@n24q02m/mcp-core 1.18.0-beta.2 → 1.18.0-beta.21

package/build/auth/relay-login.js

@@ -113,31 +113,26 @@ function getSafeNext(input) {
     }
     return next;
 }
-export async function loginGetHandler(req, res) {
-    const next = getSafeNext(req.query?.next);
-    res.set?.('Content-Type', 'text/html');
-    // ``next`` flows from the query string but every interpolation is run
-    // through ``escapeHtml`` (defined above) which replaces &, <, >, ", and
-    // ' with their HTML entity equivalents — the same character set the
-    // raw-html-format rule expects sanitisers to handle. Semgrep can't see
-    // the custom helper so we suppress the warning here.
+function renderLoginForm(next, errorMsg) {
     const safeNext = escapeHtml(String(next));
-    // Visual parity with the relay credential form: same dark-theme card,
-    // typography, ``.field-group`` / ``.field-label`` / ``.field-input``
-    // classes, and primary submit button styling. Pure POST (no JavaScript)
-    // so the gate works under strict CSP that blocks inline scripts.
-    const bodyHtml = `    <div class="container">
+    const errorHtml = errorMsg
+        ? `\n            <div id="login-error" class="status-box error" role="alert" style="display: block; margin-bottom: 1.25rem; margin-top: 0;">\n                ${escapeHtml(errorMsg)}\n            </div>`
+        : '';
+    const ariaAttributes = errorMsg
+        ? ' aria-invalid="true" aria-errormessage="login-error" aria-describedby="login-error relay-desc"'
+        : ' aria-describedby="relay-desc"';
+    return `    <div class="container">
         <div class="card">
             <div class="server-header">
                 <h1 class="server-name">Relay login</h1>
                 <div class="server-id">mcp-relay</div>
-                <p class="server-description">Enter the relay password shared by your deployer.</p>
-            </div>
+                <p class="server-description" id="relay-desc">Enter the relay password shared by your deployer.</p>
+            </div>${errorHtml}
 
-            <p class="form-title">Authenticate</p>
+            <p class="form-title" id="form-title">Authenticate</p>
 
-            <form method="POST" action="/login" novalidate>
-                <!-- nosemgrep: javascript.express.security.injection.raw-html-format.raw-html-format -- safeNext is escapeHtml(next) at line 156 -->
+            <form method="POST" action="/login" aria-labelledby="form-title">
+                <!-- nosemgrep: javascript.express.security.injection.raw-html-format.raw-html-format -- safeNext is escapeHtml(next) -->
                 <input type="hidden" name="next" value="${safeNext}">
                 <div class="field-group">
                     <label for="field-password" class="field-label">
@@ -155,15 +150,20 @@ export async function loginGetHandler(req, res) {
                         autocapitalize="off"
                         spellcheck="false"
                         required
-                        autofocus
+                        autofocus${ariaAttributes}
                     />
                 </div>
 
                 <button type="submit" class="submit-btn">Continue</button>
             </form>
         </div>
-    </div>`; // nosemgrep: javascript.express.security.injection.raw-html-format.raw-html-format
-    res.send(renderFormShell('Relay login', bodyHtml));
+    </div>`;
+}
+export async function loginGetHandler(req, res) {
+    const next = getSafeNext(req.query?.next);
+    res.set?.('Content-Type', 'text/html');
+    res.set?.('X-Frame-Options', 'DENY');
+    res.send(renderFormShell('Relay login', renderLoginForm(next)));
 }
 export async function loginPostHandler(req, res) {
     const ip = req.ip ?? 'unknown';
@@ -178,7 +178,9 @@ export async function loginPostHandler(req, res) {
     const next = getSafeNext(req.body?.next);
     if (!configuredPassword || !timingSafeEqual(password, configuredPassword)) {
         bumpFail(ip);
-        res.status(401).send('Invalid password.');
+        res.set?.('Content-Type', 'text/html');
+        res.set?.('X-Frame-Options', 'DENY');
+        res.status(401).send(renderFormShell('Relay login', renderLoginForm(next, 'Invalid password. Please try again.')));
         return;
     }
     clearFail(ip);

