@se-studio/contentful-cms 3.15.7 → 3.16.3

package/dist/hosted/next/routes/mcp.js

@@ -1,16 +1,17 @@
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
+import { isMultiTenantHostedMode, loadHostedDeploymentForRequest, loadHostedDeploymentFromEnv, } from '../../../config/hosted.js';
 import { MediaPipelineJobStore } from '../../../media-pipeline/job-store.js';
 import { isAllowedExtraRoot } from '../../../publish/classify.js';
 import { redisPlanStore } from '../../../publish/store.js';
 import { StagedUploadStore } from '../../../staged-upload/store.js';
-import { buildHostedConfig, handleHostedMcpRequest, isMcpUnauthorizedError, isTransientContentfulFailure, isUnusableContentfulCacheReason, loadHostedDeploymentFromEnv, oauthLogAuthFailure, oauthLogMcpHandlerError, patValidationFailureReason, RedisIndexCacheStore, RedisSessionStore, resolveContentfulTokenFromRequest, resolvePatForDeployment, runWithContentfulRequestStats, unauthorizedMcpResponse, } from '../../index.js';
+import { buildHostedConfig, handleHostedMcpRequest, isMcpUnauthorizedError, isTransientContentfulFailure, isUnusableContentfulCacheReason, oauthLogAuthFailure, oauthLogMcpHandlerError, patValidationFailureReason, RedisIndexCacheStore, RedisSessionStore, resolveContentfulTokenFromRequest, resolveEditorPackForTenant, resolvePatForDeployment, runWithContentfulRequestStats, unauthorizedMcpResponse, } from '../../index.js';
 import { corsPreflight, withCors } from '../../oauth/cors.js';
 import { createOAuthHandlerContext } from '../context.js';
 import { getHostedEditorPackPath } from '../editor-pack-path.js';
 import { createRedisClient } from '../redis.js';
 const redisClient = createRedisClient();
-const editorPackPath = getHostedEditorPackPath();
+const localEditorPackPath = getHostedEditorPackPath();
 function readExtraRootContentTypes(packPath) {
     try {
         const raw = readFileSync(path.join(packPath, 'publish.json'), 'utf8');
@@ -23,8 +24,16 @@ function readExtraRootContentTypes(packPath) {
         return [];
     }
 }
-export async function GET(request) {
-    return handleMcp(request);
+/**
+ * Streamable HTTP clients may open a long-lived GET SSE stream. This host is
+ * stateless and never writes to it, so GET held Fluid memory until the 300s
+ * timeout (#267). Refuse GET; clients fall back to POST/JSON.
+ */
+export async function GET(_request) {
+    return withCors(new Response(null, {
+        status: 405,
+        headers: { Allow: 'POST' },
+    }));
 }
 export async function POST(request) {
     return handleMcp(request);
@@ -39,12 +48,34 @@ async function handleMcp(request) {
     const response = await runWithContentfulRequestStats(() => handleMcpInner(request));
     return withCors(response);
 }
+async function resolveDeployment(request) {
+    if (isMultiTenantHostedMode()) {
+        const resolved = loadHostedDeploymentForRequest(request);
+        if (!resolved.tenant) {
+            throw new Error('Multi-tenant mode resolved no tenant.');
+        }
+        const pack = await resolveEditorPackForTenant(resolved.tenant);
+        return {
+            deployment: resolved.deployment,
+            displayName: resolved.tenant.displayName,
+            editorPackPath: pack.packPath,
+        };
+    }
+    return {
+        deployment: loadHostedDeploymentFromEnv(),
+        displayName: process.env['CMS_EDIT_DISPLAY_NAME'],
+        editorPackPath: localEditorPackPath,
+    };
+}
 async function handleMcpInner(request) {
-    const oauthCtx = createOAuthHandlerContext();
+    const oauthCtx = createOAuthHandlerContext(request);
     let user;
     let mcpSub;
+    let deployment;
+    let editorPackPath;
+    let displayName;
     try {
-        const deployment = loadHostedDeploymentFromEnv();
+        ({ deployment, editorPackPath, displayName } = await resolveDeployment(request));
         const { sub, contentfulToken } = await resolveContentfulTokenFromRequest(request, oauthCtx.store, deployment.spaceId);
         mcpSub = sub;
         try {
@@ -60,7 +91,7 @@ async function handleMcpInner(request) {
                     projectKey: deployment.projectKey,
                     message,
                 });
-                return unauthorizedMcpResponse('invalid_contentful_token');
+                return unauthorizedMcpResponse('invalid_contentful_token', request);
             }
             if (isTransientContentfulFailure(reason)) {
                 oauthLogAuthFailure('mcp', reason, {
@@ -77,15 +108,18 @@ async function handleMcpInner(request) {
     catch (err) {
         let deploymentMeta = {};
         try {
-            const deployment = loadHostedDeploymentFromEnv();
-            deploymentMeta = { spaceId: deployment.spaceId, projectKey: deployment.projectKey };
+            const resolved = await resolveDeployment(request);
+            deploymentMeta = {
+                spaceId: resolved.deployment.spaceId,
+                projectKey: resolved.deployment.projectKey,
+            };
         }
         catch {
-            // env not configured — still log auth failure without deployment context
+            // env/registry not configured — still log auth failure without deployment context
         }
         if (isMcpUnauthorizedError(err)) {
             oauthLogAuthFailure('mcp', err.reason, deploymentMeta);
-            return unauthorizedMcpResponse(err.reason);
+            return unauthorizedMcpResponse(err.reason, request);
         }
         const message = err instanceof Error ? err.message : String(err);
         oauthLogAuthFailure('mcp', patValidationFailureReason(message), {
@@ -95,7 +129,6 @@ async function handleMcpInner(request) {
         return Response.json({ error: message }, { status: 401 });
     }
     try {
-        const deployment = loadHostedDeploymentFromEnv();
         const runtimeContext = {
             config: buildHostedConfig(deployment, user.token),
             sessionStore: new RedisSessionStore(redisClient),
@@ -116,7 +149,7 @@ async function handleMcpInner(request) {
             resolveContext: async () => runtimeContext,
             getMcpInfo: () => ({
                 projectKey: deployment.projectKey,
-                displayName: process.env['CMS_EDIT_DISPLAY_NAME'],
+                displayName,
                 spaceId: deployment.spaceId,
             }),
             editorPackPath,
@@ -124,15 +157,10 @@ async function handleMcpInner(request) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        let deploymentMeta = {};
-        try {
-            const deployment = loadHostedDeploymentFromEnv();
-            deploymentMeta = { spaceId: deployment.spaceId, projectKey: deployment.projectKey };
-        }
-        catch {
-            // env not configured — still log handler failure without deployment context
-        }
-        oauthLogMcpHandlerError(message, deploymentMeta);
+        oauthLogMcpHandlerError(message, {
+            spaceId: deployment.spaceId,
+            projectKey: deployment.projectKey,
+        });
         return Response.json({ error: message }, { status: 500 });
     }
 }

