@muxoai/platform 1.4.0 → 1.4.2

package/dist/memory-graph.d.ts

@@ -0,0 +1,21 @@
+import type { ConnectionRecord, GovernancePolicy, MemoryKnowledgeGraph, ProvisionedResource, TemporalGraphFact } from "./types.js";
+export interface MemoryGraphInput {
+    workspace: {
+        id: string;
+        slug: string;
+        name: string;
+        tier: string;
+        policy?: GovernancePolicy;
+    };
+    namespace: string;
+    query?: string;
+    facts: TemporalGraphFact[];
+    resources: Array<Pick<ProvisionedResource, "resourceName" | "status" | "providerName" | "serviceSlug">>;
+    activeConnections: Array<Pick<ConnectionRecord, "id" | "providerSlug" | "providerName" | "createdAt">>;
+    memoriesCount: number;
+}
+/**
+ * Builds the bi-temporal knowledge graph (nodes, active/historical edges, Mermaid preview)
+ * from runtime-agnostic inputs so the Node engine and the Edge Worker render identical graphs.
+ */
+export declare function buildMemoryKnowledgeGraph(input: MemoryGraphInput): MemoryKnowledgeGraph;

package/dist/memory-graph.js

@@ -0,0 +1,173 @@
+import { formatHumanFriendlyExplanation } from "./policy.js";
+/**
+ * Builds the bi-temporal knowledge graph (nodes, active/historical edges, Mermaid preview)
+ * from runtime-agnostic inputs so the Node engine and the Edge Worker render identical graphs.
+ */
+export function buildMemoryKnowledgeGraph(input) {
+    const ws = input.workspace;
+    const query = input.query;
+    const nodeMap = new Map();
+    const rootId = `workspace:${ws.slug}`;
+    nodeMap.set(rootId, {
+        id: rootId,
+        kind: "workspace",
+        label: ws.name,
+        summary: `Workspace ${ws.name} (${ws.slug}, tier=${ws.tier})`,
+        status: "active",
+        metadata: { workspaceId: ws.id, tier: ws.tier },
+    });
+    const ensureNode = (id, status, fallbackKind = "entity", summary) => {
+        const existing = nodeMap.get(id);
+        if (existing) {
+            if (status === "active" && existing.status === "historical") {
+                existing.status = "active";
+            }
+            return existing;
+        }
+        const kind = id.startsWith("workspace:")
+            ? "workspace"
+            : id.startsWith("resource:")
+                ? "resource"
+                : id.startsWith("connection:")
+                    ? "connection"
+                    : id.startsWith("tool:")
+                        ? "tool"
+                        : id.startsWith("guardrail:")
+                            ? "guardrail"
+                            : fallbackKind;
+        const label = id.includes(":")
+            ? id.split(":").slice(1).join(":")
+            : id.length > 36
+                ? `${id.slice(0, 33)}...`
+                : id;
+        const created = {
+            id,
+            kind,
+            label,
+            summary: summary || label,
+            status,
+        };
+        nodeMap.set(id, created);
+        return created;
+    };
+    const edges = input.facts.map((fact) => {
+        const status = fact.validTo === null ? "active" : "historical";
+        const objKind = fact.sourceKind === "preference"
+            ? "preference"
+            : fact.sourceKind === "policy_decision"
+                ? "guardrail"
+                : fact.sourceKind === "resource_topology"
+                    ? "resource"
+                    : "entity";
+        ensureNode(fact.subject, status, "entity", fact.subject);
+        ensureNode(fact.object, status, objKind, fact.summary);
+        return {
+            id: fact.id,
+            source: fact.subject,
+            target: fact.object,
+            subject: fact.subject,
+            object: fact.object,
+            predicate: fact.predicate,
+            summary: fact.summary,
+            confidence: fact.confidence,
+            status,
+            validFrom: fact.validFrom,
+            validTo: fact.validTo,
+            supersededById: fact.supersededById ?? null,
+            sourceKind: fact.sourceKind,
+            sourceReferenceId: fact.sourceReferenceId ?? null,
+        };
+    });
+    for (const res of input.resources) {
+        ensureNode(`resource:${res.resourceName}`, res.status === "active" ? "active" : "historical", "resource", `${res.resourceName} (${res.providerName} / ${res.serviceSlug})`);
+    }
+    for (const conn of input.activeConnections) {
+        const connId = `connection:${conn.providerSlug}`;
