@nodetool-ai/websocket 0.7.0-rc.22 → 0.8.1

package/dist/oauth/gate.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The one gate that decides whether the MCP OAuth flow exists on this
+ * server, and the `nta_` bearer decision built on it. `server.ts`'s auth
+ * hook, the AS route plugin, and the integration test all import these, so
+ * the challenge a 401 advertises, the routes the AS serves, and the tokens
+ * the hook accepts cannot disagree.
+ */
+export declare const MCP_OAUTH_DISABLE_ENV_VAR = "NODETOOL_DISABLE_MCP_OAUTH";
+/**
+ * The issuer base URL when the OAuth flow can actually complete, else null.
+ * Four conditions, all here and nowhere else: the escape hatch is unset,
+ * the `/mcp` mount is enabled (the AS must not issue for a resource that
+ * is not mounted), a public URL is configured, and the issuer is HTTPS or
+ * loopback (refused per request — there is no boot check).
+ */
+export declare function enabledPublicUrl(env?: NodeJS.ProcessEnv): string | null;
+/**
+ * The `WWW-Authenticate` challenge for an unauthenticated or invalid `/mcp`
+ * request — undefined whenever `enabledPublicUrl` says the flow cannot
+ * complete, so the server never advertises discovery documents the AS
+ * answers with 404.
+ */
+export declare function mcpBearerChallenge(error?: "invalid_token"): string | undefined;
+/**
+ * Decide an `nta_` bearer presentation. Grants only when the flow is
+ * enabled, the token verifies, the request targets `/mcp`, and the token's
+ * stored resource matches this deployment's canonical `/mcp` URI. Every
+ * other outcome denies; the challenge is attached only on `/mcp` — the
+ * design's "the `/mcp` path, and only it" rule.
+ */
+export declare function authenticateMcpAccessToken(token: string, pathname: string): Promise<{
+    ok: true;
+    userId: string;
+} | {
+    ok: false;
+    challenge: string | undefined;
+}>;
+//# sourceMappingURL=gate.d.ts.map

package/dist/oauth/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/oauth/gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,eAAO,MAAM,yBAAyB,+BAA+B,CAAC;AAEtE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAef;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,CAAC,EAAE,eAAe,GACtB,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CACN;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAC/C,CAkBA"}

package/dist/oauth/gate.js

@@ -0,0 +1,77 @@
+/**
+ * The one gate that decides whether the MCP OAuth flow exists on this
+ * server, and the `nta_` bearer decision built on it. `server.ts`'s auth
+ * hook, the AS route plugin, and the integration test all import these, so
+ * the challenge a 401 advertises, the routes the AS serves, and the tokens
+ * the hook accepts cannot disagree.
+ */
+import { McpOauthToken } from "@nodetool-ai/models";
+import { configuredMcpUrl, isMcpHttpEnabled } from "../lib/mcp-mount.js";
+import { buildBearerChallenge } from "./www-authenticate.js";
+import { canonicalResource } from "./validate.js";
+export const MCP_OAUTH_DISABLE_ENV_VAR = "NODETOOL_DISABLE_MCP_OAUTH";
+/**
+ * The issuer base URL when the OAuth flow can actually complete, else null.
+ * Four conditions, all here and nowhere else: the escape hatch is unset,
+ * the `/mcp` mount is enabled (the AS must not issue for a resource that
+ * is not mounted), a public URL is configured, and the issuer is HTTPS or
+ * loopback (refused per request — there is no boot check).
+ */
+export function enabledPublicUrl(env = process.env) {
+    if (env[MCP_OAUTH_DISABLE_ENV_VAR] === "1")
+        return null;
+    if (!isMcpHttpEnabled(env))
+        return null;
+    const mcpUrl = configuredMcpUrl(env);
+    if (!mcpUrl)
+        return null;
+    const publicUrl = mcpUrl.slice(0, -"/mcp".length);
+    try {
+        const url = new URL(publicUrl);
+        const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost";
+        if (url.protocol !== "https:" && !loopback)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return publicUrl;
+}
+/**
+ * The `WWW-Authenticate` challenge for an unauthenticated or invalid `/mcp`
+ * request — undefined whenever `enabledPublicUrl` says the flow cannot
+ * complete, so the server never advertises discovery documents the AS
+ * answers with 404.
+ */
+export function mcpBearerChallenge(error) {
+    const publicUrl = enabledPublicUrl();
+    if (!publicUrl)
+        return undefined;
+    return buildBearerChallenge({ publicUrl, error });
+}
+/**
+ * Decide an `nta_` bearer presentation. Grants only when the flow is
+ * enabled, the token verifies, the request targets `/mcp`, and the token's
+ * stored resource matches this deployment's canonical `/mcp` URI. Every
+ * other outcome denies; the challenge is attached only on `/mcp` — the
+ * design's "the `/mcp` path, and only it" rule.
+ */
+export async function authenticateMcpAccessToken(token, pathname) {
+    const deny = {
+        ok: false,
+        challenge: pathname.startsWith("/mcp")
+            ? mcpBearerChallenge("invalid_token")
+            : undefined
+    };
+    const publicUrl = enabledPublicUrl();
+    if (!publicUrl)
+        return deny;
+    const verified = await McpOauthToken.verifyAccess(token);
+    if (!verified ||
+        !pathname.startsWith("/mcp") ||
+        verified.resource !== canonicalResource(publicUrl)) {
+        return deny;
+    }
+    return { ok: true, userId: verified.userId };
+}
+//# sourceMappingURL=gate.js.map