package/dist/hosted/next/routes/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,EACjB,iCAAiC,EACjC,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;AACxC,MAAM,cAAc,GAAG,uBAAuB,EAAE,CAAC;AAEjD,SAAS,yBAAyB,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,qBAAqB,CAAC,MAAM,CACxC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAC/E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAgB;IACzC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAgB;IACvC,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAE7C,IAAI,IAAyD,CAAC;IAC9D,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,MAAM,iCAAiC,CACtE,OAAO,EACP,QAAQ,CAAC,KAAK,EACd,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,GAAG,GAAG,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE;oBACjC,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE;oBACjC,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,GAA8C,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;YACjD,cAAc,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;QAED,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACvD,OAAO,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mBAAmB,CAAC,KAAK,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAAE;YAC9D,GAAG,cAAc;YACjB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG;YACrB,MAAM,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;YACjD,YAAY,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC;YAChD,eAAe,EAAE,IAAI,oBAAoB,CAAC,WAAW,CAAC;YACtD,iBAAiB,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC;YACrD,qBAAqB,EAAE,IAAI,qBAAqB,CAAC,WAAW,CAAC;YAC7D,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAChD,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC;YACtC,qBAAqB,EAAE,yBAAyB,CAAC,cAAc,CAAC;YAChE,iBAAiB,EACf,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,KAAK,IAAI,EAAE;oBACT,MAAM,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;gBACzE,CAAC;SACR,CAAC;QAEF,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE;YAC3C,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc;YAC1C,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;gBACjD,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC;YACF,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,cAAc,GAA8C,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;YACjD,cAAc,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAEL,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,+BAA+B,EAC/B,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,EACjB,iCAAiC,EACjC,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;AACxC,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;AAEtD,SAAS,yBAAyB,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,qBAAqB,CAAC,MAAM,CACxC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAC/E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,QAAiB;IACzC,OAAO,QAAQ,CACb,IAAI,QAAQ,CAAC,IAAI,EAAE;QACjB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;KAC3B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAgB;IACzC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAgB;IACvC,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IAK/C,IAAI,uBAAuB,EAAE,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW;YACxC,cAAc,EAAE,IAAI,CAAC,QAAQ;SAC9B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,2BAA2B,EAAE;QACzC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACjD,cAAc,EAAE,mBAAmB;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAEpD,IAAI,IAAyD,CAAC;IAC9D,IAAI,MAA0B,CAAC;IAC/B,IAAI,UAAkC,CAAC;IACvC,IAAI,cAAsB,CAAC;IAC3B,IAAI,WAA+B,CAAC;IAEpC,IAAI,CAAC;QACH,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,MAAM,iCAAiC,CACtE,OAAO,EACP,QAAQ,CAAC,KAAK,EACd,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,GAAG,GAAG,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE;oBACjC,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,uBAAuB,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE;oBACjC,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,GAA8C,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAClD,cAAc,GAAG;gBACf,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO;gBACpC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;aAC3C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QAED,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACvD,OAAO,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mBAAmB,CAAC,KAAK,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAAE;YAC9D,GAAG,cAAc;YACjB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG;YACrB,MAAM,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;YACjD,YAAY,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC;YAChD,eAAe,EAAE,IAAI,oBAAoB,CAAC,WAAW,CAAC;YACtD,iBAAiB,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC;YACrD,qBAAqB,EAAE,IAAI,qBAAqB,CAAC,WAAW,CAAC;YAC7D,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAChD,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC;YACtC,qBAAqB,EAAE,yBAAyB,CAAC,cAAc,CAAC;YAChE,iBAAiB,EACf,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,KAAK,IAAI,EAAE;oBACT,MAAM,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;gBACzE,CAAC;SACR,CAAC;QAEF,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE;YAC3C,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc;YAC1C,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,WAAW;gBACX,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC;YACF,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,uBAAuB,CAAC,OAAO,EAAE;YAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/hosted/next/routes/oauth-authorization-server.d.ts

