAS2B,gBAAgB,KAAKV,aAAa;YAAEU,kBAAkB3B,SAAS2B,gBAAgB;QAAC,CAAC;QAC9FC,YAAYhB,KAAKC,GAAG;IACtB;IAEA,eAAe;IACf,MAAMd,MAAM8B,GAAG,CAAC,CAAC,WAAW,EAAEzB,WAAW,EAAEI;IAE3C,4DAA4D;IAC5D,MAAM,EAAEoB,UAAU,EAAE,GAAGE,YAAY,GAAGtB;IACtC,OAAOsB;AACT;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,UAAUhC,KAAW,EAAEiC,QAAgB;IAC3D,OAAO,MAAMjC,MAAMkC,GAAG,CAAC,CAAC,WAAW,EAAED,UAAU;AACjD;AAEA;;;;;;;CAOC,GACD,OAAO,eAAeE,eAAenC,KAAW,EAAEiC,QAAgB,EAAEG,YAAoB;IACtF,MAAM3B,SAAS,MAAMuB,UAAUhC,OAAOiC;IACtC,IAAI,CAACxB,QAAQ,OAAO;IACpB,OAAOA,OAAOH,aAAa,KAAK8B;AAClC;AAEA;;;;;;;CAOC,GACD,OAAO,eAAeC,oBAAoBrC,KAAW,EAAEiC,QAAgB,EAAEK,WAAmB;IAC1F,MAAM7B,SAAS,MAAMuB,UAAUhC,OAAOiC;IACtC,IAAI,CAACxB,UAAU,CAACA,OAAOP,aAAa,EAAE,OAAO;IAC7C,OAAOO,OAAOP,aAAa,CAACqC,QAAQ,CAACD;AACvC;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeE,YAAYxC,KAAW;IAC3C,MAAMyC,UAA8B,EAAE;IAEtC,8CAA8C;IAC9C,IAAIzC,MAAM0C,QAAQ,EAAE;QAClB,kEAAkE;QAClE,MAAMA,WAAW1C,MAAM0C,QAAQ,CAAC;QAChC,WAAW,MAAM,CAACC,MAAMC,MAAM,IAAIF,SAAU;YAC1C,IAAIE,UAAU1B,WAAW;gBACvBuB,QAAQI,IAAI,CAACD;YACf;QACF;IACF;IAEA,OAAOH;AACT;AAEA;;;;;CAKC,GACD,OAAO,eAAeK,aAAa9C,KAAW,EAAEiC,QAAgB;IAC9D,MAAMjC,MAAM+C,MAAM,CAAC,CAAC,WAAW,EAAEd,UAAU;AAC7C;AAEA,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;CAMC,GACD,OAAO,eAAee,kBAAkBhD,KAAW,EAAEiD,QAAgB,EAAEC,MAAsB;IAC3F,MAAMlD,MAAM8B,GAAG,CAAC,CAAC,aAAa,EAAEmB,UAAU,EAAEC;AAC9C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,kBAAkBnD,KAAW,EAAEiD,QAAgB;IACnE,OAAO,MAAMjD,MAAMkC,GAAG,CAAC,CAAC,aAAa,EAAEe,UAAU;AACnD;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,qBAAqBpD,KAAW,EAAEiD,QAAgB;IACtE,MAAMjD,MAAM+C,MAAM,CAAC,CAAC,aAAa,EAAEE,UAAU;AAC/C;AAEA,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E;;;;;;CAMC,GACD,OAAO,eAAeI,YAAYrD,KAAW,EAAEsD,IAAY,EAAEC,QAA2B;IACtF,MAAMvD,MAAM8B,GAAG,CAAC,CAAC,aAAa,EAAEwB,MAAM,EAAEC;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,YAAYxD,KAAW,EAAEsD,IAAY;IACzD,OAAO,MAAMtD,MAAMkC,GAAG,CAAC,CAAC,aAAa,EAAEoB,MAAM;AAC/C;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,eAAezD,KAAW,EAAEsD,IAAY;IAC5D,MAAMtD,MAAM+C,MAAM,CAAC,CAAC,aAAa,EAAEO,MAAM;AAC3C;AAEA,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;CAMC,GACD,OAAO,eAAeI,eAAe1D,KAAW,EAAE2D,KAAa,EAAEC,SAAsB;IACrF,MAAM5D,MAAM8B,GAAG,CAAC,CAAC,WAAW,EAAE6B,OAAO,EAAEC;AACzC;AAEA;;;;;;CAMC,GACD,OAAO,eAAeC,eAAe7D,KAAW,EAAE2D,KAAa;IAC7D,OAAO,MAAM3D,MAAMkC,GAAG,CAAC,CAAC,WAAW,EAAEyB,OAAO;AAC9C;AAEA;;;;;CAKC,GACD,OAAO,eAAeG,kBAAkB9D,KAAW,EAAE2D,KAAa;IAChE,MAAM3D,MAAM+C,MAAM,CAAC,CAAC,WAAW,EAAEY,OAAO;AAC1C;AAEA,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;;;;;CAMC,GACD,OAAO,eAAeI,gBAAgB/D,KAAW,EAAE2D,KAAa,EAAEC,SAAsB;IACtF,MAAM5D,MAAM8B,GAAG,CAAC,CAAC,YAAY,EAAE6B,OAAO,EAAEC;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,eAAeI,gBAAgBhE,KAAW,EAAE2D,KAAa;IAC9D,OAAO,MAAM3D,MAAMkC,GAAG,CAAC,CAAC,YAAY,EAAEyB,OAAO;AAC/C;AAEA;;;;;CAKC,GACD,OAAO,eAAeM,mBAAmBjE,KAAW,EAAE2D,KAAa;IACjE,MAAM3D,MAAM+C,MAAM,CAAC,CAAC,YAAY,EAAEY,OAAO;AAC3C"}

package/dist/esm/lib/dcr-verify.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/lib/dcr-verify.ts"],"sourcesContent":["/**\n * DCR Token Verification Utilities\n *\n * Provides token verification for both self-hosted and external DCR modes:\n * - Self-hosted: Verifies tokens against local DCR router (/oauth/verify)\n * - External: Verifies tokens against Auth0/Stitch verification endpoint\n */\n\nimport type { ProviderTokens } from '@mcp-z/oauth';\nimport { fetchWithTimeout } from './fetch-with-timeout.ts';\n\n/**\n * Verification result from DCR authorization server\n */\nexport interface VerificationResult {\n  /** Bearer token that was verified */\n  token: string;\n  /** Client ID associated with the token */\n  clientId: string;\n  /** OAuth scopes granted to the token */\n  scopes: string[];\n  /** Token expiration timestamp (milliseconds since epoch) */\n  expiresAt: number;\n  /** Provider tokens (Microsoft access/refresh tokens) */\n  providerTokens: ProviderTokens;\n}\n\n/**\n * Verify bearer token against DCR authorization server\n *\n * Supports both self-hosted and external DCR modes by calling the\n * /oauth/verify endpoint (or equivalent external URL).\n *\n * @param bearerToken - Bearer token to verify (without \"Bearer \" prefix)\n * @param verifyUrl - Verification endpoint URL (self-hosted or external)\n * @returns Verification result with provider tokens\n * @throws Error if verification fails\n *\n * @example Self-hosted mode\n * ```typescript\n * const result = await verifyBearerToken(\n *   token,\n *   'http://localhost:3456/oauth/verify'\n * );\n * const auth = provider.toAuthProvider(result.providerTokens);\n * ```\n *\n * @example External mode (Auth0/Stitch)\n * ```typescript\n * const result = await verifyBearerToken(\n *   token,\n *   'https://auth.example.com/oauth/verify'\n * );\n * const auth = provider.toAuthProvider(result.providerTokens);\n * ```\n */\nexport async function verifyBearerToken(bearerToken: string, verifyUrl: string): Promise<VerificationResult> {\n  const response = await fetchWithTimeout(verifyUrl, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${bearerToken}`,\n    },\n  });\n\n  if (!response.ok) {\n    const errorText = await response.text();\n    throw new Error(`Token verification failed: ${response.status} ${errorText}`);\n  }\n\n  const result = (await response.json()) as VerificationResult;\n\n  // Validate required fields\n  if (!result.providerTokens || !result.providerTokens.accessToken) {\n    throw new Error('Verification response missing required provider tokens');\n  }\n\n  return result;\n}\n"],"names":["fetchWithTimeout","verifyBearerToken","bearerToken","verifyUrl","response","method","headers","Authorization","ok","errorText","text","Error","status","result","json","providerTokens","accessToken"],"mappings":"AAAA;;;;;;CAMC,GAGD,SAASA,gBAAgB,QAAQ,0BAA0B;AAkB3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,eAAeC,kBAAkBC,WAAmB,EAAEC,SAAiB;IAC5E,MAAMC,WAAW,MAAMJ,iBAAiBG,WAAW;QACjDE,QAAQ;QACRC,SAAS;YACPC,eAAe,CAAC,OAAO,EAAEL,aAAa;QACxC;IACF;IAEA,IAAI,CAACE,SAASI,EAAE,EAAE;QAChB,MAAMC,YAAY,MAAML,SAASM,IAAI;QACrC,MAAM,IAAIC,MAAM,CAAC,2BAA2B,EAAEP,SAASQ,MAAM,CAAC,CAAC,EAAEH,WAAW;IAC9E;IAEA,MAAMI,SAAU,MAAMT,SAASU,IAAI;IAEnC,2BAA2B;IAC3B,IAAI,CAACD,OAAOE,cAAc,IAAI,CAACF,OAAOE,cAAc,CAACC,WAAW,EAAE;QAChE,MAAM,IAAIL,MAAM;IAClB;IAEA,OAAOE;AACT"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/dcr-verify.ts"],"sourcesContent":["/**\n * DCR Token Verification Utilities\n *\n * Provides token verification for both self-hosted and external DCR modes:\n * - Self-hosted: Verifies tokens against local DCR router (/oauth/verify)\n * - External: Verifies tokens against Auth0/Stitch verification endpoint\n */\n\nimport type { ProviderTokens } from '@mcp-z/oauth';\nimport { fetchWithTimeout } from './fetch-with-timeout.ts';\n\n/**\n * Verification result from DCR authorization server\n */\nexport interface VerificationResult {\n  /** Bearer token that was verified */\n  token: string;\n  /** Client ID associated with the token */\n  clientId: string;\n  /** OAuth scopes granted to the token */\n  scopes: string[];\n  /** Token expiration timestamp (milliseconds since epoch) */\n  expiresAt: number;\n  /** Provider tokens (Microsoft access/refresh tokens) */\n  providerTokens: ProviderTokens;\n}\n\n/**\n * Verify bearer token against DCR authorization server\n *\n * Supports both self-hosted and external DCR modes by calling the\n * /oauth/verify endpoint (or equivalent external URL).