@noodleseed/one 0.128.0 → 0.129.0

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.75.0",
+  "version": "0.76.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -28,7 +28,7 @@
     "@noodle-borg/module": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.19.0"
+    "@noodleseed/assistant": "1.20.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.1",

package/node_modules/@noodle-borg/auth/dist/index.d.ts

@@ -12,6 +12,7 @@ export { type DiscoveredIssuerMetadata, discoverIssuerMetadata, type IssuerMetad
 export { type AccessTokenClaims, mintAccessToken } from './jwt-issuer.js';
 export { type BearerChallenge, canonicalScopes, McpOAuthClient, type McpOAuthClientOptions, type McpOAuthClientRegistration, type McpOAuthDiscovery, type McpOAuthPendingAuthorization, type McpOAuthTokens, parseBearerChallenge, } from './mcp-oauth-client.js';
 export { type ProtectedResourceMetadata, protectedResourceMetadata, protectedResourceMetadataUrl, } from './metadata.js';
+export { classifyStoredOAuthRedirectPolicy, matchOAuthAuthorizationRedirect, type NormalizedOAuthRedirectClientMetadata, normalizeOAuthClientMetadata, type OAuthApplicationType, type OAuthRedirectClientMetadata, type OAuthRedirectMatchResult, OAuthRedirectPolicyError, type OAuthRedirectPolicyErrorReason, type OAuthTokenEndpointAuthMethod, type StoredRedirectPolicyClass, } from './oauth-client-redirect-policy.js';
 export { createStaticSigningKeyProvider, type SigningKey, type SigningKeyProvider, type StaticSigningKeyOptions, } from './signer.js';
 export { createJwtVerifier, type JwtVerifierConfig, type TokenVerifier, type VerifiedIdentity, type VerifiedServicePrincipalBinding, type VerifiedTokenEnvelope, } from './verify.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/auth/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,qBAAqB,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,4BAA4B,EAC5B,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,KAAK,eAAe,EACpB,eAAe,EACf,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,yBAAyB,EAC9B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,EAC9B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,EACpC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,qBAAqB,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,4BAA4B,EAC5B,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,KAAK,eAAe,EACpB,eAAe,EACf,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,yBAAyB,EAC9B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,qCAAqC,EAC1C,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,8BAA8B,EAC9B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,EACpC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC"}

package/node_modules/@noodle-borg/auth/dist/index.js

@@ -12,6 +12,7 @@ export { discoverIssuerMetadata, issuerMetadataCandidates, } from './discovery.j
 export { mintAccessToken } from './jwt-issuer.js';
 export { canonicalScopes, McpOAuthClient, parseBearerChallenge, } from './mcp-oauth-client.js';
 export { protectedResourceMetadata, protectedResourceMetadataUrl, } from './metadata.js';
+export { classifyStoredOAuthRedirectPolicy, matchOAuthAuthorizationRedirect, normalizeOAuthClientMetadata, OAuthRedirectPolicyError, } from './oauth-client-redirect-policy.js';
 export { createStaticSigningKeyProvider, } from './signer.js';
 export { createJwtVerifier, } from './verify.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/auth/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,4BAA4B,EAC5B,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,sBAAsB,EAGtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA0B,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAEL,eAAe,EACf,cAAc,EAMd,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,GAI/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,GAMlB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,oCAAoC,EACpC,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,4BAA4B,EAC5B,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,sBAAsB,EAGtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA0B,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAEL,eAAe,EACf,cAAc,EAMd,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAE/B,4BAA4B,EAI5B,wBAAwB,GAIzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,8BAA8B,GAI/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,GAMlB,MAAM,aAAa,CAAC"}

