@nyuchi/mzizi-mcp 0.14.0 → 0.16.0

package/README.md

@@ -12,7 +12,7 @@ Owned and operated by **Mzizi**.
 ---
 
 **Live at** `https://mcp.mzizi.dev/mcp` (Cloudflare Worker `mzizi-mcp`, version
-0.14.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
+0.16.0 — `MZIZI_MCP_VERSION` in `src/server.ts` is what `serverInfo.version`
 reports, and it moves in lockstep with `package.json` and `server.json`).
 
 ## Free, with no gate except Fundi
@@ -72,10 +72,13 @@ registration and does not publish a client ID metadata document.
 
 ### Per client
 
-Each client writes the entry above in its own format. The full guide, checked against each
-vendor's documentation, is
-[docs.mzizi.dev/toolchain/connect](https://docs.mzizi.dev/toolchain/connect). The short
-version:
+Each client writes the entry above in its own format. The full guide, with the vendor page
+each line was read from, is
+[docs.mzizi.dev/toolchain/connect](https://docs.mzizi.dev/toolchain/connect); the table in this
+repository's [README](../README.md#connect-a-client) has the config path and key for Claude
+Code, Claude.ai and Desktop, Codex, Cursor, VS Code, Antigravity, Gemini CLI, Devin Desktop
+(formerly Windsurf), Zed, Cline, OpenCode, Kiro and JetBrains. All of it is documented by the
+vendors, read on 2026-11-03, and not run in the tools. The short version:
 
 ```bash
 # Claude Code: the server alone (skills over MCP) ...
@@ -84,11 +87,10 @@ claude mcp add --transport http mzizi https://mcp.mzizi.dev/mcp
 /plugin marketplace add mzizi-dev/mzizi-registry
 /plugin install mzizi@mzizi
 
-# Codex: the server alone, or the same plugin (mzizi-registry#520 adds its Codex manifest)
+# Codex: the server (there is no Codex plugin until mzizi-registry#520 merges)
 codex mcp add mzizi --url https://mcp.mzizi.dev/mcp
-codex plugin marketplace add mzizi-dev/mzizi-registry
 
-# Gemini CLI
+# Gemini CLI (enterprise; free and Pro/Ultra users moved to Antigravity CLI on 2026-06-18)
 gemini mcp add --transport http mzizi https://mcp.mzizi.dev/mcp
 
 # VS Code
@@ -104,10 +106,14 @@ code --add-mcp '{"name":"mzizi","type":"http","url":"https://mcp.mzizi.dev/mcp"}
   `mcp-client-2025-11-20` beta header.
 - **OpenAI Responses API and Agents SDK:** a tool
   `{"type": "mcp", "server_label": "mzizi", "server_url": "https://mcp.mzizi.dev/mcp"}`
-  (`HostedMCPTool(tool_config=…)` in the SDK).
-- **Cursor** (`mcp.json`, `"url"`), **OpenCode** (`opencode.json`, `"type": "remote"`),
-  **Windsurf** (`mcp_config.json`, `"serverUrl"`) and **Gemini CLI** (`settings.json`,
-  `"httpUrl"`) each name the URL field differently.
+  (`HostedMCPTool(tool_config=...)` in the SDK).
+- **The URL key differs by client:** `url` (Cursor, Zed, Kiro, JetBrains, Devin Desktop,
+  Cline, OpenCode), `serverUrl` (Antigravity), `httpUrl` (Gemini CLI `settings.json`). Cline
+  needs `"type": "streamableHttp"` set explicitly (without it, it falls back to SSE), and
+  Devin Desktop names the transport `transport`, not `type`.
+- **Needs a bridge or stdio:** a client that only speaks stdio (older MCP clients, and Junie,
+  whose current help page does not confirm streamable HTTP) runs `npx -y @nyuchi/mzizi-mcp`
+  (stdio, below). `mcp-remote` is a third-party bridge this project has not tested.
 
 **Skills over MCP.** A client that cannot install the npm package (Claude.ai, ChatGPT, the
 APIs) gets the skills from `mzizi_get_skills`: no arguments lists them with their category,
@@ -120,8 +126,10 @@ SKILL.md body, `mzizi://skills/<name>/<path>` for each file, listed by `resource
 resources or offers prompts gets them without calling a tool. `catalogue.json` and
 `mzizi_mcp_describe` list every skill with its category and files. All of it is read from the
 skill files bundled at build time, and `test/skills-surfaces.test.ts` fails if any surface
-drifts from `mzizi-skills/`. Codex, Cursor, VS Code, Gemini CLI and OpenCode also read
-`.agents/skills/`, where `npx skills experimental_sync` links the npm bundle.