\n *\n * @param bearerToken - Bearer token to verify (without \"Bearer \" prefix)\n * @param verifyUrl - Verification endpoint URL (self-hosted or external)\n * @returns Verification result with provider tokens\n * @throws Error if verification fails\n *\n * @example Self-hosted mode\n * ```typescript\n * const result = await verifyBearerToken(\n *   token,\n *   'http://localhost:3456/oauth/verify'\n * );\n * const auth = provider.toAuthProvider(result.providerTokens);\n * ```\n *\n * @example External mode (Auth0/Stitch)\n * ```typescript\n * const result = await verifyBearerToken(\n *   token,\n *   'https://auth.example.com/oauth/verify'\n * );\n * const auth = provider.toAuthProvider(result.providerTokens);\n * ```\n */\nexport async function verifyBearerToken(bearerToken: string, verifyUrl: string): Promise<VerificationResult> {\n  const response = await fetchWithTimeout(verifyUrl, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${bearerToken}`,\n    },\n  });\n\n  if (!response.ok) {\n    const errorText = await response.text();\n    throw new Error(`Token verification failed: ${response.status} ${errorText}`);\n  }\n\n  const result = (await response.json()) as VerificationResult;\n\n  // Validate required fields\n  if (!result.providerTokens || !result.providerTokens.accessToken) {\n    throw new Error('Verification response missing required provider tokens');\n  }\n\n  return result;\n}\n"],"names":["fetchWithTimeout","verifyBearerToken","bearerToken","verifyUrl","response","method","headers","Authorization","ok","errorText","text","Error","status","result","json","providerTokens","accessToken"],"mappings":"AAAA;;;;;;CAMC,GAGD,SAASA,gBAAgB,QAAQ,0BAA0B;AAkB3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,eAAeC,kBAAkBC,WAAmB,EAAEC,SAAiB;IAC5E,MAAMC,WAAW,MAAMJ,iBAAiBG,WAAW;QACjDE,QAAQ;QACRC,SAAS;YACPC,eAAe,CAAC,OAAO,EAAEL,aAAa;QACxC;IACF;IAEA,IAAI,CAACE,SAASI,EAAE,EAAE;QAChB,MAAMC,YAAY,MAAML,SAASM,IAAI;QACrC,MAAM,IAAIC,MAAM,CAAC,2BAA2B,EAAEP,SAASQ,MAAM,CAAC,CAAC,EAAEH,WAAW;IAC9E;IAEA,MAAMI,SAAU,MAAMT,SAASU,IAAI;IAEnC,2BAA2B;IAC3B,IAAI,CAACD,OAAOE,cAAc,IAAI,CAACF,OAAOE,cAAc,CAACC,WAAW,EAAE;QAChE,MAAM,IAAIL,MAAM;IAClB;IAEA,OAAOE;AACT"}

package/dist/esm/lib/fetch-with-timeout.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/lib/fetch-with-timeout.ts"],"sourcesContent":["/**\n * Fetch with timeout to prevent hanging requests\n *\n * This utility wraps the native fetch API with an AbortController to ensure\n * requests don't hang indefinitely. This is critical for OAuth token operations\n * where expired tokens might cause Microsoft's servers to hang or respond slowly.\n *\n * @param url - URL to fetch\n * @param options - Fetch options\n * @param timeoutMs - Timeout in milliseconds (default: 30000)\n * @returns Fetch response\n * @throws Error if request times out\n */\nexport async function fetchWithTimeout(url: string, options?: RequestInit, timeoutMs = 30000): Promise<Response> {\n  const controller = new AbortController();\n  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);\n\n  try {\n    const response = await fetch(url, {\n      ...options,\n      signal: controller.signal,\n    });\n    clearTimeout(timeoutId);\n    return response;\n  } catch (error) {\n    clearTimeout(timeoutId);\n    if (error instanceof Error && error.name === 'AbortError') {\n      throw new Error(`Request timeout after ${timeoutMs}ms`);\n    }\n    throw error;\n  }\n}\n"],"names":["fetchWithTimeout","url","options","timeoutMs","controller","AbortController","timeoutId","setTimeout","abort","response","fetch","signal","clearTimeout","error","Error","name"],"mappings":"AAAA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAeA,iBAAiBC,GAAW,EAAEC,OAAqB,EAAEC,YAAY,KAAK;IAC1F,MAAMC,aAAa,IAAIC;IACvB,MAAMC,YAAYC,WAAW,IAAMH,WAAWI,KAAK,IAAIL;IAEvD,IAAI;QACF,MAAMM,WAAW,MAAMC,MAAMT,KAAK;YAChC,GAAGC,OAAO;YACVS,QAAQP,WAAWO,MAAM;QAC3B;QACAC,aAAaN;QACb,OAAOG;IACT,EAAE,OAAOI,OAAO;QACdD,aAAaN;QACb,IAAIO,iBAAiBC,SAASD,MAAME,IAAI,KAAK,cAAc;YACzD,MAAM,IAAID,MAAM,CAAC,sBAAsB,EAAEX,UAAU,EAAE,CAAC;QACxD;QACA,MAAMU;IACR;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/fetch-with-timeout.ts"],"sourcesContent":["/**\n * Fetch with timeout to prevent hanging requests\n *\n * This utility wraps the native fetch API with an AbortController to ensure\n * requests don't hang indefinitely. This is critical for OAuth token operations\n * where expired tokens might cause Microsoft's servers to hang or respond slowly.\n *\n * @param url - URL to fetch\n * @param options - Fetch options\n * @param timeoutMs - Timeout in milliseconds (default: 30000)\n * @returns Fetch response\n * @throws Error if request times out\n */\nexport async function fetchWithTimeout(url: string, options?: RequestInit, timeoutMs = 30000): Promise<Response> {\n  const controller = new AbortController();\n  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);\n\n  try {\n    const response = await fetch(url, {\n      ...options,\n      signal: controller.signal,\n    });\n    clearTimeout(timeoutId);\n    return response;\n  } catch (error) {\n    clearTimeout(timeoutId);\n    if (error instanceof Error && error.name === 'AbortError') {\n      throw new Error(`Request timeout after ${timeoutMs}ms`);\n    }\n    throw error;\n  }\n}\n"],"names":["fetchWithTimeout","url","options","timeoutMs","controller","AbortController","timeoutId","setTimeout","abort","response","fetch","signal","clearTimeout","error","Error","name"],"mappings":"AAAA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAeA,iBAAiBC,GAAW,EAAEC,OAAqB,EAAEC,YAAY,KAAK;IAC1F,MAAMC,aAAa,IAAIC;IACvB,MAAMC,YAAYC,WAAW,IAAMH,WAAWI,KAAK,IAAIL;IAEvD,IAAI;QACF,MAAMM,WAAW,MAAMC,MAAMT,KAAK;YAChC,GAAGC,OAAO;YACVS,QAAQP,WAAWO,MAAM;QAC3B;QACAC,aAAaN;QACb,OAAOG;IACT,EAAE,OAAOI,OAAO;QACdD,aAAaN;QACb,IAAIO,iBAAiBC,SAASD,MAAME,IAAI,KAAK,cAAc;YACzD,MAAM,IAAID,MAAM,CAAC,sBAAsB,EAAEX,UAAU,EAAE,CAAC;QACxD;QACA,MAAMU;IACR;AACF"}

package/dist/esm/lib/loopback-router.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Loopback OAuth callback router
+ *
+ * Handles GET /oauth/callback for persistent redirectUri deployments.
+ */
+import express from 'express';
+import type { LoopbackOAuthProvider } from '../providers/loopback-oauth.js';
+export declare function createLoopbackCallbackRouter(provider: LoopbackOAuthProvider): express.Router;

package/dist/esm/lib/loopback-router.js

@@ -0,0 +1,32 @@
+/**
+ * Loopback OAuth callback router
+ *
+ * Handles GET /oauth/callback for persistent redirectUri deployments.