package/build/auth/relay-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-login.js","sourceRoot":"","sources":["../../src/auth/relay-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAUtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAA;AAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;AAC1C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC1C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACrC,MAAM,UAAU,GAAG,CAAC,CAAA;AAEpB,IAAI,kBAAkB,GAAG,EAAE,CAAA;AAE3B,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,kBAAkB,GAAG,QAAQ,IAAI,EAAE,CAAA;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAA;IAChB,KAAK,CAAC,KAAK,EAAE,CAAA;IACb,kBAAkB,GAAG,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAA;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACxC,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,aAAa,CAAA;AAC9D,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;IAC1C,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;IAChB,IAAI,KAAK,CAAC,KAAK,GAAG,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;SACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAClB,CAAC;AAgCD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA0B;IACnE,OAAO,KAAK,EAAE,GAAsB,EAAE,GAAyC,EAAE,IAAgB,EAAiB,EAAE;QAClH,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAA;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACjD,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;QACjE,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,EAAE,CAAC,CAAA;IACtC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAA2B;YACvC,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,OAAO;SACb,CAAA;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxG,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,oEAAoE;IACpE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAqC,EACrC,GAA6C;IAE7C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACzC,GAAG,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;IACtC,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACzC,sEAAsE;IACtE,qEAAqE;IACrE,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,QAAQ,GAAG;;;;;;;;;;;;0DAYuC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;WAwBvD,CAAA,CAAC,mFAAmF;IAC7F,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAA2C,EAC3C,GAAuB;IAEvB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAA;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/B,IAAI,SAAS,IAAI,GAAG,GAAG,SAAS,CAAC,OAAO,GAAG,cAAc,IAAI,SAAS,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;QACjE,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACxC,IAAI,CAAC,kBAAkB,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACzC,OAAM;IACR,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAA;IACb,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAClD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,cAAc;KACvB,CAAC,CAAA;IACF,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACpB,CAAC"}
+{"version":3,"file":"relay-login.js","sourceRoot":"","sources":["../../src/auth/relay-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAUtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAA;AAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;AAC1C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC1C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACrC,MAAM,UAAU,GAAG,CAAC,CAAA;AAEpB,IAAI,kBAAkB,GAAG,EAAE,CAAA;AAE3B,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,kBAAkB,GAAG,QAAQ,IAAI,EAAE,CAAA;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAA;IAChB,KAAK,CAAC,KAAK,EAAE,CAAA;IACb,kBAAkB,GAAG,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAA;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACxC,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,aAAa,CAAA;AAC9D,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;IAC1C,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;IAChB,IAAI,KAAK,CAAC,KAAK,GAAG,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;SACvE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAClB,CAAC;AAgCD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA0B;IACnE,OAAO,KAAK,EAAE,GAAsB,EAAE,GAAyC,EAAE,IAAgB,EAAiB,EAAE;QAClH,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAA;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACjD,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAA;YACN,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;QACjE,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,EAAE,CAAC,CAAA;IACtC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAA2B;YACvC,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,OAAO;SACb,CAAA;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC,CAAA;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxG,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,oEAAoE;IACpE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAAiB;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,QAAQ;QACxB,CAAC,CAAC,8JAA8J,UAAU,CAAC,QAAQ,CAAC,sBAAsB;QAC1M,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,cAAc,GAAG,QAAQ;QAC7B,CAAC,CAAC,gGAAgG;QAClG,CAAC,CAAC,gCAAgC,CAAA;IAEpC,OAAO;;;;;;oBAMW,SAAS;;;;;;0DAM6B,QAAQ;;;;;;;;;;;;;;;;;mCAiB/B,cAAc;;;;;;;WAOtC,CAAA;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAqC,EACrC,GAA6C;IAE7C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACzC,GAAG,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;IACtC,GAAG,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACpC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAA2C,EAC3C,GAAuB;IAEvB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAA;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/B,IAAI,SAAS,IAAI,GAAG,GAAG,SAAS,CAAC,OAAO,GAAG,cAAc,IAAI,SAAS,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;QACjE,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACxC,IAAI,CAAC,kBAAkB,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,GAAG,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;QACtC,GAAG,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAA;QAClH,OAAM;IACR,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAA;IACb,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAClD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,cAAc;KACvB,CAAC,CAAA;IACF,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACpB,CAAC"}

package/build/auth/well-known.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYtF;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMnH"}
+{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAatF;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMnH"}

package/build/auth/well-known.js

@@ -5,6 +5,7 @@ export function authorizationServerMetadata(issuerUrl) {
         authorization_endpoint: `${issuerUrl}/authorize`,
         token_endpoint: `${issuerUrl}/token`,
         registration_endpoint: `${issuerUrl}/register`,
+        jwks_uri: `${issuerUrl}/.well-known/jwks.json`,
         response_types_supported: ['code'],
         grant_types_supported: ['authorization_code', 'refresh_token'],
         code_challenge_methods_supported: ['S256'],