package/node_modules/@noodle-borg/auth/dist/oauth-client-redirect-policy.d.ts

@@ -0,0 +1,34 @@
+export type OAuthApplicationType = 'web' | 'native';
+export type OAuthTokenEndpointAuthMethod = 'none' | 'client_secret_post';
+export type StoredRedirectPolicyClass = 'normalized' | 'safe_https' | 'safe_loopback_legacy' | 'unsafe_legacy' | 'malformed_legacy';
+export interface OAuthRedirectClientMetadata {
+    application_type?: unknown;
+    redirect_uris?: unknown;
+    token_endpoint_auth_method?: unknown;
+    noodle_redirect_policy_version?: unknown;
+}
+export interface NormalizedOAuthRedirectClientMetadata {
+    application_type: OAuthApplicationType;
+    redirect_uris: readonly string[];
+    token_endpoint_auth_method: OAuthTokenEndpointAuthMethod;
+    noodle_redirect_policy_version: 1;
+}
+export interface OAuthRedirectMatchResult {
+    allowed: boolean;
+    usedLegacyLoopbackPortSubstitution: boolean;
+    reason: 'exact_match' | 'native_loopback_port_match' | 'legacy_loopback_port_match' | 'unregistered_redirect' | 'unsafe_legacy_redirect' | 'malformed_client_metadata';
+}
+export type OAuthRedirectPolicyErrorReason = 'invalid_application_type' | 'invalid_redirect_uris' | 'unsafe_redirect_uri' | 'unsupported_token_endpoint_auth_method';
+/** A closed registration-policy error suitable for mapping to OAuth invalid_client_metadata. */
+export declare class OAuthRedirectPolicyError extends Error {
+    readonly reason: OAuthRedirectPolicyErrorReason;
+    constructor(reason: OAuthRedirectPolicyErrorReason);
+}
+export declare function normalizeOAuthClientMetadata(metadata: OAuthRedirectClientMetadata): NormalizedOAuthRedirectClientMetadata;
+export declare function classifyStoredOAuthRedirectPolicy(metadata: OAuthRedirectClientMetadata): StoredRedirectPolicyClass;
+export declare function matchOAuthAuthorizationRedirect(args: {
+    client: OAuthRedirectClientMetadata;
+    requestedRedirectUri?: string;
+    allowLegacyLoopbackPortSubstitution: boolean;
+}): OAuthRedirectMatchResult;
+//# sourceMappingURL=oauth-client-redirect-policy.d.ts.map

package/node_modules/@noodle-borg/auth/dist/oauth-client-redirect-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-redirect-policy.d.ts","sourceRoot":"","sources":["../src/oauth-client-redirect-policy.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,QAAQ,CAAC;AACpD,MAAM,MAAM,4BAA4B,GAAG,MAAM,GAAG,oBAAoB,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GACjC,YAAY,GACZ,YAAY,GACZ,sBAAsB,GACtB,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,8BAA8B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,qCAAqC;IACpD,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0BAA0B,EAAE,4BAA4B,CAAC;IACzD,8BAA8B,EAAE,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,kCAAkC,EAAE,OAAO,CAAC;IAC5C,MAAM,EACF,aAAa,GACb,4BAA4B,GAC5B,4BAA4B,GAC5B,uBAAuB,GACvB,wBAAwB,GACxB,2BAA2B,CAAC;CACjC;AAED,MAAM,MAAM,8BAA8B,GACtC,0BAA0B,GAC1B,uBAAuB,GACvB,qBAAqB,GACrB,wCAAwC,CAAC;AAE7C,gGAAgG;AAChG,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,MAAM,EAAE,8BAA8B;gBAAtC,MAAM,EAAE,8BAA8B;CAI5D;AAsBD,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,2BAA2B,GACpC,qCAAqC,CAwBvC;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,2BAA2B,GACpC,yBAAyB,CAmB3B;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,MAAM,EAAE,2BAA2B,CAAC;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mCAAmC,EAAE,OAAO,CAAC;CAC9C,GAAG,wBAAwB,CAyC3B"}

