@prenta/core 8.6.1 → 8.7.0

package/dist/generated/models.d.ts

@@ -38,4 +38,7 @@ export type * from './models/DocumentCRDT.js';
 export type * from './models/DocumentComment.js';
 export type * from './models/DocumentNotification.js';
 export type * from './models/Job.js';
+export type * from './models/McpOauthGrant.js';
+export type * from './models/McpOauthRefreshReplay.js';
+export type * from './models/McpOauthTransaction.js';
 export type * from './commonInputTypes.js';

package/dist/mcp/cimd.d.ts

@@ -0,0 +1,12 @@
+import { safeFetch } from '../security/safe-fetch.js';
+export type ClientMetadata = {
+    clientId: string;
+    clientName: string;
+    redirectUris: string[];
+};
+/** HTTPS client ids only. IP literals that are private or malformed are rejected before DNS. */
+export declare function validateClientIdUrl(clientId: string): string | null;
+export declare function fetchClientMetadata(clientId: string, fetchImpl?: typeof safeFetch, now?: number): Promise<ClientMetadata | {
+    error: string;
+}>;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/mcp/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../src/mcp/cimd.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAoB,MAAM,2BAA2B,CAAA;AAEvE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB,CAAA;AAMD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWnE;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,OAAO,SAAqB,EACvC,GAAG,SAAa,GACf,OAAO,CAAC,cAAc,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA0C7C"}

package/dist/mcp/cimd.js

@@ -0,0 +1,67 @@
+import { canonicalizeHostname, isPrivateAddress } from '../security/ip-canon.js';
+import { safeFetch, SsrfBlockedError } from '../security/safe-fetch.js';
+const cache = new Map();
+const CACHE_MS = 5 * 60 * 1000;
+const MAX_BYTES = 64 * 1024;
+/** HTTPS client ids only. IP literals that are private or malformed are rejected before DNS. */
+export function validateClientIdUrl(clientId) {
+    let url;
+    try {
+        url = new URL(clientId);
+    }
+    catch {
+        return 'invalid_client';
+    }
+    if (url.protocol !== 'https:' || url.username || url.password)
+        return 'invalid_client';
+    const host = canonicalizeHostname(url.hostname);
+    if (isPrivateAddress(host))
+        return 'invalid_client';
+    return null;
+}
+export async function fetchClientMetadata(clientId, fetchImpl = safeFetch, now = Date.now()) {
+    if (validateClientIdUrl(clientId))
+        return { error: 'invalid_client' };
+    const hit = cache.get(clientId);
+    if (hit && now - hit.at < CACHE_MS)
+        return hit.meta;
+    try {
+        const res = await fetchImpl(clientId, {
+            method: 'GET',
+            redirect: 'manual',
+            followRedirects: false,
+            timeoutMs: 5000,
+            requireDnsCheck: true,
+            headers: { accept: 'application/json' },
+        });
+        if (res.status >= 300 && res.status < 400)
+            return { error: 'invalid_client' };
+        if (!res.ok)
+            return { error: 'invalid_client' };
+        const text = await res.text();
+        if (text.length > MAX_BYTES)
+            return { error: 'invalid_client' };
+        const parsed = JSON.parse(text);
+        if (parsed.client_id !== clientId)
+            return { error: 'invalid_client' };
+        if (!Array.isArray(parsed.redirect_uris) || parsed.redirect_uris.length === 0) {
+            return { error: 'invalid_client' };
+        }
+        const redirectUris = parsed.redirect_uris.filter((item) => typeof item === 'string');
+        if (redirectUris.length !== parsed.redirect_uris.length)
+            return { error: 'invalid_client' };
+        const meta = {
+            clientId,
+            clientName: typeof parsed.client_name === 'string' ? parsed.client_name.slice(0, 120) : clientId,
+            redirectUris,
+        };
+        cache.set(clientId, { at: now, meta });
+        return meta;
+    }
+    catch (err) {
+        if (err instanceof SsrfBlockedError)
+            return { error: 'invalid_client' };
+        return { error: 'invalid_client' };
+    }
+}
+//# sourceMappingURL=cimd.js.map