package/build/auth/well-known.js.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,sBAAsB,EAAE,GAAG,SAAS,YAAY;QAChD,cAAc,EAAE,GAAG,SAAS,QAAQ;QACpC,qBAAqB,EAAE,GAAG,SAAS,WAAW;QAC9C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;KACrC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,oBAA8B;IACxF,OAAO;QACL,QAAQ;QACR,qBAAqB,EAAE,oBAAoB;QAC3C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAA;AACH,CAAC"}
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/auth/well-known.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,sBAAsB,EAAE,GAAG,SAAS,YAAY;QAChD,cAAc,EAAE,GAAG,SAAS,QAAQ;QACpC,qBAAqB,EAAE,GAAG,SAAS,WAAW;QAC9C,QAAQ,EAAE,GAAG,SAAS,wBAAwB;QAC9C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;KACrC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,oBAA8B;IACxF,OAAO;QACL,QAAQ;QACR,qBAAqB,EAAE,oBAAoB;QAC3C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAA;AACH,CAAC"}

package/build/crypto/index.d.ts

@@ -1,4 +1,4 @@
 export { decrypt, type EncryptResult, encrypt } from './aes.js';
 export { deriveSharedSecret, exportPublicKey, generateKeyPair, importPublicKey } from './ecdh.js';
-export { deriveAesKey } from './kdf.js';
+export { deriveAesKey, deriveJwtSigningSeed } from './kdf.js';
 //# sourceMappingURL=index.d.ts.map

package/build/crypto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,aAAa,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,aAAa,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA"}

package/build/crypto/index.js

@@ -1,4 +1,4 @@
 export { decrypt, encrypt } from './aes.js';
 export { deriveSharedSecret, exportPublicKey, generateKeyPair, importPublicKey } from './ecdh.js';
-export { deriveAesKey } from './kdf.js';
+export { deriveAesKey, deriveJwtSigningSeed } from './kdf.js';
 //# sourceMappingURL=index.js.map

package/build/crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAsB,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAsB,OAAO,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA"}

package/build/crypto/kdf.d.ts

@@ -1,2 +1,15 @@
 export declare function deriveAesKey(sharedSecret: ArrayBuffer, passphrase: string): Promise<CryptoKey>;
+/**
+ * Derive a deterministic 32-byte Ed25519 seed for OAuth JWT signing.
+ *
+ * Used in HTTP multi-user mode (CREDENTIAL_SECRET set) so every container
+ * replica converges on the SAME signing key without a shared volume or
+ * external secret store. Domain-separated per server via the HKDF info label.
+ *
+ * HKDF-SHA256 with IKM = secret, empty salt, info =
+ * `mcp-jwt-signing-key-v1:<serverName>`. Byte-identical to core-py's
+ * `derive_jwt_signing_seed` for the same inputs (enforced by the shared
+ * crypto-vectors fixture).
+ */
+export declare function deriveJwtSigningSeed(secret: string, serverName: string): Buffer;
 //# sourceMappingURL=kdf.d.ts.map

package/build/crypto/kdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAIA,wBAAsB,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAWpG"}
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAOA,wBAAsB,YAAY,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAWpG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG/E"}

package/build/crypto/kdf.js

@@ -1,8 +1,26 @@
+import { hkdfSync } from 'node:crypto';
 const encoder = new TextEncoder();
 const INFO = encoder.encode('mcp-relay');
+const JWT_SIGNING_INFO_PREFIX = 'mcp-jwt-signing-key-v1:';
 export async function deriveAesKey(sharedSecret, passphrase) {
     const salt = encoder.encode(passphrase);
     const keyMaterial = await crypto.subtle.importKey('raw', sharedSecret, 'HKDF', false, ['deriveKey']);
     return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt, info: INFO }, keyMaterial, { name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
 }
+/**
+ * Derive a deterministic 32-byte Ed25519 seed for OAuth JWT signing.
+ *
+ * Used in HTTP multi-user mode (CREDENTIAL_SECRET set) so every container
+ * replica converges on the SAME signing key without a shared volume or
+ * external secret store. Domain-separated per server via the HKDF info label.
+ *
+ * HKDF-SHA256 with IKM = secret, empty salt, info =
+ * `mcp-jwt-signing-key-v1:<serverName>`. Byte-identical to core-py's
+ * `derive_jwt_signing_seed` for the same inputs (enforced by the shared
+ * crypto-vectors fixture).
+ */
+export function deriveJwtSigningSeed(secret, serverName) {
+    const info = encoder.encode(`${JWT_SIGNING_INFO_PREFIX}${serverName}`);
+    return Buffer.from(hkdfSync('sha256', Buffer.from(secret, 'utf-8'), Buffer.alloc(0), info, 32));
+}
 //# sourceMappingURL=kdf.js.map