+        ensureNode(connId, "active", "connection", `Connected OAuth App: ${conn.providerName} (${conn.providerSlug})`);
+        if (!edges.some((e) => e.source === rootId && e.target === connId)) {
+            edges.push({
+                id: `edge_conn_${conn.id}`,
+                source: rootId,
+                target: connId,
+                predicate: "CONNECTED_TO",
+                summary: `${ws.name} has active OAuth connection to ${conn.providerName}`,
+                confidence: 1.0,
+                status: "active",
+                validFrom: conn.createdAt,
+                validTo: null,
+                supersededById: null,
+                sourceKind: "system",
+                sourceReferenceId: conn.id,
+            });
+        }
+    }
+    const activeEdges = edges.filter((e) => e.status === "active");
+    const historicalEdges = edges.filter((e) => e.status === "historical");
+    const nodes = Array.from(nodeMap.values());
+    const safeMermaidId = (raw, idx) => `N${idx}_${raw.replace(/[^a-zA-Z0-9]/g, "_").slice(0, 14)}`;
+    const nodeIndex = new Map();
+    nodes.slice(0, 24).forEach((n, idx) => {
+        nodeIndex.set(n.id, safeMermaidId(n.label, idx));
+    });
+    const mermaidLines = ["flowchart LR"];
+    for (const n of nodes.slice(0, 24)) {
+        const mId = nodeIndex.get(n.id);
+        const cleanLabel = n.label.replace(/"/g, "'").slice(0, 22);
+        mermaidLines.push(`  ${mId}["${cleanLabel}"]`);
+    }
+    for (const e of edges.slice(0, 24)) {
+        const srcId = nodeIndex.get(e.source);
+        const tgtId = nodeIndex.get(e.target);
+        if (!srcId || !tgtId)
+            continue;
+        const pred = e.predicate.replace(/"/g, "'").slice(0, 18);
+        if (e.status === "active") {
+            mermaidLines.push(`  ${srcId} -->|${pred}| ${tgtId}`);
+        }
+        else {
+            mermaidLines.push(`  ${srcId} -.->|RETIRED: ${pred}| ${tgtId}`);
+        }
+    }
+    const headline = `Bi-Temporal Knowledge Graph (${ws.name}): ${activeEdges.length} active relationship${activeEdges.length === 1 ? "" : "s"}, ${historicalEdges.length} superseded historical relationship${historicalEdges.length === 1 ? "" : "s"} across ${nodes.length} node${nodes.length === 1 ? "" : "s"}.`;
+    const activePreview = activeEdges
+        .slice(0, 4)
+        .map((e) => `${e.source} --[${e.predicate}]--> ${e.target}`)
+        .join("; ");
+    const nonTechnical = [
+        headline,
+        activeEdges.length > 0
+            ? `Current facts: ${activeEdges.slice(0, 3).map((e) => e.summary).join(" · ")}.`
+            : "No active facts recorded yet.",
+        historicalEdges.length > 0
+            ? `Time-travel lineage: ${historicalEdges.length} older fact${historicalEdges.length === 1 ? " was" : "s were"} automatically retired when newer workspace settings or facts replaced them.`
+            : "No superseded historical facts yet.",
+    ].join(" ");
+    const technical = `workspace=${ws.id} | namespace=${input.namespace} | nodes=${nodes.length} | activeEdges=${activeEdges.length} | historicalEdges=${historicalEdges.length} | memories=${input.memoriesCount} | activePreview=[${activePreview || "none"}]`;
+    const explanation = formatHumanFriendlyExplanation({
+        headline,
+        nonTechnical,
+        technical,
+        policy: ws.policy,
+    });
+    return {
+        workspaceId: ws.id,
+        workspaceSlug: ws.slug,
+        namespace: input.namespace,
+        generatedAt: new Date().toISOString(),
+        query: query ?? null,
+        nodes,
+        edges,
+        activeEdges,
+        historicalEdges,
+        stats: {
+            nodesCount: nodes.length,
+            activeEdgesCount: activeEdges.length,
+            historicalEdgesCount: historicalEdges.length,
+            memoriesCount: input.memoriesCount,
+            resourcesCount: input.resources.length,
+            connectionsCount: input.activeConnections.length,
+        },
+        mermaid: mermaidLines.join("\n"),
+        explanation,
+    };
+}

package/dist/nl.js

@@ -223,6 +223,93 @@ export function extractParametersFromNaturalLanguage(prompt, tool, explicitInput
             input.limit = extractNumberAfterKeyword(text, ["top", "stories", "items", "limit", "posts"], 5);
         }
     }
+    else if (slug === "app.jira.create_issue") {
+        if (!input.project_key) {