@@ -1,3 +1,3 @@
-export declare function GET(): Promise<Response>;
+export declare function GET(request: Request): Promise<Response>;
 export declare function OPTIONS(): Promise<Response>;
 //# sourceMappingURL=oauth-authorization-server.d.ts.map

package/dist/hosted/next/routes/oauth-authorization-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-authorization-server.d.ts","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-authorization-server.ts"],"names":[],"mappings":"AAGA,wBAAsB,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAE7C;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEjD"}
+{"version":3,"file":"oauth-authorization-server.d.ts","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-authorization-server.ts"],"names":[],"mappings":"AAGA,wBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE7D;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEjD"}

package/dist/hosted/next/routes/oauth-authorization-server.js

@@ -1,7 +1,7 @@
 import { handleOAuthAuthorizationServerMetadataGet } from '../../index.js';
 import { corsPreflight, withCors } from '../../oauth/cors.js';
-export async function GET() {
-    return withCors(handleOAuthAuthorizationServerMetadataGet());
+export async function GET(request) {
+    return withCors(handleOAuthAuthorizationServerMetadataGet(request));
 }
 export async function OPTIONS() {
     return corsPreflight();

package/dist/hosted/next/routes/oauth-authorization-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-authorization-server.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-authorization-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,OAAO,QAAQ,CAAC,yCAAyC,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"oauth-authorization-server.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-authorization-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,OAAO,QAAQ,CAAC,yCAAyC,CAAC,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}

package/dist/hosted/next/routes/oauth-authorize.js

@@ -1,6 +1,6 @@
 import { handleOAuthAuthorizeGet } from '../../index.js';
 import { createOAuthHandlerContext } from '../context.js';
 export async function GET(request) {
-    return handleOAuthAuthorizeGet(request, createOAuthHandlerContext());
+    return handleOAuthAuthorizeGet(request, createOAuthHandlerContext(request));
 }
 //# sourceMappingURL=oauth-authorize.js.map

package/dist/hosted/next/routes/oauth-authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-authorize.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,OAAO,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"oauth-authorize.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,OAAO,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/hosted/next/routes/oauth-protected-resource-path.d.ts