package/build/crypto/kdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAExC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAyB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EACnD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/crypto/kdf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AACxC,MAAM,uBAAuB,GAAG,yBAAyB,CAAA;AAEzD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAyB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;IAEpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EACnD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,UAAkB;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,uBAAuB,GAAG,UAAU,EAAE,CAAC,CAAA;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;AACjG,CAAC"}

package/build/oauth/jwt-issuer.d.ts

@@ -1,6 +1,24 @@
 /**
- * RSA JWT Issuer and JWKS generation for TypeScript MCP servers.
+ * JWT Issuer and JWKS generation for TypeScript MCP servers.
  * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
+ *
+ * Two signing modes, selected at construction:
+ *
+ * - LOCAL single-user (credentialSecret unset): RSA-2048, RS256, kid="key-1",
+ *   keys generated on first run and persisted to disk so they survive restarts
+ *   on a real machine. Behavior is unchanged from the pre-stability-fix code.
+ *
+ * - HTTP multi-user (credentialSecret set): Ed25519, EdDSA, signing key DERIVED
+ *   deterministically from CREDENTIAL_SECRET via HKDF-SHA256. No disk I/O. Every
+ *   container replica converges on the same key without a shared volume or
+ *   external secret store, so OAuth tokens survive container recreation
+ *   (Watchtower :latest redeploys). kid is the base64url SHA-256 thumbprint of
+ *   the raw public key.
+ *
+ * The two modes are different deployments that never exchange tokens
+ * (iss/aud are server-scoped); the per-mode algorithm split is permanent and
+ * intentional. Each process runs exactly one algorithm; the verify path uses
+ * that single alg, never a {RS256, EdDSA} union.
  */
 import * as jose from 'jose';
 export declare class JWTIssuer {
@@ -8,46 +26,61 @@ export declare class JWTIssuer {
     private keysDir;
     private privateKeyPath;
     private publicKeyPath;
+    private credentialSecret;
+    alg: 'RS256' | 'EdDSA';
     private kid;
     private privateKey;
     private publicKey;
+    private okpX;
     private _initialized;
-    constructor(serverName: string, keysDir?: string);
-    /** Must call before using issuer — loads or generates RSA keys. */
+    constructor(serverName: string, keysDir?: string, credentialSecret?: string | null);
+    /** Must call before using issuer — loads/generates (RSA) or derives (EdDSA) keys. */
     init(): Promise<void>;
-    /** Return JWKS payload for /.well-known/jwks.json */
+    private deriveEddsaKeys;
+    private loadOrGenerateRsaKeys;
+    /**
+     * Return JWKS payload for /.well-known/jwks.json. Always a `keys` array
+     * (multi-key-aware for future rotation). RSA mode emits an RSA JWK; EdDSA
+     * mode emits an OKP JWK.
+     */
     getJwks(): Promise<jose.JSONWebKeySet>;
-    /** Issue an RS256 JWT access token (``typ="access"``). */
+    /** Issue a JWT access token (typ="access") signed with the active alg. */
     issueAccessToken(sub: string, expiresInSeconds?: number): Promise<string>;
     /**
-     * Issue an RS256 JWT refresh token (``typ="refresh"``).
+     * Issue a JWT refresh token (typ="refresh") signed with the active alg.
      *
-     * Defaults to a 30-day (2592000s) lifetime so long-running MCP clients can
-     * mint fresh access tokens without forcing the user back through the
-     * browser PKCE flow every hour. Same key / iss / aud as access tokens; the
-     * ``typ`` claim is the only thing distinguishing them, and
-     * ``verifyAccessToken`` rejects ``typ="refresh"`` so a refresh token can
-     * never be used as an access token at the ``/mcp`` resource.
+     * Defaults to a 1-year (31536000s) lifetime so long-running MCP clients can
+     * mint fresh access tokens without forcing the user back through the browser
+     * PKCE flow. The access token stays short-lived (1h); the refresh token is the
+     * renewal credential and is rotated on every use (the /token refresh handler
+     * issues a new refresh token each time), so the security control is rotation,
+     * not a short TTL. A short refresh TTL was the residual re-auth driver: a
+     * self-hosted server a user touches only intermittently (less than once a
+     * month) would silently expire its refresh token between sessions, forcing a
+     * fresh browser OAuth tab on the next use. With a 1-year floor, only a
+     * genuinely long idle gap re-prompts. Same key / iss / aud as access tokens;
+     * the typ claim is the only thing distinguishing them, and verifyAccessToken
+     * rejects typ="refresh" so a refresh token can never be used as an access
+     * token at the /mcp resource.
      */
     issueRefreshToken(sub: string, expiresInSeconds?: number): Promise<string>;
     /**
-     * Verify a JWT access token and return its payload. Throws on failure
-     * (bad signature, wrong issuer/audience, expired) — the same jose errors
-     * existing callers already catch. Additionally rejects tokens whose
-     * ``typ`` claim is ``"refresh"`` (throwing ``jose.errors.JWTClaimValidationFailed``)
-     * so a refresh token cannot be replayed as an access token. Tokens with
-     * ``typ="access"`` OR a missing ``typ`` claim are accepted (the latter
-     * keeps already-issued pre-refresh-support tokens valid).
+     * Verify a JWT access token and return its payload. Throws on failure (bad
+     * signature, wrong issuer/audience, expired) — the same jose errors existing
+     * callers already catch. The verify path uses the single active algorithm,
+     * never a union. Additionally rejects tokens whose typ claim is "refresh"
+     * (throwing jose.errors.JWTClaimValidationFailed) so a refresh token cannot
+     * be replayed as an access token. Tokens with typ="access" OR a missing typ
+     * claim are accepted (the latter keeps already-issued pre-refresh-support
+     * tokens valid).
      */
     verifyAccessToken(token: string): Promise<jose.JWTPayload>;
     /**
      * Verify a JWT refresh token and return its payload. Same key / audience /
-     * issuer checks as ``verifyAccessToken`` and throws the same jose errors on
-     * failure. Additionally asserts ``typ=="refresh"`` (throwing
-     * ``jose.errors.JWTClaimValidationFailed`` otherwise) so an access token
-     * can never be exchanged at the refresh grant. ``JWTClaimValidationFailed``
-     * extends ``jose.errors.JOSEError``, so callers' existing ``catch`` clauses
-     * around ``verifyAccessToken`` already catch it.
+     * issuer checks as verifyAccessToken and throws the same jose errors on
+     * failure; uses the single active algorithm. Additionally asserts
+     * typ=="refresh" (throwing jose.errors.JWTClaimValidationFailed otherwise) so
+     * an access token can never be exchanged at the refresh grant.
      */
     verifyRefreshToken(token: string): Promise<jose.JWTPayload>;
 }