package/node_modules/@noodle-borg/auth/dist/oauth-client-redirect-policy.js

@@ -0,0 +1,230 @@
+/** A closed registration-policy error suitable for mapping to OAuth invalid_client_metadata. */
+export class OAuthRedirectPolicyError extends Error {
+    reason;
+    constructor(reason) {
+        super(`OAuth client metadata rejected: ${reason}`);
+        this.reason = reason;
+        this.name = 'OAuthRedirectPolicyError';
+    }
+}
+const PERMITTED_LOOPBACK_HOSTS = new Set(['127.0.0.1', '[::1]', 'localhost']);
+export function normalizeOAuthClientMetadata(metadata) {
+    const applicationType = applicationTypeForRegistration(metadata.application_type);
+    const tokenEndpointAuthMethod = tokenEndpointAuthMethodForRegistration(metadata.token_endpoint_auth_method);
+    const redirectUris = redirectUrisForRegistration(metadata.redirect_uris);
+    const parsedRedirects = redirectUris.map(parseRedirect);
+    if (parsedRedirects.some((redirect) => !isSafeRedirect(redirect))) {
+        throw new OAuthRedirectPolicyError('unsafe_redirect_uri');
+    }
+    if (metadata.application_type === 'web' &&
+        parsedRedirects.some((redirect) => redirect.kind !== 'parsed' || redirect.channel !== 'https')) {
+        throw new OAuthRedirectPolicyError('unsafe_redirect_uri');
+    }
+    return {
+        application_type: applicationType,
+        redirect_uris: redirectUris,
+        token_endpoint_auth_method: tokenEndpointAuthMethod,
+        noodle_redirect_policy_version: 1,
+    };
+}
+export function classifyStoredOAuthRedirectPolicy(metadata) {
+    if (hasExplicitApplicationType(metadata) && isNormalizedStoredRecord(metadata))
+        return 'normalized';
+    if (isMarkedOmittedTypeCompatibleRecord(metadata))
+        return 'normalized';
+    const redirects = redirectUrisForStoredRecord(metadata.redirect_uris);
+    if (redirects === undefined)
+        return 'malformed_legacy';
+    const parsedRedirects = redirects.map(parseRedirect);
+    if (parsedRedirects.some((redirect) => redirect.kind === 'malformed')) {
+        return 'malformed_legacy';
+    }
+    if (!hasExplicitApplicationType(metadata)) {
+        if (parsedRedirects.every((redirect) => isSafeHttpsRedirect(redirect)))
+            return 'safe_https';
+        if (parsedRedirects.every(isSafeRedirect) && parsedRedirects.some(isLoopbackHttpRedirect)) {
+            return 'safe_loopback_legacy';
+        }
+    }
+    return 'unsafe_legacy';
+}
+export function matchOAuthAuthorizationRedirect(args) {
+    const policyClass = classifyStoredOAuthRedirectPolicy(args.client);
+    if (policyClass === 'malformed_legacy')
+        return rejected('malformed_client_metadata');
+    const redirectUris = redirectUrisForStoredRecord(args.client.redirect_uris);
+    if (redirectUris === undefined)
+        return rejected('malformed_client_metadata');
+    if (args.requestedRedirectUri !== undefined && redirectUris.includes(args.requestedRedirectUri)) {
+        return allowed('exact_match');
+    }
+    if (policyClass === 'unsafe_legacy')
+        return rejected('unsafe_legacy_redirect');
+    if (args.requestedRedirectUri === undefined)
+        return rejected('unregistered_redirect');
+    const requested = parseRedirect(args.requestedRedirectUri);
+    const registered = redirectUris.map(parseRedirect);
+    if (policyClass === 'normalized') {
+        if (args.client.application_type === 'native' &&
+            registered.some((redirect) => loopbackRedirectsMatchIgnoringPort(redirect, requested))) {
+            return allowed('native_loopback_port_match');
+        }
+        return rejected('unregistered_redirect');
+    }
+    if (policyClass === 'safe_loopback_legacy' &&
+        args.allowLegacyLoopbackPortSubstitution &&
+        registered.some((redirect) => loopbackRedirectsMatchIgnoringPort(redirect, requested))) {
+        const matched = registered.find((redirect) => loopbackRedirectsMatchIgnoringPort(redirect, requested));
+        return {
+            allowed: true,
+            usedLegacyLoopbackPortSubstitution: matched?.kind === 'parsed' &&
+                requested.kind === 'parsed' &&
+                matched.port !== requested.port,
+            reason: 'legacy_loopback_port_match',
+        };
+    }
+    return rejected('unregistered_redirect');
+}
+function applicationTypeForRegistration(value) {
+    if (value === undefined)
+        return 'web';
+    if (value === 'web' || value === 'native')
+        return value;
+    throw new OAuthRedirectPolicyError('invalid_application_type');
+}
+function tokenEndpointAuthMethodForRegistration(value) {
+    if (value === undefined)
+        return 'client_secret_post';
+    if (value === 'none' || value === 'client_secret_post')
+        return value;
+    throw new OAuthRedirectPolicyError('unsupported_token_endpoint_auth_method');
+}
+function redirectUrisForRegistration(value) {
+    const redirects = redirectUrisForStoredRecord(value);
+    if (redirects === undefined)
+        throw new OAuthRedirectPolicyError('invalid_redirect_uris');
+    return redirects;
+}
+function redirectUrisForStoredRecord(value) {
+    if (!Array.isArray(value) ||
+        value.length === 0 ||
+        !value.every((redirect) => typeof redirect === 'string')) {
+        return undefined;
+    }
+    return value;
+}
+function parseRedirect(value) {
+    if (typeof value !== 'string')
+        return { kind: 'malformed' };
+    try {
+        const url = new URL(value);
+        const submittedHostname = submittedHostnameFromRedirect(value);
+        const effectiveHostname = url.hostname.toLowerCase();
+        const isLoopbackHttp = url.protocol === 'http:' &&
+            submittedHostname !== undefined &&
+            submittedHostname === effectiveHostname &&
+            PERMITTED_LOOPBACK_HOSTS.has(effectiveHostname);
+        return {
+            kind: 'parsed',
+            raw: value,
+            href: url.href,
+            protocol: url.protocol,
+            hostname: effectiveHostname,
+            port: url.port,
+            pathname: url.pathname,
+            search: url.search,
+            hasCredentials: url.username !== '' || url.password !== '',
+            hasFragment: value.includes('#'),
+            channel: url.protocol === 'https:' ? 'https' : isLoopbackHttp ? 'loopback_http' : 'unsupported',
+        };
+    }
+    catch {
+        return { kind: 'malformed' };
+    }
+}
+function hasExplicitApplicationType(metadata) {
+    return metadata.application_type !== undefined;
+}
+function isNormalizedStoredRecord(metadata) {
+    try {
+        const applicationType = applicationTypeForRegistration(metadata.application_type);
+        tokenEndpointAuthMethodForRegistration(metadata.token_endpoint_auth_method);
+        const redirects = redirectUrisForStoredRecord(metadata.redirect_uris);
+        if (redirects === undefined)
+            return false;
+        const parsedRedirects = redirects.map(parseRedirect);
+        return applicationType === 'web'
+            ? parsedRedirects.every(isSafeHttpsRedirect)
+            : parsedRedirects.every(isSafeRedirect);
+    }
+    catch {
+        return false;
+    }
+}
+function isMarkedOmittedTypeCompatibleRecord(metadata) {
+    if (metadata.noodle_redirect_policy_version !== 1 || metadata.application_type !== 'web') {
+        return false;
+    }
+    try {
+        tokenEndpointAuthMethodForRegistration(metadata.token_endpoint_auth_method);
+        const redirects = redirectUrisForStoredRecord(metadata.redirect_uris);
+        if (redirects === undefined)
+            return false;
+        const parsedRedirects = redirects.map(parseRedirect);
+        return parsedRedirects.every(isSafeRedirect) && parsedRedirects.some(isLoopbackHttpRedirect);
+    }
+    catch {
+        return false;
+    }
+}
+function submittedHostnameFromRedirect(value) {
+    const authorityStart = value.indexOf('://');
+    if (authorityStart === -1)
+        return undefined;
+    const afterScheme = value.slice(authorityStart + 3);
+    const authorityEnd = afterScheme.search(/[/?#]/);
+    const authority = authorityEnd === -1 ? afterScheme : afterScheme.slice(0, authorityEnd);
+    const hostAndPort = authority.slice(authority.lastIndexOf('@') + 1);
+    if (hostAndPort.startsWith('[')) {
+        const closingBracket = hostAndPort.indexOf(']');
+        return closingBracket === -1
+            ? undefined
+            : hostAndPort.slice(0, closingBracket + 1).toLowerCase();
+    }
+    return hostAndPort
+        .slice(0, hostAndPort.indexOf(':') === -1 ? undefined : hostAndPort.indexOf(':'))
+        .toLowerCase();
+}
+function isSafeRedirect(redirect) {
+    return (redirect.kind === 'parsed' &&
+        !redirect.hasCredentials &&
+        !redirect.hasFragment &&
+        (redirect.channel === 'https' || redirect.channel === 'loopback_http'));
+}
+function isSafeHttpsRedirect(redirect) {
+    return (redirect.kind === 'parsed' &&
+        !redirect.hasCredentials &&
+        !redirect.hasFragment &&
+        redirect.channel === 'https');
+}
+function isLoopbackHttpRedirect(redirect) {
+    return (redirect.kind === 'parsed' &&
+        !redirect.hasCredentials &&
+        !redirect.hasFragment &&
+        redirect.channel === 'loopback_http');
+}
+function loopbackRedirectsMatchIgnoringPort(left, right) {
+    return (isLoopbackHttpRedirect(left) &&
+        isLoopbackHttpRedirect(right) &&
+        left.protocol === right.protocol &&
+        left.hostname === right.hostname &&
+        left.pathname === right.pathname &&
+        left.search === right.search);
+}
+function allowed(reason) {
+    return { allowed: true, usedLegacyLoopbackPortSubstitution: false, reason };
+}
+function rejected(reason) {
+    return { allowed: false, usedLegacyLoopbackPortSubstitution: false, reason };
+}
+//# sourceMappingURL=oauth-client-redirect-policy.js.map