+drifts from `mzizi-skills/`. Codex, Cursor, VS Code, Gemini CLI, Antigravity, Zed, OpenCode and
+Devin Desktop also read `.agents/skills/`, where `npx skills experimental_sync` links the npm
+bundle. For instruction formats that cannot hold a skill (Cursor rules, Antigravity and Devin
+rules, `AGENTS.md`), see [`mzizi-skills/adapters/`](../mzizi-skills/adapters/README.md).
 
 How a skills change reaches this server: the skills are read from `../mzizi-skills/` in this
 repository at build time, not from npm and not from the registry pin. A change to a SKILL.md
@@ -129,6 +137,32 @@ merged to `main` redeploys `mcp.mzizi.dev` (Workers Builds), and that deploy ser
 publish of `@nyuchi/mzizi-skills` and the registry's dependency bump feed the plugin and
 `api.mzizi.dev/v1/skills`, not this server.
 
+### Compatibility with the MCP spec
+
+Probed from outside with `curl` on 2026-11-03, with no `Origin` header and again with a CLI
+user agent (`codex_cli_rs/0.1`), against the Streamable HTTP page of the 2026-07-28 revision
+(<https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http>):
+
+| Probe                                                           | Result                                                                                                                                                                                                                |
+| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `initialize` with `2025-06-18`, `2025-11-25`                    | `200`, `application/json`, same version echoed, tools, resources and prompts with `listChanged`; no `Mcp-Session-Id` (stateless)                                                                                      |
+| `initialize` with `2026-07-28`                                  | `200`, answers `2025-11-25` (the legacy handshake is the highest it negotiates)                                                                                                                                       |
+| `server/discover` and `tools/list` with `_meta` and the headers | `200`; `supportedVersions: ["2026-07-28"]`, 14 tools                                                                                                                                                                  |
+| `tools/call` without `Mcp-Name`                                 | `400`, JSON-RPC `-32020` `HeaderMismatch`, as the spec requires                                                                                                                                                       |
+| `tools/list` with no `initialize` and no version header         | `200` (treated as the earliest header-less version, which the spec allows)                                                                                                                                            |
+| notification POST (`notifications/initialized`)                 | `202`, no body                                                                                                                                                                                                        |
+| `GET` on the endpoint                                           | `405` with `Allow: POST, OPTIONS` (the spec's answer for a server with no GET stream)                                                                                                                                 |
+| `Accept: application/json` alone                                | `406`; the client must list both `application/json` and `text/event-stream`                                                                                                                                           |
+| `MCP-Protocol-Version: 1999-01-01`                              | `400`, lists the supported versions (`2025-11-25` back to `2024-10-07`)                                                                                                                                               |
+| `Origin: http://evil.example`, `Origin: null`                   | `403`                                                                                                                                                                                                                 |
+| `Origin: https://evil.example`                                  | `200` on the deployed 0.14.0: any `https` origin is accepted. The spec says an invalid Origin MUST get `403`. The explicit allowlist merged to `staging` in #319 refuses it, and is live only after the next release. |
+| `/mcp/signin` without a token                                   | `401` with `WWW-Authenticate: Bearer ... resource_metadata=...`, the OAuth flow clients start from                                                                                                                    |
+
+Deviations to know about: a JSON-RPC batch array (removed from the spec in 2025-06-18) answers
+a single object, not an array, and `server/discover` lists only the modern version while the
+legacy handshake still negotiates the older ones. No client was run; these are the server's
+answers to a plain HTTP client.