package/dist/mcp/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../src/mcp/cimd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAChF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAQvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgD,CAAA;AACrE,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC9B,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAA;AAE3B,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,CAAA;IACzB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,gBAAgB,CAAA;IACtF,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/C,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,YAA8B,SAAS,EACvC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,mBAAmB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACrE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,QAAQ;QAAE,OAAO,GAAG,CAAC,IAAI,CAAA;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;YACpC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;YAClB,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,IAAI;YACrB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;QAC/C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI7B,CAAA;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;QACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAC9C,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAA;QACD,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;QAC3F,MAAM,IAAI,GAAmB;YAC3B,QAAQ;YACR,UAAU,EACR,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ;YACtF,YAAY;SACb,CAAA;QACD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;QACvE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;IACpC,CAAC;AACH,CAAC"}

package/dist/mcp/gate.d.ts

@@ -0,0 +1,11 @@
+export type McpCredential = {
+    credential: string;
+    baseUrl: string;
+};
+/**
+ * Accept an OAuth access token or an `act_sk_` key on `/mcp`.
+ * OAuth tokens are exchanged for an internal assertion. The client JWT is
+ * not forwarded to the CMS API.
+ */
+export declare function authorizeMcpRequest(request: Request): Promise<McpCredential | Response>;
+//# sourceMappingURL=gate.d.ts.map

package/dist/mcp/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/mcp/gate.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAgBnE;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC,CAsD7F"}

package/dist/mcp/gate.js

@@ -0,0 +1,75 @@
+import { looksLikeApiKey } from '../security/api-key-enhanced.js';
+import { canonicalMcpResource } from './oauth-grants.js';
+import { mcpBearerStatus } from './oauth-http.js';
+import { signMcpInternalToken } from './oauth-token.js';
+import { mcpOauthRuntime, mcpSiteUrl } from './runtime.js';
+function unauthorized(site) {
+    const metadata = `${site}/.well-known/oauth-protected-resource/mcp`;
+    return Response.json({ error: 'unauthorized' }, {
+        status: 401,
+        headers: {
+            'WWW-Authenticate': `Bearer resource_metadata="${metadata}", scope="content"`,
+            'cache-control': 'no-store',
+        },
+    });
+}
+/**
+ * Accept an OAuth access token or an `act_sk_` key on `/mcp`.
+ * OAuth tokens are exchanged for an internal assertion. The client JWT is
+ * not forwarded to the CMS API.
+ */
+export async function authorizeMcpRequest(request) {
+    const url = new URL(request.url);
+    if (url.searchParams.has('api_key') ||
+        url.searchParams.has('token') ||
+        url.searchParams.has('access_token')) {
+        return Response.json({ error: 'invalid_request' }, { status: 400 });
+    }
+    const runtime = mcpOauthRuntime();
+    const site = runtime?.siteUrl ?? mcpSiteUrl();
+    if (!runtime || !site) {
+        return Response.json({ error: 'server_error' }, { status: 500 });
+    }
+    const origin = request.headers.get('origin');
+    if (origin) {
+        let presented;
+        try {
+            presented = new URL(origin).origin;
+        }
+        catch {
+            return Response.json({ error: 'forbidden' }, { status: 403 });
+        }
+        if (presented !== new URL(site).origin) {
+            return Response.json({ error: 'forbidden' }, { status: 403 });
+        }
+    }
+    const bearer = request.headers.get('authorization');
+    const token = bearer?.toLowerCase().startsWith('bearer ')
+        ? bearer.slice(bearer.indexOf(' ') + 1).trim()
+        : '';
+    const apiKey = request.headers.get('x-api-key')?.trim() ?? '';
+    const presented = token || apiKey;
+    if (!presented)
+        return unauthorized(site);
+    if (looksLikeApiKey(presented))
+        return { credential: presented, baseUrl: site };
+    const status = await mcpBearerStatus(presented, runtime);
+    if (status === 'insufficient_scope') {
+        return Response.json({ error: 'insufficient_scope' }, {
+            status: 403,
+            headers: {
+                'WWW-Authenticate': 'Bearer error="insufficient_scope", scope="content"',
+                'cache-control': 'no-store',
+            },
+        });
+    }
+    if (!status)
+        return unauthorized(site);
+    const credential = await signMcpInternalToken({
+        secret: runtime.secret,
+        userId: status.userId,
+        role: status.role,
+    });
+    return { credential, baseUrl: canonicalMcpResource(site).replace(/\/mcp$/, '') };
+}
+//# sourceMappingURL=gate.js.map

