@ninomae/mcp-app-server 0.1.0

package/dist/sql.js

@@ -0,0 +1,107 @@
+const DEFAULT_TABLES = { clients: 'agent_clients', codes: 'agent_codes', refreshTokens: 'agent_refresh_tokens', accessTokens: 'agent_access_tokens' };
+function list(raw) {
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed))
+            return parsed.filter((s) => typeof s === 'string');
+    }
+    catch { }
+    return raw.split(/\s+/).filter(Boolean);
+}
+const client = (r) => ({ id: r.client_id, secretHash: r.client_secret_hash, name: r.client_name, redirectUris: list(r.redirect_uris), tokenEndpointAuthMethod: r.token_endpoint_auth_method, scope: r.scope, createdAt: r.created_at, lastUsedAt: r.last_used_at });
+const code = (r) => ({ hash: r.code_hash, clientId: r.client_id, ownerId: r.owner_uid, redirectUri: r.redirect_uri, scopes: list(r.scopes), codeChallenge: r.code_challenge, resource: r.resource, expiresAt: r.expires_at, usedAt: r.used_at, issuedTokenId: r.issued_token_id });
+const refresh = (r) => ({ hash: r.token_hash, clientId: r.client_id, ownerId: r.owner_uid, accessTokenId: r.access_token_id, scopes: list(r.scopes), expiresAt: r.expires_at, revoked: r.revoked === 1, successorId: r.successor_id });
+const access = (r) => ({ id: r.id, hash: r.token_hash, prefix: r.token_prefix, clientId: r.client_id || '', clientName: r.name, ownerId: r.owner_uid, scopes: list(r.scopes), audience: r.audience || '', createdAt: r.created_at, expiresAt: r.expires_at || '', lastUsedAt: r.last_used_at, revoked: r.revoked === 1 });
+/** @param tables Override table names only when adopting an existing schema. */
+export function sqlStore(db, tables = {}) {
+    const t = { ...DEFAULT_TABLES, ...tables };
+    const q = (sql, ...values) => db.prepare(sql).bind(...values);
+    return {
+        clients: {
+            async create(c) {
+                await q(`INSERT INTO ${t.clients}(client_id, client_secret_hash, client_name, redirect_uris, token_endpoint_auth_method, scope, created_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)`, c.id, c.secretHash, c.name, JSON.stringify(c.redirectUris), c.tokenEndpointAuthMethod, c.scope, c.createdAt).run();
+            },
+            async get(id) {
+                const row = await q(`SELECT * FROM ${t.clients} WHERE client_id = ?1`, id).first();
+                return row ? client(row) : null;
+            },
+            async touch(id, usedAt) {
+                await q(`UPDATE ${t.clients} SET last_used_at = ?1 WHERE client_id = ?2`, usedAt, id).run();
+            },
+        },
+        codes: {
+            async create(c) {
+                await q(`INSERT INTO ${t.codes}(code_hash, client_id, owner_uid, redirect_uri, scopes, code_challenge, resource, expires_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)`, c.hash, c.clientId, c.ownerId, c.redirectUri, JSON.stringify(c.scopes), c.codeChallenge, c.resource, c.expiresAt).run();
+            },
+            async get(hash) {
+                const row = await q(`SELECT * FROM ${t.codes} WHERE code_hash = ?1`, hash).first();
+                return row ? code(row) : null;
+            },
+            async consume(hash, usedAt) {
+                return !!(await q(`UPDATE ${t.codes} SET used_at = ?1 WHERE code_hash = ?2 AND used_at IS NULL`, usedAt, hash).run()).meta.changes;
+            },
+            async setIssuedToken(hash, id) {
+                await q(`UPDATE ${t.codes} SET issued_token_id = ?1 WHERE code_hash = ?2`, id, hash).run();
+            },
+        },
+        refreshTokens: {
+            async create(r) {
+                await q(`INSERT INTO ${t.refreshTokens}(token_hash, client_id, owner_uid, access_token_id, scopes, expires_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6)`, r.hash, r.clientId, r.ownerId, r.accessTokenId, JSON.stringify(r.scopes), r.expiresAt).run();
+            },
+            async get(hash) {
+                const row = await q(`SELECT * FROM ${t.refreshTokens} WHERE token_hash = ?1`, hash).first();
+                return row ? refresh(row) : null;
+            },
+            async getByAccessToken(id) {
+                const row = await q(`SELECT * FROM ${t.refreshTokens} WHERE access_token_id = ?1`, id).first();
+                return row ? refresh(row) : null;
+            },
+            async revoke(hash) {
+                return !!(await q(`UPDATE ${t.refreshTokens} SET revoked = 1 WHERE token_hash = ?1 AND revoked = 0`, hash).run()).meta.changes;
+            },
+            async revokeByAccessToken(id) {
+                await q(`UPDATE ${t.refreshTokens} SET revoked = 1 WHERE access_token_id = ?1`, id).run();
+            },
+            async setSuccessor(hash, id) {