@@ -5,7 +5,7 @@ type PathParams = {
  * RFC 9728 path-aware metadata:
  * `/.well-known/oauth-protected-resource/api/mcp`
  */
-export declare function GET(_request: Request, context: {
+export declare function GET(request: Request, context: {
     params: Promise<PathParams>;
 }): Promise<Response>;
 export declare function OPTIONS(): Promise<Response>;

package/dist/hosted/next/routes/oauth-protected-resource-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-protected-resource-path.d.ts","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-protected-resource-path.ts"],"names":[],"mappings":"AAMA,KAAK,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErC;;;GAGG;AACH,wBAAsB,GAAG,CACvB,QAAQ,EAAE,OAAO,EACjB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,GACvC,OAAO,CAAC,QAAQ,CAAC,CAMnB;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEjD"}
+{"version":3,"file":"oauth-protected-resource-path.d.ts","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-protected-resource-path.ts"],"names":[],"mappings":"AAMA,KAAK,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErC;;;GAGG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,GACvC,OAAO,CAAC,QAAQ,CAAC,CAMnB;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEjD"}

package/dist/hosted/next/routes/oauth-protected-resource-path.js

@@ -4,12 +4,12 @@ import { corsPreflight, withCors } from '../../oauth/cors.js';
  * RFC 9728 path-aware metadata:
  * `/.well-known/oauth-protected-resource/api/mcp`
  */
-export async function GET(_request, context) {
+export async function GET(request, context) {
     const { path } = await context.params;
     if (!isMcpProtectedResourcePath(path)) {
         return withCors(new Response('Not found', { status: 404 }));
     }
-    return withCors(handleOAuthProtectedResourceMetadataGet());
+    return withCors(handleOAuthProtectedResourceMetadataGet(request));
 }
 export async function OPTIONS() {
     return corsPreflight();

package/dist/hosted/next/routes/oauth-protected-resource-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-protected-resource-path.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-protected-resource-path.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uCAAuC,EACvC,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAI9D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,QAAiB,EACjB,OAAwC;IAExC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"oauth-protected-resource-path.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-protected-resource-path.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uCAAuC,EACvC,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAI9D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,OAAgB,EAChB,OAAwC;IAExC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC,uCAAuC,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}

package/dist/hosted/next/routes/oauth-protected-resource.d.ts

@@ -1,3 +1,3 @@
-export declare function GET(): Promise<Response>;
+export declare function GET(request: Request): Promise<Response>;
 export declare function OPTIONS(): Promise<Response>;
 //# sourceMappingURL=oauth-protected-resource.d.ts.map

package/dist/hosted/next/routes/oauth-protected-resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-protected-resource.d.ts","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-protected-resource.ts"],"names":[],"mappings":"AAGA,wBAAsB,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAE7C;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEjD"}
+{"version":3,"file":"oauth-protected-resource.d.ts","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-protected-resource.ts"],"names":[],"mappings":"AAGA,wBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE7D;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEjD"}

package/dist/hosted/next/routes/oauth-protected-resource.js

@@ -1,7 +1,7 @@
 import { handleOAuthProtectedResourceMetadataGet } from '../../index.js';
 import { corsPreflight, withCors } from '../../oauth/cors.js';
-export async function GET() {
-    return withCors(handleOAuthProtectedResourceMetadataGet());
+export async function GET(request) {
+    return withCors(handleOAuthProtectedResourceMetadataGet(request));
 }
 export async function OPTIONS() {
     return corsPreflight();

package/dist/hosted/next/routes/oauth-protected-resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-protected-resource.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-protected-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,OAAO,QAAQ,CAAC,uCAAuC,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"oauth-protected-resource.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-protected-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,OAAO,QAAQ,CAAC,uCAAuC,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}

package/dist/hosted/next/routes/oauth-register.js

@@ -2,7 +2,7 @@ import { handleOAuthRegisterPost } from '../../index.js';
 import { corsPreflight, withCors } from '../../oauth/cors.js';
 import { createOAuthHandlerContext } from '../context.js';
 export async function POST(request) {
-    return withCors(await handleOAuthRegisterPost(request, createOAuthHandlerContext()));
+    return withCors(await handleOAuthRegisterPost(request, createOAuthHandlerContext(request)));
 }
 export async function OPTIONS() {
     return corsPreflight();