package/dist/oauth/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/oauth/gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,CAAC,MAAM,yBAAyB,GAAG,4BAA4B,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;QAC/D,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAuB;IAEvB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EACb,QAAgB;IAKhB,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,KAAc;QAClB,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YACpC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC;YACrC,CAAC,CAAC,SAAS;KACd,CAAC;IACF,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACzD,IACE,CAAC,QAAQ;QACT,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,KAAK,iBAAiB,CAAC,SAAS,CAAC,EAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC"}

package/dist/oauth/metadata.d.ts

@@ -0,0 +1,35 @@
+/**
+ * OAuth discovery documents for the MCP resource server + authorization
+ * server: RFC 9728 protected resource metadata and RFC 8414 authorization
+ * server metadata.
+ *
+ * Pure functions — `publicUrl` is a parameter, never read from the
+ * environment. Callers derive `publicUrl` from `configuredMcpUrl()`
+ * (`lib/mcp-mount.ts`).
+ */
+/** RFC 9728 protected resource metadata document. */
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: string[];
+    resource_name: string;
+}
+/** RFC 8414 authorization server metadata document. */
+export interface AuthServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    revocation_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    scopes_supported: string[];
+    client_id_metadata_document_supported: boolean;
+    authorization_response_iss_parameter_supported: boolean;
+}
+export declare function buildProtectedResourceMetadata(publicUrl: string): ProtectedResourceMetadata;
+export declare function buildAuthServerMetadata(publicUrl: string): AuthServerMetadata;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/oauth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qDAAqD;AACrD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qCAAqC,EAAE,OAAO,CAAC;IAC/C,8CAA8C,EAAE,OAAO,CAAC;CACzD;AAqBD,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,GAChB,yBAAyB,CAS3B;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAgB7E"}

package/dist/oauth/metadata.js

@@ -0,0 +1,56 @@
+/**
+ * OAuth discovery documents for the MCP resource server + authorization
+ * server: RFC 9728 protected resource metadata and RFC 8414 authorization
+ * server metadata.
+ *
+ * Pure functions — `publicUrl` is a parameter, never read from the
+ * environment. Callers derive `publicUrl` from `configuredMcpUrl()`
+ * (`lib/mcp-mount.ts`).
+ */
+/**
+ * Normalize a public URL to its origin: lowercase scheme + host, no
+ * trailing slash, no query/hash. `publicUrl` is expected to carry no path
+ * beyond an optional trailing slash, but any path is preserved (trailing
+ * slash stripped) so a deployment mounted under a sub-path still works.
+ */
+function normalizeOrigin(publicUrl) {
+    const url = new URL(publicUrl);
+    const scheme = url.protocol.toLowerCase();
+    const host = url.host.toLowerCase();
+    let path = url.pathname;
+    if (path === "/") {
+        path = "";
+    }
+    else if (path.endsWith("/")) {
+        path = path.slice(0, -1);
+    }
+    return `${scheme}//${host}${path}`;
+}
+export function buildProtectedResourceMetadata(publicUrl) {
+    const base = normalizeOrigin(publicUrl);
+    return {
+        resource: `${base}/mcp`,
+        authorization_servers: [base],
+        scopes_supported: ["mcp"],
+        bearer_methods_supported: ["header"],
+        resource_name: "NodeTool MCP"
+    };
+}
+export function buildAuthServerMetadata(publicUrl) {
+    const base = normalizeOrigin(publicUrl);
+    return {
+        issuer: base,
+        authorization_endpoint: `${base}/oauth/authorize`,
+        token_endpoint: `${base}/oauth/token`,
+        registration_endpoint: `${base}/oauth/register`,
+        revocation_endpoint: `${base}/oauth/revoke`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: ["mcp"],
+        client_id_metadata_document_supported: true,
+        authorization_response_iss_parameter_supported: true
+    };
+}
+//# sourceMappingURL=metadata.js.map