+                await q(`UPDATE ${t.refreshTokens} SET successor_id = ?1 WHERE token_hash = ?2`, id, hash).run();
+            },
+        },
+        accessTokens: {
+            async create(a) {
+                await q(`INSERT INTO ${t.accessTokens}(id, token_hash, token_prefix, name, owner_uid, scopes, created_at, expires_at, revoked, last_used_at, client_id, audience) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 0, NULL, ?9, ?10)`, a.id, a.hash, a.prefix, a.clientName, a.ownerId, JSON.stringify(a.scopes), a.createdAt, a.expiresAt, a.clientId, a.audience).run();
+            },
+            async get(id) {
+                const row = await q(`SELECT * FROM ${t.accessTokens} WHERE id = ?1`, id).first();
+                return row ? access(row) : null;
+            },
+            async getByHash(hash) {
+                const row = await q(`SELECT * FROM ${t.accessTokens} WHERE token_hash = ?1`, hash).first();
+                return row ? access(row) : null;
+            },
+            async listByOwner(ownerId) {
+                const rows = (await q(`SELECT * FROM ${t.accessTokens} WHERE owner_uid = ?1 ORDER BY created_at DESC`, ownerId).all()).results || [];
+                // Rows without a client_id predate OAuth-only access and can never be used again; hide them.
+                return rows.filter((row) => row.client_id).map(access);
+            },
+            async touch(id, usedAt) {
+                await q(`UPDATE ${t.accessTokens} SET last_used_at = ?1 WHERE id = ?2`, usedAt, id).run();
+            },
+            async revoke(id) {
+                return !!(await q(`UPDATE ${t.accessTokens} SET revoked = 1 WHERE id = ?1 AND revoked = 0`, id).run()).meta.changes;
+            },
+        },
+        async prune(now) {
+            await q(`DELETE FROM ${t.codes} WHERE expires_at < ?1`, now).run();
+            await q(`DELETE FROM ${t.refreshTokens} WHERE expires_at < ?1`, now).run();
+        },
+        async ensureSchema() {
+            await db.exec(`CREATE TABLE IF NOT EXISTS ${t.accessTokens} (id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE, token_prefix TEXT NOT NULL, name TEXT NOT NULL, owner_uid TEXT NOT NULL, scopes TEXT NOT NULL, created_at TEXT NOT NULL, expires_at TEXT, revoked INTEGER NOT NULL DEFAULT 0, last_used_at TEXT, client_id TEXT, audience TEXT);`);
+            await db.exec(`CREATE TABLE IF NOT EXISTS ${t.clients} (client_id TEXT PRIMARY KEY, client_secret_hash TEXT, client_name TEXT NOT NULL, redirect_uris TEXT NOT NULL, token_endpoint_auth_method TEXT NOT NULL, scope TEXT, created_at TEXT NOT NULL, last_used_at TEXT);`);
+            await db.exec(`CREATE TABLE IF NOT EXISTS ${t.codes} (code_hash TEXT PRIMARY KEY, client_id TEXT NOT NULL, owner_uid TEXT NOT NULL, redirect_uri TEXT NOT NULL, scopes TEXT NOT NULL, code_challenge TEXT NOT NULL, resource TEXT, expires_at TEXT NOT NULL, used_at TEXT, issued_token_id TEXT);`);
+            await db.exec(`CREATE TABLE IF NOT EXISTS ${t.refreshTokens} (token_hash TEXT PRIMARY KEY, client_id TEXT NOT NULL, owner_uid TEXT NOT NULL, access_token_id TEXT NOT NULL, scopes TEXT NOT NULL, expires_at TEXT NOT NULL, revoked INTEGER NOT NULL DEFAULT 0, successor_id TEXT);`);
+        },
+    };
+}
+//# sourceMappingURL=sql.js.map

package/dist/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAwBA,MAAM,cAAc,GAAe,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAOlK,SAAS,IAAI,CAAC,GAAkB;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAY,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;AAC7R,MAAM,IAAI,GAAG,CAAC,CAAU,EAAc,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;AACxS,MAAM,OAAO,GAAG,CAAC,CAAa,EAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;AACvQ,MAAM,MAAM,GAAG,CAAC,CAAY,EAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC;AAExV,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,EAAe,EAAE,SAA8B,EAAE;IACxE,MAAM,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,GAAG,MAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IACjF,OAAO;QACL,OAAO,EAAE;YACP,KAAK,CAAC,MAAM,CAAC,CAAC;gBACZ,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,OAAO,gJAAgJ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC;YACvS,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,EAAE;gBACV,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,OAAO,uBAAuB,EAAE,EAAE,CAAC,CAAC,KAAK,EAAa,CAAC;gBAC9F,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClC,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM;gBACpB,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,6CAA6C,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9F,CAAC;SACF;QACD,KAAK,EAAE;YACL,KAAK,CAAC,MAAM,CAAC,CAAC;gBACZ,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