package/dist/hosted/next/routes/oauth-register.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-register.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAgB;IACzC,OAAO,QAAQ,CAAC,MAAM,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"oauth-register.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAgB;IACzC,OAAO,QAAQ,CAAC,MAAM,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}

package/dist/hosted/next/routes/oauth-token.js

@@ -2,7 +2,7 @@ import { handleOAuthTokenPost } from '../../index.js';
 import { corsPreflight, withCors } from '../../oauth/cors.js';
 import { createOAuthHandlerContext } from '../context.js';
 export async function POST(request) {
-    return withCors(await handleOAuthTokenPost(request, createOAuthHandlerContext()));
+    return withCors(await handleOAuthTokenPost(request, createOAuthHandlerContext(request)));
 }
 export async function OPTIONS() {
     return corsPreflight();

package/dist/hosted/next/routes/oauth-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-token.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAgB;IACzC,OAAO,QAAQ,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"oauth-token.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/oauth-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAgB;IACzC,OAAO,QAAQ,CAAC,MAAM,oBAAoB,CAAC,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC"}

package/dist/hosted/oauth/auth.d.ts

@@ -5,7 +5,7 @@ export declare class McpUnauthorizedError extends Error {
     constructor(reason: McpAuthFailureReason);
 }
 export declare function isMcpUnauthorizedError(error: unknown): error is McpUnauthorizedError;
-export declare function unauthorizedMcpResponse(reason?: McpAuthFailureReason): Response;
+export declare function unauthorizedMcpResponse(reason?: McpAuthFailureReason, request?: Request): Response;
 export declare function resolveContentfulTokenFromRequest(request: Request, store: OAuthStore, 
 /** Host Contentful space — same isolation as session keys (deployment.spaceId). */
 spaceId?: string): Promise<{

package/dist/hosted/oauth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,iBAAiB,GACjB,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAEtC,YAAY,MAAM,EAAE,oBAAoB,EAIvC;CACF;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF;AAQD,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,oBAAuC,GAAG,QAAQ,CAajG;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU;AACjB,mFAAmF;AACnF,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBnD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,iBAAiB,GACjB,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAEtC,YAAY,MAAM,EAAE,oBAAoB,EAIvC;CACF;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF;AAQD,wBAAgB,uBAAuB,CACrC,MAAM,GAAE,oBAAuC,EAC/C,OAAO,CAAC,EAAE,OAAO,GAChB,QAAQ,CAaV;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU;AACjB,mFAAmF;AACnF,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBnD"}

package/dist/hosted/oauth/auth.js

@@ -17,8 +17,8 @@ const INVALID_TOKEN_DESCRIPTIONS = {
     missing_contentful_token: 'Contentful session expired. Reconnect and sign in with Contentful.',
     invalid_contentful_token: 'Contentful session expired. Reconnect and sign in with Contentful.',
 };
-export function unauthorizedMcpResponse(reason = 'missing_bearer') {
-    const metadataUrl = getProtectedResourceMetadataUrl();
+export function unauthorizedMcpResponse(reason = 'missing_bearer', request) {
+    const metadataUrl = getProtectedResourceMetadataUrl(request);
     const description = INVALID_TOKEN_DESCRIPTIONS[reason];
     const www = description
         ? `Bearer error="invalid_token", error_description="${description}", resource_metadata="${metadataUrl}"`
@@ -40,7 +40,7 @@ spaceId) {
     }
     let sub;
     try {
-        ({ sub } = await verifyMcpAccessToken(bearer, getMcpResourceUrl()));
+        ({ sub } = await verifyMcpAccessToken(bearer, getMcpResourceUrl(request)));
     }
     catch {
         throw new McpUnauthorizedError('invalid_mcp_jwt');