+            const projMatch = text.match(/\bproject\s+([A-Z][A-Z0-9]{1,9})\b|\b([A-Z]{2,8})-\d+\b/);
+            input.project_key = projMatch ? projMatch[1] || projMatch[2] : "ENG";
+        }
+        if (!input.summary) {
+            const sumMatch = text.match(/\b(?:summary|titled|title)\s*[:=]?\s*["']?([^"'\n]+)["']?/i);
+            input.summary = sumMatch ? sumMatch[1].trim() : text.slice(0, 80);
+        }
+        if (!input.issue_type)
+            input.issue_type = "Task";
+    }
+    else if (slug === "app.linear.create_issue") {
+        if (!input.team_id) {
+            const teamMatch = text.match(/\bteam\s+["']?([a-zA-Z0-9_-]+)["']?/i);
+            input.team_id = teamMatch ? teamMatch[1] : "ENG";
+        }
+        if (!input.title) {
+            const titleMatch = text.match(/\b(?:titled|title)\s*[:=]?\s*["']?([^"'\n]+)["']?/i);
+            input.title = titleMatch ? titleMatch[1].trim() : text.slice(0, 80);
+        }
+    }
+    else if (slug === "app.googlecalendar.list_events") {
+        if (!input.calendarId)
+            input.calendarId = "primary";
+        if (input.maxResults === undefined) {
+            input.maxResults = extractNumberAfterKeyword(text, ["events", "meetings", "limit", "next"], 10);
+        }
+    }
+    else if (slug === "app.hubspot.search_contacts") {
+        if (!input.query) {
+            const cleaned = text.replace(/^(?:search\s+hubspot\s+(?:contacts\s+)?(?:for)?|find\s+contact)\s*/i, "").trim();
+            input.query = cleaned || text;
+        }
+        if (input.limit === undefined)
+            input.limit = 10;
+    }
+    else if (slug === "app.discord.send_message") {
+        if (!input.channel_id) {
+            const chMatch = text.match(/#([a-zA-Z0-9_-]+)|\bchannel\s+([a-zA-Z0-9_-]+)/i);
+            input.channel_id = chMatch ? chMatch[1] || chMatch[2] : "general";
+        }
+        if (!input.content) {
+            const msgMatch = text.match(/\b(?:saying|message|text|content)\s*[:=]?\s*["']?([\s\S]+?)["']?$/i);
+            input.content = msgMatch ? msgMatch[1].trim() : text;
+        }
+    }
+    else if (slug === "app.googledrive.search_files") {
+        if (!input.query) {
+            const cleaned = text.replace(/^(?:search\s+(?:google\s+)?drive\s+(?:files\s+)?(?:for)?)\s*/i, "").trim();
+            input.query = cleaned || text;
+        }
+    }
+    else if (slug === "app.airtable.list_records") {
+        if (!input.base_id) {
+            const baseMatch = text.match(/\b(app[a-zA-Z0-9]{10,})\b/);
+            input.base_id = baseMatch ? baseMatch[1] : "appDefaultBase";
+        }
+        if (!input.table_name) {
+            const tblMatch = text.match(/\btable\s+["']?([a-zA-Z0-9_-]+)["']?/i);
+            input.table_name = tblMatch ? tblMatch[1] : "Tasks";
+        }
+    }
+    else if (slug === "app.salesforce.query_records" || slug === "app.salesforce.soql_query") {
+        if (!input.query) {
+            const soqlMatch = text.match(/\b(SELECT\s+[\s\S]+)$/i);
+            input.query = soqlMatch ? soqlMatch[1].trim() : "SELECT Id, Name, Email FROM Contact LIMIT 10";
+        }
+    }
+    else if (slug === "app.pagerduty.create_incident") {
+        if (!input.title)
+            input.title = text.slice(0, 80);
+        if (!input.service_id)
+            input.service_id = "PDEFAULT";
+    }
+    else if (slug === "billing.stripe.refund") {
+        if (!input.paymentIntentId) {
+            const piMatch = text.match(/\b(pi_[a-zA-Z0-9_]+|ch_[a-zA-Z0-9_]+)\b/);
+            if (piMatch)
+                input.paymentIntentId = piMatch[1];
+        }
+        if (input.amountCents === undefined) {
+            const dollarMatch = text.match(/\$(\d+(?:\.\d{1,2})?)/);
+            if (dollarMatch)
+                input.amountCents = Math.round(parseFloat(dollarMatch[1]) * 100);
+        }
+    }
     const schemaReq = Array.isArray(tool.inputSchema?.required)
         ? tool.inputSchema.required
         : [];
@@ -277,6 +364,10 @@ function scoreToolForPrompt(prompt, tool) {
         if (slug === "billing.checkout.create")
             score += 125;
     }
+    if (/\b(refund|chargeback|pi_[a-z0-9_]+)\b/i.test(q)) {
+        if (slug === "billing.stripe.refund" || slug === "app.shopify.create_refund")
+            score += 130;
+    }
     if (!isExplicitWebSearch || hasProvisionVerb) {
         if (/\b(turso|libsql|sqlite\s+database|sqlite\s+db)\b/i.test(q)) {
             if (slug.startsWith("resource.turso."))