package/dist/oauth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/oauth/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2BH;;;;;GAKG;AACH,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IACxB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,SAAiB;IAEjB,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,QAAQ,EAAE,GAAG,IAAI,MAAM;QACvB,qBAAqB,EAAE,CAAC,IAAI,CAAC;QAC7B,gBAAgB,EAAE,CAAC,KAAK,CAAC;QACzB,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,sBAAsB,EAAE,GAAG,IAAI,kBAAkB;QACjD,cAAc,EAAE,GAAG,IAAI,cAAc;QACrC,qBAAqB,EAAE,GAAG,IAAI,iBAAiB;QAC/C,mBAAmB,EAAE,GAAG,IAAI,eAAe;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,KAAK,CAAC;QACzB,qCAAqC,EAAE,IAAI;QAC3C,8CAA8C,EAAE,IAAI;KACrD,CAAC;AACJ,CAAC"}

package/dist/oauth/pending-store.d.ts

@@ -0,0 +1,79 @@
+/**
+ * In-memory, TTL-swept store for the two short-lived, non-durable pieces of
+ * OAuth authorize-flow state: the pending `/oauth/authorize` request parked
+ * while the user is on the consent page, and the authorization code minted
+ * on approval. Models `oauthStateStore` in `../oauth-api.ts` — same
+ * lazy-prune-on-access pattern, no timer.
+ *
+ * Losing this store on restart costs one browser round-trip; nothing here
+ * is durable and nothing needs a migration.
+ */
+export interface PendingAuthorizeRequest {
+    /** request_id handed to the SPA consent page. */
+    id: string;
+    clientId: string;
+    clientName: string;
+    redirectUri: string;
+    codeChallenge: string;
+    scope: "mcp";
+    resource: string;
+    state?: string;
+    /** Every registered redirect_uri for this client is loopback-only. */
+    redirectHostIsLoopbackOnly: boolean;
+    createdAt: number;
+}
+/** What a code redeems to: the request it was minted for, who approved it,
+ * and whether it had already been spent. */
+export interface CodeRedemption {
+    request: PendingAuthorizeRequest;
+    userId: string;
+    grantId: string;
+    consumedBefore: boolean;
+}
+export declare class PendingStore {
+    private readonly requests;
+    private readonly codes;
+    private pruneRequests;
+    private pruneCodes;
+    /** Park a validated `/oauth/authorize` request. Returns its request_id. */
+    putRequest(r: Omit<PendingAuthorizeRequest, "id" | "createdAt">): string;
+    /** Read a pending request without consuming it (renders the consent page). */
+    takeRequestForApproval(id: string): PendingAuthorizeRequest | null;
+    /** Consume a pending request — approve/deny each call this exactly once. */
+    consumeRequest(id: string): PendingAuthorizeRequest | null;
+    /**
+     * Mint an authorization code for an approved request. Returns the code.
+     * `grantId` is the consent record the approval created — the token
+     * endpoint mints tokens for exactly that grant, and revokes it on code
+     * replay, so consent and redemption never produce two grant rows.
+     */
+    putCode(input: {
+        request: PendingAuthorizeRequest;
+        userId: string;
+        grantId: string;
+    }): string;
+    /** The live entry for a code, or null when it is unknown or expired. */
+    private liveEntry;
+    /**
+     * Read a code's entry without consuming it, so the token endpoint can check
+     * every binding the code carries — client_id, redirect_uri, PKCE, resource —
+     * before spending it. Redeeming first let anyone holding a leaked code burn
+     * it with one bad exchange: the legitimate client's exchange then looked
+     * like a replay and revoked the grant.
+     */
+    peekCode(code: string): CodeRedemption | null;
+    /**
+     * Consume an authorization code at the token endpoint. `consumedBefore`
+     * is true when this code was already consumed once — the OAuth 2.1 code
+     * replay rule: the caller must revoke every token minted from this code.
+     *
+     * The replay signal lives only as long as the code entry (CODE_TTL_MS):
+     * a replay arriving after the prune window returns plain null and revokes
+     * nothing. Accepted narrowing — a leaked code is valuable immediately or
+     * not at all, and the 10-minute window covers the realistic race.
+     */
+    consumeCode(code: string): CodeRedemption | null;
+}
+/** Module singleton — one process, one AS. */
+export declare const pendingStore: PendingStore;
+//# sourceMappingURL=pending-store.d.ts.map