+ */ import { getErrorTemplate, getSuccessTemplate } from '@mcp-z/oauth';
+import express from 'express';
+export function createLoopbackCallbackRouter(provider) {
+    const router = express.Router();
+    router.get('/oauth/callback', async (req, res)=>{
+        const code = typeof req.query.code === 'string' ? req.query.code : undefined;
+        const state = typeof req.query.state === 'string' ? req.query.state : undefined;
+        const error = typeof req.query.error === 'string' ? req.query.error : undefined;
+        if (error) {
+            res.status(400).send(getErrorTemplate(error));
+            return;
+        }
+        if (!code) {
+            res.status(400).send(getErrorTemplate('No authorization code received'));
+            return;
+        }
+        try {
+            await provider.handleOAuthCallback({
+                code,
+                state
+            });
+            res.status(200).send(getSuccessTemplate());
+        } catch (callbackError) {
+            res.status(500).send(getErrorTemplate(callbackError instanceof Error ? callbackError.message : 'Token exchange failed'));
+        }
+    });
+    return router;
+}

package/dist/esm/lib/loopback-router.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/loopback-router.ts"],"sourcesContent":["/**\n * Loopback OAuth callback router\n *\n * Handles GET /oauth/callback for persistent redirectUri deployments.\n */\n\nimport { getErrorTemplate, getSuccessTemplate } from '@mcp-z/oauth';\nimport type { Request, Response } from 'express';\nimport express from 'express';\nimport type { LoopbackOAuthProvider } from '../providers/loopback-oauth.ts';\n\nexport function createLoopbackCallbackRouter(provider: LoopbackOAuthProvider): express.Router {\n  const router = express.Router();\n\n  router.get('/oauth/callback', async (req: Request, res: Response) => {\n    const code = typeof req.query.code === 'string' ? req.query.code : undefined;\n    const state = typeof req.query.state === 'string' ? req.query.state : undefined;\n    const error = typeof req.query.error === 'string' ? req.query.error : undefined;\n\n    if (error) {\n      res.status(400).send(getErrorTemplate(error));\n      return;\n    }\n\n    if (!code) {\n      res.status(400).send(getErrorTemplate('No authorization code received'));\n      return;\n    }\n\n    try {\n      await provider.handleOAuthCallback({ code, state });\n      res.status(200).send(getSuccessTemplate());\n    } catch (callbackError) {\n      res.status(500).send(getErrorTemplate(callbackError instanceof Error ? callbackError.message : 'Token exchange failed'));\n    }\n  });\n\n  return router;\n}\n"],"names":["getErrorTemplate","getSuccessTemplate","express","createLoopbackCallbackRouter","provider","router","Router","get","req","res","code","query","undefined","state","error","status","send","handleOAuthCallback","callbackError","Error","message"],"mappings":"AAAA;;;;CAIC,GAED,SAASA,gBAAgB,EAAEC,kBAAkB,QAAQ,eAAe;AAEpE,OAAOC,aAAa,UAAU;AAG9B,OAAO,SAASC,6BAA6BC,QAA+B;IAC1E,MAAMC,SAASH,QAAQI,MAAM;IAE7BD,OAAOE,GAAG,CAAC,mBAAmB,OAAOC,KAAcC;QACjD,MAAMC,OAAO,OAAOF,IAAIG,KAAK,CAACD,IAAI,KAAK,WAAWF,IAAIG,KAAK,CAACD,IAAI,GAAGE;QACnE,MAAMC,QAAQ,OAAOL,IAAIG,KAAK,CAACE,KAAK,KAAK,WAAWL,IAAIG,KAAK,CAACE,KAAK,GAAGD;QACtE,MAAME,QAAQ,OAAON,IAAIG,KAAK,CAACG,KAAK,KAAK,WAAWN,IAAIG,KAAK,CAACG,KAAK,GAAGF;QAEtE,IAAIE,OAAO;YACTL,IAAIM,MAAM,CAAC,KAAKC,IAAI,CAAChB,iBAAiBc;YACtC;QACF;QAEA,IAAI,CAACJ,MAAM;YACTD,IAAIM,MAAM,CAAC,KAAKC,IAAI,CAAChB,iBAAiB;YACtC;QACF;QAEA,IAAI;YACF,MAAMI,SAASa,mBAAmB,CAAC;gBAAEP;gBAAMG;YAAM;YACjDJ,IAAIM,MAAM,CAAC,KAAKC,IAAI,CAACf;QACvB,EAAE,OAAOiB,eAAe;YACtBT,IAAIM,MAAM,CAAC,KAAKC,IAAI,CAAChB,iBAAiBkB,yBAAyBC,QAAQD,cAAcE,OAAO,GAAG;QACjG;IACF;IAEA,OAAOf;AACT"}

package/dist/esm/lib/token-verifier.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/lib/token-verifier.ts"],"sourcesContent":["/**\n * DCR Token Verifier\n *\n * Validates bearer tokens by calling Authorization Server's verification endpoint.\n * Implements proper AS/RS separation - Resource Server doesn't access token storage.\n */\n\nimport type { ProviderTokens } from '@mcp-z/oauth';\n\n/**\n * Authentication information from token verification\n */\nexport interface AuthInfo {\n  /** Bearer access token */\n  token: string;\n\n  /** Client ID that owns the token */\n  clientId: string;\n\n  /** Granted scopes */\n  scopes: string[];\n\n  /** Token expiration timestamp (milliseconds since epoch) */\n  expiresAt: number;\n\n  /** Microsoft provider tokens (if available) */\n  providerTokens?: ProviderTokens;\n}\n\n/**\n * DCR Token Verifier validates access tokens via Authorization Server\n *\n * This implements proper OAuth 2.0 architecture where the Resource Server\n * (MCP server) validates tokens by calling the Authorization Server's\n * verification endpoint rather than accessing token storage directly.\n */\nexport class DcrTokenVerifier {\n  private verifyUrl: string;\n\n  /**\n   * @param verifyUrl - Authorization Server's /oauth/verify endpoint URL\n   */\n  constructor(verifyUrl: string) {\n    this.verifyUrl = verifyUrl;\n  }\n\n  /**\n   * Verify an access token by calling the Authorization Server\n   *\n   * @param token - Bearer access token to validate\n   * @returns AuthInfo with token metadata and provider tokens\n   * @throws Error if token is invalid or verification fails\n   */\n  async verifyAccessToken(token: string): Promise<AuthInfo> {\n    try {\n      const response = await fetch(this.verifyUrl, {\n        method: 'GET',\n        headers: {\n          Authorization: `Bearer ${token}`,\n        },\n      });\n\n      if (!response.ok) {\n        let errorMessage = 'Unknown error';\n        try {\n          const error = await response.json();\n          errorMessage = (error as { error_description?: string; error?: string }).error_description ?? (error as { error?: string }).error ?? errorMessage;\n        } catch {\n          // Failed to parse error JSON, use status text\n          errorMessage = response.statusText;\n        }\n        throw new Error(`Token verification failed: ${errorMessage}`);\n      }\n\n      const authInfo = (await response.json()) as AuthInfo;\n      return authInfo;\n    } catch (error) {\n      if (error instanceof Error) {\n        throw error;\n      }\n      throw new Error(`Token verification failed: ${String(error)}`);\n    }\n  }\n}\n"],"names":["DcrTokenVerifier","verifyAccessToken","token","response","fetch","verifyUrl","method","headers","Authorization","ok","errorMessage","error","json","error_description","statusText","Error","authInfo","String"],"mappings":"AAAA;;;;;CAKC,GAwBD;;;;;;CAMC,GACD,OAAO,MAAMA;IAUX;;;;;;GAMC,GACD,MAAMC,kBAAkBC,KAAa,EAAqB;QACxD,IAAI;YACF,MAAMC,WAAW,MAAMC,MAAM,IAAI,CAACC,SAAS,EAAE;gBAC3CC,QAAQ;gBACRC,SAAS;oBACPC,eAAe,CAAC,OAAO,EAAEN,OAAO;gBAClC;YACF;YAEA,IAAI,CAACC,SAASM,EAAE,EAAE;gBAChB,IAAIC,eAAe;gBACnB,IAAI;wBAEa,MAAA;oBADf,MAAMC,QAAQ,MAAMR,SAASS,IAAI;oBACjCF,gBAAe,QAAA,2BAAA,AAACC,MAAyDE,iBAAiB,cAA3E,sCAAA,2BAA+E,AAACF,MAA6BA,KAAK,cAAlH,kBAAA,OAAsHD;gBACvI,EAAE,OAAM;oBACN,8CAA8C;oBAC9CA,eAAeP,SAASW,UAAU;gBACpC;gBACA,MAAM,IAAIC,MAAM,CAAC,2BAA2B,EAAEL,cAAc;YAC9D;YAEA,MAAMM,WAAY,MAAMb,SAASS,IAAI;YACrC,OAAOI;QACT,EAAE,OAAOL,OAAO;YACd,IAAIA,iBAAiBI,OAAO;gBAC1B,MAAMJ;YACR;YACA,MAAM,IAAII,MAAM,CAAC,2BAA2B,EAAEE,OAAON,QAAQ;QAC/D;IACF;IA3CA;;GAEC,GACD,YAAYN,SAAiB,CAAE;QAC7B,IAAI,CAACA,SAAS,GAAGA;IACnB;AAuCF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/token-verifier.ts"],"sourcesContent":["/**\n * DCR Token Verifier\n *\n * Validates bearer tokens by calling Authorization Server's verification endpoint.