+
 ### stdio (local / offline)
 
 Run the stdio bin via npx — useful for Claude Code, Cursor, or any assistant that
@@ -224,22 +258,22 @@ call, passing the result through untouched:
 
 ## Tools
 
-| Tool                               | Returns                                                                        |
-| ---------------------------------- | ------------------------------------------------------------------------------ |
-| `mzizi_search`                     | Word search over components, conventions, AI instruction sets and releases     |
-| `mzizi_get_component`              | One component in full, **Rust first**; `include: ["docs", "versions"]`         |
-| `mzizi_list_components`            | The lean, paged index; filter by `node`, `owner`, `collection`, `type`, `rust` |
-| `mzizi_get_tokens`                 | Brand system; `family: "colors"` for all 21 colour families                    |
-| `mzizi_get_architecture`           | The DNA helix, or one node/rung with `node` (uncapped)                         |
-| `mzizi_get_doctrine`               | `ubuntu-pillars`, `ubuntu-principles`, `ai-instructions`, `conventions`        |
-| `mzizi_get_skills`                 | The agent skills: listed, one by `name` (with `file`), or a `category`         |
-| `mzizi_check_accessibility`        | WCAG 2 contrast ratio and the Mzizi 7:1 floor, computed locally (not APCA)     |
-| `mzizi_report_issue`               | Your issue desk. **Sign-in**                                                   |
-| `mzizi_fundi`                      | Delegate to fundi (when the Worker can reach fundi). **Sign-in**               |
-| `mzizi_mcp_describe`               | This server's tools, their access, what each replaces, and data sources        |
-| `docs_search_mzizi`                | Search the documentation (forwarded)                                           |
-| `docs_query_docs_filesystem_mzizi` | Read-only `rg`/`cat`/`tree` over the doc pages (forwarded)                     |
-| `docs_submit_feedback`             | Report a documentation problem (forwarded)                                     |
+| Tool                               | Returns                                                                                                                  |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| `mzizi_search`                     | Word search over components, conventions, AI instruction sets and releases                                               |
+| `mzizi_get_component`              | One component in full, **Rust first**; `include: ["docs", "versions"]`                                                   |
+| `mzizi_list_components`            | The lean, paged index; filter by `node`, `owner`, `collection`, `type`, `rust`                                           |
+| `mzizi_get_tokens`                 | Brand system; `family: "colors"` for all 21 colour families, `"floors"` for the Bundu floor                              |
+| `mzizi_get_architecture`           | The DNA helix, or one node/rung with `node` (uncapped)                                                                   |
+| `mzizi_get_doctrine`               | `ubuntu-pillars`, `ubuntu-principles`, `ai-instructions`, `conventions`, `bundu-floor`                                   |
+| `mzizi_get_skills`                 | The agent skills: listed, one by `name` (with `file`), or a `category`                                                   |
+| `mzizi_check_accessibility`        | WCAG 2 contrast ratio and the Mzizi 7:1 floor, and spacing values against the spacing floor, computed locally (not APCA) |
+| `mzizi_report_issue`               | Your issue desk. **Sign-in**                                                                                             |
+| `mzizi_fundi`                      | Delegate to fundi (when the Worker can reach fundi). **Sign-in**                                                         |
+| `mzizi_mcp_describe`               | This server's tools, their access, what each replaces, and data sources                                                  |
+| `docs_search_mzizi`                | Search the documentation (forwarded)                                                                                     |
+| `docs_query_docs_filesystem_mzizi` | Read-only `rg`/`cat`/`tree` over the doc pages (forwarded)                                                               |
+| `docs_submit_feedback`             | Report a documentation problem (forwarded)                                                                               |
 
 **How the tools behave (SDK v2, #295).**
 
@@ -257,13 +291,49 @@ call, passing the result through untouched:
   `mzizi_list_components` also keeps `hasMore` / `nextOffset` for older clients.
 - A domain failure (unknown component, bad colour, sign-in needed) is a tool result with
   `isError: true` and text that says how to recover, never a protocol error.
-- **Browser origins (Streamable HTTP §Security):** an `Origin` that does not parse (the opaque
-  `null` included) or a plain-`http` origin other than localhost is refused with 403. Every
-  `https` origin passes, because browser-based MCP clients on other sites use this public,
-  cookie-less server. Clients that send no `Origin` (every non-browser client) are not affected.
+- **Browser origins (Streamable HTTP §Security):** a request with an `Origin` header whose host is
+  not on the list is refused with 403 before any server is built, on `/mcp`, `/mcp/signin` and
+  every other path starting with `/mcp`, with or without a token, and before the anonymous rate
+  limit is charged. The code refuses a present but empty `Origin` (only a missing header counts as
+  no `Origin`), though workerd appears to deliver an empty header as absent. The list is `mzizi.dev`, `www.mzizi.dev`, `docs.mzizi.dev`, `app.mzizi.dev` and
+  `mcp.mzizi.dev`, each over `https` on the default port only (no `http`, no `:8443`, no other
+  subdomain), plus localhost on any port. Add more with the `MZIZI_ALLOWED_ORIGINS` variable,
+  comma-separated `https://host` origins (case and a trailing slash are tolerated; anything else
+  that is not a plain `https` origin is dropped with a logged warning). Clients that send no
+  `Origin` (every non-browser client) are not affected. On `/mcp`, CORS echoes an allowed `Origin`
+  with `Vary: Origin` and never answers `Access-Control-Allow-Origin: *`. The OAuth provider's own
+  endpoints follow `src/auth/cors.ts` (0.16.0; the provider's own CORS, which echoed any `Origin`,
+  is replaced): `/.well-known/*` are public discovery documents and answer
+  `Access-Control-Allow-Origin: *` (GET, HEAD, OPTIONS); `/token` and `/register` echo an `Origin`
+  only if it is on the same list as `/mcp` and always send `Vary: Origin`. A listed `Origin`
+  gets `POST, OPTIONS`, `Content-Type, Authorization` and `Access-Control-Max-Age: 600`; an unlisted
+  or `null` `Origin` is still served but gets no `Access-Control-Allow-Origin`, so a browser cannot read
+  the answer; a request with no `Origin` is unaffected. Errors (400, 401, 405, 429, 5xx) carry the
+  same headers. No `Access-Control-Allow-Credentials` anywhere. `/catalogue.json` is `*` on purpose.