package/dist/oauth/pending-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.d.ts","sourceRoot":"","sources":["../../src/oauth/pending-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,WAAW,uBAAuB;IACtC,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,0BAA0B,EAAE,OAAO,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAUD;4CAC4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,uBAAuB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;CACzB;AAWD,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8C;IACvE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEtD,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,UAAU;IASlB,2EAA2E;IAC3E,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG,MAAM,CAKvE;IAED,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAWjE;IAED,4EAA4E;IAC5E,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAMzD;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE;QACb,OAAO,EAAE,uBAAuB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,MAAM,CAWT;IAED,wEAAwE;IACxE,OAAO,CAAC,SAAS;IAajB;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAG5C;IAED;;;;;;;;;OASG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAQ/C;CACF;AAED,8CAA8C;AAC9C,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/oauth/pending-store.js

@@ -0,0 +1,133 @@
+/**
+ * In-memory, TTL-swept store for the two short-lived, non-durable pieces of
+ * OAuth authorize-flow state: the pending `/oauth/authorize` request parked
+ * while the user is on the consent page, and the authorization code minted
+ * on approval. Models `oauthStateStore` in `../oauth-api.ts` — same
+ * lazy-prune-on-access pattern, no timer.
+ *
+ * Losing this store on restart costs one browser round-trip; nothing here
+ * is durable and nothing needs a migration.
+ */
+import { randomBytes } from "node:crypto";
+const REQUEST_TTL_MS = 600_000; // 10 minutes
+const CODE_TTL_MS = 600_000; // 10 minutes
+function redemption(entry) {
+    return {
+        request: entry.request,
+        userId: entry.userId,
+        grantId: entry.grantId,
+        consumedBefore: entry.consumed
+    };
+}
+export class PendingStore {
+    requests = new Map();
+    codes = new Map();
+    pruneRequests() {
+        const now = Date.now();
+        for (const [id, request] of this.requests) {
+            if (now - request.createdAt > REQUEST_TTL_MS) {
+                this.requests.delete(id);
+            }
+        }
+    }
+    pruneCodes() {
+        const now = Date.now();
+        for (const [code, entry] of this.codes) {
+            if (now - entry.createdAt > CODE_TTL_MS) {
+                this.codes.delete(code);
+            }
+        }
+    }
+    /** Park a validated `/oauth/authorize` request. Returns its request_id. */
+    putRequest(r) {
+        this.pruneRequests();
+        const id = randomBytes(16).toString("hex");
+        this.requests.set(id, { ...r, id, createdAt: Date.now() });
+        return id;
+    }
+    /** Read a pending request without consuming it (renders the consent page). */
+    takeRequestForApproval(id) {
+        this.pruneRequests();
+        const request = this.requests.get(id) ?? null;
+        if (!request) {
+            return null;
+        }
+        if (Date.now() - request.createdAt > REQUEST_TTL_MS) {
+            this.requests.delete(id);
+            return null;
+        }
+        return request;
+    }
+    /** Consume a pending request — approve/deny each call this exactly once. */
+    consumeRequest(id) {
+        const request = this.takeRequestForApproval(id);
+        if (request) {
+            this.requests.delete(id);
+        }
+        return request;
+    }
+    /**
+     * Mint an authorization code for an approved request. Returns the code.
+     * `grantId` is the consent record the approval created — the token
+     * endpoint mints tokens for exactly that grant, and revokes it on code
+     * replay, so consent and redemption never produce two grant rows.
+     */
+    putCode(input) {
+        this.pruneCodes();
+        const code = randomBytes(32).toString("base64url");
+        this.codes.set(code, {
+            request: input.request,
+            userId: input.userId,
+            grantId: input.grantId,
+            createdAt: Date.now(),
+            consumed: false
+        });
+        return code;
+    }
+    /** The live entry for a code, or null when it is unknown or expired. */
+    liveEntry(code) {
+        this.pruneCodes();
+        const entry = this.codes.get(code);
+        if (!entry) {
+            return null;
+        }
+        if (Date.now() - entry.createdAt > CODE_TTL_MS) {
+            this.codes.delete(code);
+            return null;
+        }
+        return entry;
+    }
+    /**
+     * Read a code's entry without consuming it, so the token endpoint can check
+     * every binding the code carries — client_id, redirect_uri, PKCE, resource —
+     * before spending it. Redeeming first let anyone holding a leaked code burn
+     * it with one bad exchange: the legitimate client's exchange then looked
+     * like a replay and revoked the grant.
+     */
+    peekCode(code) {
+        const entry = this.liveEntry(code);
+        return entry ? redemption(entry) : null;
+    }
+    /**
+     * Consume an authorization code at the token endpoint. `consumedBefore`
+     * is true when this code was already consumed once — the OAuth 2.1 code
+     * replay rule: the caller must revoke every token minted from this code.
+     *
+     * The replay signal lives only as long as the code entry (CODE_TTL_MS):
+     * a replay arriving after the prune window returns plain null and revokes
+     * nothing. Accepted narrowing — a leaked code is valuable immediately or
+     * not at all, and the 10-minute window covers the realistic race.
+     */
+    consumeCode(code) {
+        const entry = this.liveEntry(code);
+        if (!entry) {
+            return null;
+        }
+        const consumedBefore = entry.consumed;
+        entry.consumed = true;
+        return { ...redemption(entry), consumedBefore };
+    }
+}
+/** Module singleton — one process, one AS. */
+export const pendingStore = new PendingStore();
+//# sourceMappingURL=pending-store.js.map

