@ni-c/mcp-hub 0.9.2 → 0.11.0

package/dist/auth/oidc/quirks.js

@@ -0,0 +1,234 @@
+import crypto from 'node:crypto';
+import { Readable } from 'node:stream';
+/**
+ * The one scope the hub knows. Authorization is per client, not per scope —
+ * what a token may reach is decided by the resource it is bound to — but
+ * oidc-provider requires a non-empty granted∩requested set, so the hub needs a
+ * name for "everything this client was approved for". See `defaultScope`.
+ */
+export const HUB_SCOPE = 'mcp';
+/**
+ * Four deliberate concessions to two real clients. Every one of them is
+ * load-bearing: three are pinned by test/client-compat.test.ts because a real
+ * connector broke without them, and the fourth was found by running a real
+ * authorization flow against oidc-provider.
+ *
+ *   1. `client_secret_expires_at: 0` for every client. ChatGPT registers once
+ *      per connector and never re-registers, so an expiring secret bricks it.
+ *      Needs no code: registration.js hardcodes 0 and forbids changing it.
+ *
+ *   2. A throwaway `client_secret` for PUBLIC clients — below.
+ *   3. Refresh tokens without `offline_access` — in provider.ts.
+ *   4. Authorization with no `scope` parameter — `defaultScope` below.
+ */
+/**
+ * Quirk 2. ChatGPT refuses its own registration unless the response carries a
+ * `client_secret`, even for `token_endpoint_auth_method: 'none'`. Claude is
+ * correct and sends none, so the secret must exist in the response and NOT in
+ * the stored record — otherwise every well-behaved public client breaks.
+ *
+ * oidc-provider already gets the storage half right: `Client.needsSecret` is
+ * false for 'none', so registration.js deletes the secret before persisting.
+ * Only the response needs fixing, and `provider.use()` is the documented place:
+ * it installs middleware ahead of the router, so `await next()` returns after
+ * ctx.body was set and before Koa serialises it.
+ *
+ * Not `features.registration.policies` and not `extraClientMetadata`: both run
+ * on the properties *before* they are persisted, so both would store the secret
+ * and defeat the whole point.
+ */
+/**
+ * Quirk 2, storage half. Keeps a public client's record free of a secret.
+ *
+ * The comment above says oidc-provider gets this half right on its own. It does
+ * not, and the reason is an ordering the library is entitled to: RFC 7591 says
+ * an omitted `token_endpoint_auth_method` means `client_secret_basic`, so
+ * `Client.needsSecret` — which runs on the metadata as SENT — mints and
+ * persists a real secret for every client that leaves the field out. The hub's
+ * `clientDefaults` then rewrites the method to `none`, and the record ends up
+ * claiming to be a public client while carrying a credential.
+ *
+ * Leaving the field out is what Claude and ChatGPT both do, so this is the
+ * common case rather than a corner of it. Two things follow, and neither is
+ * visible from the outside:
+ *
+ *   - `state.json` gains a value someone could present, which is the one thing
+ *     `AuthStore` is careful never to store (tokens live there as hashes).
+ *   - `stripPhantomSecret` below gates on the stored client having NO secret,
+ *     so it stops firing for exactly the clients it was written for: a
+ *     connector that echoes the secret from its registration response gets
+ *     `401 invalid_client`, which is the failure quirk 2 exists to prevent.
+ *
+ * The response is left alone — it still carries a secret, which is what
+ * ChatGPT insists on. Only the record is cleaned.
+ */
+export function withoutPhantomSecret(payload) {
+    if (payload.token_endpoint_auth_method !== 'none' || payload.client_secret === undefined)
+        return payload;
+    // An HMAC response algorithm signs with the secret, so a client that declared
+    // one needs it kept even though its auth method does not use it.
+    const usesHmac = Object.entries(payload).some(([key, value]) => key.endsWith('_signed_response_alg') && typeof value === 'string' && value.startsWith('HS'));
+    if (usesHmac)
+        return payload;
+    const { client_secret: _secret, client_secret_expires_at: _expires, ...rest } = payload;
+    return rest;
+}
+export function installThrowawaySecret(provider, store) {
+    provider.use(async (ctx, next) => {
+        await next();
+        const body = ctx.body;
+        if (ctx.oidc?.route !== 'registration' || ctx.status !== 201 || !body)
+            return;
+        if (body.token_endpoint_auth_method === 'none' && body.client_secret === undefined) {
+            body.client_secret = crypto.randomBytes(32).toString('base64url');
+            body.client_secret_expires_at = 0;
+        }
+        // The only moment the registration access token is visible. The hub stores
+        // just its hash, which is what lets RFC 7592 management stay on mcp-hub's
+        // own, stricter implementation.
+        if (store && typeof body.client_id === 'string' && typeof body.registration_access_token === 'string') {
+            store.rememberRegistrationToken(body.client_id, body.registration_access_token);
+        }
+    });
+}
+/**
+ * RFC 8414 lists `revocation_endpoint_auth_methods_supported`, the hub
+ * advertised it, and oidc-provider does not emit it at all. A client that reads
+ * the document to decide how to authenticate at /revoke would find nothing
+ * where there used to be an answer.
+ *
+ * Same mechanism as the throwaway secret: middleware installed ahead of the
+ * router, so `ctx.body` is still a plain object when it returns.
+ */
+export function installDiscoveryFixups(provider) {
+    provider.use(async (ctx, next) => {
+        await next();
+        const body = ctx.body;
+        if (ctx.oidc?.route === 'discovery' && ctx.status === 200 && body?.revocation_endpoint) {
+            body.revocation_endpoint_auth_methods_supported = ['client_secret_post', 'none', 'private_key_jwt'];