package/dist/hosted/oauth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAShD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAuB;IAEtC,YAAY,MAA4B;QACtC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,YAAY,oBAAoB,CAAC;AAC/C,CAAC;AAED,MAAM,0BAA0B,GAAkD;IAChF,eAAe,EAAE,yCAAyC;IAC1D,wBAAwB,EAAE,oEAAoE;IAC9F,wBAAwB,EAAE,oEAAoE;CAC/F,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,MAAM,GAAyB,gBAAgB;IACrF,MAAM,WAAW,GAAG,+BAA+B,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,oDAAoD,WAAW,yBAAyB,WAAW,GAAG;QACxG,CAAC,CAAC,6BAA6B,WAAW,GAAG,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;QACrE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,KAAiB;AACjB,mFAAmF;AACnF,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAShD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAuB;IAEtC,YAAY,MAA4B;QACtC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,YAAY,oBAAoB,CAAC;AAC/C,CAAC;AAED,MAAM,0BAA0B,GAAkD;IAChF,eAAe,EAAE,yCAAyC;IAC1D,wBAAwB,EAAE,oEAAoE;IAC9F,wBAAwB,EAAE,oEAAoE;CAC/F,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACrC,MAAM,GAAyB,gBAAgB,EAC/C,OAAiB;IAEjB,MAAM,WAAW,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,oDAAoD,WAAW,yBAAyB,WAAW,GAAG;QACxG,CAAC,CAAC,6BAA6B,WAAW,GAAG,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;QACrE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,KAAiB;AACjB,mFAAmF;AACnF,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC"}

package/dist/hosted/oauth/config.d.ts

@@ -1,9 +1,19 @@
+/**
+ * Public origin from `CMS_EDIT_PUBLIC_ORIGIN` (single-tenant / env fallback).
+ * Prefer {@link resolvePublicOrigin} when a Request is available.
+ */
 export declare function getPublicOrigin(): string;
-export declare function getMcpResourceUrl(): string;
+/**
+ * Per-request public origin for OAuth, MCP resource URL, and staged upload.
+ * Multi-tenant: registry `publicOrigin` for the request Host (or override).
+ * Single-tenant: `CMS_EDIT_PUBLIC_ORIGIN`.
+ */
+export declare function resolvePublicOrigin(request?: Request): string;
+export declare function getMcpResourceUrl(request?: Request): string;
 /** RFC 9728 path suffix for the MCP resource (`/.well-known/oauth-protected-resource/api/mcp`). */
 export declare function isMcpProtectedResourcePath(segments: readonly string[]): boolean;
 export declare function getContentfulOAuthClientId(): string;
-export declare function getContentfulOAuthRedirectUri(): string;
-export declare function getContentfulAuthorizeUrl(authRequestId: string): string;
-export declare function getProtectedResourceMetadataUrl(): string;
+export declare function getContentfulOAuthRedirectUri(request?: Request): string;
+export declare function getContentfulAuthorizeUrl(authRequestId: string, requestOrOrigin?: Request | string): string;
+export declare function getProtectedResourceMetadataUrl(request?: Request): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/hosted/oauth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAQA,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,mGAAmG;AACnG,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE/E;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAEtD;AAED,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CASvE;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAExD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAuB7D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAE3D;AAED,mGAAmG;AACnG,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE/E;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED,wBAAgB,6BAA6B,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAEvE;AAED,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,eAAe,CAAC,EAAE,OAAO,GAAG,MAAM,GACjC,MAAM,CAaR;AAED,wBAAgB,+BAA+B,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAEzE"}