\n * Implements proper AS/RS separation - Resource Server doesn't access token storage.\n */\n\nimport type { ProviderTokens } from '@mcp-z/oauth';\n\n/**\n * Authentication information from token verification\n */\nexport interface AuthInfo {\n  /** Bearer access token */\n  token: string;\n\n  /** Client ID that owns the token */\n  clientId: string;\n\n  /** Granted scopes */\n  scopes: string[];\n\n  /** Token expiration timestamp (milliseconds since epoch) */\n  expiresAt: number;\n\n  /** Microsoft provider tokens (if available) */\n  providerTokens?: ProviderTokens;\n}\n\n/**\n * DCR Token Verifier validates access tokens via Authorization Server\n *\n * This implements proper OAuth 2.0 architecture where the Resource Server\n * (MCP server) validates tokens by calling the Authorization Server's\n * verification endpoint rather than accessing token storage directly.\n */\nexport class DcrTokenVerifier {\n  private verifyUrl: string;\n\n  /**\n   * @param verifyUrl - Authorization Server's /oauth/verify endpoint URL\n   */\n  constructor(verifyUrl: string) {\n    this.verifyUrl = verifyUrl;\n  }\n\n  /**\n   * Verify an access token by calling the Authorization Server\n   *\n   * @param token - Bearer access token to validate\n   * @returns AuthInfo with token metadata and provider tokens\n   * @throws Error if token is invalid or verification fails\n   */\n  async verifyAccessToken(token: string): Promise<AuthInfo> {\n    try {\n      const response = await fetch(this.verifyUrl, {\n        method: 'GET',\n        headers: {\n          Authorization: `Bearer ${token}`,\n        },\n      });\n\n      if (!response.ok) {\n        let errorMessage = 'Unknown error';\n        try {\n          const error = await response.json();\n          errorMessage = (error as { error_description?: string; error?: string }).error_description ?? (error as { error?: string }).error ?? errorMessage;\n        } catch {\n          // Failed to parse error JSON, use status text\n          errorMessage = response.statusText;\n        }\n        throw new Error(`Token verification failed: ${errorMessage}`);\n      }\n\n      const authInfo = (await response.json()) as AuthInfo;\n      return authInfo;\n    } catch (error) {\n      if (error instanceof Error) {\n        throw error;\n      }\n      throw new Error(`Token verification failed: ${String(error)}`);\n    }\n  }\n}\n"],"names":["DcrTokenVerifier","verifyAccessToken","token","response","fetch","verifyUrl","method","headers","Authorization","ok","errorMessage","error","json","error_description","statusText","Error","authInfo","String"],"mappings":"AAAA;;;;;CAKC,GAwBD;;;;;;CAMC,GACD,OAAO,MAAMA;IAUX;;;;;;GAMC,GACD,MAAMC,kBAAkBC,KAAa,EAAqB;QACxD,IAAI;YACF,MAAMC,WAAW,MAAMC,MAAM,IAAI,CAACC,SAAS,EAAE;gBAC3CC,QAAQ;gBACRC,SAAS;oBACPC,eAAe,CAAC,OAAO,EAAEN,OAAO;gBAClC;YACF;YAEA,IAAI,CAACC,SAASM,EAAE,EAAE;gBAChB,IAAIC,eAAe;gBACnB,IAAI;wBAEa,MAAA;oBADf,MAAMC,QAAQ,MAAMR,SAASS,IAAI;oBACjCF,gBAAe,QAAA,2BAAA,AAACC,MAAyDE,iBAAiB,cAA3E,sCAAA,2BAA+E,AAACF,MAA6BA,KAAK,cAAlH,kBAAA,OAAsHD;gBACvI,EAAE,OAAM;oBACN,8CAA8C;oBAC9CA,eAAeP,SAASW,UAAU;gBACpC;gBACA,MAAM,IAAIC,MAAM,CAAC,2BAA2B,EAAEL,cAAc;YAC9D;YAEA,MAAMM,WAAY,MAAMb,SAASS,IAAI;YACrC,OAAOI;QACT,EAAE,OAAOL,OAAO;YACd,IAAIA,iBAAiBI,OAAO;gBAC1B,MAAMJ;YACR;YACA,MAAM,IAAII,MAAM,CAAC,2BAA2B,EAAEE,OAAON,QAAQ;QAC/D;IACF;IA3CA;;GAEC,GACD,YAAYN,SAAiB,CAAE;QAC7B,IAAI,CAACA,SAAS,GAAGA;IACnB;AAuCF"}

package/dist/esm/providers/dcr.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/providers/dcr.ts"],"sourcesContent":["/**\n * DCR Provider - Stateless Dynamic Client Registration Provider\n *\n * Implements stateless provider pattern where provider tokens are received from\n * token verification context rather than managed by the provider itself.\n *\n * Use case: MCP HTTP servers with DCR authentication where client manages tokens\n * and provider only handles Microsoft Graph API calls with provided credentials.\n */\n\nimport type { ProviderTokens } from '@mcp-z/oauth';\nimport { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';\nimport { fetchWithTimeout } from '../lib/fetch-with-timeout.ts';\nimport type { AuthContext, EnrichedExtra, Logger, MicrosoftAuthProvider } from '../types.ts';\n\n/**\n * DCR Provider configuration\n */\nexport interface DcrOAuthProviderConfig {\n  /** Microsoft application client ID */\n  clientId: string;\n\n  /** Microsoft application client secret (optional for public clients) */\n  clientSecret?: string;\n\n  /** Azure AD tenant ID */\n  tenantId: string;\n\n  /** OAuth scopes */\n  scope: string;\n\n  /** Custom token endpoint URL (for testing, defaults to Microsoft OAuth endpoint) */\n  tokenUrl?: string;\n\n  /** DCR token verification endpoint URL (e.g., http://localhost:3000/oauth/verify) */\n  verifyEndpoint: string;\n\n  /** Logger for auth operations */\n  logger: Logger;\n}\n\n/**\n * Microsoft Graph TokenResponse\n */\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * DCR Provider - Stateless OAuth provider for Dynamic Client Registration\n *\n * Unlike LoopbackOAuthProvider which manages token storage, DcrOAuthProvider is stateless:\n * - Receives provider tokens from verification context (HTTP bearer auth)\n * - Creates auth providers on-demand from tokens\n * - Handles token refresh using Microsoft OAuth\n * - No token storage dependency\n *\n * Pattern:\n * ```typescript\n * const provider = new DcrOAuthProvider(config);\n * const auth = provider.toAuthProvider(providerTokens);\n * const accessToken = await auth.getAccessToken();\n * ```\n */\nexport class DcrOAuthProvider {\n  private config: DcrOAuthProviderConfig;\n  private emailCache = new Map<string, { email: string; expiresAt: number }>();\n\n  constructor(config: DcrOAuthProviderConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Create Microsoft Graph auth provider from provider tokens\n   *\n   * This is the core stateless pattern - provider receives tokens from context\n   * (token verification, HTTP request) and creates auth provider on-demand.