+  Browser clients hosted on other sites cannot call `/mcp` (`src/origin.ts` is the one list).
+- **PKCE and token audience:** the authorization-server metadata advertises `S256` only. Audience
+  binding applies only to clients that send a `resource` indicator (RFC 8707): such a token is
+  refused on a different server or path, but a token for `/mcp` is also accepted on
+  `/mcp/signin` (path-prefix matching, the same server). A token minted with no `resource` has no
+  audience and is served on `/mcp` and `/mcp/signin` (see the CHANGELOG, #295).
 - Calls to fundi and to the identity provider time out after 15 s.
 - `evals.xml` holds ten read-only questions with answers checked against production.
 
+**The Bundu floor, and the spacing floor in it.** The registry's minimums nothing can go under are
+served three ways, all read from the bundled registry's `/v1/brand` `accessibility` block at the
+pinned commit (`minTouchTarget`, `minInset`, `minControlGap`, `minLabelGap`, `minItemGap`,
+`minBodyLeading`), never typed in this repo (`src/floors.ts`): `mzizi_get_tokens family=floors` (also
+`family=accessibility`, and `family=spacing`, which returns `spacingFloor` beside the scale),
+`mzizi_get_doctrine topic=bundu-floor`, and the `floors` block of `mzizi_mcp_describe`, the
+`mzizi://tools` resource and `GET /catalogue.json`. The spacing floor (owner, 2026-11-04,
+mzizi-registry#617) is a 14px inset between text and its container edge (`--inset-floor`), 7px gaps between
+adjacent controls, between a label and its field and between sibling items (`--gap-floor`), and 1.5
+body leading (`--leading-floor`). `mzizi_check_accessibility` takes `insetPx`, `controlGapPx`,
+`labelGapPx`, `itemGapPx` and `leading` beside (or instead of) the two colours, compares each with that
+floor and returns `spacing: { floor, checks, meetsFloor }`. If the pinned registry commit predates the
+floor, `floors.spacing` is `null`, the tool descriptions name no number, and a spacing check is a tool
+error saying so (or, beside colours, a `spacingUnavailable` note); the tools never answer from a copy. To check a project's source rather than values, run `mzizi check` (`@nyuchi/mzizi-cli`).
+
 **Text colours from `mzizi_get_tokens`.** Every colour family carries `textLight` /
 `textDark`: use them for text in that colour on the base surface (they are
 `--color-<name>-text`). On a family's container, use `onContainerLight` /
@@ -319,6 +389,7 @@ tools present the Rust implementation first wherever one exists:
       project's own. Hash the registry source, not the installed file.
   - **Breaking for readers of 0.10.x:** the React body moved from `component` to
     `react`, and `renamedFrom` moved to the top level.
+
 - `mzizi_list_components` rows carry `rustCrate` when the component has Rust (absent
   otherwise), the response carries `withRust` (how many of `total` have Rust), and
   `rust: true` / `rust: false` filters on it.
@@ -370,11 +441,12 @@ at. See `AUTH.md`.
 
 Plain vars (`[vars]` in `wrangler.toml`, not secrets):
 
-| Var                    | Notes                                                         |
-| ---------------------- | ------------------------------------------------------------- |
-| `WORKOS_CLIENT_ID`     | Connect OAuth app client id (public client; PKCE)             |
-| `WORKOS_M2M_CLIENT_ID` | Fundi M2M app client id; used only on the HTTP + M2M fallback |
-| `FUNDI_URL`            | Base URL of the fundi worker, for the HTTP + M2M fallback     |
+| Var                     | Notes                                                                                                                                                                                          |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `WORKOS_CLIENT_ID`      | Connect OAuth app client id (public client; PKCE)                                                                                                                                              |
+| `WORKOS_M2M_CLIENT_ID`  | Fundi M2M app client id; used only on the HTTP + M2M fallback                                                                                                                                  |
+| `FUNDI_URL`             | Base URL of the fundi worker, for the HTTP + M2M fallback                                                                                                                                      |
+| `MZIZI_ALLOWED_ORIGINS` | Optional, unset by default. Extra browser origins for `/mcp`, comma-separated `https://host` (e.g. `https://partner.example`); a public setting, so a var, not a secret. See "Browser origins" |
 
 Bindings (`wrangler.toml`): `FUNDI_SERVICE` (Service Binding to `mzizi-fundi`'s
 `FundiInternal` entrypoint; what makes fundi reachable in production),

package/dist/auth/cors.d.ts

@@ -0,0 +1,33 @@
+/**
+ * CORS for the OAuth provider's own endpoints.