package/dist/oauth/pending-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.js","sourceRoot":"","sources":["../../src/oauth/pending-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,aAAa;AAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,aAAa;AAkC1C,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,YAAY;IACN,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE9C,aAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;gBAC7C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,UAAU,CAAC,CAAoD;QAC7D,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8EAA8E;IAC9E,sBAAsB,CAAC,EAAU;QAC/B,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAC5E,cAAc,CAAC,EAAU;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAIP;QACC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IAChE,SAAS,CAAC,IAAY;QAC5B,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,IAAY;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED;;;;;;;;;OASG;IACH,WAAW,CAAC,IAAY;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;QACtC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IAClD,CAAC;CACF;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC"}

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,16 @@
+/**
+ * PKCE (RFC 7636) S256 verification for the token endpoint.
+ *
+ * `PKCEHelper` (`@nodetool-ai/runtime/oauth`, `providers/oauth/pkce-helper.ts`)
+ * derives `code_challenge = BASE64URL(SHA-256(code_verifier))` the same way,
+ * but its methods are async (it also generates verifiers/state via an
+ * injectable CSPRNG). The token endpoint needs a synchronous, constant-time
+ * *comparison* of a caller-supplied verifier against a stored challenge, so
+ * this reimplements the same derivation — ascii-encoded input, base64url
+ * digest, matching `PKCEHelper.createCodeChallenge` byte for byte — and
+ * compares with `timingSafeEqual` rather than round-tripping through the
+ * async helper.
+ */
+/** Constant-time S256 PKCE verification. */
+export declare function verifyS256(codeVerifier: string, codeChallenge: string): boolean;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAO/E"}