package/build/oauth/jwt-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAI5B,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,YAAY,CAAQ;gBAEhB,UAAU,EAAE,MAAM,EAAE,OAAO,SAAmB;IAO1D,mEAAmE;IAC7D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B3B,qDAAqD;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;IAS5C,0DAA0D;IACpD,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAW7E;;;;;;;;;OASG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAWjF;;;;;;;;OAQG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;IAYhE;;;;;;;;OAQG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;CAWlE"}
+{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAU5B,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,gBAAgB,CAAe;IACvC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;IACtB,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,YAAY,CAAQ;gBAEhB,UAAU,EAAE,MAAM,EAAE,OAAO,SAAmB,EAAE,gBAAgB,GAAE,MAAM,GAAG,IAAW;IASlG,qFAAqF;IAC/E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAgBb,eAAe;YAYf,qBAAqB;IA0BnC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;IAc5C,0EAA0E;IACpE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAW7E;;;;;;;;;;;;;;;;OAgBG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAWlF;;;;;;;;;OASG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;IAahE;;;;;;OAMG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;CAYlE"}

package/build/oauth/jwt-issuer.js

@@ -1,27 +1,80 @@
 /**
- * RSA JWT Issuer and JWKS generation for TypeScript MCP servers.
+ * JWT Issuer and JWKS generation for TypeScript MCP servers.
  * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
+ *
+ * Two signing modes, selected at construction:
+ *
+ * - LOCAL single-user (credentialSecret unset): RSA-2048, RS256, kid="key-1",
+ *   keys generated on first run and persisted to disk so they survive restarts
+ *   on a real machine. Behavior is unchanged from the pre-stability-fix code.
+ *
+ * - HTTP multi-user (credentialSecret set): Ed25519, EdDSA, signing key DERIVED
+ *   deterministically from CREDENTIAL_SECRET via HKDF-SHA256. No disk I/O. Every
+ *   container replica converges on the same key without a shared volume or
+ *   external secret store, so OAuth tokens survive container recreation
+ *   (Watchtower :latest redeploys). kid is the base64url SHA-256 thumbprint of
+ *   the raw public key.
+ *
+ * The two modes are different deployments that never exchange tokens
+ * (iss/aud are server-scoped); the per-mode algorithm split is permanent and
+ * intentional. Each process runs exactly one algorithm; the verify path uses
+ * that single alg, never a {RS256, EdDSA} union.
  */
+import { createHash, createPrivateKey } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import * as jose from 'jose';
+import { deriveJwtSigningSeed } from '../crypto/kdf.js';
 const DEFAULT_KEYS_DIR = join(homedir(), '.mcp-core', 'jwt-keys');
+// RFC 8410 PKCS8 DER prefix for an Ed25519 private key. Prepended to the
+// 32-byte HKDF seed to build an importable PKCS8 key (jose 6.2.3 cannot import
+// a raw seed via importJWK d-only).
+const ED25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
 export class JWTIssuer {
-    constructor(serverName, keysDir = DEFAULT_KEYS_DIR) {
+    constructor(serverName, keysDir = DEFAULT_KEYS_DIR, credentialSecret = null) {
         this.kid = 'key-1';
         this.privateKey = null;
         this.publicKey = null;
+        this.okpX = null;
         this._initialized = false;
         this.serverName = serverName;
         this.keysDir = keysDir;
+        this.credentialSecret = credentialSecret;
+        this.alg = credentialSecret ? 'EdDSA' : 'RS256';
         this.privateKeyPath = join(this.keysDir, `${serverName}_private.pem`);
         this.publicKeyPath = join(this.keysDir, `${serverName}_public.pem`);
     }
-    /** Must call before using issuer — loads or generates RSA keys. */
+    /** Must call before using issuer — loads/generates (RSA) or derives (EdDSA) keys. */
     async init() {
         if (this._initialized)
             return;
+        if (this.credentialSecret) {
+            await this.deriveEddsaKeys(this.credentialSecret);
+            // Don't name the source env var in the message: only serverName + the
+            // public kid thumbprint are logged (never the secret), and the literal