package/dist/mcp/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/mcp/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAI1D,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,QAAQ,GAAG,GAAG,IAAI,2CAA2C,CAAA;IACnE,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,kBAAkB,EAAE,6BAA6B,QAAQ,oBAAoB;YAC7E,eAAe,EAAE,UAAU;SAC5B;KACF,CACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,IACE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EACpC,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,CAAA;IAC7C,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,SAAiB,CAAA;QACrB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QACvD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC7D,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,CAAA;IACjC,IAAI,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,eAAe,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC/E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAC/B;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,kBAAkB,EAAE,oDAAoD;gBACxE,eAAe,EAAE,UAAU;aAC5B;SACF,CACF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAA;IACF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAA;AAClF,CAAC"}

package/dist/mcp/memory-grant-store.d.ts

@@ -0,0 +1,5 @@
+import type { GrantRecord, OauthGrantStore } from './oauth-grants.js';
+export declare function createMemoryGrantStore(): OauthGrantStore & {
+    rows: GrantRecord[];
+};
+//# sourceMappingURL=memory-grant-store.d.ts.map

package/dist/mcp/memory-grant-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-grant-store.d.ts","sourceRoot":"","sources":["../../src/mcp/memory-grant-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAErE,wBAAgB,sBAAsB,IAAI,eAAe,GAAG;IAAE,IAAI,EAAE,WAAW,EAAE,CAAA;CAAE,CAuClF"}

package/dist/mcp/memory-grant-store.js

@@ -0,0 +1,44 @@
+export function createMemoryGrantStore() {
+    const rows = [];
+    const replays = [];
+    return {
+        rows,
+        async insert(row) {
+            rows.push({ ...row });
+        },
+        async findByCodeHash(hash) {
+            return rows.find((row) => row.codeHash === hash) ?? null;
+        },
+        async save(row) {
+            const index = rows.findIndex((item) => item.id === row.id);
+            if (index >= 0)
+                rows[index] = { ...row };
+        },
+        async findByRefreshHash(hash) {
+            return rows.find((row) => row.refreshHash === hash && !row.revokedAt) ?? null;
+        },
+        async findReplay(hash) {
+            return replays.find((item) => item.hash === hash) ?? null;
+        },
+        async rememberReplay(hash, familyId) {
+            replays.push({ hash, familyId });
+        },
+        async revokeFamily(familyId, now) {
+            for (const row of rows) {
+                if (row.familyId === familyId)
+                    row.revokedAt = now;
+            }
+        },
+        async listForUser(userId) {
+            return rows.filter((row) => row.userId === userId);
+        },
+        async revokeById(id, userId, now) {
+            const row = rows.find((item) => item.id === id && item.userId === userId);
+            if (!row || row.revokedAt)
+                return false;
+            row.revokedAt = now;
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=memory-grant-store.js.map

package/dist/mcp/memory-grant-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-grant-store.js","sourceRoot":"","sources":["../../src/mcp/memory-grant-store.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAkB,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAyC,EAAE,CAAA;IACxD,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAI;YACvB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAA;QAC1D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;YAC1D,IAAI,KAAK,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAA;QAC1C,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,IAAI;YAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAA;QAC/E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAA;QAC3D,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;oBAAE,GAAG,CAAC,SAAS,GAAG,GAAG,CAAA;YACpD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QACpD,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;YACzE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAA;YACvC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAA;YACnB,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/mcp/oauth-grants.d.ts