+        }
+    });
+}
+/**
+ * Quirk 4. MCP clients send no `scope` parameter at all.
+ *
+ * actions/authorization/interactions.js filters the GRANTED scopes by the
+ * REQUESTED ones and throws `access_denied` when the intersection is empty —
+ * so with no scope requested the flow dead-ends no matter what was granted.
+ * The hub issues scopeless, resource-bound tokens today, so defaulting the
+ * scope preserves current behaviour; demanding one from the clients would not,
+ * because they will never send it.
+ *
+ * A client that DOES ask for something is left alone.
+ */
+export const defaultScope = (req, _res, next) => {
+    const url = new URL(req.url, 'http://placeholder.invalid');
+    if (!url.searchParams.get('scope')) {
+        url.searchParams.set('scope', HUB_SCOPE);
+        req.url = `${url.pathname}${url.search}`;
+    }
+    next();
+};
+/**
+ * The most a `/token` body may weigh before it is refused unread.
+ *
+ * Exactly oidc-provider's own ceiling (shared/selective_body.js), because this
+ * middleware reads the stream the library would otherwise read itself: anything
+ * above it was never going to be accepted, so capping here changes nothing a
+ * legitimate client does — and without the cap the read below is unbounded,
+ * which is the one thing a request stream must never be.
+ */
+const MAX_TOKEN_BODY_BYTES = 56 * 1024;
+/**
+ * Restores the hub's existing tolerance for a client that presents the
+ * throwaway secret from quirk 2 back at the token endpoint.
+ *
+ * The SDK the hub used before gated on the STORED client having a secret
+ * (clientAuth.js: `if (client.client_secret)`), and public clients have none,
+ * so a presented secret was ignored. oidc-provider gates on the PRESENTED one
+ * (client_auth.js: any client_secret selects client_secret_basic/post) and then
+ * hard-fails with `401 invalid_client` because the record says 'none'.
+ *
+ * Whether ChatGPT actually echoes the secret is unknown and unknowable from the
+ * outside — which is the reason to be tolerant rather than to find out from a
+ * bug report. `ctx.oidc.params` is built inside the router, after every
+ * provider.use() middleware, so the raw body before the mount is the only place
+ * this can happen.
+ *
+ * Reading the body here is what makes the cap above load-bearing. `/token` is
+ * unauthenticated by nature — the credentials are IN the body — so an
+ * unbounded read is a way for anyone to spend the hub's memory, and the
+ * per-path rate limit still allows fifty of them per address per window. Every
+ * other provider path keeps the library's own bounded reader; only this one
+ * takes the stream away from it, so only this one has to bring the ceiling
+ * with it.
+ */
+export function stripPhantomSecret(store, callback) {
+    return (req, res, next) => {
+        // Anything that is not a POST still belongs to the provider, which answers
+        // 405. Handing it to next() instead would drop it into the hub's catch-all
+        // and turn a documented endpoint into a 404.
+        if (req.method !== 'POST') {
+            callback(req, res);
+            return;
+        }
+        // A declared length above the ceiling is refused without reading a byte;
+        // an absent or lying one is caught while reading.
+        const declared = Number(req.headers['content-length']);
+        if (Number.isFinite(declared) && declared > MAX_TOKEN_BODY_BYTES) {
+            refuseOversizedBody(req, res);
+            return;
+        }
+        void (async () => {
+            try {
+                const chunks = [];
+                let size = 0;
+                for await (const chunk of req) {
+                    size += chunk.length;
+                    if (size > MAX_TOKEN_BODY_BYTES) {
+                        refuseOversizedBody(req, res);
+                        return;
+                    }
+                    chunks.push(chunk);
+                }
+                const params = new URLSearchParams(Buffer.concat(chunks).toString('utf8'));
+                const clientId = params.get('client_id');
+                if (params.get('client_secret') && clientId) {
+                    const client = store.getClient(clientId);
+                    // A public client never had a secret, so whatever was presented is
+                    // the throwaway one the hub itself handed out.
+                    if (client && client.client_secret === undefined)
+                        params.delete('client_secret');
+                }
+                const body = Buffer.from(params.toString());
+                const shim = Readable.from([body]);
+                Object.assign(shim, {
+                    headers: { ...req.headers, 'content-length': String(body.length) },
+                    method: req.method,
+                    url: req.url,
+                    socket: req.socket,
+                    httpVersion: req.httpVersion
+                });
+                callback(shim, res);
+            }
+            catch (error) {
+                next(error);
+            }
+        })();
+    };
+}
+/**
+ * The same answer oidc-provider gives a body it will not read, so a client
+ * cannot tell whether the ceiling was enforced here or one layer down.
+ *
+ * The connection is closed rather than drained: the sender is still writing,
+ * and reading the rest to keep it alive would defeat the point of refusing.
+ */
+function refuseOversizedBody(req, res) {
+    const body = JSON.stringify({ error: 'invalid_request', error_description: 'failed to parse the request body' });
+    res.status(400);
+    res.set({ 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': String(Buffer.byteLength(body)), Connection: 'close' });
+    res.end(body);
+    req.destroy();
+}
+//# sourceMappingURL=quirks.js.map