package/node_modules/@noodle-borg/auth/dist/oauth-client-redirect-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-redirect-policy.js","sourceRoot":"","sources":["../src/oauth-client-redirect-policy.ts"],"names":[],"mappings":"AA0CA,gGAAgG;AAChG,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B;IAArB,YAAqB,MAAsC;QACzD,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;QADhC,WAAM,GAAN,MAAM,CAAgC;QAEzD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAoBD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAE9E,MAAM,UAAU,4BAA4B,CAC1C,QAAqC;IAErC,MAAM,eAAe,GAAG,8BAA8B,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAClF,MAAM,uBAAuB,GAAG,sCAAsC,CACpE,QAAQ,CAAC,0BAA0B,CACpC,CAAC;IACF,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAExD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;IAC5D,CAAC;IACD,IACE,QAAQ,CAAC,gBAAgB,KAAK,KAAK;QACnC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,EAC9F,CAAC;QACD,MAAM,IAAI,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,eAAe;QACjC,aAAa,EAAE,YAAY;QAC3B,0BAA0B,EAAE,uBAAuB;QACnD,8BAA8B,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,QAAqC;IAErC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,IAAI,wBAAwB,CAAC,QAAQ,CAAC;QAC5E,OAAO,YAAY,CAAC;IACtB,IAAI,mCAAmC,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,CAAC;IAEvE,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACtE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IAEvD,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;QACtE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5F,IAAI,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC1F,OAAO,sBAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAI/C;IACC,MAAM,WAAW,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,WAAW,KAAK,kBAAkB;QAAE,OAAO,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IAErF,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5E,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,WAAW,KAAK,eAAe;QAAE,OAAO,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAEtF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,IACE,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,QAAQ;YACzC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kCAAkC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EACtF,CAAC;YACD,OAAO,OAAO,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IACE,WAAW,KAAK,sBAAsB;QACtC,IAAI,CAAC,mCAAmC;QACxC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kCAAkC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EACtF,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3C,kCAAkC,CAAC,QAAQ,EAAE,SAAS,CAAC,CACxD,CAAC;QACF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,kCAAkC,EAChC,OAAO,EAAE,IAAI,KAAK,QAAQ;gBAC1B,SAAS,CAAC,IAAI,KAAK,QAAQ;gBAC3B,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;YACjC,MAAM,EAAE,4BAA4B;SACrC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAc;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,IAAI,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,sCAAsC,CAAC,KAAc;IAC5D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC;IACrD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACrE,MAAM,IAAI,wBAAwB,CAAC,wCAAwC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAc;IACjD,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IACzF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAc;IACjD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,EACxD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,cAAc,GAClB,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,iBAAiB,KAAK,SAAS;YAC/B,iBAAiB,KAAK,iBAAiB;YACvC,wBAAwB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,iBAAiB;YAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,cAAc,EAAE,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;YAC1D,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChC,OAAO,EACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa;SACzF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAqC;IACvE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAqC;IACrE,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,8BAA8B,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAClF,sCAAsC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACtE,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACrD,OAAO,eAAe,KAAK,KAAK;YAC9B,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;YAC5C,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAAC,QAAqC;IAChF,IAAI,QAAQ,CAAC,8BAA8B,KAAK,CAAC,IAAI,QAAQ,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,sCAAsC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACtE,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACrD,OAAO,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa;IAClD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,cAAc,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,cAAc,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,WAAW;SACf,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SAChF,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,QAAwB;IAC9C,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,QAAQ,CAAC,cAAc;QACxB,CAAC,QAAQ,CAAC,WAAW;QACrB,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,eAAe,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAwB;IACnD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,QAAQ,CAAC,cAAc;QACxB,CAAC,QAAQ,CAAC,WAAW;QACrB,QAAQ,CAAC,OAAO,KAAK,OAAO,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAwB;IACtD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,QAAQ,CAAC,cAAc;QACxB,CAAC,QAAQ,CAAC,WAAW;QACrB,QAAQ,CAAC,OAAO,KAAK,eAAe,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CAAC,IAAoB,EAAE,KAAqB;IACrF,OAAO,CACL,sBAAsB,CAAC,IAAI,CAAC;QAC5B,sBAAsB,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAoD;IACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kCAAkC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CACf,MAAwF;IAExF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,kCAAkC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC/E,CAAC"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/authorization-handler.d.ts