,KAAK,uIAAuI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC;YACjS,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI;gBACZ,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,KAAK,uBAAuB,EAAE,IAAI,CAAC,CAAC,KAAK,EAAW,CAAC;gBAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM;gBACxB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,4DAA4D,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YACrI,CAAC;YACD,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE;gBAC3B,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,gDAAgD,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YAC7F,CAAC;SACF;QACD,aAAa,EAAE;YACb,KAAK,CAAC,MAAM,CAAC,CAAC;gBACZ,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,aAAa,yGAAyG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC;YAChP,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI;gBACZ,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,aAAa,wBAAwB,EAAE,IAAI,CAAC,CAAC,KAAK,EAAc,CAAC;gBACxG,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnC,CAAC;YACD,KAAK,CAAC,gBAAgB,CAAC,EAAE;gBACvB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,aAAa,6BAA6B,EAAE,EAAE,CAAC,CAAC,KAAK,EAAc,CAAC;gBAC3G,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnC,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,IAAI;gBACf,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,wDAAwD,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YACjI,CAAC;YACD,KAAK,CAAC,mBAAmB,CAAC,EAAE;gBAC1B,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,6CAA6C,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC5F,CAAC;YACD,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;gBACzB,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,8CAA8C,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACnG,CAAC;SACF;QACD,YAAY,EAAE;YACZ,KAAK,CAAC,MAAM,CAAC,CAAC;gBACZ,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,YAAY,uLAAuL,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;YACnW,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,EAAE;gBACV,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,YAAY,gBAAgB,EAAE,EAAE,CAAC,CAAC,KAAK,EAAa,CAAC;gBAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClC,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI;gBAClB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,YAAY,wBAAwB,EAAE,IAAI,CAAC,CAAC,KAAK,EAAa,CAAC;gBACtG,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClC,CAAC;YACD,KAAK,CAAC,WAAW,CAAC,OAAO;gBACvB,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,YAAY,gDAAgD,EAAE,OAAO,CAAC,CAAC,GAAG,EAAa,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAChJ,6FAA6F;gBAC7F,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM;gBACpB,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,YAAY,sCAAsC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC5F,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE;gBACb,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,YAAY,gDAAgD,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YACtH,CAAC;SACF;QACD,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,KAAK,wBAAwB,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACnE,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,aAAa,wBAAwB,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,YAAY;YAChB,MAAM,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,YAAY,0RAA0R,CAAC,CAAC;YACtV,MAAM,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,oNAAoN,CAAC,CAAC;YAC3Q,MAAM,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,KAAK,+OAA+O,CAAC,CAAC;YACpS,MAAM,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,aAAa,yNAAyN,CAAC,CAAC;QACxR,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,106 @@
+export interface ClientRecord {
+    id: string;
+    /** SHA-256 of the client secret, or null for public clients (`token_endpoint_auth_method: none`). */
+    secretHash: string | null;
+    name: string;
+    redirectUris: string[];
+    tokenEndpointAuthMethod: string;
+    /** Default scope string the client asked for at registration, if any. */
+    scope: string | null;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+export interface CodeRecord {
+    /** SHA-256 of the authorization code; the primary key. */
+    hash: string;
+    clientId: string;
+    ownerId: string;
+    redirectUri: string;
+    scopes: string[];
+    codeChallenge: string;
+    resource: string | null;
+    expiresAt: string;
+    usedAt: string | null;
+    /** Access token issued when the code was exchanged; used to revoke on replay. */
+    issuedTokenId: string | null;
+}
+export interface RefreshTokenRecord {
+    /** SHA-256 of the refresh token; the primary key. */
+    hash: string;
+    clientId: string;
+    ownerId: string;