package/dist/auth/oidc/quirks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quirks.js","sourceRoot":"","sources":["../../../src/auth/oidc/quirks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgC;IACnE,IAAI,OAAO,CAAC,0BAA0B,KAAK,MAAM,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACzG,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAC9G,CAAC;IACF,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAkB,EAAE,KAAiB;IAC1E,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI;YAAE,OAAO;QAE9E,IAAI,IAAI,CAAC,0BAA0B,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACnF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClE,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,gCAAgC;QAChC,IAAI,KAAK,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,yBAAyB,KAAK,QAAQ,EAAE,CAAC;YACtG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,mBAAmB,EAAE,CAAC;YACvF,IAAI,CAAC,0CAA0C,GAAG,CAAC,oBAAoB,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACtG,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgB,EAAE,QAA+C;IAClG,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,2EAA2E;QAC3E,2EAA2E;QAC3E,6CAA6C;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YACjE,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;oBACjC,IAAI,IAAI,GAAG,oBAAoB,EAAE,CAAC;wBAChC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;wBAC9B,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,QAAQ,EAAE,CAAC;oBAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;oBACzC,mEAAmE;oBACnE,+CAA+C;oBAC/C,IAAI,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;wBAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBACnF,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAuC,CAAC;gBACzE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;oBAClB,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAClE,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;iBAC7B,CAAC,CAAC;gBACH,QAAQ,CAAC,IAA0B,EAAE,GAAG,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,GAAY,EAAE,GAAa;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,CAAC,CAAC;IACjH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,iCAAiC,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACvI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,GAAG,CAAC,OAAO,EAAE,CAAC;AAChB,CAAC"}