+ *
+ * `@cloudflare/workers-oauth-provider` answers every cross-origin request on
+ * `/token`, `/register` and `/.well-known/*` by echoing ANY `Origin` back with
+ * `Allow-Methods: *`, `Allow-Headers: Authorization, *` and a day of preflight
+ * cache. This module takes those answers over: the provider still serves the
+ * request, and its CORS headers are replaced with ours. Its own module, not
+ * `worker.ts`, because the Worker's entry may export only handlers.
+ *
+ *   /.well-known/*       public, credential-less documents: `*`, GET/HEAD only.
+ *   /token, /register    the same allowlist as the `/mcp` Origin gate
+ *                        (`origin.ts`): an allowed `Origin` is echoed with
+ *                        `Vary: Origin`; no `Origin` (every non-browser client)
+ *                        is served without CORS headers; an unlisted or `null`
+ *                        `Origin` is served too, but gets no
+ *                        `Access-Control-Allow-Origin`, so a browser cannot read
+ *                        the answer. Nothing is 403'd: a browser's block is the
+ *                        enforcement, and these endpoints take no cookie.
+ *
+ * Every answer carries the headers, errors included (a browser cannot read a
+ * 400, 401, 405, 429 or 5xx without them). No `Access-Control-Allow-Credentials`.
+ * `/authorize` is a top-level navigation, not a fetch, so it gets none.
+ */
+export type CorsRoute = "discovery" | "endpoint";
+/** Which CORS rule governs `pathname`, or undefined for a path this module leaves alone. */
+export declare function corsRouteFor(pathname: string): CorsRoute | undefined;
+/**
+ * Serve `request` through `next` (the OAuth provider) with the CORS rules above,
+ * or return undefined when the path is not one of ours.
+ */
+export declare function withProviderCors(request: Request, hosts: readonly string[] | undefined, next: () => Promise<Response>): Promise<Response | undefined>;
+//# sourceMappingURL=cors.d.ts.map

package/dist/auth/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/auth/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAiBH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;AAEjD,4FAA4F;AAC5F,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAIpE;AAoDD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACpC,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC5B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAgB/B"}

package/dist/auth/cors.js

@@ -0,0 +1,110 @@
+/**
+ * CORS for the OAuth provider's own endpoints.
+ *
+ * `@cloudflare/workers-oauth-provider` answers every cross-origin request on
+ * `/token`, `/register` and `/.well-known/*` by echoing ANY `Origin` back with
+ * `Allow-Methods: *`, `Allow-Headers: Authorization, *` and a day of preflight
+ * cache. This module takes those answers over: the provider still serves the
+ * request, and its CORS headers are replaced with ours. Its own module, not
+ * `worker.ts`, because the Worker's entry may export only handlers.
+ *
+ *   /.well-known/*       public, credential-less documents: `*`, GET/HEAD only.
+ *   /token, /register    the same allowlist as the `/mcp` Origin gate
+ *                        (`origin.ts`): an allowed `Origin` is echoed with
+ *                        `Vary: Origin`; no `Origin` (every non-browser client)
+ *                        is served without CORS headers; an unlisted or `null`
+ *                        `Origin` is served too, but gets no
+ *                        `Access-Control-Allow-Origin`, so a browser cannot read
+ *                        the answer. Nothing is 403'd: a browser's block is the
+ *                        enforcement, and these endpoints take no cookie.
+ *
+ * Every answer carries the headers, errors included (a browser cannot read a
+ * 400, 401, 405, 429 or 5xx without them). No `Access-Control-Allow-Credentials`.
+ * `/authorize` is a top-level navigation, not a fetch, so it gets none.