@@ -0,0 +1,83 @@
+export type GrantRecord = {
+    id: string;
+    userId: string;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    scope: string;
+    codeChallenge: string;
+    codeHash: string | null;
+    codeExpiresAt: Date | null;
+    codeConsumedAt: Date | null;
+    refreshHash: string | null;
+    refreshExpiresAt: Date | null;
+    familyId: string;
+    revokedAt: Date | null;
+};
+export interface OauthGrantStore {
+    insert(row: GrantRecord): Promise<void>;
+    findByCodeHash(hash: string): Promise<GrantRecord | null>;
+    save(row: GrantRecord): Promise<void>;
+    findByRefreshHash(hash: string): Promise<GrantRecord | null>;
+    findReplay(hash: string): Promise<{
+        familyId: string;
+    } | null>;
+    rememberReplay(hash: string, familyId: string): Promise<void>;
+    revokeFamily(familyId: string, now: Date): Promise<void>;
+    listForUser(userId: string): Promise<GrantRecord[]>;
+    revokeById(id: string, userId: string, now: Date): Promise<boolean>;
+}
+export declare function s256Challenge(verifier: string): string;
+export declare function pkceMatches(verifier: string, challenge: string): boolean;
+export declare function newSecret(): string;
+export declare function canonicalMcpResource(siteUrl: string): string;
+/** Exact redirect match. Loopback HTTP ignores the port (RFC 8252). */
+export declare function redirectAllowed(requested: string, registered: string[]): boolean;
+export declare function issueAuthorizationCode(store: OauthGrantStore, input: {
+    userId: string;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    scope: string;
+    codeChallenge: string;
+    now?: Date;
+}): Promise<{
+    code: string;
+    grant: GrantRecord;
+}>;
+export type CodeExchange = {
+    ok: true;
+    grant: GrantRecord;
+    refreshToken: string;
+} | {
+    ok: false;
+    error: 'invalid_grant';
+};
+/**
+ * Single-use code exchange. A replay revokes the grant family.
+ * `plain` PKCE is not accepted: the caller must pass an S256 verifier.
+ */
+export declare function exchangeAuthorizationCode(store: OauthGrantStore, input: {
+    code: string;
+    verifier: string;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    now?: Date;
+}): Promise<CodeExchange>;
+export type RefreshExchange = {
+    ok: true;
+    grant: GrantRecord;
+    refreshToken: string;
+} | {
+    ok: false;
+    error: 'invalid_grant';
+};
+/** Rotate a refresh token. Reuse of a replaced token revokes the family. */
+export declare function rotateRefreshToken(store: OauthGrantStore, input: {
+    refreshToken: string;
+    clientId: string;
+    resource: string;
+    now?: Date;
+}): Promise<RefreshExchange>;
+//# sourceMappingURL=oauth-grants.d.ts.map

package/dist/mcp/oauth-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-grants.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-grants.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,aAAa,EAAE,IAAI,GAAG,IAAI,CAAA;IAC1B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;CACvB,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAC5D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IAC9D,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IACnD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACpE;AAMD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAMxE;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAaD,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAiBhF;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,GACA,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC,CAqB/C;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAA;AAEzC;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,GACA,OAAO,CAAC,YAAY,CAAC,CA0BvB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAA;AAEzC,4EAA4E;AAC5E,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GAC9E,OAAO,CAAC,eAAe,CAAC,CAsB1B"}