package/dist/auth/oidc/verifier.js

@@ -0,0 +1,121 @@
+import { OAuthError, OAuthErrorCode } from '@modelcontextprotocol/server';
+import { jwtVerify } from 'jose';
+import { API_TOKEN_SUBJECT } from '../api-tokens.js';
+/**
+ * The one error shape `requireBearerAuth` recognises.
+ *
+ * It classifies whatever the verifier throws: an `OAuthError` carrying
+ * `invalid_token` becomes a 401 with a `WWW-Authenticate` challenge pointing at
+ * the protected-resource metadata, and anything else becomes a 500. SDK v1 had
+ * a class per code; v2 has one class and an enum, so the distinction now lives
+ * in the argument rather than in the constructor — which is exactly the kind of
+ * thing that fails silently, by answering 500 to a merely expired token and
+ * leaving the client with nothing to discover the authorization server from.
+ */
+function invalidToken(message) {
+    return new OAuthError(OAuthErrorCode.InvalidToken, message);
+}
+/**
+ * Verifies the two token shapes the hub hands out, which are deliberately not
+ * the same shape.
+ *
+ * OAuth access tokens are **opaque**. That is what makes revocation immediate:
+ * the value is the record's id, so the lookup below is the enforcement point,
+ * and `AuthStore.oidcFind` refuses anything past its expiry or minted before a
+ * `revokedBefore` cutoff. A JWT could not be revoked at all — oidc-provider
+ * never persists one.
+ *
+ * Admin-minted API tokens stay **JWTs**, signed with the hub's own key. They
+ * are not OAuth artifacts: `mcp-hub-admin tokens create` issues them for
+ * clients that cannot do OAuth at all, and only their record (jti) is stored,
+ * which is what `tokens revoke` deletes.
+ *
+ * Order matters. Opaque is tried first because it is the common case and needs
+ * no cryptography; a value that is not a stored token then gets exactly one
+ * signature check. Neither branch may report why it failed — an attacker must
+ * not be able to tell "unknown" from "revoked" from "wrong audience".
+ */
+export class OidcTokenVerifier {
+    store;
+    options;
+    constructor(store, options) {
+        this.store = store;
+        this.options = options;
+    }
+    async verifyAccessToken(token) {
+        const opaque = this.store.oidcFind('AccessToken', token);
+        if (opaque)
+            return this.fromOpaque(token, opaque);
+        return this.fromApiToken(token);
+    }
+    fromOpaque(token, payload) {
+        const clientId = payload.clientId;
+        if (typeof clientId !== 'string')
+            throw invalidToken('Invalid access token claims');
+        // An audience equal to the issuer means "not bound to one resource" — the
+        // pre-0.5 shape, kept so a deployment that never turned binding on is not
+        // logged out by an upgrade. It passes only while binding is not enforced;
+        // the per-route check is what narrows it.
+        const audience = typeof payload.aud === 'string' ? payload.aud : undefined;
+        let resource;
+        if (audience !== undefined && audience !== this.options.externalUrl) {
+            resource = this.resolve(audience);
+            if (!resource)
+                throw invalidToken('Invalid token audience');
+        }
+        else if (this.options.requireResource) {
+            throw invalidToken('Invalid token audience');
+        }
+        const scope = typeof payload.scope === 'string' ? payload.scope : '';
+        return {
+            token,
+            clientId,
+            scopes: scope ? scope.split(' ') : [],
+            ...(typeof payload.exp === 'number' ? { expiresAt: payload.exp } : {}),
+            ...(resource ? { resource } : {})
+        };
+    }
+    async fromApiToken(token) {
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, this.store.publicKey, {
+                issuer: this.options.externalUrl,
+                algorithms: ['EdDSA']
+            }));
+        }
+        catch {
+            throw invalidToken('Invalid or expired access token');
+        }
+        // Only API tokens are JWTs now. An OAuth token in this shape is one the
+        // previous authorization server minted; refusing it is what makes clients
+        // authorize once against the new one instead of silently keeping a
+        // credential nothing can revoke.
+        if (payload.sub !== API_TOKEN_SUBJECT)
+            throw invalidToken('Invalid access token claims');
+        if (typeof payload.jti !== 'string' || !this.store.getApiToken(payload.jti)) {
+            throw invalidToken('Access token has been revoked');
+        }
+        const audience = typeof payload.aud === 'string' ? payload.aud : undefined;
+        const resource = audience ? this.resolve(audience) : undefined;
+        if (!resource)
+            throw invalidToken('Invalid token audience');
+        return {
+            token,
+            clientId: `token:${payload.jti}`,
+            scopes: [],
+            ...(payload.exp !== undefined ? { expiresAt: payload.exp } : {}),
+            resource
+        };
+    }
+    resolve(audience) {
+        let parsed;
+        try {
+            parsed = new URL(audience);
+        }
+        catch {
+            return undefined;
+        }
+        return this.options.resolveResource(parsed);
+    }
+}
+//# sourceMappingURL=verifier.js.map