+    /** The access token this refresh token was issued together with. Unique per record. */
+    accessTokenId: string;
+    scopes: string[];
+    expiresAt: string;
+    revoked: boolean;
+    /** Access token id of the pair that replaced this one after rotation. */
+    successorId: string | null;
+}
+export interface AccessTokenRecord {
+    id: string;
+    /** SHA-256 of the access token. Unique. */
+    hash: string;
+    /** First characters of the raw token, shown to users so they can recognise it. */
+    prefix: string;
+    clientId: string;
+    clientName: string;
+    ownerId: string;
+    scopes: string[];
+    audience: string;
+    createdAt: string;
+    expiresAt: string;
+    lastUsedAt: string | null;
+    revoked: boolean;
+}
+export interface AppServerStore {
+    clients: {
+        create(client: ClientRecord): Promise<void>;
+        get(clientId: string): Promise<ClientRecord | null>;
+        /** Record that the client obtained a token. */
+        touch(clientId: string, usedAt: string): Promise<void>;
+    };
+    codes: {
+        create(code: CodeRecord): Promise<void>;
+        get(hash: string): Promise<CodeRecord | null>;
+        /**
+         * Mark the code used **atomically**: return true only for the first caller; false if it was
+         * already consumed. Two concurrent exchanges of the same code must not both succeed.
+         */
+        consume(hash: string, usedAt: string): Promise<boolean>;
+        setIssuedToken(hash: string, accessTokenId: string): Promise<void>;
+    };
+    refreshTokens: {
+        create(token: RefreshTokenRecord): Promise<void>;
+        get(hash: string): Promise<RefreshTokenRecord | null>;
+        getByAccessToken(accessTokenId: string): Promise<RefreshTokenRecord | null>;
+        /**
+         * Mark the token revoked **atomically**: return true only if it was active. Refresh-token
+         * rotation relies on this so a replayed token cannot be redeemed twice.
+         */
+        revoke(hash: string): Promise<boolean>;
+        revokeByAccessToken(accessTokenId: string): Promise<void>;
+        setSuccessor(hash: string, accessTokenId: string): Promise<void>;
+    };
+    accessTokens: {
+        create(token: AccessTokenRecord): Promise<void>;
+        get(id: string): Promise<AccessTokenRecord | null>;
+        getByHash(hash: string): Promise<AccessTokenRecord | null>;
+        /** Newest first. */
+        listByOwner(ownerId: string): Promise<AccessTokenRecord[]>;
+        touch(id: string, usedAt: string): Promise<void>;
+        /** Return true if the token was active and is now revoked. */
+        revoke(id: string): Promise<boolean>;
+    };
+    /** Optional: delete codes and refresh tokens whose `expiresAt` is before `now`. Called opportunistically. */
+    prune?(now: string): Promise<void>;
+    /** Optional: idempotent setup (create tables, indexes…). Exposed as `mcp.ensureSchema()`. */
+    ensureSchema?(): Promise<void>;
+}
+/**
+ * Reference implementation backed by Maps. Suitable for tests, local development and
+ * single-process servers; state is lost on restart. Also the smallest correct example
+ * of the contract for anyone writing their own store.
+ */
+export declare function memoryStore(): AppServerStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,qGAAqG;IACrG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uBAAuB,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iFAAiF;IACjF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE;QACP,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QACpD,+CAA+C;QAC/C,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,CAAC;IACF,KAAK,EAAE;QACL,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QAC9C;;;WAGG;QACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACpE,CAAC;IACF,aAAa,EAAE;QACb,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;QACtD,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;QAC5E;;;WAGG;QACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAClE,CAAC;IACF,YAAY,EAAE;QACZ,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QAC3D,oBAAoB;QACpB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,8DAA8D;QAC9D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtC,CAAC;IACF,6GAA6G;IAC7G,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,6FAA6F;IAC7F,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,cAAc,CA8F5C"}

package/dist/store.js

@@ -0,0 +1,122 @@
+// Storage contract. the server core never touches a database: everything it needs to remember
+// (registered clients, authorization codes, refresh chains, access tokens) goes through this
+// interface. Implement it over whatever you already run — SQL, KV, Redis, Mongo, an ORM.