@@ -300,6 +391,26 @@ function scoreToolForPrompt(prompt, tool) {
             if (slug.startsWith("resource.mongodb."))
                 score += 120;
         }
+        if (/\b(cloudflare\s+worker|d1\s+database|r2\s+storage)\b/i.test(q)) {
+            if (slug.startsWith("resource.cloudflare."))
+                score += 120;
+        }
+        if (/\b(vercel\s+project|deploy\s+vercel)\b/i.test(q)) {
+            if (slug.startsWith("resource.vercel."))
+                score += 120;
+        }
+        if (/\b(resend\s+email|transactional\s+email\s+api)\b/i.test(q)) {
+            if (slug.startsWith("resource.resend."))
+                score += 120;
+        }
+        if (/\b(clerk\s+auth)\b/i.test(q)) {
+            if (slug.startsWith("resource.clerk."))
+                score += 120;
+        }
+        if (/\b(workos|enterprise\s+sso|scim)\b/i.test(q)) {
+            if (slug.startsWith("resource.workos."))
+                score += 120;
+        }
     }
     if (/\b(hacker\s*news|hn\s+stories|top\s+stories)\b/i.test(q)) {
         if (slug === "instant.hackernews.top_stories")
@@ -329,6 +440,10 @@ function scoreToolForPrompt(prompt, tool) {
         if (slug === "app.github.list_pull_requests" || slug === "app.github.list_issues")
             score += 110;
     }
+    if (/\b(list\s+github\s+repos|github\s+repositories|my\s+repos)\b/i.test(q)) {
+        if (slug === "app.github.list_repos")
+            score += 120;
+    }
     if (/\b(notion\s+page|search\s+notion)\b/i.test(q)) {
         if (slug === "app.notion.search_pages")
             score += 115;
@@ -337,6 +452,46 @@ function scoreToolForPrompt(prompt, tool) {
         if (slug === "app.linear.create_issue")
             score += 115;
     }
+    if (/\b(jira\s+issue|create\s+jira|atlassian|jql)\b/i.test(q)) {
+        if (slug.startsWith("app.jira."))
+            score += 120;
+    }
+    if (/\b(hubspot|crm\s+contacts?|search\s+contacts?)\b/i.test(q)) {
+        if (slug.startsWith("app.hubspot."))
+            score += 120;
+    }
+    if (/\b(discord\s+message|send\s+discord|post\s+to\s+discord)\b/i.test(q)) {
+        if (slug.startsWith("app.discord."))
+            score += 120;
+    }
+    if (/\b(google\s+drive|gdrive|drive\s+files?)\b/i.test(q)) {
+        if (slug.startsWith("app.googledrive."))
+            score += 120;
+    }
+    if (/\b(airtable|base\s+records?)\b/i.test(q)) {
+        if (slug.startsWith("app.airtable."))
+            score += 120;
+    }
+    if (/\b(salesforce|soql|crm\s+records?)\b/i.test(q)) {
+        if (slug.startsWith("app.salesforce."))
+            score += 120;
+    }
+    if (/\b(zendesk|support\s+tickets?)\b/i.test(q)) {
+        if (slug.startsWith("app.zendesk."))
+            score += 120;
+    }
+    if (/\b(shopify|store\s+orders?)\b/i.test(q)) {
+        if (slug.startsWith("app.shopify."))