+            // "CREDENTIAL_SECRET" token trips the SAST logger-credential heuristic
+            // for no real benefit (parity with core-py jwt_issuer.py).
+            console.error(`JWTIssuer[${this.serverName}]: HTTP multi-user mode, EdDSA signing key derived (kid=${this.kid})`);
+        }
+        else {
+            await this.loadOrGenerateRsaKeys();
+            console.error(`JWTIssuer[${this.serverName}]: local single-user mode, RS256 key on disk (${this.keysDir})`);
+        }
+        this._initialized = true;
+    }
+    async deriveEddsaKeys(credentialSecret) {
+        const seed = deriveJwtSigningSeed(credentialSecret, this.serverName);
+        const der = Buffer.concat([ED25519_PKCS8_PREFIX, seed]);
+        const pem = `-----BEGIN PRIVATE KEY-----\n${der.toString('base64')}\n-----END PRIVATE KEY-----\n`;
+        this.privateKey = await jose.importPKCS8(pem, 'EdDSA', { extractable: false });
+        // Recover the public JWK x via node:crypto (jose has no seed->public path).
+        const jwk = createPrivateKey(pem).export({ format: 'jwk' });
+        this.okpX = jwk.x;
+        this.publicKey = (await jose.importJWK({ kty: 'OKP', crv: 'Ed25519', x: jwk.x }, 'EdDSA'));
+        this.kid = createHash('sha256').update(Buffer.from(jwk.x, 'base64url')).digest('base64url').slice(0, 16);
+    }
+    async loadOrGenerateRsaKeys() {
         mkdirSync(this.keysDir, { recursive: true, mode: 0o700 });
         if (existsSync(this.privateKeyPath) && existsSync(this.publicKeyPath)) {
             const privatePem = readFileSync(this.privateKeyPath, 'utf-8');
@@ -42,24 +95,32 @@ export class JWTIssuer {
             this.privateKey = await jose.importPKCS8(privatePem, 'RS256', { extractable: false });
             this.publicKey = await jose.importSPKI(publicPem, 'RS256', { extractable: true });
         }
-        this._initialized = true;
     }
-    /** Return JWKS payload for /.well-known/jwks.json */
+    /**
+     * Return JWKS payload for /.well-known/jwks.json. Always a `keys` array
+     * (multi-key-aware for future rotation). RSA mode emits an RSA JWK; EdDSA
+     * mode emits an OKP JWK.
+     */
     async getJwks() {
         if (!this.publicKey)
             throw new Error('JWTIssuer not initialized');
+        if (this.alg === 'EdDSA') {
+            return {
+                keys: [{ kty: 'OKP', crv: 'Ed25519', x: this.okpX, use: 'sig', alg: 'EdDSA', kid: this.kid }]
+            };
+        }
         const jwk = await jose.exportJWK(this.publicKey);
         jwk.kid = this.kid;
         jwk.use = 'sig';
         jwk.alg = 'RS256';
         return { keys: [jwk] };
     }
-    /** Issue an RS256 JWT access token (``typ="access"``). */
+    /** Issue a JWT access token (typ="access") signed with the active alg. */
     async issueAccessToken(sub, expiresInSeconds = 3600) {
         if (!this.privateKey)
             throw new Error('JWTIssuer not initialized');
         return new jose.SignJWT({ sub, typ: 'access' })
-            .setProtectedHeader({ alg: 'RS256', kid: this.kid })
+            .setProtectedHeader({ alg: this.alg, kid: this.kid })
             .setIssuer(this.serverName)
             .setAudience(this.serverName)
             .setIssuedAt()
@@ -67,20 +128,27 @@ export class JWTIssuer {
             .sign(this.privateKey);
     }
     /**
-     * Issue an RS256 JWT refresh token (``typ="refresh"``).
+     * Issue a JWT refresh token (typ="refresh") signed with the active alg.
      *
-     * Defaults to a 30-day (2592000s) lifetime so long-running MCP clients can
-     * mint fresh access tokens without forcing the user back through the
-     * browser PKCE flow every hour. Same key / iss / aud as access tokens; the
-     * ``typ`` claim is the only thing distinguishing them, and
-     * ``verifyAccessToken`` rejects ``typ="refresh"`` so a refresh token can
-     * never be used as an access token at the ``/mcp`` resource.
+     * Defaults to a 1-year (31536000s) lifetime so long-running MCP clients can
+     * mint fresh access tokens without forcing the user back through the browser
+     * PKCE flow. The access token stays short-lived (1h); the refresh token is the
+     * renewal credential and is rotated on every use (the /token refresh handler
+     * issues a new refresh token each time), so the security control is rotation,