package/dist/auth/oidc/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/auth/oidc/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAYrD;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,iBAAiB;IAET,KAAK;IACL,OAAO;IAF1B,YACmB,KAAgB,EAChB,OAA4B;qBAD5B,KAAK;uBACL,OAAO;IACvB,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAEO,UAAU,CAAC,KAAa,EAAE,OAAgC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,6BAA6B,CAAC,CAAC;QAEpF,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,QAAyB,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACpE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ;gBAAE,MAAM,YAAY,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,YAAY,CAAC,wBAAwB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACrC,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAa;QACtC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,YAAY,CAAC,iCAAiC,CAAC,CAAC;QACxD,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,iCAAiC;QACjC,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB;YAAE,MAAM,YAAY,CAAC,6BAA6B,CAAC,CAAC;QACzF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,MAAM,YAAY,CAAC,+BAA+B,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,QAAQ;YAAE,MAAM,YAAY,CAAC,wBAAwB,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,SAAS,OAAO,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,EAAE;YACV,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,QAAgB;QAC9B,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/auth/page.js

@@ -1,6 +1,28 @@
 export function escapeHtml(value) {
     return value.replace(/[&<>"']/g, c => `&#${c.charCodeAt(0)};`);
 }
+/**
+ * The block both pages share: what access is requested, where codes would go
+ * and — for a Client ID Metadata Document client — the URL that vouches for
+ * the name above it. The document URL is the one part of a CIMD client's
+ * identity that cannot be invented, which is why the specification asks for it
+ * to be shown; a client whose redirect URIs are all local cannot be attributed
+ * to anything at all, so that gets said outright.
+ */
+export function renderIdentity(redirectUri, identity) {
+    const lines = [
+        '  <p class="label">Requested access</p>',
+        `  <code class="target">${escapeHtml(identity.resource ?? 'Every server on this hub')}</code>`
+    ];
+    if (identity.clientId) {
+        lines.push('  <p class="label">Identified by</p>', `  <code class="target">${escapeHtml(identity.clientId)}</code>`);
+    }
+    lines.push('  <p class="label">Codes will be sent to</p>', `  <code class="target">${escapeHtml(redirectUri)}</code>`);
+    if (identity.loopbackOnly) {
+        lines.push('  <p class="error">This client only accepts codes on this machine, so any program running here could be the one asking.</p>');
+    }
+    return lines.join('\n');
+}
 /** Shared chrome for the two interactive pages, login and consent. */
 export function renderPage(title, body) {
     return `<!doctype html>

package/dist/auth/page.js.map

@@ -1 +1 @@
-{"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/auth/page.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAY;IACpD,OAAO;;;;;;SAMA,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;EAexB,IAAI;;QAEE,CAAC;AACT,CAAC"}
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/auth/page.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,QAAwB;IAC1E,MAAM,KAAK,GAAG;QACZ,yCAAyC;QACzC,0BAA0B,UAAU,CAAC,QAAQ,CAAC,QAAQ,IAAI,0BAA0B,CAAC,SAAS;KAC/F,CAAC;IACF,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,sCAAsC,EAAE,0BAA0B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,8CAA8C,EAAE,0BAA0B,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACvH,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,6HAA6H,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAY;IACpD,OAAO;;;;;;SAMA,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;EAexB,IAAI;;QAEE,CAAC;AACT,CAAC"}