+//
+// Records are plain objects. Secrets (codes, tokens, client secrets) arrive already hashed;
+// the store never sees a raw credential. Timestamps are ISO-8601 strings and compare lexically.
+/**
+ * Reference implementation backed by Maps. Suitable for tests, local development and
+ * single-process servers; state is lost on restart. Also the smallest correct example
+ * of the contract for anyone writing their own store.
+ */
+export function memoryStore() {
+    const clients = new Map();
+    const codes = new Map();
+    const refresh = new Map();
+    const access = new Map();
+    const accessByHash = new Map();
+    const copy = (value) => (value ? { ...value } : null);
+    return {
+        clients: {
+            async create(client) {
+                clients.set(client.id, { ...client });
+            },
+            async get(id) {
+                return copy(clients.get(id));
+            },
+            async touch(id, usedAt) {
+                const row = clients.get(id);
+                if (row)
+                    row.lastUsedAt = usedAt;
+            },
+        },
+        codes: {
+            async create(code) {
+                codes.set(code.hash, { ...code });
+            },
+            async get(hash) {
+                return copy(codes.get(hash));
+            },
+            async consume(hash, usedAt) {
+                const row = codes.get(hash);
+                if (!row || row.usedAt)
+                    return false;
+                row.usedAt = usedAt;
+                return true;
+            },
+            async setIssuedToken(hash, id) {
+                const row = codes.get(hash);
+                if (row)
+                    row.issuedTokenId = id;
+            },
+        },
+        refreshTokens: {
+            async create(token) {
+                refresh.set(token.hash, { ...token });
+            },
+            async get(hash) {
+                return copy(refresh.get(hash));
+            },
+            async getByAccessToken(id) {
+                for (const row of refresh.values())
+                    if (row.accessTokenId === id)
+                        return { ...row };
+                return null;
+            },
+            async revoke(hash) {
+                const row = refresh.get(hash);
+                if (!row || row.revoked)
+                    return false;
+                row.revoked = true;
+                return true;
+            },
+            async revokeByAccessToken(id) {
+                for (const row of refresh.values())
+                    if (row.accessTokenId === id)
+                        row.revoked = true;
+            },
+            async setSuccessor(hash, id) {
+                const row = refresh.get(hash);
+                if (row)
+                    row.successorId = id;
+            },
+        },
+        accessTokens: {
+            async create(token) {
+                access.set(token.id, { ...token });
+                accessByHash.set(token.hash, token.id);
+            },
+            async get(id) {
+                return copy(access.get(id));
+            },
+            async getByHash(hash) {
+                const id = accessByHash.get(hash);
+                return id ? copy(access.get(id)) : null;
+            },
+            async listByOwner(ownerId) {
+                return [...access.values()].filter((row) => row.ownerId === ownerId).sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1)).map((row) => ({ ...row }));
+            },
+            async touch(id, usedAt) {
+                const row = access.get(id);
+                if (row)
+                    row.lastUsedAt = usedAt;
+            },
+            async revoke(id) {
+                const row = access.get(id);
+                if (!row || row.revoked)
+                    return false;
+                row.revoked = true;
+                return true;
+            },
+        },
+        async prune(now) {
+            for (const [hash, row] of codes)
+                if (row.expiresAt < now)
+                    codes.delete(hash);
+            for (const [hash, row] of refresh)
+                if (row.expiresAt < now)
+                    refresh.delete(hash);
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,6FAA6F;AAC7F,yFAAyF;AACzF,EAAE;AACF,4FAA4F;AAC5F,gGAAgG;AA0GhG;;;;GAIG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAI,KAAoB,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO;QACL,OAAO,EAAE;YACP,KAAK,CAAC,MAAM,CAAC,MAAM;gBACjB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,EAAE;gBACV,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/B,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM;gBACpB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,GAAG;oBAAE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;YACnC,CAAC;SACF;QACD,KAAK,EAAE;YACL,KAAK,CAAC,MAAM,CAAC,IAAI;gBACf,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI;gBACZ,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/B,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM;gBACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACrC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,GAAG;oBAAE,GAAG,CAAC,aAAa,GAAG,EAAE,CAAC;YAClC,CAAC;SACF;QACD,aAAa,EAAE;YACb,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI;gBACZ,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjC,CAAC;YACD,KAAK,CAAC,gBAAgB,CAAC,EAAE;gBACvB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE;oBAAE,IAAI,GAAG,CAAC,aAAa,KAAK,EAAE;wBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBACpF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,IAAI;gBACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACtC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,CAAC,mBAAmB,CAAC,EAAE;gBAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE;oBAAE,IAAI,GAAG,CAAC,aAAa,KAAK,EAAE;wBAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YACvF,CAAC;YACD,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;gBACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,GAAG;oBAAE,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;YAChC,CAAC;SACF;QACD,YAAY,EAAE;YACZ,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBACnC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,EAAE;gBACV,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI;gBAClB,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1C,CAAC;YACD,KAAK,CAAC,WAAW,CAAC,OAAO;gBACvB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;YACvJ,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM;gBACpB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3B,IAAI,GAAG;oBAAE,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;YACnC,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE;gBACb,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAC;gBACtC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;SACF;QACD,KAAK,CAAC,KAAK,CAAC,GAAG;YACb,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK;gBAAE,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;oBAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO;gBAAE,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tokens.d.ts

@@ -0,0 +1,26 @@
+import type { AuthenticatedGrant, Grant } from './types.js';
+import type { AppServerStore } from './store.js';
+export interface TokenStore {
+    issue(input: {
+        ownerId: string;
+        clientId: string;
+        clientName: string;
+        scopes: string[];
+        audience: string;
+    }): Promise<{
+        id: string;
+        token: string;
+        expiresAt: string;
+    }>;
+    verify(token: string, audience: string): Promise<AuthenticatedGrant>;
+    /** Returns the token's identity when it was active and is now revoked; null otherwise. */
+    revoke(id: string): Promise<{
+        ownerId: string;
+        clientId: string;
+        clientName: string;
+    } | null>;
+    list(ownerId: string): Promise<Grant[]>;
+    owns(ownerId: string, id: string): Promise<boolean>;
+}
+export declare function createTokenStore(store: AppServerStore, prefix: string, ttlDays: number, allowedScopes: readonly string[]): TokenStore;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,YAAY,CAAC;AAGpE,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvK,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrE,0FAA0F;IAC1F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD;AAoBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAmCrI"}

package/dist/tokens.js

@@ -0,0 +1,61 @@
+import { AppServerError } from './types.js';
+import { nowIso, sha256Hex } from './util.js';
+function randomToken(prefix) {
+    return prefix + crypto.randomUUID().replace(/-/g, '') + crypto.randomUUID().replace(/-/g, '');
+}
+const toGrant = (row) => ({
+    id: row.id,
+    name: row.clientName,
+    ownerId: row.ownerId,
+    scopes: row.scopes,
+    clientId: row.clientId,
+    createdAt: row.createdAt,
+    expiresAt: row.expiresAt,
+    lastUsedAt: row.lastUsedAt || '',
+    revoked: row.revoked,
+    expired: !!row.expiresAt && row.expiresAt < nowIso(),
+    prefix: row.prefix,
+});
+export function createTokenStore(store, prefix, ttlDays, allowedScopes) {
+    const tokens = store.accessTokens;
+    return {
+        async issue(input) {
+            const scopes = input.scopes.filter((scope) => allowedScopes.includes(scope));
+            if (!scopes.length)
+                throw new AppServerError(400, 'Invalid token scopes');
+            const raw = randomToken(prefix);
+            const id = crypto.randomUUID();
+            const expiresAt = new Date(Date.now() + ttlDays * 86400 * 1000).toISOString();
+            await tokens.create({ id, hash: await sha256Hex(raw), prefix: raw.slice(0, 8), clientId: input.clientId, clientName: input.clientName.slice(0, 200), ownerId: input.ownerId, scopes, audience: input.audience, createdAt: nowIso(), expiresAt, lastUsedAt: null, revoked: false });
+            return { id, token: raw, expiresAt };
+        },
+        async verify(token, audience) {
+            const row = await tokens.getByHash(await sha256Hex(token));
+            if (!row)
+                throw new AppServerError(401, 'Invalid agent token');
+            if (row.revoked)
+                throw new AppServerError(401, 'Agent token revoked');
+            if (row.expiresAt && row.expiresAt < nowIso())
+                throw new AppServerError(401, 'Agent token expired');
+            if (row.audience !== audience)
+                throw new AppServerError(401, 'Agent token audience mismatch; authorize again');
+            await tokens.touch(row.id, nowIso());
+            return { grantId: row.id, ownerId: row.ownerId, scopes: row.scopes, clientId: row.clientId, clientName: row.clientName, audience };
+        },
+        async revoke(id) {
+            const row = await tokens.get(id);
+            if (!row)
+                return null;
+            const changed = await tokens.revoke(id);
+            return changed ? { ownerId: row.ownerId, clientId: row.clientId, clientName: row.clientName } : null;
+        },