@@ -0,0 +1,17 @@
+import type { OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import { type RequestHandler } from 'express';
+import { type Options as RateLimitOptions } from 'express-rate-limit';
+import { type OAuthLegacyRedirectRollout } from './legacy-redirect-rollout.js';
+export type AuthorizationRedirectScalarFields = Readonly<Record<string, string | number | boolean>>;
+export interface AuthorizationRedirectLogger {
+    info(event: string, scalarFields: AuthorizationRedirectScalarFields): void;
+}
+export interface SafeAuthorizationHandlerOptions {
+    readonly provider: OAuthServerProvider;
+    readonly logger?: AuthorizationRedirectLogger | undefined;
+    readonly rollout?: OAuthLegacyRedirectRollout;
+    readonly rateLimit?: Partial<RateLimitOptions> | false;
+}
+/** Guard authorization redirects with Noodle policy before the SDK can redirect to a client callback. */
+export declare function safeAuthorizationHandler({ provider, logger, rollout, rateLimit: rateLimitConfig, }: SafeAuthorizationHandlerOptions): RequestHandler;
+//# sourceMappingURL=authorization-handler.d.ts.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/authorization-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-handler.d.ts","sourceRoot":"","sources":["../src/authorization-handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAO7F,OAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,KAAK,OAAO,IAAI,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,8BAA8B,CAAC;AAOtC,MAAM,MAAM,iCAAiC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;AAEpG,MAAM,WAAW,2BAA2B;IAC1C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,iCAAiC,GAAG,IAAI,CAAC;CAC5E;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;CACxD;AAED,yGAAyG;AACzG,wBAAgB,wBAAwB,CAAC,EACvC,QAAQ,EACR,MAAoB,EACpB,OAAqC,EACrC,SAAS,EAAE,eAAe,GAC3B,EAAE,+BAA+B,GAAG,cAAc,CAqBlD"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/authorization-handler.js