package/dist/hosted/oauth/config.js

@@ -1,3 +1,4 @@
+import { isMultiTenantHostedMode, loadTenantRegistryFromEnv, resolveRequestHostname, } from '../tenant-registry.js';
 function requireEnv(name) {
     const value = process.env[name]?.trim();
     if (!value) {
@@ -5,11 +6,43 @@ function requireEnv(name) {
     }
     return value;
 }
+/**
+ * Public origin from `CMS_EDIT_PUBLIC_ORIGIN` (single-tenant / env fallback).
+ * Prefer {@link resolvePublicOrigin} when a Request is available.
+ */
 export function getPublicOrigin() {
     return requireEnv('CMS_EDIT_PUBLIC_ORIGIN').replace(/\/$/, '');
 }
-export function getMcpResourceUrl() {
-    return `${getPublicOrigin()}/api/mcp`;
+/**
+ * Per-request public origin for OAuth, MCP resource URL, and staged upload.
+ * Multi-tenant: registry `publicOrigin` for the request Host (or override).
+ * Single-tenant: `CMS_EDIT_PUBLIC_ORIGIN`.
+ */
+export function resolvePublicOrigin(request) {
+    if (!request || !isMultiTenantHostedMode()) {
+        return getPublicOrigin();
+    }
+    const registry = loadTenantRegistryFromEnv();
+    const hostname = resolveRequestHostname(request);
+    if (registry && hostname) {
+        const tenant = registry.tenants.find((t) => t.hostname === hostname);
+        if (tenant) {
+            return tenant.publicOrigin;
+        }
+    }
+    try {
+        const url = new URL(request.url);
+        if (hostname) {
+            return `${url.protocol}//${hostname}`.replace(/\/$/, '');
+        }
+        return url.origin.replace(/\/$/, '');
+    }
+    catch {
+        return getPublicOrigin();
+    }
+}
+export function getMcpResourceUrl(request) {
+    return `${resolvePublicOrigin(request)}/api/mcp`;
 }
 /** RFC 9728 path suffix for the MCP resource (`/.well-known/oauth-protected-resource/api/mcp`). */
 export function isMcpProtectedResourcePath(segments) {
@@ -18,20 +51,23 @@ export function isMcpProtectedResourcePath(segments) {
 export function getContentfulOAuthClientId() {
     return requireEnv('CONTENTFUL_OAUTH_CLIENT_ID');
 }
-export function getContentfulOAuthRedirectUri() {
-    return `${getPublicOrigin()}/oauth/contentful-callback`;
+export function getContentfulOAuthRedirectUri(request) {
+    return `${resolvePublicOrigin(request)}/oauth/contentful-callback`;
 }
-export function getContentfulAuthorizeUrl(authRequestId) {
+export function getContentfulAuthorizeUrl(authRequestId, requestOrOrigin) {
+    const redirectUri = typeof requestOrOrigin === 'string'
+        ? `${requestOrOrigin.replace(/\/$/, '')}/oauth/contentful-callback`
+        : getContentfulOAuthRedirectUri(requestOrOrigin);
     const params = new URLSearchParams({
         response_type: 'token',
         client_id: getContentfulOAuthClientId(),
-        redirect_uri: getContentfulOAuthRedirectUri(),
+        redirect_uri: redirectUri,
         scope: 'content_management_manage',
         state: authRequestId,
     });
     return `https://be.contentful.com/oauth/authorize?${params.toString()}`;
 }
-export function getProtectedResourceMetadataUrl() {
-    return `${getPublicOrigin()}/.well-known/oauth-protected-resource`;
+export function getProtectedResourceMetadataUrl(request) {
+    return `${resolvePublicOrigin(request)}/.well-known/oauth-protected-resource`;
 }
 //# sourceMappingURL=config.js.map

package/dist/hosted/oauth/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAAA,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,eAAe,EAAE,UAAU,CAAC;AACxC,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,0BAA0B,CAAC,QAA2B;IACpE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,GAAG,eAAe,EAAE,4BAA4B,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,aAAqB;IAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,0BAA0B,EAAE;QACvC,YAAY,EAAE,6BAA6B,EAAE;QAC7C,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IACH,OAAO,6CAA6C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO,GAAG,eAAe,EAAE,uCAAuC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAiB;IACnD,IAAI,CAAC,OAAO,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC3C,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAiB;IACjD,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;AACnD,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,0BAA0B,CAAC,QAA2B;IACpE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAiB;IAC7D,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,4BAA4B,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,aAAqB,EACrB,eAAkC;IAElC,MAAM,WAAW,GACf,OAAO,eAAe,KAAK,QAAQ;QACjC,CAAC,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B;QACnE,CAAC,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,0BAA0B,EAAE;QACvC,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IACH,OAAO,6CAA6C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAiB;IAC/D,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,uCAAuC,CAAC;AAChF,CAAC"}

package/dist/hosted/oauth/handlers.d.ts

@@ -3,15 +3,17 @@ import { type OAuthStore } from './store.js';
 export interface OAuthHandlerContext {
     store: OAuthStore;
     deployment: HostedDeploymentConfig;
+    /** Request-scoped public origin (Host / registry in multi-tenant mode). */
+    publicOrigin: string;
     displayName?: string;
 }
 export declare function handleOAuthAuthorizeGet(request: Request, ctx: OAuthHandlerContext): Promise<Response>;
 export declare function handleOAuthRegisterPost(request: Request, ctx: OAuthHandlerContext): Promise<Response>;
 export declare function handleOAuthTokenPost(request: Request, ctx: OAuthHandlerContext): Promise<Response>;
 export declare function handleLinkContentfulPost(request: Request, ctx: OAuthHandlerContext): Promise<Response>;
-export declare function handleOAuthAuthorizationServerMetadataGet(): Response;
-export declare function handleOAuthProtectedResourceMetadataGet(): Response;
-export declare function handleOAuthHealthCheck(): Promise<{
+export declare function handleOAuthAuthorizationServerMetadataGet(request?: Request): Response;
+export declare function handleOAuthProtectedResourceMetadataGet(request?: Request): Response;
+export declare function handleOAuthHealthCheck(request?: Request): Promise<{
     ok: boolean;
     detail: string;
 }>;