package/dist/mcp/oauth-grants.js

@@ -0,0 +1,129 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+const CODE_TTL_MS = 60_000;
+const REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+function hashSecret(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+export function s256Challenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+export function pkceMatches(verifier, challenge) {
+    const actual = s256Challenge(verifier);
+    const a = Buffer.from(actual);
+    const b = Buffer.from(challenge);
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+export function newSecret() {
+    return randomBytes(32).toString('base64url');
+}
+export function canonicalMcpResource(siteUrl) {
+    return `${siteUrl.replace(/\/+$/, '')}/mcp`;
+}
+function isLoopbackRedirect(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Exact redirect match. Loopback HTTP ignores the port (RFC 8252). */
+export function redirectAllowed(requested, registered) {
+    let url;
+    try {
+        url = new URL(requested);
+    }
+    catch {
+        return false;
+    }
+    if (isLoopbackRedirect(requested)) {
+        return registered.some((entry) => {
+            if (!isLoopbackRedirect(entry))
+                return false;
+            const reg = new URL(entry);
+            return (reg.hostname === url.hostname && reg.pathname === url.pathname && reg.search === url.search);
+        });
+    }
+    return registered.includes(requested);
+}
+export async function issueAuthorizationCode(store, input) {
+    const now = input.now ?? new Date();
+    const code = newSecret();
+    const grant = {
+        id: newSecret(),
+        userId: input.userId,
+        clientId: input.clientId,
+        redirectUri: input.redirectUri,
+        resource: input.resource,
+        scope: input.scope,
+        codeChallenge: input.codeChallenge,
+        codeHash: hashSecret(code),
+        codeExpiresAt: new Date(now.getTime() + CODE_TTL_MS),
+        codeConsumedAt: null,
+        refreshHash: null,
+        refreshExpiresAt: null,
+        familyId: newSecret(),
+        revokedAt: null,
+    };
+    await store.insert(grant);
+    return { code, grant };
+}
+/**
+ * Single-use code exchange. A replay revokes the grant family.
+ * `plain` PKCE is not accepted: the caller must pass an S256 verifier.
+ */
+export async function exchangeAuthorizationCode(store, input) {
+    const now = input.now ?? new Date();
+    const hash = hashSecret(input.code);
+    const grant = await store.findByCodeHash(hash);
+    if (!grant || grant.revokedAt)
+        return { ok: false, error: 'invalid_grant' };
+    if (grant.codeConsumedAt) {
+        await store.revokeFamily(grant.familyId, now);
+        return { ok: false, error: 'invalid_grant' };
+    }
+    if (!grant.codeExpiresAt || grant.codeExpiresAt.getTime() <= now.getTime()) {
+        return { ok: false, error: 'invalid_grant' };
+    }
+    if (grant.clientId !== input.clientId ||
+        grant.redirectUri !== input.redirectUri ||
+        grant.resource !== input.resource ||
+        !pkceMatches(input.verifier, grant.codeChallenge)) {
+        return { ok: false, error: 'invalid_grant' };
+    }
+    const refreshToken = newSecret();
+    grant.codeConsumedAt = now;
+    grant.refreshHash = hashSecret(refreshToken);
+    grant.refreshExpiresAt = new Date(now.getTime() + REFRESH_TTL_MS);
+    await store.save(grant);
+    return { ok: true, grant, refreshToken };
+}
+/** Rotate a refresh token. Reuse of a replaced token revokes the family. */
+export async function rotateRefreshToken(store, input) {
+    const now = input.now ?? new Date();
+    const hash = hashSecret(input.refreshToken);
+    const replay = await store.findReplay(hash);
+    if (replay) {
+        await store.revokeFamily(replay.familyId, now);
+        return { ok: false, error: 'invalid_grant' };
+    }
+    const grant = await store.findByRefreshHash(hash);
+    if (!grant || grant.revokedAt)
+        return { ok: false, error: 'invalid_grant' };
+    if (grant.clientId !== input.clientId || grant.resource !== input.resource) {
+        return { ok: false, error: 'invalid_grant' };
+    }
+    if (!grant.refreshExpiresAt || grant.refreshExpiresAt.getTime() <= now.getTime()) {
+        return { ok: false, error: 'invalid_grant' };
+    }
+    const next = newSecret();
+    await store.rememberReplay(hash, grant.familyId);
+    grant.refreshHash = hashSecret(next);
+    grant.refreshExpiresAt = new Date(now.getTime() + REFRESH_TTL_MS);
+    await store.save(grant);
+    return { ok: true, grant, refreshToken: next };
+}
+//# sourceMappingURL=oauth-grants.js.map