package/dist/auth/pinned-fetch.js

@@ -0,0 +1,129 @@
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+/**
+ * An HTTPS request that connects to an address someone already vetted.
+ *
+ * Checking a hostname and then handing it to `fetch` leaves a gap: the check
+ * resolves the name once, `fetch` resolves it again, and a DNS zone the caller
+ * controls can answer differently the second time. A short TTL alternating
+ * between a public address and `169.254.169.254` wins that race reliably. The
+ * only way to close it is to stop resolving twice — so the vetted address is
+ * pinned into the connection here, while the hostname is still what TLS
+ * validates the certificate against.
+ *
+ * Deliberately `node:https` rather than a custom `fetch` dispatcher: undici is
+ * not a dependency of this project, and its `Agent` would be the only reason
+ * to add one.
+ */
+/** Answers every lookup with the one address that was already checked. */
+export function pinnedLookup(address) {
+    const family = net.isIP(address);
+    return ((hostname, options, callback) => {
+        const done = (typeof options === 'function' ? options : callback);
+        const wantsAll = typeof options === 'object' && options !== null && options.all === true;
+        if (wantsAll)
+            done(null, [{ address, family }]);
+        else
+            done(null, address, family);
+    });
+}
+export async function guardedRequest(url, options) {
+    // Only https reaches this in production — the caller rejects anything else
+    // before resolving. Plain http is here so the transport can be exercised
+    // without a certificate authority, and for the local-development escape hatch.
+    const transport = url.protocol === 'http:' ? http : https;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        // Declared up here because finish() may run before the timer below is
+        // assigned — an immediate connection error would otherwise hit the
+        // temporal dead zone instead of rejecting.
+        let deadline;
+        const finish = (error, response) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(deadline);
+            if (error)
+                reject(error);
+            else
+                resolve(response);
+        };
+        const request = transport.request({
+            hostname: url.hostname.replace(/^\[|\]$/g, ''),
+            port: url.port || (url.protocol === 'http:' ? 80 : 443),
+            path: `${url.pathname}${url.search}`,
+            method: options.method ?? 'GET',
+            // No compression: this path decodes nothing, and a compressed body
+            // would make the byte cap below measure the wrong thing.
+            headers: {
+                ...options.headers,
+                host: url.host,
+                'accept-encoding': 'identity',
+                ...(options.body !== undefined ? { 'content-length': String(Buffer.byteLength(options.body)) } : {})
+            },
+            lookup: pinnedLookup(options.pinnedAddress)
+        }, response => {
+            const status = response.statusCode ?? 0;
+            // The caller asked for no redirects; a hop would be resolved and
+            // connected without going through the address check again.
+            if (status >= 300 && status < 400) {
+                response.destroy();
+                request.destroy();
+                finish(new Error(`refused to follow a redirect (HTTP ${status})`));
+                return;
+            }
+            const declared = Number(response.headers['content-length']);
+            if (Number.isFinite(declared) && declared > options.maxBytes) {
+                response.destroy();
+                request.destroy();
+                finish(new Error(`response exceeds ${options.maxBytes} bytes`));
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            response.on('data', (chunk) => {
+                size += chunk.byteLength;
+                if (size > options.maxBytes) {
+                    response.destroy();
+                    request.destroy();
+                    finish(new Error(`response exceeds ${options.maxBytes} bytes`));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.on('error', error => finish(error));
+            response.on('end', () => {
+                if (settled)
+                    return;
+                const headers = new Headers();
+                for (const [key, value] of Object.entries(response.headers)) {
+                    if (value === undefined)
+                        continue;
+                    try {
+                        if (Array.isArray(value))
+                            for (const entry of value)
+                                headers.append(key, entry);
+                        else
+                            headers.set(key, value);
+                    }
+                    catch {
+                        // A header the Fetch API will not represent is not one this
+                        // caller reads; dropping it beats failing the whole request.
+                    }
+                }
+                // A zero-length body has to be null: Response refuses an empty
+                // buffer for the statuses that may not carry one.
+                finish(undefined, new Response(chunks.length > 0 ? Buffer.concat(chunks) : null, { status, headers }));
+            });
+        });
+        // Bounds the whole exchange, not just socket inactivity — a body trickled
+        // a byte at a time would otherwise keep the request alive indefinitely.
+        deadline = setTimeout(() => {
+            request.destroy(new Error(`timed out after ${options.timeoutMs}ms`));
+        }, options.timeoutMs);
+        request.on('error', error => finish(error));
+        request.end(options.body);
+    });
+}
+//# sourceMappingURL=pinned-fetch.js.map