\n   *\n   * @param tokens - Provider tokens (Microsoft access/refresh tokens)\n   * @returns Microsoft Graph-compatible auth provider\n   */\n  toAuthProvider(tokens: ProviderTokens): MicrosoftAuthProvider {\n    // Capture tokens in closure for auth provider\n    let currentTokens = { ...tokens };\n\n    return {\n      getAccessToken: async (): Promise<string> => {\n        // Check if token is still valid\n        if (this.isTokenValid(currentTokens)) {\n          return currentTokens.accessToken;\n        }\n\n        // Token expired - try refresh if available\n        if (currentTokens.refreshToken) {\n          try {\n            const refreshedTokens = await this.refreshAccessToken(currentTokens.refreshToken);\n            currentTokens = refreshedTokens;\n            return currentTokens.accessToken;\n          } catch (error) {\n            throw new Error(`Token refresh failed: ${error instanceof Error ? error.message : String(error)}`);\n          }\n        }\n\n        // No refresh token - token expired and cannot refresh\n        throw new Error('Access token expired and no refresh token available');\n      },\n    };\n  }\n\n  /**\n   * Check if token is still valid (with 1 minute buffer)\n   */\n  private isTokenValid(tokens: ProviderTokens): boolean {\n    if (!tokens.expiresAt) return true; // No expiry = assume valid\n    return Date.now() < tokens.expiresAt - 60000; // 1 minute buffer\n  }\n\n  /**\n   * Refresh Microsoft access token using refresh token\n   *\n   * @param refreshToken - Microsoft refresh token\n   * @returns New provider tokens\n   */\n  async refreshAccessToken(refreshToken: string): Promise<ProviderTokens> {\n    const { clientId, clientSecret, tenantId, scope, tokenUrl: customTokenUrl } = this.config;\n\n    const tokenUrl = customTokenUrl ?? `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      refresh_token: refreshToken,\n      client_id: clientId,\n      grant_type: 'refresh_token',\n      scope,\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);\n    }\n\n    const tokenResponse = (await response.json()) as TokenResponse;\n\n    return {\n      accessToken: tokenResponse.access_token,\n      refreshToken: refreshToken, // Keep original refresh token\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n  }\n\n  /**\n   * Get user email from Microsoft Graph API (with caching)\n   *\n   * @param tokens - Provider tokens to use for API call\n   * @returns User's email address\n   */\n  async getUserEmail(tokens: ProviderTokens): Promise<string> {\n    const cacheKey = tokens.accessToken;\n    const cached = this.emailCache.get(cacheKey);\n\n    // Check cache (with same expiry as access token)\n    if (cached && Date.now() < cached.expiresAt) {\n      return cached.email;\n    }\n\n    const auth = this.toAuthProvider(tokens);\n    const accessToken = await auth.getAccessToken();\n\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to get user info: ${response.status} ${await response.text()}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    const email = userInfo.mail ?? userInfo.userPrincipalName;\n\n    // Cache with token expiration (default 1 hour if not specified)\n    this.emailCache.set(cacheKey, {\n      email,\n      expiresAt: tokens.expiresAt ?? Date.now() + 3600000,\n    });\n\n    return email;\n  }\n\n  /**\n   * Auth middleware for HTTP servers with DCR bearer auth\n   * Validates bearer tokens and enriches extra with provider tokens\n   *\n   * Pattern:\n   * ```typescript\n   * const provider = new DcrOAuthProvider({ ..., verifyEndpoint: 'http://localhost:3000/oauth/verify' });\n   * const middleware = provider.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);\n   * ```\n   */\n  authMiddleware() {\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position\n        const extra = allArgs[extraPosition] as EnrichedExtra;\n\n        // Extract DCR bearer token from SDK's authInfo (if present) or request headers\n        let bearerToken: string | undefined;\n\n        // Option 1: Token already verified by SDK's bearerAuth middleware\n        if (extra.authInfo && typeof extra.authInfo === 'object') {\n          // authInfo contains the validated token - extract it\n          // The SDK's bearerAuth middleware already validated it, but we need the raw token for /oauth/verify\n          // Check if authInfo has the token directly, otherwise extract from headers\n          const authInfo = extra.authInfo as unknown as Record<string, unknown>;\n          bearerToken = (typeof authInfo.accessToken === 'string' ? authInfo.accessToken : undefined) ?? (typeof authInfo.token === 'string' ? authInfo.token : undefined);\n        }\n\n        // Option 2: Extract from Authorization header\n        if (!bearerToken && extra.requestInfo?.headers) {\n          const authHeader = extra.requestInfo.headers.authorization || extra.requestInfo.headers.Authorization;\n          if (authHeader) {\n            // Handle both string and string[] types\n            const headerValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n            if (headerValue) {\n              const match = /^Bearer\\s+(.+)$/i.exec(headerValue);\n              if (match) {\n                bearerToken = match[1];\n              }\n            }\n          }\n        }\n\n        if (!bearerToken) {\n          throw new McpError(ErrorCode.InvalidRequest, 'Missing Authorization header. DCR mode requires bearer token.');\n        }\n\n        // Call /oauth/verify to validate DCR token and get provider tokens\n        const verifyResponse = await fetchWithTimeout(this.config.verifyEndpoint, {\n          headers: { Authorization: `Bearer ${bearerToken}` },\n        });\n\n        if (!verifyResponse.ok) {\n          throw new McpError(ErrorCode.InvalidRequest, `Token verification failed: ${verifyResponse.status}`);\n        }\n\n        const verifyData = (await verifyResponse.json()) as {\n          providerTokens: ProviderTokens;\n        };\n\n        // Fetch user email to use as accountId (with caching)\n        let accountId: string;\n        try {\n          accountId = await this.getUserEmail(verifyData.providerTokens);\n        } catch (error) {\n          throw new McpError(ErrorCode.InternalError, `Failed to get user email for DCR authentication: ${error instanceof Error ? error.message : String(error)}`);\n        }\n\n        // Create auth provider from provider tokens\n        const auth = this.toAuthProvider(verifyData.providerTokens);\n\n        // Inject authContext and logger into extra\n        (extra as { authContext?: AuthContext }).authContext = {\n          auth,\n          accountId, // User's email address\n        };\n        (extra as { logger?: unknown }).logger = this.config.logger;\n\n        // Call original handler with all args\n        return await originalHandler(...allArgs);\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      // Use structural constraints to avoid contravariance check on handler type.\n      // wrapAtPosition is now generic and returns T directly.