@@ -0,0 +1,118 @@
+import { InvalidRequestError, ServerError, TooManyRequestsError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { authorizationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/authorize.js';
+import { allowedMethods } from '@modelcontextprotocol/sdk/server/auth/middleware/allowedMethods.js';
+import { classifyStoredOAuthRedirectPolicy, matchOAuthAuthorizationRedirect, } from '@noodle-borg/auth';
+import express, {} from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { stageALegacyRedirectRollout, } from './legacy-redirect-rollout.js';
+const POLICY_ERROR_DESCRIPTION = 'redirect_uri is not permitted for this client';
+const LEGACY_OBSERVATION_EVENT = 'oauth.authorization_redirect.legacy_observed';
+/** Guard authorization redirects with Noodle policy before the SDK can redirect to a client callback. */
+export function safeAuthorizationHandler({ provider, logger = NOOP_LOGGER, rollout = stageALegacyRedirectRollout, rateLimit: rateLimitConfig, }) {
+    const router = express.Router();
+    router.use(allowedMethods(['GET', 'POST']));
+    router.use(express.urlencoded({ extended: false }));
+    if (rateLimitConfig !== false) {
+        router.use(rateLimit({
+            windowMs: 15 * 60 * 1000,
+            max: 100,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: new TooManyRequestsError('You have exceeded the rate limit for authorization requests').toResponseObject(),
+            ...rateLimitConfig,
+        }));
+    }
+    router.use(authorizationRedirectGuard(provider, logger, rollout));
+    router.use(authorizationHandler({ provider, rateLimit: false }));
+    return router;
+}
+function authorizationRedirectGuard(provider, logger, rollout) {
+    return async (req, res, next) => {
+        const phaseOne = phaseOneInput(req.method === 'POST' ? req.body : req.query);
+        if (phaseOne === undefined) {
+            next();
+            return;
+        }
+        let client;
+        try {
+            client = await provider.clientsStore.getClient(phaseOne.clientId);
+        }
+        catch {
+            rejectStoreFailure(res);
+            return;
+        }
+        if (client === undefined) {
+            next();
+            return;
+        }
+        const effectiveRedirectUri = phaseOne.redirectUri ?? soleRegisteredRedirectUri(client.redirect_uris);
+        if (effectiveRedirectUri === undefined) {
+            next();
+            return;
+        }
+        const policyClass = classifyStoredOAuthRedirectPolicy(client);
+        const match = matchOAuthAuthorizationRedirect({
+            client,
+            requestedRedirectUri: effectiveRedirectUri,
+            allowLegacyLoopbackPortSubstitution: rollout.loopbackPortMode === 'observe',
+        });
+        if (policyClass === 'unsafe_legacy' || policyClass === 'malformed_legacy') {
+            observeLegacy(logger, policyClass, match);
+            if (rollout.unsafeLegacyMode === 'observe') {
+                next();
+                return;
+            }
+            rejectRedirect(res);
+            return;
+        }
+        if (policyClass === 'safe_loopback_legacy' && match.usedLegacyLoopbackPortSubstitution) {
+            observeLegacy(logger, policyClass, match);
+        }
+        if (!match.allowed) {
+            rejectRedirect(res);
+            return;
+        }
+        next();
+    };
+}
+function soleRegisteredRedirectUri(value) {
+    if (!Array.isArray(value) || value.length !== 1)
+        return undefined;
+    const [redirectUri] = value;
+    return typeof redirectUri === 'string' && URL.canParse(redirectUri) ? redirectUri : undefined;
+}
+function phaseOneInput(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const input = value;
+    if (typeof input.client_id !== 'string')
+        return undefined;
+    if (input.redirect_uri === undefined)
+        return { clientId: input.client_id };
+    if (typeof input.redirect_uri !== 'string' || !URL.canParse(input.redirect_uri))
+        return undefined;
+    return { clientId: input.client_id, redirectUri: input.redirect_uri };
+}
+function observeLegacy(logger, policyClass, match) {
+    try {
+        logger.info(LEGACY_OBSERVATION_EVENT, {
+            policyClass,
+            reason: match.reason,
+            allowed: match.allowed,
+            usedLegacyLoopbackPortSubstitution: match.usedLegacyLoopbackPortSubstitution,
+        });
+    }
+    catch {
+        // Observation telemetry is non-authoritative and must not change authorization behavior.
+    }
+}
+function rejectRedirect(res) {
+    res.setHeader('Cache-Control', 'no-store');
+    res.status(400).json(new InvalidRequestError(POLICY_ERROR_DESCRIPTION).toResponseObject());
+}
+function rejectStoreFailure(res) {
+    res.setHeader('Cache-Control', 'no-store');
+    res.status(500).json(new ServerError('Internal Server Error').toResponseObject());
+}
+const NOOP_LOGGER = { info: () => undefined };
+//# sourceMappingURL=authorization-handler.js.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/authorization-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-handler.js","sourceRoot":"","sources":["../src/authorization-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,oEAAoE,CAAC;AAGpG,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,OAAO,EAAE,EAAuB,MAAM,SAAS,CAAC;AACvD,OAAO,EAAoC,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAEL,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,wBAAwB,GAAG,+CAA+C,CAAC;AACjF,MAAM,wBAAwB,GAAG,8CAA8C,CAAC;AAiBhF,yGAAyG;AACzG,MAAM,UAAU,wBAAwB,CAAC,EACvC,QAAQ,EACR,MAAM,GAAG,WAAW,EACpB,OAAO,GAAG,2BAA2B,EACrC,SAAS,EAAE,eAAe,GACM;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CACR,SAAS,CAAC;YACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;YACxB,GAAG,EAAE,GAAG;YACR,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI,oBAAoB,CAC/B,6DAA6D,CAC9D,CAAC,gBAAgB,EAAE;YACpB,GAAG,eAAe;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CACjC,QAA6B,EAC7B,MAAmC,EACnC,OAAmC;IAEnC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,MAA8C,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GACxB,QAAQ,CAAC,WAAW,IAAI,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,+BAA+B,CAAC;YAC5C,MAAM;YACN,oBAAoB,EAAE,oBAAoB;YAC1C,mCAAmC,EAAE,OAAO,CAAC,gBAAgB,KAAK,SAAS;SAC5E,CAAC,CAAC;QAEH,IAAI,WAAW,KAAK,eAAe,IAAI,WAAW,KAAK,kBAAkB,EAAE,CAAC;YAC1E,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBAC3C,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,sBAAsB,IAAI,KAAK,CAAC,kCAAkC,EAAE,CAAC;YACvF,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,cAAc,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;IAC5B,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,SAAS,aAAa,CACpB,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAC3E,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAClG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CACpB,MAAmC,EACnC,WAAsC,EACtC,KAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACpC,WAAW;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kCAAkC,EAAE,KAAK,CAAC,kCAAkC;SAC7E,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAkC;IACxD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAkC;IAC5D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,WAAW,GAAgC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.d.ts