package/dist/mcp/oauth-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-grants.js","sourceRoot":"","sources":["../../src/mcp/oauth-grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA+B/C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,SAAiB;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAA;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAC3F,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,UAAoB;IACrE,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;YAC1B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAC5F,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAsB,EACtB,KAQC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAA;IACxB,MAAM,KAAK,GAAgB;QACzB,EAAE,EAAE,SAAS,EAAE;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1B,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;QACpD,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,QAAQ,EAAE,SAAS,EAAE;QACrB,SAAS,EAAE,IAAI;KAChB,CAAA;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAsB,EACtB,KAOC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC9C,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACvC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACjC,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC9C,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,EAAE,CAAA;IAChC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAA;IAC1B,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IAC5C,KAAK,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAA;IACjE,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;AAC1C,CAAC;AAMD,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAsB,EACtB,KAA+E;IAE/E,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC9C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC3E,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAA;IACxB,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IAChD,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACpC,KAAK,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAA;IACjE,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;AAChD,CAAC"}

package/dist/mcp/oauth-http.d.ts

@@ -0,0 +1,43 @@
+import { type ClientMetadata } from './cimd.js';
+import { type OauthGrantStore } from './oauth-grants.js';
+import type { OauthTransaction, TransactionStore } from './transactions.js';
+export type OauthUser = {
+    id: string;
+    role: string;
+    active: boolean;
+};
+export type McpOauthRuntime = {
+    siteUrl: string;
+    adminPath: string;
+    secret: string;
+    grants: OauthGrantStore;
+    transactions: TransactionStore;
+    loadUser: (userId: string) => Promise<OauthUser | null>;
+    fetchClient?: (clientId: string) => Promise<ClientMetadata | {
+        error: string;
+    }>;
+    now?: () => Date;
+    allowAttempt?: (key: string) => boolean;
+};
+export declare function mcpResourceMetadata(runtime: McpOauthRuntime): Response;
+export declare function mcpAuthorizationServerMetadata(runtime: McpOauthRuntime): Response;
+export declare function beginAuthorization(request: Request, runtime: McpOauthRuntime): Promise<Response>;
+export declare function readConsentTransaction(txnId: string, runtime: McpOauthRuntime): Promise<{
+    transaction: OauthTransaction;
+    redirectHost: string;
+} | null>;
+export declare function completeConsent(input: {
+    txnId: string;
+    userId: string;
+    allow: boolean;
+}, runtime: McpOauthRuntime): Promise<{
+    redirectUrl: string;
+} | {
+    error: string;
+}>;
+export declare function handleTokenRequest(request: Request, runtime: McpOauthRuntime): Promise<Response>;
+export declare function mcpBearerStatus(token: string, runtime: McpOauthRuntime): Promise<{
+    userId: string;
+    role: string;
+} | 'insufficient_scope' | null>;
+//# sourceMappingURL=oauth-http.d.ts.map

package/dist/mcp/oauth-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-http.d.ts","sourceRoot":"","sources":["../../src/mcp/oauth-http.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAK3E,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAA;AAErE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,eAAe,CAAA;IACvB,YAAY,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;IACvD,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC/E,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;IAChB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;CACxC,CAAA;AAgCD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAQtE;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAcjF;AAQD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4CnB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,WAAW,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAIzE;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,EACxD,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCtD;AAoBD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CAqDnB;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,GAAG,IAAI,CAAC,CAiBzE"}