+ */
+import { OAUTH_ENDPOINT_CORS, corsHeadersFor, isAllowedOrigin } from "../origin.js";
+/** Headers the provider sets on its answers; removed before ours go on. */
+const PROVIDER_CORS_HEADERS = [
+    "Access-Control-Allow-Origin",
+    "Access-Control-Allow-Methods",
+    "Access-Control-Allow-Headers",
+    "Access-Control-Max-Age",
+    "Access-Control-Allow-Credentials",
+    "Access-Control-Expose-Headers",
+];
+/** What a browser MCP client sends when it fetches discovery documents (the SDK adds `MCP-Protocol-Version`). */
+const DISCOVERY_ALLOW_HEADERS = "Content-Type, MCP-Protocol-Version";
+/** Which CORS rule governs `pathname`, or undefined for a path this module leaves alone. */
+export function corsRouteFor(pathname) {
+    if (pathname === "/.well-known" || pathname.startsWith("/.well-known/"))
+        return "discovery";
+    if (pathname === "/token" || pathname === "/register")
+        return "endpoint";
+    return undefined;
+}
+/** The CORS headers for `request` on `route`. */
+function headersFor(route, request, hosts) {
+    if (route === "discovery")
+        return { "Access-Control-Allow-Origin": "*" };
+    const origin = request.headers.get("origin");
+    return corsHeadersFor(origin, isAllowedOrigin(origin, hosts), OAUTH_ENDPOINT_CORS);
+}
+function withHeaders(response, extra) {
+    const headers = new Headers(response.headers);
+    for (const name of PROVIDER_CORS_HEADERS)
+        headers.delete(name);
+    for (const [key, value] of Object.entries(extra)) {
+        if (key === "Vary") {
+            if (!/(^|,)\s*origin\s*(,|$)/i.test(headers.get("Vary") ?? ""))
+                headers.append(key, value);
+        }
+        else
+            headers.set(key, value);
+    }
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+/** The preflight answer: 204, the route's methods and headers, the same origin decision. */
+function preflight(route, request, hosts) {
+    if (route === "discovery") {
+        return new Response(null, {
+            status: 204,
+            headers: {
+                "Access-Control-Allow-Origin": "*",
+                "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS",
+                "Access-Control-Allow-Headers": DISCOVERY_ALLOW_HEADERS,
+                "Access-Control-Max-Age": "600",
+            },
+        });
+    }
+    const origin = request.headers.get("origin");
+    return new Response(null, {
+        status: 204,
+        headers: corsHeadersFor(origin, isAllowedOrigin(origin, hosts), OAUTH_ENDPOINT_CORS),
+    });
+}
+/**
+ * Serve `request` through `next` (the OAuth provider) with the CORS rules above,
+ * or return undefined when the path is not one of ours.
+ */
+export async function withProviderCors(request, hosts, next) {
+    const route = corsRouteFor(new URL(request.url).pathname);
+    if (!route)
+        return undefined;
+    if (request.method === "OPTIONS")
+        return preflight(route, request, hosts);
+    let response;
+    try {
+        response = await next();
+    }
+    catch (error) {
+        // A throw would reach the browser as an opaque network error; answer it.
+        console.error("mzizi-mcp: OAuth provider threw", error);
+        response = Response.json({ error: "server_error", error_description: "Internal error" }, { status: 500 });
+    }
+    return withHeaders(response, headersFor(route, request, hosts));
+}
+//# sourceMappingURL=cors.js.map

package/dist/auth/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/auth/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,qBAAqB,GAAG;IAC5B,6BAA6B;IAC7B,8BAA8B;IAC9B,8BAA8B;IAC9B,wBAAwB;IACxB,kCAAkC;IAClC,+BAA+B;CAChC,CAAC;AAEF,iHAAiH;AACjH,MAAM,uBAAuB,GAAG,oCAAoC,CAAC;AAIrE,4FAA4F;AAC5F,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5F,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iDAAiD;AACjD,SAAS,UAAU,CACjB,KAAgB,EAChB,OAAgB,EAChB,KAAoC;IAEpC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB,EAAE,KAA6B;IACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,qBAAqB;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7F,CAAC;;YAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAChB,KAAgB,EAChB,OAAgB,EAChB,KAAoC;IAEpC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,6BAA6B,EAAE,GAAG;gBAClC,8BAA8B,EAAE,oBAAoB;gBACpD,8BAA8B,EAAE,uBAAuB;gBACvD,wBAAwB,EAAE,KAAK;aAChC;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,mBAAmB,CAAC;KACrF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,KAAoC,EACpC,IAA6B;IAE7B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACxD,QAAQ,GAAG,QAAQ,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/auth/front.d.ts

@@ -4,6 +4,14 @@
  * Its own module, not `worker.ts`: the Worker's entry module may export only
  * handlers and Durable Object classes, and this is tested directly.
  */
+/**
+ * True for the provider's API route as the PROVIDER matches it: any path that
+ * starts with `/mcp` (`/mcp`, `/mcp/signin`, `/mcpx`, `/mcp%2Fsignin`: the
+ * provider's `matchApiRoute` is a bare `startsWith`). The Origin gate in
+ * `worker.ts` uses this, so no path the provider treats as the API route
+ * escapes the gate.
+ */
+export declare function isProviderApiPath(pathname: string): boolean;
 /**
  * True for a request the free tier serves: the MCP path, no credential at all.