@@ -0,0 +1,18 @@
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import { type OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { type NormalizedOAuthRedirectClientMetadata } from '@noodle-borg/auth';
+import { type RequestHandler } from 'express';
+import { type Options as RateLimitOptions } from 'express-rate-limit';
+export type RegisteredOAuthClient = OAuthClientInformationFull & Omit<NormalizedOAuthRedirectClientMetadata, 'redirect_uris'> & {
+    readonly redirect_uris: string[];
+};
+export interface SafeClientRegistrationHandlerOptions {
+    readonly clientsStore: OAuthRegisteredClientsStore;
+    readonly clientSecretExpirySeconds?: number;
+    readonly rateLimit?: Partial<RateLimitOptions> | false;
+}
+/**
+ * Preserve the MCP SDK's DCR transport while retaining Noodle's normalized redirect-policy metadata.
+ */
+export declare function safeClientRegistrationHandler({ clientsStore, clientSecretExpirySeconds, rateLimit: rateLimitConfig, }: SafeClientRegistrationHandlerOptions): RequestHandler;
+//# sourceMappingURL=client-registration-handler.d.ts.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registration-handler.d.ts","sourceRoot":"","sources":["../src/client-registration-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAQpG,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,KAAK,qCAAqC,EAI3C,MAAM,mBAAmB,CAAC;AAE3B,OAAgB,EAA4B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,IAAI,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AAIjF,MAAM,MAAM,qBAAqB,GAAG,0BAA0B,GAC5D,IAAI,CAAC,qCAAqC,EAAE,eAAe,CAAC,GAAG;IAC7D,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;CAClC,CAAC;AAEJ,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAC;IACnD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;CACxD;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,YAAY,EACZ,yBAAgE,EAChE,SAAS,EAAE,eAAe,GAC3B,EAAE,oCAAoC,GAAG,cAAc,CAuEvD"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.js