\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n"],"names":["ErrorCode","McpError","fetchWithTimeout","DcrOAuthProvider","toAuthProvider","tokens","currentTokens","getAccessToken","isTokenValid","accessToken","refreshToken","refreshedTokens","refreshAccessToken","error","Error","message","String","expiresAt","Date","now","clientId","clientSecret","tenantId","scope","tokenUrl","customTokenUrl","config","params","refresh_token","client_id","grant_type","client_secret","body","URLSearchParams","response","method","headers","toString","ok","errorText","text","status","tokenResponse","json","access_token","expires_in","undefined","getUserEmail","userInfo","cacheKey","cached","emailCache","get","email","auth","Authorization","mail","userPrincipalName","set","authMiddleware","wrapAtPosition","module","extraPosition","originalHandler","handler","wrappedHandler","allArgs","extra","bearerToken","authInfo","token","requestInfo","authHeader","authorization","headerValue","Array","isArray","match","exec","InvalidRequest","verifyResponse","verifyEndpoint","verifyData","accountId","providerTokens","InternalError","authContext","logger","withToolAuth","withResourceAuth","withPromptAuth","Map"],"mappings":"AAAA;;;;;;;;CAQC,GAGD,SAASA,SAAS,EAAEC,QAAQ,QAAQ,qCAAqC;AACzE,SAASC,gBAAgB,QAAQ,+BAA+B;AAwChE;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC;IAQX;;;;;;;;GAQC,GACDC,eAAeC,MAAsB,EAAyB;QAC5D,8CAA8C;QAC9C,IAAIC,gBAAgB;YAAE,GAAGD,MAAM;QAAC;QAEhC,OAAO;YACLE,gBAAgB;gBACd,gCAAgC;gBAChC,IAAI,IAAI,CAACC,YAAY,CAACF,gBAAgB;oBACpC,OAAOA,cAAcG,WAAW;gBAClC;gBAEA,2CAA2C;gBAC3C,IAAIH,cAAcI,YAAY,EAAE;oBAC9B,IAAI;wBACF,MAAMC,kBAAkB,MAAM,IAAI,CAACC,kBAAkB,CAACN,cAAcI,YAAY;wBAChFJ,gBAAgBK;wBAChB,OAAOL,cAAcG,WAAW;oBAClC,EAAE,OAAOI,OAAO;wBACd,MAAM,IAAIC,MAAM,CAAC,sBAAsB,EAAED,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH,QAAQ;oBACnG;gBACF;gBAEA,sDAAsD;gBACtD,MAAM,IAAIC,MAAM;YAClB;QACF;IACF;IAEA;;GAEC,GACD,AAAQN,aAAaH,MAAsB,EAAW;QACpD,IAAI,CAACA,OAAOY,SAAS,EAAE,OAAO,MAAM,2BAA2B;QAC/D,OAAOC,KAAKC,GAAG,KAAKd,OAAOY,SAAS,GAAG,OAAO,kBAAkB;IAClE;IAEA;;;;;GAKC,GACD,MAAML,mBAAmBF,YAAoB,EAA2B;QACtE,MAAM,EAAEU,QAAQ,EAAEC,YAAY,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,UAAUC,cAAc,EAAE,GAAG,IAAI,CAACC,MAAM;QAEzF,MAAMF,WAAWC,2BAAAA,4BAAAA,iBAAkB,CAAC,kCAAkC,EAAEH,SAAS,kBAAkB,CAAC;QACpG,MAAMK,SAAiC;YACrCC,eAAelB;YACfmB,WAAWT;YACXU,YAAY;YACZP;QACF;QAEA,sDAAsD;QACtD,IAAIF,cAAc;YAChBM,OAAOI,aAAa,GAAGV;QACzB;QAEA,MAAMW,OAAO,IAAIC,gBAAgBN;QAEjC,MAAMO,WAAW,MAAMhC,iBAAiBsB,UAAU;YAChDW,QAAQ;YACRC,SAAS;gBACP,gBAAgB;YAClB;YACAJ,MAAMA,KAAKK,QAAQ;QACrB;QAEA,IAAI,CAACH,SAASI,EAAE,EAAE;YAChB,MAAMC,YAAY,MAAML,SAASM,IAAI;YACrC,MAAM,IAAI1B,MAAM,CAAC,sBAAsB,EAAEoB,SAASO,MAAM,CAAC,CAAC,EAAEF,WAAW;QACzE;QAEA,MAAMG,gBAAiB,MAAMR,SAASS,IAAI;QAE1C,OAAO;YACLlC,aAAaiC,cAAcE,YAAY;YACvClC,cAAcA;YACd,GAAIgC,cAAcG,UAAU,KAAKC,aAAa;gBAAE7B,WAAWC,KAAKC,GAAG,KAAKuB,cAAcG,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIH,cAAcnB,KAAK,KAAKuB,aAAa;gBAAEvB,OAAOmB,cAAcnB,KAAK;YAAC,CAAC;QACzE;IACF;IAEA;;;;;GAKC,GACD,MAAMwB,aAAa1C,MAAsB,EAAmB;YAuB5C2C,gBAKD3C;QA3Bb,MAAM4C,WAAW5C,OAAOI,WAAW;QACnC,MAAMyC,SAAS,IAAI,CAACC,UAAU,CAACC,GAAG,CAACH;QAEnC,iDAAiD;QACjD,IAAIC,UAAUhC,KAAKC,GAAG,KAAK+B,OAAOjC,SAAS,EAAE;YAC3C,OAAOiC,OAAOG,KAAK;QACrB;QAEA,MAAMC,OAAO,IAAI,CAAClD,cAAc,CAACC;QACjC,MAAMI,cAAc,MAAM6C,KAAK/C,cAAc;QAE7C,MAAM2B,WAAW,MAAMhC,iBAAiB,uCAAuC;YAC7EkC,SAAS;gBACPmB,eAAe,CAAC,OAAO,EAAE9C,aAAa;YACxC;QACF;QAEA,IAAI,CAACyB,SAASI,EAAE,EAAE;YAChB,MAAM,IAAIxB,MAAM,CAAC,yBAAyB,EAAEoB,SAASO,MAAM,CAAC,CAAC,EAAE,MAAMP,SAASM,IAAI,IAAI;QACxF;QAEA,MAAMQ,WAAY,MAAMd,SAASS,IAAI;QACrC,MAAMU,SAAQL,iBAAAA,SAASQ,IAAI,cAAbR,4BAAAA,iBAAiBA,SAASS,iBAAiB;QAEzD,gEAAgE;QAChE,IAAI,CAACN,UAAU,CAACO,GAAG,CAACT,UAAU;YAC5BI;YACApC,SAAS,GAAEZ,oBAAAA,OAAOY,SAAS,cAAhBZ,+BAAAA,oBAAoBa,KAAKC,GAAG,KAAK;QAC9C;QAEA,OAAOkC;IACT;IAEA;;;;;;;;;;;;GAYC,GACDM,iBAAiB;QACf,0EAA0E;QAC1E,sFAAsF;QACtF,MAAMC,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,kBAAkBF,OAAOG,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;oBAiBXC;gBAhBpB,0CAA0C;gBAC1C,MAAMA,QAAQD,OAAO,CAACJ,cAAc;gBAEpC,+EAA+E;gBAC/E,IAAIM;gBAEJ,kEAAkE;gBAClE,IAAID,MAAME,QAAQ,IAAI,OAAOF,MAAME,QAAQ,KAAK,UAAU;wBAKzC;oBAJf,qDAAqD;oBACrD,oGAAoG;oBACpG,2EAA2E;oBAC3E,MAAMA,WAAWF,MAAME,QAAQ;oBAC/BD,eAAe,OAAA,OAAOC,SAAS5D,WAAW,KAAK,WAAW4D,SAAS5D,WAAW,GAAGqC,uBAAlE,kBAAA,OAAiF,OAAOuB,SAASC,KAAK,KAAK,WAAWD,SAASC,KAAK,GAAGxB;gBACxJ;gBAEA,8CAA8C;gBAC9C,IAAI,CAACsB,iBAAeD,qBAAAA,MAAMI,WAAW,cAAjBJ,yCAAAA,mBAAmB/B,OAAO,GAAE;oBAC9C,MAAMoC,aAAaL,MAAMI,WAAW,CAACnC,OAAO,CAACqC,aAAa,IAAIN,MAAMI,WAAW,CAACnC,OAAO,CAACmB,aAAa;oBACrG,IAAIiB,YAAY;wBACd,wCAAwC;wBACxC,MAAME,cAAcC,MAAMC,OAAO,CAACJ,cAAcA,UAAU,CAAC,EAAE,GAAGA;wBAChE,IAAIE,aAAa;4BACf,MAAMG,QAAQ,mBAAmBC,IAAI,CAACJ;4BACtC,IAAIG,OAAO;gCACTT,cAAcS,KAAK,CAAC,EAAE;4BACxB;wBACF;oBACF;gBACF;gBAEA,IAAI,CAACT,aAAa;oBAChB,MAAM,IAAInE,SAASD,UAAU+E,cAAc,EAAE;gBAC/C;gBAEA,mEAAmE;gBACnE,MAAMC,iBAAiB,MAAM9E,iBAAiB,IAAI,CAACwB,MAAM,CAACuD,cAAc,EAAE;oBACxE7C,SAAS;wBAAEmB,eAAe,CAAC,OAAO,EAAEa,aAAa;oBAAC;gBACpD;gBAEA,IAAI,CAACY,eAAe1C,EAAE,EAAE;oBACtB,MAAM,IAAIrC,SAASD,UAAU+E,cAAc,EAAE,CAAC,2BAA2B,EAAEC,eAAevC,MAAM,EAAE;gBACpG;gBAEA,MAAMyC,aAAc,MAAMF,eAAerC,IAAI;gBAI7C,sDAAsD;gBACtD,IAAIwC;gBACJ,IAAI;oBACFA,YAAY,MAAM,IAAI,CAACpC,YAAY,CAACmC,WAAWE,cAAc;gBAC/D,EAAE,OAAOvE,OAAO;oBACd,MAAM,IAAIZ,SAASD,UAAUqF,aAAa,EAAE,CAAC,iDAAiD,EAAExE,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH,QAAQ;gBAC1J;gBAEA,4CAA4C;gBAC5C,MAAMyC,OAAO,IAAI,CAAClD,cAAc,CAAC8E,WAAWE,cAAc;gBAE1D,2CAA2C;gBAC1CjB,MAAwCmB,WAAW,GAAG;oBACrDhC;oBACA6B;gBACF;gBACChB,MAA+BoB,MAAM,GAAG,IAAI,CAAC7D,MAAM,CAAC6D,MAAM;gBAE3D,sCAAsC;gBACtC,OAAO,MAAMxB,mBAAmBG;YAClC;YAEA,OAAO;gBACL,GAAGL,MAAM;gBACTG,SAASC;YACX;QACF;QAEA,OAAO;YACL,4EAA4E;YAC5E,wDAAwD;YACxDuB,cAAc,CAAgE3B,SAAcD,eAAeC,QAAQ;YACnH4B,kBAAkB,CAAqF5B,SAAcD,eAAeC,QAAQ;YAC5I6B,gBAAgB,CAAgE7B,SAAcD,eAAeC,QAAQ;QACvH;IACF;IA9OA,YAAYnC,MAA8B,CAAE;aAFpCyB,aAAa,IAAIwC;QAGvB,IAAI,CAACjE,MAAM,GAAGA;IAChB;AA6OF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/providers/dcr.ts"],"sourcesContent":["/**\n * DCR Provider - Stateless Dynamic Client Registration Provider\n *\n * Implements stateless provider pattern where provider tokens are received from\n * token verification context rather than managed by the provider itself.\n *\n * Use case: MCP HTTP servers with DCR authentication where client manages tokens\n * and provider only handles Microsoft Graph API calls with provided credentials.\n */\n\nimport type { ProviderTokens } from '@mcp-z/oauth';\nimport { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';\nimport { fetchWithTimeout } from '../lib/fetch-with-timeout.ts';\nimport type { AuthContext, EnrichedExtra, Logger, MicrosoftAuthProvider } from '../types.ts';\n\n/**\n * DCR Provider configuration\n */\nexport interface DcrOAuthProviderConfig {\n  /** Microsoft application client ID */\n  clientId: string;\n\n  /** Microsoft application client secret (optional for public clients) */\n  clientSecret?: string;\n\n  /** Azure AD tenant ID */\n  tenantId: string;\n\n  /** OAuth scopes */\n  scope: string;\n\n  /** Custom token endpoint URL (for testing, defaults to Microsoft OAuth endpoint) */\n  tokenUrl?: string;\n\n  /** DCR token verification endpoint URL (e.g., http://localhost:3000/oauth/verify) */\n  verifyEndpoint: string;\n\n  /** Logger for auth operations */\n  logger: Logger;\n}\n\n/**\n * Microsoft Graph TokenResponse\n */\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * DCR Provider - Stateless OAuth provider for Dynamic Client Registration\n *\n * Unlike LoopbackOAuthProvider which manages token storage, DcrOAuthProvider is stateless:\n * - Receives provider tokens from verification context (HTTP bearer auth)\n * - Creates auth providers on-demand from tokens\n * - Handles token refresh using Microsoft OAuth\n * - No token storage dependency\n *\n * Pattern:\n * ```typescript\n * const provider = new DcrOAuthProvider(config);\n * const auth = provider.toAuthProvider(providerTokens);\n * const accessToken = await auth.getAccessToken();\n * ```\n */\nexport class DcrOAuthProvider {\n  private config: DcrOAuthProviderConfig;\n  private emailCache = new Map<string, { email: string; expiresAt: number }>();\n\n  constructor(config: DcrOAuthProviderConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Create Microsoft Graph auth provider from provider tokens\n   *\n   * This is the core stateless pattern - provider receives tokens from context\n   * (token verification, HTTP request) and creates auth provider on-demand.