+            score += 120;
+    }
+    if (/\b(pagerduty|on-call|trigger\s+incident)\b/i.test(q)) {
+        if (slug.startsWith("app.pagerduty."))
+            score += 120;
+    }
+    if (/\b(sentry|error\s+issues?|stack\s+traces?)\b/i.test(q)) {
+        if (slug.startsWith("app.sentry."))
+            score += 120;
+    }
     if (/\b(google\s+calendar|schedule\s+meeting|list\s+events|calendar\s+events)\b/i.test(q)) {
         if (slug.includes("calendar") || slug.includes("gcal"))
             score += 110;

package/dist/oauth.d.ts

@@ -0,0 +1,32 @@
+/** Shared OAuth 2.1 (PKCE + consent) helpers for the Node server and the edge worker. */
+export declare const DEFAULT_OAUTH_SCOPE = "mcp:tools muxo:mcp muxo:read muxo:execute muxo:provision";
+export declare const PKCE_VERIFIER_PATTERN: RegExp;
+export declare const OAUTH_CODE_TTL_MS: number;
+/** API keys minted through OAuth do not expire; this is the advisory lifetime clients see. */
+export declare const OAUTH_ACCESS_TOKEN_TTL_SECONDS = 2592000;
+export declare const LOOPBACK_CLIENT_NAME = "An app on this computer";
+export interface AuthorizeRequest {
+    clientId: string;
+    clientName: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string | null;
+    codeChallengeMethod: "S256" | "plain" | null;
+    scope: string;
+}
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function pkceS256(verifier: string): Promise<string>;
+export declare function timingSafeEqualText(a: string, b: string): boolean;
+/** Checks a token-endpoint code_verifier against the challenge stored with the authorization code. */
+export declare function verifyPkce(verifier: string, challenge: string, method: "S256" | "plain" | null): Promise<"ok" | "missing" | "mismatch">;
+export declare function oauthClientName(redirect: URL, clientId: string): string;
+/** Name of the workspace API key minted for an OAuth connection, as listed in the console. */
+export declare function oauthConnectionKeyName(clientName: string): string;
+/** Origin shown on the consent screen; app-scheme redirects have no origin, so show the scheme. */
+export declare function oauthRedirectOrigin(redirectUri: string): string;
+export declare function parseAuthorizeRequest(params: URLSearchParams): AuthorizeRequest | {
+    error: string;
+};
+/** Parses a token-endpoint body (form or JSON) and HTTP Basic client credentials into one parameter set. */
+export declare function parseOAuthFormBody(rawBody: string, contentType: string, authorizationHeader: string): URLSearchParams;
+export declare function oauthSecretToken(prefix: string): string;

package/dist/oauth.js

@@ -0,0 +1,134 @@
+import { MCP_TOOLS_OAUTH_SCOPE } from "./mcp-schema.js";
+/** Shared OAuth 2.1 (PKCE + consent) helpers for the Node server and the edge worker. */
+export const DEFAULT_OAUTH_SCOPE = `${MCP_TOOLS_OAUTH_SCOPE} muxo:mcp muxo:read muxo:execute muxo:provision`;
+export const PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+export const OAUTH_CODE_TTL_MS = 10 * 60 * 1000;
+/** API keys minted through OAuth do not expire; this is the advisory lifetime clients see. */
+export const OAUTH_ACCESS_TOKEN_TTL_SECONDS = 2_592_000;
+export const LOOPBACK_CLIENT_NAME = "An app on this computer";
+const BLOCKED_REDIRECT_SCHEMES = new Set(["javascript:", "data:", "file:", "vbscript:", "about:", "blob:", "ftp:"]);
+export function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export async function pkceS256(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return base64UrlEncode(new Uint8Array(digest));
+}
+export function timingSafeEqualText(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/** Checks a token-endpoint code_verifier against the challenge stored with the authorization code. */
+export async function verifyPkce(verifier, challenge, method) {
+    if (!PKCE_VERIFIER_PATTERN.test(verifier))
+        return "missing";
+    const computed = method === "S256" ? await pkceS256(verifier) : verifier;
+    return timingSafeEqualText(computed, challenge) ? "ok" : "mismatch";
+}
+export function oauthClientName(redirect, clientId) {
+    const host = redirect.hostname.toLowerCase();
+    if (host === "chatgpt.com" || host.endsWith(".chatgpt.com") || host.endsWith(".openai.com"))