package/dist/oauth/pkce.js

@@ -0,0 +1,29 @@
+/**
+ * PKCE (RFC 7636) S256 verification for the token endpoint.
+ *
+ * `PKCEHelper` (`@nodetool-ai/runtime/oauth`, `providers/oauth/pkce-helper.ts`)
+ * derives `code_challenge = BASE64URL(SHA-256(code_verifier))` the same way,
+ * but its methods are async (it also generates verifiers/state via an
+ * injectable CSPRNG). The token endpoint needs a synchronous, constant-time
+ * *comparison* of a caller-supplied verifier against a stored challenge, so
+ * this reimplements the same derivation — ascii-encoded input, base64url
+ * digest, matching `PKCEHelper.createCodeChallenge` byte for byte — and
+ * compares with `timingSafeEqual` rather than round-tripping through the
+ * async helper.
+ */
+import { createHash, timingSafeEqual } from "node:crypto";
+function deriveS256Challenge(codeVerifier) {
+    return createHash("sha256")
+        .update(codeVerifier, "ascii")
+        .digest("base64url");
+}
+/** Constant-time S256 PKCE verification. */
+export function verifyS256(codeVerifier, codeChallenge) {
+    const expected = Buffer.from(deriveS256Challenge(codeVerifier));
+    const actual = Buffer.from(codeChallenge);
+    if (expected.length !== actual.length) {
+        return false;
+    }
+    return timingSafeEqual(expected, actual);
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,SAAS,mBAAmB,CAAC,YAAoB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;SAC7B,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,aAAqB;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/dist/oauth/validate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Structural checks shared by the authorize and token endpoints: redirect
+ * URI allowlisting, resource-indicator (RFC 8707) matching, and scope.
+ */
+/**
+ * A redirect URI is allowed when it is `https://…`, or `http://` to a
+ * loopback host (`127.0.0.1` or `localhost`, any port).
+ */
+export declare function isAllowedRedirectUri(uri: string): boolean;
+/** The canonical `/mcp` resource URI for this deployment. */
+export declare function canonicalResource(publicUrl: string): string;
+/**
+ * A `resource` parameter matches when absent (client didn't send one — ok,
+ * per RFC 8707 the parameter is optional) or when it equals the canonical
+ * `/mcp` resource for this deployment exactly.
+ */
+export declare function resourceMatches(requested: string | undefined, publicUrl: string): boolean;
+/** The one scope this AS issues. Absent/empty defaults to it. */
+export declare function validateScope(scope: string | undefined): {
+    ok: true;
+    scope: "mcp";
+} | {
+    ok: false;
+};
+//# sourceMappingURL=validate.d.ts.map

package/dist/oauth/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/oauth/validate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAczD;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAChB,OAAO,CAKT;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAK5C"}

package/dist/oauth/validate.js

@@ -0,0 +1,62 @@
+/**
+ * Structural checks shared by the authorize and token endpoints: redirect
+ * URI allowlisting, resource-indicator (RFC 8707) matching, and scope.
+ */
+/** Lowercase scheme + host, no trailing slash — mirrors metadata.ts. */
+function normalizeOrigin(publicUrl) {
+    const url = new URL(publicUrl);
+    const scheme = url.protocol.toLowerCase();
+    const host = url.host.toLowerCase();
+    let path = url.pathname;
+    if (path === "/") {
+        path = "";
+    }
+    else if (path.endsWith("/")) {
+        path = path.slice(0, -1);
+    }
+    return `${scheme}//${host}${path}`;
+}
+const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "localhost"]);
+/**
+ * A redirect URI is allowed when it is `https://…`, or `http://` to a
+ * loopback host (`127.0.0.1` or `localhost`, any port).
+ */
+export function isAllowedRedirectUri(uri) {
+    let url;
+    try {
+        url = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === "https:") {
+        return true;
+    }
+    if (url.protocol === "http:") {
+        return LOOPBACK_HOSTNAMES.has(url.hostname.toLowerCase());
+    }
+    return false;
+}
+/** The canonical `/mcp` resource URI for this deployment. */
+export function canonicalResource(publicUrl) {
+    return `${normalizeOrigin(publicUrl)}/mcp`;
+}
+/**
+ * A `resource` parameter matches when absent (client didn't send one — ok,
+ * per RFC 8707 the parameter is optional) or when it equals the canonical
+ * `/mcp` resource for this deployment exactly.
+ */
+export function resourceMatches(requested, publicUrl) {
+    if (requested === undefined) {
+        return true;
+    }
+    return requested === canonicalResource(publicUrl);
+}
+/** The one scope this AS issues. Absent/empty defaults to it. */
+export function validateScope(scope) {
+    if (scope === undefined || scope === "" || scope === "mcp") {
+        return { ok: true, scope: "mcp" };
+    }
+    return { ok: false };
+}
+//# sourceMappingURL=validate.js.map

package/dist/oauth/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/oauth/validate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wEAAwE;AACxE,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IACxB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE/D;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA6B,EAC7B,SAAiB;IAEjB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,KAAK,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAC3B,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC"}

package/dist/oauth/www-authenticate.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `WWW-Authenticate` challenge for an unauthenticated or invalid request to
+ * `/mcp`, per the MCP authorization spec § "WWW-Authenticate".
+ */
+export declare function buildBearerChallenge(input: {
+    publicUrl: string;
+    error?: "invalid_token";
+}): string;
+//# sourceMappingURL=www-authenticate.d.ts.map

package/dist/oauth/www-authenticate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"www-authenticate.d.ts","sourceRoot":"","sources":["../../src/oauth/www-authenticate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB,GAAG,MAAM,CAaT"}