\n   *\n   * @param tokens - Provider tokens (Microsoft access/refresh tokens)\n   * @returns Microsoft Graph-compatible auth provider\n   */\n  toAuthProvider(tokens: ProviderTokens): MicrosoftAuthProvider {\n    // Capture tokens in closure for auth provider\n    let currentTokens = { ...tokens };\n\n    return {\n      getAccessToken: async (): Promise<string> => {\n        // Check if token is still valid\n        if (this.isTokenValid(currentTokens)) {\n          return currentTokens.accessToken;\n        }\n\n        // Token expired - try refresh if available\n        if (currentTokens.refreshToken) {\n          try {\n            const refreshedTokens = await this.refreshAccessToken(currentTokens.refreshToken);\n            currentTokens = refreshedTokens;\n            return currentTokens.accessToken;\n          } catch (error) {\n            throw new Error(`Token refresh failed: ${error instanceof Error ? error.message : String(error)}`);\n          }\n        }\n\n        // No refresh token - token expired and cannot refresh\n        throw new Error('Access token expired and no refresh token available');\n      },\n    };\n  }\n\n  /**\n   * Check if token is still valid (with 1 minute buffer)\n   */\n  private isTokenValid(tokens: ProviderTokens): boolean {\n    if (!tokens.expiresAt) return true; // No expiry = assume valid\n    return Date.now() < tokens.expiresAt - 60000; // 1 minute buffer\n  }\n\n  /**\n   * Refresh Microsoft access token using refresh token\n   *\n   * @param refreshToken - Microsoft refresh token\n   * @returns New provider tokens\n   */\n  async refreshAccessToken(refreshToken: string): Promise<ProviderTokens> {\n    const { clientId, clientSecret, tenantId, scope, tokenUrl: customTokenUrl } = this.config;\n\n    const tokenUrl = customTokenUrl ?? `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      refresh_token: refreshToken,\n      client_id: clientId,\n      grant_type: 'refresh_token',\n      scope,\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);\n    }\n\n    const tokenResponse = (await response.json()) as TokenResponse;\n\n    return {\n      accessToken: tokenResponse.access_token,\n      refreshToken: refreshToken, // Keep original refresh token\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n  }\n\n  /**\n   * Get user email from Microsoft Graph API (with caching)\n   *\n   * @param tokens - Provider tokens to use for API call\n   * @returns User's email address\n   */\n  async getUserEmail(tokens: ProviderTokens): Promise<string> {\n    const cacheKey = tokens.accessToken;\n    const cached = this.emailCache.get(cacheKey);\n\n    // Check cache (with same expiry as access token)\n    if (cached && Date.now() < cached.expiresAt) {\n      return cached.email;\n    }\n\n    const auth = this.toAuthProvider(tokens);\n    const accessToken = await auth.getAccessToken();\n\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to get user info: ${response.status} ${await response.text()}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    const email = userInfo.mail ?? userInfo.userPrincipalName;\n\n    // Cache with token expiration (default 1 hour if not specified)\n    this.emailCache.set(cacheKey, {\n      email,\n      expiresAt: tokens.expiresAt ?? Date.now() + 3600000,\n    });\n\n    return email;\n  }\n\n  /**\n   * Auth middleware for HTTP servers with DCR bearer auth\n   * Validates bearer tokens and enriches extra with provider tokens\n   *\n   * Pattern:\n   * ```typescript\n   * const provider = new DcrOAuthProvider({ ..., verifyEndpoint: 'http://localhost:3000/oauth/verify' });\n   * const middleware = provider.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);\n   * ```\n   */\n  authMiddleware() {\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position\n        const extra = allArgs[extraPosition] as EnrichedExtra;\n\n        // Extract DCR bearer token from SDK's authInfo (if present) or request headers\n        let bearerToken: string | undefined;\n\n        // Option 1: Token already verified by SDK's bearerAuth middleware\n        if (extra.authInfo && typeof extra.authInfo === 'object') {\n          // authInfo contains the validated token - extract it\n          // The SDK's bearerAuth middleware already validated it, but we need the raw token for /oauth/verify\n          // Check if authInfo has the token directly, otherwise extract from headers\n          const authInfo = extra.authInfo as unknown as Record<string, unknown>;\n          bearerToken = (typeof authInfo.accessToken === 'string' ? authInfo.accessToken : undefined) ?? (typeof authInfo.token === 'string' ? authInfo.token : undefined);\n        }\n\n        // Option 2: Extract from Authorization header\n        if (!bearerToken && extra.requestInfo?.headers) {\n          const authHeader = extra.requestInfo.headers.authorization || extra.requestInfo.headers.Authorization;\n          if (authHeader) {\n            // Handle both string and string[] types\n            const headerValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n            if (headerValue) {\n              const match = /^Bearer\\s+(.+)$/i.exec(headerValue);\n              if (match) {\n                bearerToken = match[1];\n              }\n            }\n          }\n        }\n\n        if (!bearerToken) {\n          throw new McpError(ErrorCode.InvalidRequest, 'Missing Authorization header. DCR mode requires bearer token.');\n        }\n\n        // Call /oauth/verify to validate DCR token and get provider tokens\n        const verifyResponse = await fetchWithTimeout(this.config.verifyEndpoint, {\n          headers: { Authorization: `Bearer ${bearerToken}` },\n        });\n\n        if (!verifyResponse.ok) {\n          throw new McpError(ErrorCode.InvalidRequest, `Token verification failed: ${verifyResponse.status}`);\n        }\n\n        const verifyData = (await verifyResponse.json()) as {\n          providerTokens: ProviderTokens;\n        };\n\n        // Fetch user email to use as accountId (with caching)\n        let accountId: string;\n        try {\n          accountId = await this.getUserEmail(verifyData.providerTokens);\n        } catch (error) {\n          throw new McpError(ErrorCode.InternalError, `Failed to get user email for DCR authentication: ${error instanceof Error ? error.message : String(error)}`);\n        }\n\n        // Create auth provider from provider tokens\n        const auth = this.toAuthProvider(verifyData.providerTokens);\n\n        // Inject authContext and logger into extra\n        (extra as { authContext?: AuthContext }).authContext = {\n          auth,\n          accountId, // User's email address\n        };\n        (extra as { logger?: unknown }).logger = this.config.logger;\n\n        // Call original handler with all args\n        return await originalHandler(...allArgs);\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      // Use structural constraints to avoid contravariance check on handler type.