+        return "ChatGPT";
+    if (host === "claude.ai" || host.endsWith(".claude.ai") || host.endsWith(".anthropic.com"))
+        return "Claude";
+    if (host === "127.0.0.1" || host === "localhost" || host === "[::1]")
+        return LOOPBACK_CLIENT_NAME;
+    if (redirect.protocol !== "https:" && redirect.protocol !== "http:")
+        return redirect.protocol.replace(/:$/, "");
+    return clientId.length <= 64 && /^[\w.-]+$/.test(clientId) && !clientId.startsWith("muxo_dcr_") ? clientId : host;
+}
+/** Name of the workspace API key minted for an OAuth connection, as listed in the console. */
+export function oauthConnectionKeyName(clientName) {
+    return `${clientName === LOOPBACK_CLIENT_NAME ? "Local app" : clientName} connection`;
+}
+/** Origin shown on the consent screen; app-scheme redirects have no origin, so show the scheme. */
+export function oauthRedirectOrigin(redirectUri) {
+    const target = new URL(redirectUri);
+    return target.origin === "null" ? target.protocol : target.origin;
+}
+export function parseAuthorizeRequest(params) {
+    const responseType = params.get("response_type");
+    if (responseType && responseType !== "code")
+        return { error: "Only response_type=code is supported." };
+    const redirectUri = (params.get("redirect_uri") || "").trim();
+    if (!redirectUri || redirectUri.length > 2048)
+        return { error: "A valid redirect_uri is required." };
+    let redirect;
+    try {
+        redirect = new URL(redirectUri);
+    }
+    catch {
+        return { error: "redirect_uri is not a valid URL." };
+    }
+    const loopback = ["127.0.0.1", "localhost", "[::1]"].includes(redirect.hostname);
+    if (redirect.hash ||
+        BLOCKED_REDIRECT_SCHEMES.has(redirect.protocol) ||
+        (redirect.protocol === "http:" && !loopback)) {
+        return { error: "redirect_uri must use https, a loopback http address, or an app scheme." };
+    }
+    const clientId = (params.get("client_id") || "muxo-mcp-client").trim().slice(0, 256);
+    const codeChallenge = (params.get("code_challenge") || "").trim() || null;
+    const rawMethod = (params.get("code_challenge_method") || "").trim();
+    if (codeChallenge && !PKCE_VERIFIER_PATTERN.test(codeChallenge)) {
+        return { error: "code_challenge is malformed." };
+    }
+    if (rawMethod && rawMethod !== "S256" && rawMethod !== "plain") {
+        return { error: "code_challenge_method must be S256 or plain." };
+    }
+    return {
+        clientId,
+        clientName: oauthClientName(redirect, clientId),
+        redirectUri,
+        state: (params.get("state") || "").slice(0, 1024),
+        codeChallenge,
+        codeChallengeMethod: codeChallenge ? (rawMethod === "S256" ? "S256" : "plain") : null,
+        scope: (params.get("scope") || DEFAULT_OAUTH_SCOPE).slice(0, 512),
+    };
+}
+/** Parses a token-endpoint body (form or JSON) and HTTP Basic client credentials into one parameter set. */
+export function parseOAuthFormBody(rawBody, contentType, authorizationHeader) {
+    const params = new URLSearchParams();
+    if (contentType.includes("application/json")) {
+        let body = {};
+        try {
+            const parsed = JSON.parse(rawBody || "{}");
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                body = parsed;
+        }
+        catch {
+            body = {};
+        }
+        for (const [k, v] of Object.entries(body))
+            if (typeof v === "string")
+                params.set(k, v);
+    }
+    else {
+        for (const [k, v] of new URLSearchParams(rawBody))
+            params.set(k, v);
+    }
+    const basic = authorizationHeader.match(/^basic\s+(.+)$/i);
+    if (basic && !params.get("client_id")) {
+        try {
+            const decoded = atob(basic[1].trim());
+            params.set("client_id", decodeURIComponent(decoded.split(":")[0] || ""));
+        }
+        catch {
+            // Public clients do not need client credentials, so a malformed header is ignored.
+        }
+    }
+    return params;
+}
+export function oauthSecretToken(prefix) {
+    const bytes = new Uint8Array(24);
+    crypto.getRandomValues(bytes);
+    return `${prefix}_${Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("")}`;
+}