+        async list(ownerId) {
+            return (await tokens.listByOwner(ownerId)).map(toGrant);
+        },
+        async owns(ownerId, id) {
+            const row = await tokens.get(id);
+            return !!row && row.ownerId === ownerId;
+        },
+    };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAW9C,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,GAAsB,EAAS,EAAE,CAAC,CAAC;IAClD,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,GAAG,CAAC,UAAU;IACpB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,SAAS,EAAE,GAAG,CAAC,SAAS;IACxB,SAAS,EAAE,GAAG,CAAC,SAAS;IACxB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;IAChC,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,MAAM,EAAE;IACpD,MAAM,EAAE,GAAG,CAAC,MAAM;CACnB,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAAC,KAAqB,EAAE,MAAc,EAAE,OAAe,EAAE,aAAgC;IACvH,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9E,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACnR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ;YAC1B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC/D,IAAI,GAAG,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACtE,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,MAAM,EAAE;gBAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACpG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;YAC/G,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;QACrI,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvG,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,152 @@
+import type { ZodRawShape } from 'zod';
+import type { AppServerStore } from './store.js';
+import type { RateLimitConfig } from './rate-limit.js';
+/** The user the host app recognizes on the consent page. `id` must be stable and never reused. */
+export interface Identity {
+    id: string;
+    displayName?: string;
+    email?: string;
+}
+/**
+ * The only contract between the host app and the server: given the consent-page request
+ * (whatever credential the host's own login puts on it), say who the current user is.
+ * Throw `AppServerError(401, …)` when nobody is signed in.
+ */
+export interface IdentityProvider {
+    resolve(request: Request): Promise<Identity>;
+}
+export interface ScopeDefinition {
+    /** Human-readable meaning shown on the consent page. */
+    description: string;
+    /** Always granted; the consent page cannot uncheck it (typically the read scope). */
+    required?: boolean;
+    /** Pre-checked on the consent page. Required scopes are always on. */
+    default?: boolean;
+}
+export interface ToolAnnotations {
+    readOnlyHint: boolean;
+    destructiveHint?: boolean;
+    idempotentHint?: boolean;
+    openWorldHint: boolean;
+}
+export interface ToolResult {
+    content: {
+        type: 'text';
+        text: string;
+    }[];
+    isError?: boolean;
+}
+/** Everything a tool handler may know about the caller. Nothing here comes from tool input. */
+export interface ToolContext {
+    ownerId: string;
+    scopes: string[];
+    grantId: string;
+    clientId: string;
+    clientName: string;
+    /** The MCP request; hosts that route tools through their own REST API can forward its Authorization header. */
+    request: Request;
+}
+export interface AgentTool {
+    name: string;
+    /** Scope required to see and call the tool; omit for tools any authorized agent may use. */
+    scope?: string;
+    description: string;
+    inputSchema: ZodRawShape;
+    annotations: ToolAnnotations;
+    handler: (args: Record<string, unknown>, ctx: ToolContext) => Promise<ToolResult>;
+}
+export interface Origins {
+    /** Where agents reach the server; written into metadata, `resource` and token audience. */
+    publicOrigin: string;
+    /** Where the consent page lives (may differ from publicOrigin during local development). */
+    webOrigin: string;
+}
+export type AppServerEvent = {
+    type: 'authorized' | 'refreshed' | 'revoked';
+    ownerId: string;
+    grantId: string;
+    clientId: string;
+    clientName: string;
+    scopes?: string[];
+} | {
+    type: 'tool';
+    ownerId: string;
+    grantId: string;
+    clientId: string;
+    clientName: string;
+    tool: string;
+    ok: boolean;
+};
+export interface Grant {
+    id: string;
+    name: string;
+    ownerId: string;
+    scopes: string[];
+    clientId: string;
+    createdAt: string;
+    expiresAt: string;
+    lastUsedAt: string;
+    revoked: boolean;
+    expired: boolean;
+    prefix: string;
+}
+/** Result of verifying an agent access token on any request (MCP or the host's own API). */
+export interface AuthenticatedGrant {
+    grantId: string;
+    ownerId: string;
+    scopes: string[];
+    clientId: string;
+    clientName: string;
+    audience: string;
+}
+export interface McpAppServerConfig {
+    /** MCP server name; also used in server.json. */
+    name: string;
+    version?: string;
+    /** All server routes hang here: `<basePath>/mcp`, `<basePath>/mcp/schema`, `<basePath>/oauth/*`. */
+    basePath: string;
+    /** Path on `webOrigin` that renders the consent page. Default `/oauth/authorize`. */
+    consentPath?: string;
+    /**
+     * Ordered scope catalogue; order is preserved in metadata and on the consent page. Optional:
+     * omit it when your app has no notion of delegated scopes — the server then uses one implicit
+     * required scope named after the server, the consent page is a plain allow/deny, and every
+     * tool is visible to every authorized agent. Authorization stays entirely in your handlers.