package/dist/auth/pinned-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-fetch.js","sourceRoot":"","sources":["../../src/auth/pinned-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B;;;;;;;;;;;;;;GAcG;AAEH,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,QAAgB,EAAE,OAAgB,EAAE,QAAiB,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAIvD,CAAC;QACV,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAK,OAA6B,CAAC,GAAG,KAAK,IAAI,CAAC;QAChH,IAAI,QAAQ;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;;YAC3C,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAA8B,CAAC;AAClC,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAQ,EAAE,OAA8B;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,+EAA+E;IAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,sEAAsE;QACtE,mEAAmE;QACnE,2CAA2C;QAC3C,IAAI,QAAmD,CAAC;QACxD,MAAM,MAAM,GAAG,CAAC,KAAwB,EAAE,QAAmB,EAAQ,EAAE;YACrE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,CAAC,QAAS,CAAC,CAAC;QAC1B,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAC/B;YACE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YAC9C,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YACvD,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,mEAAmE;YACnE,yDAAyD;YACzD,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,OAAO;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,iBAAiB,EAAE,UAAU;gBAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrG;YACD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC;SAC5C,EACD,QAAQ,CAAC,EAAE;YACT,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;YACxC,iEAAiE;YACjE,2DAA2D;YAC3D,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC7D,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACpC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBACzB,IAAI,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;oBAC5B,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7C,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5D,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAClC,IAAI,CAAC;wBACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;4BAAE,KAAK,MAAM,KAAK,IAAI,KAAK;gCAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;;4BAC3E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC/B,CAAC;oBAAC,MAAM,CAAC;wBACP,4DAA4D;wBAC5D,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;gBACD,+DAA+D;gBAC/D,kDAAkD;gBAClD,MAAM,CAAC,SAAS,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACzG,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,0EAA0E;QAC1E,wEAAwE;QACxE,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/protected-resource.js

@@ -0,0 +1,41 @@
+import { Router } from 'express';
+import { authSecurityHeaders } from './headers.js';
+/**
+ * RFC 9728 Protected Resource Metadata.
+ *
+ * This is the RESOURCE SERVER's document, not the authorization server's, which
+ * is why it lives outside `createAuthRoutes` and survives whichever
+ * authorization server the hub is running. Losing it would take out discovery
+ * for every client, and it is the one piece of the auth surface that is not
+ * oidc-provider's to serve.
+ *
+ * Two shapes, both required: the root document the SDK used to publish, and the
+ * path-scoped form (§3.1) a client connected to `/<name>/mcp` looks up first.
+ */
+export function createProtectedResourceRoutes(options) {
+    const router = Router();
+    const issuerUrl = new URL(options.externalUrl);
+    const resourceName = options.resourceName ?? 'mcp-hub';
+    // These used to be served from inside the auth router and inherited its
+    // headers; pulled out here, they would have quietly lost them. A discovery
+    // document is exactly the thing a shared cache should not keep.
+    router.use(authSecurityHeaders);
+    router.get('/.well-known/oauth-protected-resource', (_req, res) => {
+        res.json({
+            resource: issuerUrl.href,
+            authorization_servers: [options.externalUrl],
+            resource_name: resourceName
+        });
+    });
+    router.get('/.well-known/oauth-protected-resource/{*splat}', (req, res) => {
+        const suffix = req.path.replace('/.well-known/oauth-protected-resource', '');
+        res.json({
+            resource: issuerUrl.origin + suffix,
+            authorization_servers: [options.externalUrl],
+            bearer_methods_supported: ['header'],
+            resource_name: resourceName
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=protected-resource.js.map

package/dist/auth/protected-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-resource.js","sourceRoot":"","sources":["../../src/auth/protected-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAQnD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAiC;IAC7E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC;IAEvD,wEAAwE;IACxE,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,SAAS,CAAC,IAAI;YACxB,qBAAqB,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5C,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,gDAAgD,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM;YACnC,qBAAqB,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}