\n      // wrapAtPosition is now generic and returns T directly.\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n"],"names":["ErrorCode","McpError","fetchWithTimeout","DcrOAuthProvider","toAuthProvider","tokens","currentTokens","getAccessToken","isTokenValid","accessToken","refreshToken","refreshedTokens","refreshAccessToken","error","Error","message","String","expiresAt","Date","now","clientId","clientSecret","tenantId","scope","tokenUrl","customTokenUrl","config","params","refresh_token","client_id","grant_type","client_secret","body","URLSearchParams","response","method","headers","toString","ok","errorText","text","status","tokenResponse","json","access_token","expires_in","undefined","getUserEmail","userInfo","cacheKey","cached","emailCache","get","email","auth","Authorization","mail","userPrincipalName","set","authMiddleware","wrapAtPosition","module","extraPosition","originalHandler","handler","wrappedHandler","allArgs","extra","bearerToken","authInfo","token","requestInfo","authHeader","authorization","headerValue","Array","isArray","match","exec","InvalidRequest","verifyResponse","verifyEndpoint","verifyData","accountId","providerTokens","InternalError","authContext","logger","withToolAuth","withResourceAuth","withPromptAuth","Map"],"mappings":"AAAA;;;;;;;;CAQC,GAGD,SAASA,SAAS,EAAEC,QAAQ,QAAQ,qCAAqC;AACzE,SAASC,gBAAgB,QAAQ,+BAA+B;AAwChE;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC;IAQX;;;;;;;;GAQC,GACDC,eAAeC,MAAsB,EAAyB;QAC5D,8CAA8C;QAC9C,IAAIC,gBAAgB;YAAE,GAAGD,MAAM;QAAC;QAEhC,OAAO;YACLE,gBAAgB;gBACd,gCAAgC;gBAChC,IAAI,IAAI,CAACC,YAAY,CAACF,gBAAgB;oBACpC,OAAOA,cAAcG,WAAW;gBAClC;gBAEA,2CAA2C;gBAC3C,IAAIH,cAAcI,YAAY,EAAE;oBAC9B,IAAI;wBACF,MAAMC,kBAAkB,MAAM,IAAI,CAACC,kBAAkB,CAACN,cAAcI,YAAY;wBAChFJ,gBAAgBK;wBAChB,OAAOL,cAAcG,WAAW;oBAClC,EAAE,OAAOI,OAAO;wBACd,MAAM,IAAIC,MAAM,CAAC,sBAAsB,EAAED,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH,QAAQ;oBACnG;gBACF;gBAEA,sDAAsD;gBACtD,MAAM,IAAIC,MAAM;YAClB;QACF;IACF;IAEA;;GAEC,GACD,AAAQN,aAAaH,MAAsB,EAAW;QACpD,IAAI,CAACA,OAAOY,SAAS,EAAE,OAAO,MAAM,2BAA2B;QAC/D,OAAOC,KAAKC,GAAG,KAAKd,OAAOY,SAAS,GAAG,OAAO,kBAAkB;IAClE;IAEA;;;;;GAKC,GACD,MAAML,mBAAmBF,YAAoB,EAA2B;QACtE,MAAM,EAAEU,QAAQ,EAAEC,YAAY,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,UAAUC,cAAc,EAAE,GAAG,IAAI,CAACC,MAAM;QAEzF,MAAMF,WAAWC,2BAAAA,4BAAAA,iBAAkB,CAAC,kCAAkC,EAAEH,SAAS,kBAAkB,CAAC;QACpG,MAAMK,SAAiC;YACrCC,eAAelB;YACfmB,WAAWT;YACXU,YAAY;YACZP;QACF;QAEA,sDAAsD;QACtD,IAAIF,cAAc;YAChBM,OAAOI,aAAa,GAAGV;QACzB;QAEA,MAAMW,OAAO,IAAIC,gBAAgBN;QAEjC,MAAMO,WAAW,MAAMhC,iBAAiBsB,UAAU;YAChDW,QAAQ;YACRC,SAAS;gBACP,gBAAgB;YAClB;YACAJ,MAAMA,KAAKK,QAAQ;QACrB;QAEA,IAAI,CAACH,SAASI,EAAE,EAAE;YAChB,MAAMC,YAAY,MAAML,SAASM,IAAI;YACrC,MAAM,IAAI1B,MAAM,CAAC,sBAAsB,EAAEoB,SAASO,MAAM,CAAC,CAAC,EAAEF,WAAW;QACzE;QAEA,MAAMG,gBAAiB,MAAMR,SAASS,IAAI;QAE1C,OAAO;YACLlC,aAAaiC,cAAcE,YAAY;YACvClC,cAAcA;YACd,GAAIgC,cAAcG,UAAU,KAAKC,aAAa;gBAAE7B,WAAWC,KAAKC,GAAG,KAAKuB,cAAcG,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIH,cAAcnB,KAAK,KAAKuB,aAAa;gBAAEvB,OAAOmB,cAAcnB,KAAK;YAAC,CAAC;QACzE;IACF;IAEA;;;;;GAKC,GACD,MAAMwB,aAAa1C,MAAsB,EAAmB;YAuB5C2C,gBAKD3C;QA3Bb,MAAM4C,WAAW5C,OAAOI,WAAW;QACnC,MAAMyC,SAAS,IAAI,CAACC,UAAU,CAACC,GAAG,CAACH;QAEnC,iDAAiD;QACjD,IAAIC,UAAUhC,KAAKC,GAAG,KAAK+B,OAAOjC,SAAS,EAAE;YAC3C,OAAOiC,OAAOG,KAAK;QACrB;QAEA,MAAMC,OAAO,IAAI,CAAClD,cAAc,CAACC;QACjC,MAAMI,cAAc,MAAM6C,KAAK/C,cAAc;QAE7C,MAAM2B,WAAW,MAAMhC,iBAAiB,uCAAuC;YAC7EkC,SAAS;gBACPmB,eAAe,CAAC,OAAO,EAAE9C,aAAa;YACxC;QACF;QAEA,IAAI,CAACyB,SAASI,EAAE,EAAE;YAChB,MAAM,IAAIxB,MAAM,CAAC,yBAAyB,EAAEoB,SAASO,MAAM,CAAC,CAAC,EAAE,MAAMP,SAASM,IAAI,IAAI;QACxF;QAEA,MAAMQ,WAAY,MAAMd,SAASS,IAAI;QACrC,MAAMU,SAAQL,iBAAAA,SAASQ,IAAI,cAAbR,4BAAAA,iBAAiBA,SAASS,iBAAiB;QAEzD,gEAAgE;QAChE,IAAI,CAACN,UAAU,CAACO,GAAG,CAACT,UAAU;YAC5BI;YACApC,SAAS,GAAEZ,oBAAAA,OAAOY,SAAS,cAAhBZ,+BAAAA,oBAAoBa,KAAKC,GAAG,KAAK;QAC9C;QAEA,OAAOkC;IACT;IAEA;;;;;;;;;;;;GAYC,GACDM,iBAAiB;QACf,0EAA0E;QAC1E,sFAAsF;QACtF,MAAMC,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,kBAAkBF,OAAOG,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;oBAiBXC;gBAhBpB,0CAA0C;gBAC1C,MAAMA,QAAQD,OAAO,CAACJ,cAAc;gBAEpC,+EAA+E;gBAC/E,IAAIM;gBAEJ,kEAAkE;gBAClE,IAAID,MAAME,QAAQ,IAAI,OAAOF,MAAME,QAAQ,KAAK,UAAU;wBAKzC;oBAJf,qDAAqD;oBACrD,oGAAoG;oBACpG,2EAA2E;oBAC3E,MAAMA,WAAWF,MAAME,QAAQ;oBAC/BD,eAAe,OAAA,OAAOC,SAAS5D,WAAW,KAAK,WAAW4D,SAAS5D,WAAW,GAAGqC,uBAAlE,kBAAA,OAAiF,OAAOuB,SAASC,KAAK,KAAK,WAAWD,SAASC,KAAK,GAAGxB;gBACxJ;gBAEA,8CAA8C;gBAC9C,IAAI,CAACsB,iBAAeD,qBAAAA,MAAMI,WAAW,cAAjBJ,yCAAAA,mBAAmB/B,OAAO,GAAE;oBAC9C,MAAMoC,aAAaL,MAAMI,WAAW,CAACnC,OAAO,CAACqC,aAAa,IAAIN,MAAMI,WAAW,CAACnC,OAAO,CAACmB,aAAa;oBACrG,IAAIiB,YAAY;wBACd,wCAAwC;wBACxC,MAAME,cAAcC,MAAMC,OAAO,CAACJ,cAAcA,UAAU,CAAC,EAAE,GAAGA;wBAChE,IAAIE,aAAa;4BACf,MAAMG,QAAQ,mBAAmBC,IAAI,CAACJ;4BACtC,IAAIG,OAAO;gCACTT,cAAcS,KAAK,CAAC,EAAE;4BACxB;wBACF;oBACF;gBACF;gBAEA,IAAI,CAACT,aAAa;oBAChB,MAAM,IAAInE,SAASD,UAAU+E,cAAc,EAAE;gBAC/C;gBAEA,mEAAmE;gBACnE,MAAMC,iBAAiB,MAAM9E,iBAAiB,IAAI,CAACwB,MAAM,CAACuD,cAAc,EAAE;oBACxE7C,SAAS;wBAAEmB,eAAe,CAAC,OAAO,EAAEa,aAAa;oBAAC;gBACpD;gBAEA,IAAI,CAACY,eAAe1C,EAAE,EAAE;oBACtB,MAAM,IAAIrC,SAASD,UAAU+E,cAAc,EAAE,CAAC,2BAA2B,EAAEC,eAAevC,MAAM,EAAE;gBACpG;gBAEA,MAAMyC,aAAc,MAAMF,eAAerC,IAAI;gBAI7C,sDAAsD;gBACtD,IAAIwC;gBACJ,IAAI;oBACFA,YAAY,MAAM,IAAI,CAACpC,YAAY,CAACmC,WAAWE,cAAc;gBAC/D,EAAE,OAAOvE,OAAO;oBACd,MAAM,IAAIZ,SAASD,UAAUqF,aAAa,EAAE,CAAC,iDAAiD,EAAExE,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH,QAAQ;gBAC1J;gBAEA,4CAA4C;gBAC5C,MAAMyC,OAAO,IAAI,CAAClD,cAAc,CAAC8E,WAAWE,cAAc;gBAE1D,2CAA2C;gBAC1CjB,MAAwCmB,WAAW,GAAG;oBACrDhC;oBACA6B;gBACF;gBACChB,MAA+BoB,MAAM,GAAG,IAAI,CAAC7D,MAAM,CAAC6D,MAAM;gBAE3D,sCAAsC;gBACtC,OAAO,MAAMxB,mBAAmBG;YAClC;YAEA,OAAO;gBACL,GAAGL,MAAM;gBACTG,SAASC;YACX;QACF;QAEA,OAAO;YACL,4EAA4E;YAC5E,wDAAwD;YACxDuB,cAAc,CAAgE3B,SAAcD,eAAeC,QAAQ;YACnH4B,kBAAkB,CAAqF5B,SAAcD,eAAeC,QAAQ;YAC5I6B,gBAAgB,CAAgE7B,SAAcD,eAAeC,QAAQ;QACvH;IACF;IA9OA,YAAYnC,MAA8B,CAAE;aAFpCyB,aAAa,IAAIwC;QAGvB,IAAI,CAACjE,MAAM,GAAGA;IAChB;AA6OF"}

package/dist/esm/providers/device-code.js

@@ -64,7 +64,7 @@ import { fetchWithTimeout } from '../lib/fetch-with-timeout.js';
             },
             body: new URLSearchParams({
                 client_id: clientId,
-                scope: scope
+                scope
             })
         });
         if (!deviceCodeResponse.ok) {
@@ -199,7 +199,7 @@ import { fetchWithTimeout } from '../lib/fetch-with-timeout.js';
                 grant_type: 'refresh_token',
                 client_id: clientId,
                 refresh_token: refreshToken,
-                scope: scope
+                scope
             })
         });
         if (!response.ok) {