+     */
+    scopes?: Record<string, ScopeDefinition>;
+    identity: IdentityProvider;
+    tools: readonly AgentTool[];
+    /**
+     * Where clients, codes and tokens live. Implement `AppServerStore` over your own database, or use
+     * `memoryStore()` (dev/tests) or `sqlStore()` from `@ninomae/mcp-app-server/sql` (D1, SQLite).
+     */
+    storage: AppServerStore;
+    /** Static origins or derived per request (e.g. from Host + env). */
+    origins: Origins | ((request: Request) => Origins);
+    /** Access token lifetime in days (default 30) and refresh token lifetime (default 90). */
+    accessTokenDays?: number;
+    refreshTokenDays?: number;
+    /** Prefix for issued access tokens; lets the host recognize them on its own routes. Default `agt_`. */
+    tokenPrefix?: string;
+    /**
+     * Rate limit for `POST <base>/oauth/register`, the one unauthenticated endpoint that writes.
+     * Default: `memoryRateLimiter()` (20 per hour per IP, per process). Pass your platform's shared
+     * counter on multi-instance runtimes, or `false` to disable.
+     */
+    registrationLimit?: RateLimitConfig | false;
+    /** Audit hook. Never receives tool payloads. */
+    onEvent?: (event: AppServerEvent) => Promise<void> | void;
+    /** Let `initialize` / `tools/list` answer without a token so registries can inspect the server. Default true. */
+    anonymousDiscovery?: boolean;
+    /** Optional free-text contract (markdown) published with the schema and via a `*_get_contract`-style tool if the host wants one. */
+    contract?: string;
+}
+export declare class AppServerError extends Error {
+    status: number;
+    /** OAuth error code when the failure is reported through an OAuth response. */
+    code: string;
+    constructor(status: number, message: string, 
+    /** OAuth error code when the failure is reported through an OAuth response. */
+    code?: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,kGAAkG;AAClG,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,+GAA+G;IAC/G,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,eAAe,CAAC;IAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,OAAO;IACtB,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3I;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC;AAExH,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IAC5B;;;OAGG;IACH,OAAO,EAAE,cAAc,CAAC;IACxB,oEAAoE;IACpE,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IACnD,0FAA0F;IAC1F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAC5C,gDAAgD;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,iHAAiH;IACjH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oIAAoI;IACpI,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,cAAe,SAAQ,KAAK;IAE9B,MAAM,EAAE,MAAM;IAErB,+EAA+E;IACxE,IAAI,EAAE,MAAM;gBAHZ,MAAM,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;IACf,+EAA+E;IACxE,IAAI,GAAE,MAA6D;CAK7E"}

package/dist/types.js

@@ -0,0 +1,13 @@
+export class AppServerError extends Error {
+    status;
+    code;
+    constructor(status, message, 
+    /** OAuth error code when the failure is reported through an OAuth response. */
+    code = status === 401 ? 'invalid_token' : 'invalid_request') {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'AppServerError';
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AA4IA,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE9B;IAGA;IAJT,YACS,MAAc,EACrB,OAAe;IACf,+EAA+E;IACxE,OAAe,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB;QAE1E,KAAK,CAAC,OAAO,CAAC,CAAC;QALR,WAAM,GAAN,MAAM,CAAQ;QAGd,SAAI,GAAJ,IAAI,CAA+D;QAG1E,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}