+     * not a short TTL. A short refresh TTL was the residual re-auth driver: a
+     * self-hosted server a user touches only intermittently (less than once a
+     * month) would silently expire its refresh token between sessions, forcing a
+     * fresh browser OAuth tab on the next use. With a 1-year floor, only a
+     * genuinely long idle gap re-prompts. Same key / iss / aud as access tokens;
+     * the typ claim is the only thing distinguishing them, and verifyAccessToken
+     * rejects typ="refresh" so a refresh token can never be used as an access
+     * token at the /mcp resource.
      */
-    async issueRefreshToken(sub, expiresInSeconds = 2592000) {
+    async issueRefreshToken(sub, expiresInSeconds = 31536000) {
         if (!this.privateKey)
             throw new Error('JWTIssuer not initialized');
         return new jose.SignJWT({ sub, typ: 'refresh' })
-            .setProtectedHeader({ alg: 'RS256', kid: this.kid })
+            .setProtectedHeader({ alg: this.alg, kid: this.kid })
             .setIssuer(this.serverName)
             .setAudience(this.serverName)
             .setIssuedAt()
@@ -88,20 +156,22 @@ export class JWTIssuer {
             .sign(this.privateKey);
     }
     /**
-     * Verify a JWT access token and return its payload. Throws on failure
-     * (bad signature, wrong issuer/audience, expired) — the same jose errors
-     * existing callers already catch. Additionally rejects tokens whose
-     * ``typ`` claim is ``"refresh"`` (throwing ``jose.errors.JWTClaimValidationFailed``)
-     * so a refresh token cannot be replayed as an access token. Tokens with
-     * ``typ="access"`` OR a missing ``typ`` claim are accepted (the latter
-     * keeps already-issued pre-refresh-support tokens valid).
+     * Verify a JWT access token and return its payload. Throws on failure (bad
+     * signature, wrong issuer/audience, expired) — the same jose errors existing
+     * callers already catch. The verify path uses the single active algorithm,
+     * never a union. Additionally rejects tokens whose typ claim is "refresh"
+     * (throwing jose.errors.JWTClaimValidationFailed) so a refresh token cannot
+     * be replayed as an access token. Tokens with typ="access" OR a missing typ
+     * claim are accepted (the latter keeps already-issued pre-refresh-support
+     * tokens valid).
      */
     async verifyAccessToken(token) {
         if (!this.publicKey)
             throw new Error('JWTIssuer not initialized');
         const { payload } = await jose.jwtVerify(token, this.publicKey, {
             issuer: this.serverName,
-            audience: this.serverName
+            audience: this.serverName,
+            algorithms: [this.alg]
         });
         if (payload.typ === 'refresh') {
             throw new jose.errors.JWTClaimValidationFailed('Refresh token cannot be used as an access token', payload, 'typ');
@@ -110,19 +180,18 @@ export class JWTIssuer {
     }
     /**
      * Verify a JWT refresh token and return its payload. Same key / audience /
-     * issuer checks as ``verifyAccessToken`` and throws the same jose errors on
-     * failure. Additionally asserts ``typ=="refresh"`` (throwing
-     * ``jose.errors.JWTClaimValidationFailed`` otherwise) so an access token
-     * can never be exchanged at the refresh grant. ``JWTClaimValidationFailed``
-     * extends ``jose.errors.JOSEError``, so callers' existing ``catch`` clauses
-     * around ``verifyAccessToken`` already catch it.
+     * issuer checks as verifyAccessToken and throws the same jose errors on
+     * failure; uses the single active algorithm. Additionally asserts
+     * typ=="refresh" (throwing jose.errors.JWTClaimValidationFailed otherwise) so
+     * an access token can never be exchanged at the refresh grant.
      */
     async verifyRefreshToken(token) {
         if (!this.publicKey)
             throw new Error('JWTIssuer not initialized');
         const { payload } = await jose.jwtVerify(token, this.publicKey, {
             issuer: this.serverName,
-            audience: this.serverName
+            audience: this.serverName,
+            algorithms: [this.alg]
         });
         if (payload.typ !== 'refresh') {
             throw new jose.errors.JWTClaimValidationFailed('Token is not a refresh token', payload, 'typ');