  *

package/dist/auth/front.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"front.d.ts","sourceRoot":"","sources":["../../src/auth/front.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI/D"}
+{"version":3,"file":"front.d.ts","sourceRoot":"","sources":["../../src/auth/front.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI/D"}

package/dist/auth/front.js

@@ -6,6 +6,16 @@
  */
 /** The paths served to a caller with no token. `/mcp/signin` is deliberately not one. */
 const ANONYMOUS_PATHS = new Set(["/mcp", "/mcp/"]);
+/**
+ * True for the provider's API route as the PROVIDER matches it: any path that
+ * starts with `/mcp` (`/mcp`, `/mcp/signin`, `/mcpx`, `/mcp%2Fsignin`: the
+ * provider's `matchApiRoute` is a bare `startsWith`). The Origin gate in
+ * `worker.ts` uses this, so no path the provider treats as the API route
+ * escapes the gate.
+ */
+export function isProviderApiPath(pathname) {
+    return pathname.startsWith("/mcp");
+}
 /**
  * True for a request the free tier serves: the MCP path, no credential at all.
  *

package/dist/auth/front.js.map

@@ -1 +1 @@
-{"version":3,"file":"front.js","sourceRoot":"","sources":["../../src/auth/front.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yFAAyF;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"front.js","sourceRoot":"","sources":["../../src/auth/front.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yFAAyF;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC"}

package/dist/auth/mcp-api-handler.d.ts

@@ -24,7 +24,7 @@ type AuthedContext = ExecutionContext & {
  * Takes no `ctx` on purpose, so the anonymous front in `worker.ts` cannot pick
  * up a `ctx.props` the provider did not set.
  */
-export declare function serveAnonymous(request: Request, env: Env): Promise<Response>;
+export declare function serveAnonymous(request: Request, env: Env, hosts?: readonly string[]): Promise<Response>;
 export declare const mcpApiHandler: {
     fetch(request: Request, env: Env, ctx: AuthedContext): Promise<Response>;
 };

package/dist/auth/mcp-api-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-api-handler.d.ts","sourceRoot":"","sources":["../../src/auth/mcp-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAGvC,KAAK,aAAa,GAAG,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEzD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE5E;AAED,eAAO,MAAM,aAAa;mBACH,OAAO,OAAO,GAAG,OAAO,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;CA4B/E,CAAA"}
+{"version":3,"file":"mcp-api-handler.d.ts","sourceRoot":"","sources":["../../src/auth/mcp-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAIvC,KAAK,aAAa,GAAG,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA;AAEzD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,GAAE,SAAS,MAAM,EAA6B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEjI;AAED,eAAO,MAAM,aAAa;mBACH,OAAO,OAAO,GAAG,OAAO,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;CA4B/E,CAAA"}

package/dist/auth/mcp-api-handler.js

@@ -15,6 +15,7 @@
 import { createMziziHttpHandler } from "../http.js";
 import { createFundiCaller, createUserTokenResolver, fundiConfigured } from "../fundi-client.js";
 import { deskFor } from "../desk-context.js";
+import { allowedHostsFromEnv } from "../origin.js";
 /**
  * The free tier: no user. `fundi` says whether to LIST mzizi_fundi (so its
  * refusal can say how to sign in); it wires no caller and no desk.
@@ -22,8 +23,8 @@ import { deskFor } from "../desk-context.js";
  * Takes no `ctx` on purpose, so the anonymous front in `worker.ts` cannot pick
  * up a `ctx.props` the provider did not set.
  */
-export function serveAnonymous(request, env) {
-    return createMziziHttpHandler({ anonymous: { fundi: fundiConfigured(env) } })(request);
+export function serveAnonymous(request, env, hosts = allowedHostsFromEnv(env)) {
+    return createMziziHttpHandler({ anonymous: { fundi: fundiConfigured(env) }, allowedOrigins: hosts })(request);
 }
 export const mcpApiHandler = {
     async fetch(request, env, ctx) {
@@ -47,7 +48,7 @@ export const mcpApiHandler = {
         // `idFromName` is deterministic, so the same person reaches the same object
         // across sessions, devices and years; that is what makes the history real.