@@ -0,0 +1,130 @@
+import crypto from 'node:crypto';
+import { InvalidClientMetadataError, OAuthError, ServerError, TooManyRequestsError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { allowedMethods } from '@modelcontextprotocol/sdk/server/auth/middleware/allowedMethods.js';
+import { OAuthClientInformationFullSchema, OAuthClientMetadataSchema, } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { normalizeOAuthClientMetadata, OAuthRedirectPolicyError, } from '@noodle-borg/auth';
+import cors from 'cors';
+import express, {} from 'express';
+import { rateLimit } from 'express-rate-limit';
+const DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS = 30 * 24 * 60 * 60;
+/**
+ * Preserve the MCP SDK's DCR transport while retaining Noodle's normalized redirect-policy metadata.
+ */
+export function safeClientRegistrationHandler({ clientsStore, clientSecretExpirySeconds = DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS, rateLimit: rateLimitConfig, }) {
+    if (!clientsStore.registerClient) {
+        throw new Error('Client registration store does not support registering clients');
+    }
+    const registerClient = clientsStore.registerClient.bind(clientsStore);
+    const router = express.Router();
+    router.use(cors());
+    router.use(allowedMethods(['POST']));
+    router.use(express.json());
+    router.use(invalidJsonHandler);
+    if (rateLimitConfig !== false) {
+        router.use(rateLimit({
+            windowMs: 60 * 60 * 1000,
+            max: 20,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: new TooManyRequestsError('You have exceeded the rate limit for client registration requests').toResponseObject(),
+            ...rateLimitConfig,
+        }));
+    }
+    router.post('/', async (req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        try {
+            const parseResult = OAuthClientMetadataSchema.safeParse(req.body);
+            if (!parseResult.success) {
+                throw new InvalidClientMetadataError(parseResult.error.message);
+            }
+            const submitted = requestObject(req.body);
+            const normalized = normalizeOAuthClientMetadata({
+                application_type: submitted.application_type,
+                redirect_uris: parseResult.data.redirect_uris,
+                token_endpoint_auth_method: submitted.token_endpoint_auth_method,
+                noodle_redirect_policy_version: submitted.noodle_redirect_policy_version,
+            });
+            const persistedPolicy = { ...normalized, redirect_uris: [...normalized.redirect_uris] };
+            const issuedAt = Math.floor(Date.now() / 1000);
+            const hasSecret = normalized.token_endpoint_auth_method === 'client_secret_post';
+            const credentials = hasSecret
+                ? {
+                    client_secret: crypto.randomBytes(32).toString('hex'),
+                    client_secret_expires_at: clientSecretExpirySeconds > 0 ? issuedAt + clientSecretExpirySeconds : 0,
+                }
+                : {};
+            const client = {
+                ...parseResult.data,
+                ...persistedPolicy,
+                ...credentials,
+                client_id: crypto.randomUUID(),
+                client_id_issued_at: issuedAt,
+            };
+            const stored = await registerClient(client);
+            res.status(201).json(validatedStoredClient(stored, persistedPolicy));
+        }
+        catch (error) {
+            const oauthError = registrationError(error);
+            const status = oauthError instanceof ServerError ? 500 : 400;
+            res.status(status).json(oauthError.toResponseObject());
+        }
+    });
+    return router;
+}
+const invalidJsonHandler = (error, _req, res, next) => {
+    if (!isInvalidJson(error)) {
+        next(error);
+        return;
+    }
+    res.setHeader('Cache-Control', 'no-store');
+    res
+        .status(400)
+        .json(new InvalidClientMetadataError('client metadata must be valid JSON').toResponseObject());
+};
+function isInvalidJson(error) {
+    if (!(error instanceof SyntaxError))
+        return false;
+    const parseError = error;
+    return parseError.status === 400 && parseError.type === 'entity.parse.failed';
+}
+function requestObject(value) {
+    return typeof value === 'object' && value !== null ? value : {};
+}
+function validatedStoredClient(value, normalized) {
+    const sdkRecord = OAuthClientInformationFullSchema.safeParse(value);
+    const stored = requestObject(value);
+    if (!sdkRecord.success ||
+        stored.application_type !== normalized.application_type ||
+        stored.token_endpoint_auth_method !== normalized.token_endpoint_auth_method ||
+        stored.noodle_redirect_policy_version !== normalized.noodle_redirect_policy_version ||
+        !sameRedirectUris(stored.redirect_uris, normalized.redirect_uris)) {
+        throw new ServerError('Internal Server Error');
+    }
+    return value;
+}
+function sameRedirectUris(actual, expected) {
+    return (Array.isArray(actual) &&
+        actual.length === expected.length &&
+        actual.every((value, index) => value === expected[index]));
+}
+function registrationError(error) {
+    if (error instanceof OAuthRedirectPolicyError) {
+        return new InvalidClientMetadataError(policyErrorDescription(error.reason));
+    }
+    if (error instanceof OAuthError)
+        return error;
+    return new ServerError('Internal Server Error');
+}
+function policyErrorDescription(reason) {
+    switch (reason) {
+        case 'invalid_application_type':
+            return 'application_type must be web or native';
+        case 'invalid_redirect_uris':
+            return 'redirect_uris must be a non-empty list of URI strings';
+        case 'unsafe_redirect_uri':
+            return 'redirect_uris must use HTTPS or a permitted loopback HTTP redirect without credentials or fragments';
+        case 'unsupported_token_endpoint_auth_method':
+            return 'token_endpoint_auth_method must be none or client_secret_post';
+    }
+}
+//# sourceMappingURL=client-registration-handler.js.map