package/dist/hosted/oauth/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAmB/F,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAGpB,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAmDD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA0EnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4BnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAgGnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAiDnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAcpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAQlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAmB/F,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAGpB,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAmDD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA0EnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4BnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAgGnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAiDnB;AAED,wBAAgB,yCAAyC,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAcrF;AAED,wBAAgB,uCAAuC,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAQnF;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB1C"}

package/dist/hosted/oauth/handlers.js

@@ -2,7 +2,7 @@ import { validatePatForDeployment } from '../../config/hosted.js';
 import { flushTelemetry, recordOAuthTelemetryFailure, recordOAuthTelemetrySuccess, } from '../../telemetry/index.js';
 import { CIMD_CLIENT_TTL_SECONDS, fetchClientIdMetadata, isCimdClientId, metadataAllowsRedirect, } from './cimd.js';
 import { completeAuthorizationCodeGrant, issueAuthorizationRedirect } from './complete.js';
-import { getContentfulAuthorizeUrl, getMcpResourceUrl, getPublicOrigin } from './config.js';
+import { getContentfulAuthorizeUrl, getPublicOrigin, resolvePublicOrigin } from './config.js';
 import { oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason } from './log.js';
 import { noteOauthRedirect } from './redirect-hosts.js';
 import { normalizeLoopbackRedirectUri, redirectUriMatchesRegistered } from './redirect-uri.js';
@@ -102,7 +102,7 @@ export async function handleOAuthAuthorizeGet(request, ctx) {
         resource,
         scope: granted.scope,
     });
-    const contentfulAuthorizeUrl = getContentfulAuthorizeUrl(authRequestId);
+    const contentfulAuthorizeUrl = getContentfulAuthorizeUrl(authRequestId, ctx.publicOrigin);
     return Response.redirect(contentfulAuthorizeUrl, 302);
 }
 export async function handleOAuthRegisterPost(request, ctx) {
@@ -248,7 +248,7 @@ export async function handleLinkContentfulPost(request, ctx) {
             spaceId: ctx.deployment.spaceId,
             projectKey: ctx.deployment.projectKey,
         });
-        const origin = getPublicOrigin();
+        const origin = ctx.publicOrigin;
         const resumeUrl = new URL(`${origin}/oauth/authorize`);
         resumeUrl.searchParams.set('resume', authRequestId);
         resumeUrl.searchParams.set('sub', user.userId);
@@ -267,8 +267,8 @@ export async function handleLinkContentfulPost(request, ctx) {
         return Response.json({ error: message }, { status: 401 });
     }
 }
-export function handleOAuthAuthorizationServerMetadataGet() {
-    const origin = getPublicOrigin();
+export function handleOAuthAuthorizationServerMetadataGet(request) {
+    const origin = resolvePublicOrigin(request);
     return Response.json({
         issuer: origin,
         authorization_endpoint: `${origin}/oauth/authorize`,
@@ -282,18 +282,23 @@ export function handleOAuthAuthorizationServerMetadataGet() {
         client_id_metadata_document_supported: true,
     });
 }
-export function handleOAuthProtectedResourceMetadataGet() {
-    const origin = getPublicOrigin();
+export function handleOAuthProtectedResourceMetadataGet(request) {
+    const origin = resolvePublicOrigin(request);
     return Response.json({
-        resource: getMcpResourceUrl(),
+        resource: `${origin}/api/mcp`,
         authorization_servers: [origin],
         scopes_supported: [...CMS_EDIT_OAUTH_SCOPES],
         bearer_methods_supported: ['header'],
     });
 }
-export async function handleOAuthHealthCheck() {
+export async function handleOAuthHealthCheck(request) {
     try {
-        getPublicOrigin();
+        if (request) {
+            resolvePublicOrigin(request);
+        }
+        else {
+            getPublicOrigin();
+        }
         if (!process.env['MCP_OAUTH_JWT_SECRET']?.trim()) {
             return { ok: false, detail: 'Missing MCP_OAUTH_JWT_SECRET' };
         }