package/build/oauth/jwt-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-issuer.js","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,OAAO,SAAS;IAUpB,YAAY,UAAkB,EAAE,OAAO,GAAG,gBAAgB;QALlD,QAAG,GAAG,OAAO,CAAA;QACb,eAAU,GAA0B,IAAI,CAAA;QACxC,cAAS,GAA0B,IAAI,CAAA;QACvC,iBAAY,GAAG,KAAK,CAAA;QAG1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,cAAc,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,aAAa,CAAC,CAAA;IACrE,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY;YAAE,OAAM;QAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAEzD,IAAI,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;YAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC3D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;gBACpE,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAElD,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAE7D,0DAA0D;YAC1D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChD,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QAClB,GAAG,CAAC,GAAG,GAAG,KAAK,CAAA;QACf,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;QACjB,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IACxB,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,gBAAgB,GAAG,IAAI;QACzD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;aAC5C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,gBAAgB,GAAG,OAAO;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAC7C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iDAAiD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAChG,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}
+{"version":3,"file":"jwt-issuer.js","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;AAEjE,yEAAyE;AACzE,+EAA+E;AAC/E,oCAAoC;AACpC,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;AAEnF,MAAM,OAAO,SAAS;IAapB,YAAY,UAAkB,EAAE,OAAO,GAAG,gBAAgB,EAAE,mBAAkC,IAAI;QAN1F,QAAG,GAAG,OAAO,CAAA;QACb,eAAU,GAA0B,IAAI,CAAA;QACxC,cAAS,GAA0B,IAAI,CAAA;QACvC,SAAI,GAAkB,IAAI,CAAA;QAC1B,iBAAY,GAAG,KAAK,CAAA;QAG1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAA;QACxC,IAAI,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QAC/C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,cAAc,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,aAAa,CAAC,CAAA;IACrE,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY;YAAE,OAAM;QAC7B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YACjD,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,2DAA2D;YAC3D,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,UAAU,2DAA2D,IAAI,CAAC,GAAG,GAAG,CAAC,CAAA;QACnH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAA;YAClC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,UAAU,iDAAiD,IAAI,CAAC,OAAO,GAAG,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,gBAAwB;QACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAA;QACvD,MAAM,GAAG,GAAG,gCAAgC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,+BAA+B,CAAA;QACjG,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,4EAA4E;QAC5E,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAkB,CAAA;QAC5E,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;QACjB,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAmB,CAAA;QAC5G,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1G,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAEzD,IAAI,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;YAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC3D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;gBACpE,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAElD,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAE7D,0DAA0D;YAC1D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,IAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACxG,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChD,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QAClB,GAAG,CAAC,GAAG,GAAG,KAAK,CAAA;QACf,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;QACjB,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IACxB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,gBAAgB,GAAG,IAAI;QACzD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;aAC5C,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACpD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,gBAAgB,GAAG,QAAQ;QAC9D,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAC7C,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACpD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;SACvB,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iDAAiD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;SACvB,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAChG,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}