         const desk = deskFor(env.ISSUE_DESK.get(env.ISSUE_DESK.idFromName(props.userId)), props, fundi?.resolveUserToken);
-        return createMziziHttpHandler({ fundi, desk })(request);
+        return createMziziHttpHandler({ fundi, desk, allowedOrigins: allowedHostsFromEnv(env) })(request);
     },
 };
 //# sourceMappingURL=mcp-api-handler.js.map

package/dist/auth/mcp-api-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-api-handler.js","sourceRoot":"","sources":["../../src/auth/mcp-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGhG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAI5C;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAQ;IACvD,OAAO,sBAAsB,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;AACxF,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAkB;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,kEAAkE;QAClE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAEvD,yEAAyE;QACzE,4EAA4E;QAC5E,sCAAsC;QACtC,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,gCAAgC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;YAC3F,CAAC,CAAC,SAAS,CAAA;QACb,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAC3D,KAAK,EACL,KAAK,EAAE,gBAAgB,CACxB,CAAA;QAED,OAAO,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;CACF,CAAA"}
+{"version":3,"file":"mcp-api-handler.js","sourceRoot":"","sources":["../../src/auth/mcp-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGhG,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAIlD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAQ,EAAE,QAA2B,mBAAmB,CAAC,GAAG,CAAC;IAC5G,OAAO,sBAAsB,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;AAC/G,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAkB;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;QACvB,kEAAkE;QAClE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAEvD,yEAAyE;QACzE,4EAA4E;QAC5E,sCAAsC;QACtC,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,gCAAgC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;YAC3F,CAAC,CAAC,SAAS,CAAA;QACb,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAC3D,KAAK,EACL,KAAK,EAAE,gBAAgB,CACxB,CAAA;QAED,OAAO,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;IACnG,CAAC;CACF,CAAA"}

package/dist/auth/provider-options.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The OAuth provider's static options, shared by `worker.ts` and the tests that
+ * drive the real provider (`test/oauth-provider.test.ts`), so a test cannot
+ * pass against a configuration the Worker does not run.
+ *
+ * Its own module, not `worker.ts`: the Worker's entry module may export only
+ * handlers and Durable Object classes.
+ */
+export declare const PROVIDER_OPTIONS: {
+    readonly apiRoute: "/mcp";
+    readonly authorizeEndpoint: "/authorize";
+    readonly tokenEndpoint: "/token";
+    readonly clientRegistrationEndpoint: "/register";
+    readonly allowPlainPKCE: false;
+};
+//# sourceMappingURL=provider-options.d.ts.map

package/dist/auth/provider-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-options.d.ts","sourceRoot":"","sources":["../../src/auth/provider-options.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,gBAAgB;;;;;;CAWnB,CAAA"}

package/dist/auth/provider-options.js

@@ -0,0 +1,21 @@
+/**
+ * The OAuth provider's static options, shared by `worker.ts` and the tests that
+ * drive the real provider (`test/oauth-provider.test.ts`), so a test cannot
+ * pass against a configuration the Worker does not run.
+ *
+ * Its own module, not `worker.ts`: the Worker's entry module may export only
+ * handlers and Durable Object classes.
+ */
+export const PROVIDER_OPTIONS = {
+    // A prefix: it covers `/mcp` and `/mcp/signin`.
+    apiRoute: "/mcp",
+    authorizeEndpoint: "/authorize",
+    tokenEndpoint: "/token",
+    clientRegistrationEndpoint: "/register",
+    // OAuth 2.1 and the MCP authorization spec require S256; `plain` offers no
+    // protection against an intercepted code (#295). With this `false` the
+    // authorization-server metadata advertises `["S256"]` and the token endpoint
+    // refuses a `plain` challenge.
+    allowPlainPKCE: false,
+};
+//# sourceMappingURL=provider-options.js.map

package/dist/auth/provider-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-options.js","sourceRoot":"","sources":["../../src/auth/provider-options.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,gDAAgD;IAChD,QAAQ,EAAE,MAAM;IAChB,iBAAiB,EAAE,YAAY;IAC/B,aAAa,EAAE,QAAQ;IACvB,0BAA0B,EAAE,WAAW;IACvC,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,+BAA+B;IAC/B,cAAc,EAAE,KAAK;CACb,CAAA"}

package/dist/env.d.ts

@@ -19,6 +19,7 @@ export interface Env {
     FUNDI_SERVICE?: Fetcher;
     COOKIE_ENCRYPTION_KEY: string;
     ISSUE_DESK: DurableObjectNamespace<import("./issue-desk.js").IssueDesk>;
+    MZIZI_ALLOWED_ORIGINS?: string;
     ANON_RATE_LIMIT?: import("./rate-limit.js").RateLimiter;
     OAUTH_KV: KVNamespace;
     OAUTH_PROVIDER: OAuthHelpers;

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAiBlB,gBAAgB,EAAE,MAAM,CAAA;IAYxB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAO9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAM7B,UAAU,EAAE,sBAAsB,CAAC,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAA;IAMvE,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAA;IAGvD,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAEtE,MAAM,WAAW,GAAG;IAiBlB,gBAAgB,EAAE,MAAM,CAAA;IAYxB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAO9B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAUlB,aAAa,CAAC,EAAE,OAAO,CAAA;IAGvB,qBAAqB,EAAE,MAAM,CAAA;IAM7B,UAAU,EAAE,sBAAsB,CAAC,OAAO,iBAAiB,EAAE,SAAS,CAAC,CAAA;IAMvE,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAM9B,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAA;IAGvD,QAAQ,EAAE,WAAW,CAAA;IACrB,cAAc,EAAE,YAAY,CAAA;CAC7B"}